@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/init/initializer.js

@@ -1,385 +0,0 @@
-/**
- * HubInitializer (S-48 / S5a; hub.md §5). Validates a plan, binds the local owner's confirmation to that exact plan,
- * then commits in durable stages under an operation receipt:
- *
- *   started → identity (S1 keys) → web-tls → secret → config (hub.* with enabled: false) → manifest → enabled
- *
- * `hub.enabled: true` is the last write. An interrupted commit leaves the Hub off and a visible repair state; it can
- * be resumed only with the same plan (the saved answers) and never overwrites another Hub identity, never repoints
- * credentials, never installs a service (the wizard asks for that separately, afterwards).
- */
-import { createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
-import { isIP } from "node:net";
-import { existsSync, lstatSync, mkdirSync, readFileSync, statSync } from "node:fs";
-import { dirname } from "node:path";
-import yaml from "js-yaml";
-import { atomicWriteFileSync } from "../../atomic-write.js";
-import { applyFleetYamlPatches } from "../../fleet-yaml-patch.js";
-import { HubDirectoryConfigError, resolveDirectoryConfig } from "../directory/index.js";
-import { isCanonicalObjectId } from "../directory/profiles.js";
-import { checkBrowserTls } from "./browser-tls.js";
-import { existingFleetEvidence } from "./existing-fleet.js";
-import { BIND_PASSWORD_REF, ENABLE_PATCH, WEB_TLS_CONFIG, hubConfigPatches, hubPaths } from "./layout.js";
-import { hubPlanDigest } from "./plan-digest.js";
-import { HubInitError, } from "./types.js";
-import { hubInstallationInventory } from "./inventory.js";
-export const STAGES = ["started", "identity", "web-tls", "secret", "config", "manifest", "enabled"];
-const CONFIRMATION_TTL_MS = 10 * 60_000;
-const MAX_PEM_BYTES = 1024 * 1024;
-const NAME = /^[^\u0000-\u001f\u007f]{1,64}$/;
-const TLS_TEXT = {
-    "cert-unreadable": "the certificate file is not a PEM certificate",
-    "key-unreadable": "the key file is not an unencrypted PEM private key",
-    "key-mismatch": "the private key does not belong to the certificate",
-    "host-not-covered": "the certificate does not name the web address's host",
-    "not-yet-valid": "the certificate is not valid yet",
-    expired: "the certificate has expired",
-    "ca-certificate": "the first certificate is a CA certificate, not the server's",
-};
-function canonical(value) {
-    if (Array.isArray(value))
-        return `[${value.map(canonical).join(",")}]`;
-    if (value && typeof value === "object") {
-        const entries = Object.entries(value).filter(([, v]) => v !== undefined);
-        entries.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-}
-const sha256 = (data) => createHash("sha256").update(data).digest("hex");
-function readPem(path, label, problems) {
-    try {
-        const st = statSync(path);
-        if (!st.isFile()) {
-            problems.push(`${label}: not a file`);
-            return undefined;
-        }
-        if (st.size > MAX_PEM_BYTES) {
-            problems.push(`${label}: larger than 1 MB`);
-            return undefined;
-        }
-        return readFileSync(path, "utf8");
-    }
-    catch {
-        problems.push(`${label}: cannot be read`);
-        return undefined;
-    }
-}
-export function originProblems(label, text) {
-    let url;
-    try {
-        url = new URL(text);
-    }
-    catch {
-        return [`${label}: not a URL`];
-    }
-    const problems = [];
-    if (url.protocol !== "https:")
-        problems.push(`${label}: must be https:// (there is no plaintext sign-in)`);
-    if (url.username || url.password)
-        problems.push(`${label}: must not carry credentials`);
-    if ((url.pathname && url.pathname !== "/") || url.search || url.hash)
-        problems.push(`${label}: must be https://host[:port] only`);
-    if (!url.hostname)
-        problems.push(`${label}: has no host`);
-    if (problems.length === 0 && url.origin !== text.replace(/\/$/, ""))
-        problems.push(`${label}: write it as ${url.origin}`);
-    return problems;
-}
-const HOSTNAME = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
-/** A listener names one interface: an IP address or host name, never a wildcard (no implicit all-interface exposure). */
-export function listenProblems(label, listen) {
-    if (!listen || typeof listen !== "object")
-        return [`${label}: required`];
-    const problems = [];
-    const host = typeof listen.host === "string" ? listen.host : "";
-    if (host === "0.0.0.0" || host === "::" || host === "*" || host === "") {
-        problems.push(`${label}: name one interface address (a wildcard would listen on every network)`);
-    }
-    else if (!isIP(host) && !HOSTNAME.test(host)) {
-        problems.push(`${label}: "${host}" is not an IP address or host name`);
-    }
-    if (!Number.isInteger(listen.port) || listen.port < 1 || listen.port > 65535)
-        problems.push(`${label}: port must be 1–65535`);
-    return problems;
-}
-/** Private directory: created 0700, never a symlink, owned by `uid`. */
-function ensurePrivateDir(path, uid) {
-    let st;
-    try {
-        st = lstatSync(path);
-    }
-    catch {
-        mkdirSync(path, { recursive: true, mode: 0o700 });
-        st = lstatSync(path);
-    }
-    if (st.isSymbolicLink() || !st.isDirectory())
-        throw new HubInitError(`${path} is not a private directory (a symlink or not a directory)`);
-    if (uid !== undefined && st.uid !== uid)
-        throw new HubInitError(`${path} is owned by another user`);
-    if ((st.mode & 0o077) !== 0)
-        throw new HubInitError(`${path} is readable by other users (mode ${(st.mode & 0o777).toString(8)})`);
-}
-function writePrivate(path, content, uid) {
-    ensurePrivateDir(dirname(path), uid);
-    atomicWriteFileSync(path, content, { mode: 0o600 });
-    const mode = statSync(path).mode & 0o777;
-    if ((mode & 0o077) !== 0)
-        throw new HubInitError(`${path} could not be made private (mode ${mode.toString(8)})`);
-}
-export function createHubInitializer(deps) {
-    const paths = hubPaths(deps.home);
-    const now = deps.now ?? Date.now;
-    const uid = deps.uid ?? (typeof process.getuid === "function" ? process.getuid() : undefined);
-    const pending = new Map();
-    const readReceipt = () => {
-        if (!existsSync(paths.operation))
-            return undefined;
-        try {
-            const parsed = JSON.parse(readFileSync(paths.operation, "utf8"));
-            if (parsed?.version !== 1 || typeof parsed.planDigest !== "string" || !Array.isArray(parsed.done))
-                throw new Error("shape");
-            return parsed;
-        }
-        catch {
-            throw new HubInitError(`the initialization receipt ${paths.operation} is unreadable; inspect ${paths.hub} before trying again`);
-        }
-    };
-    const writeReceipt = (receipt) => writePrivate(paths.operation, `${JSON.stringify(receipt, null, 2)}\n`, uid);
-    const hubConfigured = () => {
-        if (!existsSync(paths.fleetYaml))
-            return false;
-        try {
-            return /^hub:\s*$/m.test(readFileSync(paths.fleetYaml, "utf8")) && /^\s+hubId:/m.test(readFileSync(paths.fleetYaml, "utf8"));
-        }
-        catch {
-            return false;
-        }
-    };
-    const inspect = async () => {
-        const fleetEvidence = existingFleetEvidence(deps.home, deps.probe);
-        const receipt = readReceipt();
-        // An unfinished receipt means incomplete, even when its manifest is already written (enabled comes after it).
-        const complete = receipt ? receipt.done.includes("enabled") : existsSync(paths.manifest) || hubConfigured();
-        const keysPresent = existsSync(paths.keys) || (await deps.identity.read(deps.home).catch(() => undefined)) !== undefined;
-        const incomplete = receipt && !complete ? { startedAt: receipt.startedAt, stage: receipt.done[receipt.done.length - 1] ?? "started", plan: receipt.plan } : undefined;
-        return {
-            existingFleet: fleetEvidence.length > 0,
-            existingHub: complete || (!receipt && keysPresent),
-            fleetEvidence,
-            ...(incomplete ? { incomplete } : {}),
-        };
-    };
-    /** All problems with the plan; reads the certificate files. */
-    const problemsOf = async (plan, inspection) => {
-        const problems = [];
-        if (!deps.identity.available) {
-            problems.push("Hub key generation is not available in this build yet: it ships with the Hub transport. Nothing was changed.");
-        }
-        if (inspection.existingHub)
-            problems.push(`a Hub is already initialized under ${deps.home}; initialization never replaces a Hub identity`);
-        if (typeof plan.name !== "string" || !NAME.test(plan.name.trim()) || plan.name !== plan.name.trim())
-            problems.push("name: 1–64 characters, no control characters, no leading or trailing spaces");
-        problems.push(...originProblems("web address", plan.webOrigin), ...originProblems("member address", plan.memberOrigin));
-        problems.push(...listenProblems("member listener", plan.memberListen), ...listenProblems("web listener", plan.webListen));
-        if (plan.memberListen && plan.webListen && plan.memberListen.host === plan.webListen.host && plan.memberListen.port === plan.webListen.port) {
-            problems.push("the member listener and the web listener must use different addresses");
-        }
-        if (plan.webOrigin === plan.memberOrigin)
-            problems.push("the web address and the member address must differ (browsers and members use separate origins)");
-        try {
-            resolveDirectoryConfig(plan.directory);
-        }
-        catch (err) {
-            problems.push(err instanceof HubDirectoryConfigError ? err.message : "directory: invalid settings");
-        }
-        if (plan.bindPasswordRef !== BIND_PASSWORD_REF)
-            problems.push(`bindPasswordRef must be ${BIND_PASSWORD_REF}`);
-        const admin = plan.administrator;
-        if (!admin || admin.realm !== plan.directory?.realm || !isCanonicalObjectId(admin.objectId ?? "")) {
-            problems.push("administrator: must be the designated directory identity (same realm, immutable object id)");
-        }
-        for (const [key, value] of Object.entries(plan.retention ?? {})) {
-            if (!Number.isInteger(value) || value < 1 || value > 3650)
-                problems.push(`retention.${key}: a whole number of days from 1 to 3650`);
-        }
-        if (!plan.retention || !("contentDays" in plan.retention) || !("eventDays" in plan.retention))
-            problems.push("retention: both contentDays and eventDays are required (there is no default)");
-        if (plan.coexistence === "dedicated" && inspection.existingFleet) {
-            problems.push(`this account already runs a fleet (${inspection.fleetEvidence.join(", ")}): use a dedicated account, or confirm the same-account pilot`);
-        }
-        else if (plan.coexistence === "same-user-pilot" && !inspection.existingFleet) {
-            problems.push('coexistence "same-user-pilot" is only for an account that already runs a fleet');
-        }
-        else if (plan.coexistence !== "dedicated" && plan.coexistence !== "same-user-pilot") {
-            problems.push('coexistence must be "dedicated" or "same-user-pilot"');
-        }
-        let digestExtra;
-        let pems;
-        const certPem = readPem(plan.webTls?.certFile ?? "", "browser certificate", problems);
-        const keyPem = readPem(plan.webTls?.keyFile ?? "", "browser private key", problems);
-        if (certPem !== undefined && keyPem !== undefined && originProblems("web address", plan.webOrigin).length === 0) {
-            const check = checkBrowserTls(certPem, keyPem, plan.webOrigin, now());
-            for (const p of check.problems)
-                problems.push(`browser certificate: ${TLS_TEXT[p]}`);
-            if (check.ok) {
-                const spki = createPublicKey(createPrivateKey(keyPem)).export({ type: "spki", format: "der" });
-                digestExtra = { webCertSha256: sha256(certPem), webKeySpkiSha256: sha256(spki) };
-                pems = { cert: certPem, key: keyPem };
-            }
-        }
-        return { problems, ...(digestExtra ? { digestExtra } : {}), ...(pems ? { pems } : {}) };
-    };
-    const digestOf = (plan, extra) => sha256(canonical({ plan, ...extra }));
-    /** Validation for a commit that may resume this plan's own interrupted operation. */
-    const inspectionFor = async (plan) => {
-        const inspection = await inspect();
-        const receipt = readReceipt();
-        if (receipt && inspection.incomplete) {
-            // The plan's own interrupted operation is not "another Hub"; anything else is.
-            const fresh = await problemsOf(plan, { ...inspection, existingHub: false });
-            if (fresh.digestExtra && digestOf(plan, fresh.digestExtra) === receipt.planDigest)
-                return { ...inspection, existingHub: false };
-            return { ...inspection, existingHub: true };
-        }
-        return inspection;
-    };
-    const validate = async (plan) => {
-        const { problems } = await problemsOf(plan, await inspectionFor(plan));
-        if (problems.length > 0)
-            throw new HubInitError(problems[0], problems);
-    };
-    return {
-        inspect,
-        validate,
-        async prepareConfirmation(plan, secrets) {
-            const inspection = await inspectionFor(plan);
-            const { problems, digestExtra } = await problemsOf(plan, inspection);
-            if (!secrets || typeof secrets.bindPassword !== "string" || secrets.bindPassword.length === 0)
-                problems.push("the directory service account password is missing");
-            if (problems.length > 0 || !digestExtra)
-                throw new HubInitError(problems[0] ?? "the plan is not valid", problems);
-            const planDigest = digestOf(plan, digestExtra);
-            const reference = randomBytes(16).toString("hex");
-            pending.set(reference, { planDigest, secrets: { bindPassword: secrets.bindPassword }, expiresAt: now() + CONFIRMATION_TTL_MS });
-            const summary = [
-                `Hub name: ${plan.name}`,
-                `Web address (browsers): ${plan.webOrigin}`,
-                `Member address (fleets connect here): ${plan.memberOrigin}`,
-                `Listeners: web ${plan.webListen.host}:${plan.webListen.port}, members ${plan.memberListen.host}:${plan.memberListen.port}`,
-                `Browser certificate: ${plan.webTls.certFile}`,
-                `Directory: ${plan.directory.url} (realm ${plan.directory.realm}, ${plan.directory.profile})`,
-                `Hub administrator: ${plan.administrator.realm}/${plan.administrator.objectId}`,
-                `Retention: question/answer content ${plan.retention.contentDays} days, event records ${plan.retention.eventDays} days`,
-                `Placement: ${plan.coexistence === "dedicated" ? "dedicated account" : "same account as an existing fleet (pilot only)"}`,
-            ].join("\n");
-            return { reference, planDigest, summary };
-        },
-        async commit(plan, localOwnerConfirmation) {
-            const held = pending.get(localOwnerConfirmation);
-            pending.delete(localOwnerConfirmation); // single use, whatever happens next
-            if (!held)
-                throw new HubInitError("this confirmation is unknown or was already used; confirm the plan again");
-            if (held.expiresAt <= now())
-                throw new HubInitError("this confirmation expired; confirm the plan again");
-            const inspection = await inspectionFor(plan);
-            const { problems, digestExtra, pems } = await problemsOf(plan, inspection);
-            if (problems.length > 0 || !digestExtra || !pems)
-                throw new HubInitError(problems[0] ?? "the plan is not valid", problems);
-            const planDigest = digestOf(plan, digestExtra);
-            if (planDigest !== held.planDigest)
-                throw new HubInitError("the plan or its certificate files changed after confirmation; confirm again");
-            ensurePrivateDir(paths.hub, uid);
-            let receipt = readReceipt();
-            if (receipt && receipt.planDigest !== planDigest)
-                throw new HubInitError("another initialization is in progress with different answers");
-            if (!receipt) {
-                receipt = { version: 1, operationId: randomBytes(8).toString("hex"), planDigest, startedAt: new Date(now()).toISOString(), plan, done: ["started"] };
-                writeReceipt(receipt);
-                deps.afterStage?.("started");
-            }
-            const r = receipt;
-            const mark = (stage) => {
-                if (!r.done.includes(stage))
-                    r.done.push(stage);
-                writeReceipt(r);
-                deps.afterStage?.(stage);
-            };
-            // identity: S1 creates the keys; a resumed operation must find exactly the identity it created.
-            let identity;
-            if (r.done.includes("identity")) {
-                const found = await deps.identity.read(deps.home);
-                if (!found || !r.identity || found.hubId !== r.identity.hubId || found.spkiSha256 !== r.identity.spkiSha256) {
-                    throw new HubInitError("the Hub identity on disk is not the one this initialization created; nothing more was changed");
-                }
-                identity = found;
-            }
-            else {
-                if (await deps.identity.read(deps.home))
-                    throw new HubInitError("a Hub identity already exists that this initialization did not create; nothing was replaced");
-                identity = await deps.identity.provision({ home: deps.home, memberOrigin: plan.memberOrigin });
-                r.identity = identity;
-                mark("identity");
-            }
-            if (!r.done.includes("web-tls")) {
-                // The exact PEM text that was checked and bound to the confirmation (certificate hash and key SPKI): no re-read.
-                writePrivate(paths.webCert, pems.cert, uid);
-                writePrivate(paths.webKey, pems.key, uid);
-                mark("web-tls");
-            }
-            // On resume the password typed now wins: an earlier run's file is rewritten when it differs.
-            const storedSecret = r.done.includes("secret") && existsSync(paths.bindSecret) ? readFileSync(paths.bindSecret, "utf8") : undefined;
-            if (storedSecret !== held.secrets.bindPassword) {
-                writePrivate(paths.bindSecret, held.secrets.bindPassword, uid);
-                mark("secret");
-            }
-            if (!r.done.includes("config")) {
-                if (!existsSync(paths.fleetYaml))
-                    atomicWriteFileSync(paths.fleetYaml, "hub:\n  enabled: false\n", { mode: 0o600 });
-                // An existing fleet's file without hub: create the block (off) first; the patcher writes leaves under it.
-                const current = yaml.load(readFileSync(paths.fleetYaml, "utf8"));
-                if (!current || typeof current !== "object" || !("hub" in current))
-                    applyFleetYamlPatches(paths.fleetYaml, [{ path: ["hub"], value: { enabled: false } }]);
-                applyFleetYamlPatches(paths.fleetYaml, hubConfigPatches(plan, identity));
-                mark("config");
-            }
-            if (!r.done.includes("manifest")) {
-                // Sealed by S1 with the issuer key over the normalized settings now in fleet.yaml; the mount re-checks both.
-                const sealedDigest = hubPlanDigest({ ...hubSettingsFor(plan, identity) });
-                const committedAt = new Date(now()).toISOString();
-                const confirmationId = sha256(localOwnerConfirmation).slice(0, 32);
-                const signature = await deps.identity.seal({ home: deps.home, planDigest: sealedDigest, confirmationId, committedAt });
-                const manifest = { v: 1, hubId: identity.hubId, planDigest: sealedDigest, committedAt, confirmationId, signature };
-                writePrivate(paths.manifest, `${JSON.stringify(manifest, null, 2)}\n`, uid);
-                mark("manifest");
-            }
-            if (!r.done.includes("enabled")) {
-                // An unsigned, informational record alongside the sealed runtime manifest; enabled is still the last patch.
-                // Also creates the record when resuming a pre-inventory operation that already completed the manifest stage.
-                writePrivate(paths.inventory, `${JSON.stringify(hubInstallationInventory(plan, identity, new Date(now()).toISOString()), null, 2)}\n`, uid);
-                applyFleetYamlPatches(paths.fleetYaml, [ENABLE_PATCH]);
-                mark("enabled");
-            }
-            held.secrets.bindPassword = "";
-            return { hubId: identity.hubId, spkiSha256: identity.spkiSha256, issuerKeyId: identity.issuerKeyId, configPath: paths.fleetYaml };
-        },
-    };
-}
-/** The hub.* settings exactly as hubConfigPatches writes them (for the sealed digest). */
-export function hubSettingsFor(plan, identity) {
-    return {
-        name: plan.name,
-        hubId: identity.hubId,
-        webOrigin: plan.webOrigin,
-        memberOrigin: plan.memberOrigin,
-        memberListen: plan.memberListen,
-        webListen: plan.webListen,
-        webTls: WEB_TLS_CONFIG,
-        directory: { ...plan.directory, bindPasswordRef: plan.bindPasswordRef },
-        administrator: plan.administrator,
-        retention: plan.retention,
-        coexistence: plan.coexistence,
-    };
-}
-export { UNAVAILABLE_IDENTITY } from "./identity.js";
-//# sourceMappingURL=initializer.js.map

package/dist/hub/init/initializer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"initializer.js","sourceRoot":"","sources":["../../../src/hub/init/initializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAA0B,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAmB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EACL,YAAY,GASb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AAwB7G,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAE9C,MAAM,QAAQ,GAAsC;IAClD,iBAAiB,EAAE,+CAA+C;IAClE,gBAAgB,EAAE,oDAAoD;IACtE,cAAc,EAAE,oDAAoD;IACpE,kBAAkB,EAAE,sDAAsD;IAC1E,eAAe,EAAE,kCAAkC;IACnD,OAAO,EAAE,6BAA6B;IACtC,gBAAgB,EAAE,6DAA6D;CAChF,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1F,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,QAAkB;IAC9D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,CAAC,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;YAC5C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACxF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,QAAQ,GAAG,kHAAkH,CAAC;AAEpI,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,MAAkD;IAC9F,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,yEAAyE,CAAC,CAAC;IACnG,CAAC;SAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,IAAI,qCAAqC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC9H,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,IAAY,EAAE,GAAuB;IAC7D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,4DAA4D,CAAC,CAAC;IAC1I,IAAI,GAAG,KAAK,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACpG,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,qCAAqC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACpI,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,GAAuB;IAC1E,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,IAAI,oCAAoC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAwB;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8E,CAAC;IAEtG,MAAM,WAAW,GAAG,GAAiC,EAAE;QACrD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAqB,CAAC;YACrF,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,8BAA8B,KAAK,CAAC,SAAS,2BAA2B,KAAK,CAAC,GAAG,sBAAsB,CAAC,CAAC;QAClI,CAAC;IACH,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEhI,MAAM,aAAa,GAAG,GAAY,EAAE;QAClC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/H,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAgC,EAAE;QACrD,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,8GAA8G;QAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;QAC5G,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,CAAC;QACzH,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrJ,OAAO;YACL,aAAa,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;YACvC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,WAAW,CAAC;YAClD,aAAa;YACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC;IAEF,+DAA+D;IAC/D,MAAM,UAAU,GAAG,KAAK,EACtB,IAAiB,EACjB,UAA6B,EACgF,EAAE;QAC/G,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,8GAA8G,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,UAAU,CAAC,WAAW;YAAE,QAAQ,CAAC,IAAI,CAAC,sCAAsC,IAAI,CAAC,IAAI,gDAAgD,CAAC,CAAC;QAC3I,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAClM,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QACxH,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1H,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC5I,QAAQ,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;QAC1J,IAAI,CAAC;YACH,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,iBAAiB;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,iBAAiB,EAAE,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QAC9G,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,GAAG,yCAAyC,CAAC,CAAC;QACtI,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC7L,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,sCAAsC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC1J,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YAC/E,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAClG,CAAC;aAAM,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB,EAAE,CAAC;YACtF,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,WAA+C,CAAC;QACpD,IAAI,IAA+C,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QACpF,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChH,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;gBAAE,QAAQ,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/F,WAAW,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAE,KAA6B,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IAE7G,qFAAqF;IACrF,MAAM,aAAa,GAAG,KAAK,EAAE,IAAiB,EAA8B,EAAE;QAC5E,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACrC,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,KAAK,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,UAAU;gBAAE,OAAO,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YAChI,OAAO,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;QAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ;QAER,KAAK,CAAC,mBAAmB,CAAC,IAAiB,EAAE,OAAuB;YAClE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAClK,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YAClH,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;YAChI,MAAM,OAAO,GAAG;gBACd,aAAa,IAAI,CAAC,IAAI,EAAE;gBACxB,2BAA2B,IAAI,CAAC,SAAS,EAAE;gBAC3C,yCAAyC,IAAI,CAAC,YAAY,EAAE;gBAC5D,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,aAAa,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;gBAC3H,wBAAwB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAC9C,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG;gBAC7F,sBAAsB,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC/E,sCAAsC,IAAI,CAAC,SAAS,CAAC,WAAW,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,OAAO;gBACvH,cAAc,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gDAAgD,EAAE;aAC1H,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,sBAA8B;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,oCAAoC;YAC5E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,YAAY,CAAC,0EAA0E,CAAC,CAAC;YAC9G,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,mDAAmD,CAAC,CAAC;YAEzG,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC3E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,uBAAuB,EAAE,QAAQ,CAAC,CAAC;YAC3H,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,6EAA6E,CAAC,CAAC;YAE1I,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU;gBAAE,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACzI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrJ,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAE,EAAE;gBACnC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChD,YAAY,CAAC,CAAC,CAAC,CAAC;gBAChB,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC,CAAC;YAEF,gGAAgG;YAChG,IAAI,QAA4B,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;oBAC5G,MAAM,IAAI,YAAY,CAAC,+FAA+F,CAAC,CAAC;gBAC1H,CAAC;gBACD,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,YAAY,CAAC,6FAA6F,CAAC,CAAC;gBAC/J,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;gBAC/F,CAAC,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,iHAAiH;gBACjH,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5C,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,CAAC,CAAC;YAClB,CAAC;YAED,6FAA6F;YAC7F,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpI,IAAI,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC/C,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;oBAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACpH,0GAA0G;gBAC1G,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAmC,CAAC;gBACnG,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;oBAAE,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3J,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,6GAA6G;gBAC7G,MAAM,YAAY,GAAG,aAAa,CAAC,EAAE,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1E,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClD,MAAM,cAAc,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACvH,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;gBACnH,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5E,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,4GAA4G;gBAC5G,6GAA6G;gBAC7G,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5I,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,SAAS,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACpI,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,IAAiB,EAAE,QAA4B;IAC5E,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;QACvE,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/hub/init/inventory.d.ts

@@ -1,17 +0,0 @@
-import type { HubIdentitySummary, HubInitPlan } from "./types.js";
-export declare const HUB_INVENTORY_REL = "hub/install-inventory.json";
-export declare const HUB_INVENTORY_PATHS: readonly ["fleet.yaml", "hub/", "fleet.log"];
-export interface HubInstallationInventory {
-    v: 1;
-    purpose: "installation-record";
-    recordedAt: string;
-    hubId: string;
-    webOrigin: string;
-    memberOrigin: string;
-    spkiSha256: string;
-    coexistence: HubInitPlan["coexistence"];
-    serviceLabel: "com.agend.fleet";
-    paths: readonly string[];
-}
-export declare function hubInstallationInventory(plan: HubInitPlan, identity: HubIdentitySummary, recordedAt: string): HubInstallationInventory;
-export declare function readHubInstallationInventory(home: string): HubInstallationInventory;

package/dist/hub/init/inventory.js

@@ -1,33 +0,0 @@
-/** Informational installation inventory. Never used for admission, runtime authority or file removal. */
-import { readPrivateFile } from "../private-files.js";
-export const HUB_INVENTORY_REL = "hub/install-inventory.json";
-export const HUB_INVENTORY_PATHS = ["fleet.yaml", "hub/", "fleet.log"];
-export function hubInstallationInventory(plan, identity, recordedAt) {
-    // Select only public setup metadata. Never copy directory config, passwords, PEMs, imported paths or admin identity.
-    return { v: 1, purpose: "installation-record", recordedAt, hubId: identity.hubId, webOrigin: plan.webOrigin,
-        memberOrigin: plan.memberOrigin, spkiSha256: identity.spkiSha256, coexistence: plan.coexistence,
-        serviceLabel: "com.agend.fleet", paths: [...HUB_INVENTORY_PATHS] };
-}
-function origin(value) {
-    if (typeof value !== "string" || /[\u0000-\u0020\u007f]/.test(value))
-        return false;
-    try {
-        const u = new URL(value);
-        return u.protocol === "https:" && u.origin === value && !u.username && !u.password;
-    }
-    catch {
-        return false;
-    }
-}
-export function readHubInstallationInventory(home) {
-    const x = JSON.parse(readPrivateFile(home, HUB_INVENTORY_REL, 8192));
-    if (x?.v !== 1 || x.purpose !== "installation-record" || typeof x.recordedAt !== "string"
-        || !Number.isFinite(Date.parse(x.recordedAt)) || new Date(x.recordedAt).toISOString() !== x.recordedAt
-        || typeof x.hubId !== "string" || !/^[a-zA-Z0-9._:-]{1,128}$/.test(x.hubId)
-        || !origin(x.webOrigin) || !origin(x.memberOrigin) || !/^[a-f0-9]{64}$/.test(x.spkiSha256)
-        || !["dedicated", "same-user-pilot"].includes(x.coexistence) || x.serviceLabel !== "com.agend.fleet"
-        || JSON.stringify(x.paths) !== JSON.stringify(HUB_INVENTORY_PATHS))
-        throw Error("invalid_hub_installation_inventory");
-    return x;
-}
-//# sourceMappingURL=inventory.js.map

package/dist/hub/init/inventory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../../../src/hub/init/inventory.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAchF,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,QAA4B,EAAE,UAAkB;IAC1G,qHAAqH;IACrH,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS;QACzG,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC/F,YAAY,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAAC,CAAC;IACrH,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,MAAM,CAAC,GAA6B,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,qBAAqB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;WACpF,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,UAAU;WACnG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;WACxE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;WACvF,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,iBAAiB;WACjG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;QAAE,MAAM,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/hub/init/layout.d.ts

@@ -1,32 +0,0 @@
-import type { RawConfigPatch } from "../../settings-api.js";
-import type { HubIdentitySummary, HubInitPlan } from "./types.js";
-export declare const HUB_DIR = "hub";
-export declare const BIND_SECRET_REL = "hub/secrets/directory-bind";
-export declare const BIND_PASSWORD_REF = "file:hub/secrets/directory-bind";
-export declare function hubPaths(home: string): {
-    hub: string;
-    keys: string;
-    initDir: string;
-    operation: string;
-    manifest: string;
-    inventory: string;
-    secrets: string;
-    bindSecret: string;
-    webTlsDir: string;
-    webCert: string;
-    webKey: string;
-    fleetYaml: string;
-};
-/** Resolve a bindPasswordRef the initializer wrote. Only the one private file scheme is accepted. */
-export declare function bindSecretPath(home: string, ref: string): string | undefined;
-/**
- * The hub.* settings, written with enabled: false. `enabled: true` is a separate, last patch (hub.md §5: "commits
- * hub.enabled last"). Paths are relative to the AgEnD home.
- */
-export declare function hubConfigPatches(plan: HubInitPlan, identity: HubIdentitySummary): RawConfigPatch[];
-/** The copied browser certificate, as hub.webTls names it (relative to the AgEnD home). */
-export declare const WEB_TLS_CONFIG: {
-    readonly certificateFile: "hub/web-tls/cert.pem";
-    readonly keyFile: "hub/web-tls/key.pem";
-};
-export declare const ENABLE_PATCH: RawConfigPatch;

package/dist/hub/init/layout.js

@@ -1,53 +0,0 @@
-/**
- * Where initialization puts things, and the fleet.yaml keys it writes. Everything Hub-private lives under
- * <home>/hub (0700); key material under hub/keys is S1's (hub.md §4).
- */
-import { join } from "node:path";
-export const HUB_DIR = "hub";
-export const BIND_SECRET_REL = "hub/secrets/directory-bind";
-export const BIND_PASSWORD_REF = `file:${BIND_SECRET_REL}`;
-export function hubPaths(home) {
-    const hub = join(home, HUB_DIR);
-    return {
-        hub,
-        keys: join(hub, "keys"),
-        initDir: join(hub, "init"),
-        operation: join(hub, "init", "operation.json"),
-        manifest: join(hub, "init-manifest.json"),
-        inventory: join(hub, "install-inventory.json"),
-        secrets: join(hub, "secrets"),
-        bindSecret: join(home, BIND_SECRET_REL),
-        webTlsDir: join(hub, "web-tls"),
-        webCert: join(hub, "web-tls", "cert.pem"),
-        webKey: join(hub, "web-tls", "key.pem"),
-        fleetYaml: join(home, "fleet.yaml"),
-    };
-}
-/** Resolve a bindPasswordRef the initializer wrote. Only the one private file scheme is accepted. */
-export function bindSecretPath(home, ref) {
-    return ref === BIND_PASSWORD_REF ? join(home, BIND_SECRET_REL) : undefined;
-}
-/**
- * The hub.* settings, written with enabled: false. `enabled: true` is a separate, last patch (hub.md §5: "commits
- * hub.enabled last"). Paths are relative to the AgEnD home.
- */
-export function hubConfigPatches(plan, identity) {
-    return [
-        { path: ["hub", "enabled"], value: false },
-        { path: ["hub", "name"], value: plan.name },
-        { path: ["hub", "hubId"], value: identity.hubId },
-        { path: ["hub", "webOrigin"], value: plan.webOrigin },
-        { path: ["hub", "memberOrigin"], value: plan.memberOrigin },
-        { path: ["hub", "memberListen"], value: { host: plan.memberListen.host, port: plan.memberListen.port } },
-        { path: ["hub", "webListen"], value: { host: plan.webListen.host, port: plan.webListen.port } },
-        { path: ["hub", "webTls"], value: { ...WEB_TLS_CONFIG } },
-        { path: ["hub", "directory"], value: { ...plan.directory, bindPasswordRef: plan.bindPasswordRef } },
-        { path: ["hub", "administrator"], value: { realm: plan.administrator.realm, objectId: plan.administrator.objectId } },
-        { path: ["hub", "retention"], value: { contentDays: plan.retention.contentDays, eventDays: plan.retention.eventDays } },
-        { path: ["hub", "coexistence"], value: plan.coexistence },
-    ];
-}
-/** The copied browser certificate, as hub.webTls names it (relative to the AgEnD home). */
-export const WEB_TLS_CONFIG = { certificateFile: "hub/web-tls/cert.pem", keyFile: "hub/web-tls/key.pem" };
-export const ENABLE_PATCH = { path: ["hub", "enabled"], value: true };
-//# sourceMappingURL=layout.js.map

package/dist/hub/init/layout.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"layout.js","sourceRoot":"","sources":["../../../src/hub/init/layout.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,eAAe,EAAE,CAAC;AAE3D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO;QACL,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC;QAC9C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,wBAAwB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAC7B,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;QAC/B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC;QACzC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC;QACvC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,OAAO,GAAG,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB,EAAE,QAA4B;IAC9E,OAAO;QACL,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QAC1C,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;QAC3C,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;QACjD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;QACrD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE;QAC3D,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;QACxG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;QAC/F,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,cAAc,EAAE,EAAE;QACzD,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE;QACnG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE;QACrH,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE;QACvH,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE;KAC1D,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,EAAW,CAAC;AAEnH,MAAM,CAAC,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC"}

package/dist/hub/init/network.d.ts

@@ -1,18 +0,0 @@
-import type { HubInitPlan, HubListen } from "./types.js";
-export type HubInitListeners = Pick<HubInitPlan, "webListen" | "memberListen">;
-export type HubNetworkReason = "invalid" | "unresolved" | "interface" | "occupied" | "permission" | "reserved" | "unavailable";
-export interface HubNetworkProblem {
-    listener: "web" | "member";
-    reason: HubNetworkReason;
-}
-export type HubNetworkCheck = (listeners: HubInitListeners) => Promise<HubNetworkProblem[]>;
-export interface HubNetworkOptions {
-    /** The daemon's own loopback dashboard/preview listeners, even before it starts. */
-    reserved?: readonly HubListen[];
-    /** DNS seam: tests never resolve an external name. Numeric listener IPs do not use DNS. */
-    resolve?: (host: string) => Promise<string>;
-}
-/** Refresh config at each preflight; the Hub also starts the daemon's existing local dashboard/preview. */
-export declare function checkHubInitNetworkForHome(home: string, listeners: HubInitListeners): Promise<HubNetworkProblem[]>;
-/** Hold both sockets together to detect alias conflicts; close every successful bind before returning. */
-export declare function checkHubInitNetwork(listeners: HubInitListeners, options?: HubNetworkOptions): Promise<HubNetworkProblem[]>;