@songsid/agend 2.3.5-alpha.5 → 2.3.5-beta.1

package/dist/hub/mount.js

@@ -1,123 +0,0 @@
-const record = (x) => !!x && typeof x === "object" && !Array.isArray(x);
-export class HubMount {
-    options;
-    generation = 0;
-    serverOn = false;
-    memberOn = false;
-    server = null;
-    member = null;
-    // Includes factories and startup: close must drain their eventual physical resources too.
-    transition = Promise.resolve();
-    enqueue(work) {
-        const result = this.transition.then(work);
-        this.transition = result.catch(() => { });
-        return result;
-    }
-    async drain() {
-        const owned = ["server", "member"].filter(kind => this[kind] !== null);
-        const results = await Promise.allSettled(owned.map(async (kind) => {
-            const service = this[kind];
-            service.fence();
-            await service.close();
-            if (this[kind] === service)
-                this[kind] = null; // Retain ownership until positive shutdown.
-        }));
-        if (results.some(r => r.status === "rejected")) {
-            this.options.hold("service-unavailable");
-            throw Error("Hub cleanup is unconfirmed");
-        }
-    }
-    constructor(options) {
-        this.options = options;
-    }
-    epoch() { return this.generation; }
-    serverEnabled() { return this.serverOn; }
-    memberEnabled() { return this.memberOn; }
-    /** Revocation is synchronous, before asynchronous stop/import/start work. */
-    fence() {
-        this.generation++;
-        this.serverOn = this.memberOn = false;
-        this.server?.fence();
-        this.member?.fence();
-    }
-    close() {
-        this.fence();
-        return this.enqueue(() => this.drain());
-    }
-    apply(input) {
-        // Revoke synchronously, even while a previous factory/start/cleanup is still awaiting.
-        this.fence();
-        const generation = this.generation, snapshot = structuredClone(input);
-        return this.enqueue(() => this.applyOwned(snapshot, generation));
-    }
-    async applyOwned(input, generation) {
-        await this.drain();
-        if (generation !== this.generation)
-            return;
-        const server = record(input.hub) && input.hub.enabled === true ? structuredClone(input.hub) : null;
-        const member = record(input.hub_member) && input.hub_member.enabled === true ? structuredClone(input.hub_member) : null;
-        if (!server && !member)
-            return;
-        if (server) {
-            let reason = "initialization";
-            try {
-                if (typeof server.hubId !== "string" || typeof server.memberOrigin !== "string")
-                    throw Error("Invalid Hub configuration");
-                const digest = this.options.planDigest(server);
-                const { verifyHubInitialization } = await import("./initialization.js");
-                if (generation !== this.generation)
-                    return;
-                verifyHubInitialization({ home: this.options.home, hubId: server.hubId, memberOrigin: server.memberOrigin, planDigest: digest });
-                reason = "service-unavailable";
-                this.serverOn = true;
-                const current = () => this.serverOn && generation === this.generation;
-                const service = await this.options.createServer(server, current);
-                this.server = service;
-                if (!current()) {
-                    await this.drain();
-                    return;
-                }
-                await service.start();
-                if (!current()) {
-                    await this.drain();
-                    return;
-                }
-            }
-            catch {
-                if (generation === this.generation) {
-                    this.serverOn = false;
-                    this.options.hold(reason);
-                }
-                await this.drain();
-            }
-        }
-        if (member && generation === this.generation) {
-            let reason = "member-pairing";
-            try {
-                // The member factory owns validation of its atomic pairing receipt and consent generation.
-                this.memberOn = true;
-                const current = () => this.memberOn && generation === this.generation;
-                const service = await this.options.createMember(member, current);
-                reason = "service-unavailable";
-                this.member = service;
-                if (!current()) {
-                    await this.drain();
-                    return;
-                }
-                await service.start();
-                if (!current()) {
-                    await this.drain();
-                    return;
-                }
-            }
-            catch {
-                if (generation === this.generation) {
-                    this.memberOn = false;
-                    this.options.hold(reason);
-                }
-                await this.drain();
-            }
-        }
-    }
-}
-//# sourceMappingURL=mount.js.map

package/dist/hub/mount.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mount.js","sourceRoot":"","sources":["../../src/hub/mount.ts"],"names":[],"mappings":"AAYA,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/G,MAAM,OAAO,QAAQ;IAqBU,OAAO;IApB5B,UAAU,GAAG,CAAC,CAAC;IACf,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IACjB,MAAM,GAA6B,IAAI,CAAC;IACxC,MAAM,GAA6B,IAAI,CAAC;IAChD,0FAA0F;IAClF,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,KAAK;QACjB,MAAM,KAAK,GAAI,CAAC,QAAQ,EAAE,QAAQ,CAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAE,CAAC;YAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACpE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,4CAA4C;QAC7F,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAAC,CAAC;IAC1I,CAAC;IACD,YAA6B,OAAwB;uBAAxB,OAAO;IAAoB,CAAC;IACzD,KAAK,KAAa,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,aAAa,KAAc,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,aAAa,KAAc,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,6EAA6E;IAC7E,KAAK;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,CAAC,KAA8C;QAClD,uFAAuF;QACvF,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACnE,CAAC;IACO,KAAK,CAAC,UAAU,CAAC,KAA8C,EAAE,UAAkB;QACzF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;YAAE,OAAO;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,GAA6C,gBAAgB,CAAC;YACxE,IAAI,CAAC;gBACH,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;gBACxE,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC3C,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjI,MAAM,GAAG,qBAAqB,CAAC;gBAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;gBACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC/C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,MAAM,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,MAAM,GAA6C,gBAAgB,CAAC;YACxE,IAAI,CAAC;gBACH,2FAA2F;gBAC3F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;gBACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,GAAG,qBAAqB,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtD,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC/C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;oBAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/hub/pairing-client.d.ts

@@ -1,17 +0,0 @@
-import { type HubPendingPairing } from "./profile.js";
-/** Persists only a pending claim. current is a Settings-owned local-owner continuation, never a browser boolean. */
-export declare function beginHubPairing(input: {
-    home: string;
-    memberOrigin: string;
-    code: string;
-    current(): boolean;
-}): Promise<HubPendingPairing>;
-export declare function claimHubPairing(input: {
-    home: string;
-    hubId: string;
-    approvedFingerprint: string;
-    expectedProfileDigest: string | null;
-    current(): boolean;
-}): Promise<{
-    status: "pending" | "paired";
-}>;

package/dist/hub/pairing-client.js

@@ -1,108 +0,0 @@
-/** Restricted TLS bootstrap: no directory password, bearer credential, inventory or work travels here. */
-import { request } from "node:https";
-import { createPublicKey } from "node:crypto";
-import { z } from "zod";
-import { hubOrigin, verifyHubCertificate, pinnedHubAgent } from "./tls.js";
-import { parseStrictJson, validated, token, uuid, HubProtocolError } from "./validation.js";
-import { HUB_PATHS } from "./protocol.js";
-import { issuerKeyId, sha256 } from "./identity.js";
-import { HubMemberProfileStore, pendingSchema, validateHubBinding } from "./profile.js";
-async function post(origin, path, body, pinned) {
-    const normalized = hubOrigin(origin), bytes = JSON.stringify(body);
-    if (Buffer.byteLength(bytes) > 2048)
-        throw new HubProtocolError();
-    return new Promise((resolve, reject) => {
-        let certificatePem = "", done = false;
-        const agent = pinned ? pinnedHubAgent({ memberOrigin: normalized, spkiSha256: pinned.spkiSha256 }) : undefined;
-        let deadline;
-        const fail = () => { if (!done) {
-            done = true;
-            clearTimeout(deadline);
-            agent?.destroy();
-            req.destroy();
-            reject(new HubProtocolError("unavailable"));
-        } };
-        const req = request(new URL(path, normalized), { method: "POST", agent: agent ?? false, rejectUnauthorized: false, minVersion: "TLSv1.2", headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(bytes) }, timeout: 5_000 }, res => {
-            const chunks = [];
-            let total = 0;
-            res.on("data", part => { total += part.length; if (total > 32 * 1024) {
-                fail();
-                return;
-            } chunks.push(Buffer.from(part)); });
-            res.on("aborted", fail);
-            res.on("error", fail);
-            res.on("end", () => {
-                if (done)
-                    return;
-                if (res.statusCode !== 200 || !certificatePem) {
-                    fail();
-                    return;
-                }
-                try {
-                    const value = parseStrictJson(Buffer.concat(chunks), 32 * 1024);
-                    done = true;
-                    clearTimeout(deadline);
-                    agent?.destroy();
-                    resolve({ value, certificatePem });
-                }
-                catch {
-                    fail();
-                }
-            });
-        });
-        req.on("socket", raw => {
-            const socket = raw;
-            const examined = () => {
-                try {
-                    const cert = verifyHubCertificate(socket.getPeerCertificate().raw, normalized, pinned?.spkiSha256);
-                    certificatePem = cert.toString();
-                    req.end(bytes);
-                }
-                catch {
-                    fail();
-                }
-            };
-            if (socket.getPeerCertificate()?.raw)
-                examined();
-            else
-                socket.once("secureConnect", examined);
-        });
-        deadline = setTimeout(fail, 5_000);
-        deadline.unref();
-        req.on("timeout", fail);
-        req.on("error", fail);
-        // No .end until the exact peer certificate has been examined; redirects are never followed.
-    });
-}
-/** Persists only a pending claim. current is a Settings-owned local-owner continuation, never a browser boolean. */
-export async function beginHubPairing(input) {
-    if (!input.current() || !/^[a-f0-9]{12}$/.test(input.code))
-        throw new HubProtocolError("denied");
-    const origin = hubOrigin(input.memberOrigin), response = await post(origin, HUB_PATHS.pair, { code: input.code });
-    if (!input.current() || !response.value || typeof response.value !== "object" || Array.isArray(response.value))
-        throw new HubProtocolError("stale");
-    const p = validated(pendingSchema, { v: 1, ...response.value, certificatePem: response.certificatePem });
-    validateHubBinding(p);
-    if (p.hub.memberOrigin !== origin || p.expiresAt <= Date.now() || p.expiresAt > Date.now() + 600_000 || p.fingerprint !== sha256(JSON.stringify(["agend-hub-pair-v1", p.hub.hubId, p.hub.memberOrigin, p.hub.spkiSha256, p.hub.issuerPublicKey, p.hub.webOrigin, p.pairingId, p.owner.realm, p.owner.objectId, sha256(p.claimSecret)])))
-        throw new HubProtocolError("denied");
-    new HubMemberProfileStore(input.home, p.hub.hubId).savePending(p, input.current);
-    return p;
-}
-export async function claimHubPairing(input) {
-    const store = new HubMemberProfileStore(input.home, input.hubId), pending = store.readPending();
-    if (!input.current() || pending.fingerprint !== input.approvedFingerprint || pending.expiresAt <= Date.now())
-        throw new HubProtocolError("stale");
-    const response = await post(pending.hub.memberOrigin, HUB_PATHS.claim, { pairingId: pending.pairingId, fleetId: pending.fleetId, claimSecret: pending.claimSecret }, { certificatePem: pending.certificatePem, spkiSha256: pending.hub.spkiSha256 });
-    if (!input.current())
-        throw new HubProtocolError("stale");
-    const result = validated(z.union([z.strictObject({ status: z.literal("pending") }), z.strictObject({ status: z.literal("approved"), fleetId: uuid, credential: token })]), response.value);
-    if (result.status === "pending")
-        return { status: "pending" };
-    if (result.fleetId !== pending.fleetId || store.readPending().fingerprint !== pending.fingerprint)
-        throw new HubProtocolError("stale");
-    store.saveProfile({ v: 1, hub: pending.hub, owner: pending.owner, fleetId: pending.fleetId, credential: result.credential,
-        certificatePem: response.certificatePem, issuerKeyId: issuerKeyId(createPublicKey(pending.hub.issuerPublicKey)) }, input.expectedProfileDigest, input.current);
-    store.clearPending();
-    return { status: "paired" }; // a save failure leaves an explicit unresolved claim; never retry credential issuance
-}
-//# sourceMappingURL=pairing-client.js.map

package/dist/hub/pairing-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing-client.js","sourceRoot":"","sources":["../../src/hub/pairing-client.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,kBAAkB,EAA0B,MAAM,cAAc,CAAC;AAChH,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa,EAAE,MAAuD;IACtH,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,cAAc,GAAG,EAAE,EAAE,IAAI,GAAG,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/G,IAAI,QAAoC,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACzJ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,EAAE;YAC7P,MAAM,MAAM,GAAa,EAAE,CAAC;YAAC,IAAI,KAAK,GAAG,CAAC,CAAC;YAC3C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAAC,IAAI,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7H,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBAAC,IAAI,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAClE,IAAI,CAAC;oBAAC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;oBAAC,IAAI,GAAG,IAAI,CAAC;oBAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBAAC,KAAK,EAAE,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;YACvL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;YACrB,MAAM,MAAM,GAAG,GAAgB,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;oBACnG,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,EAAE,CAAC;gBAAC,CAAC;YACrB,CAAC,CAAC;YACF,IAAI,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG;gBAAE,QAAQ,EAAE,CAAC;;gBAAM,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrD,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,4FAA4F;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC;AACD,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA+E;IACnH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpJ,MAAM,CAAC,GAAG,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACzG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9W,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,CAAC;AAC7F,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA6H;IACjK,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IACrP,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3L,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvI,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;QACvH,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACjK,KAAK,CAAC,YAAY,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,sFAAsF;AAC3I,CAAC"}

package/dist/hub/pairing.d.ts

@@ -1,65 +0,0 @@
-import type { HubTransportStore } from "./store.js";
-import type { HubDirectory, HubRequestContext, PersonKey } from "./types.js";
-export interface HubPairingIdentity {
-    hubId: string;
-    memberOrigin: string;
-    webOrigin: string;
-    spkiSha256: string;
-    issuerPublicKey: string;
-}
-export declare function hubPairingFingerprint(identity: HubPairingIdentity, pairId: string, owner: PersonKey, claimDigest: string): string;
-export declare function displayHubFingerprint(fingerprint: string): string;
-export declare class HubPairingService {
-    private readonly options;
-    constructor(options: {
-        store: HubTransportStore;
-        identity: HubPairingIdentity;
-        directory: HubDirectory;
-        enabled(): boolean;
-        now?: () => number;
-        fenceFleet(fleetId: string, reason: "replaced" | "revoked"): void;
-    });
-    private now;
-    private check;
-    private audit;
-    private budget;
-    create(ctx: HubRequestContext, owner: PersonKey): Promise<{
-        pairingId: string;
-        code: string;
-        expiresAt: number;
-    }>;
-    /** Unauthenticated bootstrap accepts a code only: no cookies, passwords, exports or directory attributes. */
-    pair(input: unknown): {
-        pairingId: string;
-        fleetId: string;
-        claimSecret: string;
-        fingerprint: string;
-        expiresAt: number;
-        hub: HubPairingIdentity;
-        owner: PersonKey;
-    };
-    confirmOwner(ctx: HubRequestContext, pairId: string, fingerprint: string): Promise<void>;
-    approve(ctx: HubRequestContext, pairId: string, fingerprint: string): Promise<void>;
-    private throttled;
-    claim(input: unknown): Promise<{
-        status: "pending";
-    } | {
-        status: "approved";
-        fleetId: string;
-        credential: string;
-    }>;
-    authenticate(credential: string): {
-        fleetId: string;
-        owner: PersonKey;
-        generation: number;
-    };
-    bindingCurrent(fleetId: string, generation: number): boolean;
-    connect(credential: string): Promise<{
-        fleetId: string;
-        owner: PersonKey;
-        generation: number;
-        linkEpoch: number;
-        revocationVersion: number;
-    }>;
-    revoke(ctx: HubRequestContext, fleetId: string): Promise<void>;
-}

package/dist/hub/pairing.js

@@ -1,211 +0,0 @@
-import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { z } from "zod";
-import { HubProtocolError, hash, person, token, uuid, validated } from "./validation.js";
-import { personKeyString, sha256 } from "./identity.js";
-const TTL = 10 * 60_000;
-const secret = () => randomBytes(32).toString("hex");
-export function hubPairingFingerprint(identity, pairId, owner, claimDigest) {
-    validated(uuid, identity.hubId);
-    validated(hash, identity.spkiSha256);
-    validated(uuid, pairId);
-    validated(hash, claimDigest);
-    validated(person, owner);
-    return sha256(JSON.stringify(["agend-hub-pair-v1", identity.hubId, identity.memberOrigin, identity.spkiSha256,
-        identity.issuerPublicKey, identity.webOrigin, pairId, owner.realm, owner.objectId, claimDigest]));
-}
-export function displayHubFingerprint(fingerprint) {
-    return validated(hash, fingerprint).slice(0, 32).toUpperCase().match(/.{4}/g).join("-");
-}
-const pairBody = z.strictObject({ code: z.string().regex(/^[a-f0-9]{12}$/) });
-const claimBody = z.strictObject({ pairingId: uuid, fleetId: uuid, claimSecret: token });
-export class HubPairingService {
-    options;
-    constructor(options) {
-        this.options = options;
-    }
-    now() { return this.options.now?.() ?? Date.now(); }
-    check() { if (!this.options.enabled())
-        throw new HubProtocolError("unavailable"); }
-    audit(actor, action, requestId) {
-        return { at: this.now(), requestId, actor: actor.kind === "directory" ? { kind: "person", person: actor.person } : actor.kind === "member" ? actor : { kind: "local-host" }, action, result: "allowed" };
-    }
-    budget(state, key, maximum = 10) {
-        const now = this.now();
-        state.buckets = state.buckets.filter(x => now - x.since < 60_000);
-        const digest = sha256(key), row = state.buckets.find(x => x.key === digest);
-        if (!row) {
-            if (state.buckets.length >= 1024)
-                return false;
-            state.buckets.push({ key: digest, since: now, attempts: 1 });
-            return true;
-        }
-        row.attempts = Math.min(row.attempts + 1, maximum + 1);
-        return row.attempts <= maximum;
-    }
-    async create(ctx, owner) {
-        validated(person, owner);
-        this.check();
-        const eligible = await this.options.directory.checkEligibility(owner);
-        if (!eligible.eligible || personKeyString(eligible.person.key) !== personKeyString(owner))
-            throw new HubProtocolError("denied");
-        const admin = await ctx.requireAdmin();
-        this.check();
-        const id = randomUUID(), code = randomBytes(6).toString("hex"), expiresAt = this.now() + TTL;
-        this.options.store.mutate(this.audit(admin, "pairing.created", ctx.requestId), state => {
-            state.pairings = state.pairings.filter(p => p.expiresAt > this.now());
-            if (state.pairings.length >= 64)
-                throw new HubProtocolError("backpressure");
-            state.pairings.push({ id, owner: { ...owner }, codeHash: sha256(code), expiresAt, fleetId: null, claimHash: null, fingerprint: null,
-                ownerConfirmed: false, adminApproved: false, state: "offered" });
-        });
-        return { pairingId: id, code, expiresAt };
-    }
-    /** Unauthenticated bootstrap accepts a code only: no cookies, passwords, exports or directory attributes. */
-    pair(input) {
-        const { code } = validated(pairBody, input);
-        this.check();
-        const invalid = this.options.store.read().buckets.find(b => b.key === sha256("pair:invalid"));
-        if (invalid && this.now() - invalid.since < 60_000 && invalid.attempts > 10
-            && !this.options.store.read().pairings.some(p => p.codeHash === sha256(code)))
-            throw new HubProtocolError("denied");
-        const claimSecret = secret(), claimHash = sha256(claimSecret), fleetId = randomUUID();
-        const result = this.options.store.mutate(this.audit({ kind: "member", fleetId }, "pairing.claim-requested", randomUUID()), state => {
-            const p = state.pairings.find(p => p.codeHash === sha256(code) && p.state === "offered" && p.expiresAt > this.now());
-            if (!p) {
-                this.budget(state, "pair:invalid");
-                return null;
-            }
-            if (!this.budget(state, `pair:${p.id}`))
-                return null;
-            p.codeHash = null;
-            p.claimHash = claimHash;
-            p.fleetId = fleetId;
-            p.state = "pending";
-            p.fingerprint = hubPairingFingerprint(this.options.identity, p.id, p.owner, claimHash);
-            return { pairingId: p.id, fleetId, claimSecret, fingerprint: p.fingerprint, expiresAt: p.expiresAt, hub: { hubId: this.options.identity.hubId, memberOrigin: this.options.identity.memberOrigin, webOrigin: this.options.identity.webOrigin, spkiSha256: this.options.identity.spkiSha256, issuerPublicKey: this.options.identity.issuerPublicKey }, owner: { ...p.owner } };
-        });
-        if (!result)
-            throw new HubProtocolError("denied");
-        return result;
-    }
-    async confirmOwner(ctx, pairId, fingerprint) {
-        validated(uuid, pairId);
-        validated(hash, fingerprint);
-        const owner = await ctx.requirePerson();
-        this.check();
-        this.options.store.mutate(this.audit({ kind: "directory", person: owner, sessionId: "" }, "pairing.owner-confirmed", ctx.requestId), state => {
-            const p = state.pairings.find(p => p.id === pairId);
-            if (!p || p.state !== "pending" || p.expiresAt <= this.now() || p.fingerprint !== fingerprint || personKeyString(p.owner) !== personKeyString(owner))
-                throw new HubProtocolError("denied");
-            p.ownerConfirmed = true;
-        });
-    }
-    async approve(ctx, pairId, fingerprint) {
-        validated(uuid, pairId);
-        validated(hash, fingerprint);
-        const admin = await ctx.requireAdmin();
-        this.check();
-        this.options.store.mutate(this.audit(admin, "pairing.approved", ctx.requestId), state => {
-            const p = state.pairings.find(p => p.id === pairId);
-            if (!p || p.state !== "pending" || p.expiresAt <= this.now() || p.fingerprint !== fingerprint || !p.ownerConfirmed)
-                throw new HubProtocolError("denied");
-            p.adminApproved = true;
-        });
-    }
-    throttled(state, key, maximum) {
-        const bucket = state.buckets.find(b => b.key === sha256(key));
-        return !!bucket && this.now() - bucket.since < 60_000 && bucket.attempts >= maximum;
-    }
-    async claim(input) {
-        const body = validated(claimBody, input);
-        this.check();
-        const credential = secret();
-        const matches = (p) => p.id === body.pairingId && p.fleetId === body.fleetId && p.claimHash === sha256(body.claimSecret)
-            && p.state === "pending" && p.expiresAt > this.now();
-        const initial = this.options.store.read(), offered = initial.pairings.find(matches);
-        const key = offered ? `claim:${offered.id}` : "claim:invalid", maximum = offered ? 60 : 10;
-        // Already-throttled requests publish no additional audit/floor write. Valid claims have their own budget.
-        if (this.throttled(initial, key, maximum))
-            throw new HubProtocolError("denied");
-        let eligible = false;
-        if (offered) {
-            const result = await this.options.directory.checkEligibility(offered.owner);
-            eligible = result.eligible && personKeyString(result.person.key) === personKeyString(offered.owner);
-        }
-        this.check();
-        const event = { ...this.audit({ kind: "member", fleetId: body.fleetId }, "pairing.claimed", randomUUID()), result: "denied" };
-        const outcome = this.options.store.mutate(event, state => {
-            // Recheck after directory I/O: concurrent polling or claim consumption cannot bypass the durable budget.
-            const p = state.pairings.find(matches), liveKey = p ? `claim:${p.id}` : "claim:invalid", limit = p ? 60 : 10;
-            if (this.throttled(state, liveKey, limit))
-                throw new HubProtocolError("denied");
-            if (!this.budget(state, liveKey, limit) || !p || !eligible)
-                return null;
-            if (!p.ownerConfirmed || !p.adminApproved) {
-                event.result = "allowed";
-                event.action = "pairing.claim-pending";
-                return { status: "pending" };
-            }
-            if (state.fleets.length >= 256)
-                throw new HubProtocolError("backpressure");
-            p.state = "claimed";
-            p.claimHash = null;
-            state.fleets.push({ id: body.fleetId, owner: p.owner, credentialHash: sha256(credential), generation: 1, status: "active" });
-            event.result = "allowed";
-            return { status: "approved", fleetId: body.fleetId, credential };
-        });
-        if (!outcome)
-            throw new HubProtocolError("denied");
-        return outcome;
-    }
-    authenticate(credential) {
-        validated(token, credential);
-        this.check();
-        const digest = Buffer.from(sha256(credential), "hex");
-        const fleet = this.options.store.read().fleets.find(f => f.status === "active" && f.credentialHash && timingSafeEqual(digest, Buffer.from(f.credentialHash, "hex")));
-        if (!fleet)
-            throw new HubProtocolError("denied");
-        return { fleetId: fleet.id, owner: fleet.owner, generation: fleet.generation };
-    }
-    bindingCurrent(fleetId, generation) {
-        try {
-            this.check();
-            const f = this.options.store.read().fleets.find(f => f.id === fleetId);
-            return f?.status === "active" && f.generation === generation;
-        }
-        catch {
-            return false;
-        }
-    }
-    async connect(credential) {
-        let f = this.authenticate(credential);
-        const eligible = await this.options.directory.checkEligibility(f.owner);
-        if (!eligible.eligible || personKeyString(eligible.person.key) !== personKeyString(f.owner))
-            throw new HubProtocolError("denied");
-        f = this.authenticate(credential);
-        this.options.fenceFleet(f.fleetId, "replaced");
-        return this.options.store.mutate(this.audit({ kind: "member", fleetId: f.fleetId }, "member.connected", randomUUID()), state => {
-            const current = state.fleets.find(x => x.id === f.fleetId);
-            if (!current || current.generation !== f.generation || current.status !== "active")
-                throw new HubProtocolError("stale");
-            state.nextLinkEpoch++;
-            return { ...f, linkEpoch: state.nextLinkEpoch, revocationVersion: state.revocationVersion };
-        });
-    }
-    async revoke(ctx, fleetId) {
-        validated(uuid, fleetId);
-        const admin = await ctx.requireAdmin();
-        this.check();
-        this.options.fenceFleet(fleetId, "revoked");
-        this.options.store.mutate(this.audit(admin, "member.revoked", ctx.requestId), state => {
-            const f = state.fleets.find(f => f.id === fleetId);
-            if (!f)
-                throw new HubProtocolError("not-found");
-            f.status = "revoked";
-            f.credentialHash = null;
-            f.generation++;
-            state.revocationVersion++;
-        });
-    }
-}
-//# sourceMappingURL=pairing.js.map

package/dist/hub/pairing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/hub/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGxD,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;AACxB,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAIrD,MAAM,UAAU,qBAAqB,CAAC,QAA4B,EAAE,MAAc,EAAE,KAAgB,EAAE,WAAmB;IACvH,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvJ,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,UAAU;QAC3G,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3F,CAAC;AACD,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,MAAM,OAAO,iBAAiB;IACC,OAAO;IAApC,YAA6B,OACgF;uBADhF,OAAO;IAC4E,CAAC;IACzG,GAAG,KAAa,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5D,KAAK,KAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzF,KAAK,CAAC,KAAqD,EAAE,MAAc,EAAE,SAAiB;QACpG,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;IACtO,CAAC;IACO,MAAM,CAAC,KAAwB,EAAE,GAAW,EAAE,OAAO,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACxI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAsB,EAAE,KAAgB;QACnD,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChI,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,UAAU,EAAE,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC;QAC7F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE;YACrF,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC5E,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;gBACjI,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,6GAA6G;IAC7G,IAAI,CAAC,KAAc;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9F,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;eACtE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACtH,MAAM,WAAW,GAAG,MAAM,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,yBAAyB,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE;YACjI,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACrH,IAAI,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;YAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC;YAAC,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;YACrF,CAAC,CAAC,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvF,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/W,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IACnE,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,GAAsB,EAAE,MAAc,EAAE,WAAmB;QAC5E,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7G,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,yBAAyB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE;YAC3I,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3L,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,GAAsB,EAAE,MAAc,EAAE,WAAmB;QACvE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5G,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE;YACtF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,cAAc;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACzJ,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IACO,SAAS,CAAC,KAAwB,EAAE,GAAW,EAAE,OAAe;QACtE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAc;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,CAAC,CAAwC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;eAC1J,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,0GAA0G;QAC1G,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChF,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5E,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,QAAgC,EAAE,CAAC;QAC/J,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;YACvD,yGAAyG;YACzG,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACxE,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,KAAK,CAAC,MAAM,GAAG,uBAAuB,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;YAAC,CAAC;YACvJ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAC3E,CAAC,CAAC,KAAK,GAAG,SAAS,CAAC;YAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;YACxC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7H,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,UAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,OAAO,CAAC;IACrE,CAAC;IACD,YAAY,CAAC,UAAkB;QAC7B,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QACrK,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;IACnI,CAAC;IACD,cAAc,CAAC,OAAe,EAAE,UAAkB;QAChD,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACrL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE;YAC7H,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxH,KAAK,CAAC,aAAa,EAAE,CAAC;YAAC,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,aAAa,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAsB,EAAE,OAAe;QAClD,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5H,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE;YACpF,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACpG,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC;YAAC,CAAC,CAAC,cAAc,GAAG,IAAI,CAAC;YAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/hub/policy.d.ts

@@ -1,63 +0,0 @@
-import type Database from "better-sqlite3";
-import type { HubAuthorizationLease, HubAuthorizationRequest, HubAuthorizationResult, HubExposure, HubGrant } from "./types.js";
-import type { HubLinkContext } from "./server.js";
-import { type HubCore } from "./http/core.js";
-export declare const LEASE_MS = 5000;
-/** P1 question lifetime (hub.md §2: at most 24 hours). */
-export declare const QUESTION_LIFETIME_MS: number;
-export declare const TERMINAL: Set<string>;
-declare const POSITIVE: string[];
-export interface MessageRow {
-    id: string;
-    room_id: string;
-    idempotency_key: string;
-    sequence: number;
-    fleet_id: string;
-    exposure_id: string;
-    exposure_revision: number;
-    grant_id: string;
-    grant_revision: number;
-    asker: string;
-    owner: string;
-    content_digest: string;
-    question_ref: string;
-    stage: string;
-    member_sequence: number;
-    reason_code: string | null;
-    stage_at: number;
-    sent_epoch: number;
-    answer_id: string | null;
-    answer_digest: string | null;
-    answer_ref: string | null;
-    created_at: number;
-    expires_at: number;
-}
-export declare const readMessage: (db: Database.Database, id: string) => MessageRow | undefined;
-export type Facts = {
-    ok: true;
-    exposure: HubExposure;
-    grant: HubGrant;
-} | {
-    ok: false;
-    reason: "revoked" | "stale" | "expired" | "denied";
-};
-/** The message's room, grant and exposure as they are now — the synchronous half of "authorize now". */
-export declare function messageFacts(db: Database.Database, msg: MessageRow, now: number): Facts;
-export declare class HubPolicyService {
-    private readonly core;
-    constructor(core: HubCore);
-    /** Both people of a message are eligible in the directory now (two fresh lookups, bounded). */
-    peopleEligible(msg: Pick<MessageRow, "asker" | "owner">): Promise<boolean>;
-    /** A member's `authorize.request` on its current link → a lease for exactly that operation, or a bounded refusal. */
-    authorize(input: HubAuthorizationRequest, link: HubLinkContext): Promise<HubAuthorizationResult>;
-    /**
-     * The release lease an answer frame carries, checked against the Hub's own record of it: same fleet, link epoch,
-     * message, exact answer id/digest (via the operation digest), unexpired, unused. It is then spent.
-     */
-    spendReleaseLease(db: Database.Database, lease: HubAuthorizationLease, answer: {
-        messageId: string;
-        answerId: string;
-        contentDigest: string;
-    }, link: HubLinkContext, now: number): void;
-}
-export { POSITIVE };