@source-repo/rpc 3.0.0

package/dist/RPC/Signing.js

@@ -0,0 +1,171 @@
+import { base64ToUint8Array, stringToUint8Array, uint8ArrayToBase64 } from 'uint8array-extras';
+/**
+ * Frame signing, for transports that cannot authenticate a connection.
+ *
+ * MQTT peers connect to a broker, not to each other, so a receiver has no connection to attribute
+ * a message to and the source field is only a claim. Signing each frame makes the claim checkable
+ * without trusting the broker: a broker operator, or any peer whose ACLs let it publish to another
+ * peer's topic, still cannot forge a message from someone else.
+ *
+ * Built on WebCrypto, which is present in Node and in browsers, so the same code signs on both.
+ */
+const subtle = () => {
+    const available = globalThis.crypto?.subtle;
+    if (!available)
+        throw new Error('source-rpc signing needs WebCrypto (globalThis.crypto.subtle)');
+    return available;
+};
+const toBytes = (value) => (typeof value === 'string' ? stringToUint8Array(value) : value);
+/**
+ * WebCrypto takes a BufferSource, which recent typings narrow to views over a plain ArrayBuffer.
+ * A Uint8Array may sit on a SharedArrayBuffer, so copying is what makes the type honest rather
+ * than asserted away. The cost is trivial next to the hashing that follows.
+ */
+const bufferSource = (bytes) => new Uint8Array(bytes);
+/**
+ * The exact bytes a signature covers: a JSON array of the header fields, followed by the payload.
+ *
+ * A JSON array fixes the field order and escapes the values, so no combination of names can be
+ * made to look like a different frame. The verifier rebuilds the preamble from the fields it
+ * parsed, so it knows where the payload begins without needing a length prefix.
+ */
+export const canonicalSignedBytes = (frame) => {
+    const preamble = stringToUint8Array(JSON.stringify([frame.source, frame.target, frame.time, frame.seq, frame.nonce]));
+    const result = new Uint8Array(preamble.length + frame.payload.length);
+    result.set(preamble, 0);
+    result.set(frame.payload, preamble.length);
+    return result;
+};
+/**
+ * The MQTT 5 canonical form. The topic is signed rather than a target field, because under this
+ * layout the topic is what carries the addressing.
+ *
+ * Frame version 1 deliberately left contentType out, on the reasoning that it only says how to read
+ * bytes that are themselves covered - so altering it could make the payload fail to parse but never
+ * change what was authorised. **That reasoning is wrong**, and the counterexample is one byte long:
+ * `0x31` decodes as the JSON text `"1"`, which is the number 1, and as a MsgPack positive fixint,
+ * which is the number 49. Both parse. Both verify. Flipping one unsigned property therefore changed
+ * a signed setpoint from 1 to 49 with the signature still good.
+ *
+ * The same argument applies to anything else the receiver acts on rather than merely transports: the
+ * error code decides what a caller does about a failure, the declared contract version decides
+ * whether the call is accepted at all, the response topic decides where the answer is published, the
+ * ttl decides whether the method runs at all, and the idempotency key decides whether it runs again.
+ * All five are covered.
+ *
+ * The MQTT message expiry is deliberately **not** covered, because the broker is meant to decrement
+ * it in flight and a signature over it would break on the first queued message. Nothing is lost:
+ * expiry may only narrow the signed ttl, never extend it, so rewriting it can delay or drop a frame
+ * - which anyone able to rewrite it could do anyway - but cannot buy a stale command more time.
+ */
+export const canonicalSignedBytesV5 = (frame) => {
+    const preamble = stringToUint8Array(JSON.stringify([
+        frame.version,
+        frame.topic,
+        frame.responseTopic,
+        frame.source,
+        frame.kind,
+        frame.path,
+        frame.methodOrEvent,
+        frame.correlation,
+        frame.contentType,
+        frame.code,
+        frame.contractVersion,
+        frame.ttl,
+        frame.idempotencyKey,
+        frame.timestamp,
+        frame.nonce
+    ]));
+    const result = new Uint8Array(preamble.length + frame.payload.length);
+    result.set(preamble, 0);
+    result.set(frame.payload, preamble.length);
+    return result;
+};
+/** A nonce with enough entropy that collisions are not a practical concern. */
+export const createNonce = () => uint8ArrayToBase64(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+/**
+ * Rejects frames that are too old and frames whose nonce has been seen before.
+ *
+ * A signature alone does not stop a captured frame being sent again, which for RPC would mean
+ * replaying a command. The freshness window bounds how long a captured frame stays useful and
+ * bounds how many nonces have to be remembered to cover it.
+ */
+export class ReplayGuard {
+    maxClockSkew;
+    maxTrackedNonces;
+    seen = new Map();
+    constructor(
+    /** How far a frame's timestamp may differ from now. Peers need clocks within this of each other. */
+    maxClockSkew = 60000, 
+    /** Hard cap on remembered nonces, so a flood cannot grow this without bound. */
+    maxTrackedNonces = 5000) {
+        this.maxClockSkew = maxClockSkew;
+        this.maxTrackedNonces = maxTrackedNonces;
+    }
+    /** True if the frame is fresh and previously unseen. Records the nonce as a side effect. */
+    accept(nonce, time, now = Date.now()) {
+        if (!nonce || !Number.isFinite(time))
+            return false;
+        if (Math.abs(now - time) > this.maxClockSkew)
+            return false;
+        if (this.seen.has(nonce))
+            return false;
+        this.seen.set(nonce, now);
+        this.prune(now);
+        return true;
+    }
+    prune(now) {
+        // Insertion order tracks arrival order, so the first entry that is still fresh means the
+        // rest are too.
+        for (const [nonce, at] of this.seen) {
+            if (now - at > this.maxClockSkew || this.seen.size > this.maxTrackedNonces) {
+                this.seen.delete(nonce);
+                continue;
+            }
+            break;
+        }
+    }
+    get size() {
+        return this.seen.size;
+    }
+}
+const identityOf = (source, identityFor) => identityFor?.(source) ?? { name: source };
+/**
+ * HMAC-SHA256 with a secret per peer. Universally available, but symmetric: whoever can verify a
+ * peer's messages can also forge them, so the secret must only be shared with parties allowed to
+ * act as that peer. Use Ed25519 when a compromised verifier must not be able to impersonate.
+ */
+export const createHmacSigner = (secret) => {
+    let imported;
+    const key = () => (imported ??= subtle().importKey('raw', bufferSource(toBytes(secret)), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']));
+    return async (canonicalBytes) => uint8ArrayToBase64(new Uint8Array(await subtle().sign('HMAC', await key(), bufferSource(canonicalBytes))));
+};
+export const createHmacVerifier = (resolveSecret, identityFor) => {
+    return async (canonicalBytes, signature, { source }) => {
+        const secret = await resolveSecret(source);
+        if (!secret)
+            return undefined;
+        const key = await subtle().importKey('raw', bufferSource(toBytes(secret)), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+        // subtle.verify compares in constant time, so this does not leak the expected signature.
+        const valid = await subtle().verify('HMAC', key, bufferSource(base64ToUint8Array(signature)), bufferSource(canonicalBytes));
+        return valid ? identityOf(source, identityFor) : undefined;
+    };
+};
+/**
+ * Ed25519, taking WebCrypto keys directly so key storage and format stay the caller's concern.
+ * Asymmetric: the verifier holds only public keys, so compromising a server does not let anyone
+ * forge messages from its peers.
+ */
+export const createEd25519Signer = (privateKey) => {
+    return async (canonicalBytes) => uint8ArrayToBase64(new Uint8Array(await subtle().sign('Ed25519', privateKey, bufferSource(canonicalBytes))));
+};
+export const createEd25519Verifier = (resolvePublicKey, identityFor) => {
+    return async (canonicalBytes, signature, { source }) => {
+        const publicKey = await resolvePublicKey(source);
+        if (!publicKey)
+            return undefined;
+        const valid = await subtle().verify('Ed25519', publicKey, bufferSource(base64ToUint8Array(signature)), bufferSource(canonicalBytes));
+        return valid ? identityOf(source, identityFor) : undefined;
+    };
+};
+//# sourceMappingURL=Signing.js.map

package/dist/RPC/Signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Signing.js","sourceRoot":"","sources":["../../src/RPC/Signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAG9F;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAG,GAAG,EAAE;IAChB,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAA;IAC3C,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAChG,OAAO,SAAS,CAAA;AACpB,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAA0B,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAE/G;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,KAAiB,EAA2B,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;AAE1F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAkB,EAAc,EAAE;IACnE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACrH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,MAAM,CAAA;AACjB,CAAC,CAAA;AA+CD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAoB,EAAc,EAAE;IACvE,MAAM,QAAQ,GAAG,kBAAkB,CAC/B,IAAI,CAAC,SAAS,CAAC;QACX,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,aAAa;QACnB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,WAAW;QACjB,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,GAAG;QACT,KAAK,CAAC,cAAc;QACpB,KAAK,CAAC,SAAS;QACf,KAAK,CAAC,KAAK;KACd,CAAC,CACL,CAAA;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACrE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACvB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,MAAM,CAAA;AACjB,CAAC,CAAA;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE1G;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IAKT,YAAY;IAEZ,gBAAgB;IANnB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExC;IACI,oGAAoG;IAC7F,YAAY,GAAG,KAAK;IAC3B,gFAAgF;IACzE,gBAAgB,GAAG,IAAI;4BAFvB,YAAY;gCAEZ,gBAAgB;IACxB,CAAC;IAEJ,4FAA4F;IAC5F,MAAM,CAAC,KAAa,EAAE,IAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAChD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAA;QAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,OAAO,IAAI,CAAA;IACf,CAAC;IAEO,KAAK,CAAC,GAAW;QACrB,yFAAyF;QACzF,gBAAgB;QAChB,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACzE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACvB,SAAQ;YACZ,CAAC;YACD,MAAK;QACT,CAAC;IACL,CAAC;IAED,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACzB,CAAC;CACJ;AAKD,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,WAAyD,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAE3I;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAA2B,EAAiB,EAAE;IAC3E,IAAI,QAAwC,CAAA;IAC5C,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC7I,OAAO,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/I,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAC9B,aAA+C,EAC/C,WAAyD,EAC1C,EAAE;IACjB,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChI,yFAAyF;QACzF,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAA;QAC3H,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC,CAAA;AACL,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,UAAqB,EAAiB,EAAE;IACxE,OAAO,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;AACjJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,gBAAwC,EACxC,WAAyD,EAC1C,EAAE;IACjB,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAA;QACpI,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC,CAAA;AACL,CAAC,CAAA"}

package/dist/RPC/Tokens.d.ts

@@ -0,0 +1,49 @@
+import { RpcAuthenticator } from './Auth.js';
+/**
+ * Bearer tokens for a socket.io transport: the smallest thing that turns a bus anyone can join into
+ * one only its own peers can.
+ *
+ * Signing (Signing.ts) answers a different question. It proves a *frame* came from a peer, which is
+ * what MQTT needs, because there is no connection for anyone to have authenticated. A socket.io bus
+ * does have one, and a token presented once at the handshake pins it - after which the transport
+ * refuses any frame whose source is not the name that token resolved to. That check is the point,
+ * and it is what a shared password cannot do.
+ *
+ * So: **one token per peer, not one token for the bus.** A token that maps to a name is evidence of
+ * who is calling. A single token everyone knows is evidence only that the caller is inside the
+ * fence, and any holder can then claim to be the peer whose commands matter. `createTokenAuthenticator`
+ * takes a map for that reason and has no single-secret form.
+ *
+ * Tokens are bearer credentials: whoever has one is that peer. They belong in a secret store or an
+ * environment variable, never in the image, the repository or the command line.
+ */
+/**
+ * What a token entitles its holder to be. A bare string is the peer name it may use; the object
+ * form adds roles for an `RpcAuthorizer` to read.
+ */
+export type TokenGrant = string | {
+    name: string;
+    roles?: string[];
+};
+/**
+ * Accept peers presenting a token this map knows, as the peer that token names.
+ *
+ * ```typescript
+ * new RpcServer({
+ *     transports: [{ port: defaultWebSocketPort }],
+ *     authenticate: createTokenAuthenticator({ [process.env.PLANT_TOKEN!]: 'plantServer' })
+ * })
+ * ```
+ *
+ * The peer presents it as `credentials: { token }`, and its `name` must be the one the token maps
+ * to - the transport drops frames that claim any other source, so a mismatch shows up as every call
+ * timing out rather than as a refusal. Worth getting right in configuration rather than debugging.
+ *
+ * An empty or blank token is refused at construction. It would otherwise sit in the map matching
+ * every peer that presented no credentials at all, which is the one mistake here that looks like it
+ * is working.
+ */
+export declare const createTokenAuthenticator: (tokens: {
+    [token: string]: TokenGrant;
+}) => RpcAuthenticator;
+//# sourceMappingURL=Tokens.d.ts.map

package/dist/RPC/Tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.d.ts","sourceRoot":"","sources":["../../src/RPC/Tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,WAAW,CAAA;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAUpE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,WAAY;IAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,KAAG,gBAqBlF,CAAA"}

package/dist/RPC/Tokens.js

@@ -0,0 +1,45 @@
+const grantToIdentity = (grant) => typeof grant === 'string' ? { name: grant } : { name: grant.name, ...(grant.roles ? { roles: grant.roles } : {}) };
+/**
+ * Accept peers presenting a token this map knows, as the peer that token names.
+ *
+ * ```typescript
+ * new RpcServer({
+ *     transports: [{ port: defaultWebSocketPort }],
+ *     authenticate: createTokenAuthenticator({ [process.env.PLANT_TOKEN!]: 'plantServer' })
+ * })
+ * ```
+ *
+ * The peer presents it as `credentials: { token }`, and its `name` must be the one the token maps
+ * to - the transport drops frames that claim any other source, so a mismatch shows up as every call
+ * timing out rather than as a refusal. Worth getting right in configuration rather than debugging.
+ *
+ * An empty or blank token is refused at construction. It would otherwise sit in the map matching
+ * every peer that presented no credentials at all, which is the one mistake here that looks like it
+ * is working.
+ */
+export const createTokenAuthenticator = (tokens) => {
+    // Copied into a Map at construction so a later mutation of the caller's object cannot widen who
+    // is admitted, and so lookup is by hash of the whole token rather than a comparison that could
+    // return early on the first wrong character.
+    const grants = new Map();
+    for (const [token, grant] of Object.entries(tokens)) {
+        if (!token.trim())
+            throw new Error('createTokenAuthenticator: a blank token would admit any peer presenting none');
+        const identity = grantToIdentity(grant);
+        if (!identity.name)
+            throw new Error('createTokenAuthenticator: a token must name the peer it admits');
+        grants.set(token, identity);
+    }
+    if (!grants.size)
+        throw new Error('createTokenAuthenticator: no tokens, so nothing could ever connect');
+    return (credentials) => {
+        const presented = credentials?.token;
+        if (typeof presented !== 'string')
+            return undefined;
+        // Returned by value: an authorizer that mutated the identity it was handed would otherwise
+        // change what every later connection with the same token is granted.
+        const identity = grants.get(presented);
+        return identity ? { ...identity, ...(identity.roles ? { roles: [...identity.roles] } : {}) } : undefined;
+    };
+};
+//# sourceMappingURL=Tokens.js.map

package/dist/RPC/Tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tokens.js","sourceRoot":"","sources":["../../src/RPC/Tokens.ts"],"names":[],"mappings":"AA2BA,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAe,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;AAOtH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAuC,EAAoB,EAAE;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;QAClH,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACrG,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IAEvG,OAAO,CAAC,WAAW,EAAE,EAAE;QACnB,MAAM,SAAS,GAAI,WAA4C,EAAE,KAAK,CAAA;QACtE,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACnD,2FAA2F;QAC3F,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtC,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5G,CAAC,CAAA;AACL,CAAC,CAAA"}

package/dist/RpcClient.d.ts

@@ -0,0 +1,91 @@
+import { EventEmitter } from 'events';
+import { PeerRegistry, Transport } from './RPC/Core.js';
+import { MessageSigner, type TrustedCertificateAuthority } from './RPC/Auth.js';
+import { RpcSchema } from './RPC/Schema.js';
+import { IManageRpc } from './RPC/Rpc.js';
+import { RpcClientHandler, type WithOptions } from './RPC/RpcClientHandler.js';
+export interface RpcClientOptions {
+    name: string;
+    /** Supply one to take full control of the link. When absent init() builds one from the url. */
+    transport?: Transport;
+    defaultTarget?: string;
+    useMsgPack: boolean;
+    /** How long a call waits for a response before rejecting with an RpcError of code 'Timeout'. */
+    callTimeout: number;
+    /** How long ready() waits for the transport to connect before throwing. 0 waits forever. */
+    readyTimeout: number;
+    /** Reject in-flight calls as soon as the link drops instead of waiting out their timeouts. */
+    failCallsOnDisconnect: boolean;
+    /**
+     * Credentials presented when connecting to a server that authenticates. Passed to socket.io as
+     * the handshake `auth` payload, and to MQTT as broker connect options. When the server
+     * authenticates, `name` must match the identity these credentials resolve to - the server
+     * drops frames whose source does not match.
+     */
+    credentials?: unknown;
+    /**
+     * Sign outgoing frames. Only meaningful for MQTT, where there is no connection for a server to
+     * authenticate and the source field would otherwise be an unverifiable claim.
+     */
+    sign?: MessageSigner;
+    /**
+     * The contract this client was built against. Its per-namespace versions are declared on each
+     * call so a server can tell a genuinely stale caller from one sending rubbish.
+     */
+    schema?: RpcSchema;
+    /**
+     * Connect to an `https://`, `wss://` or `mqtts://` peer without checking its certificate.
+     *
+     * Deliberately unsafe, and off: anything able to answer on that address can then read and
+     * rewrite everything this client sends, which over this library means industrial commands. It
+     * exists for a development server with a self-signed certificate. A plant with its own
+     * certificate authority should pass the CA in `credentials` instead, which keeps verification
+     * on rather than switching it off.
+     */
+    allowInsecureTls?: boolean;
+    /**
+     * A certificate authority to trust, on top of the system ones, when dialling an `https://`,
+     * `wss://` or `mqtts://` peer.
+     *
+     * This is the answer for a plant that issues its own certificates, and it is the one to reach
+     * for before `allowInsecureTls`: verification stays on, so a server presenting anything this
+     * does not vouch for is still refused.
+     */
+    ca?: TrustedCertificateAuthority;
+}
+export interface RpcProxy<T> {
+    name: string;
+    target?: string;
+    /**
+     * The remote instance, plus `$with` for the options a caller can attach to a call - an
+     * idempotency key, so far. `$with` returns another proxy for the same instance rather than
+     * changing this one, so options never leak into calls that did not ask for them.
+     */
+    remote?: T & WithOptions<T>;
+}
+/**
+ * Emits the TransportEvent.connected and TransportEvent.disconnected lifecycle events so an
+ * application can show link state instead of inferring it from failed calls.
+ */
+export declare class RpcClient extends EventEmitter {
+    url?: string | undefined;
+    rpcClient?: RpcClientHandler;
+    manageRpc?: IManageRpc;
+    readyFlag: boolean;
+    /** Peer name -> module, shared by this client's modules and nothing outside them. */
+    readonly peers: PeerRegistry;
+    options: RpcClientOptions;
+    constructor(url?: string | undefined, options?: Partial<RpcClientOptions>);
+    /** Why init() failed, rethrown by ready() so the caller sees the cause and not a timeout. */
+    private initError?;
+    close(): Promise<void>;
+    init(): Promise<void>;
+    /**
+     * React to the link coming and going. On reconnect the subscriptions are replayed, which both
+     * restores server-side state and re-identifies this client so pushed events can reach it again.
+     */
+    private wireTransportLifecycle;
+    ready(): Promise<void>;
+    proxy<T>(name: string, target?: string): Promise<RpcProxy<T>>;
+}
+//# sourceMappingURL=RpcClient.d.ts.map

package/dist/RpcClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RpcClient.d.ts","sourceRoot":"","sources":["../src/RpcClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,EAAiB,YAAY,EAAE,SAAS,EAAkB,MAAM,eAAe,CAAA;AACtF,OAAO,EAAE,aAAa,EAAE,KAAK,2BAA2B,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAwB,UAAU,EAAE,MAAM,cAAc,CAAA;AAC/D,OAAO,EAAsB,gBAAgB,EAAE,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAMlG,MAAM,WAAW,gBAAgB;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,+FAA+F;IAC/F,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,OAAO,CAAA;IACnB,gGAAgG;IAChG,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,YAAY,EAAE,MAAM,CAAA;IACpB,8FAA8F;IAC9F,qBAAqB,EAAE,OAAO,CAAA;IAC9B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,EAAE,CAAC,EAAE,2BAA2B,CAAA;CACnC;AAED,MAAM,WAAW,QAAQ,CAAC,CAAC;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;CAC9B;AAED;;;GAGG;AACH,qBAAa,SAAU,SAAQ,YAAY;IAmB5B,GAAG,CAAC,EAAE,MAAM;IAlBvB,SAAS,CAAC,EAAE,gBAAgB,CAAA;IAC5B,SAAS,CAAC,EAAE,UAAU,CAAA;IACtB,SAAS,UAAQ;IACjB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,eAAqB;IAGnC,OAAO,EAAE,gBAAgB,CASxB;IACD,YACW,GAAG,CAAC,EAAE,MAAM,YAAA,EACnB,OAAO,GAAE,OAAO,CAAC,gBAAgB,CAAM,EAY1C;IACD,6FAA6F;IAC7F,OAAO,CAAC,SAAS,CAAC,CAAS;IACrB,KAAK,kBAOV;IACK,IAAI,kBA8CT;IAED;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAexB,KAAK,kBAaV;IACK,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,wBAM3C;CACJ"}

package/dist/RpcClient.js

@@ -0,0 +1,145 @@
+import { EventEmitter } from 'events';
+import { PeerRegistry, TransportEvent } from './RPC/Core.js';
+import { defaultWebSocketPort } from './RPC/Rpc.js';
+import { defaultCallTimeout, RpcClientHandler } from './RPC/RpcClientHandler.js';
+import { SocketIoClientTransport } from './Transports/SocketIoClientTransport.js';
+import { codecFor } from './RPC/Codec.js';
+import { readableName } from './Utilities/ReadableName.js';
+/**
+ * Emits the TransportEvent.connected and TransportEvent.disconnected lifecycle events so an
+ * application can show link state instead of inferring it from failed calls.
+ */
+export class RpcClient extends EventEmitter {
+    url;
+    rpcClient;
+    manageRpc;
+    readyFlag = false;
+    /** Peer name -> module, shared by this client's modules and nothing outside them. */
+    peers = new PeerRegistry();
+    // No transport here: constructing one in a field initialiser opened a socket on every client
+    // that init() then replaced and orphaned, leaving it reconnecting forever.
+    options = {
+        // Readable rather than a UUID: this name is what a peer list shows, what a log line blames
+        // and, over MQTT, the broker's client id.
+        name: readableName(),
+        defaultTarget: '*',
+        useMsgPack: true,
+        callTimeout: defaultCallTimeout,
+        readyTimeout: 30000,
+        failCallsOnDisconnect: true
+    };
+    constructor(url, options = {}) {
+        super();
+        this.url = url;
+        this.options = { ...this.options, ...options };
+        // init() is async and the constructor cannot await it, so its rejection was unhandled -
+        // and Node ends the process on one of those. A bad url, an unreachable broker or a name the
+        // transport refuses took the whole application down from a constructor. Kept instead, so
+        // ready() can report the real cause rather than timing out with nothing to say.
+        void this.init().catch((e) => {
+            this.initError = e;
+            this.emit('initError', e);
+        });
+    }
+    /** Why init() failed, rethrown by ready() so the caller sees the cause and not a timeout. */
+    initError;
+    async close() {
+        this.rpcClient?.failPendingCalls('client closed');
+        this.rpcClient?.subscriptions.clear();
+        await this.rpcClient?.close();
+        await this.options.transport?.close();
+        this.peers.clear();
+        this.readyFlag = false;
+    }
+    async init() {
+        // A caller-supplied transport is honoured. It used to be overwritten unconditionally, so
+        // passing one had no effect at all.
+        let transport = this.options.transport;
+        if (!transport) {
+            const socketOptions = {
+                ...(this.options.credentials ? { auth: this.options.credentials } : {}),
+                // The socket.io typings narrow `ca` to a string, while the runtime takes what Node's
+                // tls does. Passing the bytes of a PEM is the ordinary thing readFileSync gives you.
+                ...(this.options.ca ? { ca: this.options.ca } : {})
+            };
+            if (this.url?.startsWith('http') || this.url?.startsWith('ws'))
+                transport = new SocketIoClientTransport(this.options.name, this.url, undefined, socketOptions, true, this.options.allowInsecureTls);
+            else if (this.url?.startsWith('mqtt')) {
+                // Imported on demand so a browser bundle that only speaks WebSocket does not have
+                // to carry the MQTT client. Bundlers split this into a chunk fetched only when an
+                // mqtt:// url is actually used.
+                const { MqttTransport } = await import('./Transports/MqttTransport.js');
+                transport = new MqttTransport(this.options.name, this.url, {
+                    mqtt: {
+                        ...(this.options.credentials ?? {}),
+                        ...(this.options.ca ? { ca: this.options.ca } : {})
+                    },
+                    sign: this.options.sign,
+                    allowInsecureTls: this.options.allowInsecureTls
+                });
+            }
+            else
+                transport = new SocketIoClientTransport(this.options.name, `http://localhost:${defaultWebSocketPort}`, undefined, socketOptions, true, this.options.allowInsecureTls);
+        }
+        this.options.transport = transport;
+        // The transport encodes, so there is no converter between it and the handler. A structured
+        // wire format such as MQTT 5 needs to see the message, not bytes a converter already flattened.
+        transport.codec = codecFor(this.options.useMsgPack);
+        this.rpcClient = new RpcClientHandler(this.options.name, [transport], this.options.callTimeout);
+        if (this.options.schema)
+            this.rpcClient.schemaVersions = Object.fromEntries(Object.entries(this.options.schema.namespaces).map(([namespace, described]) => [namespace, described.version]));
+        this.rpcClient.pipe(transport);
+        for (const module of [transport, this.rpcClient])
+            module.usePeerRegistry(this.peers);
+        this.wireTransportLifecycle(transport);
+        this.readyFlag = true;
+        // Built directly instead of via proxy(), which awaits ready(). init() is not awaited by
+        // the constructor, so a ready() rejection here would surface as an unhandled rejection.
+        // The proxy is inert until a call is made, so there is nothing to wait for.
+        this.manageRpc = this.rpcClient.proxy('manageRpc', this.options.defaultTarget);
+        await this.options.transport.open();
+    }
+    /**
+     * React to the link coming and going. On reconnect the subscriptions are replayed, which both
+     * restores server-side state and re-identifies this client so pushed events can reach it again.
+     */
+    wireTransportLifecycle(transport) {
+        transport.on(TransportEvent.disconnected, (reason) => {
+            if (this.options.failCallsOnDisconnect)
+                this.rpcClient?.failPendingCalls(`transport disconnected: ${reason ?? 'unknown reason'}`);
+            this.emit(TransportEvent.disconnected, reason);
+        });
+        transport.on(TransportEvent.connected, () => {
+            // No-op on the first connect, when nothing has been subscribed yet.
+            this.rpcClient
+                ?.resubscribe()
+                .then((restored) => this.emit(TransportEvent.connected, { restoredSubscriptions: restored }))
+                // Not 'error': an EventEmitter throws on an unhandled 'error' event.
+                .catch((e) => this.emit('resubscribeError', e));
+        });
+    }
+    async ready() {
+        const deadline = Date.now() + this.options.readyTimeout;
+        while (!this.options.transport?.readyFlag || !this.readyFlag) {
+            // Checked every turn, not just once: init() is still running when ready() is first
+            // called, so the failure usually arrives while this loop is already waiting.
+            if (this.initError !== undefined)
+                throw new Error(`RpcClient '${this.options.name}': could not start: ${this.initError instanceof Error ? this.initError.message : String(this.initError)}`, {
+                    cause: this.initError
+                });
+            if (this.options.readyTimeout > 0 && Date.now() > deadline)
+                throw new Error(`RpcClient '${this.options.name}': transport not ready within ${this.options.readyTimeout} ms`);
+            await new Promise((res) => setTimeout(res, 10));
+        }
+    }
+    async proxy(name, target) {
+        await this.ready();
+        const result = { name };
+        if (target)
+            result.target = target;
+        if (this.rpcClient)
+            result.remote = this.rpcClient.proxy(name, target ? target : this.options.defaultTarget);
+        return result;
+    }
+}
+//# sourceMappingURL=RpcClient.js.map

package/dist/RpcClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RpcClient.js","sourceRoot":"","sources":["../src/RpcClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AACrC,OAAO,EAAiB,YAAY,EAAa,cAAc,EAAE,MAAM,eAAe,CAAA;AAGtF,OAAO,EAAE,oBAAoB,EAAc,MAAM,cAAc,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAoB,MAAM,2BAA2B,CAAA;AAElG,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AA+D1D;;;GAGG;AACH,MAAM,OAAO,SAAU,SAAQ,YAAY;IAmB5B,GAAG;IAlBd,SAAS,CAAmB;IAC5B,SAAS,CAAa;IACtB,SAAS,GAAG,KAAK,CAAA;IACjB,qFAAqF;IAC5E,KAAK,GAAG,IAAI,YAAY,EAAE,CAAA;IACnC,6FAA6F;IAC7F,2EAA2E;IAC3E,OAAO,GAAqB;QACxB,2FAA2F;QAC3F,0CAA0C;QAC1C,IAAI,EAAE,YAAY,EAAE;QACpB,aAAa,EAAE,GAAG;QAClB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,kBAAkB;QAC/B,YAAY,EAAE,KAAK;QACnB,qBAAqB,EAAE,IAAI;KAC9B,CAAA;IACD,YACW,GAAY,EACnB,OAAO,GAA8B,EAAE;QAEvC,KAAK,EAAE,CAAA;mBAHA,GAAG;QAIV,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAA;QAC9C,wFAAwF;QACxF,4FAA4F;QAC5F,yFAAyF;QACzF,gFAAgF;QAChF,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAA;YAClB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QAC7B,CAAC,CAAC,CAAA;IACN,CAAC;IACD,6FAA6F;IACrF,SAAS,CAAU;IAC3B,KAAK,CAAC,KAAK;QACP,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,CAAA;QACrC,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAA;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAA;QACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAA;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI;QACN,yFAAyF;QACzF,oCAAoC;QACpC,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAA;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,aAAa,GAAG;gBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAyC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,qFAAqF;gBACrF,qFAAqF;gBACrF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAA;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC;gBAC1D,SAAS,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;iBAClI,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,kFAAkF;gBAClF,kFAAkF;gBAClF,gCAAgC;gBAChC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAA;gBACvE,SAAS,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE;oBACvD,IAAI,EAAE;wBACF,GAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAoB;wBACvD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9E;oBACD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACvB,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;iBAClD,CAAC,CAAA;YACN,CAAC;;gBAAM,SAAS,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,oBAAoB,oBAAoB,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAChL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAA;QAClC,2FAA2F;QAC3F,gGAAgG;QAChG,SAAS,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/F,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;YACnB,IAAI,CAAC,SAAS,CAAC,cAAc,GAAG,MAAM,CAAC,WAAW,CAC9C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CACjH,CAAA;QACL,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACrB,wFAAwF;QACxF,wFAAwF;QACxF,4EAA4E;QAC5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAa,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC1F,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACvC,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,SAAwB;QACnD,SAAS,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC,MAAc,EAAE,EAAE;YACzD,IAAI,IAAI,CAAC,OAAO,CAAC,qBAAqB;gBAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,2BAA2B,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAA;YACjI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,SAAS,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE;YACxC,oEAAoE;YACpE,IAAI,CAAC,SAAS;gBACV,EAAE,WAAW,EAAE;iBACd,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC7F,qEAAqE;iBACpE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACN,CAAC;IAED,KAAK,CAAC,KAAK;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAA;QACvD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3D,mFAAmF;YACnF,6EAA6E;YAC7E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAC5B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,uBAAuB,IAAI,CAAC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;oBACvJ,KAAK,EAAE,IAAI,CAAC,SAAS;iBACxB,CAAC,CAAA;YACN,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBACtD,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,iCAAiC,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;YACnH,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;QACnD,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,MAAe;QACxC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;QAClB,MAAM,MAAM,GAAgB,EAAE,IAAI,EAAE,CAAA;QACpC,IAAI,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;QAClC,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;QAC/G,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}