borgmcp 1.1.15 → 2.0.1

package/dist/server-handshake.js

@@ -0,0 +1,505 @@
+import { ATTACH_PATH, CUBES_PATH, ENROLLMENT_EXCHANGE_PATH, HEALTH_PATH, PROTOCOL_INFO_PATH, createAttachRequestEnvelope, createProtocolEnvelope, decodeAttachResponseEnvelope, decodeCreateCubeRequest, decodeCreateCubeResponseEnvelope, decodeEnrollmentExchangeRequest, decodeEnrollmentExchangeResponseEnvelope, decodeProtocolErrorEnvelope, decodeProtocolTagPreflight, ErrorCode, } from 'borgmcp-shared/protocol';
+import { createHash, randomUUID } from 'node:crypto';
+import { activatePendingServerEnrollment, clearPendingServerCubeCreation, clearPendingServerEnrollment, getServerCredential, getServerCredentialRecord, getPendingServerEnrollment, getOrCreatePendingServerCubeCreation, getOrCreatePendingServerEnrollment, } from './config.js';
+import { activateAndBindSeat, bindPendingSeatToWorktree, scrubPendingSeat, seatRef, } from './seats.js';
+import { BorgServerError } from './server-errors.js';
+import { readBoundedResponseBody } from './server-response.js';
+import { loadBorgServerTrust, } from './server-trust.js';
+const HANDSHAKE_BODY_LIMIT = 64 * 1024;
+const HANDSHAKE_TIMEOUT_MS = 5_000;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const CLIENT_ATTACH_PATH = '/api/client/attach';
+export const DEFAULT_LOCAL_SERVER_ORIGIN = 'https://127.0.0.1:7091';
+function handshakeUrl(origin, path) {
+    return new URL(path, `${origin}/`).toString();
+}
+/** Bodyless, non-identifying liveness probe from the shared contract. */
+export async function probeBorgServer(origin, fetchImpl = fetch, timeoutMs = 750) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(handshakeUrl(origin, HEALTH_PATH), {
+            method: 'GET',
+            redirect: 'error',
+            signal: controller.signal,
+        });
+        return response.status === 204;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+const readHandshakeBody = (response, signal) => readBoundedResponseBody(response, HANDSHAKE_BODY_LIMIT, 'Borg server protocol handshake exceeded the response limit', signal);
+async function readHandshakeBodyWithTimeout(response) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => {
+        controller.abort(new Error('Borg server protocol handshake timed out'));
+    }, HANDSHAKE_TIMEOUT_MS);
+    try {
+        return await readHandshakeBody(response, controller.signal);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Credential-free protocol-tag preflight. After the caller has verified pinned
+ * TLS, confirm the server speaks the exact protocol tag BEFORE any bearer is
+ * created, sent, or a seat attached. Sends NO Authorization header, cookie,
+ * query, or body; rejects redirects; and bounds the response. A tag mismatch,
+ * an extra field, or any transport anomaly fails closed here — no keychain
+ * write and no attach. The bearer is proven only at attach.
+ */
+export async function preflightBorgServerTag(origin, fetchImpl = fetch) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), HANDSHAKE_TIMEOUT_MS);
+    try {
+        const response = await fetchImpl(handshakeUrl(origin, PROTOCOL_INFO_PATH), {
+            method: 'GET',
+            redirect: 'error',
+            signal: controller.signal,
+            headers: {
+                Accept: 'application/json',
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Borg server protocol preflight failed (HTTP ${response.status})`);
+        }
+        let decoded;
+        try {
+            decoded = JSON.parse(await readHandshakeBody(response, controller.signal));
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('response limit'))
+                throw error;
+            throw new Error('Borg server returned an invalid protocol preflight');
+        }
+        return decodeProtocolTagPreflight(decoded);
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * The NETWORK-ONLY half of an attach: POST the ALREADY-MINTED pending bearer and
+ * decode, WITHOUT minting (the mint is owned by the single-store prepareSeat, CR#1).
+ * Returns the deferred activate/scrubPending handles: FINALIZE calls `activate`
+ * with the decided worktree binding, and activateAndBindSeat stamps ACTIVE + binds
+ * the worktree in ONE atomic commit (activate+bind merged — no cross-store gap).
+ */
+export async function sendBorgServerAttach(origin, trustIdentity, parentCredential, request, pendingBearer, deps = {}) {
+    if (!UUID_RE.test(request.cubeId) || !UUID_RE.test(request.roleId)) {
+        throw new Error('Borg server attach requires valid cube and role identities');
+    }
+    if (request.priorDroneId !== undefined && !UUID_RE.test(request.priorDroneId)) {
+        throw new Error('Borg server attach prior drone identity is invalid');
+    }
+    if (!/^[A-Za-z0-9_-]{43,1024}$/.test(parentCredential)) {
+        throw new Error('stored Borg server enrollment credential is invalid');
+    }
+    const pending = { credential: pendingBearer };
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), HANDSHAKE_TIMEOUT_MS);
+    try {
+        const response = await (deps.fetchImpl ?? fetch)(handshakeUrl(origin, ATTACH_PATH), {
+            method: 'POST',
+            redirect: 'error',
+            signal: controller.signal,
+            headers: {
+                Accept: 'application/json',
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${parentCredential}`,
+            },
+            body: JSON.stringify(createAttachRequestEnvelope(randomUUID(), {
+                cube_id: request.cubeId,
+                role_id: request.roleId,
+                session_credential: pending.credential,
+                ...(request.priorDroneId === undefined
+                    ? {}
+                    : { prior_drone_id: request.priorDroneId }),
+            })),
+        });
+        if (response.status === 401 || response.status === 403) {
+            // A typed SESSION_REJECTED body means the presented bearer targets a seat
+            // already bound to a different session (takeover), distinct from a rejected
+            // parent enrollment credential. Decode defensively; any anomaly falls back
+            // to the generic credential rejection below. Never echo the response body.
+            if (response.status === 401) {
+                let rejectedCode;
+                try {
+                    rejectedCode = decodeProtocolErrorEnvelope(JSON.parse(await readHandshakeBody(response, controller.signal))).error.code;
+                }
+                catch {
+                    rejectedCode = undefined;
+                }
+                if (rejectedCode === ErrorCode.SESSION_REJECTED) {
+                    throw new BorgServerError('SESSION_REJECTED', 'Borg server rejected the session: the seat is already bound to another session');
+                }
+            }
+            throw new BorgServerError('CREDENTIAL_REJECTED', 'Borg server enrollment was rejected');
+        }
+        if (response.status === 409) {
+            throw new BorgServerError('ATTACH_CONFLICT', 'Borg server attach request conflicted');
+        }
+        if (!response.ok) {
+            throw new Error(`Borg server attach failed (HTTP ${response.status})`);
+        }
+        let decoded;
+        try {
+            decoded = decodeAttachResponseEnvelope(JSON.parse(await readHandshakeBody(response, controller.signal))).payload;
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('response limit'))
+                throw error;
+            throw new Error('Borg server returned an invalid attach response');
+        }
+        if (decoded.cube.id !== request.cubeId || decoded.role.id !== request.roleId) {
+            throw new Error('Borg server returned an attach identity outside the request');
+        }
+        const seatInput = {
+            origin,
+            trustIdentity,
+            cubeId: request.cubeId,
+            roleId: request.roleId,
+            operation: request.operation,
+        };
+        const credentialRef = (deps.sessionCredentialRef ?? seatRef)(seatInput);
+        const pendingBearerDigest = createHash('sha256').update(pending.credential).digest('hex');
+        return {
+            cube: decoded.cube,
+            role: decoded.role,
+            drone: decoded.drone,
+            session: {
+                sessionId: decoded.session.id,
+                expiresAt: decoded.session.expires_at,
+            },
+            result: decoded.result,
+            credentialRef,
+            pendingBearerDigest,
+            // The single-store ATOMIC activate+bind — invoked by FINALIZE with the decided
+            // worktree binding. Stamps server metadata + the worktree binding ONLY onto the
+            // EXACT pending record whose bearer we sent (digest-matched), in ONE commit. A
+            // same-ref replacement or a concurrent delete aborts (`replaced`/`missing`) —
+            // never binds bearer A's server session onto bearer B, and never leaves an
+            // ACTIVE credential without a binding (they land together).
+            activate: (binding) => (deps.activateAndBind ?? activateAndBindSeat)({
+                ...seatInput,
+                droneId: decoded.drone.id,
+                sessionId: decoded.session.id,
+                expiresAt: decoded.session.expires_at,
+                expectedPendingDigest: pendingBearerDigest,
+                worktree: binding.worktree,
+                name: binding.name,
+                droneLabel: binding.droneLabel,
+                ...(binding.roleName !== undefined ? { roleName: binding.roleName } : {}),
+                ...(binding.roleClass !== undefined ? { roleClass: binding.roleClass } : {}),
+                ...(binding.isHumanSeat !== undefined ? { isHumanSeat: binding.isHumanSeat } : {}),
+            }),
+            // Abort-scrub of ONLY this own pending record (never an ACTIVE record, never
+            // a same-ref replacement) — invoked when the server did not honor the
+            // reattach/remint intent.
+            scrubPending: () => (deps.scrubPending ?? scrubPendingSeat)(credentialRef, { origin, trustIdentity, cubeId: request.cubeId }, pendingBearerDigest),
+            // CR#2: on activation failure, bind the EXACT digest-matched PENDING record to
+            // the preserved (spawned) worktree WITHOUT activating it — it stays pending, so
+            // it is non-hydratable as a live seat but IS discoverable/resumable from that
+            // worktree. The rerun re-sends the identical bearer and converges (no ghost).
+            bindPending: (binding) => (deps.bindPending ?? bindPendingSeatToWorktree)({
+                ...seatInput,
+                expectedPendingDigest: pendingBearerDigest,
+                droneId: decoded.drone.id,
+                worktree: binding.worktree,
+                name: binding.name,
+                droneLabel: binding.droneLabel,
+                ...(binding.roleName !== undefined ? { roleName: binding.roleName } : {}),
+                ...(binding.roleClass !== undefined ? { roleClass: binding.roleClass } : {}),
+                ...(binding.isHumanSeat !== undefined ? { isHumanSeat: binding.isHumanSeat } : {}),
+            }),
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+// SR-seven (c): the pre-composite mint-without-cube-lock seams (prepareBorgServerAttach)
+// and the activate-first no-binding wrapper (attachBorgServer) are DELETED — there is
+// no code path, not even test-only, that mints/sends a session_credential outside the
+// cube-owned composite. The ONLY session-credential send is sendBorgServerAttach, driven
+// by assimilate-deps AFTER prepareSeat has minted under the single store flock.
+/**
+ * Redeem one invitation after the caller has verified TLS and derived the
+ * stable server/CA identity. The client-generated bearer + retry key are
+ * persisted PENDING in the local 0600 file store before the first request. A
+ * transport-ambiguous exchange is retried with that exact tuple; only a decoded
+ * response followed by an authenticated protocol proof activates the bearer.
+ */
+export async function enrollBorgServer(origin, trustIdentity, invitation, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    // Credential-free tag preflight FIRST (CR fb4d6eba): after pinned TLS, an
+    // incompatible server must be rejected before any credential is created or
+    // persisted and before any invitation/secret-bearing request is sent.
+    const protocol = await preflightBorgServerTag(origin, fetchImpl);
+    const pending = await (deps.prepareEnrollment ?? getOrCreatePendingServerEnrollment)({
+        origin,
+        trustIdentity,
+        invitation,
+        ...(deps.clientName ? { clientName: deps.clientName } : {}),
+    });
+    const request = decodeEnrollmentExchangeRequest({
+        invitation: pending.invitation,
+        retry_key: pending.retryKey,
+        client_credential: pending.credential,
+        ...(pending.clientName ? { client_name: pending.clientName } : {}),
+    });
+    let response = null;
+    let lastTransportError;
+    for (let attempt = 0; attempt < 2 && response === null; attempt += 1) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), HANDSHAKE_TIMEOUT_MS);
+        try {
+            response = await fetchImpl(handshakeUrl(origin, ENROLLMENT_EXCHANGE_PATH), {
+                method: 'POST',
+                redirect: 'error',
+                signal: controller.signal,
+                headers: {
+                    Accept: 'application/json',
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(createProtocolEnvelope(randomUUID(), request)),
+            });
+        }
+        catch (error) {
+            lastTransportError = error;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    if (!response)
+        throw lastTransportError;
+    if (response.status === 401 || response.status === 403) {
+        await (deps.clearPendingEnrollment ?? clearPendingServerEnrollment)(origin, trustIdentity, pending.retryKey);
+        throw new BorgServerError('INVITATION_REJECTED', 'the invitation was rejected or expired');
+    }
+    if (response.status !== 201) {
+        throw new Error(`Borg server enrollment failed (HTTP ${response.status})`);
+    }
+    let decoded;
+    try {
+        decoded = decodeEnrollmentExchangeResponseEnvelope(JSON.parse(await readHandshakeBodyWithTimeout(response)));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('response limit'))
+            throw error;
+        throw new Error('Borg server returned an invalid enrollment envelope');
+    }
+    await (deps.activateEnrollment ?? activatePendingServerEnrollment)({
+        origin,
+        trustIdentity,
+        retryKey: pending.retryKey,
+        credential: pending.credential,
+        clientId: decoded.payload.client_id,
+        serverCapabilities: decoded.payload.server_capabilities,
+    });
+    return {
+        token: pending.credential,
+        trustIdentity,
+        protocol,
+        clientId: decoded.payload.client_id,
+        serverCapabilities: decoded.payload.server_capabilities,
+    };
+}
+/** Resume an exact durable enrollment tuple without asking for the invitation again. */
+export async function resumeBorgServerEnrollment(origin, trustIdentity, deps = {}) {
+    const pending = await (deps.loadPendingEnrollment ?? getPendingServerEnrollment)(origin, trustIdentity);
+    if (!pending)
+        return null;
+    deps.onPending?.();
+    return enrollBorgServer(origin, trustIdentity, pending.invitation, {
+        ...(deps.fetchImpl === undefined ? {} : { fetchImpl: deps.fetchImpl }),
+        prepareEnrollment: async () => pending,
+        ...(deps.activateEnrollment === undefined
+            ? {}
+            : { activateEnrollment: deps.activateEnrollment }),
+        ...(deps.clearPendingEnrollment === undefined
+            ? {}
+            : { clearPendingEnrollment: deps.clearPendingEnrollment }),
+        ...(pending.clientName === undefined ? {} : { clientName: pending.clientName }),
+    });
+}
+/**
+ * Create one repository cube through the narrow owner capability. The retry
+ * key is persisted in the OS keychain before network I/O and reused exactly
+ * after an ambiguous transport result. Ordinary clients are denied locally
+ * before any create request is sent.
+ */
+export async function createBorgServerCube(origin, trustIdentity, parentCredential, input, deps = {}) {
+    const active = await (deps.loadCredentialRecord ?? getServerCredentialRecord)(origin, trustIdentity);
+    if (!active || active.credential !== parentCredential) {
+        throw new BorgServerError('CREDENTIAL_REJECTED', 'stored Borg server credential was rejected');
+    }
+    if (!active.clientId || !active.serverCapabilities.includes('create_cube')) {
+        throw new BorgServerError('CREATE_CUBE_DENIED', 'This Borg server client is not authorized to create cubes');
+    }
+    const pending = await (deps.prepareCubeCreation ?? getOrCreatePendingServerCubeCreation)({
+        origin,
+        trustIdentity,
+        clientId: active.clientId,
+        projectRoot: input.projectRoot,
+        name: input.name,
+        template: 'default',
+    });
+    const request = decodeCreateCubeRequest({
+        retry_key: pending.retryKey,
+        name: pending.name,
+        template: pending.template,
+    });
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    let response = null;
+    let lastTransportError;
+    for (let attempt = 0; attempt < 2 && response === null; attempt += 1) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), HANDSHAKE_TIMEOUT_MS);
+        try {
+            response = await fetchImpl(handshakeUrl(origin, CUBES_PATH), {
+                method: 'POST',
+                redirect: 'error',
+                signal: controller.signal,
+                headers: {
+                    Accept: 'application/json',
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${parentCredential}`,
+                },
+                body: JSON.stringify(createProtocolEnvelope(randomUUID(), request)),
+            });
+        }
+        catch (error) {
+            lastTransportError = error;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    if (!response)
+        throw lastTransportError;
+    if (response.status === 401 || response.status === 403) {
+        throw new BorgServerError('CREDENTIAL_REJECTED', 'Borg server enrollment was rejected');
+    }
+    if (response.status === 404) {
+        throw new BorgServerError('CREATE_CUBE_DENIED', 'This Borg server client is not authorized to create cubes');
+    }
+    if (response.status === 409) {
+        throw new Error('Borg server cube creation retry state conflicted');
+    }
+    if (response.status !== 201) {
+        throw new Error(`Borg server cube creation failed (HTTP ${response.status})`);
+    }
+    let decoded;
+    try {
+        decoded = decodeCreateCubeResponseEnvelope(JSON.parse(await readHandshakeBodyWithTimeout(response)));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('response limit'))
+            throw error;
+        throw new Error('Borg server returned an invalid cube creation envelope');
+    }
+    await (deps.clearCubeCreation ?? clearPendingServerCubeCreation)(pending);
+    return decoded.payload;
+}
+export async function createLocalBorgServerCube(origin, trustIdentity, parentCredential, input, deps = {}) {
+    const trust = await (deps.loadTrust ?? loadBorgServerTrust)(origin);
+    if (trust.identity !== trustIdentity) {
+        throw new Error('Borg server trust identity changed; refusing cube creation');
+    }
+    return createBorgServerCube(origin, trustIdentity, parentCredential, input, {
+        fetchImpl: trust.fetchImpl,
+    });
+}
+/**
+ * Swappable Part-4 integration seam. Trust verification supplies the server/CA
+ * identity; this function then reads only the credential bound to that exact
+ * origin+identity pair and negotiates the authenticated shared contract.
+ */
+export async function connectEnrolledBorgServer(origin, trustIdentity, deps = {}) {
+    const active = deps.loadCredentialRecord
+        ? await deps.loadCredentialRecord(origin, trustIdentity)
+        : deps.loadCredential
+            ? null
+            : await getServerCredentialRecord(origin, trustIdentity);
+    const token = active?.credential ?? await (deps.loadCredential ?? getServerCredential)(origin, trustIdentity);
+    if (!token) {
+        throw new BorgServerError('NOT_ENROLLED', 'no enrolled credential is stored for this Borg server identity');
+    }
+    const protocol = await preflightBorgServerTag(origin, deps.fetchImpl ?? fetch);
+    return {
+        token,
+        trustIdentity,
+        protocol,
+        ...(active === null ? {} : {
+            clientId: active.clientId,
+            serverCapabilities: active.serverCapabilities,
+        }),
+    };
+}
+/** Resolve the same-user server CA and its authority-bound keychain credential. */
+export async function resolveBorgServerAuthority(origin, deps = {}) {
+    const trust = await (deps.loadTrust ?? loadBorgServerTrust)(origin);
+    const active = deps.loadCredentialRecord
+        ? await deps.loadCredentialRecord(origin, trust.identity)
+        : deps.loadCredential
+            ? null
+            : await getServerCredentialRecord(origin, trust.identity);
+    const token = active?.credential ?? await (deps.loadCredential ?? getServerCredential)(origin, trust.identity);
+    if (!token) {
+        throw new BorgServerError('NOT_ENROLLED', 'no enrolled credential is stored for this Borg server identity');
+    }
+    return { ...trust, token };
+}
+/** Load pinned trust, then prove the stored credential against /api/protocol. */
+export async function connectLocalBorgServer(origin, deps = {}) {
+    const trust = await (deps.loadTrust ?? loadBorgServerTrust)(origin);
+    return connectEnrolledBorgServer(origin, trust.identity, {
+        fetchImpl: trust.fetchImpl,
+        ...(deps.loadCredential === undefined ? {} : { loadCredential: deps.loadCredential }),
+        ...(deps.loadCredentialRecord === undefined
+            ? {}
+            : { loadCredentialRecord: deps.loadCredentialRecord }),
+    });
+}
+/** Load and verify the local CA before sending an enrollment invitation. */
+export async function enrollLocalBorgServer(origin, invitation, deps = {}) {
+    const trust = await (deps.loadTrust ?? loadBorgServerTrust)(origin);
+    return enrollBorgServer(origin, trust.identity, invitation, {
+        fetchImpl: trust.fetchImpl,
+        ...(deps.prepareEnrollment === undefined ? {} : { prepareEnrollment: deps.prepareEnrollment }),
+        ...(deps.activateEnrollment === undefined ? {} : { activateEnrollment: deps.activateEnrollment }),
+        ...(deps.clearPendingEnrollment === undefined
+            ? {}
+            : { clearPendingEnrollment: deps.clearPendingEnrollment }),
+        ...(deps.clientName === undefined ? {} : { clientName: deps.clientName }),
+    });
+}
+/** Load verified trust and resume a prior ambiguous enrollment before prompting. */
+export async function resumeLocalBorgServerEnrollment(origin, deps = {}) {
+    const trust = await (deps.loadTrust ?? loadBorgServerTrust)(origin);
+    return resumeBorgServerEnrollment(origin, trust.identity, {
+        fetchImpl: trust.fetchImpl,
+        ...(deps.loadPendingEnrollment === undefined
+            ? {}
+            : { loadPendingEnrollment: deps.loadPendingEnrollment }),
+        ...(deps.onPending === undefined ? {} : { onPending: deps.onPending }),
+    });
+}
+/** Advisory discovery that still verifies the server-owned CA. */
+export async function probeLocalBorgServer(origin) {
+    try {
+        const trust = await loadBorgServerTrust(origin);
+        return await probeBorgServer(origin, trust.fetchImpl);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=server-handshake.js.map

package/dist/server-handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-handshake.js","sourceRoot":"","sources":["../src/server-handshake.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACV,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,gCAAgC,EAChC,+BAA+B,EAC/B,wCAAwC,EACxC,2BAA2B,EAC3B,0BAA0B,EAC1B,SAAS,GAIV,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,oCAAoC,EACpC,kCAAkC,GAEnC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,OAAO,GAKR,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EACL,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAiC,CAAC;AAI7E,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,YAAuB,KAAK,EAC5B,SAAS,GAAG,GAAG;IAEf,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;YAClE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,QAAkB,EAAE,MAAoB,EAAE,EAAE,CACrE,uBAAuB,CACrB,QAAQ,EACR,oBAAoB,EACpB,4DAA4D,EAC5D,MAAM,CACP,CAAC;AAEJ,KAAK,UAAU,4BAA4B,CAAC,QAAkB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC1E,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,YAAuB,KAAK;IAE5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE;YACzE,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AA4ED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,aAAqB,EACrB,gBAAwB,EACxB,OAKC,EACD,aAAqB,EACrB,OAMI,EAAE;IAEN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,gBAAgB,EAAE;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,UAAU,EAAE,EAAE;gBAC7D,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,kBAAkB,EAAE,OAAO,CAAC,UAAU;gBACtC,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;aAC9C,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvD,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,IAAI,YAAmC,CAAC;gBACxC,IAAI,CAAC;oBACH,YAAY,GAAG,2BAA2B,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC,KAAK,CAAC,IAAI,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY,GAAG,SAAS,CAAC;gBAC3B,CAAC;gBACD,IAAI,YAAY,KAAK,SAAS,CAAC,gBAAgB,EAAE,CAAC;oBAChD,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gFAAgF,CACjF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,OAAmE,CAAC;QACxE,IAAI,CAAC;YACH,OAAO,GAAG,4BAA4B,CACpC,IAAI,CAAC,KAAK,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CACjE,CAAC,OAAO,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG;YAChB,MAAM;YACN,aAAa;YACb,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACF,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,oBAAoB,IAAI,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1F,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE;gBACP,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;aACtC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa;YACb,mBAAmB;YACnB,+EAA+E;YAC/E,gFAAgF;YAChF,+EAA+E;YAC/E,8EAA8E;YAC9E,2EAA2E;YAC3E,4DAA4D;YAC5D,QAAQ,EAAE,CAAC,OAAoB,EAAE,EAAE,CACjC,CAAC,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC,CAAC;gBAC5C,GAAG,SAAS;gBACZ,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;gBACzB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;gBAC7B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;gBACrC,qBAAqB,EAAE,mBAAmB;gBAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;YACJ,6EAA6E;YAC7E,sEAAsE;YACtE,0BAA0B;YAC1B,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC,CACzD,aAAa,EACb,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACjD,mBAAmB,CACpB;YACD,+EAA+E;YAC/E,gFAAgF;YAChF,8EAA8E;YAC9E,8EAA8E;YAC9E,WAAW,EAAE,CAAC,OAAoB,EAAE,EAAE,CACpC,CAAC,IAAI,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;gBAC9C,GAAG,SAAS;gBACZ,qBAAqB,EAAE,mBAAmB;gBAC1C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;gBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC;SACL,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,sFAAsF;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,aAAqB,EACrB,UAAkB,EAClB,OAMI,EAAE;IAEN,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,kCAAkC,CAAC,CAAC;QACnF,MAAM;QACN,aAAa;QACb,UAAU;QACV,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,iBAAiB,EAAE,OAAO,CAAC,UAAU;QACrC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,kBAA2B,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAAE;gBACzE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;aACpE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,kBAAkB,CAAC;IAExC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,4BAA4B,CAAC,CACjE,MAAM,EACN,aAAa,EACb,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uCAAuC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAoE,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,GAAG,wCAAwC,CAChD,IAAI,CAAC,KAAK,CAAC,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,MAAM,KAAK,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,CAAC;QACjE,MAAM;QACN,aAAa;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACnC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;KACxD,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,UAAU;QACzB,aAAa;QACb,QAAQ;QACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACnC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB;KACxD,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,aAAqB,EACrB,OAMI,EAAE;IAEN,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,0BAA0B,CAAC,CAC9E,MAAM,EACN,aAAa,CACd,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;IACnB,OAAO,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE;QACjE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO;QACtC,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5D,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,aAAqB,EACrB,gBAAwB,EACxB,KAA4C,EAC5C,OAKI,EAAE;IAEN,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,IAAI,yBAAyB,CAAC,CAC3E,MAAM,EACN,aAAa,CACd,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,CAAC;QACtD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,oCAAoC,CAAC,CAAC;QACvF,MAAM;QACN,aAAa;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,IAAI,QAAQ,GAAoB,IAAI,CAAC;IACrC,IAAI,kBAA2B,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,gBAAgB,EAAE;iBAC5C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;aACpE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kBAAkB,GAAG,KAAK,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,MAAM,kBAAkB,CAAC;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACvB,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAA4D,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,GAAG,gCAAgC,CACxC,IAAI,CAAC,KAAK,CAAC,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CACzD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,MAAM,KAAK,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,8BAA8B,CAAC,CAC9D,OAA0C,CAC3C,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAAqB,EACrB,gBAAwB,EACxB,KAA4C,EAC5C,OAAmD,EAAE;IAErD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE;QAC1E,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,aAAqB,EACrB,OAII,EAAE;IAEN,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB;QACtC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC,cAAc;YACnB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,yBAAyB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,CACpF,MAAM,EACN,aAAa,CACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IAC/E,OAAO;QACL,KAAK;QACL,aAAa;QACb,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB;QACtC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC,cAAc;YACnB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,CACpF,MAAM,EACN,KAAK,CAAC,QAAQ,CACf,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,cAAc,EACd,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;QACvD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;QACrF,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,UAAkB,EAClB,OAMI,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9F,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjG,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;KAC1E,CAAC,CAAC;AACL,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAc,EACd,OAII,EAAE;IAEN,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;QACxD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;KACvE,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/server-response.d.ts

@@ -0,0 +1,3 @@
+/** Read one server response without trusting Content-Length or stream EOF. */
+export declare function readBoundedResponseBody(response: Response, maxBytes: number, limitMessage: string, signal?: AbortSignal): Promise<string>;
+//# sourceMappingURL=server-response.d.ts.map

package/dist/server-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-response.d.ts","sourceRoot":"","sources":["../src/server-response.ts"],"names":[],"mappings":"AA0BA,8EAA8E;AAC9E,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CA2CjB"}

package/dist/server-response.js

@@ -0,0 +1,67 @@
+function abortError(signal) {
+    return signal.reason instanceof Error
+        ? signal.reason
+        : new Error('Borg server request was aborted');
+}
+async function readWithAbort(reader, signal) {
+    if (!signal)
+        return reader.read();
+    if (signal.aborted)
+        throw abortError(signal);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortError(signal));
+        signal.addEventListener('abort', onAbort, { once: true });
+        reader.read().then(resolve, reject).finally(() => {
+            signal.removeEventListener('abort', onAbort);
+        });
+    });
+}
+/** Read one server response without trusting Content-Length or stream EOF. */
+export async function readBoundedResponseBody(response, maxBytes, limitMessage, signal) {
+    const declaredLength = response.headers.get('content-length');
+    if (declaredLength !== null) {
+        const parsed = Number(declaredLength);
+        if (!Number.isSafeInteger(parsed) || parsed < 0 || parsed > maxBytes) {
+            await response.body?.cancel().catch(() => { });
+            throw new Error(limitMessage);
+        }
+    }
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await readWithAbort(reader, signal);
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => { });
+                throw new Error(limitMessage);
+            }
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        await reader.cancel(error).catch(() => { });
+        throw error;
+    }
+    finally {
+        try {
+            reader.releaseLock();
+        }
+        catch {
+            // The stream may already be canceled.
+        }
+    }
+    const body = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(body);
+}
+//# sourceMappingURL=server-response.js.map

package/dist/server-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-response.js","sourceRoot":"","sources":["../src/server-response.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,MAAmB;IACrC,OAAO,MAAM,CAAC,MAAM,YAAY,KAAK;QACnC,CAAC,CAAC,MAAM,CAAC,MAAM;QACf,CAAC,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACnD,CAAC;AAMD,KAAK,UAAU,aAAa,CAC1B,MAA+C,EAC/C,MAAoB;IAEpB,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAE7C,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/C,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,QAAgB,EAChB,YAAoB,EACpB,MAAoB;IAEpB,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YACrE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC"}

package/dist/server-trust.d.ts

@@ -0,0 +1,14 @@
+export type ServerFetch = typeof fetch;
+export interface BorgServerTrust {
+    identity: string;
+    fetchImpl: ServerFetch;
+}
+/**
+ * Minimal fetch-compatible HTTPS transport bound to one origin and one
+ * explicit local CA. Node's global fetch cannot consume the server-owned CA,
+ * and disabling certificate validation would collapse the authority boundary.
+ */
+export declare function createPinnedServerFetch(origin: string, caCertificate: string): ServerFetch;
+export declare function loadBorgServerTrust(origin: string, dataDirectory?: string): Promise<BorgServerTrust>;
+export declare function __clearServerTrustCacheForTest(): void;
+//# sourceMappingURL=server-trust.d.ts.map

package/dist/server-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-trust.d.ts","sourceRoot":"","sources":["../src/server-trust.ts"],"names":[],"mappings":"AA0CA,MAAM,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB;AAyFD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,WAAW,CA0E1F;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,aAAa,SAAwB,GACpC,OAAO,CAAC,eAAe,CAAC,CAoB1B;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}