cordisx 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/src/launcher/local-wallet-authority.js

@@ -0,0 +1,370 @@
+import { localWorkSettlementReceipt } from '@cordisx/protocol/local-work-settlement/v1';
+import { createHash, createPublicKey, randomBytes, sign, verify } from 'node:crypto';
+import { localWalletBinding, localWalletBytes, localWalletChallenge } from '@cordisx/protocol/local-wallet/v1';
+import { MANAGED_SOURCE_KEYCHAIN_SERVICE } from './managed-source-authority.js';
+import { HttpNativeCallingContextUnavailableError, } from './plugin-http-native-account-diagnostics.js';
+import { LOCAL_WALLET_KEYCHAIN_SERVICE, localWalletPrivateKey, localWalletRealm, } from './local-wallet-registry.js';
+const object = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid local wallet object');
+    return value;
+};
+function signature(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{86}$/u.test(value)) {
+        throw new Error('invalid local wallet signature');
+    }
+    const bytes = Buffer.from(value, 'base64url');
+    if (bytes.length !== 64 || bytes.toString('base64url') !== value)
+        throw new Error('invalid local wallet signature');
+    return bytes;
+}
+/** Independent local authority. Native reads occur exclusively during original-account enrollment. */
+export class LocalWalletAuthority {
+    options;
+    disposed = false;
+    operations = new Set();
+    queues = new Map();
+    leases = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    trust(principal, binding, trusts) {
+        const audience = binding.audience === 'local-work-income' ? 'work-income' : 'source-account';
+        const trust = trusts.find(entry => entry.owner.pluginId === principal.identity.pluginId && entry.owner.source === principal.identity.source
+            && entry.binding.origin === binding.origin && entry.binding.instanceId === binding.instanceId
+            && entry.binding.sourceId === binding.sourceId && entry.binding.audience === audience);
+        if (!trust)
+            throw new Error('local wallet owner not provisioned');
+        return trust;
+    }
+    current(profile) {
+        return !this.disposed && this.options.registry.current(profile);
+    }
+    closeOwner(principal) {
+        const prefix = JSON.stringify(principal);
+        for (const key of this.leases.keys())
+            if (key.startsWith(prefix + ':'))
+                this.leases.delete(key);
+    }
+    async execute(principal, raw, deadline, active, enrollment, readWork, settlement = false) {
+        const input = object(raw);
+        if (Object.keys(input).some(key => !(settlement
+            ? ['origin', 'sourceId', 'instanceId', 'audience']
+            : ['origin', 'sourceId', 'instanceId', 'audience', 'baseline']).includes(key))
+            || (input.baseline !== undefined && (input.baseline !== true || settlement)))
+            throw new Error('invalid local wallet input');
+        const binding = localWalletBinding(input), work = binding.audience === 'local-work-income';
+        if (!!enrollment !== (binding.audience === 'local-wallet-enrollment') || (!work && input.baseline !== undefined)
+            || (settlement && !work)) {
+            throw new Error('invalid local wallet operation');
+        }
+        if (!Number.isSafeInteger(deadline) || deadline <= Date.now() || deadline > Date.now() + 15_000) {
+            throw new Error('invalid local wallet deadline');
+        }
+        const queueKey = localWalletRealm(binding);
+        if (this.queues.size >= 64 && !this.queues.has(queueKey))
+            throw new Error('local wallet queue limit');
+        const abort = new AbortController();
+        this.operations.add(abort);
+        let reject;
+        const expired = new Promise((_, fail) => {
+            reject = fail;
+        });
+        const timeout = setTimeout(() => abort.abort(), deadline - Date.now());
+        const retire = () => reject(new Error('local wallet operation retired'));
+        abort.signal.addEventListener('abort', retire, { once: true });
+        const leaseKey = JSON.stringify(principal) + ':' + queueKey;
+        let operationLease;
+        const clearOperationLease = () => {
+            if (operationLease && this.leases.get(leaseKey) === operationLease)
+                this.leases.delete(leaseKey);
+        };
+        const prior = this.queues.get(queueKey) ?? Promise.resolve();
+        const run = prior.catch(() => { }).then(async () => {
+            const live = () => {
+                if (abort.signal.aborted || this.disposed || !active() || !this.options.live(principal) || Date.now() >= deadline)
+                    throw new Error('local wallet operation retired');
+            };
+            live();
+            const trust = this.trust(principal, binding, await this.options.trusts());
+            live();
+            let profile, nativeAccount;
+            if (enrollment) {
+                const account = await enrollment.account();
+                live();
+                if (account instanceof HttpNativeCallingContextUnavailableError)
+                    throw account;
+                if (!account)
+                    throw new Error('original account unavailable');
+                nativeAccount = account;
+                const preparationGuard = () => {
+                    live();
+                    const currentTrust = this.trust(principal, binding, this.options.trustsNow());
+                    if (currentTrust.signingKeyRef !== trust.signingKeyRef || currentTrust.serverPublicKey !== trust.serverPublicKey)
+                        throw new Error('local wallet server trust retired');
+                };
+                const preparationFence = async () => {
+                    preparationGuard();
+                    const current = await enrollment.account();
+                    preparationGuard();
+                    if (current instanceof HttpNativeCallingContextUnavailableError)
+                        throw current;
+                    if (current !== nativeAccount)
+                        throw new Error('original account retired');
+                };
+                profile = await this.options.registry.prepare(binding, 'codex:' + createHash('sha256').update(account).digest('base64url'), trust.serverPublicKey, preparationFence, preparationGuard);
+            }
+            else
+                profile = this.options.registry.active(binding);
+            let custodyGuard;
+            let workProfileGuard;
+            const publicationGuard = () => {
+                if (abort.signal.aborted || this.disposed || !this.options.live(principal) || Date.now() >= deadline) {
+                    throw new Error('local wallet publication retired');
+                }
+                custodyGuard?.();
+                workProfileGuard?.();
+                if (!this.current(profile))
+                    throw new Error('local wallet delegation retired');
+                const currentTrust = this.trust(principal, binding, this.options.trustsNow());
+                if (currentTrust.signingKeyRef !== trust.signingKeyRef || currentTrust.serverPublicKey !== trust.serverPublicKey)
+                    throw new Error('local wallet server trust retired');
+                const entry = profile.entries.find(entry => entry.realm === localWalletRealm(binding));
+                if (!work && entry.serverPublicKey !== trust.serverPublicKey)
+                    throw new Error('local wallet realm key mismatch');
+            };
+            const synchronousFence = () => {
+                live();
+                publicationGuard();
+            };
+            const fence = async () => {
+                synchronousFence();
+                if (enrollment) {
+                    const current = await enrollment.account();
+                    synchronousFence();
+                    if (current instanceof HttpNativeCallingContextUnavailableError)
+                        throw current;
+                    if (current !== nativeAccount)
+                        throw new Error('original account retired');
+                }
+            };
+            const monitor = setInterval(() => {
+                try {
+                    synchronousFence();
+                }
+                catch {
+                    abort.abort();
+                }
+            }, 100);
+            const stop = () => clearInterval(monitor);
+            abort.signal.addEventListener('abort', stop, { once: true });
+            if (work && !settlement)
+                operationLease = this.leases.get(leaseKey);
+            try {
+                const request = async (path, body, bearer) => {
+                    await fence();
+                    synchronousFence();
+                    const response = await this.options.fetch(binding.origin + path, {
+                        method: body === undefined ? 'GET' : 'POST',
+                        redirect: 'manual',
+                        credentials: 'omit',
+                        signal: abort.signal,
+                        headers: {
+                            'content-type': 'application/json',
+                            accept: 'application/json',
+                            ...(bearer === undefined ? {} : { authorization: 'Bearer ' + bearer }),
+                        },
+                        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+                    });
+                    if (response.status < 200 || response.status >= 300) {
+                        await response.body?.cancel();
+                        throw new Error('local wallet server rejected');
+                    }
+                    const reader = response.body?.getReader(), chunks = [];
+                    let size = 0;
+                    if (reader) {
+                        while (true) {
+                            const next = await reader.read();
+                            if (next.done)
+                                break;
+                            size += next.value.byteLength;
+                            if (size > 1_048_576) {
+                                await reader.cancel();
+                                throw new Error('local wallet response too large');
+                            }
+                            chunks.push(next.value);
+                        }
+                    }
+                    await fence();
+                    synchronousFence();
+                    return { body: object(JSON.parse(Buffer.concat(chunks).toString('utf8'))), statusCode: response.status };
+                };
+                const challengeResponse = await request('/v1/auth/host/challenge?'
+                    + new URLSearchParams({
+                        sourceId: binding.sourceId,
+                        instanceId: binding.instanceId,
+                        audience: binding.audience,
+                    }).toString());
+                const envelope = challengeResponse.body;
+                if (Object.keys(envelope).some(key => !['payload', 'signature'].includes(key))) {
+                    throw new Error('invalid local challenge envelope');
+                }
+                const challenge = localWalletChallenge(envelope.payload, binding);
+                if (!verify(null, localWalletBytes(challenge), trust.serverPublicKey, signature(envelope.signature))) {
+                    throw new Error('invalid local challenge signature');
+                }
+                let workSnapshot;
+                let payload = {
+                    ...challenge,
+                    contract: 'cordisx.local-wallet-assertion/v1',
+                    subject: profile.subject,
+                };
+                if (enrollment) {
+                    payload = {
+                        ...payload,
+                        contract: 'cordisx.local-wallet-enrollment/v1',
+                        nativeSubject: 'codex:' + createHash('sha256').update(nativeAccount).digest('base64url'),
+                        publicKey: profile.publicKey,
+                    };
+                }
+                else if (work) {
+                    if (!readWork)
+                        throw new Error('classified work unavailable');
+                    const snapshot = await readWork();
+                    await fence();
+                    if (snapshot.status !== 'ready')
+                        throw new Error('classified work unavailable');
+                    workSnapshot = snapshot;
+                    workProfileGuard = () => {
+                        if (readWork.current?.(snapshot) === false)
+                            throw new Error('work profile continuity retired');
+                    };
+                    synchronousFence();
+                    const custody = this.options.custody;
+                    if (settlement) {
+                        if (!custody)
+                            throw new Error('settlement custody unavailable');
+                        const accountId = profile.entries.find(entry => entry.realm === localWalletRealm(binding)).accountId;
+                        await custody.claim(snapshot.scopeId, binding, accountId, profile.subject, synchronousFence);
+                        custodyGuard = () => custody.assert(snapshot.scopeId, binding, accountId, profile.subject);
+                        synchronousFence();
+                        payload = { ...payload, contract: 'cordisx.local-work-settlement/v1', snapshot };
+                    }
+                    else {
+                        await custody?.claimLegacy(snapshot.scopeId, synchronousFence);
+                        custodyGuard = () => {
+                            if (custody && !custody.legacyAllowed(snapshot.scopeId)) {
+                                throw new Error('durable settlement policy conflict');
+                            }
+                        };
+                        synchronousFence();
+                        const priorLease = this.leases.get(leaseKey), now = Date.now();
+                        const baseline = input.baseline === true || !priorLease || priorLease.revision !== profile.revision
+                            || now - priorLease.observed > 15_000;
+                        if (this.leases.size >= 128 && !priorLease)
+                            throw new Error('local work lease limit');
+                        const lease = baseline
+                            ? { id: randomBytes(32).toString('base64url'), observed: now, revision: profile.revision }
+                            : { ...priorLease, observed: now };
+                        payload = {
+                            ...payload,
+                            contract: 'cordisx.local-work-observation/v1',
+                            snapshot,
+                            leaseId: lease.id,
+                            continuity: baseline ? 'baseline' : 'continuous',
+                        };
+                        lease.observed = now;
+                        this.leases.set(leaseKey, lease);
+                        operationLease = lease;
+                    }
+                }
+                const privateKey = await this.options.keychain.read(enrollment ? MANAGED_SOURCE_KEYCHAIN_SERVICE : LOCAL_WALLET_KEYCHAIN_SERVICE, enrollment ? trust.signingKeyRef : profile.keyRef);
+                await fence();
+                const key = localWalletPrivateKey(privateKey);
+                if (!enrollment
+                    && createPublicKey(key).export({ type: 'spki', format: 'der' }).toString('base64') !== profile.publicKey)
+                    throw new Error('local wallet key mismatch');
+                localWalletChallenge(challenge, binding);
+                const signed = { payload, signature: sign(null, localWalletBytes(payload), key).toString('base64url') };
+                let bearer;
+                if (enrollment) {
+                    bearer = await enrollment.bearer();
+                    await fence();
+                    profile = await this.options.registry.transition(profile, localWalletRealm(binding), 'submitted', undefined, undefined, fence, synchronousFence);
+                    await fence();
+                }
+                const response = await request(enrollment
+                    ? '/v1/auth/host/local-wallet/enroll'
+                    : settlement
+                        ? '/v1/income/work/settle'
+                        : work
+                            ? '/v1/income/work'
+                            : '/v1/auth/host/session', signed, bearer);
+                const result = object(response.body.payload);
+                if (Object.keys(response.body).some(key => !['payload', 'signature'].includes(key))
+                    || Object.keys(result).some(key => !['contract', 'origin', 'sourceId', 'instanceId', 'audience', 'nonce', 'subject', 'nativeSubject', 'result']
+                        .includes(key)) || result.contract !== 'cordisx.local-wallet-result/v1' || result.nonce !== challenge.nonce
+                    || result.subject !== profile.subject
+                    || (enrollment ? result.nativeSubject !== payload.nativeSubject : result.nativeSubject !== undefined)
+                    || Object.keys(binding).some(key => result[key] !== binding[key])
+                    || !verify(null, localWalletBytes(result), trust.serverPublicKey, signature(response.body.signature)))
+                    throw new Error('invalid local wallet result signature');
+                await fence();
+                if (enrollment
+                    && (object(result.result).enrolled !== true || object(result.result).instanceId !== binding.instanceId
+                        || object(object(result.result).account).id !== enrollment.originalAccountId))
+                    throw new Error('local wallet enrollment account mismatch');
+                if (enrollment) {
+                    profile = await this.options.registry.transition(profile, localWalletRealm(binding), 'active', JSON.stringify(response.body), enrollment.originalAccountId, fence, synchronousFence);
+                }
+                if (!enrollment && !work
+                    && (object(result.result).instanceId !== binding.instanceId
+                        || object(object(result.result).account).id
+                            !== profile.entries.find(entry => entry.realm === localWalletRealm(binding)).accountId))
+                    throw new Error('local wallet account mismatch');
+                if (work) {
+                    const wallet = object(object(result.result).wallet);
+                    if (wallet.origin !== binding.origin || wallet.instanceId !== binding.instanceId
+                        || wallet.accountId !== profile.entries.find(entry => entry.realm === localWalletRealm(binding)).accountId)
+                        throw new Error('local work wallet mismatch');
+                    if (settlement) {
+                        localWorkSettlementReceipt(object(result.result).receipt, workSnapshot, binding, String(wallet.accountId));
+                    }
+                }
+                synchronousFence();
+                return { body: object(result.result), statusCode: response.statusCode, profile, publicationGuard };
+            }
+            catch (error) {
+                if (work)
+                    clearOperationLease();
+                throw error;
+            }
+            finally {
+                stop();
+                abort.signal.removeEventListener('abort', stop);
+            }
+        });
+        this.queues.set(queueKey, run);
+        void run.finally(() => {
+            if (this.queues.get(queueKey) === run)
+                this.queues.delete(queueKey);
+        }).catch(() => { });
+        try {
+            return await Promise.race([run, expired]);
+        }
+        finally {
+            clearTimeout(timeout);
+            abort.signal.removeEventListener('abort', retire);
+            this.operations.delete(abort);
+            if (work && abort.signal.aborted)
+                clearOperationLease();
+        }
+    }
+    dispose() {
+        this.disposed = true;
+        for (const abort of this.operations)
+            abort.abort();
+        this.leases.clear();
+    }
+}
+//# sourceMappingURL=local-wallet-authority.js.map

package/dist/src/launcher/local-wallet-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-wallet-authority.js","sourceRoot":"","sources":["../../../src/launcher/local-wallet-authority.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAA;AACvF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAM9G,OAAO,EAAE,+BAA+B,EAA2B,MAAM,+BAA+B,CAAA;AACxG,OAAO,EAEL,wCAAwC,GACzC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EAErB,gBAAgB,GAEjB,MAAM,4BAA4B,CAAA;AACnC,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC/G,OAAO,KAAgC,CAAA;AACzC,CAAC,CAAA;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACnH,OAAO,KAAK,CAAA;AACd,CAAC;AACD,sGAAsG;AACtG,MAAM,OAAO,oBAAoB;IAMZ;IALX,QAAQ,GAAG,KAAK,CAAA;IACP,UAAU,GAAG,IAAI,GAAG,EAAmB,CAAA;IACvC,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC5C,MAAM,GAAG,IAAI,GAAG,EAA8D,CAAA;IAC/F,YACmB,OAQhB;QARgB,YAAO,GAAP,OAAO,CAQvB;IACA,CAAC;IACI,KAAK,CACX,SAAiC,EACjC,OAA6B,EAC7B,MAAqC;QAErC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAA;QAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAChC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM;eACrG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;eAC1F,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CACtF,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACjE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CAAC,OAA2B;QACjC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,CAAC;IACD,UAAU,CAAC,SAAiC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACjG,CAAC;IACD,KAAK,CAAC,OAAO,CACX,SAAiC,EACjC,GAAY,EACZ,QAAgB,EAChB,MAAqB,EACrB,UAIC,EACD,QAA0B,EAC1B,UAAU,GAAG,KAAK;QAElB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5B,CAAC,CAAC,UAAU;YACV,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC;YAClD,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChF;eACE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,mBAAmB,CAAA;QAC1F,IACE,CAAC,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,yBAAyB,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;eACzG,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACrG,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAA;QACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,MAA+B,CAAA;QACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;YAC7C,MAAM,GAAG,IAAI,CAAA;QACf,CAAC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAA;QACxE,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,QAAQ,CAAA;QAC3D,IAAI,cAA8E,CAAA;QAClF,MAAM,mBAAmB,GAAG,GAAG,EAAE;YAC/B,IAAI,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAClG,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;QAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAChD,MAAM,IAAI,GAAG,GAAG,EAAE;gBAChB,IACE,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAC7G,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACrD,CAAC,CAAA;YACD,IAAI,EAAE,CAAA;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACzE,IAAI,EAAE,CAAA;YACN,IAAI,OAA2B,EAAE,aAAiC,CAAA;YAClE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAA;gBAC1C,IAAI,EAAE,CAAA;gBACN,IAAI,OAAO,YAAY,wCAAwC;oBAAE,MAAM,OAAO,CAAA;gBAC9E,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBAC7D,aAAa,GAAG,OAAO,CAAA;gBACvB,MAAM,gBAAgB,GAAG,GAAG,EAAE;oBAC5B,IAAI,EAAE,CAAA;oBACN,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;oBAC7E,IACE,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;wBAC5G,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACxD,CAAC,CAAA;gBACD,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;oBAClC,gBAAgB,EAAE,CAAA;oBAClB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAA;oBAC1C,gBAAgB,EAAE,CAAA;oBAClB,IAAI,OAAO,YAAY,wCAAwC;wBAAE,MAAM,OAAO,CAAA;oBAC9E,IAAI,OAAO,KAAK,aAAa;wBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC5E,CAAC,CAAA;gBACD,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAC3C,OAAO,EACP,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EACnE,KAAK,CAAC,eAAe,EACrB,gBAAgB,EAChB,gBAAgB,CACjB,CAAA;YACH,CAAC;;gBAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACtD,IAAI,YAAsC,CAAA;YAC1C,IAAI,gBAA0C,CAAA;YAC9C,MAAM,gBAAgB,GAAG,GAAG,EAAE;gBAC5B,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;oBACrG,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;gBACrD,CAAC;gBACD,YAAY,EAAE,EAAE,CAAA;gBAChB,gBAAgB,EAAE,EAAE,CAAA;gBACpB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;gBAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;gBAC7E,IACE,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;oBAC5G,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAAE,CAAA;gBACvF,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAClH,CAAC,CAAA;YACD,MAAM,gBAAgB,GAAG,GAAG,EAAE;gBAC5B,IAAI,EAAE,CAAA;gBACN,gBAAgB,EAAE,CAAA;YACpB,CAAC,CAAA;YACD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;gBACvB,gBAAgB,EAAE,CAAA;gBAClB,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,CAAA;oBAC1C,gBAAgB,EAAE,CAAA;oBAClB,IAAI,OAAO,YAAY,wCAAwC;wBAAE,MAAM,OAAO,CAAA;oBAC9E,IAAI,OAAO,KAAK,aAAa;wBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;gBAC5E,CAAC;YACH,CAAC,CAAA;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC/B,IAAI,CAAC;oBACH,gBAAgB,EAAE,CAAA;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,KAAK,EAAE,CAAA;gBACf,CAAC;YACH,CAAC,EAAE,GAAG,CAAC,CAAA;YACP,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;YACzC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC5D,IAAI,IAAI,IAAI,CAAC,UAAU;gBAAE,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,MAAe,EAAE,EAAE;oBACtE,MAAM,KAAK,EAAE,CAAA;oBACb,gBAAgB,EAAE,CAAA;oBAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,EAAE;wBAC/D,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;wBAC3C,QAAQ,EAAE,QAAQ;wBAClB,WAAW,EAAE,MAAM;wBACnB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,MAAM,EAAE,kBAAkB;4BAC1B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,GAAG,MAAM,EAAE,CAAC;yBACvE;wBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;qBAC9D,CAAC,CAAA;oBACF,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;wBACpD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;wBAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;oBACjD,CAAC;oBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,GAAiB,EAAE,CAAA;oBACpE,IAAI,IAAI,GAAG,CAAC,CAAA;oBACZ,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;4BAChC,IAAI,IAAI,CAAC,IAAI;gCAAE,MAAK;4BACpB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAA;4BAC7B,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;gCACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;gCACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;4BACpD,CAAC;4BACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;wBACzB,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,EAAE,CAAA;oBACb,gBAAgB,EAAE,CAAA;oBAClB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;gBAC1G,CAAC,CAAA;gBACD,MAAM,iBAAiB,GAAG,MAAM,OAAO,CACrC,0BAA0B;sBACtB,IAAI,eAAe,CAAC;wBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;wBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B,CAAC,CAAC,QAAQ,EAAE,CAChB,CAAA;gBACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAA;gBACvC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC/E,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;gBACrD,CAAC;gBACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;oBACrG,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACtD,CAAC;gBACD,IAAI,YAA2E,CAAA;gBAC/E,IAAI,OAAO,GAA4B;oBACrC,GAAG,SAAS;oBACZ,QAAQ,EAAE,mCAAmC;oBAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAA;gBACD,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,GAAG;wBACR,GAAG,OAAO;wBACV,QAAQ,EAAE,oCAAoC;wBAC9C,aAAa,EAAE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;wBACzF,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B,CAAA;gBACH,CAAC;qBAAM,IAAI,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;oBAC7D,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAA;oBACjC,MAAM,KAAK,EAAE,CAAA;oBACb,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;oBAC/E,YAAY,GAAG,QAAQ,CAAA;oBACvB,gBAAgB,GAAG,GAAG,EAAE;wBACtB,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK;4BAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;oBAChG,CAAC,CAAA;oBACD,gBAAgB,EAAE,CAAA;oBAClB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;oBACpC,IAAI,UAAU,EAAE,CAAC;wBACf,IAAI,CAAC,OAAO;4BAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;wBAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAAE,CAAC,SAAU,CAAA;wBACtG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;wBAC5F,YAAY,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;wBAC1F,gBAAgB,EAAE,CAAA;wBAClB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,kCAAkC,EAAE,QAAQ,EAAE,CAAA;oBAClF,CAAC;yBAAM,CAAC;wBACN,MAAM,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;wBAC9D,YAAY,GAAG,GAAG,EAAE;4BAClB,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gCACxD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;4BACvD,CAAC;wBACH,CAAC,CAAA;wBACD,gBAAgB,EAAE,CAAA;wBAClB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;wBAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;+BAC9F,GAAG,GAAG,UAAU,CAAC,QAAQ,GAAG,MAAM,CAAA;wBACvC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,UAAU;4BAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;wBACrF,MAAM,KAAK,GAAG,QAAQ;4BACpB,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;4BAC1F,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAA;wBACpC,OAAO,GAAG;4BACR,GAAG,OAAO;4BACV,QAAQ,EAAE,mCAAmC;4BAC7C,QAAQ;4BACR,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;yBACjD,CAAA;wBACD,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAA;wBACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;wBAChC,cAAc,GAAG,KAAK,CAAA;oBACxB,CAAC;gBACH,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CACjD,UAAU,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,6BAA6B,EAC5E,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAClD,CAAA;gBACD,MAAM,KAAK,EAAE,CAAA;gBACb,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAA;gBAC7C,IACE,CAAC,UAAU;uBACR,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,SAAS;oBACxG,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;gBAC9C,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;gBACxC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;gBACvG,IAAI,MAA0B,CAAA;gBAC9B,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,CAAA;oBAClC,MAAM,KAAK,EAAE,CAAA;oBACb,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAC9C,OAAO,EACP,gBAAgB,CAAC,OAAO,CAAC,EACzB,WAAW,EACX,SAAS,EACT,SAAS,EACT,KAAK,EACL,gBAAgB,CACjB,CAAA;oBACD,MAAM,KAAK,EAAE,CAAA;gBACf,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,UAAU;oBACR,CAAC,CAAC,mCAAmC;oBACrC,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,wBAAwB;wBAC1B,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,iBAAiB;4BACnB,CAAC,CAAC,uBAAuB,EAC3B,MAAM,EACN,MAAM,CACP,CAAA;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBAC5C,IACE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;uBAC5E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAChC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,QAAQ,CAAC;yBACzG,QAAQ,CAAC,GAAG,CAAC,CACjB,IAAI,MAAM,CAAC,QAAQ,KAAK,gCAAgC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK;uBAC1F,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;uBAClC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC;uBAClG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAiC,CAAC,CAAC;uBAC5F,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrG,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;gBAC1D,MAAM,KAAK,EAAE,CAAA;gBACb,IACE,UAAU;uBACP,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;2BACjG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,iBAAiB,CAAC;oBAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;gBAC7D,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAC9C,OAAO,EACP,gBAAgB,CAAC,OAAO,CAAC,EACzB,QAAQ,EACR,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC7B,UAAU,CAAC,iBAAiB,EAC5B,KAAK,EACL,gBAAgB,CACjB,CAAA;gBACH,CAAC;gBACD,IACE,CAAC,UAAU,IAAI,CAAC,IAAI;uBACjB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;2BACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;gCACrC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAAE,CAAC,SAAS,CAAC;oBAC5F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBAClD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAA;oBACnD,IACE,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;2BACzE,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,CAAC,OAAO,CAAC,CAAE,CAAC,SAAS;wBAC3G,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;oBAC/C,IAAI,UAAU,EAAE,CAAC;wBACf,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,YAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;oBAC7G,CAAC;gBACH,CAAC;gBACD,gBAAgB,EAAE,CAAA;gBAClB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAA;YACpG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,IAAI;oBAAE,mBAAmB,EAAE,CAAA;gBAC/B,MAAM,KAAK,CAAA;YACb,CAAC;oBAAS,CAAC;gBACT,IAAI,EAAE,CAAA;gBACN,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACjD,CAAC;QACH,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC9B,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;QAC3C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC7B,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,mBAAmB,EAAE,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC;CACF"}

package/dist/src/launcher/local-wallet-http-operation.d.ts

@@ -0,0 +1,29 @@
+import type { HttpConnectionV1, HttpResultV1 } from '@cordisx/protocol/plugin-http/v1';
+import type { LocalWalletHttpResultV4 } from '@cordisx/protocol/plugin-http/v4';
+import type { WorkUsageReader } from './work-usage.js';
+import type { OwnerDocumentPrincipal } from './owner-document-rpc.js';
+import type { Grant } from './plugin-http-authority.js';
+import type { PluginHttpClientLifetime } from './plugin-http-client-lifetime.js';
+import type { LauncherKeychainBackend } from './secret-store.js';
+import { type HttpNativeAccountValue } from './plugin-http-native-account-diagnostics.js';
+import type { LocalWalletAuthority } from './local-wallet-authority.js';
+interface LocalWalletHttpOperationOptions {
+    readonly setPublicationGuard: (guard: () => void) => void;
+    readonly setNativeReadLive: (live: () => boolean) => void;
+    readonly input: Record<string, unknown>;
+    readonly principal: OwnerDocumentPrincipal;
+    readonly client: PluginHttpClientLifetime;
+    readonly clientLive: () => boolean;
+    readonly account: (() => Promise<HttpNativeAccountValue>) | undefined;
+    readonly readWork: WorkUsageReader | undefined;
+    readonly ownerKey: string;
+    readonly keychain: LauncherKeychainBackend;
+    readonly local: LocalWalletAuthority;
+    readonly grants: Map<string, Grant>;
+    readonly live: () => boolean;
+    readonly authorize: (principal: OwnerDocumentPrincipal, input: Record<string, unknown>, client: PluginHttpClientLifetime) => Promise<HttpResultV1<HttpConnectionV1>>;
+    readonly retire: (id: string, grant: Grant) => Promise<void>;
+}
+export declare function handleLocalWalletHttpOperation(options: LocalWalletHttpOperationOptions): Promise<LocalWalletHttpResultV4<unknown>>;
+export {};
+//# sourceMappingURL=local-wallet-http-operation.d.ts.map

package/dist/src/launcher/local-wallet-http-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-wallet-http-operation.d.ts","sourceRoot":"","sources":["../../../src/launcher/local-wallet-http-operation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AAChF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,6CAA6C,CAAA;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAYvE,UAAU,+BAA+B;IACvC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,IAAI,CAAA;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,OAAO,KAAK,IAAI,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,SAAS,CAAA;IACrE,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,CAAA;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAA;IAC1C,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,CAClB,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,wBAAwB,KAC7B,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7D;AACD,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAyB3C"}

package/dist/src/launcher/local-wallet-http-operation.js

@@ -0,0 +1,117 @@
+import { HttpNativeCallingContextUnavailableError, } from './plugin-http-native-account-diagnostics.js';
+const fail = (code) => ({
+    status: 'unavailable',
+    code,
+});
+const accepted = (value) => ({ status: 'accepted', value });
+const record = (value) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('invalid local wallet request');
+    return value;
+};
+export async function handleLocalWalletHttpOperation(options) {
+    const deadline = options.input.managedDeadline;
+    if (typeof deadline !== 'number' || !Number.isSafeInteger(deadline) || deadline > Date.now() + 15_000) {
+        return fail('invalid-request');
+    }
+    if (deadline <= Date.now())
+        return fail('deadline-exceeded');
+    let active = true;
+    let timer;
+    const expired = new Promise(resolve => {
+        timer = setTimeout(() => {
+            active = false;
+            resolve(fail('deadline-exceeded'));
+        }, deadline - Date.now());
+    });
+    options.setNativeReadLive(() => active && Date.now() < deadline && options.clientLive() && options.live());
+    const run = executeLocalWalletHttpOperation({
+        ...options,
+        live: () => active && Date.now() < deadline && options.live(),
+    });
+    try {
+        return await Promise.race([run, expired]);
+    }
+    finally {
+        active = false;
+        clearTimeout(timer);
+    }
+}
+async function executeLocalWalletHttpOperation(options) {
+    const { input, principal, client, clientLive, account, readWork } = options;
+    const enrolling = input.operation === 'plugin-http-enroll-local-wallet';
+    const request = record(input.input);
+    const binding = enrolling ? record(request.binding) : request;
+    if (binding.audience !== (enrolling
+        ? 'local-wallet-enrollment'
+        : ['plugin-http-submit-local-work', 'plugin-http-settle-local-work'].includes(String(input.operation))
+            ? 'local-work-income'
+            : 'local-wallet'))
+        return fail('invalid-request');
+    let enrollment;
+    let grantLive = () => true;
+    if (enrolling) {
+        if (Object.keys(request).some(name => !['binding', 'connection'].includes(name)) || !account) {
+            return fail('invalid-request');
+        }
+        const descriptor = record(request.connection), previous = options.grants.get(String(descriptor.id));
+        if (!previous || previous.client !== client || previous.owner !== options.ownerKey || !previous.nativeAccount
+            || !previous.nativeWalletAccountId || previous.retained || previous.localFence
+            || previous.connection.origin !== binding.origin || descriptor.origin !== previous.connection.origin
+            || descriptor.contract !== previous.connection.contract || descriptor.credential !== 'bearer'
+            || previous.connection.credential !== 'bearer')
+            return fail('connection-unavailable');
+        const pinned = previous.nativeAccount;
+        grantLive = () => options.grants.get(previous.connection.id) === previous && previous.nativeAccount === pinned;
+        const reader = account;
+        enrollment = {
+            originalAccountId: previous.nativeWalletAccountId,
+            account: async () => {
+                const value = await reader();
+                if (value instanceof HttpNativeCallingContextUnavailableError)
+                    throw value;
+                if (!grantLive() || value !== pinned)
+                    throw new Error('original grant retired');
+                return value;
+            },
+            bearer: async () => {
+                if (!grantLive())
+                    throw new Error('original grant retired');
+                return options.keychain.read(previous.keychainService, previous.connection.id);
+            },
+        };
+    }
+    const live = () => clientLive() && grantLive() && options.live();
+    const result = await options.local.execute(principal, binding, Number(input.managedDeadline), live, enrollment, readWork, input.operation === 'plugin-http-settle-local-work');
+    options.setPublicationGuard(result.publicationGuard);
+    result.publicationGuard();
+    if (!live() || !options.local.current(result.profile))
+        return fail('stale-generation');
+    const response = {
+        statusCode: result.statusCode,
+        contentType: 'application/json',
+        body: JSON.stringify(result.body),
+    };
+    if (input.operation !== 'plugin-http-connect-local-account')
+        return accepted(response);
+    const { sessionToken, ...safe } = result.body;
+    if (typeof sessionToken !== 'string' || result.body.instanceId !== binding.instanceId
+        || typeof record(result.body.account).id !== 'string' || !record(result.body.account).id)
+        return fail('invalid-request');
+    const authorized = await options.authorize(principal, {
+        origin: binding.origin,
+        credential: 'bearer',
+        secret: sessionToken,
+    }, client);
+    if (authorized.status !== 'accepted')
+        return authorized;
+    const grant = options.grants.get(authorized.value.id);
+    const local = options.local;
+    grant.localFence = () => local.current(result.profile);
+    if (!live() || !grant.localFence()) {
+        await options.retire(grant.connection.id, grant);
+        return fail('stale-generation');
+    }
+    return accepted({ connection: authorized.value, response: { ...response, body: JSON.stringify(safe) } });
+}
+//# sourceMappingURL=local-wallet-http-operation.js.map

package/dist/src/launcher/local-wallet-http-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-wallet-http-operation.js","sourceRoot":"","sources":["../../../src/launcher/local-wallet-http-operation.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,wCAAwC,GACzC,MAAM,6CAA6C,CAAA;AAEpD,MAAM,IAAI,GAAG,CACX,IAA6F,EACxE,EAAE,CAAC,CAAC;IACzB,MAAM,EAAE,aAAa;IACrB,IAAI;CACL,CAAC,CAAA;AACF,MAAM,QAAQ,GAAG,CAAI,KAAQ,EAAmB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;AAClF,MAAM,MAAM,GAAG,CAAC,KAAc,EAA2B,EAAE;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAChH,OAAO,KAAgC,CAAA;AACzC,CAAC,CAAA;AAsBD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAwC;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAA;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;QACtG,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAChC,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC5D,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,IAAI,KAAqC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAmC,OAAO,CAAC,EAAE;QACtE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,GAAG,KAAK,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAA;QACpC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAC1G,MAAM,GAAG,GAAG,+BAA+B,CAAC;QAC1C,GAAG,OAAO;QACV,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE;KAC9D,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3C,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,KAAK,CAAA;QACd,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AACD,KAAK,UAAU,+BAA+B,CAC5C,OAAwC;IAExC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,iCAAiC,CAAA;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC7D,IACE,OAAO,CAAC,QAAQ,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACtG,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,cAAc,CAAC;QACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAChC,IAAI,UAIS,CAAA;IACb,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAA;IAC1B,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAChC,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACnG,IACE,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,aAAa;eACtG,CAAC,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU;eAC3E,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,CAAC,MAAM;eACjG,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ;eAC1F,QAAQ,CAAC,UAAU,CAAC,UAAU,KAAK,QAAQ;YAC9C,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAA;QACrC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,MAAM,CAAA;QAC9G,MAAM,MAAM,GAAG,OAAO,CAAA;QACtB,UAAU,GAAG;YACX,iBAAiB,EAAE,QAAQ,CAAC,qBAAqB;YACjD,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAA;gBAC5B,IAAI,KAAK,YAAY,wCAAwC;oBAAE,MAAM,KAAK,CAAA;gBAC1E,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,KAAK,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;gBAC/E,OAAO,KAAK,CAAA;YACd,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,IAAI,CAAC,SAAS,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;gBAC3D,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;YAChF,CAAC;SACF,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CACxC,SAAS,EACT,OAAO,EACP,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAC7B,IAAI,EACJ,UAAU,EACV,QAAQ,EACR,KAAK,CAAC,SAAS,KAAK,+BAA+B,CACpD,CAAA;IACD,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpD,MAAM,CAAC,gBAAgB,EAAE,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACtF,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;KAClC,CAAA;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,mCAAmC;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;IAC7C,IACE,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;WAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;QACxF,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAChC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,YAAY;KACrB,EAAE,MAAM,CAAC,CAAA;IACV,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,UAAU,CAAA;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAE,CAAA;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,KAAK,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,QAAQ,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1G,CAAC"}

package/dist/src/launcher/local-wallet-registry.d.ts

@@ -0,0 +1,46 @@
+import type { LocalWalletBindingV1 } from '@cordisx/protocol/local-wallet/v1';
+import type { LauncherKeychainBackend } from './secret-store.js';
+export declare class LocalWalletStateError extends Error {
+    readonly code: 'local-wallet-not-enrolled' | 'local-wallet-reconciliation-required' | 'local-wallet-revoked';
+    constructor(code: 'local-wallet-not-enrolled' | 'local-wallet-reconciliation-required' | 'local-wallet-revoked');
+}
+export declare const LOCAL_WALLET_KEYCHAIN_SERVICE = "cordisx/local-wallet/v1";
+export interface LocalWalletEntry {
+    readonly realm: string;
+    readonly nativeSubject: string;
+    readonly serverPublicKey: string;
+    readonly status: 'prepared' | 'submitted' | 'active' | 'revoked';
+    readonly accountId?: string;
+    readonly receipt?: string;
+}
+export interface LocalWalletProfile {
+    readonly contract: 'cordisx.local-wallet-profile/v1';
+    readonly keyRef: string;
+    readonly publicKey: string;
+    readonly subject: string;
+    readonly revision: string;
+    readonly entries: readonly LocalWalletEntry[];
+}
+export declare const localWalletRealm: (binding: LocalWalletBindingV1) => string;
+export declare function localWalletPrivateKey(value: string): import("crypto").KeyObject;
+/** Host-private, profile-scoped delegation. Missing keys and unknown enrollment never recreate authority. */
+export declare class LocalWalletRegistry {
+    private readonly keychain;
+    private readonly file;
+    constructor(homeDir: string, profileId: string, keychain: LauncherKeychainBackend);
+    read(): LocalWalletProfile | undefined;
+    private mutation;
+    private write;
+    prepare(binding: LocalWalletBindingV1, nativeSubject: string, serverPublicKey: string, beforeCommit?: () => Promise<void>, guard?: () => void): Promise<LocalWalletProfile>;
+    transition(profile: LocalWalletProfile, realm: string, status: LocalWalletEntry['status'], receipt?: string, accountId?: string, beforeCommit?: () => Promise<void>, guard?: () => void): Promise<{
+        revision: string;
+        entries: LocalWalletEntry[];
+        contract: "cordisx.local-wallet-profile/v1";
+        keyRef: string;
+        publicKey: string;
+        subject: string;
+    }>;
+    active(binding: LocalWalletBindingV1): LocalWalletProfile;
+    current(profile: LocalWalletProfile): boolean;
+}
+//# sourceMappingURL=local-wallet-registry.d.ts.map

package/dist/src/launcher/local-wallet-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-wallet-registry.d.ts","sourceRoot":"","sources":["../../../src/launcher/local-wallet-registry.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,2BAA2B,GAAG,sCAAsC,GAAG,sBAAsB;gBAAnG,IAAI,EAAE,2BAA2B,GAAG,sCAAsC,GAAG,sBAAsB;CAI/G;AACD,eAAO,MAAM,6BAA6B,4BAA4B,CAAA;AACtE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AACD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,iCAAiC,CAAA;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC9C;AACD,eAAO,MAAM,gBAAgB,GAAI,SAAS,oBAAoB,WAAyD,CAAA;AACvH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,8BAOlD;AACD,6GAA6G;AAC7G,qBAAa,mBAAmB;IAEkB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADzE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;gBACjB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAmB,QAAQ,EAAE,uBAAuB;IAMlG,IAAI,IAAI,kBAAkB,GAAG,SAAS;YAsDxB,QAAQ;YASR,KAAK;IAeb,OAAO,CACX,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,EACvB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAClC,KAAK,CAAC,EAAE,MAAM,IAAI;IAkDd,UAAU,CACd,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAClC,KAAK,CAAC,EAAE,MAAM,IAAI;;;kBArKD,iCAAiC;gBACnC,MAAM;mBACH,MAAM;iBACR,MAAM;;IAmMxB,MAAM,CAAC,OAAO,EAAE,oBAAoB;IASpC,OAAO,CAAC,OAAO,EAAE,kBAAkB;CAOpC"}