ftown 0.20.8 → 0.21.0

package/dist/ledger-relay.js

@@ -0,0 +1,453 @@
+/*
+ * Account-mode wiring between the bridge's ledger replica (via BridgeSecurityService), the ftown server and the relay:
+ * - the server's public ledger endpoints, bounded (createLedgerServer);
+ * - the relay token by proof (createRelayTokenFetcher) behind the cooldown/caching provider, with the ledger hooks (createAccountRelay);
+ * - the relay's ledger messages and (re)subscriptions, spaced so a relay publisher cannot force back-to-back reads and verifies;
+ * - the last relay URL the server named (security/relay-url.json), for an offline start.
+ * Nothing here decides trust: every ledger goes to security.offerLedger / refreshLedger, which verify it.
+ */
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { UnauthorizedError } from 'centrifuge';
+import { createRelayTokenFetcher } from './relay-token.js';
+import { createTokenProvider } from './token-provider.js';
+export const LEDGER_REQUEST_TIMEOUT_MS = 15_000;
+/** A ledger is at most 2 MiB (LEDGER_LIMITS.maxBytes); its JSON envelope stays well under this. */
+const MAX_LEDGER_RESPONSE_BYTES = 3 * 1024 * 1024;
+const MAX_RELAY_URL_LENGTH = 2048;
+/** Relay-triggered ledger work (offers and refreshes) runs at least this far apart... */
+export const RELAY_LEDGER_MIN_SPACING_MS = 1_000;
+/** ...doubling up to this while it keeps changing nothing; an adopted ledger resets it. */
+export const RELAY_LEDGER_MAX_SPACING_MS = 60_000;
+/** Refreshes pulled by requests from endpoints the replica does not list run at most this often (single-flight, trailing). */
+export const UNKNOWN_ENDPOINT_REFRESH_SPACING_MS = 2_000;
+/** An HTTP answer that is not a success, with its status. */
+export class HttpStatusError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'HttpStatusError';
+    }
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+const apiBase = (apiUrl) => apiUrl.replace(/\/+$/, '');
+/** The HTTP status an error reports: its `status`, else a `(NNN)` in its message (relay-token errors), else null. */
+export function httpStatusOf(error) {
+    if (typeof error === 'object' && error !== null && 'status' in error && typeof error.status === 'number')
+        return error.status;
+    const match = /\((\d{3})\)/.exec(messageOf(error));
+    return match ? Number(match[1]) : null;
+}
+/** A refusal (401/403, or an UnauthorizedError) rather than a temporary failure. */
+export function isRefusal(error) {
+    if (error instanceof UnauthorizedError)
+        return true;
+    const status = httpStatusOf(error);
+    return status === 401 || status === 403;
+}
+function timeoutError(error, timeoutMs) {
+    return error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError')
+        ? new Error(`Ledger request timed out after ${timeoutMs}ms`) : error;
+}
+export function createLedgerServer(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const timeoutMs = input.timeoutMs ?? LEDGER_REQUEST_TIMEOUT_MS;
+    const maxBytes = input.maxBytes ?? MAX_LEDGER_RESPONSE_BYTES;
+    const base = apiBase(input.apiUrl);
+    return {
+        async fetchLedger(accountId) {
+            let text;
+            let status;
+            try {
+                const response = await fetchImpl(`${base}/api/account/ledger?accountId=${encodeURIComponent(accountId)}`, {
+                    method: 'GET', headers: { accept: 'application/json' }, cache: 'no-store', signal: AbortSignal.timeout(timeoutMs),
+                });
+                status = response.status;
+                if (Number(response.headers.get('content-length')) > maxBytes) {
+                    await response.body?.cancel().catch(() => undefined);
+                    throw new Error('ledger_response_too_large');
+                }
+                text = await response.text();
+            }
+            catch (error) {
+                throw timeoutError(error, timeoutMs);
+            }
+            if (Buffer.byteLength(text, 'utf8') > maxBytes)
+                throw new Error('ledger_response_too_large');
+            if (status !== 200)
+                throw new HttpStatusError(`Ledger read failed (${status})`, status);
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                throw new Error('Ledger response malformed');
+            }
+            const ledger = typeof body === 'object' && body !== null && !Array.isArray(body) ? body.ledger : undefined;
+            if (typeof ledger !== 'object' || ledger === null)
+                throw new Error('Ledger response malformed');
+            return ledger;
+        },
+        async postLedger(ledger) {
+            try {
+                const response = await fetchImpl(`${base}/api/account/ledger`, {
+                    method: 'POST', headers: { 'Content-Type': 'application/json', accept: 'application/json' }, cache: 'no-store',
+                    body: JSON.stringify({ ledger }), signal: AbortSignal.timeout(timeoutMs),
+                });
+                await response.body?.cancel().catch(() => undefined);
+                return response.status;
+            }
+            catch (error) {
+                throw timeoutError(error, timeoutMs);
+            }
+        },
+    };
+}
+/**
+ * Publishes ONLY this bridge's own ledger endpoint in the account's endpoint directory (PUT /api/security/endpoints), authenticated
+ * with its relay token. Throws HttpStatusError when the server does not accept it.
+ */
+export async function registerBridgeEndpoint(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const timeoutMs = input.timeoutMs ?? LEDGER_REQUEST_TIMEOUT_MS;
+    let status;
+    try {
+        const response = await fetchImpl(`${apiBase(input.apiUrl)}/api/security/endpoints`, {
+            method: 'PUT', headers: { Authorization: `Bearer ${input.token}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ endpoint: input.endpoint, bridgeId: input.bridgeId, label: input.label, protocolVersion: 1 }),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        await response.body?.cancel().catch(() => undefined);
+        status = response.status;
+    }
+    catch (error) {
+        throw timeoutError(error, timeoutMs);
+    }
+    if (status < 200 || status >= 300)
+        throw new HttpStatusError(`Endpoint directory registration failed (${status})`, status);
+}
+/** The line printed when the startup relay token is refused (exit 1). */
+export function relayTokenFailureMessage(error, apiUrl) {
+    if (error instanceof UnauthorizedError) {
+        return "[Bridge] The ftown server did not accept this computer's key. If it was removed from your account, run `ftown start --new-identity` to pair it again.";
+    }
+    if (isRefusal(error))
+        return `[Bridge] The ftown server at ${apiBase(apiUrl)} refused this computer (${messageOf(error)}).`;
+    return `[Bridge] Could not get a relay token from ${apiBase(apiUrl)} (${messageOf(error)}). Check the connection and run \`ftown start\` again.`;
+}
+export const MISSING_RELAY_URL_MESSAGE = '[Bridge] The ftown server did not name its relay (centrifugoUrl) in the relay-token response. '
+    + 'Update the server, or set FTOWN_CENTRIFUGO_URL to its wss:// URL.';
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname.endsWith('.localhost');
+}
+/**
+ * A Centrifugo URL the bridge may connect to, or null: wss://, or ws:// only to a loopback host or when the API itself is plain
+ * http (the operator already chose an insecure transport). The token rides this connection.
+ */
+export function parseRelayUrl(value, apiUrl) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > MAX_RELAY_URL_LENGTH)
+        return null;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (url.username || url.password)
+        return null;
+    if (url.protocol === 'wss:')
+        return url.href;
+    if (url.protocol !== 'ws:')
+        return null;
+    let insecureApi = false;
+    try {
+        insecureApi = new URL(apiUrl).protocol === 'http:';
+    }
+    catch { /* treated as secure */ }
+    return insecureApi || isLoopbackHost(url.hostname) ? url.href : null;
+}
+const relayUrlFile = (dataDir) => join(dataDir, 'security', 'relay-url.json');
+/** The last relay URL the server named (`security/relay-url.json`), if it is still acceptable for this API; else null. */
+export function readSavedRelayUrl(dataDir, apiUrl) {
+    try {
+        const value = JSON.parse(readFileSync(relayUrlFile(dataDir), 'utf8'));
+        if (typeof value !== 'object' || value === null || value.version !== 1)
+            return null;
+        return parseRelayUrl(value.url, apiUrl);
+    }
+    catch {
+        return null;
+    }
+}
+/** Atomically saves the relay URL (mode 0600). The identity reset deletes it. */
+export function saveRelayUrl(dataDir, url) {
+    const file = relayUrlFile(dataDir);
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    mkdirSync(join(dataDir, 'security'), { recursive: true, mode: 0o700 });
+    try {
+        writeFileSync(temporary, JSON.stringify({ version: 1, url }), { mode: 0o600, flag: 'wx' });
+        renameSync(temporary, file);
+    }
+    catch (error) {
+        rmSync(temporary, { force: true });
+        throw error;
+    }
+}
+/** Subscribes `listener` when the security service offers onApprovalRequired; false when it does not (nothing subscribed). */
+export function subscribeApprovalRequired(security, listener) {
+    const signal = security.onApprovalRequired;
+    if (typeof signal !== 'function')
+        return false;
+    signal.call(security, listener);
+    return true;
+}
+const defaultSchedule = (run, ms) => {
+    const timer = setTimeout(run, ms);
+    timer.unref();
+    return () => clearTimeout(timer);
+};
+export function createAccountRelay(deps) {
+    const log = deps.log ?? ((line) => console.warn(line));
+    const monotonic = deps.now ?? (() => performance.now());
+    const schedule = deps.schedule ?? defaultSchedule;
+    const baseFetch = deps.fetchImpl ?? fetch;
+    const relayTokenUrl = `${apiBase(deps.apiUrl)}/api/auth/relay-token`;
+    const override = deps.relayUrlOverride === undefined || deps.relayUrlOverride === '' ? null : parseRelayUrl(deps.relayUrlOverride, deps.apiUrl);
+    if (deps.relayUrlOverride && override === null)
+        log('[Bridge] Ignoring FTOWN_CENTRIFUGO_URL: it must be a wss:// URL (ws:// only for a local relay).');
+    let learnedRelayUrl = null;
+    const savedRelayUrl = deps.savedRelayUrl ?? null;
+    const head = () => deps.security.ledgerStatus().head;
+    /** The relay connection was refused (terminal for centrifuge-js) and has not been reconnected since. */
+    let relayRefused = false;
+    /** The local head whose chain was last POSTed after a plain 401 (at most once per head). */
+    let postedHead;
+    let stopped = false;
+    const reconnectIfRefused = () => {
+        if (!relayRefused || stopped)
+            return;
+        relayRefused = false;
+        try {
+            deps.reconnect?.();
+        }
+        catch (error) {
+            log(`[Bridge] Relay reconnect failed: ${messageOf(error)}`);
+        }
+    };
+    // Reads `centrifugoUrl` from a successful relay-token response without consuming the body the fetcher reads.
+    const fetchImpl = async (input, init) => {
+        const response = await baseFetch(input, init);
+        if (response.ok && String(input) === relayTokenUrl) {
+            try {
+                const body = JSON.parse(await response.clone().text());
+                const named = typeof body === 'object' && body !== null ? parseRelayUrl(body.centrifugoUrl, deps.apiUrl) : null;
+                if (named !== null) {
+                    const previous = learnedRelayUrl ?? savedRelayUrl;
+                    learnedRelayUrl = named;
+                    if (named !== previous) {
+                        try {
+                            deps.onRelayUrl?.(named);
+                        }
+                        catch (error) {
+                            log(`[Bridge] Could not save the relay URL: ${messageOf(error)}`);
+                        }
+                    }
+                }
+            }
+            catch { /* the fetcher reports a malformed response */ }
+        }
+        return response;
+    };
+    const fetcher = createRelayTokenFetcher({
+        apiUrl: deps.apiUrl,
+        accountId: () => deps.accountId,
+        bridgeId: deps.bridgeId,
+        authPrivateKey: deps.authPrivateKey,
+        head,
+        // A newer server ledger rides the token response. An invalid one is only logged: the token is still returned.
+        onLedger: async (ledger) => {
+            try {
+                if (await deps.security.offerLedger(ledger, 'server') === 'reject')
+                    log('[Bridge] Ignored an account ledger from the relay-token response.');
+            }
+            catch (error) {
+                log(`[Bridge] Account ledger from the relay-token response failed: ${messageOf(error)}`);
+            }
+        },
+        // Evidence of a revoked key: only a ledger that verifies and revokes this bridge triggers the reset (security's onBridgeRevoked).
+        onRevoked: async (ledger) => {
+            try {
+                await deps.security.offerLedger(ledger, 'server');
+            }
+            catch (error) {
+                log(`[Bridge] Revocation evidence failed: ${messageOf(error)}`);
+            }
+        },
+        // The server may be missing our add_bridge (e.g. the approving browser's write was lost): offer it our chain once per local head,
+        // then retry once.
+        onUnauthorized: async () => {
+            const current = head();
+            if (postedHead !== undefined && postedHead === current)
+                return false;
+            try {
+                const state = await deps.store.read();
+                if (state === null)
+                    return false;
+                const status = await deps.server.postLedger(state.ledger);
+                postedHead = current;
+                return status === 200 || status === 201;
+            }
+            catch (error) {
+                log(`[Bridge] Could not send the account ledger to the server: ${messageOf(error)}`);
+                return false;
+            }
+        },
+        hostname: deps.hostname,
+        localPort: deps.localPort,
+        fetchImpl,
+        timeoutMs: LEDGER_REQUEST_TIMEOUT_MS,
+    });
+    const tokens = createTokenProvider({
+        fetchToken: async () => {
+            const token = await fetcher();
+            // Every relay-token answer is a server contact: it renews the offline grace of the account devices.
+            deps.security.noteServerContact();
+            // The key is accepted again (e.g. the server learned our add_bridge): a refused relay connection may come back.
+            reconnectIfRefused();
+            return token;
+        },
+        now: monotonic,
+        random: deps.random,
+        head,
+    });
+    // Relay-triggered ledger work: at most one at a time, at least RELAY_LEDGER_MIN_SPACING_MS apart, only the latest kept.
+    let pending = null;
+    let running = false;
+    let cancelTimer = null;
+    let readyAt = 0;
+    let idleRuns = 0;
+    let lastRunEndedAt = Number.NEGATIVE_INFINITY;
+    const run = async (work) => {
+        const before = head();
+        try {
+            if (work.kind === 'offer') {
+                if (await deps.security.offerLedger(work.ledger, 'relay') !== 'adopt')
+                    return 'idle';
+            }
+            else {
+                if (work.head !== null && work.head === before)
+                    return 'skipped';
+                await deps.security.refreshLedger();
+                if (head() === before)
+                    return 'idle';
+            }
+        }
+        catch (error) {
+            log(`[Bridge] Relay ledger update failed: ${messageOf(error)}`);
+            return 'idle';
+        }
+        reconnectIfRefused();
+        return 'adopt';
+    };
+    const pump = () => {
+        if (stopped || running || cancelTimer !== null || pending === null)
+            return;
+        const wait = readyAt - monotonic();
+        if (wait > 0) {
+            cancelTimer = schedule(() => { cancelTimer = null; pump(); }, wait);
+            return;
+        }
+        const work = pending;
+        pending = null;
+        running = true;
+        void run(work).then(outcome => {
+            if (outcome === 'skipped')
+                return;
+            lastRunEndedAt = monotonic();
+            if (outcome === 'adopt')
+                idleRuns = 0;
+            const spacing = outcome === 'adopt' ? RELAY_LEDGER_MIN_SPACING_MS
+                : Math.min(RELAY_LEDGER_MIN_SPACING_MS * 2 ** idleRuns++, RELAY_LEDGER_MAX_SPACING_MS);
+            readyAt = monotonic() + spacing;
+        }).finally(() => { running = false; pump(); });
+    };
+    const submit = (work) => {
+        if (stopped)
+            return;
+        // Leading edge: the first work after a quiet second runs at once with a fresh backoff; only a burst is spaced and backed off.
+        if (!running && pending === null && cancelTimer === null && monotonic() - lastRunEndedAt >= RELAY_LEDGER_MIN_SPACING_MS) {
+            idleRuns = 0;
+            readyAt = 0;
+        }
+        pending = work;
+        pump();
+    };
+    // Refreshes pulled by unknown endpoints: their own limit, independent of the relay spacing.
+    let unknownInFlight = false;
+    let unknownQueued = false;
+    let unknownCancel = null;
+    let unknownReadyAt = Number.NEGATIVE_INFINITY;
+    const refreshForUnknown = () => {
+        if (stopped)
+            return;
+        if (unknownInFlight) {
+            unknownQueued = true;
+            return;
+        }
+        if (unknownCancel !== null)
+            return;
+        const wait = unknownReadyAt - monotonic();
+        if (wait > 0) {
+            unknownCancel = schedule(() => { unknownCancel = null; refreshForUnknown(); }, wait);
+            return;
+        }
+        unknownInFlight = true;
+        unknownReadyAt = monotonic() + UNKNOWN_ENDPOINT_REFRESH_SPACING_MS;
+        const before = head();
+        deps.security.refreshLedger()
+            .then(() => { if (head() !== before)
+            reconnectIfRefused(); })
+            .catch((error) => log(`[Bridge] Account ledger refresh failed: ${messageOf(error)}`))
+            .finally(() => {
+            unknownInFlight = false;
+            if (unknownQueued) {
+                unknownQueued = false;
+                refreshForUnknown();
+            }
+        });
+    };
+    return {
+        tokens,
+        async connectionToken() {
+            try {
+                return await tokens.getToken();
+            }
+            catch (error) {
+                if (error instanceof UnauthorizedError)
+                    relayRefused = true;
+                throw error;
+            }
+        },
+        relayUrl: () => override ?? learnedRelayUrl ?? savedRelayUrl,
+        onLedgerMessage(message) {
+            if (message.type === 'ledger')
+                submit({ kind: 'offer', ledger: message.ledger });
+            else if (message.head !== head())
+                submit({ kind: 'refresh', head: message.head });
+        },
+        onLedgerSubscribed: () => submit({ kind: 'refresh', head: null }),
+        onUnknownEndpoint: refreshForUnknown,
+        stop() {
+            stopped = true;
+            pending = null;
+            cancelTimer?.();
+            cancelTimer = null;
+            unknownCancel?.();
+            unknownCancel = null;
+        },
+    };
+}
+//# sourceMappingURL=ledger-relay.js.map

package/dist/ledger-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-relay.js","sourceRoot":"","sources":["../src/ledger-relay.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD,mGAAmG;AACnG,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AACjD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,8HAA8H;AAC9H,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAK,CAAC;AASzD,6DAA6D;AAC7D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACF;IAAtC,YAAY,OAAe,EAAW,MAAc;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,WAAM,GAAN,MAAM,CAAQ;QAElD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrG,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEvE,qHAAqH;AACrH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC9H,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,YAAY,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,SAAiB;IACrD,OAAO,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;QAC7F,CAAC,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA0F;IAC3H,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAAC;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,SAAS;YACzB,IAAI,IAAY,CAAC;YACjB,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,iCAAiC,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE;oBACxG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;iBAClH,CAAC,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;oBAC9D,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC/C,CAAC;gBACD,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,eAAe,CAAC,uBAAuB,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC;YACxF,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAAC,CAAC;YACxF,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACrI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAChG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,qBAAqB,EAAE;oBAC7D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,EAAE,UAAU;oBAC9G,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;iBACzE,CAAC,CAAC;gBACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,OAAO,QAAQ,CAAC,MAAM,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAE5C;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,yBAAyB,CAAC;IAC/D,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE;YAClF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;YACpH,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAAC,CAAC;IACzD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7H,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,MAAc;IACrE,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO,uJAAuJ,CAAC;IACjK,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,gCAAgC,OAAO,CAAC,MAAM,CAAC,2BAA2B,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5H,OAAO,6CAA6C,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,wDAAwD,CAAC;AACnJ,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,gGAAgG;MACrI,mEAAmE,CAAC;AAExE,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACzH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAAc;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACxG,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QAAC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC7F,OAAO,WAAW,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;AAE9F,0HAA0H;AAC1H,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,MAAc;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAK,KAA+B,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/G,OAAO,aAAa,CAAE,KAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAiED,8HAA8H;AAC9H,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,QAAsC;IAChG,MAAM,MAAM,GAAI,QAAmC,CAAC,kBAAkB,CAAC;IACvE,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAID,MAAM,eAAe,GAAG,CAAC,GAAe,EAAE,EAAU,EAAgB,EAAE;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAChJ,IAAI,IAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,IAAI;QAAE,GAAG,CAAC,iGAAiG,CAAC,CAAC;IACvJ,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC;IACpE,wGAAwG;IACxG,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,4FAA4F;IAC5F,IAAI,UAAqC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,IAAI,CAAC,YAAY,IAAI,OAAO;YAAE,OAAO;QACrC,YAAY,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,GAAG,CAAC,oCAAoC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC5G,CAAC,CAAC;IAEF,6GAA6G;IAC7G,MAAM,SAAS,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,aAAa,EAAE,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAE,IAAoC,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACjJ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM,QAAQ,GAAG,eAAe,IAAI,aAAa,CAAC;oBAClD,eAAe,GAAG,KAAK,CAAC;oBACxB,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACvB,IAAI,CAAC;4BAAC,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;wBAAC,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BAAC,GAAG,CAAC,0CAA0C,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;wBAAC,CAAC;oBACxH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC;QACtC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS;QAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,IAAI;QACJ,8GAA8G;QAC9G,QAAQ,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACvB,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,mEAAmE,CAAC,CAAC;YAC/I,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,GAAG,CAAC,iEAAiE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QAC/G,CAAC;QACD,kIAAkI;QAClI,SAAS,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACxB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAAC,CAAC;YAC1D,OAAO,KAAK,EAAE,CAAC;gBAAC,GAAG,CAAC,wCAAwC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;QACpF,CAAC;QACD,kIAAkI;QAClI,mBAAmB;QACnB,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;YACvB,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YACrE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACtC,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1D,UAAU,GAAG,OAAO,CAAC;gBACrB,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,6DAA6D,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACrF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,SAAS,EAAE,yBAAyB;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;YAC9B,oGAAoG;YACpG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAClC,gHAAgH;YAChH,kBAAkB,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,EAAE,SAAS;QACd,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI;KACL,CAAC,CAAC;IAEH,wHAAwH;IACxH,IAAI,OAAO,GAAqB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAE9C,MAAM,GAAG,GAAG,KAAK,EAAE,IAAe,EAAyC,EAAE;QAC3E,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO;oBAAE,OAAO,MAAM,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;oBAAE,OAAO,SAAS,CAAC;gBACjE,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACpC,IAAI,IAAI,EAAE,KAAK,MAAM;oBAAE,OAAO,MAAM,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,wCAAwC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,kBAAkB,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,IAAI,OAAO,IAAI,OAAO,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO;QAC3E,MAAM,IAAI,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC;QACnC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC;QACrB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;YAC5B,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,cAAc,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,KAAK,OAAO;gBAAE,QAAQ,GAAG,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,2BAA2B;gBAC/D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,IAAI,QAAQ,EAAE,EAAE,2BAA2B,CAAC,CAAC;YACzF,OAAO,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC;QAClC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAe,EAAQ,EAAE;QACvC,IAAI,OAAO;YAAE,OAAO;QACpB,8HAA8H;QAC9H,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,IAAI,SAAS,EAAE,GAAG,cAAc,IAAI,2BAA2B,EAAE,CAAC;YACxH,QAAQ,GAAG,CAAC,CAAC;YACb,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,4FAA4F;IAC5F,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,aAAa,GAAwB,IAAI,CAAC;IAC9C,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9C,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,eAAe,EAAE,CAAC;YAAC,aAAa,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QACtD,IAAI,aAAa,KAAK,IAAI;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,cAAc,GAAG,SAAS,EAAE,CAAC;QAC1C,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,aAAa,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,eAAe,GAAG,IAAI,CAAC;QACvB,cAAc,GAAG,SAAS,EAAE,GAAG,mCAAmC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE;aAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,MAAM;YAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;aAC5D,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,GAAG,CAAC,2CAA2C,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;aAC7F,OAAO,CAAC,GAAG,EAAE;YACZ,eAAe,GAAG,KAAK,CAAC;YACxB,IAAI,aAAa,EAAE,CAAC;gBAAC,aAAa,GAAG,KAAK,CAAC;gBAAC,iBAAiB,EAAE,CAAC;YAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,KAAK,CAAC,eAAe;YACnB,IAAI,CAAC;gBAAC,OAAO,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YAAC,CAAC;YACvC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,iBAAiB;oBAAE,YAAY,GAAG,IAAI,CAAC;gBAC5D,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,IAAI,eAAe,IAAI,aAAa;QAC5D,eAAe,CAAC,OAAO;YACrB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;iBAC5E,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE;gBAAE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjE,iBAAiB,EAAE,iBAAiB;QACpC,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,EAAE,EAAE,CAAC;YAChB,WAAW,GAAG,IAAI,CAAC;YACnB,aAAa,EAAE,EAAE,CAAC;YAClB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ledger-startup.d.ts

@@ -0,0 +1,151 @@
+import { type IdentityResetReason, type IdentityResetResult } from './identity-reset.js';
+import type { BridgeMode } from './revocation-gating.js';
+import { type LedgerBridgeIdentity } from './security/bridge/ledger-identity.js';
+import { BridgeLedgerStore, type OwnBridgeStatus, type ReconcileResult } from './security/bridge/ledger-store.js';
+import type { EndpointPublic } from './security/protocol.js';
+export declare const LEGACY_ACCOUNT_RESET_MESSAGE = "[Bridge] Old account data from a previous ftown version was cleared. Pair this computer again with the link below.";
+export declare const NOT_IN_LEDGER_MESSAGE = "This computer is not in your account's ledger. Run `ftown start --new-identity` to pair it again.";
+export declare const PAIRING_REJECTED_HINT = "Pairing did not complete. Run `ftown start` to try again.";
+export declare const SERVER_LEDGER_MISMATCH_MESSAGE = "[Bridge] The server's account ledger does not list this computer. If it was removed from your account, run `ftown start --new-identity` to pair it again.";
+export declare const UPDATE_RESTART_UNPAIRED_MESSAGE = "[Bridge] An update restart cannot pair this computer. Run `ftown start` to pair it.";
+export declare const UPDATED_TO_LEDGER_MESSAGE = "[Bridge] ftown was updated to the passkey ledger; run `ftown start` to pair this computer.";
+/** Only account bridges use the passkey ledger (legacy reset, pairing, ledger replica, relay token by proof). */
+export declare function usesLedger(mode: BridgeMode): boolean;
+export interface IdentityResetDeps {
+    hasLegacyAccountState: (dataDir: string) => boolean;
+    beginIdentityReset: (dataDir: string, reason: IdentityResetReason) => void;
+    completePendingIdentityReset: (dataDir: string) => IdentityResetResult | null;
+}
+export type IdentityResetOutcome = {
+    kind: 'continue';
+    reset: IdentityResetResult | null;
+}
+/** Exit 1 after printing `message`; nothing was changed on disk. */
+ | {
+    kind: 'exit';
+    message: string;
+};
+/**
+ * Step 2. Account mode: `--new-identity`, or any v1 account state on disk, starts a manual reset (the latter says so in one line).
+ * An update restart (a v1 -> v2 auto-update) has no visible terminal for the pairing link: with v1 state on disk it changes nothing
+ * and exits, and the next `ftown start` resets and pairs. Every mode then finishes a pending reset, as before (a revoked restart or a
+ * crash may have left one).
+ */
+export declare function resetIdentityForStart(input: {
+    dataDir: string;
+    mode: BridgeMode;
+    newIdentity: boolean;
+    updateRestart: boolean;
+    log: (line: string) => void;
+}, deps?: Partial<IdentityResetDeps>): IdentityResetOutcome;
+export type OwnStatusAction = 'continue' | 'revoked_restart' | 'exit_absent';
+/** Step 4. Only a signed revocation resets the identity; a bridge the ledger does not list fails closed and is never reset. */
+export declare function ownStatusAction(own: OwnBridgeStatus): OwnStatusAction;
+/** A ledger identity bound to its account: endpoint and accountId are set. */
+export type BoundLedgerIdentity = LedgerBridgeIdentity & {
+    endpoint: EndpointPublic;
+    accountId: string;
+};
+export type AccountStartup = {
+    kind: 'ready';
+    identity: BoundLedgerIdentity;
+    store: BridgeLedgerStore;
+    reconciled: ReconcileResult;
+} | {
+    kind: 'revoked';
+}
+/** Exit 1 after printing `message` (null: the cause was already printed). */
+ | {
+    kind: 'exit';
+    message: string | null;
+};
+export interface AccountStartupDeps {
+    dataDir: string;
+    bridgeId: string;
+    /** False during an update restart: it must come back with its existing identity and never pair. */
+    allowPairing: boolean;
+    /** One pairing attempt (runLedgerPairing) with the unbound identity and the empty store; binds both on success. Throws
+     *  Error('pairing_expired') (its hint already printed) or Error('pairing_rejected'). */
+    pair: (identity: LedgerBridgeIdentity, store: BridgeLedgerStore) => Promise<unknown>;
+    /** The server's ledger for this account (GET /api/account/ledger?accountId=…, bounded). */
+    fetchLedger: (accountId: string) => Promise<unknown>;
+    /** Injectable for tests. */
+    loadOrCreateIdentity?: (dataDir: string) => Promise<LedgerBridgeIdentity>;
+    reconcile?: (dataDir: string) => Promise<ReconcileResult>;
+    readIdentity?: (dataDir: string) => Promise<LedgerBridgeIdentity | null>;
+}
+export declare function ledgerUnavailableMessage(reason: string): string;
+/**
+ * Steps 3-4, account mode only, before any network use of the identity:
+ * - keys exist (created when absent), then identity and replica are reconciled;
+ * - 'unpaired' -> one pairing attempt (expired/rejected -> exit 1 with the hint);
+ * - 'needs_ledger' -> the server ledger is adopted only through adoptBound (any failure -> exit 1; the identity stays bound);
+ * - own status from the trusted replica: 'revoked' -> revoked restart; 'absent' -> exit 1 (never a reset); 'active' -> ready.
+ * Corrupted local files throw (they are never reset).
+ */
+export declare function startAccountIdentity(deps: AccountStartupDeps): Promise<AccountStartup>;
+export type RelayStartup = {
+    kind: 'revoked';
+}
+/** Exit 1 after printing `message`. */
+ | {
+    kind: 'exit';
+    message: string;
+} | {
+    kind: 'online';
+    token: string;
+    relayUrl: string;
+}
+/** The server is unreachable for now: start with the saved relay URL and keep retrying in the background. */
+ | {
+    kind: 'offline';
+    relayUrl: string;
+    reason: string;
+};
+export declare function offlineWithoutRelayUrlMessage(reason: string): string;
+/**
+ * Step 5, the first relay token. A proven revocation (the token hooks offer the server's evidence first) wins over everything; a
+ * refusal (401/403) exits; a temporary failure (network, timeout, 5xx, cooldown) starts offline with the saved relay URL, and exits
+ * only when there is none. After a successful token the revocation is checked again: the token response's ledger may prove it.
+ */
+export declare function startRelay(input: {
+    getToken: () => Promise<string>;
+    relayUrl: () => string | null;
+    bridgeRevoked: () => boolean;
+    apiUrl: string;
+}): Promise<RelayStartup>;
+export declare function endpointRefusedMessage(reason: string): string;
+export type RegistrationAttempt = {
+    kind: 'registered';
+} | {
+    kind: 'retry';
+} | {
+    kind: 'revoked';
+} | {
+    kind: 'exit';
+    message: string;
+};
+export interface EndpointRegistrarDeps {
+    /** PUT /api/security/endpoints with this bridge's own ledger endpoint (registerBridgeEndpoint). */
+    register: (token: string) => Promise<void>;
+    tokens: {
+        getToken(): Promise<string>;
+        cooldownRemainingMs(): number;
+    };
+    bridgeRevoked: () => boolean;
+    log: (line: string) => void;
+    /** Returns a cancel function. Defaults to an unref'd setTimeout. */
+    schedule?: (run: () => void, ms: number) => () => void;
+    /** First background delay (default 15 s), doubling to maxDelayMs (default 10 min); never earlier than the token cooldown. */
+    baseDelayMs?: number;
+    maxDelayMs?: number;
+}
+export interface EndpointRegistrar {
+    /** Step 6 at an online start, with the first token: a refusal exits, a temporary failure is retried in the background. */
+    registerNow(token: string): Promise<RegistrationAttempt>;
+    /** Retries getToken() + registration in the background until it succeeds or is refused, honouring the token cooldown. */
+    retryInBackground(): void;
+    registered(): boolean;
+    stop(): void;
+}
+export declare function createEndpointRegistrar(deps: EndpointRegistrarDeps): EndpointRegistrar;