ftown 0.20.8 → 0.21.0

package/dist/security/bridge/ledger-identity.d.ts

@@ -0,0 +1,48 @@
+import type { EndpointPublic } from '../protocol.js';
+export interface LedgerBridgeIdentity {
+    /** ECDH P-256 endpoint key pair for HPKE; the private key is non-extractable. */
+    keyPair: CryptoKeyPair;
+    /** Raw uncompressed ECDH point, base64url: BridgePairRequest.endpointPublicKey. */
+    endpointPublicKey: string;
+    /** base64url SHA-256 of the raw endpoint point: EndpointPublic.id. */
+    endpointId: string;
+    /** Raw uncompressed ECDSA point, base64url: BridgePairRequest/LedgerBridge.authPublicKey. */
+    authPublicKey: string;
+    /** Non-extractable ECDSA P-256 signing key for signAuthProof. */
+    authPrivateKey: CryptoKey;
+    /** The bound endpoint, or null before pairing. With `keyPair` it is the bridge's EndpointIdentity. */
+    endpoint: EndpointPublic | null;
+    /** endpoint.ownerId once bound, else null. */
+    accountId: string | null;
+}
+/** What is on disk, without importing keys. A corrupted file throws BridgeSecurityError('key_unavailable'). */
+export type LedgerIdentityFileInfo = {
+    state: 'absent';
+    accountId: null;
+} | {
+    state: 'ready';
+    accountId: string | null;
+};
+/** Reports the v2 identity file's state without importing keys. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export declare function inspectIdentityFile(dataDir: string): Promise<LedgerIdentityFileInfo>;
+/**
+ * True iff the data dir holds v1 ACCOUNT state: `refresh-token`, `security/account-enrollment.json`,
+ * `security/pending-approval-status.json` or `security/pending-approval-confirmation.json` exists, or `security/bridge-identity.json`
+ * has a readable endpoint owner that is not `solo:` (Solo's identity is never reported). An unreadable bridge-identity.json is not
+ * reported: its owner cannot be told apart from Solo's. Reads only; never modifies anything.
+ */
+export declare function hasLegacyAccountState(dataDir: string): boolean;
+/** Loads the identity without creating one: null when absent. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export declare function readLedgerIdentity(dataDir: string): Promise<LedgerBridgeIdentity | null>;
+/**
+ * Loads the identity, creating fresh keys only when the file is absent. Throws BridgeSecurityError: key_unavailable for an unreadable
+ * or corrupted file (never replaced), storage_unavailable when the new file cannot be written.
+ */
+export declare function loadOrCreateLedgerIdentity(dataDir: string): Promise<LedgerBridgeIdentity>;
+/**
+ * Binds the identity to `accountId` once: sets endpoint {version:1, id, ownerId: accountId, kind:'bridge', publicKey}. Idempotent for
+ * the same account. Throws BridgeSecurityError: wrong_context for a different (or malformed) accountId, key_unavailable when there is
+ * no valid identity to bind, storage_unavailable when the file cannot be written. Binds are serialized within this process only: the
+ * bridge's single-instance guarantee keeps a second process from binding concurrently.
+ */
+export declare function bindLedgerIdentity(dataDir: string, accountId: string): Promise<LedgerBridgeIdentity>;

package/dist/security/bridge/ledger-identity.js

@@ -0,0 +1,342 @@
+/*
+ * OS-local keys of a ledger (v2) bridge: `<dataDir>/security/ledger-identity.json`, version 2.
+ * - An ECDH P-256 endpoint key (HPKE) and an ECDSA P-256 auth key (AuthProof), both stored as JWK, file mode 0600.
+ * - Before pairing the file has keys but no endpoint; bindLedgerIdentity sets {version:1, id, ownerId: accountId, kind:'bridge',
+ *   publicKey} exactly once and never rebinds to another account.
+ * - Absence alone creates keys. A corrupted or unreadable file is never replaced: it throws BridgeSecurityError('key_unavailable').
+ * - Solo and --local keep their v1 `security/bridge-identity.json` (identity.ts); this module never reads, writes or deletes it, except
+ *   for hasLegacyAccountState, which only reads its owner to tell a v1 ACCOUNT identity from a Solo one.
+ * - Writers are serialized within this process; across processes the bridge's single-instance guarantee is relied on (creation is
+ *   still exclusive via link(2), but two processes binding at once could each believe they won).
+ */
+import { randomUUID } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { link, mkdir, open, readdir, rename, rm } from 'node:fs/promises';
+import { basename, dirname, join, resolve } from 'node:path';
+import { z } from 'zod';
+import { exportPublicKey, importPublicKey } from '../crypto.js';
+import { generateAuthKey } from '../ledger/proof.js';
+import { BridgeSecurityError } from './errors.js';
+import { endpointSchema } from './metadata.js';
+const FILE_NAME = 'ledger-identity.json';
+const MAX_FILE_BYTES = 64 * 1024;
+const ECDH = { name: 'ECDH', namedCurve: 'P-256' };
+const ECDSA = { name: 'ECDSA', namedCurve: 'P-256' };
+const SIGN = { name: 'ECDSA', hash: 'SHA-256' };
+/** v1 account-mode state (never Solo's): any of these means the data dir still holds a v1 account bridge. */
+const LEGACY_ACCOUNT_FILES = [
+    ['refresh-token'], ['security', 'account-enrollment.json'], ['security', 'pending-approval-status.json'],
+    ['security', 'pending-approval-confirmation.json'],
+];
+const TEMPORARY = /^\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.tmp$/;
+const jwkSchema = z.strictObject({
+    kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string().max(64), y: z.string().max(64), d: z.string().max(64),
+    key_ops: z.array(z.string().max(32)).max(8).optional(), ext: z.boolean().optional(),
+});
+const pointSchema = z.string().regex(/^[A-Za-z0-9_-]{87}$/);
+const recordSchema = z.strictObject({
+    version: z.literal(2),
+    endpoint: endpointSchema.optional(),
+    privateKey: jwkSchema,
+    endpointPublicKey: pointSchema,
+    authPublicKey: pointSchema,
+    authPrivateKey: jwkSchema,
+}).superRefine((record, context) => {
+    if (record.endpointPublicKey === record.authPublicKey)
+        context.addIssue({ code: 'custom', message: 'Shared identity key' });
+    const endpoint = record.endpoint;
+    if (endpoint !== undefined && (endpoint.kind !== 'bridge' || endpoint.publicKey !== record.endpointPublicKey || !isAccountId(endpoint.ownerId))) {
+        context.addIssue({ code: 'custom', message: 'Invalid bound endpoint' });
+    }
+});
+const queues = new Map();
+const swept = new Set();
+/** Canonical unpadded base64url of exactly 32 bytes: the accountId syntax. */
+function isAccountId(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(value))
+        return false;
+    const raw = Buffer.from(value, 'base64url');
+    return raw.length === 32 && raw.toString('base64url') === value;
+}
+function identityFile(dataDir) {
+    return resolve(join(dataDir, 'security', FILE_NAME));
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string' ? error.code : undefined;
+}
+/** Operations on one file run one at a time within this process. */
+function serialized(file, run) {
+    const previous = queues.get(file) ?? Promise.resolve();
+    const next = previous.then(run);
+    const settled = next.then(() => undefined, () => undefined);
+    queues.set(file, settled);
+    void settled.then(() => { if (queues.get(file) === settled)
+        queues.delete(file); });
+    return next;
+}
+/** Once per process: removes `<file>.<uuid>.tmp` left by a crash mid-write. Runs inside the file's queue, so no own write is in flight. */
+async function sweepTemporaries(file) {
+    if (swept.has(file))
+        return;
+    swept.add(file);
+    const prefix = basename(file);
+    let names;
+    try {
+        names = await readdir(dirname(file));
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (name.indexOf(prefix) === 0 && TEMPORARY.test(name.slice(prefix.length)))
+            await rm(join(dirname(file), name), { force: true }).catch(() => undefined);
+    }
+}
+/** null when absent; every other read failure is key_unavailable. */
+async function readText(file) {
+    let handle;
+    try {
+        handle = await open(file, 'r');
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return null;
+        throw new BridgeSecurityError('key_unavailable');
+    }
+    try {
+        const info = await handle.stat();
+        if (!info.isFile() || info.size > MAX_FILE_BYTES)
+            throw new Error('Unexpected identity file');
+        return await handle.readFile('utf8');
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+    finally {
+        await handle.close();
+    }
+}
+function parseRecord(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+    const parsed = recordSchema.safeParse(value);
+    if (!parsed.success)
+        throw new BridgeSecurityError('key_unavailable');
+    return parsed.data;
+}
+async function readRecord(file) {
+    const text = await readText(file);
+    return text === null ? null : parseRecord(text);
+}
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await open(directory, 'r');
+    }
+    catch {
+        return;
+    }
+    try {
+        await handle.sync();
+    }
+    catch { /* directory fsync is unsupported on some platforms */ }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Writes a complete 0600 file next to the target, then publishes it atomically: `link` when `exclusive` (never replaces an existing
+ * identity; returns false if one appeared meanwhile), else `rename` (replace). Throws storage_unavailable on any failure.
+ */
+async function publish(file, record, exclusive) {
+    const directory = dirname(file);
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        const handle = await open(temporary, 'wx', 0o600);
+        try {
+            await handle.writeFile(JSON.stringify(recordSchema.parse(record)));
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        if (exclusive) {
+            try {
+                await link(temporary, file);
+            }
+            catch (error) {
+                if (errorCode(error) === 'EEXIST')
+                    return false;
+                throw error;
+            }
+        }
+        else {
+            await rename(temporary, file);
+        }
+    }
+    catch {
+        throw new BridgeSecurityError('storage_unavailable');
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+    await syncDirectory(directory);
+    return true;
+}
+function sameBytes(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1)
+        difference |= left[index] ^ right[index];
+    return difference === 0;
+}
+async function generateRecord() {
+    try {
+        const endpoint = await crypto.subtle.generateKey(ECDH, true, ['deriveBits']);
+        const auth = await generateAuthKey(true);
+        return recordSchema.parse({
+            version: 2,
+            privateKey: await crypto.subtle.exportKey('jwk', endpoint.privateKey),
+            endpointPublicKey: await exportPublicKey(endpoint.publicKey),
+            authPublicKey: auth.publicKey,
+            authPrivateKey: await crypto.subtle.exportKey('jwk', auth.privateKey),
+        });
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+/** Imports both keys non-extractable and proves each private key belongs to its pinned public point. */
+async function importRecord(record) {
+    try {
+        const endpointPublic = await importPublicKey(record.endpointPublicKey);
+        const endpointJwk = await crypto.subtle.exportKey('jwk', endpointPublic);
+        if (record.privateKey.x !== endpointJwk.x || record.privateKey.y !== endpointJwk.y)
+            throw new Error('Endpoint key mismatch');
+        const endpointPrivate = await crypto.subtle.importKey('jwk', record.privateKey, ECDH, false, ['deriveBits']);
+        // WebCrypto may trust the supplied public coordinates of a JWK: prove the private scalar by a fresh exchange.
+        const probe = await crypto.subtle.generateKey(ECDH, false, ['deriveBits']);
+        const left = new Uint8Array(await crypto.subtle.deriveBits({ name: 'ECDH', public: probe.publicKey }, endpointPrivate, 256));
+        const right = new Uint8Array(await crypto.subtle.deriveBits({ name: 'ECDH', public: endpointPublic }, probe.privateKey, 256));
+        if (!sameBytes(left, right))
+            throw new Error('Endpoint key mismatch');
+        const authRaw = Buffer.from(record.authPublicKey, 'base64url');
+        if (authRaw.length !== 65 || authRaw[0] !== 4 || authRaw.toString('base64url') !== record.authPublicKey)
+            throw new Error('Auth key');
+        const authPublic = await crypto.subtle.importKey('raw', new Uint8Array(authRaw), ECDSA, true, ['verify']);
+        const authJwk = await crypto.subtle.exportKey('jwk', authPublic);
+        if (record.authPrivateKey.x !== authJwk.x || record.authPrivateKey.y !== authJwk.y)
+            throw new Error('Auth key mismatch');
+        const authPrivateKey = await crypto.subtle.importKey('jwk', record.authPrivateKey, ECDSA, false, ['sign']);
+        const challenge = crypto.getRandomValues(new Uint8Array(32));
+        const signature = await crypto.subtle.sign(SIGN, authPrivateKey, challenge);
+        if (!await crypto.subtle.verify(SIGN, authPublic, signature, challenge))
+            throw new Error('Auth key mismatch');
+        const endpointRaw = new Uint8Array(Buffer.from(record.endpointPublicKey, 'base64url'));
+        const endpointId = Buffer.from(await crypto.subtle.digest('SHA-256', endpointRaw)).toString('base64url');
+        const endpoint = record.endpoint === undefined ? null : { ...record.endpoint };
+        if (endpoint !== null && endpoint.id !== endpointId)
+            throw new Error('Endpoint id mismatch');
+        return {
+            keyPair: { publicKey: endpointPublic, privateKey: endpointPrivate }, endpointPublicKey: record.endpointPublicKey, endpointId,
+            authPublicKey: record.authPublicKey, authPrivateKey, endpoint, accountId: endpoint === null ? null : endpoint.ownerId,
+        };
+    }
+    catch {
+        throw new BridgeSecurityError('key_unavailable');
+    }
+}
+/** Reports the v2 identity file's state without importing keys. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export async function inspectIdentityFile(dataDir) {
+    const record = await readRecord(identityFile(dataDir));
+    if (record === null)
+        return { state: 'absent', accountId: null };
+    return { state: 'ready', accountId: record.endpoint === undefined ? null : record.endpoint.ownerId };
+}
+/**
+ * True iff the data dir holds v1 ACCOUNT state: `refresh-token`, `security/account-enrollment.json`,
+ * `security/pending-approval-status.json` or `security/pending-approval-confirmation.json` exists, or `security/bridge-identity.json`
+ * has a readable endpoint owner that is not `solo:` (Solo's identity is never reported). An unreadable bridge-identity.json is not
+ * reported: its owner cannot be told apart from Solo's. Reads only; never modifies anything.
+ */
+export function hasLegacyAccountState(dataDir) {
+    if (LEGACY_ACCOUNT_FILES.some(parts => existsSync(join(dataDir, ...parts))))
+        return true;
+    let value;
+    try {
+        value = JSON.parse(readFileSync(join(dataDir, 'security', 'bridge-identity.json'), 'utf8'));
+    }
+    catch {
+        return false;
+    }
+    if (typeof value !== 'object' || value === null || !('endpoint' in value))
+        return false;
+    const endpoint = value.endpoint;
+    if (typeof endpoint !== 'object' || endpoint === null || !('ownerId' in endpoint) || typeof endpoint.ownerId !== 'string')
+        return false;
+    return endpoint.ownerId.length > 0 && endpoint.ownerId.indexOf('solo:') !== 0;
+}
+/** Loads the identity without creating one: null when absent. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export function readLedgerIdentity(dataDir) {
+    const file = identityFile(dataDir);
+    return serialized(file, async () => {
+        await sweepTemporaries(file);
+        const record = await readRecord(file);
+        return record === null ? null : importRecord(record);
+    });
+}
+/**
+ * Loads the identity, creating fresh keys only when the file is absent. Throws BridgeSecurityError: key_unavailable for an unreadable
+ * or corrupted file (never replaced), storage_unavailable when the new file cannot be written.
+ */
+export function loadOrCreateLedgerIdentity(dataDir) {
+    const file = identityFile(dataDir);
+    return serialized(file, async () => {
+        await sweepTemporaries(file);
+        const existing = await readRecord(file);
+        if (existing !== null)
+            return importRecord(existing);
+        const created = await generateRecord();
+        if (await publish(file, created, true))
+            return importRecord(created);
+        // Another process created it between the read and the link: use theirs.
+        const raced = await readRecord(file);
+        if (raced === null)
+            throw new BridgeSecurityError('key_unavailable');
+        return importRecord(raced);
+    });
+}
+/**
+ * Binds the identity to `accountId` once: sets endpoint {version:1, id, ownerId: accountId, kind:'bridge', publicKey}. Idempotent for
+ * the same account. Throws BridgeSecurityError: wrong_context for a different (or malformed) accountId, key_unavailable when there is
+ * no valid identity to bind, storage_unavailable when the file cannot be written. Binds are serialized within this process only: the
+ * bridge's single-instance guarantee keeps a second process from binding concurrently.
+ */
+export function bindLedgerIdentity(dataDir, accountId) {
+    if (!isAccountId(accountId))
+        return Promise.reject(new BridgeSecurityError('wrong_context'));
+    const file = identityFile(dataDir);
+    return serialized(file, async () => {
+        await sweepTemporaries(file);
+        const record = await readRecord(file);
+        if (record === null)
+            throw new BridgeSecurityError('key_unavailable');
+        const identity = await importRecord(record);
+        if (identity.accountId !== null) {
+            if (identity.accountId !== accountId)
+                throw new BridgeSecurityError('wrong_context');
+            return identity;
+        }
+        const endpoint = { version: 1, id: identity.endpointId, ownerId: accountId, kind: 'bridge', publicKey: identity.endpointPublicKey };
+        await publish(file, { ...record, endpoint }, false);
+        return { ...identity, endpoint: { ...endpoint }, accountId };
+    });
+}
+//# sourceMappingURL=ledger-identity.js.map

package/dist/security/bridge/ledger-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-identity.js","sourceRoot":"","sources":["../../../src/security/bridge/ledger-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAsB/C,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAC5D,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAW,CAAC;AAC9D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AACzD,6GAA6G;AAC7G,MAAM,oBAAoB,GAAG;IAC3B,CAAC,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC,UAAU,EAAE,8BAA8B,CAAC;IACxG,CAAC,UAAU,EAAE,oCAAoC,CAAC;CACnD,CAAC;AACF,MAAM,SAAS,GAAG,uEAAuE,CAAC;AAE1F,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAClH,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpF,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAC5D,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,SAAS;IACrB,iBAAiB,EAAE,WAAW;IAC9B,aAAa,EAAE,WAAW;IAC1B,cAAc,EAAE,SAAS;CAC1B,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,aAAa;QAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC5H,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,iBAAiB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChJ,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;AAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;AAEhC,8EAA8E;AAC9E,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC;AAClE,CAAC;AACD,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnI,CAAC;AACD,oEAAoE;AACpE,SAAS,UAAU,CAAI,IAAY,EAAE,GAAqB;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1B,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AACD,2IAA2I;AAC3I,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAC5B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3J,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9F,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AACD,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAC9D,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACjI,CAAC;AACD;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAsB,EAAE,SAAkB;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBACxF,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACjC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YACpC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAChD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB,EAAE,KAAiB;IACpD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9F,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AACD,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,YAAY,CAAC,KAAK,CAAC;YACxB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC;YACrE,iBAAiB,EAAE,MAAM,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC5D,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,cAAc,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AACD,wGAAwG;AACxG,KAAK,UAAU,YAAY,CAAC,MAAsB;IAChD,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7H,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7G,8GAA8G;QAC9G,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9H,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAEtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QACrI,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzH,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAE9G,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/E,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7F,OAAO;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,UAAU;YAC5H,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;SACtH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,uIAAuI;AACvI,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAC5H,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxI,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,qIAAqI;AACrI,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;QACrE,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QACrE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,SAAiB;IACnE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACrF,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACpJ,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/security/bridge/ledger-store.d.ts

@@ -0,0 +1,84 @@
+import type { BridgePairLink, PairApproval } from '../ledger/pairing.js';
+import type { Ledger, LedgerCheckpoint, LedgerTransition, Signed } from '../ledger/protocol.js';
+export type LedgerSource = 'server' | 'relay';
+export type OwnBridgeStatus = 'active' | 'revoked' | 'absent';
+export type ReconcileResult = 'ok' | 'unpaired' | 'needs_ledger';
+export interface StickyRevocations {
+    deviceIds: string[];
+    bridgeIds: string[];
+}
+export interface BridgeLedgerState {
+    ledger: Ledger;
+    /** The stored chain's own checkpoint (raw). Never use it for a trust decision. */
+    checkpoint: LedgerCheckpoint;
+    /** applyRevocations(checkpoint, sticky): the checkpoint for every trust decision. */
+    trusted: LedgerCheckpoint;
+    /** Union of the revocations of every chain this replica kept or adopted. */
+    sticky: StickyRevocations;
+    lastServerReadAt: number | null;
+}
+export interface LedgerOfferResult {
+    decision: 'adopt' | 'keep' | 'reject';
+    /** The stored state after the decision; null while the store is empty. */
+    state: BridgeLedgerState | null;
+    /** Local records discarded by a winning fork, for the owner to re-sign; empty otherwise. */
+    discarded: Signed<LedgerTransition>[];
+}
+export interface BridgeLedgerStoreOptions {
+    /** The account the bridge identity is bound to: ledgers of any other account are rejected even while the store is empty, and a
+     *  stored ledger of another account throws LedgerStoreError('ledger_store_wrong_account'). */
+    accountId?: string | null;
+    now?: () => number;
+}
+export type LedgerStoreErrorCode = 'ledger_store_corrupt' | 'ledger_store_wrong_account' | 'ledger_store_pairing_rejected' | 'ledger_store_bound_rejected';
+/** Not retryable; file contents and crypto errors never enter it. Read/write failures throw BridgeSecurityError('storage_unavailable'). */
+export declare class LedgerStoreError extends Error {
+    readonly code: LedgerStoreErrorCode;
+    readonly retryable = false;
+    constructor(code: LedgerStoreErrorCode);
+}
+export declare class BridgeLedgerStore {
+    private readonly replica;
+    constructor(dataDir: string, options?: BridgeLedgerStoreOptions);
+    /** The stored state, or null while no ledger is stored. Throws LedgerStoreError for a corrupted or wrong-account file. */
+    read(): Promise<BridgeLedgerState | null>;
+    /** applyRevocations(checkpoint, sticky) of the stored chain, or null while no ledger is stored. */
+    trusted(): Promise<LedgerCheckpoint | null>;
+    /** 'revoked' iff bridgeId is revoked in trusted(); 'active' iff trusted() lists bridgeId with this auth key; else 'absent'. */
+    ownBridgeStatus(bridgeId: string, authPublicKey: string): Promise<OwnBridgeStatus>;
+    /** ownBridgeStatus(bridgeId, …) === 'revoked': by the stored chain or by any chain this replica ever kept or adopted. */
+    ownBridgeRevoked(bridgeId: string): Promise<boolean>;
+    /**
+     * Offers an untrusted candidate chain from the server or the relay. Never binds an empty store, and never throws for a bad candidate:
+     * it is rejected. Throws LedgerStoreError for a corrupted or wrong-account local file, and BridgeSecurityError('storage_unavailable')
+     * when the file cannot be read or written.
+     */
+    offer(candidate: unknown, source: LedgerSource): Promise<LedgerOfferResult>;
+    /**
+     * The pairing path, after openPairApproval. Runs confirmPairedLedger(link, approval, ledger, now, sticky) with this replica's sticky
+     * set, then binds the empty store (or applies the replica rule to a bound store of the same account); the request's bridge must be in
+     * the resulting trusted roster. Returns trusted(). Throws LedgerStoreError('ledger_store_pairing_rejected') and writes nothing on any
+     * pairing failure.
+     */
+    adoptPaired(link: BridgePairLink, approval: PairApproval, ledger: unknown, now?: number): Promise<LedgerCheckpoint>;
+    /**
+     * Recovery when the identity is bound but the store is empty (reconcileIdentityAndStore returned 'needs_ledger'): accepts a server
+     * ledger only if its account is the identity's bound account and its trusted roster lists this identity's bridge keys (endpoint id and
+     * authPublicKey). Returns trusted(). Throws LedgerStoreError('ledger_store_bound_rejected') and writes nothing otherwise.
+     */
+    adoptBound(ledger: unknown, now?: number): Promise<LedgerCheckpoint>;
+    /** Records the time of the last successful server ledger read. No-op while no ledger is stored. */
+    markServerRead(now: number): Promise<void>;
+}
+/**
+ * Startup recovery between the identity file and the ledger store, under the store's queue:
+ * - identity bound, store holds its account's ledger -> 'ok'; store holds another account's -> throws ledger_store_wrong_account;
+ * - identity bound, store empty -> 'needs_ledger' (fetch the server ledger, then adoptBound); a bound identity is never unbound;
+ * - identity unbound (or absent), store empty -> 'unpaired';
+ * - identity unbound, store's trusted roster lists this identity's bridge keys -> binds the identity to that account -> 'ok';
+ * - otherwise (absent identity, or keys not listed) the stale ledger.json is deleted -> 'unpaired'.
+ * Corrupted files throw (LedgerStoreError / BridgeSecurityError('key_unavailable')) and are never reset.
+ */
+export declare function reconcileIdentityAndStore(dataDir: string, options?: {
+    now?: () => number;
+}): Promise<ReconcileResult>;