instar 1.3.896 → 1.3.897

package/dist/core/MutualSshRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshRuntime.js","sourceRoot":"","sources":["../../src/core/MutualSshRuntime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAiC,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAiD,MAAM,wBAAwB,CAAC;AACxI,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAA4B,MAAM,gCAAgC,CAAC;AAC/H,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAA2B,MAAM,yBAAyB,CAAC;AAqC3H,sGAAsG;AACtG,MAAM,OAAO,gBAAgB;IAuBE;IAtBZ,eAAe,CAAqB;IACpC,cAAc,CAAwB;IACtC,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;IACnC,UAAU,CAA4B;IACtC,SAAS,CAA0B;IAC5C,QAAQ,CAA4B;IACpC,QAAQ,GAA8B,IAAI,CAAC;IAC3C,MAAM,GAA0C,IAAI,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAChD,gBAAgB,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAClD,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IAChD,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,GAA0B,IAAI,CAAC;IACpC,gBAAgB,GAA0B,IAAI,CAAC;IAC/C,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IACP,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,SAAS,CAAS;IAEnC,YAA6B,CAAuB;QAAvB,MAAC,GAAD,CAAC,CAAsB;QAClD,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC;QAC3C,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACvC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpG,IAAI,CAAC,eAAe,GAAG,IAAI,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QACtF,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC7D,aAAa,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACrF,kBAAkB,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxI,eAAe,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;gBAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3E,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAClE,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBACjE,MAAM,CAAC,kCAAkC,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC1G,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACpD,CAAC;YACD,cAAc,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YACpH,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;SAC9H,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAC;QACjF,IAAI,CAAC,yBAAyB,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAClE,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,eAAe,CAAC,gBAAgB,KAAK,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,eAAe,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC3I,MAAM,WAAW,GAAG,eAAe,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gBACpF,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,EAAE,cAAc,EAAE,eAAe,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC/I,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC;gBAChC,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;oBAC9B,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;oBAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oBACnB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACzF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjG,KAAK,MAAM,SAAS,IAAI,WAAW;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBACjG,OAAO,KAAK,EAAE,CAAC;oBACb,oEAAoE;oBACpE,iEAAiE;oBACjE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACzF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/G,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAC,SAAS,EAAC,EAAE;gBAC/P,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,eAAe,CAAC,CAAC;gBAC3I,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACjF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAC9C,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,YAAY,CAAC,GAAY,EAAE,mBAA2B;QACpD,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1J,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IACzD,CAAC;IAED,WAAW,CAAC,GAAY,EAAE,mBAA2B;QACnD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,GAA0B,CAAC;QACzC,IAAI,KAAK,CAAC,eAAe,KAAK,mBAAmB,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACnM,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC;YAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC3P,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,uBAAuB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1I,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,mBAAmB,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,yBAAyB;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACzL,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI,CAAC,QAAQ,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5H,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1G,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrJ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,mBAAmB,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAClK,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,kFAAkF;IAClF,kBAAkB,CAAC,GAAY,EAAE,mBAA2B;QAC1D,IAAI,CAAC;YAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAChE,OAAO,KAAK,EAAE,CAAC;YACb,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACjJ,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrK,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC;gBAChD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;oBAC5E,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE;oBAC/B,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;oBACpE,uBAAuB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;oBACxI,qBAAqB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;iBACnI,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;QACpG,MAAM,UAAU,GAAG,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACvG,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChF,MAAM,KAAK,GAAG,CAAC,iBAAiB,IAAI,UAAU,CAAC;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QAC1P,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACxN,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,gBAAgB;YAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE;YAAE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,kBAAkB,CAAC;YACrC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc;YACzF,mBAAmB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClL,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,sBAAsB;YAClF,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc;YAC5C,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE;gBAChC,MAAM,QAAQ,GAAG,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,kBAAkB,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvM,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC;YACjZ,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACjG,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvF,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,sEAAsE;YACtE,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBACtC,wEAAwE;gBACxE,wEAAwE;YAC1E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,YAAoB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY;YACtE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC;YAC9F,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ;SACjD,CAAC,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,QAAQ,GAAiD;YAC7D,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY;YACtE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAC1F,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC/F,iBAAiB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;YAC3J,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;YACnG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG,CAAC;QACF,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAyB,CAAC;QACrJ,IAAI,QAAQ,EAAE,MAAM;YAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;IAEO,aAAa,CAAC,MAA0B;QAC9C,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC3Q,IAAI,KAAK,IAAI,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;YACtD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzC,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,KAAK,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAAC,CAAC;QAC3Q,IAAI,KAAK,IAAI,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,0BAA0B;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACrG,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,mBAAmB,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;gBACvF,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;gBACjF,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,0BAA0B;aACvH,CAAC;YACF,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE;gBAC1B,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,wBAAwB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC;gBAC1G,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC7H,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1T,CAAC;IAEO,SAAS,CAAC,IAAmB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO;YACL,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS;YACtE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YACzK,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,cAAc;YACtE,yBAAyB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,CAAC,iBAAiB;YAC5G,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,QAAQ,CAAC,oBAAoB;YAC1G,0BAA0B,EAAE,IAAI,CAAC,kBAAkB;YACnD,kCAAkC,EAAE,kBAAkB,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YACjG,qBAAqB,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;YAChG,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;SAC3C,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,KAA0B,EAAE,MAAc;QAC5D,IAAI,KAAK,CAAC,eAAe,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,oBAAoB,CAAC,SAAiB,EAAE,UAAkB;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,iBAAiB,KAAK,UAAU;YAAE,OAAO;QACnF,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACpS,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IAEO,iBAAiB,CAAC,SAAiB;QACzC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3I,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAEO,uBAAuB;QAC7B,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,0BAA0B;YAAE,OAAO;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,uBAAuB,KAAK,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC;QAC/I,CAAC,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,KAAK,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACpD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,CAAC,gBAAgB;YAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACnG,CAAC;IAEO,UAAU,CAAC,KAAsC;QACvD,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClK,CAAC;IACO,GAAG,CAAC,MAAc,EAAE,MAAc,IAAY,OAAO,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,KAA8B,IAAU,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAE3G,yBAAyB;QAC/B,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACtG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAiB,CAAC;YACpE,8EAA8E;YAC9E,gFAAgF;YAChF,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IAC1F,CAAC;IAEO,aAAa;QACnB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvI,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;QACnE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/K,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,IAAY,IAAa,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/MutualSshVerifier.d.ts

@@ -0,0 +1,44 @@
+export interface DirectionalSshProof {
+    sourceMachineId: string;
+    targetMachineId: string;
+    pairingEpoch: number;
+    observerBootId: string;
+    endpointId: string;
+    sourceClientKeyGeneration: number;
+    targetHostKeyGeneration: number;
+    targetHostKeyFingerprint: string;
+    verifiedAt: string;
+    expiresAt: string;
+    challengeDigest: string;
+    machineSignature?: string;
+    /** Origin-process local authority. Omitted from replicated proof payloads. */
+    monotonicDeadlineMs?: number;
+}
+export interface SshProbeTarget {
+    sourceMachineId: string;
+    targetMachineId: string;
+    host: string;
+    port: number;
+    endpointId: string;
+    pairingEpoch: number;
+    observerBootId: string;
+    sourceClientKeyGeneration: number;
+    targetHostKeyGeneration: number;
+    targetHostPublicKey: string;
+    clientPrivateKeyPath: string;
+    expectedMachineFingerprint: string;
+    expectedSourceClientKeyFingerprint: string;
+    verifyMachineResponse: (canonicalPayload: string, signature: string) => boolean;
+    signProof?: (canonicalPayload: string) => string;
+}
+export declare function canonicalDirectionalSshProof(proof: Omit<DirectionalSshProof, 'machineSignature' | 'monotonicDeadlineMs'>): string;
+export declare class MutualSshVerifier {
+    probe(target: SshProbeTarget, now?: number): Promise<DirectionalSshProof>;
+    static mutual(aToB: DirectionalSshProof | undefined, bToA: DirectionalSshProof | undefined, now?: number, context?: {
+        monotonicNow?: number;
+        liveBootIds?: ReadonlySet<string>;
+        sourceClientGenerations?: ReadonlyMap<string, number>;
+        targetHostGenerations?: ReadonlyMap<string, number>;
+    }): boolean;
+}
+//# sourceMappingURL=MutualSshVerifier.d.ts.map

package/dist/core/MutualSshVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshVerifier.d.ts","sourceRoot":"","sources":["../../src/core/MutualSshVerifier.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB,EAAE,MAAM,CAAC;IAClC,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,yBAAyB,EAAE,MAAM,CAAC;IAClC,uBAAuB,EAAE,MAAM,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B,EAAE,MAAM,CAAC;IACnC,kCAAkC,EAAE,MAAM,CAAC;IAC3C,qBAAqB,EAAE,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAChF,SAAS,CAAC,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,MAAM,CAAC;CAClD;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,GAAG,qBAAqB,CAAC,GAAG,MAAM,CASjI;AAED,qBAAa,iBAAiB;IACtB,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgDnF,MAAM,CAAC,MAAM,CACX,IAAI,EAAE,mBAAmB,GAAG,SAAS,EACrC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EACrC,GAAG,SAAa,EAChB,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACrD,GACA,OAAO;CAUX"}

package/dist/core/MutualSshVerifier.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs';
+import { createHash, randomBytes } from 'node:crypto';
+import { Client, utils } from 'ssh2';
+import { canonicalSshResponse } from './MachineSshEndpoint.js';
+export function canonicalDirectionalSshProof(proof) {
+    return JSON.stringify({
+        sourceMachineId: proof.sourceMachineId, targetMachineId: proof.targetMachineId,
+        pairingEpoch: proof.pairingEpoch, observerBootId: proof.observerBootId,
+        endpointId: proof.endpointId, sourceClientKeyGeneration: proof.sourceClientKeyGeneration,
+        targetHostKeyGeneration: proof.targetHostKeyGeneration,
+        targetHostKeyFingerprint: proof.targetHostKeyFingerprint, verifiedAt: proof.verifiedAt,
+        expiresAt: proof.expiresAt, challengeDigest: proof.challengeDigest,
+    });
+}
+export class MutualSshVerifier {
+    async probe(target, now = Date.now()) {
+        const nonce = randomBytes(24).toString('base64url');
+        const challenge = {
+            nonce, pairingEpoch: target.pairingEpoch, observerBootId: target.observerBootId,
+            clientGeneration: target.sourceClientKeyGeneration, hostGeneration: target.targetHostKeyGeneration,
+        };
+        const expectedHost = utils.parseKey(target.targetHostPublicKey);
+        if (expectedHost instanceof Error)
+            throw new Error('invalid-pinned-host-key');
+        const expectedHostFingerprint = createHash('sha256').update(expectedHost.getPublicSSH()).digest('hex');
+        const response = await withDeadline(8_000, (resolve, reject) => {
+            const client = new Client();
+            client.once('ready', () => client.subsys('instar-rpc', (error, stream) => {
+                if (error)
+                    return reject(error);
+                let data = '';
+                stream.setEncoding('utf8');
+                stream.on('data', (chunk) => { data += chunk; if (data.length > 256 * 1024)
+                    client.end(); });
+                stream.on('close', () => {
+                    client.end();
+                    try {
+                        resolve(JSON.parse(data.trim()));
+                    }
+                    catch {
+                        reject(new Error('invalid-ssh-rpc-response'));
+                    }
+                });
+                stream.end(`${JSON.stringify(challenge)}\n`);
+            }));
+            client.once('error', reject);
+            client.connect({
+                host: target.host, port: target.port, username: 'instar', privateKey: fs.readFileSync(target.clientPrivateKeyPath),
+                readyTimeout: 7_500, hostVerifier: (key) => key.equals(expectedHost.getPublicSSH()),
+                algorithms: { serverHostKey: ['ssh-ed25519'], kex: ['curve25519-sha256', 'curve25519-sha256@libssh.org'] },
+            });
+            return () => client.end();
+        });
+        const { signature, ...unsigned } = response;
+        if (typeof signature !== 'string' || !target.verifyMachineResponse(canonicalSshResponse(unsigned), signature))
+            throw new Error('ssh-proof-machine-signature-invalid');
+        if (response.nonce !== nonce || response.machineId !== target.targetMachineId || response.machineFingerprint !== target.expectedMachineFingerprint
+            || response.sourceClientKeyFingerprint !== target.expectedSourceClientKeyFingerprint
+            || response.pairingEpoch !== target.pairingEpoch || response.observerBootId !== target.observerBootId
+            || response.clientGeneration !== target.sourceClientKeyGeneration || response.hostGeneration !== target.targetHostKeyGeneration)
+            throw new Error('ssh-proof-identity-mismatch');
+        const proof = {
+            sourceMachineId: target.sourceMachineId, targetMachineId: target.targetMachineId,
+            pairingEpoch: target.pairingEpoch, observerBootId: target.observerBootId, endpointId: target.endpointId,
+            sourceClientKeyGeneration: target.sourceClientKeyGeneration, targetHostKeyGeneration: target.targetHostKeyGeneration,
+            targetHostKeyFingerprint: expectedHostFingerprint, verifiedAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + 300_000).toISOString(), challengeDigest: createHash('sha256').update(nonce).digest('hex'),
+            monotonicDeadlineMs: performance.now() + 300_000,
+        };
+        if (target.signProof)
+            proof.machineSignature = target.signProof(canonicalDirectionalSshProof(proof));
+        return proof;
+    }
+    static mutual(aToB, bToA, now = Date.now(), context) {
+        if (!aToB || !bToA)
+            return false;
+        const proofs = [aToB, bToA];
+        if (context?.liveBootIds && proofs.some(proof => !context.liveBootIds.has(proof.observerBootId)))
+            return false;
+        if (context?.sourceClientGenerations && proofs.some(proof => context.sourceClientGenerations.get(proof.sourceMachineId) !== proof.sourceClientKeyGeneration))
+            return false;
+        if (context?.targetHostGenerations && proofs.some(proof => context.targetHostGenerations.get(proof.targetMachineId) !== proof.targetHostKeyGeneration))
+            return false;
+        if (context?.monotonicNow !== undefined && proofs.some(proof => proof.monotonicDeadlineMs === undefined || proof.monotonicDeadlineMs <= context.monotonicNow))
+            return false;
+        return aToB.sourceMachineId === bToA.targetMachineId && aToB.targetMachineId === bToA.sourceMachineId
+            && aToB.pairingEpoch === bToA.pairingEpoch && Date.parse(aToB.expiresAt) > now && Date.parse(bToA.expiresAt) > now;
+    }
+}
+function withDeadline(ms, run) {
+    return new Promise((resolve, reject) => {
+        let cleanup = () => { };
+        const timer = setTimeout(() => { cleanup(); reject(new Error('ssh-probe-timeout')); }, ms);
+        cleanup = run(value => { clearTimeout(timer); resolve(value); }, error => { clearTimeout(timer); reject(error); });
+    });
+}
+//# sourceMappingURL=MutualSshVerifier.js.map

package/dist/core/MutualSshVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshVerifier.js","sourceRoot":"","sources":["../../src/core/MutualSshVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAA6C,MAAM,yBAAyB,CAAC;AAqC1G,MAAM,UAAU,4BAA4B,CAAC,KAA4E;IACvH,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;QAC9E,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;QACtE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB;QACxF,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;QACtD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QACtF,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe;KACnE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,KAAK,CAAC,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAoB;YACjC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc;YAC/E,gBAAgB,EAAE,MAAM,CAAC,yBAAyB,EAAE,cAAc,EAAE,MAAM,CAAC,uBAAuB;SACnG,CAAC;QACF,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAChE,IAAI,YAAY,YAAY,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9E,MAAM,uBAAuB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAiB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7E,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACvE,IAAI,KAAK;oBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACd,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI;oBAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,MAAM,CAAC,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC;wBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;oBAAC,CAAC;gBACpG,CAAC,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,OAAO,CAAC;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,oBAAoB,CAAC;gBAClH,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC3F,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,EAAE;aAC3G,CAAC,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC5C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACtK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC,kBAAkB,KAAK,MAAM,CAAC,0BAA0B;eAC7I,QAAQ,CAAC,0BAA0B,KAAK,MAAM,CAAC,kCAAkC;eACjF,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;eAClG,QAAQ,CAAC,gBAAgB,KAAK,MAAM,CAAC,yBAAyB,IAAI,QAAQ,CAAC,cAAc,KAAK,MAAM,CAAC,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAClL,MAAM,KAAK,GAAwB;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;YAChF,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;YACvG,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACpH,wBAAwB,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAC1F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACnH,mBAAmB,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;SACjD,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC;QACrG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CACX,IAAqC,EACrC,IAAqC,EACrC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,OAKC;QAED,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,WAAY,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAChH,IAAI,OAAO,EAAE,uBAAuB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,uBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,yBAAyB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5K,IAAI,OAAO,EAAE,qBAAqB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,qBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,uBAAuB,CAAC;YAAE,OAAO,KAAK,CAAC;QACtK,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,IAAI,OAAO,CAAC,YAAa,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7K,OAAO,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;eAChG,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;IACvH,CAAC;CACF;AAED,SAAS,YAAY,CAAI,EAAU,EAAE,GAAgF;IACnH,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,OAAO,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/SshBootstrapAdvert.d.ts

@@ -0,0 +1,23 @@
+export interface SshBootstrapAdvert {
+    machineId: string;
+    agentId: string;
+    pairingEpoch: number;
+    observerBootId: string;
+    clientKeyGeneration: number;
+    hostKeyGeneration: number;
+    clientPublicKey: string;
+    sshHostPublicKeys: string[];
+    endpoints: Array<{
+        host: string;
+        port: number;
+        source: 'tailscale' | 'lan' | 'configured';
+    }>;
+    issuedAt: string;
+    expiresAt: string;
+    hostKeyTransitionSignature?: string;
+    machineSignature: string;
+}
+export declare function canonicalSshBootstrapAdvert(advert: Omit<SshBootstrapAdvert, 'machineSignature'>): string;
+/** Structural security floor; MachineAuth signature/principal validation precedes this call. */
+export declare function validateSshBootstrapAdvert(input: unknown, principalMachineId: string, principalAgentId: string, now?: number): SshBootstrapAdvert;
+//# sourceMappingURL=SshBootstrapAdvert.d.ts.map

package/dist/core/SshBootstrapAdvert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshBootstrapAdvert.d.ts","sourceRoot":"","sources":["../../src/core/SshBootstrapAdvert.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,GAAG,KAAK,GAAG,YAAY,CAAA;KAAE,CAAC,CAAC;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,MAAM,CASxG;AAED,gGAAgG;AAChG,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,kBAAkB,CAarJ"}

package/dist/core/SshBootstrapAdvert.js

@@ -0,0 +1,43 @@
+import net from 'node:net';
+export function canonicalSshBootstrapAdvert(advert) {
+    return JSON.stringify({
+        machineId: advert.machineId, agentId: advert.agentId, pairingEpoch: advert.pairingEpoch,
+        observerBootId: advert.observerBootId, clientKeyGeneration: advert.clientKeyGeneration,
+        hostKeyGeneration: advert.hostKeyGeneration, clientPublicKey: advert.clientPublicKey,
+        sshHostPublicKeys: advert.sshHostPublicKeys, endpoints: advert.endpoints,
+        issuedAt: advert.issuedAt, expiresAt: advert.expiresAt,
+        ...(advert.hostKeyTransitionSignature ? { hostKeyTransitionSignature: advert.hostKeyTransitionSignature } : {}),
+    });
+}
+/** Structural security floor; MachineAuth signature/principal validation precedes this call. */
+export function validateSshBootstrapAdvert(input, principalMachineId, principalAgentId, now = Date.now()) {
+    if (!input || typeof input !== 'object')
+        throw new Error('invalid-ssh-advert');
+    const row = input;
+    if (row.machineId !== principalMachineId || row.agentId !== principalAgentId)
+        throw new Error('ssh-advert-principal-mismatch');
+    if (!Number.isSafeInteger(row.pairingEpoch) || row.pairingEpoch < 1 || !Number.isSafeInteger(row.clientKeyGeneration) || !Number.isSafeInteger(row.hostKeyGeneration))
+        throw new Error('ssh-advert-generation-invalid');
+    const issuedAt = Date.parse(row.issuedAt);
+    const expiresAt = Date.parse(row.expiresAt);
+    if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || issuedAt > now + 30_000 || expiresAt <= now || expiresAt - now > 300_000)
+        throw new Error('ssh-advert-expired');
+    if (!Array.isArray(row.sshHostPublicKeys) || !/^ssh-ed25519 [A-Za-z0-9+/=]+(?:\s|$)/.test(row.clientPublicKey) || row.sshHostPublicKeys.length < 1 || row.sshHostPublicKeys.length > 2 || row.sshHostPublicKeys.some(key => !/^ssh-ed25519 [A-Za-z0-9+/=]+(?:\s|$)/.test(key)))
+        throw new Error('ssh-advert-key-invalid');
+    if (!Array.isArray(row.endpoints) || row.endpoints.length > 8 || row.endpoints.some(endpoint => !validEndpoint(endpoint)))
+        throw new Error('ssh-advert-endpoint-invalid');
+    if (typeof row.observerBootId !== 'string' || row.observerBootId.length < 8 || row.observerBootId.length > 128 || typeof row.machineSignature !== 'string' || row.machineSignature.length < 32 || row.machineSignature.length > 512)
+        throw new Error('ssh-advert-signature-invalid');
+    if (row.hostKeyTransitionSignature !== undefined && (typeof row.hostKeyTransitionSignature !== 'string' || row.hostKeyTransitionSignature.length < 32 || row.hostKeyTransitionSignature.length > 512))
+        throw new Error('ssh-advert-transition-signature-invalid');
+    return row;
+}
+function validEndpoint(endpoint) {
+    if (!['tailscale', 'lan', 'configured'].includes(endpoint.source) || !Number.isInteger(endpoint.port) || endpoint.port < 1024 || endpoint.port > 65535)
+        return false;
+    if (net.isIP(endpoint.host) !== 4)
+        return false;
+    const [a, b] = endpoint.host.split('.').map(Number);
+    return a === 10 || (a === 100 && b >= 64 && b <= 127) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
+}
+//# sourceMappingURL=SshBootstrapAdvert.js.map

package/dist/core/SshBootstrapAdvert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshBootstrapAdvert.js","sourceRoot":"","sources":["../../src/core/SshBootstrapAdvert.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAkB3B,MAAM,UAAU,2BAA2B,CAAC,MAAoD;IAC9F,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY;QACvF,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QACtF,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe;QACpF,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACxE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QACtD,GAAG,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChH,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,0BAA0B,CAAC,KAAc,EAAE,kBAA0B,EAAE,gBAAwB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/H,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,KAA2B,CAAC;IACxC,IAAI,GAAG,CAAC,SAAS,KAAK,kBAAkB,IAAI,GAAG,CAAC,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxN,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,GAAG,GAAG,GAAG,MAAM,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,GAAG,GAAG,GAAG,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACjL,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1T,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1K,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrR,IAAI,GAAG,CAAC,0BAA0B,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,CAAC,0BAA0B,KAAK,QAAQ,IAAI,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAClQ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,QAAiD;IACtE,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC;IACrK,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;AACzH,CAAC"}

package/dist/core/SshHostKeyLifecycle.d.ts

@@ -0,0 +1,43 @@
+export type SshHostKeyState = 'current' | 'quarantined' | 'overlap' | 'retired' | 'rollback-rejected';
+export interface SignedHostKeyProposal {
+    agentId: string;
+    machineId: string;
+    pairingEpoch: number;
+    generation: number;
+    previousGeneration: number;
+    publicKey: string;
+    issuedAt: string;
+    machineSignature: string;
+    previousHostSignature?: string;
+}
+export interface HostKeyProposalVerifier {
+    verifyMachine(proposal: SignedHostKeyProposal): boolean;
+    verifyPreviousHost(proposal: SignedHostKeyProposal): boolean;
+}
+export interface HostKeyGeneration {
+    generation: number;
+    fingerprint: string;
+    publicKey: string;
+    state: SshHostKeyState;
+    quarantinedAt?: number;
+}
+export declare function canonicalHostKeyProposal(proposal: Omit<SignedHostKeyProposal, 'machineSignature' | 'previousHostSignature'>): string;
+/** Monotonic, fail-closed host-key rotation state machine. */
+export declare class SshHostKeyLifecycle {
+    private readonly overlapCeilingMs;
+    private current;
+    private candidate?;
+    constructor(initial: {
+        generation: number;
+        publicKey: string;
+    }, overlapCeilingMs?: number);
+    propose(proposal: SignedHostKeyProposal, verifier: HostKeyProposalVerifier, now?: number): HostKeyGeneration;
+    proveCandidate(generation: number): HostKeyGeneration;
+    promote(generation: number, allRequiredInboundProofs: boolean, now?: number): HostKeyGeneration;
+    expire(now?: number): void;
+    snapshot(): {
+        current: HostKeyGeneration;
+        candidate?: HostKeyGeneration;
+    };
+}
+//# sourceMappingURL=SshHostKeyLifecycle.d.ts.map

package/dist/core/SshHostKeyLifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshHostKeyLifecycle.d.ts","sourceRoot":"","sources":["../../src/core/SshHostKeyLifecycle.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAEtG,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC;IACxD,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,eAAe,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,GAAG,uBAAuB,CAAC,GAAG,MAAM,CAMpI;AAED,8DAA8D;AAC9D,qBAAa,mBAAmB;IAIkC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAHjG,OAAO,CAAC,OAAO,CAAoB;IACnC,OAAO,CAAC,SAAS,CAAC,CAAoB;gBAE1B,OAAO,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAmB,gBAAgB,SAAU;IAI3G,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,GAAG,SAAa,GAAG,iBAAiB;IAgBhH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,iBAAiB;IAMrD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,GAAG,SAAa,GAAG,iBAAiB;IASnG,MAAM,CAAC,GAAG,SAAa,GAAG,IAAI;IAI9B,QAAQ,IAAI;QAAE,OAAO,EAAE,iBAAiB,CAAC;QAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE;CAG1E"}

package/dist/core/SshHostKeyLifecycle.js

@@ -0,0 +1,68 @@
+import { createHash } from 'node:crypto';
+export function canonicalHostKeyProposal(proposal) {
+    return JSON.stringify({
+        agentId: proposal.agentId, machineId: proposal.machineId, pairingEpoch: proposal.pairingEpoch,
+        generation: proposal.generation, previousGeneration: proposal.previousGeneration,
+        publicKey: proposal.publicKey, issuedAt: proposal.issuedAt,
+    });
+}
+/** Monotonic, fail-closed host-key rotation state machine. */
+export class SshHostKeyLifecycle {
+    overlapCeilingMs;
+    current;
+    candidate;
+    constructor(initial, overlapCeilingMs = 600_000) {
+        this.overlapCeilingMs = overlapCeilingMs;
+        this.current = { ...initial, fingerprint: keyFingerprint(initial.publicKey), state: 'current' };
+    }
+    propose(proposal, verifier, now = Date.now()) {
+        const fp = keyFingerprint(proposal.publicKey);
+        if (!verifier.verifyMachine(proposal))
+            throw new Error('host-key-machine-signature-invalid');
+        if (proposal.generation <= this.current.generation || proposal.previousGeneration !== this.current.generation) {
+            throw new Error('host-key-rollback-rejected');
+        }
+        if (proposal.generation !== this.current.generation + 1)
+            throw new Error('host-key-generation-gap');
+        if (this.candidate) {
+            if (this.candidate.generation === proposal.generation && this.candidate.fingerprint === fp)
+                return this.candidate;
+            throw new Error('host-key-competing-proposal');
+        }
+        this.candidate = { generation: proposal.generation, publicKey: proposal.publicKey, fingerprint: fp, state: 'quarantined', quarantinedAt: now };
+        if (proposal.previousHostSignature && verifier.verifyPreviousHost(proposal))
+            this.candidate.state = 'overlap';
+        return this.candidate;
+    }
+    proveCandidate(generation) {
+        if (!this.candidate || this.candidate.generation !== generation)
+            throw new Error('host-key-not-quarantined');
+        this.candidate.state = 'overlap';
+        return this.candidate;
+    }
+    promote(generation, allRequiredInboundProofs, now = Date.now()) {
+        if (!this.candidate || this.candidate.generation !== generation || this.candidate.state !== 'overlap')
+            throw new Error('host-key-not-in-overlap');
+        if (now - (this.candidate.quarantinedAt ?? now) > this.overlapCeilingMs)
+            throw new Error('host-key-overlap-expired');
+        if (!allRequiredInboundProofs)
+            throw new Error('host-key-proofs-incomplete');
+        this.current = { ...this.candidate, state: 'current', quarantinedAt: undefined };
+        this.candidate = undefined;
+        return this.current;
+    }
+    expire(now = Date.now()) {
+        if (this.candidate && now - (this.candidate.quarantinedAt ?? now) > this.overlapCeilingMs)
+            this.candidate = undefined;
+    }
+    snapshot() {
+        return { current: { ...this.current }, candidate: this.candidate ? { ...this.candidate } : undefined };
+    }
+}
+function keyFingerprint(publicKey) {
+    const body = publicKey.trim().split(/\s+/)[1];
+    if (!body)
+        throw new Error('host-key-invalid');
+    return createHash('sha256').update(Buffer.from(body, 'base64')).digest('hex');
+}
+//# sourceMappingURL=SshHostKeyLifecycle.js.map

package/dist/core/SshHostKeyLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshHostKeyLifecycle.js","sourceRoot":"","sources":["../../src/core/SshHostKeyLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC,MAAM,UAAU,wBAAwB,CAAC,QAAmF;IAC1H,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY;QAC7F,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAChF,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,OAAO,mBAAmB;IAImD;IAHzE,OAAO,CAAoB;IAC3B,SAAS,CAAqB;IAEtC,YAAY,OAAkD,EAAmB,mBAAmB,OAAO;QAA1B,qBAAgB,GAAhB,gBAAgB,CAAU;QACzG,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAClG,CAAC;IAED,OAAO,CAAC,QAA+B,EAAE,QAAiC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1F,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC7F,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,kBAAkB,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;QAC/I,IAAI,QAAQ,CAAC,qBAAqB,IAAI,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC;QAC9G,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,UAAkB;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC7G,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC;QACjC,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,UAAkB,EAAE,wBAAiC,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC7E,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAClJ,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACrH,IAAI,CAAC,wBAAwB;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IACxH,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACzG,CAAC;CACF;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC"}

package/dist/core/SshPeerAdmissionStore.d.ts

@@ -0,0 +1,29 @@
+export interface SshPeerAdmission {
+    agentId: string;
+    machineId: string;
+    pairingEpoch: number;
+    clientGeneration: number;
+    observerBootId: string;
+    publicKey: string;
+    expiresAt: string;
+    /** Machine-local only. Never replicated or reconstructed from receipt time. */
+    monotonicDeadlineMs?: number;
+}
+export interface AdmissionClock {
+    wallNow(): number;
+    monotonicNow(): number;
+}
+/** Atomic, symlink-refusing admission leases for the restricted SSH endpoint. */
+export declare class SshPeerAdmissionStore {
+    private readonly clock;
+    private readonly file;
+    private admissions;
+    constructor(stateDir: string, clock?: AdmissionClock);
+    reconcile(desired: SshPeerAdmission[], now?: number): void;
+    authenticate(publicKey: Buffer, now?: number): SshPeerAdmission | null;
+    revoke(machineId: string): void;
+    list(now?: number): SshPeerAdmission[];
+    private load;
+    private persist;
+}
+//# sourceMappingURL=SshPeerAdmissionStore.d.ts.map

package/dist/core/SshPeerAdmissionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshPeerAdmissionStore.d.ts","sourceRoot":"","sources":["../../src/core/SshPeerAdmissionStore.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,IAAI,MAAM,CAAC;IAClB,YAAY,IAAI,MAAM,CAAC;CACxB;AAOD,iFAAiF;AACjF,qBAAa,qBAAqB;IAIF,OAAO,CAAC,QAAQ,CAAC,KAAK;IAHpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,UAAU,CAAuC;gBAE7C,QAAQ,EAAE,MAAM,EAAmB,KAAK,GAAE,cAGrD;IAKD,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,GAAG,SAAuB,GAAG,IAAI;IAsBxE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAuB,GAAG,gBAAgB,GAAG,IAAI;IAMpF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAK/B,IAAI,CAAC,GAAG,SAAuB,GAAG,gBAAgB,EAAE;IAMpD,OAAO,CAAC,IAAI;IAcZ,OAAO,CAAC,OAAO;CAOhB"}

package/dist/core/SshPeerAdmissionStore.js

@@ -0,0 +1,86 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+function fingerprint(key) {
+    const raw = Buffer.isBuffer(key) ? key : Buffer.from(key.trim().split(/\s+/)[1] ?? '', 'base64');
+    return createHash('sha256').update(raw).digest('hex');
+}
+/** Atomic, symlink-refusing admission leases for the restricted SSH endpoint. */
+export class SshPeerAdmissionStore {
+    clock;
+    file;
+    admissions = new Map();
+    constructor(stateDir, clock = {
+        wallNow: () => Date.now(),
+        monotonicNow: () => performance.now(),
+    }) {
+        this.clock = clock;
+        this.file = path.join(stateDir, 'machine-ssh', 'peer-admissions.json');
+        this.load();
+    }
+    reconcile(desired, now = this.clock.wallNow()) {
+        const next = new Map();
+        for (const row of desired) {
+            if (Date.parse(row.expiresAt) <= now || Date.parse(row.expiresAt) - now > 300_000)
+                continue;
+            const fp = fingerprint(row.publicKey);
+            const collision = [...next.values()].some(x => fingerprint(x.publicKey) === fp && (x.agentId !== row.agentId || x.machineId !== row.machineId));
+            if (collision)
+                throw new Error('ssh-admission-key-identity-conflict');
+            const previous = this.admissions.get(fp);
+            if (previous && (row.pairingEpoch < previous.pairingEpoch || (row.pairingEpoch === previous.pairingEpoch && row.clientGeneration < previous.clientGeneration))) {
+                next.set(fp, previous);
+                continue;
+            }
+            const remaining = Math.min(300_000, Date.parse(row.expiresAt) - now);
+            next.set(fp, {
+                ...row,
+                monotonicDeadlineMs: this.clock.monotonicNow() + remaining,
+            });
+        }
+        this.admissions = next;
+        this.persist();
+    }
+    authenticate(publicKey, now = this.clock.wallNow()) {
+        const row = this.admissions.get(fingerprint(publicKey));
+        if (!row || Date.parse(row.expiresAt) <= now)
+            return null;
+        return row.monotonicDeadlineMs !== undefined && row.monotonicDeadlineMs > this.clock.monotonicNow() ? row : null;
+    }
+    revoke(machineId) {
+        for (const [key, value] of this.admissions)
+            if (value.machineId === machineId)
+                this.admissions.delete(key);
+        this.persist();
+    }
+    list(now = this.clock.wallNow()) {
+        return [...this.admissions.values()].filter(x => Date.parse(x.expiresAt) > now
+            && x.monotonicDeadlineMs !== undefined
+            && x.monotonicDeadlineMs > this.clock.monotonicNow());
+    }
+    load() {
+        try {
+            const stat = fs.lstatSync(this.file);
+            if (stat.isSymbolicLink())
+                throw new Error('ssh-admission-store-symlink-refused');
+            // A process restart intentionally invalidates persisted leases. A fresh signed
+            // advert must be observed on this boot before authentication can succeed.
+            for (const row of JSON.parse(fs.readFileSync(this.file, 'utf8'))) {
+                this.admissions.set(fingerprint(row.publicKey), { ...row, monotonicDeadlineMs: undefined });
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    persist() {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+        if (fs.existsSync(this.file) && fs.lstatSync(this.file).isSymbolicLink())
+            throw new Error('ssh-admission-store-symlink-refused');
+        const tmp = `${this.file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, `${JSON.stringify([...this.admissions.values()], null, 2)}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, this.file);
+    }
+}
+//# sourceMappingURL=SshPeerAdmissionStore.js.map

package/dist/core/SshPeerAdmissionStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SshPeerAdmissionStore.js","sourceRoot":"","sources":["../../src/core/SshPeerAdmissionStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACjG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,qBAAqB;IAIe;IAH9B,IAAI,CAAS;IACtB,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEzD,YAAY,QAAgB,EAAmB,QAAwB;QACrE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACzB,YAAY,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;KACtC;QAH8C,UAAK,GAAL,KAAK,CAGnD;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,SAAS,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,OAAO;gBAAE,SAAS;YAC5F,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAChJ,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,IAAI,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBAC/J,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;gBACX,GAAG,GAAG;gBACN,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,OAAO,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACnH,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QAC7B,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG;eACzE,CAAC,CAAC,mBAAmB,KAAK,SAAS;eACnC,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClF,+EAA+E;YAC/E,0EAA0E;YAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAuB,EAAE,CAAC;gBACvF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,OAAO;QACb,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC9C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/core/devGatedFeatures.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EA4lB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EAoKnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}
+{"version":3,"file":"devGatedFeatures.d.ts","sourceRoot":"","sources":["../../src/core/devGatedFeatures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB,EAAE,eAAe,EAkmB/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EAoKnD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAO5E"}

package/dist/core/devGatedFeatures.js

@@ -42,6 +42,12 @@ export const DEV_GATED_FEATURES = [
         description: 'Feedback work handoff into user-visible Initiative tasks.',
         justification: 'Ships dryRun:true; development agents exercise the exact state machine without canonical queue or Initiative mutation until operator promotion.',
     },
+    {
+        name: 'mutualSsh',
+        configPath: 'multiMachine.mutualSsh.enabled',
+        description: 'Mutual SSH-subsystem bootstrap and continuous proof: dedicated Instar-only keys, restricted subsystem admissions, and source-local A→B/B→A evidence.',
+        justification: 'Ships dryRun:true and fleet-dark. The dev canary generates only dedicated keys beneath Instar state and computes would-admit/would-probe evidence; it never touches personal SSH state or accepts a peer session until an explicit dryRun:false flip. No shell, exec, forwarding, SFTP, passwords, or public wildcard bind exists.',
+    },
     {
         name: 'ownershipGatedSpawn',
         configPath: 'multiMachine.sessionPool.ownershipGatedSpawn.enabled',