mindoodb 0.0.53 → 0.0.55

package/dist/node/server/peer/ClusterManager.js

@@ -0,0 +1,274 @@
+"use strict";
+/**
+ * Owns everything cluster-shaped on one node: the peer session authenticator,
+ * one {@link PeerReplicator} per trusted server that has a `url`, the job
+ * registry behind the mutating admin actions, and the audit log.
+ *
+ * `MindooDBServer` holds exactly one of these and routes both `/system/peer/*`
+ * (server-to-server protocol) and `/system/cluster/*` (admin surface) into it.
+ * Keeping the two prefixes on one object is fine — they never share an auth
+ * class, and the read model both need is the same in-memory replication state.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterManager = void 0;
+const logging_1 = require("../../../core/logging");
+const PeerAuthService_1 = require("./PeerAuthService");
+const PeerReplicator_1 = require("./PeerReplicator");
+const ClusterJobRunner_1 = require("./ClusterJobRunner");
+const ClusterAuditLog_1 = require("./ClusterAuditLog");
+class ClusterManager {
+    constructor(deps) {
+        this.deps = deps;
+        this.jobs = new ClusterJobRunner_1.ClusterJobRunner();
+        this.replicators = new Map();
+        this.started = false;
+        /**
+         * Tenants each peer is allowed to hear about, from the last Bloom handshake
+         * that peer performed against us.
+         *
+         * Inbound state, distinct from a replicator's own outbound intersection: this
+         * is what *they* asked about, and it exists so the peer event stream can be
+         * filtered. Without it the feed would announce every tenant we host, which
+         * would hand a peer the tenant list the Bloom exchange is designed to keep
+         * from it.
+         */
+        this.peerIntersections = new Map();
+        this.logger =
+            deps.logger?.createChild("Cluster") ??
+                new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), "Cluster", true);
+        this.auth = new PeerAuthService_1.PeerAuthService(deps.cryptoAdapter, () => deps.listTrustedServers());
+        this.audit = new ClusterAuditLog_1.ClusterAuditLog(deps.dataDir);
+    }
+    get localRole() {
+        return this.deps.localRole ?? "peer";
+    }
+    // ------------------------------------------------------------- lifecycle
+    /**
+     * Bring the replicator set in line with `trusted-servers.json`.
+     *
+     * Called at startup and after any peer CRUD. Existing replicators are updated
+     * in place rather than recreated so their scan cursors and echo-suppression
+     * state survive an edit to, say, the attachment mode.
+     */
+    syncReplicators() {
+        const configured = new Map(this.deps
+            .listTrustedServers()
+            .filter((peer) => typeof peer.url === "string" && peer.url.length > 0)
+            .map((peer) => [peer.name, peer]));
+        for (const [name, replicator] of this.replicators) {
+            if (!configured.has(name)) {
+                void replicator.stop();
+                this.replicators.delete(name);
+            }
+        }
+        for (const [name, peer] of configured) {
+            const existing = this.replicators.get(name);
+            if (existing) {
+                existing.updatePeer(peer);
+                continue;
+            }
+            const replicator = new PeerReplicator_1.PeerReplicator(peer, {
+                cryptoAdapter: this.deps.cryptoAdapter,
+                localServerName: this.deps.localServerName() ?? "",
+                localSigningPublicKey: this.deps.localSigningPublicKey() ?? "",
+                localRole: this.localRole,
+                getSigningKey: () => this.deps.getSigningKey(),
+                getEncryptionKey: () => this.deps.getEncryptionKey(),
+                listTenants: () => this.deps.listTenants(),
+                listDatabases: (tenantId) => this.deps.listDatabases(tenantId),
+                getLocalStore: (tenantId, dbId, storeKind) => this.deps.getLocalStore(tenantId, dbId, storeKind),
+                eventBus: this.deps.eventBus,
+                logger: this.logger,
+            });
+            this.replicators.set(name, replicator);
+            if (this.started)
+                replicator.start();
+        }
+    }
+    start() {
+        if (this.started)
+            return;
+        if (!this.deps.localServerName()) {
+            this.logger.info("No server identity; peer replication stays off");
+            return;
+        }
+        this.started = true;
+        this.syncReplicators();
+        for (const replicator of this.replicators.values()) {
+            replicator.start();
+        }
+        this.logger.info(`Peer replication started for ${this.replicators.size} peer(s)`);
+    }
+    async stop() {
+        this.started = false;
+        await Promise.all([...this.replicators.values()].map((peer) => peer.stop()));
+        this.replicators.clear();
+    }
+    get autoSyncEnabled() {
+        return this.started;
+    }
+    getReplicator(name) {
+        return this.replicators.get(name) ?? null;
+    }
+    /** Record what a peer's Bloom handshake matched; see {@link peerIntersections}. */
+    recordPeerIntersection(peerName, tenantIds) {
+        this.peerIntersections.set(peerName, new Set(tenantIds));
+    }
+    /**
+     * May this peer be told that something changed in this tenant?
+     *
+     * Closed by default: a peer that has not run the Bloom handshake in this
+     * process gets nothing, rather than everything.
+     */
+    peerMaySeeTenant(peerName, tenantId) {
+        return this.peerIntersections.get(peerName)?.has(tenantId) ?? false;
+    }
+    // ------------------------------------------------------------ read model
+    topology() {
+        return {
+            server: { name: this.deps.localServerName(), role: this.localRole },
+            peers: [...this.replicators.values()].map((peer) => peer.topologyEntry()),
+        };
+    }
+    status() {
+        const peers = [...this.replicators.values()].map((peer) => peer.snapshot());
+        // Node health is the worst peer's health: one stalled link is enough to
+        // mean this node is not fully converged with the mesh.
+        const { health, reasons } = (0, PeerReplicator_1.rollUpHealth)([], peers.flatMap((peer) => peer.reasons));
+        return {
+            server: this.deps.localServerName(),
+            health: peers.length === 0 ? "ok" : health,
+            reasons: peers.length === 0 ? [] : reasons,
+            autoSyncEnabled: this.started,
+            generatedAt: new Date().toISOString(),
+            peers,
+        };
+    }
+    tenantStatus(tenantId) {
+        return {
+            tenantId,
+            generatedAt: new Date().toISOString(),
+            peers: [...this.replicators.values()].map((peer) => ({
+                name: peer.name,
+                tenant: peer.tenantSnapshot(tenantId),
+            })),
+        };
+    }
+    // --------------------------------------------------------------- actions
+    /**
+     * Dispatch an action as a job across the peers the scope selects.
+     *
+     * Records the request in the audit log first, with the job id, so an action
+     * that is issued is on record even if the node dies mid-run.
+     */
+    runAction(kind, scope, requestedBy) {
+        const targets = this.targetsFor(scope);
+        if (targets.length === 0) {
+            this.audit.append({
+                at: new Date().toISOString(),
+                actor: requestedBy,
+                action: kind,
+                scope,
+                jobId: null,
+                outcome: "rejected",
+                detail: scope.peer ? "unknown peer" : "no peers configured",
+            });
+            return {
+                accepted: false,
+                error: scope.peer ? `Unknown peer: ${scope.peer}` : "No peers configured",
+            };
+        }
+        const job = this.jobs.start(kind, scope, requestedBy, async (ctx) => {
+            const result = {
+                transferredEntries: 0,
+                transferredBytes: 0,
+                rejectedEntries: 0,
+                tenantsProcessed: 0,
+                databasesProcessed: 0,
+            };
+            let completed = 0;
+            const peerScope = { tenantId: scope.tenantId, dbId: scope.dbId };
+            for (const replicator of targets) {
+                switch (kind) {
+                    case "sync":
+                    case "retry-rejected": {
+                        const run = kind === "sync"
+                            ? await replicator.syncNow(peerScope)
+                            : await replicator.retryRejected(peerScope);
+                        result.transferredEntries += run.pushed + run.pulled;
+                        result.rejectedEntries += run.rejected;
+                        result.tenantsProcessed += run.tenants;
+                        result.databasesProcessed += run.databases;
+                        if (run.errors.length > 0) {
+                            throw new Error(run.errors.join("; "));
+                        }
+                        break;
+                    }
+                    case "refresh-intersection": {
+                        const shared = await replicator.refreshIntersection();
+                        result.tenantsProcessed += shared.length;
+                        break;
+                    }
+                    case "pause":
+                        replicator.pause();
+                        break;
+                    case "resume":
+                        replicator.resume();
+                        break;
+                }
+                completed += 1;
+                ctx.progress(completed, targets.length);
+            }
+            return result;
+        });
+        this.audit.append({
+            at: new Date().toISOString(),
+            actor: requestedBy,
+            action: kind,
+            scope,
+            jobId: job.id,
+            outcome: "accepted",
+        });
+        return { accepted: true, job };
+    }
+    targetsFor(scope) {
+        if (!scope.peer)
+            return [...this.replicators.values()];
+        const replicator = this.replicators.get(scope.peer);
+        return replicator ? [replicator] : [];
+    }
+    /** Record a peer CRUD change; the caller has already persisted it. */
+    auditPeerChange(action, peerName, actor) {
+        this.audit.append({
+            at: new Date().toISOString(),
+            actor,
+            action,
+            scope: { peer: peerName },
+            jobId: null,
+            outcome: "accepted",
+        });
+    }
+    /**
+     * Mirrors of one tenant, for `GET /.well-known/mindoodb-cluster`.
+     *
+     * Only peers that actually hold the requested tenant are listed — a client
+     * asking about tenant A must not learn that this server also replicates
+     * tenants B and C to some other node.
+     */
+    mirrorsForTenant(tenantId) {
+        const mirrors = [];
+        for (const replicator of this.replicators.values()) {
+            // No snapshot for this tenant means the Bloom intersection did not put it
+            // on both sides, so the peer is not a mirror a client could fail over to.
+            if (!replicator.tenantSnapshot(tenantId))
+                continue;
+            const entry = replicator.topologyEntry();
+            if (!entry.url)
+                continue;
+            mirrors.push({ name: entry.name, url: entry.url, role: entry.role });
+        }
+        return mirrors;
+    }
+}
+exports.ClusterManager = ClusterManager;
+//# sourceMappingURL=ClusterManager.js.map

package/dist/node/server/peer/ClusterManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterManager.js","sourceRoot":"","sources":["../../../../src/node/server/peer/ClusterManager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAGH,mDAAiF;AAIjF,uDAAoD;AACpD,qDAAoF;AACpF,yDAAsD;AACtD,uDAAoD;AAyCpD,MAAa,cAAc;IAoBzB,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAlB5C,SAAI,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAGtB,gBAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;QAEzD,YAAO,GAAG,KAAK,CAAC;QACxB;;;;;;;;;WASG;QACc,sBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAGlE,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;gBACnC,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,iCAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,GAAG,IAAI,iCAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACvC,CAAC;IAED,0EAA0E;IAE1E;;;;;;OAMG;IACH,eAAe;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,IAAI,CAAC,IAAI;aACN,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC,CAC7C,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,+BAAc,CAAC,IAAI,EAAE;gBAC1C,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;gBACtC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;gBAClD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBAC9D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBACpD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC1C,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAC9D,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;gBACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,OAAO;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,mFAAmF;IACnF,sBAAsB,CAAC,QAAgB,EAAE,SAAmB;QAC1D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IACtE,CAAC;IAED,0EAA0E;IAE1E,QAAQ;QACN,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YACnE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,6BAAY,EACtC,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC1C,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;YAC1C,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,KAAK;SACN,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;aACtC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,0EAA0E;IAE1E;;;;;OAKG;IACH,SAAS,CACP,IAAoB,EACpB,KAAsB,EACtB,WAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,IAAI;gBACZ,KAAK;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB;aAC5D,CAAC,CAAC;YACH,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,qBAAqB;aAC1E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,MAAM,GAAqB;gBAC/B,kBAAkB,EAAE,CAAC;gBACrB,gBAAgB,EAAE,CAAC;gBACnB,eAAe,EAAE,CAAC;gBAClB,gBAAgB,EAAE,CAAC;gBACnB,kBAAkB,EAAE,CAAC;aACtB,CAAC;YACF,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,SAAS,GAAkB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAEhF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;gBACjC,QAAQ,IAAI,EAAE,CAAC;oBACb,KAAK,MAAM,CAAC;oBACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,GAAG,GACP,IAAI,KAAK,MAAM;4BACb,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;4BACrC,CAAC,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;wBAChD,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;wBACrD,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC;wBACvC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,OAAO,CAAC;wBACvC,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,SAAS,CAAC;wBAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzC,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;wBAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mBAAmB,EAAE,CAAC;wBACtD,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC;wBACzC,MAAM;oBACR,CAAC;oBACD,KAAK,OAAO;wBACV,UAAU,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM;oBACR,KAAK,QAAQ;wBACX,UAAU,CAAC,MAAM,EAAE,CAAC;wBACpB,MAAM;gBACV,CAAC;gBACD,SAAS,IAAI,CAAC,CAAC;gBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK;YACL,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAEO,UAAU,CAAC,KAAsB;QACvC,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,eAAe,CACb,MAAqD,EACrD,QAAgB,EAChB,KAAa;QAEb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,MAAM;YACN,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,OAAO,GAAyD,EAAE,CAAC;QACzE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,0EAA0E;YAC1E,0EAA0E;YAC1E,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,SAAS;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAlSD,wCAkSC"}

package/dist/node/server/peer/PeerAuthService.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Peer (server-to-server) authentication for `/system/peer/*`.
+ *
+ * Same Ed25519 challenge-response as the tenant sync handshake, but the key
+ * lookup goes to `trusted-servers.json` instead of a tenant directory. The
+ * issued JWT is deliberately a **different token class** from the system-admin
+ * JWT: `/system/peer/*` accepts only peer tokens and `/system/cluster/*` only
+ * admin tokens, so a peer can never administer this node and an admin can never
+ * write as a peer.
+ */
+import type { CryptoAdapter } from "../../../core/crypto/CryptoAdapter";
+import type { TrustedServer } from "../types";
+export interface PeerTokenPayload {
+    /** Trusted-server name that authenticated. */
+    sub: string;
+    /** The Ed25519 key that signed the challenge, i.e. the peer's identity. */
+    publicsignkey: string;
+    /** Marks this as a peer token; absent/false tokens are rejected by peer routes. */
+    peer: true;
+    iat: number;
+    exp: number;
+}
+export declare class PeerAuthService {
+    private readonly cryptoAdapter;
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    private readonly listTrustedServers;
+    private challenges;
+    /** Challenge creation is unauthenticated, so the map is bounded (DoS guard). */
+    private static readonly MAX_CHALLENGES;
+    private readonly jwtSecret;
+    private readonly challengeExpirationMs;
+    private readonly tokenExpirationMs;
+    constructor(cryptoAdapter: CryptoAdapter, 
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    listTrustedServers: () => TrustedServer[], options?: {
+        jwtSecret?: Uint8Array;
+        challengeExpirationMs?: number;
+        tokenExpirationMs?: number;
+    });
+    /** Resolve a trusted server by its signing key (the canonical identity). */
+    findTrustedServerByKey(publicsignkey: string): TrustedServer | null;
+    /**
+     * Issue a challenge for a peer identified by its signing key.
+     *
+     * @throws Error("Unknown peer") when the key is not in trusted-servers.json.
+     */
+    generateChallenge(publicsignkey: string): Promise<string>;
+    authenticate(challenge: string, signature: Uint8Array): Promise<{
+        success: boolean;
+        token?: string;
+        error?: string;
+    }>;
+    /**
+     * Validate a peer JWT. Returns null unless the token carries `peer: true`
+     * *and* the signing key is still trusted — revoking trust must cut off
+     * outstanding tokens, not just future handshakes.
+     */
+    validateToken(token: string): Promise<PeerTokenPayload | null>;
+    private verifySignature;
+    private generateToken;
+    private cleanupExpiredChallenges;
+    private evictChallengesOverCap;
+    private base64UrlEncode;
+    private base64UrlDecode;
+    private uint8ArrayToBase64Url;
+    private base64UrlToUint8Array;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=PeerAuthService.d.ts.map

package/dist/node/server/peer/PeerAuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerAuthService.d.ts","sourceRoot":"","sources":["../../../../src/node/server/peer/PeerAuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAeD,qBAAa,eAAe;IAUxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAXrC,OAAO,CAAC,UAAU,CAA2C;IAC7D,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGxB,aAAa,EAAE,aAAa;IAC7C,wEAAwE;IACvD,kBAAkB,EAAE,MAAM,aAAa,EAAE,EAC1D,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,UAAU,CAAC;QACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAQH,4EAA4E;IAC5E,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IASnE;;;;OAIG;IACG,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBzD,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BhE;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAsCtD,eAAe;YAkCf,aAAa;IAyB3B,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/node/server/peer/PeerAuthService.js

@@ -0,0 +1,208 @@
+"use strict";
+/**
+ * Peer (server-to-server) authentication for `/system/peer/*`.
+ *
+ * Same Ed25519 challenge-response as the tenant sync handshake, but the key
+ * lookup goes to `trusted-servers.json` instead of a tenant directory. The
+ * issued JWT is deliberately a **different token class** from the system-admin
+ * JWT: `/system/peer/*` accepts only peer tokens and `/system/cluster/*` only
+ * admin tokens, so a peer can never administer this node and an admin can never
+ * write as a peer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PeerAuthService = void 0;
+const uuid_1 = require("uuid");
+/** Whitespace-insensitive PEM comparison (JSON transport reflows line endings). */
+function normalizePem(pem) {
+    return pem.replace(/\s+/g, "");
+}
+class PeerAuthService {
+    constructor(cryptoAdapter, 
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    listTrustedServers, options) {
+        this.cryptoAdapter = cryptoAdapter;
+        this.listTrustedServers = listTrustedServers;
+        this.challenges = new Map();
+        this.jwtSecret =
+            options?.jwtSecret ?? cryptoAdapter.getRandomValues(new Uint8Array(32));
+        this.challengeExpirationMs = options?.challengeExpirationMs ?? 5 * 60 * 1000;
+        this.tokenExpirationMs = options?.tokenExpirationMs ?? 60 * 60 * 1000;
+    }
+    /** Resolve a trusted server by its signing key (the canonical identity). */
+    findTrustedServerByKey(publicsignkey) {
+        const wanted = normalizePem(publicsignkey);
+        return (this.listTrustedServers().find((server) => normalizePem(server.signingPublicKey) === wanted) ?? null);
+    }
+    /**
+     * Issue a challenge for a peer identified by its signing key.
+     *
+     * @throws Error("Unknown peer") when the key is not in trusted-servers.json.
+     */
+    async generateChallenge(publicsignkey) {
+        const server = this.findTrustedServerByKey(publicsignkey);
+        if (!server) {
+            throw new Error("Unknown peer");
+        }
+        const challenge = (0, uuid_1.v7)();
+        this.challenges.set(challenge, {
+            challenge,
+            serverName: server.name,
+            publicsignkey: server.signingPublicKey,
+            expiresAt: Date.now() + this.challengeExpirationMs,
+            used: false,
+        });
+        this.cleanupExpiredChallenges();
+        this.evictChallengesOverCap();
+        return challenge;
+    }
+    async authenticate(challenge, signature) {
+        const stored = this.challenges.get(challenge);
+        if (!stored) {
+            return { success: false, error: "Challenge not found or expired" };
+        }
+        if (Date.now() > stored.expiresAt) {
+            this.challenges.delete(challenge);
+            return { success: false, error: "Challenge expired" };
+        }
+        if (stored.used) {
+            return { success: false, error: "Challenge already used" };
+        }
+        stored.used = true;
+        // Re-resolve against the live trust list: an operator may have removed the
+        // peer between challenge and response.
+        if (!this.findTrustedServerByKey(stored.publicsignkey)) {
+            return { success: false, error: "Peer is no longer trusted" };
+        }
+        const valid = await this.verifySignature(challenge, signature, stored.publicsignkey);
+        if (!valid) {
+            return { success: false, error: "Invalid signature" };
+        }
+        const token = await this.generateToken(stored.serverName, stored.publicsignkey);
+        return { success: true, token };
+    }
+    /**
+     * Validate a peer JWT. Returns null unless the token carries `peer: true`
+     * *and* the signing key is still trusted — revoking trust must cut off
+     * outstanding tokens, not just future handshakes.
+     */
+    async validateToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerB64, payloadB64, signatureB64] = parts;
+        try {
+            // Pin the algorithm to HS256 to block algorithm-confusion attacks.
+            const header = JSON.parse(this.base64UrlDecode(headerB64));
+            if (header.alg !== "HS256")
+                return null;
+            const subtle = this.cryptoAdapter.getSubtle();
+            const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+            const dataToVerify = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+            const sig = this.base64UrlToUint8Array(signatureB64);
+            const isValid = await subtle.verify("HMAC", signingKey, sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength), dataToVerify.buffer);
+            if (!isValid)
+                return null;
+            const payload = JSON.parse(this.base64UrlDecode(payloadB64));
+            if (payload.peer !== true)
+                return null;
+            if (payload.exp < Math.floor(Date.now() / 1000))
+                return null;
+            if (!this.findTrustedServerByKey(payload.publicsignkey))
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    async verifySignature(message, signature, publicKeyPem) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        try {
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const keyData = this.base64ToUint8Array(pemContents);
+            const publicKey = await subtle.importKey("spki", keyData.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const messageBytes = new TextEncoder().encode(message);
+            return await subtle.verify({ name: "Ed25519" }, publicKey, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), messageBytes.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateToken(serverName, publicsignkey) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: serverName,
+            publicsignkey,
+            peer: true,
+            iat: now,
+            exp: now + Math.floor(this.tokenExpirationMs / 1000),
+        };
+        const headerB64 = this.base64UrlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+        const payloadB64 = this.base64UrlEncode(JSON.stringify(payload));
+        const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const dataToSign = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = await subtle.sign("HMAC", signingKey, dataToSign.buffer);
+        return `${headerB64}.${payloadB64}.${this.uint8ArrayToBase64Url(new Uint8Array(signature))}`;
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [key, challenge] of this.challenges) {
+            if (challenge.expiresAt < now) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+    evictChallengesOverCap() {
+        let overflow = this.challenges.size - PeerAuthService.MAX_CHALLENGES;
+        if (overflow <= 0)
+            return;
+        for (const key of this.challenges.keys()) {
+            if (overflow-- <= 0)
+                break;
+            this.challenges.delete(key);
+        }
+    }
+    base64UrlEncode(str) {
+        return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlDecode(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        return atob(base64);
+    }
+    uint8ArrayToBase64Url(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlToUint8Array(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+exports.PeerAuthService = PeerAuthService;
+/** Challenge creation is unauthenticated, so the map is bounded (DoS guard). */
+PeerAuthService.MAX_CHALLENGES = 10000;
+//# sourceMappingURL=PeerAuthService.js.map

package/dist/node/server/peer/PeerAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerAuthService.js","sourceRoot":"","sources":["../../../../src/node/server/peer/PeerAuthService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,+BAAoC;AAuBpC,mFAAmF;AACnF,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAa,eAAe;IAS1B,YACmB,aAA4B;IAC7C,wEAAwE;IACvD,kBAAyC,EAC1D,OAIC;QAPgB,kBAAa,GAAb,aAAa,CAAe;QAE5B,uBAAkB,GAAlB,kBAAkB,CAAuB;QAXpD,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QAkB3D,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,sBAAsB,CAAC,aAAqB;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,CACL,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAC7D,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,aAAa,EAAE,MAAM,CAAC,gBAAgB;YACtC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB;YAClD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAqB,CAAC;YAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAgB,EAChF,YAAY,CAAC,MAAqB,CACnC,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAqB,CAAC;YACjF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvC,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrE,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,YAAY,CAAC,MAAqB,CACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,aAAqB;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAqB;YAChC,GAAG,EAAE,UAAU;YACf,aAAa;YACb,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAqB,CAAC,CAAC;QAC1F,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,eAAe,CAAC,cAAc,CAAC;QACrE,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,IAAI,CAAC;gBAAE,MAAM;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AAvPH,0CAwPC;AAtPC,gFAAgF;AACxD,8BAAc,GAAG,KAAM,AAAT,CAAU"}