mindoodb 0.0.85 → 0.0.88

package/dist/server/peer/PeerAuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerAuthService.d.ts","sourceRoot":"","sources":["../../../src/server/peer/PeerAuthService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAeD,qBAAa,eAAe;IAUxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAXrC,OAAO,CAAC,UAAU,CAA2C;IAC7D,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAU;IAEhD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAS;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGxB,aAAa,EAAE,aAAa;IAC7C,wEAAwE;IACvD,kBAAkB,EAAE,MAAM,aAAa,EAAE,EAC1D,OAAO,CAAC,EAAE;QACR,SAAS,CAAC,EAAE,UAAU,CAAC;QACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAQH,4EAA4E;IAC5E,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IASnE;;;;OAIG;IACG,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBzD,YAAY,CAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BhE;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAsCtD,eAAe;YAyBf,aAAa;IAyB3B,OAAO,CAAC,wBAAwB;IAShC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,eAAe;IAMvB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,kBAAkB;CAQ3B"}

package/dist/server/peer/PeerAuthService.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * Peer (server-to-server) authentication for `/system/peer/*`.
+ *
+ * Same Ed25519 challenge-response as the tenant sync handshake, but the key
+ * lookup goes to `trusted-servers.json` instead of a tenant directory. The
+ * issued JWT is deliberately a **different token class** from the system-admin
+ * JWT: `/system/peer/*` accepts only peer tokens and `/system/cluster/*` only
+ * admin tokens, so a peer can never administer this node and an admin can never
+ * write as a peer.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PeerAuthService = void 0;
+const AuthChallenge_1 = require("../../core/crypto/AuthChallenge");
+/** Whitespace-insensitive PEM comparison (JSON transport reflows line endings). */
+function normalizePem(pem) {
+    return pem.replace(/\s+/g, "");
+}
+class PeerAuthService {
+    constructor(cryptoAdapter, 
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    listTrustedServers, options) {
+        this.cryptoAdapter = cryptoAdapter;
+        this.listTrustedServers = listTrustedServers;
+        this.challenges = new Map();
+        this.jwtSecret =
+            options?.jwtSecret ?? cryptoAdapter.getRandomValues(new Uint8Array(32));
+        this.challengeExpirationMs = options?.challengeExpirationMs ?? 5 * 60 * 1000;
+        this.tokenExpirationMs = options?.tokenExpirationMs ?? 60 * 60 * 1000;
+    }
+    /** Resolve a trusted server by its signing key (the canonical identity). */
+    findTrustedServerByKey(publicsignkey) {
+        const wanted = normalizePem(publicsignkey);
+        return (this.listTrustedServers().find((server) => normalizePem(server.signingPublicKey) === wanted) ?? null);
+    }
+    /**
+     * Issue a challenge for a peer identified by its signing key.
+     *
+     * @throws Error("Unknown peer") when the key is not in trusted-servers.json.
+     */
+    async generateChallenge(publicsignkey) {
+        const server = this.findTrustedServerByKey(publicsignkey);
+        if (!server) {
+            throw new Error("Unknown peer");
+        }
+        const challenge = (0, AuthChallenge_1.issueAuthChallenge)();
+        this.challenges.set(challenge, {
+            challenge,
+            serverName: server.name,
+            publicsignkey: server.signingPublicKey,
+            expiresAt: Date.now() + this.challengeExpirationMs,
+            used: false,
+        });
+        this.cleanupExpiredChallenges();
+        this.evictChallengesOverCap();
+        return challenge;
+    }
+    async authenticate(challenge, signature) {
+        const stored = this.challenges.get(challenge);
+        if (!stored) {
+            return { success: false, error: "Challenge not found or expired" };
+        }
+        if (Date.now() > stored.expiresAt) {
+            this.challenges.delete(challenge);
+            return { success: false, error: "Challenge expired" };
+        }
+        if (stored.used) {
+            return { success: false, error: "Challenge already used" };
+        }
+        stored.used = true;
+        // Re-resolve against the live trust list: an operator may have removed the
+        // peer between challenge and response.
+        if (!this.findTrustedServerByKey(stored.publicsignkey)) {
+            return { success: false, error: "Peer is no longer trusted" };
+        }
+        const valid = await this.verifySignature(challenge, signature, stored.publicsignkey);
+        if (!valid) {
+            return { success: false, error: "Invalid signature" };
+        }
+        const token = await this.generateToken(stored.serverName, stored.publicsignkey);
+        return { success: true, token };
+    }
+    /**
+     * Validate a peer JWT. Returns null unless the token carries `peer: true`
+     * *and* the signing key is still trusted — revoking trust must cut off
+     * outstanding tokens, not just future handshakes.
+     */
+    async validateToken(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return null;
+        const [headerB64, payloadB64, signatureB64] = parts;
+        try {
+            // Pin the algorithm to HS256 to block algorithm-confusion attacks.
+            const header = JSON.parse(this.base64UrlDecode(headerB64));
+            if (header.alg !== "HS256")
+                return null;
+            const subtle = this.cryptoAdapter.getSubtle();
+            const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+            const dataToVerify = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+            const sig = this.base64UrlToUint8Array(signatureB64);
+            const isValid = await subtle.verify("HMAC", signingKey, sig.buffer.slice(sig.byteOffset, sig.byteOffset + sig.byteLength), dataToVerify.buffer);
+            if (!isValid)
+                return null;
+            const payload = JSON.parse(this.base64UrlDecode(payloadB64));
+            if (payload.peer !== true)
+                return null;
+            if (payload.exp < Math.floor(Date.now() / 1000))
+                return null;
+            if (!this.findTrustedServerByKey(payload.publicsignkey))
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    async verifySignature(message, signature, publicKeyPem) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        try {
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const keyData = this.base64ToUint8Array(pemContents);
+            const publicKey = await subtle.importKey("spki", keyData.buffer, { name: "Ed25519" }, false, ["verify"]);
+            return await (0, AuthChallenge_1.verifyAuthChallengeSignature)(subtle, publicKey, message, signature);
+        }
+        catch {
+            return false;
+        }
+    }
+    async generateToken(serverName, publicsignkey) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const now = Math.floor(Date.now() / 1000);
+        const payload = {
+            sub: serverName,
+            publicsignkey,
+            peer: true,
+            iat: now,
+            exp: now + Math.floor(this.tokenExpirationMs / 1000),
+        };
+        const headerB64 = this.base64UrlEncode(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+        const payloadB64 = this.base64UrlEncode(JSON.stringify(payload));
+        const signingKey = await subtle.importKey("raw", this.jwtSecret.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        const dataToSign = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+        const signature = await subtle.sign("HMAC", signingKey, dataToSign.buffer);
+        return `${headerB64}.${payloadB64}.${this.uint8ArrayToBase64Url(new Uint8Array(signature))}`;
+    }
+    cleanupExpiredChallenges() {
+        const now = Date.now();
+        for (const [key, challenge] of this.challenges) {
+            if (challenge.expiresAt < now) {
+                this.challenges.delete(key);
+            }
+        }
+    }
+    evictChallengesOverCap() {
+        let overflow = this.challenges.size - PeerAuthService.MAX_CHALLENGES;
+        if (overflow <= 0)
+            return;
+        for (const key of this.challenges.keys()) {
+            if (overflow-- <= 0)
+                break;
+            this.challenges.delete(key);
+        }
+    }
+    base64UrlEncode(str) {
+        return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlDecode(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        return atob(base64);
+    }
+    uint8ArrayToBase64Url(bytes) {
+        let binary = "";
+        for (let i = 0; i < bytes.length; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    }
+    base64UrlToUint8Array(str) {
+        let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+        while (base64.length % 4)
+            base64 += "=";
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    base64ToUint8Array(base64) {
+        const binary = atob(base64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+exports.PeerAuthService = PeerAuthService;
+/** Challenge creation is unauthenticated, so the map is bounded (DoS guard). */
+PeerAuthService.MAX_CHALLENGES = 10000;
+//# sourceMappingURL=PeerAuthService.js.map

package/dist/server/peer/PeerAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerAuthService.js","sourceRoot":"","sources":["../../../src/server/peer/PeerAuthService.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,mEAAmG;AAuBnG,mFAAmF;AACnF,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAa,eAAe;IAS1B,YACmB,aAA4B;IAC7C,wEAAwE;IACvD,kBAAyC,EAC1D,OAIC;QAPgB,kBAAa,GAAb,aAAa,CAAe;QAE5B,uBAAkB,GAAlB,kBAAkB,CAAuB;QAXpD,eAAU,GAAiC,IAAI,GAAG,EAAE,CAAC;QAkB3D,IAAI,CAAC,SAAS;YACZ,OAAO,EAAE,SAAS,IAAI,aAAa,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC7E,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,sBAAsB,CAAC,aAAqB;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,CACL,IAAI,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAC5B,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAC7D,IAAI,IAAI,CACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,aAAqB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,kCAAkB,GAAE,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,aAAa,EAAE,MAAM,CAAC,gBAAgB;YACtC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB;YAClD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,SAAiB,EACjB,SAAqB;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAEnB,2EAA2E;QAC3E,uCAAuC;QACvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,IAAI,CAAC;YACH,mEAAmE;YACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAqB,CAAC;YAC/E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC,MAAM,EACN,UAAU,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAgB,EAChF,YAAY,CAAC,MAAqB,CACnC,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAqB,CAAC;YACjF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvC,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrE,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAqB,EACrB,YAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,OAAO,CAAC,MAAqB,EAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,OAAO,MAAM,IAAA,4CAA4B,EAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,aAAqB;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAqB;YAChC,GAAG,EAAE,UAAU;YACf,aAAa;YACb,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;SACrD,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,CAAC,SAAS,CAAC,MAAqB,EACpC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAqB,CAAC,CAAC;QAC1F,OAAO,GAAG,SAAS,IAAI,UAAU,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAEO,wBAAwB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,eAAe,CAAC,cAAc,CAAC;QACrE,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,QAAQ,EAAE,IAAI,CAAC;gBAAE,MAAM;YAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,qBAAqB,CAAC,KAAiB;QAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IAEO,qBAAqB,CAAC,GAAW;QACvC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AA9OH,0CA+OC;AA7OC,gFAAgF;AACxD,8BAAc,GAAG,KAAM,AAAT,CAAU"}

package/dist/server/peer/PeerReplicator.d.ts

@@ -0,0 +1,303 @@
+/**
+ * Server-to-server replication with one trusted peer.
+ *
+ * One replicator instance per entry in `trusted-servers.json` that carries a
+ * `url`. It owns everything about that link: the peer session, the set of
+ * tenants both sides hold, the mirror loop over every database, the live push
+ * out of {@link SyncEventBus}, and the SSE subscription that pulls the other
+ * direction.
+ *
+ * ## What it replicates
+ *
+ * Everything both servers already have in common, and nothing else. The tenant
+ * set is intersected via a Bloom summary (see {@link refreshIntersection}), so
+ * a server never learns which tenants it does *not* host on the other side. For
+ * each shared tenant it mirrors **all** databases — the union of the local and
+ * remote database lists — in both stores (`docs` and `attachments`).
+ *
+ * ## Convergence invariants
+ *
+ * 1. **Directory first.** Databases are ordered by
+ *    {@link orderDatabasesForReplication}: `directory`, then `userdirectory`,
+ *    then the rest. An application entry signed by a key the peer does not
+ *    trust yet is rejected per entry, so the grants have to land first.
+ * 2. **Cursor holds on rejection.** Unlike a client, a peer must not skip past
+ *    a rejected entry — that is permanent divergence between two servers that
+ *    are supposed to be identical. The peer path passes
+ *    `rejectionPolicy: "hold"`, which clamps the cursor so the next run
+ *    re-offers the entry once the missing trust has replicated.
+ * 3. **Receipts are preserved, not re-stamped.** Enforced on the receiving side
+ *    in `ServerNetworkContentAddressedStore`; this side just transports.
+ */
+import type { IrohStreamIO } from "../../core/appendonlystores/network/IrohStreamIO";
+import { StoreKind, type ContentAddressedStore } from "../../core/types";
+import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
+import { Logger } from "../../core/logging";
+import type { TrustedServer } from "../types";
+import type { SyncEventBus, SyncChangeEvent } from "../SyncEventBus";
+import { type ClusterHealth, type ClusterHealthReason, type ClusterPeerStatus, type ClusterTenantStatus, type ClusterTopologyPeer, type PeerRole } from "./types";
+/**
+ * An established Iroh connection to a peer (Node: `IrohPeerLink`). Injected so
+ * the replicator itself does not depend on Iroh; hosts without Iroh leave it
+ * out and `iroh:` peer urls fail with a clear error.
+ */
+export interface PeerIrohLink {
+    rpc(method: string, args: unknown[]): Promise<unknown>;
+    asStreamIO(): IrohStreamIO;
+    subscribeEvents(token: string, onEvent: (event: SyncChangeEvent) => void, signal: AbortSignal): Promise<void>;
+    close(): Promise<void>;
+}
+export interface PeerTransferLimits {
+    /** Batches transferred in parallel per store pair. */
+    maxConcurrentBatches?: number;
+    /** Entries per batch for document stores. */
+    docsBatchSize?: number;
+    /** Entries per batch for attachment stores (chunks of up to 256 KB each). */
+    attachmentsBatchSize?: number;
+}
+/** What a replicator needs from the surrounding server to do its job. */
+export interface PeerReplicatorHost {
+    cryptoAdapter: CryptoAdapter;
+    /** This server's name, as the peer knows it in its own trusted-servers list. */
+    localServerName: string;
+    /** This server's Ed25519 public key (PEM) — how the peer looks us up. */
+    localSigningPublicKey: string;
+    /** This node's own mesh role, which decides whether spoke-to-spoke is suppressed. */
+    localRole: PeerRole;
+    /** Ed25519 signing key, for the peer challenge. */
+    getSigningKey(): Promise<CryptoKey | undefined>;
+    /** RSA private key, to unwrap entries the peer sends us. */
+    getEncryptionKey(): Promise<CryptoKey | undefined>;
+    /** Tenant ids hosted locally. */
+    listTenants(): string[];
+    /** Database ids held locally for a tenant. */
+    listDatabases(tenantId: string): string[] | Promise<string[]>;
+    /** Local store for a (tenant, db, kind) triple, created on demand. */
+    getLocalStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
+    eventBus: SyncEventBus;
+    /** Bound Iroh endpoint for `iroh:` peer urls. Missing / null → reconnect. */
+    getIrohStreamIO?: () => IrohStreamIO | null;
+    /** Dial a peer over Iroh; required for `iroh:` peer urls. */
+    openIrohLink?: (io: IrohStreamIO, ticket: string) => PeerIrohLink;
+    /**
+     * Keep a Server-Sent-Events subscription to the peer open so its changes
+     * are pulled right away (default). A host that cannot hold a connection
+     * open cheaply turns this off and pulls on a schedule instead.
+     */
+    liveEventStream?: boolean;
+    /**
+     * Bounds on what one transfer holds in memory, for hosts with a small heap
+     * (Cloudflare: 128 MB per isolate). Default: the sync defaults (up to 250
+     * entries per batch, 3 batches in parallel).
+     */
+    transferLimits?: PeerTransferLimits;
+    /**
+     * Documents purged from a database on this server (the purge registry).
+     * Entries of these documents are refused when pulled from the peer, the
+     * same way the server refuses them on a push (docs/accesscontrol.md §13).
+     */
+    getPurgedDocIds?(tenantId: string, dbId: string): ReadonlySet<string>;
+    /**
+     * Called after a pull brought new `directory` entries, before the tenant's
+     * other databases are mirrored: executes purge requests that arrived by
+     * replication, which no client push would otherwise trigger here.
+     */
+    onDirectoryPulled?(tenantId: string): Promise<void>;
+    logger?: Logger;
+}
+export interface PeerSyncScope {
+    tenantId?: string;
+    dbId?: string;
+    /**
+     * Stop starting new store pairs after this time (epoch ms), for hosts that
+     * limit how long one invocation may run. The next run resumes with the
+     * tenant this one did not finish.
+     */
+    deadline?: number;
+}
+export interface PeerSyncRunResult {
+    peer: string;
+    tenants: number;
+    databases: number;
+    pushed: number;
+    pulled: number;
+    rejected: number;
+    /** Pairs whose cursor is clamped waiting for trust to replicate (invariant 2). */
+    held: number;
+    errors: string[];
+    /** The deadline ended the run before every store pair was mirrored. */
+    deferred?: boolean;
+}
+export declare class PeerReplicator {
+    private peer;
+    private readonly host;
+    private readonly logger;
+    private direction;
+    private role;
+    private attachments;
+    private running;
+    private paused;
+    private sessionState;
+    private eventsConnected;
+    private token;
+    private tokenIssuedAt;
+    private tokenPromise;
+    private intersection;
+    /** Tenant a run that hit its deadline did not finish; the next run starts there. */
+    private resumeTenantId;
+    private intersectionAt;
+    private tenants;
+    private transferredEntries;
+    private transferredBytes;
+    private syncInFlight;
+    private pendingScopes;
+    private pushTimer;
+    private idleTimer;
+    private reconnectTimer;
+    private reconnectAttempt;
+    private sseAbort;
+    private irohLink;
+    private unsubscribeBus;
+    private lastError;
+    private lastErrorClass;
+    private lastErrorAt;
+    private lastSyncAt;
+    /**
+     * Scan cursors, per (source, target) store pair.
+     *
+     * In-process only, deliberately: a restarted server pays one metadata scan
+     * per pair and then re-establishes the fast path from the store head. Cheap
+     * enough, and it avoids a second on-disk format to keep consistent with the
+     * stores it describes.
+     */
+    private readonly cursors;
+    constructor(peer: TrustedServer, host: PeerReplicatorHost);
+    get name(): string;
+    get url(): string | undefined;
+    /** Replace the peer config in place (peer CRUD) without dropping cursors. */
+    updatePeer(peer: TrustedServer): void;
+    /** Roles and endpoint, for `GET /system/cluster/topology`. */
+    topologyEntry(): ClusterTopologyPeer;
+    start(): void;
+    stop(): Promise<void>;
+    pause(): void;
+    resume(): void;
+    private bootstrap;
+    private scheduleReconnect;
+    private ensureToken;
+    private authenticate;
+    private isIrohPeer;
+    private getIrohLink;
+    private peerFetch;
+    private irohPeerFetch;
+    /**
+     * Recompute the set of tenants both servers host.
+     *
+     * We send a Bloom summary of our tenant ids; the peer answers with the ids on
+     * *its* side that the filter might contain. Those are candidates only — a
+     * Bloom filter has false positives — so the result is intersected against the
+     * authoritative local list before anything is replicated. That second step is
+     * what makes the false-positive rate a performance question rather than a
+     * correctness one.
+     */
+    refreshIntersection(): Promise<string[]>;
+    /**
+     * Run one full replication pass, optionally narrowed to a tenant or database.
+     *
+     * Concurrent calls collapse onto the in-flight run: the caller that arrives
+     * second gets the same promise rather than a second parallel mirror of the
+     * same stores.
+     */
+    syncNow(scope?: PeerSyncScope): Promise<PeerSyncRunResult>;
+    /**
+     * Re-offer entries the peer rejected.
+     *
+     * Under the hold policy the cursor is already clamped, so a plain sync run is
+     * the retry — this exists as a named admin action so the UI has something to
+     * call that says what it does.
+     */
+    retryRejected(scope?: PeerSyncScope): Promise<PeerSyncRunResult>;
+    private runSync;
+    /**
+     * The (database, store) pairs to mirror for one tenant, in order.
+     *
+     * `eager` interleaves — each database's documents are immediately followed by
+     * its attachments, so a database is complete before the next one starts.
+     * `lazy` runs every document store first and only then the attachment stores:
+     * a run that is interrupted (or a link that is slow) has then spent its
+     * bandwidth on the text, which is what makes documents readable, rather than
+     * on blobs that can be fetched later. `never` skips attachments entirely.
+     *
+     * Database order comes from {@link orderDatabasesForReplication} either way —
+     * invariant 1 outranks the attachment policy.
+     */
+    private mirrorPlan;
+    /**
+     * Databases to mirror for a tenant: the union of both sides, in invariant
+     * order (invariant 1).
+     *
+     * Union rather than intersection, because a database that exists only on the
+     * peer is exactly the thing a fresh mirror needs to pull.
+     */
+    private databasesFor;
+    private syncStorePair;
+    /**
+     * One leg of a store pair, with a batch-wide denial folded into `held`.
+     *
+     * See {@link syncStorePair}: a denial means "not now", so the cursor must
+     * stay put and the pair is retried on the next run. Any other failure is a
+     * real error and propagates to the tenant loop.
+     */
+    private transfer;
+    private createRemoteStore;
+    private cursorStore;
+    private acceptsLocalChange;
+    /**
+     * Push a local change now and resolve when done, instead of coalescing it
+     * on a timer. For hosts that cannot rely on timers outliving the request
+     * that reported the change.
+     */
+    replicateLocalChange(event: SyncChangeEvent): Promise<void>;
+    private onLocalChange;
+    /**
+     * Round-robin over the pending (tenant, db) scopes.
+     *
+     * Sequential on purpose: a hub with many spokes should not open a hundred
+     * parallel sessions to one peer, and one busy tenant must not starve the
+     * others — each pending scope gets its turn in the order it was queued.
+     */
+    private flushScopes;
+    private startEventStream;
+    private consumeEventStream;
+    private consumeIrohEventStream;
+    private handleEventFrame;
+    private handleChangeEvent;
+    private recordError;
+    /**
+     * Status snapshot for `GET /system/cluster/status`.
+     *
+     * Read straight from in-memory replication state — no store scans — so the
+     * admin UI can poll it without competing with replication for I/O. Contains
+     * counts and classified reasons only: never a docId, never an author key.
+     */
+    snapshot(): ClusterPeerStatus;
+    tenantSnapshot(tenantId: string): ClusterTenantStatus | null;
+    private tenantStatus;
+    /** Reasons that come from the link itself rather than from any one tenant. */
+    private peerLevelReasons;
+}
+/**
+ * Collapse reasons into one health verdict, shared by the per-tenant, per-peer
+ * and per-node rollups so all three agree on the thresholds.
+ *
+ * `stalled` outranks `degraded` deliberately. A clamped cursor is the visible
+ * precursor of divergence: the link looks healthy, entries keep flowing, and
+ * yet one database is quietly stuck behind an entry the peer will not accept
+ * until the directory catches up. That is the state an operator most needs to
+ * see, so a transient error elsewhere must not mask it.
+ */
+export declare function rollUpHealth(tenants: ClusterTenantStatus[], extraReasons?: ClusterHealthReason[]): {
+    health: ClusterHealth;
+    reasons: ClusterHealthReason[];
+};
+//# sourceMappingURL=PeerReplicator.d.ts.map

package/dist/server/peer/PeerReplicator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerReplicator.d.ts","sourceRoot":"","sources":["../../../src/server/peer/PeerReplicator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kDAAkD,CAAC;AACrF,OAAO,EAAmB,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE1F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAW9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EASL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EAEtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAExB,KAAK,QAAQ,EAEd,MAAM,SAAS,CAAC;AAEjB;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,UAAU,IAAI,YAAY,CAAC;IAC3B,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,EACzC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,SAAS,EAAE,QAAQ,CAAC;IACpB,mDAAmD;IACnD,aAAa,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAChD,4DAA4D;IAC5D,gBAAgB,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnD,iCAAiC;IACjC,WAAW,IAAI,MAAM,EAAE,CAAC;IACxB,8CAA8C;IAC9C,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,sEAAsE;IACtE,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC;IACvB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IAC5C,6DAA6D;IAC7D,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC;IAClE;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAwBD,qBAAa,cAAc;IACzB,OAAO,CAAC,IAAI,CAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,IAAI,CAAW;IACvB,OAAO,CAAC,WAAW,CAAqB;IAExC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAAmC;IACvD,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,YAAY,CAAgC;IAEpD,OAAO,CAAC,YAAY,CAAgB;IACpC,oFAAoF;IACpF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,gBAAgB,CAAK;IAE7B,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,SAAS,CAA8C;IAC/D,OAAO,CAAC,SAAS,CAA+C;IAChE,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAgC;IAChD,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,cAAc,CAA6B;IAEnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,UAAU,CAAuB;IAEzC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2C;gBAEvD,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB;IAYzD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,GAAG,IAAI,MAAM,GAAG,SAAS,CAE5B;IAED,6EAA6E;IAC7E,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI;IAarC,8DAA8D;IAC9D,aAAa,IAAI,mBAAmB;IAWpC,KAAK,IAAI,IAAI;IAiCP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B,KAAK,IAAI,IAAI;IAQb,MAAM,IAAI,IAAI;YAQA,SAAS;IAavB,OAAO,CAAC,iBAAiB;YAiBX,WAAW;YAWX,YAAY;IA4C1B,OAAO,CAAC,UAAU;YAIJ,WAAW;YAuBX,SAAS;YAuCT,aAAa;IA6C3B;;;;;;;;;OASG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAsC9C;;;;;;OAMG;IACG,OAAO,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQhE;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;YAIxD,OAAO;IA0GrB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAE,UAAU;IAiBnB;;;;;;OAMG;YACW,YAAY;YAeZ,aAAa;IA4F3B;;;;;;OAMG;YACW,QAAQ;YAkER,iBAAiB;IAgD/B,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACG,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IASjE,OAAO,CAAC,aAAa;IAcrB;;;;;;OAMG;YACW,WAAW;IAazB,OAAO,CAAC,gBAAgB;YAgBV,kBAAkB;YAgDlB,sBAAsB;IAoBpC,OAAO,CAAC,gBAAgB;IAexB,OAAO,CAAC,iBAAiB;IA6BzB,OAAO,CAAC,WAAW;IAYnB;;;;;;OAMG;IACH,QAAQ,IAAI,iBAAiB;IA4B7B,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAK5D,OAAO,CAAC,YAAY;IAkBpB,8EAA8E;IAC9E,OAAO,CAAC,gBAAgB;CAkBzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,mBAAmB,EAAE,EAC9B,YAAY,GAAE,mBAAmB,EAAO,GACvC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAsB3D"}