nterminal 1.3.13 → 1.3.14

package/dist/server/agent/directTlsIdentity.d.ts

@@ -0,0 +1,39 @@
+export interface DirectTlsIdentity {
+    certificate: string;
+    privateKey: string;
+}
+export interface DirectTlsLink {
+    agentId: string;
+    mainUrl: string;
+    required: boolean;
+}
+export interface DirectTlsIdentityOptions {
+    requireExisting?: boolean;
+}
+export declare const DIRECT_TLS_CERTIFICATE_DAYS = 365;
+export declare const DIRECT_TLS_RENEW_BEFORE_MS: number;
+/**
+ * One self-signed agent certificate; never a chain or a CN fallback. Expired
+ * pins may be retained during an explicit transition, but not future-dated pins.
+ * Local loading, renewal, and activation deliberately use the strict default.
+ */
+export declare function validateAgentCertificate(pem: unknown, options?: {
+    allowExpired?: boolean;
+}): string;
+export declare function readDirectTlsLink(stateDir: string): Promise<DirectTlsLink | null>;
+/**
+ * Explicit state only, outside the installed package. Never silently renews.
+ * Expired committed certificates fail closed with direct_tls_certificate_expired
+ * and remain untouched: missed renewal requires explicit operator repair.
+ */
+export declare function ensureDirectTlsIdentity(stateDir: string, options?: DirectTlsIdentityOptions): Promise<DirectTlsIdentity>;
+/**
+ * Durable activation CAS. The parent must roll out overlapping CA pins first,
+ * then hot-reload only after success. A stale expected identity is a conflict;
+ * missing, invalid, or expired committed state is never repaired by this API.
+ * An I/O error after rename can leave next committed: reload to reconcile before
+ * retrying activation. This function does not manage the parent's staged file.
+ */
+export declare function saveDirectTlsIdentity(stateDir: string, expected: DirectTlsIdentity, next: DirectTlsIdentity): Promise<void>;
+/** Staging only: preserve the private key; the parent owns pin rollout and activation. */
+export declare function createRenewedDirectTlsIdentity(identity: DirectTlsIdentity): Promise<DirectTlsIdentity>;

package/dist/server/agent/directTlsIdentity.js

@@ -0,0 +1,493 @@
+import { execFile } from 'node:child_process';
+import { createPrivateKey, randomBytes, sign, verify, X509Certificate } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rmdir, unlink } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { acquireVerifiedLock, VerifiedLockError } from '../hooks/verifiedLock.js';
+import { httpsOrigin } from './directTlsProtocol.js';
+export const DIRECT_TLS_CERTIFICATE_DAYS = 365;
+export const DIRECT_TLS_RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000;
+const AGENT_NAME = 'nterminal-agent.invalid';
+const MAX_PEM_BYTES = 16 * 1024;
+const MAX_IDENTITY_BYTES = 48 * 1024;
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+const runFile = promisify(execFile);
+const pendingEnsures = new Map();
+const WORK_FILES = new Set(['openssl.cnf', 'private-key.pem', 'certificate.pem', 'identity.json']);
+const OPENSSL_CONFIG = `[req]
+prompt = no
+distinguished_name = subject
+[subject]
+CN = ${AGENT_NAME}
+[agent]
+subjectAltName = DNS:${AGENT_NAME}
+subjectKeyIdentifier = hash
+# Bind the issuer serial so same-key renewal pins cannot shadow one another.
+authorityKeyIdentifier = keyid,issuer:always
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature
+extendedKeyUsage = serverAuth
+`;
+function failure(reason) { return new Error(`direct_tls_${reason}`); }
+class CertificateExpiredError extends Error {
+    constructor() { super('direct_tls_certificate_expired'); }
+}
+function missing(error) { return error?.code === 'ENOENT'; }
+function exists(error) { return error?.code === 'EEXIST'; }
+function uid() {
+    if (!process.getuid)
+        throw failure('unsupported_platform');
+    return process.getuid();
+}
+function singlePem(pem, labels) {
+    if (typeof pem !== 'string' || Buffer.byteLength(pem, 'utf8') > MAX_PEM_BYTES)
+        throw failure('invalid_pem');
+    const match = new RegExp(`^[ \\t\\r\\n]*-----BEGIN (${labels})-----\\r?\\n([A-Za-z0-9+/=\\r\\n]+)\\r?\\n-----END \\1-----[ \\t\\r\\n]*$`).exec(pem);
+    if (!match)
+        throw failure('invalid_pem');
+    const base64 = match[2].replace(/[\r\n]/g, '');
+    const der = Buffer.from(base64, 'base64');
+    if (!base64 || der.toString('base64') !== base64 || der[0] !== 0x30)
+        throw failure('invalid_pem');
+    // OpenSSL accepts trailing DER bytes. Require precisely one definite-length
+    // DER sequence, including minimal length encoding, before asking it to parse.
+    const first = der[1];
+    if (first === undefined)
+        throw failure('invalid_pem');
+    let header = 2;
+    let length = first;
+    if (first & 0x80) {
+        const count = first & 0x7f;
+        if (count < 1 || count > 3 || der.length < 2 + count || der[2] === 0)
+            throw failure('invalid_pem');
+        header += count;
+        length = der.readUIntBE(2, count);
+        if (length < 128)
+            throw failure('invalid_pem');
+    }
+    if (header + length !== der.length)
+        throw failure('invalid_pem');
+    return { label: match[1], der };
+}
+/**
+ * One self-signed agent certificate; never a chain or a CN fallback. Expired
+ * pins may be retained during an explicit transition, but not future-dated pins.
+ * Local loading, renewal, and activation deliberately use the strict default.
+ */
+export function validateAgentCertificate(pem, options = {}) {
+    try {
+        const { der } = singlePem(pem, 'CERTIFICATE');
+        const cert = new X509Certificate(der);
+        const now = Date.now();
+        const from = Date.parse(cert.validFrom);
+        const to = Date.parse(cert.validTo);
+        if (!cert.raw.equals(der) || !Number.isFinite(from) || !Number.isFinite(to)
+            || from > now || to <= from || cert.subject !== cert.issuer || !cert.verify(cert.publicKey)) {
+            throw failure('invalid_certificate');
+        }
+        if (cert.checkHost(AGENT_NAME, { subject: 'never', wildcards: false, partialWildcards: false,
+            multiLabelWildcards: false, singleLabelSubdomains: false })?.toLowerCase() !== AGENT_NAME) {
+            throw failure('invalid_certificate');
+        }
+        const key = cert.publicKey;
+        const details = key.asymmetricKeyDetails;
+        const rsa = (key.asymmetricKeyType === 'rsa' || key.asymmetricKeyType === 'rsa-pss')
+            && (details?.modulusLength ?? 0) >= 2048;
+        const ec = key.asymmetricKeyType === 'ec'
+            && ['prime256v1', 'secp256k1', 'secp384r1', 'secp521r1'].includes(details?.namedCurve ?? '');
+        if (!rsa && !ec)
+            throw failure('invalid_certificate');
+        if (to <= now && options.allowExpired !== true)
+            throw new CertificateExpiredError();
+        const canonical = cert.toString();
+        if (Buffer.byteLength(canonical) > MAX_PEM_BYTES)
+            throw failure('invalid_certificate');
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof CertificateExpiredError)
+            throw error;
+        throw failure('invalid_certificate');
+    }
+}
+function validateIdentity(value) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw failure('invalid_identity');
+        const record = value;
+        if (Object.keys(record).length !== 2 || typeof record.privateKey !== 'string')
+            throw failure('invalid_identity');
+        const certificate = validateAgentCertificate(record.certificate);
+        const { label, der } = singlePem(record.privateKey, 'PRIVATE KEY|RSA PRIVATE KEY|EC PRIVATE KEY');
+        const key = createPrivateKey({ key: der, format: 'der',
+            type: label === 'PRIVATE KEY' ? 'pkcs8' : label === 'RSA PRIVATE KEY' ? 'pkcs1' : 'sec1' });
+        const cert = new X509Certificate(certificate);
+        if (!cert.checkPrivateKey(key))
+            throw failure('invalid_identity');
+        // Matching public fields alone does not detect a damaged private scalar or
+        // RSA private components in an otherwise parseable key container.
+        const challenge = Buffer.from('nterminal-direct-tls-key-consistency', 'ascii');
+        const digest = key.asymmetricKeyDetails?.hashAlgorithm ?? 'sha256';
+        if (!verify(digest, challenge, cert.publicKey, sign(digest, challenge, key)))
+            throw failure('invalid_identity');
+        return { certificate, privateKey: record.privateKey };
+    }
+    catch (error) {
+        if (error instanceof CertificateExpiredError)
+            throw error;
+        throw failure('invalid_identity');
+    }
+}
+function safeDirectory(info, owned, privateMode = false) {
+    const owner = uid();
+    // Root-owned, sticky system temp directories are trusted ancestors, not state
+    // directories. All other writable-by-others or foreign-owned paths fail shut.
+    const systemTemp = !owned && info.uid === 0 && (info.mode & 0o1000) !== 0;
+    if (!info.isDirectory() || (info.uid !== owner && (owned || info.uid !== 0))
+        || (!systemTemp && (info.mode & 0o022) !== 0)
+        || (privateMode && (info.mode & 0o7777) !== 0o700))
+        throw failure('unsafe_path');
+}
+async function directoryChain(directory, create = false, ownedLeaf = true) {
+    const root = path.parse(directory).root;
+    let current = root;
+    safeDirectory(await lstat(root), false);
+    for (const component of directory.slice(root.length).split(path.sep).filter(Boolean)) {
+        const parent = current;
+        current = path.join(current, component);
+        if (create) {
+            try {
+                await mkdir(current, { mode: 0o700 });
+            }
+            catch (error) {
+                if (!exists(error))
+                    throw error;
+            }
+        }
+        safeDirectory(await lstat(current), ownedLeaf && current === directory);
+        // Sync even existing entries: the previous owner may have exited between
+        // mkdir and its directory fsync. No successfully returned path is volatile.
+        if (create)
+            await syncDirectory(parent);
+    }
+}
+async function syncDirectory(directory) {
+    const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        safeDirectory(await handle.stat(), false);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function privateDirectory(directory) {
+    try {
+        await mkdir(directory, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!exists(error))
+            throw error;
+    }
+    safeDirectory(await lstat(directory), true, true);
+    await syncDirectory(path.dirname(directory));
+}
+function safeFile(info) {
+    if (!info.isFile() || info.uid !== uid() || info.nlink !== 1 || (info.mode & 0o7777) !== 0o600) {
+        throw failure('unsafe_path');
+    }
+}
+async function readPrivateFile(file, durable = false) {
+    let handle;
+    try {
+        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (missing(error))
+            return null;
+        throw failure('unsafe_path');
+    }
+    try {
+        const before = await handle.stat();
+        safeFile(before);
+        if (before.size > MAX_IDENTITY_BYTES)
+            throw failure('file_too_large');
+        const buffer = Buffer.alloc(MAX_IDENTITY_BYTES + 1);
+        let size = 0;
+        while (size < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, size, buffer.length - size, null);
+            if (bytesRead === 0)
+                break;
+            size += bytesRead;
+        }
+        if (size > MAX_IDENTITY_BYTES)
+            throw failure('file_too_large');
+        const after = await handle.stat();
+        safeFile(after);
+        const entry = await lstat(file);
+        if (entry.ino !== after.ino || entry.dev !== after.dev || before.size !== after.size
+            || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs)
+            throw failure('file_changed');
+        if (durable)
+            await handle.sync();
+        return new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, size));
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writePrivateFile(file, text) {
+    const handle = await open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        await handle.chmod(0o600);
+        safeFile(await handle.stat());
+        await handle.writeFile(text, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readIdentity(file) {
+    const text = await readPrivateFile(file, true);
+    if (text === null)
+        return null;
+    try {
+        return validateIdentity(JSON.parse(text));
+    }
+    catch (error) {
+        if (error instanceof CertificateExpiredError)
+            throw error;
+        throw failure('invalid_identity');
+    }
+}
+export async function readDirectTlsLink(stateDir) {
+    const directory = path.join(resolveStateDirectory(stateDir), 'direct-tls');
+    await directoryChain(directory);
+    const text = await readPrivateFile(path.join(directory, 'link.json'), true);
+    if (text === null)
+        return null;
+    try {
+        const link = JSON.parse(text);
+        if (!link || typeof link.agentId !== 'string' || !link.agentId || typeof link.required !== 'boolean') {
+            throw failure('invalid_state');
+        }
+        return { agentId: link.agentId, mainUrl: httpsOrigin(link.mainUrl), required: link.required };
+    }
+    catch {
+        throw new Error('invalid_direct_tls_state');
+    }
+}
+function sameIdentity(actual, expected) {
+    return actual === null || expected === null ? actual === expected
+        : actual.certificate === expected.certificate && actual.privateKey === expected.privateKey;
+}
+async function commitIdentity(directory, work, expected, next) {
+    const staged = path.join(work, 'identity.json');
+    const file = path.join(directory, 'identity.json');
+    await writePrivateFile(staged, `${JSON.stringify(next)}\n`);
+    await syncDirectory(work);
+    if (!sameIdentity(await readIdentity(file), expected))
+        throw failure('identity_conflict');
+    await rename(staged, file);
+    await syncDirectory(directory);
+    await syncDirectory(work);
+}
+async function clearWork(directory) {
+    let info;
+    try {
+        info = await lstat(directory);
+    }
+    catch (error) {
+        if (missing(error))
+            return;
+        throw error;
+    }
+    safeDirectory(info, true, true);
+    const names = await readdir(directory);
+    // Never recursively remove unknown or linked entries, even during recovery.
+    for (const name of names) {
+        if (!WORK_FILES.has(name))
+            throw failure('unsafe_staging');
+        safeFile(await lstat(path.join(directory, name)));
+    }
+    for (const name of names)
+        await unlink(path.join(directory, name));
+    await rmdir(directory);
+    await syncDirectory(path.dirname(directory));
+}
+async function generateIdentity(work, privateKey) {
+    await writePrivateFile(path.join(work, 'openssl.cnf'), OPENSSL_CONFIG);
+    await writePrivateFile(path.join(work, 'private-key.pem'), privateKey ?? '');
+    await writePrivateFile(path.join(work, 'certificate.pem'), '');
+    const options = { cwd: work, encoding: 'utf8', maxBuffer: 64 * 1024, timeout: 5000, killSignal: 'SIGKILL',
+        env: { PATH: process.env.PATH ?? '/usr/bin:/bin', OPENSSL_CONF: path.join(work, 'openssl.cnf') } };
+    try {
+        if (privateKey === undefined) {
+            await runFile('openssl', ['genpkey', '-algorithm', 'EC', '-pkeyopt', 'ec_paramgen_curve:P-256', '-out', 'private-key.pem'], options);
+        }
+        await runFile('openssl', ['req', '-new', '-x509', '-batch', '-sha256', '-days', String(DIRECT_TLS_CERTIFICATE_DAYS),
+            '-key', 'private-key.pem', '-out', 'certificate.pem', '-config', 'openssl.cnf', '-extensions', 'agent',
+            '-set_serial', `0x${randomBytes(16).toString('hex')}`], options);
+    }
+    catch {
+        throw failure('openssl_failed');
+    }
+    return validateIdentity({ certificate: await readPrivateFile(path.join(work, 'certificate.pem')),
+        privateKey: privateKey ?? await readPrivateFile(path.join(work, 'private-key.pem')) });
+}
+async function lockIdentity(directory) {
+    const lock = path.join(directory, '.identity.lock');
+    const owners = `${lock}.owners`;
+    await privateDirectory(owners);
+    const deadline = performance.now() + 30_000;
+    for (;;) {
+        // The shared lock checks identity and hard links; enforce this store's more
+        // restrictive directory modes before it reads or reclaims owner records.
+        for (const name of await readdir(owners)) {
+            try {
+                safeDirectory(await lstat(path.join(owners, name)), true, true);
+            }
+            catch (error) {
+                if (!missing(error))
+                    throw error;
+            }
+        }
+        try {
+            return (await acquireVerifiedLock(lock)).release;
+        }
+        catch (error) {
+            if (!(error instanceof VerifiedLockError) || !error.retryable)
+                throw error;
+            if (performance.now() >= deadline)
+                throw failure('busy');
+            await delay(20 + Math.floor(Math.random() * 30));
+        }
+    }
+}
+async function ensureIdentity(stateDir, requireExisting) {
+    await directoryChain(stateDir, true);
+    const directory = path.join(stateDir, 'direct-tls');
+    await privateDirectory(directory);
+    const release = await lockIdentity(directory);
+    const file = path.join(directory, 'identity.json');
+    const work = path.join(directory, '.identity-work');
+    try {
+        await directoryChain(directory);
+        const link = await readDirectTlsLink(stateDir);
+        const existing = await readIdentity(file);
+        if (!existing && (requireExisting || link?.required))
+            throw failure('identity_missing');
+        // A verified lock proves any previous writer is gone before discarding its
+        // incomplete staging. A committed but invalid identity is never replaced.
+        await clearWork(work);
+        if (existing) {
+            await syncDirectory(directory);
+            return existing;
+        }
+        await privateDirectory(work);
+        try {
+            const identity = await generateIdentity(work);
+            await commitIdentity(directory, work, null, identity);
+            return identity;
+        }
+        finally {
+            await clearWork(work);
+        }
+    }
+    finally {
+        await release();
+    }
+}
+function resolveStateDirectory(stateDir) {
+    if (typeof stateDir !== 'string' || !stateDir.trim() || stateDir.includes('\0'))
+        throw failure('invalid_state_directory');
+    const directory = path.resolve(stateDir);
+    const relative = path.relative(PACKAGE_ROOT, directory);
+    if (relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))
+        || directory.split(path.sep).includes('node_modules'))
+        throw failure('state_in_package');
+    return directory;
+}
+/**
+ * Explicit state only, outside the installed package. Never silently renews.
+ * Expired committed certificates fail closed with direct_tls_certificate_expired
+ * and remain untouched: missed renewal requires explicit operator repair.
+ */
+export async function ensureDirectTlsIdentity(stateDir, options = {}) {
+    const directory = resolveStateDirectory(stateDir);
+    // A load-only request must never join a request allowed to generate a key.
+    const key = `${directory}\0${options.requireExisting === true ? 'existing' : 'create'}`;
+    let pending = pendingEnsures.get(key);
+    if (!pending) {
+        pending = ensureIdentity(directory, options.requireExisting === true);
+        pendingEnsures.set(key, pending);
+    }
+    try {
+        return { ...await pending };
+    }
+    finally {
+        if (pendingEnsures.get(key) === pending)
+            pendingEnsures.delete(key);
+    }
+}
+/**
+ * Durable activation CAS. The parent must roll out overlapping CA pins first,
+ * then hot-reload only after success. A stale expected identity is a conflict;
+ * missing, invalid, or expired committed state is never repaired by this API.
+ * An I/O error after rename can leave next committed: reload to reconcile before
+ * retrying activation. This function does not manage the parent's staged file.
+ */
+export async function saveDirectTlsIdentity(stateDir, expected, next) {
+    const state = resolveStateDirectory(stateDir);
+    const previous = validateIdentity(expected);
+    const replacement = validateIdentity(next);
+    await directoryChain(state);
+    const directory = path.join(state, 'direct-tls');
+    safeDirectory(await lstat(directory), true, true);
+    const release = await lockIdentity(directory);
+    const work = path.join(directory, '.identity-work');
+    try {
+        await directoryChain(directory);
+        const current = await readIdentity(path.join(directory, 'identity.json'));
+        if (!sameIdentity(current, previous))
+            throw failure('identity_conflict');
+        await clearWork(work);
+        if (sameIdentity(current, replacement)) {
+            await syncDirectory(directory);
+            return;
+        }
+        await privateDirectory(work);
+        try {
+            await commitIdentity(directory, work, previous, replacement);
+        }
+        finally {
+            await clearWork(work);
+        }
+    }
+    finally {
+        await release();
+    }
+}
+/** Staging only: preserve the private key; the parent owns pin rollout and activation. */
+export async function createRenewedDirectTlsIdentity(identity) {
+    const validated = validateIdentity(identity);
+    // Only the OS temp root may be an alias. Check the canonical path as strictly
+    // as before; state and identity paths must still never traverse symlinks.
+    const parent = await realpath(path.resolve(tmpdir()));
+    await directoryChain(path.dirname(parent), false, false);
+    safeDirectory(await lstat(parent), false);
+    const work = await mkdtemp(path.join(parent, 'nterminal-direct-tls-'));
+    try {
+        safeDirectory(await lstat(work), true, true);
+        return await generateIdentity(work, validated.privateKey);
+    }
+    finally {
+        await clearWork(work);
+    }
+}
+//# sourceMappingURL=directTlsIdentity.js.map

package/dist/server/agent/directTlsIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"directTlsIdentity.js","sourceRoot":"","sources":["../../../src/server/agent/directTlsIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAUrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAC/C,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnE,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AAChC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AAC5F,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACpC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsC,CAAC;AACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC,CAAC;AACnG,MAAM,cAAc,GAAG;;;;OAIhB,UAAU;;uBAEM,UAAU;;;;;;;CAOhC,CAAC;AAEF,SAAS,OAAO,CAAC,MAAc,IAAW,OAAO,IAAI,KAAK,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACrF,MAAM,uBAAwB,SAAQ,KAAK;IACzC,gBAAgB,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC;CAC3D;AACD,SAAS,OAAO,CAAC,KAAc,IAAa,OAAQ,KAA+B,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AACzG,SAAS,MAAM,CAAC,KAAc,IAAa,OAAQ,KAA+B,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AACxG,SAAS,GAAG;IACV,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,MAAc;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,aAAa;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,6BAA6B,MAAM,4EAA4E,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpJ,IAAI,CAAC,KAAK;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAClG,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;QAC3B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY,EAAE,UAAsC,EAAE;IAC7F,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;eACtE,IAAI,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK;YAC1F,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YAC5F,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACzC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC;eAC/E,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,KAAK,IAAI;eACpC,CAAC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE;YAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,EAAE,IAAI,GAAG,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACpF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,aAAa;YAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACjH,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,4CAA4C,CAAC,CAAC;QAClG,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;YACpD,IAAI,EAAE,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAClE,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,OAAO,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,EAAE,aAAa,IAAI,QAAQ,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAChH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAW,EAAE,KAAc,EAAE,WAAW,GAAG,KAAK;IACrE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;WACvE,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;WAC1C,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,IAAI;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,OAAO,CAAC;QACvB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9C,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QACpD,CAAC;QACD,aAAa,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,MAAM;YAAE,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACxG,IAAI,CAAC;QAAC,aAAa,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAC/D,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IAChD,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;IAAC,CAAC;IAClD,aAAa,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAW;IAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/F,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK;IAC1D,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACpG,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAAC,CAAC;IAChF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjB,IAAI,MAAM,CAAC,IAAI,GAAG,kBAAkB;YAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAClF,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,IAAI,IAAI,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,GAAG,kBAAkB;YAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;eAC/E,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QACzG,IAAI,OAAO;YAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACzH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,QAAQ,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAClD,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACrG,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAAC,CAAC;AAC1D,CAAC;AAED,SAAS,YAAY,CAAC,MAAgC,EAAE,QAAkC;IACxF,OAAO,MAAM,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC/D,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,QAAkC,EAC/F,IAAuB;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,YAAY,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC1F,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3B,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,SAAiB;IACxC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IACtC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IAC1D,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3D,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,UAAmB;IAC/D,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAe,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAkB;QACzH,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;IACrG,IAAI,CAAC;QACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;QACvI,CAAC;QACD,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,2BAA2B,CAAC;YACjH,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO;YACtG,aAAa,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAC,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC9F,UAAU,EAAE,UAAU,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;IAChC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IAC5C,SAAS,CAAC;QACR,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC;gBAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAAC,CAAC;YACxE,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAAC,CAAC;QACzD,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC;YAC3E,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,eAAwB;IACtE,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,QAAQ,CAAC;YAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACxF,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,QAAQ,EAAE,CAAC;YAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO,QAAQ,CAAC;QAAC,CAAC;QAClE,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtD,OAAO,QAAQ,CAAC;QAClB,CAAC;gBAAS,CAAC;YAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC1H,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;WAC5G,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,UAAoC,EAAE;IACpG,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAClD,2EAA2E;IAC3E,MAAM,GAAG,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxF,IAAI,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC;QACtE,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QAAC,OAAO,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;YAC5B,CAAC;QAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,QAA2B,EACvF,IAAuB;IACvB,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACjD,aAAa,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACzE,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnF,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YAAC,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAAC,CAAC;gBAC7D,CAAC;YAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,QAA2B;IAC9E,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,aAAa,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,MAAM,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;AACtC,CAAC"}

package/dist/server/agent/directTlsMigration.d.ts

@@ -0,0 +1,25 @@
+import type { FastifyInstance } from 'fastify';
+import type { AppConfig } from '../config.js';
+import type { FileStore, StoredAgent } from '../storage/fileStore.js';
+import { type SecondaryDirectTls } from './secondaryDirectTls.js';
+import type { AuthService } from '../auth/authService.js';
+export declare function probeDirectTls(agent: StoredAgent): Promise<boolean>;
+export declare function registerDirectTlsRoutes(app: FastifyInstance, config: AppConfig, store: FileStore, auth: AuthService, secondary?: SecondaryDirectTls): void;
+/** Runs on main, independent of Update all/browser lifetime. At most two peers at a time. */
+export declare class DirectTlsMigration {
+    private readonly config;
+    private readonly store;
+    private readonly warn;
+    private stopped;
+    private timer;
+    private readonly controller;
+    private readonly retryAfter;
+    constructor(config: AppConfig, store: FileStore, warn: (agentId: string, code: string) => void);
+    start(): void;
+    dispose(): void;
+    private schedule;
+    private run;
+    private needsRenewal;
+    renew(agent: StoredAgent): Promise<void>;
+    migrate(agent: StoredAgent, mainUrl: string): Promise<void>;
+}