merge: Phase 11.5 security remediation, invite redesign, per-node identity

Brings in the security remediation branch. Three bodies of work, and what they
changed about what this project may claim.

Phase 11.5 closed the gap between the documents and the code: the unauthenticated
node HTTP API and the TCP transport deleted, one handshake shared by the
remaining two transports, mutual authentication, structured admin transcripts,
upload confinement, group isolation, revocation that reaches nodes. Six critical
and seven high findings closed, bounded, or deferred by decision.

The invite redesign closed H3 and M3 — the last open High. The hub was the key
directory: an inviter fetched the invitee's key from it and wrapped the group key
for whatever came back, so a hub answering with its own key was handed the group
key by an honest member following the protocol exactly. That lookup is gone. The
node holds the group key and wraps it itself, for a key its recipient proves
possession of, bound to an account by a one-time code the hub never sees. M3 fell
out of the same work: node authority comes from a local roster, never from the
hub.

Per-node identity cut what remains of C4 down to one operator. A single keypair
used to be copied to every node its owner joined; each node now gets its own, so
cracking the bundle on one machine yields a key that is a stranger everywhere
else — and on that machine, one that unlocks nothing its holder did not already
serve. The bundle KDF moved to Argon2id 128 MB, and the hub stopped storing or
publishing user keys at all.

What this project may now say: the hub cannot read your content unless it ships
you malicious client code. T3 remains, accepted (D1), and is what the native
client removes. C4 is reduced, not closed, until 13.3. Chat is still plaintext at
rest until Phase 15. Draft-v5 §2 states each claim against the adversary it holds
against, which is the convention this branch exists to keep.

Four defects were found by deploying it and using a browser, none by the test
suite: a node going deaf on its hub socket, a token that predated group
membership, a client reading values before they were assigned, and identity keys
a browser held but never re-read. The lessons are recorded in CLAUDE.md.

Tests: 343 across the three packages, plus QE/deploy/e2e.py — register, pair,
invite, join, download, stream, second browser, revoke — run against the live
deployment on a wiped hub and node.

9 files changed, 940 insertions, 224 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ddff928..3087e0e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -65,9 +65,13 @@ async function getAllCachedIndexes() {
 
 // ── Auth persistence ─────────────────────────────────────────────────────────
 
-let _sessionKeys = null;
+// The key that opens a node's keypair bundle, derived once at sign-in. There is
+// no global identity to keep: identity keys belong to a node and are fetched from
+// it (transport.js), so nothing of that kind lives here.
 let _bundleKey = null;
-let _pendingBundlePush = null;
+// A one-time pairing code the user just typed, consumed by the next connection
+// attempt. Deliberately not persisted: it is single-use and short-lived.
+let _pendingJoinCode = null;
 
 function _openKeyDB() {
   return new Promise((resolve, reject) => {
@@ -105,18 +109,45 @@ async function _clearKeyDB() {
     db.close();
   } catch {}
 }
-function _saveSessionKeys() {
-  try {
-    if (_sessionKeys) sessionStorage.setItem('meshbay_sk', JSON.stringify(_sessionKeys));
-  } catch {}
+/**
+ * Rough passphrase strength, in bits, and what it is up against.
+ *
+ * This number carries more weight here than in most applications. The encrypted
+ * keypair bundle is protected by PBKDF2-SHA512 (600k) and sits on every node
+ * whose group you join, so the people who host your groups can attack it offline
+ * (finding C4). PBKDF2 is memory-light, which is exactly what GPUs are good at.
+ *
+ * The estimate is deliberately conservative — character classes and length, with
+ * a penalty for repetition and for the handful of patterns everyone tries. It is
+ * a guide, not a guarantee, and it says so in the UI.
+ */
+function passwordBits(pw) {
+  if (!pw) return 0;
+  let pool = 0;
+  if (/[a-z]/.test(pw)) pool += 26;
+  if (/[A-Z]/.test(pw)) pool += 26;
+  if (/[0-9]/.test(pw)) pool += 10;
+  if (/[^A-Za-z0-9]/.test(pw)) pool += 32;
+  let bits = pw.length * Math.log2(pool || 1);
+
+  const unique = new Set(pw).size;
+  if (unique < pw.length / 2) bits *= 0.6;          // "aaaaaaaa", "abcabcabc"
+  if (/^[0-9]+$/.test(pw)) bits *= 0.5;             // dates, PINs
+  if (/(password|motdepasse|azerty|qwerty|123456|meshbay)/i.test(pw)) bits *= 0.3;
+  return Math.round(bits);
 }
-function _restoreSessionKeys() {
-  try {
-    if (!_sessionKeys) {
-      const sk = sessionStorage.getItem('meshbay_sk');
-      if (sk) _sessionKeys = JSON.parse(sk);
-    }
-  } catch {}
+
+const PASSWORD_MIN_BITS = 60;   // refuse below this
+const PASSWORD_MIN_LEN = 12;
+
+/** Public X25519 key from our own secret — never read back from the hub. */
+async function _pkXFromSk(skPkcs8B64) {
+  const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0));
+  const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'X25519' }, true, ['deriveBits']);
+  const jwk = await crypto.subtle.exportKey('jwk', sk);
+  const b64 = jwk.x.replace(/-/g, '+').replace(/_/g, '/');
+  const pad = b64.length % 4;
+  return pad ? b64 + '='.repeat(4 - pad) : b64;
 }
 
 function loadAuth() {
@@ -132,11 +163,8 @@ function saveAuth(auth) {
     localStorage.setItem(AUTH_KEY, JSON.stringify(auth));
   } else {
     localStorage.removeItem(AUTH_KEY);
-    _sessionKeys = null;
     _bundleKey = null;
-    _pendingBundlePush = null;
     _clearKeyDB();
-    try { sessionStorage.removeItem('meshbay_sk'); } catch {}
   }
 }
 
@@ -390,7 +418,14 @@ function RegisterPage() {
   const onSubmit = async (e) => {
     e.preventDefault();
     if (password !== confirm) { setError(t('register.err_mismatch')); return; }
-    if (password.length < 8) { setError(t('register.err_min_len')); return; }
+    if (password.length < PASSWORD_MIN_LEN) {
+      setError(t('register.err_min_len', { n: PASSWORD_MIN_LEN })); return;
+    }
+    // The floor can only live here: with the password split (T1) the hub never
+    // sees the password, so it cannot enforce anything about it.
+    if (passwordBits(password) < PASSWORD_MIN_BITS) {
+      setError(t('register.err_too_weak')); return;
+    }
     setError('');
     setLoading(true);
     try {
@@ -438,6 +473,18 @@ function RegisterPage() {
           <input type="password" placeholder="${t('register.password')}" value=${password}
                  onInput=${e => setPassword(e.target.value)}
                  autocomplete="new-password" required minlength="8" />
+          ${password && html`
+            <div style="margin:-4px 0 10px">
+              <div style="height:4px;background:var(--border);border-radius:2px;overflow:hidden">
+                <div style=${`height:100%;width:${Math.min(100, passwordBits(password) / 100 * 100)}%;
+                     background:${passwordBits(password) < PASSWORD_MIN_BITS ? 'var(--error)'
+                       : passwordBits(password) < 80 ? 'var(--yellow, #f59e0b)' : 'var(--success)'}`}></div>
+              </div>
+              <p style="font-size:0.8em;color:var(--text-dim);margin-top:4px">
+                ${t('register.strength', { bits: passwordBits(password) })}
+              </p>
+            </div>
+          `}
           <input type="password" placeholder="${t('register.confirm')}" value=${confirm}
                  onInput=${e => setConfirm(e.target.value)}
                  autocomplete="new-password" required />
@@ -762,7 +809,7 @@ async function pipelinedDownload(transport, gekKey, fileId, totalChunks, onChunk
   return results;
 }
 
-function GroupPage({ groupId, group, token, username, userId }) {
+function GroupPage({ groupId, group, token, username, userId, onRefreshAuth }) {
   const [status, setStatus] = useState('idle');
   const [entries, setEntries] = useState([]);
   const [cached, setCached] = useState(false);
@@ -778,8 +825,25 @@ function GroupPage({ groupId, group, token, username, userId }) {
   const [uploading, setUploading] = useState(false);
   const [menuOpen, setMenuOpen] = useState(null);
   const [isNodeAdmin, setIsNodeAdmin] = useState(false);
+  const [needsCode, setNeedsCode] = useState(false);
+  const [codeInput, setCodeInput] = useState('');
+  const [retryKey, setRetryKey] = useState(0);
   const transportRef = useRef(null);
   const gekRef = useRef(null);
+  // One refresh per mount: if a fresh token still says we are not a member, we
+  // really are not, and retrying forever would hide that.
+  const refreshedRef = useRef(false);
+
+  const submitJoinCode = useCallback((e) => {
+    e.preventDefault();
+    const code = codeInput.trim();
+    if (!code) return;
+    _pendingJoinCode = code;
+    setCodeInput('');
+    setNeedsCode(false);
+    setError('');
+    setRetryKey(k => k + 1);
+  }, [codeInput]);
 
   useEffect(() => {
     if (menuOpen === null) return;
@@ -803,7 +867,6 @@ function GroupPage({ groupId, group, token, username, userId }) {
       setError('');
       gekRef.current = null;
       if (!_bundleKey) _bundleKey = await _loadBundleKey();
-      _restoreSessionKeys();
       try {
         const nodesData = await hubFetch(`/v1/groups/${groupId}/nodes`, { token });
         if (cancelled) return;
@@ -812,11 +875,9 @@ function GroupPage({ groupId, group, token, username, userId }) {
           return;
         }
 
-        // Session keys for P2P GEK bundle fetch (node delivers wrapped GEK)
-        const sessionKeys = _sessionKeys ? {
-          skXB64: _sessionKeys.skXB64,
-          pkXB64: _sessionKeys.pkXB64,
-        } : null;
+        // No keys are carried in: the transport fetches this node's identity
+        // from the node, or creates one there on a first join.
+        const sessionKeys = null;
 
         setStatus('connecting');
         const nodeId = nodesData.nodes[0].node_id;
@@ -824,34 +885,21 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = transport;
 
         const ack = await transport.connect(
-          nodeId, token, groupId, null, sessionKeys, _bundleKey, username);
+          nodeId, token, groupId, null, sessionKeys, _bundleKey, username,
+          userId, _pendingJoinCode);
+        _pendingJoinCode = null;
         if (cancelled) return;
         setIsNodeAdmin(!!ack.is_node_admin);
 
-        // If transport recovered different session keys from node during handshake
-        if (transport.sessionKeys) {
-          const recovered = transport.sessionKeys;
-          if (!_sessionKeys || recovered.skXB64 !== _sessionKeys.skXB64) {
-            _sessionKeys = recovered;
-            if (!_sessionKeys.pkXB64) {
-              const pubkeys = await hubFetch(
-                `/v1/users/${username}/pubkeys`, { token });
-              _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-            }
-            _pendingBundlePush = null;
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _saveSessionKeys();
-          }
-        }
-
-        // Push keypair bundle to node (new registration, localStorage → node)
-        if (_pendingBundlePush && transport.connected) {
+        // A first join to this node generated an identity for it; leave it with
+        // the node so any other browser can become the same person here with the
+        // passphrase. It is this node's key and no other's.
+        if (transport.connected && transport.newNodeBundle) {
           try {
-            await transport.storeKeypairBundle(_pendingBundlePush);
-            try { localStorage.removeItem(`meshbay_kp_${username}`); } catch {}
-            _pendingBundlePush = null;
+            await transport.storeKeypairBundle(transport.newNodeBundle);
+            transport.newNodeBundle = null;
           } catch (e) {
-            console.warn('[MeshBay] Bundle push to node deferred:', e.message);
+            console.warn('[MeshBay] could not leave our key with the node:', e.message);
           }
         }
 
@@ -880,10 +928,24 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         cacheGroupIndex(groupId, group ? group.name : groupId, freshEntries);
       } catch (err) {
-        if (!cancelled) {
-          setError(err.message);
-          setStatus('error');
+        if (cancelled) return;
+
+        // Our token predates being added to this group. Refresh once and retry
+        // rather than telling someone who was just invited that they are not a
+        // member — which is what the node honestly sees, and is useless to them.
+        if (err.reason === 'not_a_member' && !refreshedRef.current && onRefreshAuth) {
+          refreshedRef.current = true;
+          try {
+            if (await onRefreshAuth()) return;   // new token → effect re-runs
+          } catch { /* fall through to the message below */ }
         }
+
+        // The node has never seen this browser for this account: it needs a
+        // one-time code from the operator before it will hand over the group
+        // key. Not an error to shout about — a step in joining.
+        if (err.reason === 'code_required') setNeedsCode(true);
+        setError(err.message);
+        setStatus('error');
       }
     };
 
@@ -902,7 +964,7 @@ function GroupPage({ groupId, group, token, username, userId }) {
         transportRef.current = null;
       }
     };
-  }, [groupId, token]);
+  }, [groupId, token, retryKey]);
 
   const downloadFile = useCallback(async (entry) => {
     const transport = transportRef.current;
@@ -979,8 +1041,13 @@ function GroupPage({ groupId, group, token, username, userId }) {
     const transport = transportRef.current;
     if (!transport || !transport.connected) return;
     try {
-      const signFn = (_sessionKeys && window.MeshBayKeys)
-        ? (challenge) => window.MeshBayKeys.signChallenge(_sessionKeys.skEdB64, challenge)
+      // Signs an explicit transcript built by transport.js, not opaque bytes from
+      // the node — see MeshBayCrypto.adminTranscript and finding H5.
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
         : null;
       await transport.deleteFile(entry.id, signFn);
       const indexMsg = await transport.fetchIndex();
@@ -1077,6 +1144,17 @@ function GroupPage({ groupId, group, token, username, userId }) {
         `}
       </div>
       ${error && html`<div class="error-msg" style="margin-bottom:12px">${error}</div>`}
+      ${needsCode && html`
+        <form class="invite-form" style="margin-bottom:12px" onSubmit=${submitJoinCode}>
+          <h4>${t('group.join_code_title')}</h4>
+          <p class="settings-hint">${t('group.join_code_hint')}</p>
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${codeInput} onInput=${e => setCodeInput(e.target.value)} required />
+            <button class="admin-btn" type="submit">${t('group.join_code_btn')}</button>
+          </div>
+        </form>
+      `}
       ${dlState && html`
         <div class="dl-bar">
           <span class="dl-name">${dlState.name}</span>
@@ -1222,7 +1300,8 @@ function GroupPage({ groupId, group, token, username, userId }) {
 
         ${tab === 'members' && html`
           <${MembersPanel} groupId=${groupId} group=${group} token=${token}
-            transportRef=${transportRef} gekRef=${gekRef} />
+            transportRef=${transportRef} gekRef=${gekRef}
+            isNodeAdmin=${isNodeAdmin} userId=${userId} />
         `}
       `}
       ${status === 'offline' && html`
@@ -1363,13 +1442,41 @@ function _b64ToU8(b64) {
 
 // ── Members Panel ────────────────────────────────────────────────────────
 
-function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
+function MembersPanel({ groupId, group, token, transportRef, gekRef,
+                       isNodeAdmin, userId }) {
   const [members, setMembers] = useState([]);
   const [adminId, setAdminId] = useState('');
   const [loading, setLoading] = useState(true);
   const [inviteUser, setInviteUser] = useState('');
   const [inviting, setInviting] = useState(false);
   const [error, setError] = useState('');
+  const [inviteCode, setInviteCode] = useState(null);
+  const [pairCode, setPairCode] = useState('');
+  const [pairStatus, setPairStatus] = useState('');
+  const [pairing, setPairing] = useState(false);
+
+  // Pairing lives here rather than in Settings because this is where a live
+  // connection to the node exists — and it is offered only when the node itself
+  // says this account is its operator (is_node_admin comes from the authenticated
+  // handshake_ack, not from the hub).
+  const doPair = useCallback(async (e) => {
+    e.preventDefault();
+    const code = pairCode.trim();
+    if (!code) return;
+    setPairing(true);
+    setPairStatus('');
+    try {
+      const transport = transportRef && transportRef.current;
+      if (!transport || !transport.connected) throw new Error('Not connected to the node');
+      await transport.pairOperator(userId, code);
+      setPairCode('');
+      setPairStatus('paired');
+    } catch (err) {
+      setPairStatus(err.message);
+    } finally {
+      setPairing(false);
+    }
+  }, [pairCode, transportRef, userId]);
 
   const loadMembers = useCallback(() => {
     setLoading(true);
@@ -1391,29 +1498,37 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     if (!inviteUser.trim()) return;
     setInviting(true);
     setError('');
+    setInviteCode(null);
     try {
       const transport = transportRef && transportRef.current;
       const username = inviteUser.trim();
-
-      // Fetch invitee's public keys (hub = public key directory)
-      const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-      const pkXBytes = Uint8Array.from(atob(pubkeys.pk_x25519), c => c.charCodeAt(0));
-
-      // Get raw GEK from the active transport connection
-      if (!transport || !transport.connected || !transport.gekRaw) {
-        throw new Error('Not connected to node or no GEK available');
+      if (!transport || !transport.connected) {
+        throw new Error('Not connected to the node — it must be online to invite');
       }
-      const gekBytes = transport.gekRaw;
 
-      // Wrap GEK for invitee and store on node via P2P
-      const bundle = await window.MeshBayCrypto.wrapGEK(gekBytes, pkXBytes);
-      await transport.storeGekBundle(pubkeys.user_id, groupId, bundle);
+      // The hub is asked for the account id, and nothing else. It is no longer
+      // asked for the invitee's public key: the node wraps the group key itself,
+      // for a key the invitee proves possession of when they connect (H3). A hub
+      // that answered with the wrong account here would produce an invite whose
+      // code it never learns — the code goes to a human, out of band.
+      const account = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
 
-      // Add member on hub (membership management only)
+      // Signed with the identity this node pinned for us — the only one it
+      // will accept, and the only one we hold here.
+      const sk = transport.sessionKeys && transport.sessionKeys.skEdB64;
+      const signFn = (sk && window.MeshBayKeys)
+        ? (transcript) => window.MeshBayKeys.signBytes(sk, transcript)
+        : null;
+      const result = await transport.createInvite(
+        account.user_id, groupId, username, signFn);
+
+      // Membership on the hub is what lets them reach the node at all; the code
+      // is what gets them the key.
       await hubFetch(`/v1/groups/${groupId}/members/${username}`, {
         method: 'POST', token, body: {},
       });
 
+      setInviteCode({ username, code: result.code, expires: result.expires_at });
       setInviteUser('');
       loadMembers();
     } catch (err) {
@@ -1421,7 +1536,7 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
     } finally {
       setInviting(false);
     }
-  }, [groupId, token, inviteUser, loadMembers]);
+  }, [groupId, token, inviteUser, loadMembers, transportRef]);
 
   if (loading) return html`<p class="page-message">${t('explore.loading')}</p>`;
 
@@ -1452,6 +1567,15 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
         <form class="invite-form" onSubmit=${doInvite}>
           <h4>${t('members.invite_title')}</h4>
           ${error && html`<p class="error-msg">${error}</p>`}
+          ${inviteCode && html`
+            <div class="success-msg" style="margin-bottom:8px">
+              <p>${t('members.invite_code_ready', { user: inviteCode.username })}</p>
+              <p style="font-family:monospace;font-size:1.4em;letter-spacing:2px;margin:6px 0">
+                ${inviteCode.code}
+              </p>
+              <p>${t('members.invite_code_hint')}</p>
+            </div>
+          `}
           <div style="display:flex;gap:8px">
             <input type="text" placeholder="${t('members.username_placeholder')}"
               value=${inviteUser} onInput=${e => setInviteUser(e.target.value)} required />
@@ -1461,6 +1585,24 @@ function MembersPanel({ groupId, group, token, transportRef, gekRef }) {
           </div>
         </form>
       `}
+      ${isNodeAdmin && html`
+        <form class="invite-form" onSubmit=${doPair}>
+          <h4>${t('members.pair_title')}</h4>
+          <p class="settings-hint">${t('members.pair_hint')}</p>
+          ${pairStatus && html`
+            <p class=${pairStatus === 'paired' ? 'success-msg' : 'error-msg'}>
+              ${pairStatus === 'paired' ? t('members.pair_success') : pairStatus}
+            </p>
+          `}
+          <div style="display:flex;gap:8px">
+            <input type="text" placeholder="XXXX-XXXX" style="font-family:monospace"
+              value=${pairCode} onInput=${e => setPairCode(e.target.value)} required />
+            <button class="admin-btn" type="submit" disabled=${pairing}>
+              ${pairing ? '...' : t('members.pair_btn')}
+            </button>
+          </div>
+        </form>
+      `}
     </div>
   `;
 }
@@ -1969,6 +2111,15 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
   const [currentNodeKey, setCurrentNodeKey] = useState(null);
   const [nodeKeyStatus, setNodeKeyStatus] = useState('');
   const [nodeKeyLoading, setNodeKeyLoading] = useState(false);
+  const [pinCount, setPinCount] = useState(
+    () => (window.MeshBayTransport?.pinnedNodeCount?.() ?? 0));
+
+  // 11.5.8: node identity pins are refused strictly on change, so users need a
+  // deliberate way to accept a legitimate rotation (operator reinstalled a node).
+  const clearPins = useCallback(() => {
+    window.MeshBayTransport?.clearNodePin?.();
+    setPinCount(window.MeshBayTransport?.pinnedNodeCount?.() ?? 0);
+  }, []);
 
   useEffect(() => {
     hubFetch(`/v1/users/${user.username}/pubkeys`, { token: user.token })
@@ -2060,6 +2211,17 @@ function SettingsPage({ user, theme, onThemeChange, groups }) {
       </div>
 
       <div class="settings-section">
+        <h3 class="settings-heading">${t('settings.node_pins')}</h3>
+        <p class="settings-hint">${t('settings.node_pins_hint')}</p>
+        <div class="settings-row">
+          <span class="settings-label">${t('settings.node_pins_count', { n: pinCount })}</span>
+          <button class="btn-secondary" onClick=${clearPins} disabled=${pinCount === 0}>
+            ${t('settings.node_pins_clear')}
+          </button>
+        </div>
+      </div>
+
+      <div class="settings-section">
         <h3 class="settings-heading">${t('settings.appearance')}</h3>
         <div class="settings-row">
           <span class="settings-label">${t('settings.theme')}</span>
@@ -2501,12 +2663,10 @@ function App() {
         const data = await window.MeshBayKeys.loginAndRecover(username, password);
         token = data.accessToken;
         refreshToken = data.refreshToken;
+        // The only thing sign-in produces: the key that opens a node's bundle.
+        // Which identity we use is decided per node, when we get there.
         _bundleKey = data.bundleKey;
         await _storeBundleKey(_bundleKey);
-        if (data.skXB64) {
-          _sessionKeys = { skXB64: data.skXB64, skEdB64: data.skEdB64 };
-          _pendingBundlePush = data.keypairBundleEnc;
-        }
       } else {
         const data = await hubFetch('/v1/users/login', {
           method: 'POST',
@@ -2516,11 +2676,6 @@ function App() {
         refreshToken = data.refresh_token;
       }
       const me = await hubFetch('/v1/users/me', { token });
-      if (_sessionKeys) {
-        const pubkeys = await hubFetch(`/v1/users/${username}/pubkeys`, { token });
-        _sessionKeys.pkXB64 = pubkeys.pk_x25519;
-        _saveSessionKeys();
-      }
       const u = { username, userId: me.user_id, token, refreshToken, role: me.role };
       setUser(u);
       saveAuth(u);
@@ -2533,6 +2688,20 @@ function App() {
     },
   };
 
+  // Group membership is baked into the access token at login and the hub does not
+  // push updates, so someone invited after they signed in carries a token that
+  // says they are in nothing. Refreshing re-reads membership from the database.
+  const refreshAuth = useCallback(async () => {
+    if (!user || !user.refreshToken) return null;
+    const data = await hubFetch('/v1/users/token/refresh', {
+      method: 'POST', body: { refresh_token: user.refreshToken },
+    });
+    const u = { ...user, token: data.access_token };
+    setUser(u);
+    saveAuth(u);
+    return data.access_token;
+  }, [user]);
+
   let page;
   if (route === '/login' || route === '/register') {
     page = route === '/register'
@@ -2557,7 +2726,8 @@ function App() {
     const group = groups.find(g => g.id === groupId);
     page = html`<${GroupPage}
       groupId=${groupId} group=${group} token=${user.token}
-      username=${user.username} userId=${user.userId} />`;
+      username=${user.username} userId=${user.userId}
+      onRefreshAuth=${refreshAuth} />`;
   } else if (route === '/admin') {
     page = (user.role === 'moderator' || user.role === 'admin')
       ? html`<${AdminPage} token=${user.token} />`
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
index 5ebf624..21bf05d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
@@ -230,24 +230,133 @@ function b64encode(bytes) {
   return btoa(String.fromCharCode(...bytes));
 }
 
+// ── Admin operation transcript ───────────────────────────────────────────────
+// Mirrors meshbay_common/adminop.py::admin_transcript(). Both sides build these
+// bytes independently; they are never taken off the wire.
+//
+// Finding H5: the client used to sign 32 raw random bytes chosen by the node — a
+// blind signing oracle. It now reconstructs a domain-separated, length-prefixed
+// transcript naming the operation, subject, node and group, so the UI can show the
+// user what they are authorizing and a signature cannot be reused elsewhere.
+
+const ADMIN_TRANSCRIPT_PREFIX = new TextEncoder().encode('meshbay:admin:v1');
+
+function adminTranscript(op, nodePkB64, groupId, subject, nonceB64, ts) {
+  const enc = new TextEncoder();
+  const fields = [
+    enc.encode(op),
+    enc.encode(nodePkB64),
+    enc.encode(groupId),
+    enc.encode(subject),
+    b64decode(nonceB64),
+    enc.encode(String(ts)),
+  ];
+  let total = ADMIN_TRANSCRIPT_PREFIX.length;
+  for (const f of fields) total += 4 + f.length;
+
+  const out = new Uint8Array(total);
+  out.set(ADMIN_TRANSCRIPT_PREFIX, 0);
+  let off = ADMIN_TRANSCRIPT_PREFIX.length;
+  for (const f of fields) {
+    new DataView(out.buffer).setUint32(off, f.length, false);
+    off += 4;
+    out.set(f, off);
+    off += f.length;
+  }
+  return out;
+}
+
 // ── GEK proof (HMAC-SHA256 for handshake challenge) ─────────────────────────
 
-async function hmacGEK(gekRaw, nonceB64, offerFp, answerFp) {
-  const nonce = b64decode(nonceB64);
-  const data = concatBuffers([
-    nonce,
-    offerFp || new Uint8Array(0),
-    answerFp || new Uint8Array(0),
+// Mirrors meshbay_common/handshake.py. Every field length-prefixed and the role
+// bound in, so a client proof can never be replayed as a node proof and a missing
+// fingerprint cannot silently degrade the proof to nonce-only (L4).
+const HANDSHAKE_PREFIX = new TextEncoder().encode('meshbay:mnp:handshake:v1');
+
+function _lenPrefixed(parts) {
+  let total = 0;
+  for (const p of parts) total += 4 + p.length;
+  const out = new Uint8Array(total);
+  const view = new DataView(out.buffer);
+  let off = 0;
+  for (const p of parts) {
+    view.setUint32(off, p.length, false);
+    off += 4;
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+
+function webrtcBinding(offerFp, answerFp) {
+  if (!offerFp || !offerFp.length || !answerFp || !answerFp.length) {
+    throw new Error('Channel binding unavailable — refusing to handshake');
+  }
+  return _lenPrefixed([offerFp, answerFp]);
+}
+
+function handshakeTranscript(role, groupId, nonceClient, nonceNode, binding) {
+  const enc = new TextEncoder();
+  const body = _lenPrefixed([
+    enc.encode(role), enc.encode(groupId), nonceClient, nonceNode, binding,
   ]);
+  const out = new Uint8Array(HANDSHAKE_PREFIX.length + body.length);
+  out.set(HANDSHAKE_PREFIX, 0);
+  out.set(body, HANDSHAKE_PREFIX.length);
+  return out;
+}
+
+async function handshakeProof(gekRaw, role, groupId, nonceClient, nonceNode, binding) {
+  const transcript = handshakeTranscript(role, groupId, nonceClient, nonceNode, binding);
   const key = await crypto.subtle.importKey(
     'raw', gekRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-  const sig = await crypto.subtle.sign('HMAC', key, data);
-  return b64encode(new Uint8Array(sig));
+  const sig = await crypto.subtle.sign('HMAC', key, transcript);
+  return new Uint8Array(sig);
+}
+
+// ── Join / pairing transcript ───────────────────────────────────────────────
+
+// Mirrors meshbay_common/join.py. Signing both of our public keys together binds
+// the X25519 key to the Ed25519 identity the node pins, so the node can safely
+// wrap the group key for a key that came over the wire instead of one fetched
+// from the hub's directory (H3). nonce_node ties it to this connection.
+const JOIN_PREFIX = new TextEncoder().encode('meshbay:join:v1');
+
+function joinTranscript(nodePkB64, groupId, userId, pkEdB64, pkXB64, nonceNode, ts) {
+  const enc = new TextEncoder();
+  const body = _lenPrefixed([
+    enc.encode(nodePkB64),
+    enc.encode(groupId),
+    enc.encode(userId),
+    enc.encode(pkEdB64),
+    enc.encode(pkXB64),
+    nonceNode,
+    enc.encode(String(ts)),
+  ]);
+  const out = new Uint8Array(JOIN_PREFIX.length + body.length);
+  out.set(JOIN_PREFIX, 0);
+  out.set(body, JOIN_PREFIX.length);
+  return out;
+}
+
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+
+/** Verify the node's Ed25519 signature over the handshake transcript (C3). */
+async function verifyNodeSignature(nodePkB64, sigB64, transcript) {
+  const raw = b64decode(nodePkB64);
+  const key = await crypto.subtle.importKey('raw', raw, { name: 'Ed25519' }, false, ['verify']);
+  return crypto.subtle.verify('Ed25519', key, b64decode(sigB64), transcript);
 }
 
 // Export for use in app.js
 window.MeshBayCrypto = {
   importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile,
   generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode,
-  hmacGEK,
+  adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding,
+  joinTranscript, verifyNodeSignature, constantTimeEqual,
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
index 3450735..f0c5cef 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/i18n.js
@@ -38,7 +38,7 @@ const en = {
   'register.title': 'Register',
   'register.username': 'Username',
   'register.email': 'Email',
-  'register.password': 'Password (min 8 chars)',
+  'register.password': 'Passphrase (min 12 chars)',
   'register.confirm': 'Confirm password',
   'register.submit': 'Register',
   'register.loading': 'Creating account...',
@@ -48,7 +48,11 @@ const en = {
   'register.success_msg': 'You can now log in with your credentials.',
   'register.go_login': 'Go to login',
   'register.err_mismatch': 'Passwords do not match',
-  'register.err_min_len': 'Password must be at least 8 characters',
+  'register.err_min_len': 'Use at least {n} characters',
+  'register.err_too_weak': 'Too easy to guess. Your passphrase is what protects '
+    + 'your keys where they are stored — a few unrelated words work well.',
+  'register.strength': 'Strength: about {bits} bits. This protects the copy of '
+    + 'your keys kept on the nodes you join, so it is worth getting right.',
 
   // Home
   'home.welcome': 'Welcome to MeshBay',
@@ -120,6 +124,10 @@ const en = {
   'settings.coming_soon': 'Coming soon.',
   'settings.profile': 'Profile',
   'settings.username': 'Username',
+  'settings.node_pins': 'Node identities',
+  'settings.node_pins_hint': "Each node's identity key is remembered the first time you connect. If it changes, the connection is refused — that is expected only when an operator reinstalls a node. Verify with them before clearing.",
+  'settings.node_pins_count': '{n} pinned',
+  'settings.node_pins_clear': 'Clear pinned identities',
   'settings.appearance': 'Appearance',
   'settings.theme': 'Theme',
   'settings.theme_light': 'Light',
@@ -236,6 +244,22 @@ const en = {
   'members.invite_title': 'Invite member',
   'members.username_placeholder': 'Username',
   'members.invite_btn': 'Invite',
+  'members.pair_title': 'Pair this browser with your node',
+  'members.pair_hint': 'Your node only accepts operator actions — invites, file '
+    + 'deletion — from a browser it has been paired with. Run '
+    + '`meshbay-node operator pair` on the node and type the code here. The code '
+    + 'never passes through the hub, which is what stops the hub from claiming to '
+    + 'be you.',
+  'members.pair_btn': 'Pair',
+  'members.pair_success': 'This browser is now paired with the node.',
+  'members.invite_code_ready': 'Invitation code for {user} — send it to them the way '
+    + 'you normally talk. It works once, and it never passes through the hub.',
+  'members.invite_code_hint': 'They enter it the first time they open this group. '
+    + 'You do not need to be online then.',
+  'group.join_code_title': 'This node needs to recognise you',
+  'group.join_code_hint': 'Ask whoever invited you for the one-time code, and enter '
+    + 'it here. After that this browser is recognised and you will not be asked again.',
+  'group.join_code_btn': 'Join',
 
   'notif.title': 'Notifications',
   'notif.empty': 'No notifications',
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index ff3da33..a27522d 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -67,11 +67,35 @@ async function generateKeypairs() {
 
 // ── Password → AES key ────────────────────────────────────────────────────────
 
-/**
- * Derive an AES-256 key from password + username using PBKDF2-SHA512.
- * Used for encrypting the keypair bundle.
- */
-async function deriveEncryptionKey(password, username) {
+// Argon2id parameters for the keypair bundle.
+//
+// This is the one KDF in the browser that guards something an adversary can take
+// away and attack at leisure: the bundle is stored on every node whose group its
+// owner joins (finding C4). PBKDF2 was the wrong tool — it is compute-only, which
+// is exactly what a GPU is good at, so 600k iterations bought far less than the
+// wall-clock time suggested.
+//
+// 128 MB / t=3 / p=1 measured at ~640 ms through this WASM build on a desktop.
+// Memory is the lever, not time: each guess must hold 128 MB, so a 24 GB card
+// fits ~187 in parallel and its bandwidth caps it near 2k guesses/s, against no
+// ceiling at all for PBKDF2. 256 MB would double that again at ~1.3 s, which is
+// too much to ask of a phone for something paid at every sign-in.
+const ARGON2_MEM_KIB = 131072;   // 128 MB
+const ARGON2_TIME    = 3;
+const ARGON2_LANES   = 1;
+
+// Bundles written before this carry no marker and are read with the old KDF.
+// They are re-encrypted the first time their owner signs in (see upgradeBundle).
+const BUNDLE_V2_MAGIC = 'MBK2';
+
+function _argon2() {
+  const a = (typeof window !== 'undefined' && window.argon2) || globalThis.argon2;
+  if (!a) throw new Error('Argon2 unavailable — vendor/argon2.min.js did not load');
+  return a;
+}
+
+/** Legacy: PBKDF2-SHA512. Kept to read bundles written before the change. */
+async function deriveEncryptionKeyV1(password, username) {
   const enc   = new TextEncoder();
   const km    = await crypto.subtle.importKey(
     'raw', enc.encode(password), 'PBKDF2', false, ['deriveKey']);
@@ -86,6 +110,27 @@ async function deriveEncryptionKey(password, username) {
   );
 }
 
+/**
+ * Derive the bundle key with Argon2id.
+ *
+ * The salt stays deterministic and domain-separated per user, as before: it is
+ * what lets the key be derived once at sign-in and kept, instead of holding the
+ * passphrase in memory to re-derive it whenever a bundle turns up. It is unique
+ * per account, so it does what a salt is for — no shared precomputation.
+ */
+async function deriveEncryptionKey(password, username) {
+  const enc  = new TextEncoder();
+  const salt = new Uint8Array(await crypto.subtle.digest(
+    'SHA-256', enc.encode(`meshbay:bundle:v2:${username}`))).slice(0, 16);
+  const out = await _argon2().hash({
+    pass: password, salt,
+    time: ARGON2_TIME, mem: ARGON2_MEM_KIB, parallelism: ARGON2_LANES,
+    hashLen: 32, type: _argon2().ArgonType.Argon2id,
+  });
+  return crypto.subtle.importKey(
+    'raw', out.hash, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+}
+
 // ── Bundle encryption ─────────────────────────────────────────────────────────
 
 /**
@@ -94,29 +139,42 @@ async function deriveEncryptionKey(password, username) {
  */
 async function encryptBundle(skEdRaw, skXRaw, password, username) {
   const aesKey = await deriveEncryptionKey(password, username);
+  return encryptBundleWithKey(skEdRaw, skXRaw, aesKey);
+}
+
+/** Same, when the key was already derived at sign-in. Always writes v2. */
+async function encryptBundleWithKey(skEdRaw, skXRaw, aesKey) {
   const nonce  = crypto.getRandomValues(new Uint8Array(12));
   const data   = new TextEncoder().encode(JSON.stringify({
     skEd: btoa(String.fromCharCode(...new Uint8Array(skEdRaw))),
     skX:  btoa(String.fromCharCode(...new Uint8Array(skXRaw))),
   }));
   const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce }, aesKey, data);
-  // Return base64(nonce || ciphertext)
-  const out = new Uint8Array(nonce.length + ct.byteLength);
-  out.set(nonce);
-  out.set(new Uint8Array(ct), nonce.length);
+  // base64( "MBK2" || nonce || ciphertext ). The marker is what tells a reader
+  // which KDF produced the key, so old bundles stay readable and new ones are
+  // never fed to the old derivation.
+  const magic = new TextEncoder().encode(BUNDLE_V2_MAGIC);
+  const out = new Uint8Array(magic.length + nonce.length + ct.byteLength);
+  out.set(magic);
+  out.set(nonce, magic.length);
+  out.set(new Uint8Array(ct), magic.length + nonce.length);
   return btoa(String.fromCharCode(...out));
 }
 
+function bundleVersion(bundleB64) {
+  try {
+    return atob(bundleB64).startsWith(BUNDLE_V2_MAGIC) ? 2 : 1;
+  } catch { return 1; }
+}
+
 /**
  * Decrypt a keypair bundle. Throws if password is wrong.
  */
 async function decryptBundle(bundleB64, password, username) {
-  const aesKey = await deriveEncryptionKey(password, username);
-  const raw    = Uint8Array.from(atob(bundleB64), c => c.charCodeAt(0));
-  const nonce  = raw.slice(0, 12);
-  const ct     = raw.slice(12);
-  const plain  = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ct);
-  return JSON.parse(new TextDecoder().decode(plain));
+  const key = bundleVersion(bundleB64) === 2
+    ? await deriveEncryptionKey(password, username)
+    : await deriveEncryptionKeyV1(password, username);
+  return decryptBundleWithKey(bundleB64, key);
 }
 
 // ── Registration ──────────────────────────────────────────────────────────────
@@ -131,45 +189,62 @@ async function decryptBundle(bundleB64, password, username) {
  * Returns the raw private keys for immediate use after registration.
  */
 async function registerUser(username, email, password) {
-  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
-
-  const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']);
-  const pkXCrypto  = await crypto.subtle.importKey('spki', pkXRaw,  'X25519',  true, []);
-  const pkEdBytes  = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto));
-  const pkXBytes   = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
-
-  const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username);
+  // No keypair here any more. Identity keys are per node: one is generated the
+  // first time this account joins a given node, encrypted under the passphrase,
+  // and left with that node. So an operator who cracks what sits on their own
+  // disk holds a key that is worthless anywhere else — and on their own node,
+  // one that unlocks nothing they did not already have.
+  //
+  // It also means the hub stores no user key to publish, which is what H3 read.
   const authKey = await deriveAuthKey(password, username);
 
   const resp = await fetch(`${HUB}/v1/users/register`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({
-      username,
-      email,
-      auth_key: authKey,
-      pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)),
-      pk_user_x25519:  btoa(String.fromCharCode(...pkXBytes)),
-    }),
+    body: JSON.stringify({ username, email, auth_key: authKey }),
   });
 
   if (!resp.ok) throw new Error(`Registration failed: ${await resp.text()}`);
+  return { registered: true };
+}
 
-  // Store encrypted bundle locally — will be backed up to node on first group connect
-  try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {}
-
-  return { skEdRaw, skXRaw, pkEdBytes, pkXBytes, keypairBundleEnc: encBundle };
+/**
+ * A fresh identity for one node, encrypted under the passphrase-derived key.
+ *
+ * Returns { skEdB64, skXB64, pkXB64, bundleEnc } — the bundle goes to that node
+ * and nowhere else, and is what any other browser fetches to become the same
+ * person there.
+ */
+async function generateNodeIdentity(bundleKey) {
+  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
+  const b64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
+  const pkXCrypto = await crypto.subtle.importKey('spki', pkXRaw, { name: 'X25519' }, true, []);
+  const pkXBytes = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
+  return {
+    skEdB64: b64(skEdRaw),
+    skXB64: b64(skXRaw),
+    pkXB64: b64(pkXBytes),
+    bundleEnc: await encryptBundleWithKey(skEdRaw, skXRaw, bundleKey.v2 || bundleKey),
+  };
 }
 
 /**
  * Decrypt a keypair bundle using a pre-derived AES-256 CryptoKey.
  * Used when the bundle is fetched from the node (bundleKey was derived at login).
  */
-async function decryptBundleWithKey(bundleB64, aesKey) {
+async function decryptBundleWithKey(bundleB64, aesKeyOrPair) {
+  const v2  = bundleVersion(bundleB64) === 2;
+  // Callers derive both keys at sign-in and pass the pair, because which one a
+  // bundle needs is only known once it has been read — and the passphrase is
+  // deliberately not kept around to derive the other one later.
+  const key = (aesKeyOrPair && aesKeyOrPair.v2)
+    ? (v2 ? aesKeyOrPair.v2 : aesKeyOrPair.v1)
+    : aesKeyOrPair;
   const raw   = Uint8Array.from(atob(bundleB64), c => c.charCodeAt(0));
-  const nonce = raw.slice(0, 12);
-  const ct    = raw.slice(12);
-  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, aesKey, ct);
+  const off   = v2 ? BUNDLE_V2_MAGIC.length : 0;
+  const nonce = raw.slice(off, off + 12);
+  const ct    = raw.slice(off + 12);
+  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce }, key, ct);
   return JSON.parse(new TextDecoder().decode(plain));
 }
 
@@ -195,67 +270,34 @@ async function loginAndRecover(username, password) {
   const result = {
     accessToken:  data.access_token,
     refreshToken: data.refresh_token,
-    bundleKey:    await deriveEncryptionKey(password, username),
+    // Both, so a bundle written before the KDF changed can still be opened —
+    // and re-written with the new one on the next backup.
+    bundleKey: {
+      v2: await deriveEncryptionKey(password, username),
+      v1: await deriveEncryptionKeyV1(password, username),
+    },
   };
 
-  // localStorage bundle = new registration, not yet pushed to node
-  const bundleEnc = (typeof localStorage !== 'undefined'
-    && localStorage.getItem(`meshbay_kp_${username}`)) || null;
-
-  if (bundleEnc) {
-    const keys = await decryptBundle(bundleEnc, password, username);
-    result.skEdB64 = keys.skEd;
-    result.skXB64  = keys.skX;
-    result.keypairBundleEnc = bundleEnc;
-  }
-
+  // Nothing else to recover at sign-in. Identity keys belong to a node, so they
+  // are fetched from the node being connected to (or generated there on a first
+  // join) — see transport.js. All that is needed here is the key that opens them.
   return result;
 }
 
-async function regenerateKeys(token, username, password) {
-  const { skEdRaw, pkEdRaw, skXRaw, pkXRaw } = await generateKeypairs();
-
-  const pkEdCrypto = await crypto.subtle.importKey('spki', pkEdRaw, 'Ed25519', true, ['verify']);
-  const pkXCrypto  = await crypto.subtle.importKey('spki', pkXRaw,  'X25519',  true, []);
-  const pkEdBytes  = new Uint8Array(await crypto.subtle.exportKey('raw', pkEdCrypto));
-  const pkXBytes   = new Uint8Array(await crypto.subtle.exportKey('raw', pkXCrypto));
-
-  const resp = await fetch(`${HUB}/v1/users/me/keys`, {
-    method: 'PUT',
-    headers: {
-      'Content-Type': 'application/json',
-      'Authorization': `Bearer ${token}`,
-    },
-    body: JSON.stringify({
-      pk_user_ed25519: btoa(String.fromCharCode(...pkEdBytes)),
-      pk_user_x25519:  btoa(String.fromCharCode(...pkXBytes)),
-    }),
-  });
-
-  if (!resp.ok) throw new Error(`Key rotation failed: ${await resp.text()}`);
-
-  const encBundle = await encryptBundle(skEdRaw, skXRaw, password, username);
-  try { localStorage.setItem(`meshbay_kp_${username}`, encBundle); } catch {}
-
-  return {
-    skEdB64: btoa(String.fromCharCode(...new Uint8Array(skEdRaw))),
-    skXB64:  btoa(String.fromCharCode(...new Uint8Array(skXRaw))),
-    pkEdB64: btoa(String.fromCharCode(...pkEdBytes)),
-    pkXB64:  btoa(String.fromCharCode(...pkXBytes)),
-    keypairBundleEnc: encBundle,
-  };
-}
+// regenerateKeys() removed. Rotating an identity is now per node: the operator
+// runs `meshbay-node member unpin <user>` and issues a fresh code. A hub call
+// that silently changed what every node believed about someone was the wrong
+// shape for this.
 
-async function signChallenge(skEdPkcs8B64, challengeB64) {
+async function signBytes(skEdPkcs8B64, message) {
   const skRaw = Uint8Array.from(atob(skEdPkcs8B64), c => c.charCodeAt(0));
   const sk = await crypto.subtle.importKey(
     'pkcs8', skRaw, { name: 'Ed25519' }, false, ['sign']);
-  const challenge = Uint8Array.from(atob(challengeB64), c => c.charCodeAt(0));
-  const sig = await crypto.subtle.sign('Ed25519', sk, challenge);
+  const sig = await crypto.subtle.sign('Ed25519', sk, message);
   return btoa(String.fromCharCode(...new Uint8Array(sig)));
 }
 
 window.MeshBayKeys = {
-  registerUser, loginAndRecover, regenerateKeys, generateKeypairs, signChallenge,
-  deriveAuthKey, decryptBundleWithKey,
+  registerUser, loginAndRecover, generateNodeIdentity, generateKeypairs, signBytes,
+  deriveAuthKey, decryptBundleWithKey, encryptBundleWithKey, bundleVersion,
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/style.css b/packages/meshbay-hub/src/meshbay_hub/static/style.css
index e430201..81c4130 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/style.css
+++ b/packages/meshbay-hub/src/meshbay_hub/static/style.css
@@ -316,6 +316,21 @@ button:disabled { opacity: 0.5; cursor: not-allowed; }
   font-size: 0.85em;
 }
 
+.success-msg {
+  background: #16a34a20;
+  color: var(--success);
+  border: 1px solid var(--success);
+  border-radius: 6px;
+  padding: 8px 12px;
+  font-size: 0.85em;
+}
+
+.settings-hint {
+  font-size: 0.85em;
+  color: var(--text-dim);
+  margin-bottom: 8px;
+}
+
 /* ── Group cards (9.7 prep) ───────────────────────────────────────────────── */
 
 .group-grid {
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index ca9c60e..0a8796e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -26,6 +26,31 @@ async function _pkFromSk(skPkcs8B64) {
   return pad ? b64 + '='.repeat(4 - pad) : b64;
 }
 
+async function _pkEdFromSk(skPkcs8B64) {
+  const raw = Uint8Array.from(atob(skPkcs8B64), c => c.charCodeAt(0));
+  const sk = await crypto.subtle.importKey('pkcs8', raw, { name: 'Ed25519' }, true, ['sign']);
+  const jwk = await crypto.subtle.exportKey('jwk', sk);
+  const b64 = jwk.x.replace(/-/g, '+').replace(/_/g, '/');
+  const pad = b64.length % 4;
+  return pad ? b64 + '='.repeat(4 - pad) : b64;
+}
+
+const JOIN_REFUSALS = {
+  code_required: 'This node does not know this browser yet. Ask the node operator '
+    + 'for a pairing code (meshbay-node operator pair).',
+  code_invalid: 'That pairing code is not valid — it may be mistyped, expired, '
+    + 'already used, or issued for a different account.',
+  key_changed: 'This account is already paired with a different key on this node. '
+    + 'If you reset your keys, the operator must unpin you before pairing again.',
+  not_authorized_for_group: 'The node does not list you as a member of this group. '
+    + 'Being a member on the hub is not enough — ask the operator for an invite.',
+  no_gek: 'This group has no key yet. The node operator must run '
+    + '`meshbay-node gek-init` for it.',
+  signature_invalid: 'The node rejected the signature over your keys.',
+  stale_request: 'Your clock is too far from the node\'s — check the system time.',
+  group_mismatch: 'The node refused a request naming a different group.',
+};
+
 class MeshBayTransport {
   constructor(hubUrl, accessToken) {
     this._hubUrl = hubUrl;
@@ -53,11 +78,19 @@ class MeshBayTransport {
 
   get sessionKeys() { return this._sessionKeys; }
 
-  async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username) {
+  /** Set on a first join: the identity created for this node, still to be left with it. */
+  get newNodeBundle() { return this._newNodeBundle || null; }
+  set newNodeBundle(v) { this._newNodeBundle = v; }
+
+  async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username,
+                userId, joinCode) {
     this._gekRaw = gekRaw || null;
     this._sessionKeys = sessionKeys || null;
     this._bundleKey = bundleKey || null;
     this._username = username || null;
+    this._userId = userId || null;
+    this._newNodeBundle = null;
+    this._joinError = null;
     this._pc = new RTCPeerConnection({
       iceServers: [{ urls: 'stun:stun.l.google.com:19302' }],
     });
@@ -129,11 +162,16 @@ class MeshBayTransport {
 
     await channelReady;
 
+    // The client nonce is what makes the NODE's proof fresh (C3) — without it a
+    // recorded handshake_ack could be replayed by an impersonating peer.
+    this._nonceClient = crypto.getRandomValues(new Uint8Array(32));
+
     const reply = await this._sendAndWait({
       type: 'handshake',
       v: '0.1',
       token: jwtToken,
       group_id: groupId || '',
+      nonce: window.MeshBayCrypto.b64encode(this._nonceClient),
     });
 
     if (reply.type === 'handshake_challenge') {
@@ -141,7 +179,23 @@ class MeshBayTransport {
         throw new Error('Node requires GEK proof but no crypto available');
       }
 
-      // Recover session keys from node if not available locally (P2P keypair bundle)
+      // Recorded the moment the challenge arrives, because everything below may
+      // need them — joining, in particular, happens before the proof and signs a
+      // transcript over both. Reading them further down, next to the proof that
+      // also uses them, meant join_request ran with neither.
+      //
+      // nonce_node ties a join to this connection, so one cannot be lifted onto
+      // another. node_pk is announced here because a first-time member has no
+      // GEK and so cannot complete the handshake that would prove it; it is
+      // unverified at this point and checked against the ack below.
+      this._nonceNode = window.MeshBayCrypto.b64decode(reply.nonce);
+      this.nodePk = reply.node_pk || null;
+
+      // Our identity for THIS node: fetched from it, or created if this is a
+      // first join. Keys are per node, so there is nothing to carry between
+      // them — and an operator who cracks the copy on their own disk gets a key
+      // that opens nothing anywhere else.
+      let fresh = false;
       if (!this._sessionKeys && this._bundleKey && window.MeshBayKeys) {
         const kpResp = await this._sendAndWait({
           type: 'keypair_bundle_fetch', v: '0.1',
@@ -151,11 +205,22 @@ class MeshBayTransport {
             kpResp.bundle_enc, this._bundleKey);
           const pkXB64 = await _pkFromSk(keys.skX);
           this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 };
+        } else {
+          // This node has never seen us. Generate the identity we will use here
+          // and nowhere else; it is stored on this node once the join succeeds,
+          // which is what lets another browser become the same person here.
+          const id = await window.MeshBayKeys.generateNodeIdentity(this._bundleKey);
+          this._sessionKeys = {
+            skEdB64: id.skEdB64, skXB64: id.skXB64, pkXB64: id.pkXB64,
+          };
+          this._newNodeBundle = id.bundleEnc;
+          fresh = true;
         }
       }
 
-      // Fetch wrapped GEK bundle from node (P2P only — hub never touches crypto)
-      if (!gekRaw && this._sessionKeys) {
+      // An identity this node already knows still needs its group key, which the
+      // node wraps on every connection.
+      if (!gekRaw && this._sessionKeys && !fresh) {
         const bundleResp = await this._sendAndWait({
           type: 'gek_bundle_fetch', v: '0.1',
         });
@@ -166,52 +231,159 @@ class MeshBayTransport {
             gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw, myPkX);
             this._gekRaw = gekRaw;
           } catch (e) {
-            console.warn('[MeshBay] GEK unwrap failed with local keys, trying node keypair bundle');
-            if (this._bundleKey && window.MeshBayKeys) {
-              const kpResp = await this._sendAndWait({
-                type: 'keypair_bundle_fetch', v: '0.1',
-              });
-              if (kpResp.type === 'keypair_bundle_resp' && kpResp.found) {
-                const keys = await window.MeshBayKeys.decryptBundleWithKey(
-                  kpResp.bundle_enc, this._bundleKey);
-                const pkXB64 = await _pkFromSk(keys.skX);
-                this._sessionKeys = { skXB64: keys.skX, skEdB64: keys.skEd, pkXB64 };
-                const skXRaw2 = Uint8Array.from(atob(keys.skX), c => c.charCodeAt(0));
-                const myPkX2 = Uint8Array.from(atob(pkXB64), c => c.charCodeAt(0));
-                gekRaw = await window.MeshBayCrypto.unwrapGEK(bundleResp, skXRaw2, myPkX2);
-                this._gekRaw = gekRaw;
-              }
-            }
+            console.warn('[MeshBay] stored GEK bundle did not open; joining instead');
           }
         }
       }
 
-      if (!gekRaw) {
-        throw new Error('Node requires GEK proof but no GEK available');
+      // No stored bundle: ask the node to recognise us and wrap the key itself.
+      // This is the normal path for anyone who joined after the invite redesign —
+      // no bundle is pre-stored for members any more. A code is needed only the
+      // first time this node sees this account.
+      if (!gekRaw && this._sessionKeys && userId) {
+        try {
+          gekRaw = await this.joinGroup(userId, groupId, joinCode);
+        } catch (e) {
+          // The UI turns this into "ask the operator for an invite code".
+          this._joinError = e;
+        }
       }
 
-      let proof = '';
-      if (gekRaw) {
-        const offerFp = _extractDtlsFingerprint(this._pc.localDescription.sdp);
-        const answerFp = _extractDtlsFingerprint(this._rawAnswerSdp);
-        proof = await window.MeshBayCrypto.hmacGEK(gekRaw, reply.nonce, offerFp, answerFp);
+      if (!gekRaw && !this._sessionKeys) {
+        // No identity keys in this browser and none recoverable from the node:
+        // the keypair bundle is created where you register and only reaches a
+        // node after a first successful connection, so a brand-new member opening
+        // a second browser has nothing to sign or unwrap with. Say that, rather
+        // than blaming the GEK — a code prompt here would be useless, since a
+        // code proves who you are and we have no key to bind to.
+        const err = new Error(
+          'This browser does not hold your keys. Open the group once from the '
+          + 'browser where you registered — after that this one can recover them.');
+        err.reason = 'no_keys';
+        throw err;
+      }
+
+      if (!gekRaw) {
+        throw this._joinError
+          || new Error('Node requires GEK proof but no GEK available');
       }
+
+      const C = window.MeshBayCrypto;
+      // Node's answer SDP carries ITS fingerprint; our offer carries ours. Throws
+      // if either is missing rather than proceeding with an unbound proof (L4).
+      const binding = C.webrtcBinding(
+        _extractDtlsFingerprint(this._pc.localDescription.sdp),
+        _extractDtlsFingerprint(this._rawAnswerSdp),
+      );
+      const nonceNode = this._nonceNode;   // captured when the challenge arrived
+      const gid = groupId || '';
+
+      const proof = await C.handshakeProof(
+        gekRaw, 'client', gid, this._nonceClient, nonceNode, binding);
+
       const ack = await this._sendAndWait({
         type: 'handshake_response',
         v: '0.1',
-        proof,
+        proof: C.b64encode(proof),
       });
       if (ack.type !== 'handshake_ack') {
         throw new Error('GEK proof rejected: ' + (ack.detail || JSON.stringify(ack)));
       }
+
+      // Authenticate the NODE before trusting anything it says (C3). Until this
+      // ran, node_pk was decorative: a peer that had hijacked signaling could
+      // accept our proof, ignore it, and serve a forged index, chat history and
+      // is_node_admin flag.
+      const expected = await C.handshakeProof(
+        gekRaw, 'node', gid, this._nonceClient, nonceNode, binding);
+      if (!ack.proof || !C.constantTimeEqual(C.b64decode(ack.proof), expected)) {
+        throw new Error('Node failed to prove GEK possession — refusing connection');
+      }
+      const transcript = C.handshakeTranscript(
+        'node', gid, this._nonceClient, nonceNode, binding);
+      if (!ack.node_pk || !ack.sig
+          || !await C.verifyNodeSignature(ack.node_pk, ack.sig, transcript)) {
+        throw new Error('Node signature invalid — refusing connection');
+      }
+      // Trust On First Use (11.5.8). With C6 closed, a substituted node already
+      // fails the GEK proof — this covers the case where an attacker HAS the GEK
+      // (an ex-member, or a leaked key) and swaps the node underneath.
+      // Strict refusal: a warning users can click through is decorative.
+      // The key announced in the challenge must be the one that just proved
+      // itself. A peer that changed identity mid-handshake is not one to trust
+      // with anything, including a join we may already have signed for it.
+      if (this.nodePk && this.nodePk !== ack.node_pk) {
+        throw new Error('Node identity changed during the handshake — refusing');
+      }
+      _checkNodePin(nodeId, ack.node_pk);
+      this.nodePk = ack.node_pk;
+
       return ack;
     }
 
-    if (reply.type !== 'handshake_ack') {
-      throw new Error('MNP handshake rejected: ' + (reply.detail || JSON.stringify(reply)));
+    // A node that answers a handshake with anything other than a challenge is not
+    // running the mutual protocol. Accepting a bare handshake_ack here would let a
+    // peer skip proving GEK possession entirely (C3/C6).
+    const rejected = new Error(
+      'MNP handshake rejected: ' + (reply.detail || `unexpected ${reply.type}`));
+    // `not_a_member` usually means our token predates being added to the group;
+    // the caller refreshes it and tries again rather than showing that to someone
+    // who was invited thirty seconds ago.
+    rejected.reason = reply.code || '';
+    throw rejected;
+  }
+
+  /**
+   * Pair this browser with the node using a one-time code (M3, and the same
+   * substitution as H3).
+   *
+   * The node has no way to know which key belongs to its operator unless someone
+   * tells it locally — asking the hub would let the hub name itself node
+   * administrator. The code comes from `meshbay-node operator pair`, over SSH, and
+   * the hub never sees it.
+   */
+  async pairOperator(userId, code) {
+    if (!this._connected) throw new Error('Not connected to the node');
+    if (!userId) throw new Error('Missing user id');
+    if (!this._sessionKeys || !this._sessionKeys.skEdB64 || !this._sessionKeys.skXB64) {
+      throw new Error('Identity keys unavailable in this browser — sign in again');
     }
+    if (!this._nonceNode || !this.nodePk) {
+      throw new Error('Handshake incomplete — reconnect and retry');
+    }
+
+    const C = window.MeshBayCrypto;
+    // Both public keys are derived from OUR OWN secret keys, never read back from
+    // the hub: signing a public key the directory handed us would reintroduce the
+    // substitution this whole mechanism exists to close.
+    const pkEdB64 = await _pkEdFromSk(this._sessionKeys.skEdB64);
+    const pkXB64 = await _pkFromSk(this._sessionKeys.skXB64);
+    const ts = Math.floor(Date.now() / 1000);
+
+    // group_id is empty: operator authority is node-wide, not per group.
+    const transcript = C.joinTranscript(
+      this.nodePk, '', userId, pkEdB64, pkXB64, this._nonceNode, ts);
+    const sig = await window.MeshBayKeys.signBytes(this._sessionKeys.skEdB64, transcript);
 
-    return reply;
+    const resp = await this._sendAndWait({
+      type: 'join_request',
+      v: '0.1',
+      group_id: '',
+      pk_ed25519: pkEdB64,
+      pk_x25519: pkXB64,
+      code: code || '',
+      ts,
+      sig,
+    });
+
+    if (resp.type === 'error') throw new Error(resp.detail || 'Pairing refused');
+    if (resp.type !== 'join_result' || !resp.ok) {
+      const reason = resp.reason || 'unknown';
+      const err = new Error(JOIN_REFUSALS[reason] || `Pairing refused: ${reason}`);
+      err.reason = reason;
+      throw err;
+    }
+    return resp;
   }
 
   async fetchIndex() {
@@ -266,6 +438,39 @@ class MeshBayTransport {
     return msg;
   }
 
+  /**
+   * Authorize a privileged node operation with the user's Ed25519 identity key.
+   *
+   * The client rebuilds the signed transcript from the challenge fields and refuses
+   * to sign unless the operation and subject match what the user actually asked for.
+   * Previously the node sent 32 opaque random bytes and the client signed them
+   * blind, which let any peer obtain a signature over content of its choosing
+   * (finding H5).
+   */
+  async _authorizeAdminOp(challenge, expectedOp, expectedSubject, signFn) {
+    if (challenge.op !== expectedOp || challenge.subject !== expectedSubject) {
+      throw new Error(
+        `Refusing to sign: node asked to authorize "${challenge.op}" on ` +
+        `"${challenge.subject}", but the requested action was "${expectedOp}" ` +
+        `on "${expectedSubject}"`);
+    }
+    if (!signFn) throw new Error('Admin challenge received but no signing key available');
+
+    const transcript = window.MeshBayCrypto.adminTranscript(
+      challenge.op, challenge.node_pk, challenge.group_id,
+      challenge.subject, challenge.nonce, challenge.ts);
+
+    const signature = await signFn(transcript);
+    const ack = await this._sendAndWait({
+      type: 'admin_response',
+      v: '0.1',
+      op_id: challenge.op_id,
+      signature,
+    });
+    if (ack.type === 'error') throw new Error(ack.detail);
+    return ack;
+  }
+
   async deleteFile(fileId, signFn) {
     const msg = await this._sendAndWait({
       type: 'file_delete',
@@ -274,16 +479,7 @@ class MeshBayTransport {
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      if (!signFn) throw new Error('Admin challenge received but no signing key available');
-      const signature = await signFn(msg.challenge);
-      const ack = await this._sendAndWait({
-        type: 'admin_response',
-        v: '0.1',
-        file_id: fileId,
-        signature,
-      });
-      if (ack.type === 'error') throw new Error(ack.detail);
-      return ack;
+      return this._authorizeAdminOp(msg, 'file_delete', fileId, signFn);
     }
     return msg;
   }
@@ -304,15 +500,95 @@ class MeshBayTransport {
     return msg;
   }
 
-  async storeGekBundle(userId, groupId, bundle) {
+  /**
+   * Ask the node for a one-time pairing code admitting `userId` to this group.
+   *
+   * This replaces wrapping the group key in the browser. We no longer fetch the
+   * invitee's public key from the hub, so the hub can no longer answer with its own
+   * and be handed the group key (H3). The node wraps the key later, itself, for a
+   * key the invitee proves possession of.
+   *
+   * Returns {code, expires_at} — the code is displayed once and passed to the
+   * invitee out of band.
+   */
+  async createInvite(userId, groupId, username, signFn) {
     const msg = await this._sendAndWait({
-      type: 'gek_bundle_store',
+      type: 'invite_create',
       v: '0.1',
       user_id: userId,
       group_id: groupId,
-      pk_eph_b64: bundle.pk_eph_b64,
-      nonce_b64: bundle.nonce_b64,
-      wrapped_b64: bundle.wrapped_b64,
+      username: username || '',
+    });
+    if (msg.type === 'error') throw new Error(msg.detail);
+    if (msg.type === 'admin_challenge') {
+      return this._authorizeAdminOp(msg, 'invite_create', userId, signFn);
+    }
+    return msg;
+  }
+
+  /**
+   * Ask the node to recognise us and hand over the group key.
+   *
+   * Sent when we hold no GEK for a group. `code` is needed only the first time
+   * this node sees this account (and not at all in an open-join group).
+   */
+  async joinGroup(userId, groupId, code) {
+    if (!this._sessionKeys || !this._sessionKeys.skEdB64 || !this._sessionKeys.skXB64) {
+      throw new Error('Identity keys unavailable in this browser — sign in again');
+    }
+    if (!this._nonceNode || !this.nodePk) {
+      throw new Error('Handshake incomplete — reconnect and retry');
+    }
+
+    const C = window.MeshBayCrypto;
+    const pkEdB64 = await _pkEdFromSk(this._sessionKeys.skEdB64);
+    const pkXB64 = await _pkFromSk(this._sessionKeys.skXB64);
+    const ts = Math.floor(Date.now() / 1000);
+
+    const transcript = C.joinTranscript(
+      this.nodePk, groupId || '', userId, pkEdB64, pkXB64, this._nonceNode, ts);
+    const sig = await window.MeshBayKeys.signBytes(this._sessionKeys.skEdB64, transcript);
+
+    const resp = await this._sendAndWait({
+      type: 'join_request',
+      v: '0.1',
+      group_id: groupId || '',
+      pk_ed25519: pkEdB64,
+      pk_x25519: pkXB64,
+      code: code || '',
+      ts,
+      sig,
+    });
+
+    if (resp.type === 'error') throw new Error(resp.detail || 'Join refused');
+    if ((resp.type !== 'join_result' || !resp.ok) || !resp.gek) {
+      const reason = resp.reason || 'unknown';
+      const err = new Error(JOIN_REFUSALS[reason] || `Join refused: ${reason}`);
+      // The UI reacts to `code_required` by asking for one; everything else is
+      // shown as-is.
+      err.reason = reason;
+      throw err;
+    }
+
+    // Unwrap with our own secret key — the node wrapped for the public key we
+    // just proved we hold, so nobody else can open this.
+    const skXRaw = Uint8Array.from(atob(this._sessionKeys.skXB64), c => c.charCodeAt(0));
+    const myPkX = Uint8Array.from(atob(pkXB64), c => c.charCodeAt(0));
+    const gekRaw = await C.unwrapGEK(resp, skXRaw, myPkX);
+    this._gekRaw = gekRaw;
+    return gekRaw;
+  }
+
+  /**
+   * Withdraw our key backup from this node.
+   *
+   * The counterpart of storeKeypairBundle: turning the setting off has to remove
+   * what is already stored, not merely stop adding to it — otherwise the blob
+   * stays on every node the account has ever joined (C4).
+   */
+  async deleteKeypairBundle() {
+    const msg = await this._sendAndWait({
+      type: 'keypair_bundle_delete', v: '0.1',
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     return msg;
@@ -627,5 +903,48 @@ function _extractDtlsFingerprint(sdp) {
   return bytes;
 }
 
+// ── Node identity pinning (11.5.8) ───────────────────────────────────────────
+
+const NODE_PIN_PREFIX = 'mb_nodepin_';
+
+function _checkNodePin(nodeId, nodePk) {
+  if (!nodeId || !nodePk) return;
+  const key = NODE_PIN_PREFIX + nodeId;
+
+  let pinned = null;
+  try { pinned = localStorage.getItem(key); } catch { return; }
+
+  if (pinned === null) {
+    try { localStorage.setItem(key, nodePk); } catch {}
+    return;
+  }
+  if (pinned !== nodePk) {
+    throw new Error(
+      'This node\'s identity key has changed. That is expected only if its ' +
+      'operator reinstalled the node — otherwise someone may be impersonating ' +
+      'it. Verify with the operator out of band, then clear the pin in ' +
+      'Settings to accept the new key.');
+  }
+}
+
+/** Forget a pinned node identity — the deliberate escape hatch for a legitimate rotation. */
+function clearNodePin(nodeId) {
+  try {
+    if (nodeId) localStorage.removeItem(NODE_PIN_PREFIX + nodeId);
+    else {
+      for (const k of Object.keys(localStorage))
+        if (k.startsWith(NODE_PIN_PREFIX)) localStorage.removeItem(k);
+    }
+  } catch {}
+}
+
+function pinnedNodeCount() {
+  try {
+    return Object.keys(localStorage).filter(k => k.startsWith(NODE_PIN_PREFIX)).length;
+  } catch { return 0; }
+}
+
 // Export
+MeshBayTransport.clearNodePin = clearNodePin;
+MeshBayTransport.pinnedNodeCount = pinnedNodeCount;
 window.MeshBayTransport = MeshBayTransport;
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md b/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md
new file mode 100644
index 0000000..6935e91
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/PROVENANCE.md
@@ -0,0 +1,36 @@
+# Vendored third-party assets
+
+The SPA is served under a CSP that forbids every external host, so anything it
+uses has to live here. Each entry records exactly what was taken and from where,
+so it can be checked or rebuilt without guesswork.
+
+## argon2.min.js
+
+| | |
+|---|---|
+| Package | `argon2-browser` 1.18.0 (npm) |
+| Source | https://registry.npmjs.org/argon2-browser/-/argon2-browser-1.18.0.tgz |
+| Tarball sha256 | `cdb11795a4971bde095fe6b836aa424de50c4558ed4b9505bc74111eee7f6d35` |
+| Tarball sha1 (npm dist.shasum) | `f35820211e0a431aed7f82b9348477234be69bec` |
+| File taken | `package/dist/argon2-bundled.min.js` |
+| File sha256 | `77c64b946baf1a5116dc591f4b9965d636b1b455f75edd2d4a587cb75e01687b` |
+
+The bundled build carries the WebAssembly inline as base64, so there is no second
+request and nothing to locate at runtime.
+
+**Why it is here at all:** WebCrypto has no memory-hard KDF. The encrypted
+keypair bundle is protected by the passphrase alone and rests on every node whose
+group its owner joins (finding C4), so PBKDF2 — compute-only, and therefore cheap
+on a GPU — was the wrong tool for it. Measured through this build on the dev
+machine: Argon2id 128 MB / t=3 / p=1 takes ~640 ms, against ~240 ms for
+PBKDF2-SHA512 at 600k, for a memory cost a GPU cannot ignore.
+
+### argon2.wasm
+
+The same build's standalone WebAssembly, sha256
+`0c2149886c13e4eae4a6ca25ee71d47423c5c8740a874cf04ff816d1b2c901d7`.
+
+The browser never requests it — `argon2.min.js` carries the same bytes inline as
+a data URL. It is kept because the cross-language parity test drives the vendored
+library under node, where the emscripten loader takes its file path instead of the
+inline copy, and a test that cannot run is a test that stops being true.
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js
new file mode 100644
index 0000000..607e16f
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.min.js
@@ -0,0 +1 @@
+!function(A,I){"object"==typeof exports&&"object"==typeof module?module.exports=I():"function"==typeof define&&define.amd?define([],I):"object"==typeof exports?exports.argon2=I():A.argon2=I()}(this,(function(){return(()=>{var A,I,g={773:(A,I,g)=>{var B,Q="undefined"!=typeof self&&void 0!==self.Module?self.Module:{},C={};for(B in Q)Q.hasOwnProperty(B)&&(C[B]=Q[B]);var E,i,o,D,e=[];E="object"==typeof window,i="function"==typeof importScripts,o="object"==typeof process&&"object"==typeof process.versions&&"string"==typeof process.versions.node,D=!E&&!o&&!i;var n,t,a,r,s,y="";o?(y=i?g(967).dirname(y)+"/":"//",n=function(A,I){return r||(r=g(145)),s||(s=g(967)),A=s.normalize(A),r.readFileSync(A,I?null:"utf8")},a=function(A){var I=n(A,!0);return I.buffer||(I=new Uint8Array(I)),G(I.buffer),I},process.argv.length>1&&process.argv[1].replace(/\\/g,"/"),e=process.argv.slice(2),A.exports=Q,process.on("uncaughtException",(function(A){if(!(A instanceof V))throw A})),process.on("unhandledRejection",u),Q.inspect=function(){return"[Emscripten Module object]"}):D?("undefined"!=typeof read&&(n=function(A){return read(A)}),a=function(A){var I;return"function"==typeof readbuffer?new Uint8Array(readbuffer(A)):(G("object"==typeof(I=read(A,"binary"))),I)},"undefined"!=typeof scriptArgs?e=scriptArgs:void 0!==arguments&&(e=arguments),"undefined"!=typeof print&&("undefined"==typeof console&&(console={}),console.log=print,console.warn=console.error="undefined"!=typeof printErr?printErr:print)):(E||i)&&(i?y=self.location.href:"undefined"!=typeof document&&document.currentScript&&(y=document.currentScript.src),y=0!==y.indexOf("blob:")?y.substr(0,y.lastIndexOf("/")+1):"",n=function(A){var I=new XMLHttpRequest;return I.open("GET",A,!1),I.send(null),I.responseText},i&&(a=function(A){var I=new XMLHttpRequest;return I.open("GET",A,!1),I.responseType="arraybuffer",I.send(null),new Uint8Array(I.response)}),t=function(A,I,g){var B=new XMLHttpRequest;B.open("GET",A,!0),B.responseType="arraybuffer",B.onload=function(){200==B.status||0==B.status&&B.response?I(B.response):g()},B.onerror=g,B.send(null)}),Q.print||console.log.bind(console);var F,c,w=Q.printErr||console.warn.bind(console);for(B in C)C.hasOwnProperty(B)&&(Q[B]=C[B]);C=null,Q.arguments&&(e=Q.arguments),Q.thisProgram&&Q.thisProgram,Q.quit&&Q.quit,Q.wasmBinary&&(F=Q.wasmBinary),Q.noExitRuntime,"object"!=typeof WebAssembly&&u("no native wasm support detected");var h=!1;function G(A,I){A||u("Assertion failed: "+I)}var N,R,f="undefined"!=typeof TextDecoder?new TextDecoder("utf8"):void 0;function U(A){N=A,Q.HEAP8=new Int8Array(A),Q.HEAP16=new Int16Array(A),Q.HEAP32=new Int32Array(A),Q.HEAPU8=R=new Uint8Array(A),Q.HEAPU16=new Uint16Array(A),Q.HEAPU32=new Uint32Array(A),Q.HEAPF32=new Float32Array(A),Q.HEAPF64=new Float64Array(A)}Q.INITIAL_MEMORY;var M,Y=[],S=[],H=[],d=0,k=null,J=null;function u(A){throw Q.onAbort&&Q.onAbort(A),w(A+=""),h=!0,A="abort("+A+"). Build with -s ASSERTIONS=1 for more info.",new WebAssembly.RuntimeError(A)}function p(A){return A.startsWith("data:application/octet-stream;base64,")}function L(A){return A.startsWith("file://")}Q.preloadedImages={},Q.preloadedAudios={};var l,K="argon2.wasm";function q(A){try{if(A==K&&F)return new Uint8Array(F);if(a)return a(A);throw"both async and sync fetching of the wasm failed"}catch(A){u(A)}}function b(A){for(;A.length>0;){var I=A.shift();if("function"!=typeof I){var g=I.func;"number"==typeof g?void 0===I.arg?M.get(g)():M.get(g)(I.arg):g(void 0===I.arg?null:I.arg)}else I(Q)}}function x(A){try{return c.grow(A-N.byteLength+65535>>>16),U(c.buffer),1}catch(A){}}p(K)||(l=K,K=Q.locateFile?Q.locateFile(l,y):y+l);var m,X={a:function(A,I,g){R.copyWithin(A,I,I+g)},b:function(A){var I,g=R.length,B=2147418112;if((A>>>=0)>B)return!1;for(var Q=1;Q<=4;Q*=2){var C=g*(1+.2/Q);if(C=Math.min(C,A+100663296),x(Math.min(B,((I=Math.max(A,C))%65536>0&&(I+=65536-I%65536),I))))return!0}return!1}},W=(function(){var A={a:X};function I(A,I){var g,B=A.exports;Q.asm=B,U((c=Q.asm.c).buffer),M=Q.asm.k,g=Q.asm.d,S.unshift(g),function(A){if(d--,Q.monitorRunDependencies&&Q.monitorRunDependencies(d),0==d&&(null!==k&&(clearInterval(k),k=null),J)){var I=J;J=null,I()}}()}function g(A){I(A.instance)}function B(I){return function(){if(!F&&(E||i)){if("function"==typeof fetch&&!L(K))return fetch(K,{credentials:"same-origin"}).then((function(A){if(!A.ok)throw"failed to load wasm binary file at '"+K+"'";return A.arrayBuffer()})).catch((function(){return q(K)}));if(t)return new Promise((function(A,I){t(K,(function(I){A(new Uint8Array(I))}),I)}))}return Promise.resolve().then((function(){return q(K)}))}().then((function(I){return WebAssembly.instantiate(I,A)})).then(I,(function(A){w("failed to asynchronously prepare wasm: "+A),u(A)}))}if(d++,Q.monitorRunDependencies&&Q.monitorRunDependencies(d),Q.instantiateWasm)try{return Q.instantiateWasm(A,I)}catch(A){return w("Module.instantiateWasm callback failed with error: "+A),!1}F||"function"!=typeof WebAssembly.instantiateStreaming||p(K)||L(K)||"function"!=typeof fetch?B(g):fetch(K,{credentials:"same-origin"}).then((function(I){return WebAssembly.instantiateStreaming(I,A).then(g,(function(A){return w("wasm streaming compile failed: "+A),w("falling back to ArrayBuffer instantiation"),B(g)}))}))}(),Q.___wasm_call_ctors=function(){return(Q.___wasm_call_ctors=Q.asm.d).apply(null,arguments)},Q._argon2_hash=function(){return(Q._argon2_hash=Q.asm.e).apply(null,arguments)},Q._malloc=function(){return(W=Q._malloc=Q.asm.f).apply(null,arguments)}),T=(Q._free=function(){return(Q._free=Q.asm.g).apply(null,arguments)},Q._argon2_verify=function(){return(Q._argon2_verify=Q.asm.h).apply(null,arguments)},Q._argon2_error_message=function(){return(Q._argon2_error_message=Q.asm.i).apply(null,arguments)},Q._argon2_encodedlen=function(){return(Q._argon2_encodedlen=Q.asm.j).apply(null,arguments)},Q._argon2_hash_ext=function(){return(Q._argon2_hash_ext=Q.asm.l).apply(null,arguments)},Q._argon2_verify_ext=function(){return(Q._argon2_verify_ext=Q.asm.m).apply(null,arguments)},Q.stackAlloc=function(){return(T=Q.stackAlloc=Q.asm.n).apply(null,arguments)});function V(A){this.name="ExitStatus",this.message="Program terminated with exit("+A+")",this.status=A}function j(A){function I(){m||(m=!0,Q.calledRun=!0,h||(b(S),Q.onRuntimeInitialized&&Q.onRuntimeInitialized(),function(){if(Q.postRun)for("function"==typeof Q.postRun&&(Q.postRun=[Q.postRun]);Q.postRun.length;)A=Q.postRun.shift(),H.unshift(A);var A;b(H)}()))}A=A||e,d>0||(function(){if(Q.preRun)for("function"==typeof Q.preRun&&(Q.preRun=[Q.preRun]);Q.preRun.length;)A=Q.preRun.shift(),Y.unshift(A);var A;b(Y)}(),d>0||(Q.setStatus?(Q.setStatus("Running..."),setTimeout((function(){setTimeout((function(){Q.setStatus("")}),1),I()}),1)):I()))}if(Q.allocate=function(A,I){var g;return g=1==I?T(A.length):W(A.length),A.subarray||A.slice?R.set(A,g):R.set(new Uint8Array(A),g),g},Q.UTF8ToString=function(A,I){return A?function(A,I,g){for(var B=I+g,Q=I;A[Q]&&!(Q>=B);)++Q;if(Q-I>16&&A.subarray&&f)return f.decode(A.subarray(I,Q));for(var C="";I<Q;){var E=A[I++];if(128&E){var i=63&A[I++];if(192!=(224&E)){var o=63&A[I++];if((E=224==(240&E)?(15&E)<<12|i<<6|o:(7&E)<<18|i<<12|o<<6|63&A[I++])<65536)C+=String.fromCharCode(E);else{var D=E-65536;C+=String.fromCharCode(55296|D>>10,56320|1023&D)}}else C+=String.fromCharCode((31&E)<<6|i)}else C+=String.fromCharCode(E)}return C}(R,A,I):""},Q.ALLOC_NORMAL=0,J=function A(){m||j(),m||(J=A)},Q.run=j,Q.preInit)for("function"==typeof Q.preInit&&(Q.preInit=[Q.preInit]);Q.preInit.length>0;)Q.preInit.pop()();j(),A.exports=Q,Q.unloadRuntime=function(){"undefined"!=typeof self&&delete self.Module,Q=c=M=N=R=void 0,delete A.exports}},631:function(A,I,g){var B,Q;"undefined"!=typeof self&&self,void 0===(Q="function"==typeof(B=function(){const A="undefined"!=typeof self?self:this,I={Argon2d:0,Argon2i:1,Argon2id:2};function B(I){if(B._promise)return B._promise;if(B._module)return Promise.resolve(B._module);let C;return C=A.process&&A.process.versions&&A.process.versions.node?Q().then((A=>new Promise((I=>{A.postRun=()=>I(A)})))):(A.loadArgon2WasmBinary?A.loadArgon2WasmBinary():Promise.resolve(g(721)).then((A=>function(A){const I=atob(A),g=new Uint8Array(new ArrayBuffer(I.length));for(let A=0;A<I.length;A++)g[A]=I.charCodeAt(A);return g}(A)))).then((g=>function(I,g){return new Promise((B=>(A.Module={wasmBinary:I,wasmMemory:g,postRun(){B(Module)}},Q())))}(g,I?function(A){const I=1024,g=64*I,B=(1024*I*1024*2-64*I)/g,Q=Math.min(Math.max(Math.ceil(A*I/g),256)+256,B);return new WebAssembly.Memory({initial:Q,maximum:B})}(I):void 0))),B._promise=C,C.then((A=>(B._module=A,delete B._promise,A)))}function Q(){return A.loadArgon2WasmModule?A.loadArgon2WasmModule():Promise.resolve(g(773))}function C(A,I){return A.allocate(I,"i8",A.ALLOC_NORMAL)}function E(A,I){return C(A,new Uint8Array([...I,0]))}function i(A){if("string"!=typeof A)return A;if("function"==typeof TextEncoder)return(new TextEncoder).encode(A);if("function"==typeof Buffer)return Buffer.from(A);throw new Error("Don't know how to encode UTF8")}return{ArgonType:I,hash:function(A){const g=A.mem||1024;return B(g).then((B=>{const Q=A.time||1,o=A.parallelism||1,D=i(A.pass),e=E(B,D),n=D.length,t=i(A.salt),a=E(B,t),r=t.length,s=A.type||I.Argon2d,y=B.allocate(new Array(A.hashLen||24),"i8",B.ALLOC_NORMAL),F=A.secret?C(B,A.secret):0,c=A.secret?A.secret.byteLength:0,w=A.ad?C(B,A.ad):0,h=A.ad?A.ad.byteLength:0,G=A.hashLen||24,N=B._argon2_encodedlen(Q,g,o,r,G,s),R=B.allocate(new Array(N+1),"i8",B.ALLOC_NORMAL);let f,U,M;try{U=B._argon2_hash_ext(Q,g,o,e,n,a,r,y,G,R,N,s,F,c,w,h,19)}catch(A){f=A}if(0!==U||f){try{f||(f=B.UTF8ToString(B._argon2_error_message(U)))}catch(A){}M={message:f,code:U}}else{let A="";const I=new Uint8Array(G);for(let g=0;g<G;g++){const Q=B.HEAP8[y+g];I[g]=Q,A+=("0"+(255&Q).toString(16)).slice(-2)}M={hash:I,hashHex:A,encoded:B.UTF8ToString(R)}}try{B._free(e),B._free(a),B._free(y),B._free(R),w&&B._free(w),F&&B._free(F)}catch(A){}if(f)throw M;return M}))},verify:function(A){return B().then((g=>{const B=i(A.pass),Q=E(g,B),o=B.length,D=A.secret?C(g,A.secret):0,e=A.secret?A.secret.byteLength:0,n=A.ad?C(g,A.ad):0,t=A.ad?A.ad.byteLength:0,a=E(g,i(A.encoded));let r,s,y,F=A.type;if(void 0===F){let g=A.encoded.split("$")[1];g&&(g=g.replace("a","A"),F=I[g]||I.Argon2d)}try{s=g._argon2_verify_ext(a,Q,o,D,e,n,t,F)}catch(A){r=A}if(s||r){try{r||(r=g.UTF8ToString(g._argon2_error_message(s)))}catch(A){}y={message:r,code:s}}try{g._free(Q),g._free(a)}catch(A){}if(r)throw y;return y}))},unloadRuntime:function(){B._module&&(B._module.unloadRuntime(),delete B._promise,delete B._module)}}})?B.apply(I,[]):B)||(A.exports=Q)},721:function(A,I){A.exports="AGFzbQEAAAABkwESYAN/f38Bf2ABfwF/YAJ/fwBgAn9/AX9gAX8AYAR/f39/AX9gA39/fwBgBH9/f38AYAJ/fgBgAn5/AX5gAn5+AX5gBX9/f39/AGAGf3x/f39/AX9gAABgCH9/f39/f39/AX9gEX9/f39/f39/f39/f39/f39/AX9gBn9/f39/fwF/YA1/f39/f39/f39/f39/AX8CDQIBYQFhAAABYQFiAAEDPDsJCgIAAAIEAQEAAQsGAQAHAAIBAwICAwIIBQECAwEHDQMBBgQGAQEFBQEAAAIEAAAIAQAODwQQAQURAwQFAXABAwMFBwEBgAL//wEGCQF/AUGQo8ACCwcxDAFjAgABZAAhAWUAOwFmAAkBZwAIAWgAOgFpADkBagA4AWsBAAFsADYBbQA1AW4AMwkIAQBBAQsCCzQKwbMBOwgAIAAgAa2KCx4AIAAgAXwgAEIBhkL+////H4MgAUL/////D4N+fAsXAEHwHCgCAEUgAEVyRQRAIAAgARAdCwuDBAEDfyACQYAETwRAIAAgASACEAAaIAAPCyAAIAJqIQMCQCAAIAFzQQNxRQRAAkAgAEEDcUUEQCAAIQIMAQsgAkEBSARAIAAhAgwBCyAAIQIDQCACIAEtAAA6AAAgAUEBaiEBIAJBAWoiAkEDcUUNASACIANJDQALCwJAIANBfHEiBEHAAEkNACACIARBQGoiBUsNAANAIAIgASgCADYCACACIAEoAgQ2AgQgAiABKAIINgIIIAIgASgCDDYCDCACIAEoAhA2AhAgAiABKAIUNgIUIAIgASgCGDYCGCACIAEoAhw2AhwgAiABKAIgNgIgIAIgASgCJDYCJCACIAEoAig2AiggAiABKAIsNgIsIAIgASgCMDYCMCACIAEoAjQ2AjQgAiABKAI4NgI4IAIgASgCPDYCPCABQUBrIQEgAkFAayICIAVNDQALCyACIARPDQEDQCACIAEoAgA2AgAgAUEEaiEBIAJBBGoiAiAESQ0ACwwBCyADQQRJBEAgACECDAELIAAgA0EEayIESwRAIAAhAgwBCyAAIQIDQCACIAEtAAA6AAAgAiABLQABOgABIAIgAS0AAjoAAiACIAEtAAM6AAMgAUEEaiEBIAJBBGoiAiAETQ0ACwsgAiADSQRAA0AgAiABLQAAOgAAIAFBAWohASACQQFqIgIgA0cNAAsLIAALzwEBA38CQCACRQ0AQX8hAyAARSABRXINACAAKQNQQgBSDQACQCAAKALgASIDIAJqQYEBSQ0AIABB4ABqIgUgA2ogAUGAASADayIEEAUaIABCgAEQGiAAIAUQGUEAIQMgAEEANgLgASABIARqIQEgAiAEayICQYEBSQ0AA0AgAEKAARAaIAAgARAZIAFBgAFqIQEgAkGAAWsiAkGAAUsNAAsgACgC4AEhAwsgACADakHgAGogASACEAUaIAAgACgC4AEgAmo2AuABQQAhAwsgAwsJACAAIAE2AAALpwwBB38CQCAARQ0AIABBCGsiAyAAQQRrKAIAIgFBeHEiAGohBQJAIAFBAXENACABQQNxRQ0BIAMgAygCACIBayIDQbAfKAIASQ0BIAAgAWohACADQbQfKAIARwRAIAFB/wFNBEAgAygCCCICIAFBA3YiBEEDdEHIH2pGGiACIAMoAgwiAUYEQEGgH0GgHygCAEF+IAR3cTYCAAwDCyACIAE2AgwgASACNgIIDAILIAMoAhghBgJAIAMgAygCDCIBRwRAIAMoAggiAiABNgIMIAEgAjYCCAwBCwJAIANBFGoiAigCACIEDQAgA0EQaiICKAIAIgQNAEEAIQEMAQsDQCACIQcgBCIBQRRqIgIoAgAiBA0AIAFBEGohAiABKAIQIgQNAAsgB0EANgIACyAGRQ0BAkAgAyADKAIcIgJBAnRB0CFqIgQoAgBGBEAgBCABNgIAIAENAUGkH0GkHygCAEF+IAJ3cTYCAAwDCyAGQRBBFCAGKAIQIANGG2ogATYCACABRQ0CCyABIAY2AhggAygCECICBEAgASACNgIQIAIgATYCGAsgAygCFCICRQ0BIAEgAjYCFCACIAE2AhgMAQsgBSgCBCIBQQNxQQNHDQBBqB8gADYCACAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAA8LIAMgBU8NACAFKAIEIgFBAXFFDQACQCABQQJxRQRAIAVBuB8oAgBGBEBBuB8gAzYCAEGsH0GsHygCACAAaiIANgIAIAMgAEEBcjYCBCADQbQfKAIARw0DQagfQQA2AgBBtB9BADYCAA8LIAVBtB8oAgBGBEBBtB8gAzYCAEGoH0GoHygCACAAaiIANgIAIAMgAEEBcjYCBCAAIANqIAA2AgAPCyABQXhxIABqIQACQCABQf8BTQRAIAUoAggiAiABQQN2IgRBA3RByB9qRhogAiAFKAIMIgFGBEBBoB9BoB8oAgBBfiAEd3E2AgAMAgsgAiABNgIMIAEgAjYCCAwBCyAFKAIYIQYCQCAFIAUoAgwiAUcEQCAFKAIIIgJBsB8oAgBJGiACIAE2AgwgASACNgIIDAELAkAgBUEUaiICKAIAIgQNACAFQRBqIgIoAgAiBA0AQQAhAQwBCwNAIAIhByAEIgFBFGoiAigCACIEDQAgAUEQaiECIAEoAhAiBA0ACyAHQQA2AgALIAZFDQACQCAFIAUoAhwiAkECdEHQIWoiBCgCAEYEQCAEIAE2AgAgAQ0BQaQfQaQfKAIAQX4gAndxNgIADAILIAZBEEEUIAYoAhAgBUYbaiABNgIAIAFFDQELIAEgBjYCGCAFKAIQIgIEQCABIAI2AhAgAiABNgIYCyAFKAIUIgJFDQAgASACNgIUIAIgATYCGAsgAyAAQQFyNgIEIAAgA2ogADYCACADQbQfKAIARw0BQagfIAA2AgAPCyAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAAsgAEH/AU0EQCAAQQN2IgFBA3RByB9qIQACf0GgHygCACICQQEgAXQiAXFFBEBBoB8gASACcjYCACAADAELIAAoAggLIQIgACADNgIIIAIgAzYCDCADIAA2AgwgAyACNgIIDwtBHyECIANCADcCECAAQf///wdNBEAgAEEIdiIBIAFBgP4/akEQdkEIcSIBdCICIAJBgOAfakEQdkEEcSICdCIEIARBgIAPakEQdkECcSIEdEEPdiABIAJyIARyayIBQQF0IAAgAUEVanZBAXFyQRxqIQILIAMgAjYCHCACQQJ0QdAhaiEBAkACQAJAQaQfKAIAIgRBASACdCIHcUUEQEGkHyAEIAdyNgIAIAEgAzYCACADIAE2AhgMAQsgAEEAQRkgAkEBdmsgAkEfRht0IQIgASgCACEBA0AgASIEKAIEQXhxIABGDQIgAkEddiEBIAJBAXQhAiAEIAFBBHFqIgdBEGooAgAiAQ0ACyAHIAM2AhAgAyAENgIYCyADIAM2AgwgAyADNgIIDAELIAQoAggiACADNgIMIAQgAzYCCCADQQA2AhggAyAENgIMIAMgADYCCAtBwB9BwB8oAgBBAWsiAEF/IAAbNgIACwuULQEMfyMAQRBrIgwkAAJAAkACQAJAAkACQAJAAkACQAJAAkACQCAAQfQBTQRAQaAfKAIAIgVBECAAQQtqQXhxIABBC0kbIghBA3YiAnYiAUEDcQRAIAFBf3NBAXEgAmoiA0EDdCIBQdAfaigCACIEQQhqIQACQCAEKAIIIgIgAUHIH2oiAUYEQEGgHyAFQX4gA3dxNgIADAELIAIgATYCDCABIAI2AggLIAQgA0EDdCIBQQNyNgIEIAEgBGoiASABKAIEQQFyNgIEDA0LIAhBqB8oAgAiCk0NASABBEACQEECIAJ0IgBBACAAa3IgASACdHEiAEEAIABrcUEBayIAIABBDHZBEHEiAnYiAUEFdkEIcSIAIAJyIAEgAHYiAUECdkEEcSIAciABIAB2IgFBAXZBAnEiAHIgASAAdiIBQQF2QQFxIgByIAEgAHZqIgNBA3QiAEHQH2ooAgAiBCgCCCIBIABByB9qIgBGBEBBoB8gBUF+IAN3cSIFNgIADAELIAEgADYCDCAAIAE2AggLIARBCGohACAEIAhBA3I2AgQgBCAIaiICIANBA3QiASAIayIDQQFyNgIEIAEgBGogAzYCACAKBEAgCkEDdiIBQQN0QcgfaiEHQbQfKAIAIQQCfyAFQQEgAXQiAXFFBEBBoB8gASAFcjYCACAHDAELIAcoAggLIQEgByAENgIIIAEgBDYCDCAEIAc2AgwgBCABNgIIC0G0HyACNgIAQagfIAM2AgAMDQtBpB8oAgAiBkUNASAGQQAgBmtxQQFrIgAgAEEMdkEQcSICdiIBQQV2QQhxIgAgAnIgASAAdiIBQQJ2QQRxIgByIAEgAHYiAUEBdkECcSIAciABIAB2IgFBAXZBAXEiAHIgASAAdmpBAnRB0CFqKAIAIgEoAgRBeHEgCGshAyABIQIDQAJAIAIoAhAiAEUEQCACKAIUIgBFDQELIAAoAgRBeHEgCGsiAiADIAIgA0kiAhshAyAAIAEgAhshASAAIQIMAQsLIAEgCGoiCSABTQ0CIAEoAhghCyABIAEoAgwiBEcEQCABKAIIIgBBsB8oAgBJGiAAIAQ2AgwgBCAANgIIDAwLIAFBFGoiAigCACIARQRAIAEoAhAiAEUNBCABQRBqIQILA0AgAiEHIAAiBEEUaiICKAIAIgANACAEQRBqIQIgBCgCECIADQALIAdBADYCAAwLC0F/IQggAEG/f0sNACAAQQtqIgBBeHEhCEGkHygCACIJRQ0AQQAgCGshAwJAAkACQAJ/QQAgCEGAAkkNABpBHyAIQf///wdLDQAaIABBCHYiACAAQYD+P2pBEHZBCHEiAnQiACAAQYDgH2pBEHZBBHEiAXQiACAAQYCAD2pBEHZBAnEiAHRBD3YgASACciAAcmsiAEEBdCAIIABBFWp2QQFxckEcagsiBUECdEHQIWooAgAiAkUEQEEAIQAMAQtBACEAIAhBAEEZIAVBAXZrIAVBH0YbdCEBA0ACQCACKAIEQXhxIAhrIgcgA08NACACIQQgByIDDQBBACEDIAIhAAwDCyAAIAIoAhQiByAHIAIgAUEddkEEcWooAhAiAkYbIAAgBxshACABQQF0IQEgAg0ACwsgACAEckUEQEEAIQRBAiAFdCIAQQAgAGtyIAlxIgBFDQMgAEEAIABrcUEBayIAIABBDHZBEHEiAnYiAUEFdkEIcSIAIAJyIAEgAHYiAUECdkEEcSIAciABIAB2IgFBAXZBAnEiAHIgASAAdiIBQQF2QQFxIgByIAEgAHZqQQJ0QdAhaigCACEACyAARQ0BCwNAIAAoAgRBeHEgCGsiASADSSECIAEgAyACGyEDIAAgBCACGyEEIAAoAhAiAQR/IAEFIAAoAhQLIgANAAsLIARFDQAgA0GoHygCACAIa08NACAEIAhqIgYgBE0NASAEKAIYIQUgBCAEKAIMIgFHBEAgBCgCCCIAQbAfKAIASRogACABNgIMIAEgADYCCAwKCyAEQRRqIgIoAgAiAEUEQCAEKAIQIgBFDQQgBEEQaiECCwNAIAIhByAAIgFBFGoiAigCACIADQAgAUEQaiECIAEoAhAiAA0ACyAHQQA2AgAMCQsgCEGoHygCACICTQRAQbQfKAIAIQMCQCACIAhrIgFBEE8EQEGoHyABNgIAQbQfIAMgCGoiADYCACAAIAFBAXI2AgQgAiADaiABNgIAIAMgCEEDcjYCBAwBC0G0H0EANgIAQagfQQA2AgAgAyACQQNyNgIEIAIgA2oiACAAKAIEQQFyNgIECyADQQhqIQAMCwsgCEGsHygCACIGSQRAQawfIAYgCGsiATYCAEG4H0G4HygCACICIAhqIgA2AgAgACABQQFyNgIEIAIgCEEDcjYCBCACQQhqIQAMCwtBACEAIAhBL2oiCQJ/QfgiKAIABEBBgCMoAgAMAQtBhCNCfzcCAEH8IkKAoICAgIAENwIAQfgiIAxBDGpBcHFB2KrVqgVzNgIAQYwjQQA2AgBB3CJBADYCAEGAIAsiAWoiBUEAIAFrIgdxIgIgCE0NCkHYIigCACIEBEBB0CIoAgAiAyACaiIBIANNIAEgBEtyDQsLQdwiLQAAQQRxDQUCQAJAQbgfKAIAIgMEQEHgIiEAA0AgAyAAKAIAIgFPBEAgASAAKAIEaiADSw0DCyAAKAIIIgANAAsLQQAQDCIBQX9GDQYgAiEFQfwiKAIAIgNBAWsiACABcQRAIAIgAWsgACABakEAIANrcWohBQsgBSAITSAFQf7///8HS3INBkHYIigCACIEBEBB0CIoAgAiAyAFaiIAIANNIAAgBEtyDQcLIAUQDCIAIAFHDQEMCAsgBSAGayAHcSIFQf7///8HSw0FIAUQDCIBIAAoAgAgACgCBGpGDQQgASEACyAAQX9GIAhBMGogBU1yRQRAQYAjKAIAIgEgCSAFa2pBACABa3EiAUH+////B0sEQCAAIQEMCAsgARAMQX9HBEAgASAFaiEFIAAhAQwIC0EAIAVrEAwaDAULIAAiAUF/Rw0GDAQLAAtBACEEDAcLQQAhAQwFCyABQX9HDQILQdwiQdwiKAIAQQRyNgIACyACQf7///8HSw0BIAIQDCIBQX9GQQAQDCIAQX9GciAAIAFNcg0BIAAgAWsiBSAIQShqTQ0BC0HQIkHQIigCACAFaiIANgIAQdQiKAIAIABJBEBB1CIgADYCAAsCQAJAAkBBuB8oAgAiBwRAQeAiIQADQCABIAAoAgAiAyAAKAIEIgJqRg0CIAAoAggiAA0ACwwCC0GwHygCACIAQQAgACABTRtFBEBBsB8gATYCAAtBACEAQeQiIAU2AgBB4CIgATYCAEHAH0F/NgIAQcQfQfgiKAIANgIAQewiQQA2AgADQCAAQQN0IgNB0B9qIANByB9qIgI2AgAgA0HUH2ogAjYCACAAQQFqIgBBIEcNAAtBrB8gBUEoayIDQXggAWtBB3FBACABQQhqQQdxGyIAayICNgIAQbgfIAAgAWoiADYCACAAIAJBAXI2AgQgASADakEoNgIEQbwfQYgjKAIANgIADAILIAAtAAxBCHEgAyAHS3IgASAHTXINACAAIAIgBWo2AgRBuB8gB0F4IAdrQQdxQQAgB0EIakEHcRsiAGoiAjYCAEGsH0GsHygCACAFaiIBIABrIgA2AgAgAiAAQQFyNgIEIAEgB2pBKDYCBEG8H0GIIygCADYCAAwBC0GwHygCACABSwRAQbAfIAE2AgALIAEgBWohAkHgIiEAAkACQAJAAkACQAJAA0AgAiAAKAIARwRAIAAoAggiAA0BDAILCyAALQAMQQhxRQ0BC0HgIiEAA0AgByAAKAIAIgJPBEAgAiAAKAIEaiIEIAdLDQMLIAAoAgghAAwACwALIAAgATYCACAAIAAoAgQgBWo2AgQgAUF4IAFrQQdxQQAgAUEIakEHcRtqIgkgCEEDcjYCBCACQXggAmtBB3FBACACQQhqQQdxG2oiBSAIIAlqIgZrIQIgBSAHRgRAQbgfIAY2AgBBrB9BrB8oAgAgAmoiADYCACAGIABBAXI2AgQMAwsgBUG0HygCAEYEQEG0HyAGNgIAQagfQagfKAIAIAJqIgA2AgAgBiAAQQFyNgIEIAAgBmogADYCAAwDCyAFKAIEIgBBA3FBAUYEQCAAQXhxIQcCQCAAQf8BTQRAIAUoAggiAyAAQQN2IgBBA3RByB9qRhogAyAFKAIMIgFGBEBBoB9BoB8oAgBBfiAAd3E2AgAMAgsgAyABNgIMIAEgAzYCCAwBCyAFKAIYIQgCQCAFIAUoAgwiAUcEQCAFKAIIIgAgATYCDCABIAA2AggMAQsCQCAFQRRqIgAoAgAiAw0AIAVBEGoiACgCACIDDQBBACEBDAELA0AgACEEIAMiAUEUaiIAKAIAIgMNACABQRBqIQAgASgCECIDDQALIARBADYCAAsgCEUNAAJAIAUgBSgCHCIDQQJ0QdAhaiIAKAIARgRAIAAgATYCACABDQFBpB9BpB8oAgBBfiADd3E2AgAMAgsgCEEQQRQgCCgCECAFRhtqIAE2AgAgAUUNAQsgASAINgIYIAUoAhAiAARAIAEgADYCECAAIAE2AhgLIAUoAhQiAEUNACABIAA2AhQgACABNgIYCyAFIAdqIQUgAiAHaiECCyAFIAUoAgRBfnE2AgQgBiACQQFyNgIEIAIgBmogAjYCACACQf8BTQRAIAJBA3YiAEEDdEHIH2ohAgJ/QaAfKAIAIgFBASAAdCIAcUUEQEGgHyAAIAFyNgIAIAIMAQsgAigCCAshACACIAY2AgggACAGNgIMIAYgAjYCDCAGIAA2AggMAwtBHyEAIAJB////B00EQCACQQh2IgAgAEGA/j9qQRB2QQhxIgN0IgAgAEGA4B9qQRB2QQRxIgF0IgAgAEGAgA9qQRB2QQJxIgB0QQ92IAEgA3IgAHJrIgBBAXQgAiAAQRVqdkEBcXJBHGohAAsgBiAANgIcIAZCADcCECAAQQJ0QdAhaiEEAkBBpB8oAgAiA0EBIAB0IgFxRQRAQaQfIAEgA3I2AgAgBCAGNgIAIAYgBDYCGAwBCyACQQBBGSAAQQF2ayAAQR9GG3QhACAEKAIAIQEDQCABIgMoAgRBeHEgAkYNAyAAQR12IQEgAEEBdCEAIAMgAUEEcWoiBCgCECIBDQALIAQgBjYCECAGIAM2AhgLIAYgBjYCDCAGIAY2AggMAgtBrB8gBUEoayIDQXggAWtBB3FBACABQQhqQQdxGyIAayICNgIAQbgfIAAgAWoiADYCACAAIAJBAXI2AgQgASADakEoNgIEQbwfQYgjKAIANgIAIAcgBEEnIARrQQdxQQAgBEEna0EHcRtqQS9rIgAgACAHQRBqSRsiAkEbNgIEIAJB6CIpAgA3AhAgAkHgIikCADcCCEHoIiACQQhqNgIAQeQiIAU2AgBB4CIgATYCAEHsIkEANgIAIAJBGGohAANAIABBBzYCBCAAQQhqIQEgAEEEaiEAIAEgBEkNAAsgAiAHRg0DIAIgAigCBEF+cTYCBCAHIAIgB2siBEEBcjYCBCACIAQ2AgAgBEH/AU0EQCAEQQN2IgBBA3RByB9qIQICf0GgHygCACIBQQEgAHQiAHFFBEBBoB8gACABcjYCACACDAELIAIoAggLIQAgAiAHNgIIIAAgBzYCDCAHIAI2AgwgByAANgIIDAQLQR8hACAHQgA3AhAgBEH///8HTQRAIARBCHYiACAAQYD+P2pBEHZBCHEiAnQiACAAQYDgH2pBEHZBBHEiAXQiACAAQYCAD2pBEHZBAnEiAHRBD3YgASACciAAcmsiAEEBdCAEIABBFWp2QQFxckEcaiEACyAHIAA2AhwgAEECdEHQIWohAwJAQaQfKAIAIgJBASAAdCIBcUUEQEGkHyABIAJyNgIAIAMgBzYCACAHIAM2AhgMAQsgBEEAQRkgAEEBdmsgAEEfRht0IQAgAygCACEBA0AgASICKAIEQXhxIARGDQQgAEEddiEBIABBAXQhACACIAFBBHFqIgMoAhAiAQ0ACyADIAc2AhAgByACNgIYCyAHIAc2AgwgByAHNgIIDAMLIAMoAggiACAGNgIMIAMgBjYCCCAGQQA2AhggBiADNgIMIAYgADYCCAsgCUEIaiEADAULIAIoAggiACAHNgIMIAIgBzYCCCAHQQA2AhggByACNgIMIAcgADYCCAtBrB8oAgAiACAITQ0AQawfIAAgCGsiATYCAEG4H0G4HygCACICIAhqIgA2AgAgACABQQFyNgIEIAIgCEEDcjYCBCACQQhqIQAMAwtB3B5BMDYCAEEAIQAMAgsCQCAFRQ0AAkAgBCgCHCICQQJ0QdAhaiIAKAIAIARGBEAgACABNgIAIAENAUGkHyAJQX4gAndxIgk2AgAMAgsgBUEQQRQgBSgCECAERhtqIAE2AgAgAUUNAQsgASAFNgIYIAQoAhAiAARAIAEgADYCECAAIAE2AhgLIAQoAhQiAEUNACABIAA2AhQgACABNgIYCwJAIANBD00EQCAEIAMgCGoiAEEDcjYCBCAAIARqIgAgACgCBEEBcjYCBAwBCyAEIAhBA3I2AgQgBiADQQFyNgIEIAMgBmogAzYCACADQf8BTQRAIANBA3YiAEEDdEHIH2ohAgJ/QaAfKAIAIgFBASAAdCIAcUUEQEGgHyAAIAFyNgIAIAIMAQsgAigCCAshACACIAY2AgggACAGNgIMIAYgAjYCDCAGIAA2AggMAQtBHyEAIANB////B00EQCADQQh2IgAgAEGA/j9qQRB2QQhxIgJ0IgAgAEGA4B9qQRB2QQRxIgF0IgAgAEGAgA9qQRB2QQJxIgB0QQ92IAEgAnIgAHJrIgBBAXQgAyAAQRVqdkEBcXJBHGohAAsgBiAANgIcIAZCADcCECAAQQJ0QdAhaiECAkACQCAJQQEgAHQiAXFFBEBBpB8gASAJcjYCACACIAY2AgAgBiACNgIYDAELIANBAEEZIABBAXZrIABBH0YbdCEAIAIoAgAhCANAIAgiASgCBEF4cSADRg0CIABBHXYhAiAAQQF0IQAgASACQQRxaiICKAIQIggNAAsgAiAGNgIQIAYgATYCGAsgBiAGNgIMIAYgBjYCCAwBCyABKAIIIgAgBjYCDCABIAY2AgggBkEANgIYIAYgATYCDCAGIAA2AggLIARBCGohAAwBCwJAIAtFDQACQCABKAIcIgJBAnRB0CFqIgAoAgAgAUYEQCAAIAQ2AgAgBA0BQaQfIAZBfiACd3E2AgAMAgsgC0EQQRQgCygCECABRhtqIAQ2AgAgBEUNAQsgBCALNgIYIAEoAhAiAARAIAQgADYCECAAIAQ2AhgLIAEoAhQiAEUNACAEIAA2AhQgACAENgIYCwJAIANBD00EQCABIAMgCGoiAEEDcjYCBCAAIAFqIgAgACgCBEEBcjYCBAwBCyABIAhBA3I2AgQgCSADQQFyNgIEIAMgCWogAzYCACAKBEAgCkEDdiIAQQN0QcgfaiEEQbQfKAIAIQICf0EBIAB0IgAgBXFFBEBBoB8gACAFcjYCACAEDAELIAQoAggLIQAgBCACNgIIIAAgAjYCDCACIAQ2AgwgAiAANgIIC0G0HyAJNgIAQagfIAM2AgALIAFBCGohAAsgDEEQaiQAIAALfwEDfyAAIQECQCAAQQNxBEADQCABLQAARQ0CIAFBAWoiAUEDcQ0ACwsDQCABIgJBBGohASACKAIAIgNBf3MgA0GBgoQIa3FBgIGChHhxRQ0ACyADQf8BcUUEQCACIABrDwsDQCACLQABIQMgAkEBaiIBIQIgAw0ACwsgASAAawvyAgICfwF+AkAgAkUNACAAIAJqIgNBAWsgAToAACAAIAE6AAAgAkEDSQ0AIANBAmsgAToAACAAIAE6AAEgA0EDayABOgAAIAAgAToAAiACQQdJDQAgA0EEayABOgAAIAAgAToAAyACQQlJDQAgAEEAIABrQQNxIgRqIgMgAUH/AXFBgYKECGwiATYCACADIAIgBGtBfHEiBGoiAkEEayABNgIAIARBCUkNACADIAE2AgggAyABNgIEIAJBCGsgATYCACACQQxrIAE2AgAgBEEZSQ0AIAMgATYCGCADIAE2AhQgAyABNgIQIAMgATYCDCACQRBrIAE2AgAgAkEUayABNgIAIAJBGGsgATYCACACQRxrIAE2AgAgBCADQQRxQRhyIgRrIgJBIEkNACABrUKBgICAEH4hBSADIARqIQEDQCABIAU3AxggASAFNwMQIAEgBTcDCCABIAU3AwAgAUEgaiEBIAJBIGsiAkEfSw0ACwsgAAtPAQJ/QdgeKAIAIgEgAEEDakF8cSICaiEAAkAgAkEAIAAgAU0bDQAgAD8AQRB0SwRAIAAQAUUNAQtB2B4gADYCACABDwtB3B5BMDYCAEF/C20BAX8jAEGAAmsiBSQAIARBgMAEcSACIANMckUEQCAFIAFB/wFxIAIgA2siAkGAAiACQYACSSIBGxALGiABRQRAA0AgACAFQYACEA4gAkGAAmsiAkH/AUsNAAsLIAAgBSACEA4LIAVBgAJqJAALnQIBA38gAC0AAEEgcUUEQAJAIAEhBAJAIAIgACIBKAIQIgAEfyAABQJ/IAEiACABLQBKIgNBAWsgA3I6AEogASgCACIDQQhxBEAgACADQSByNgIAQX8MAQsgAEIANwIEIAAgACgCLCIDNgIcIAAgAzYCFCAAIAMgACgCMGo2AhBBAAsNASABKAIQCyABKAIUIgVrSwRAIAEgBCACIAEoAiQRAAAaDAILAn8gASwAS0F/SgRAIAIhAANAIAIgACIDRQ0CGiAEIANBAWsiAGotAABBCkcNAAsgASAEIAMgASgCJBEAACADSQ0CIAMgBGohBCABKAIUIQUgAiADawwBCyACCyEAIAUgBCAAEAUaIAEgASgCFCAAajYCFAsLCwsKACAAQTBrQQpJC2MBAn8gAkUEQEEADwsCfyAALQAAIgMEQANAAkACQCABLQAAIgRFDQAgAkEBayICRQ0AIAMgBEYNAQsgAwwDCyABQQFqIQEgAC0AASEDIABBAWohACADDQALC0EACyABLQAAawucDQIQfhB/IwBBgBBrIhQkACAUQYAIaiABEBcgFEGACGogABAWIBQgFEGACGoQFyADBEAgFCACEBYLQQAhAEEAIQEDQCAUQYAIaiABQQd0IgNBwAByaiIVKQMAIBRBgAhqIANB4AByaiIWKQMAIBRBgAhqIANqIhcpAwAgFEGACGogA0EgcmoiGCkDACIIEAMiBIVBIBACIgUQAyIGIAiFQRgQAiEIIAggBiAFIAQgCBADIgeFQRAQAiIKEAMiEYVBPxACIQggFEGACGogA0HIAHJqIhkpAwAgFEGACGogA0HoAHJqIhopAwAgFEGACGogA0EIcmoiGykDACAUQYAIaiADQShyaiIcKQMAIgQQAyIFhUEgEAIiBhADIgsgBIVBGBACIQQgBCALIAYgBSAEEAMiC4VBEBACIhIQAyIThUE/EAIhBCAUQYAIaiADQdAAcmoiHSkDACAUQYAIaiADQfAAcmoiHikDACAUQYAIaiADQRByaiIfKQMAIBRBgAhqIANBMHJqIiApAwAiBRADIgaFQSAQAiIMEAMiDSAFhUEYEAIhBSAFIA0gDCAGIAUQAyINhUEQEAIiDBADIg6FQT8QAiEFIBRBgAhqIANB2AByaiIhKQMAIBRBgAhqIANB+AByaiIiKQMAIBRBgAhqIANBGHJqIiMpAwAgFEGACGogA0E4cmoiAykDACIGEAMiD4VBIBACIgkQAyIQIAaFQRgQAiEGIAYgECAJIA8gBhADIg+FQRAQAiIJEAMiEIVBPxACIQYgFyAHIAQQAyIHIAQgDiAHIAmFQSAQAiIHEAMiDoVBGBACIgQQAyIJNwMAICIgByAJhUEQEAIiBzcDACAdIA4gBxADIgc3AwAgHCAEIAeFQT8QAjcDACAbIAsgBRADIgQgBSAQIAQgCoVBIBACIgQQAyIHhUEYEAIiBRADIgo3AwAgFiAEIAqFQRAQAiIENwMAICEgByAEEAMiBDcDACAgIAQgBYVBPxACNwMAIB8gDSAGEAMiBCAGIBEgBCAShUEgEAIiBBADIgWFQRgQAiIGEAMiBzcDACAaIAQgB4VBEBACIgQ3AwAgFSAFIAQQAyIENwMAIAMgBCAGhUE/EAI3AwAgIyAPIAgQAyIEIAggEyAEIAyFQSAQAiIEEAMiBYVBGBACIggQAyIGNwMAIB4gBCAGhUEQEAIiBDcDACAZIAUgBBADIgQ3AwAgGCAEIAiFQT8QAjcDACABQQFqIgFBCEcNAAsDQCAAQQR0IgMgFEGACGpqIgEiFUGABGopAwAgASkDgAYgASkDACABKQOAAiIIEAMiBIVBIBACIgUQAyIGIAiFQRgQAiEIIAggBiAFIAQgCBADIgeFQRAQAiIKEAMiEYVBPxACIQggASkDiAQgASkDiAYgFEGACGogA0EIcmoiAykDACABKQOIAiIEEAMiBYVBIBACIgYQAyILIASFQRgQAiEEIAQgCyAGIAUgBBADIguFQRAQAiISEAMiE4VBPxACIQQgASkDgAUgASkDgAcgASkDgAEgASkDgAMiBRADIgaFQSAQAiIMEAMiDSAFhUEYEAIhBSAFIA0gDCAGIAUQAyINhUEQEAIiDBADIg6FQT8QAiEFIAEpA4gFIAEpA4gHIAEpA4gBIAEpA4gDIgYQAyIPhUEgEAIiCRADIhAgBoVBGBACIQYgBiAQIAkgDyAGEAMiD4VBEBACIgkQAyIQhUE/EAIhBiABIAcgBBADIgcgBCAOIAcgCYVBIBACIgcQAyIOhUEYEAIiBBADIgk3AwAgASAHIAmFQRAQAiIHNwOIByABIA4gBxADIgc3A4AFIAEgBCAHhUE/EAI3A4gCIAMgCyAFEAMiBCAFIBAgBCAKhUEgEAIiBBADIgeFQRgQAiIFEAMiCjcDACABIAQgCoVBEBACIgQ3A4AGIAEgByAEEAMiBDcDiAUgASAEIAWFQT8QAjcDgAMgASANIAYQAyIEIAYgESAEIBKFQSAQAiIEEAMiBYVBGBACIgYQAyIHNwOAASABIAQgB4VBEBACIgQ3A4gGIBUgBSAEEAMiBDcDgAQgASAEIAaFQT8QAjcDiAMgASAPIAgQAyIEIAggEyAEIAyFQSAQAiIEEAMiBYVBGBACIggQAyIGNwOIASABIAQgBoVBEBACIgQ3A4AHIAEgBSAEEAMiBDcDiAQgASAEIAiFQT8QAjcDgAIgAEEBaiIAQQhHDQALIAIgFBAXIAIgFEGACGoQFiAUQYAQaiQAC8MBAQN/IwBBQGoiAyQAIANBAEHAABALIQRBfyEDAkAgAEUgAUVyDQAgACgC5AEgAksNACAAKQNQQgBSDQAgACAANQLgARAaIAAQJUEAIQMgAEHgAGoiAiAAKALgASIFakEAQYABIAVrEAsaIAAgAhAZA0AgBCADQQN0IgVqIAAgBWopAwAQMiADQQFqIgNBCEcNAAsgASAEIAAoAuQBEAUaIARBwAAQBCACQYABEAQgAEHAABAEQQAhAwsgBEFAayQAIAML1AMBBn8jAEEQayIEJAAgBCABNgIMIwBBoAFrIgMkACADQQhqQYAYQZABEAUaIAMgADYCNCADIAA2AhwgA0F+IABrIgJB/////wcgAkH/////B0kbIgU2AjggAyAAIAVqIgA2AiQgAyAANgIYIANBCGohACMAQdABayICJAAgAiABNgLMASACQaABakEAQSgQCxogAiACKALMATYCyAECQEEAIAJByAFqIAJB0ABqIAJBoAFqEBtBAEgNACAAKAJMQQBOIQYgACgCACEBIAAsAEpBAEwEQCAAIAFBX3E2AgALIAFBIHEhBwJ/IAAoAjAEQCAAIAJByAFqIAJB0ABqIAJBoAFqEBsMAQsgAEHQADYCMCAAIAJB0ABqNgIQIAAgAjYCHCAAIAI2AhQgACgCLCEBIAAgAjYCLCAAIAJByAFqIAJB0ABqIAJBoAFqEBsgAUUNABogAEEAQQAgACgCJBEAABogAEEANgIwIAAgATYCLCAAQQA2AhwgAEEANgIQIAAoAhQaIABBADYCFEEACxogACAAKAIAIAdyNgIAIAZFDQALIAJB0AFqJAAgBQRAIAMoAhwiACAAIAMoAhhGa0EAOgAACyADQaABaiQAIARBEGokAAs0AQF/QQEhAQJAIABBCkkNAEECIQEDQCAAQeQASQ0BIAFBAWohASAAQQpuIQAMAAsACyABC4UBAQd/AkAgAC0AACIGQTBrQf8BcUEJSw0AIAYhAgNAIAQhByADQZmz5swBSw0BIAJB/wFxQTBrIgIgA0EKbCIEQX9zSw0BIAIgBGohAyAAIAdBAWoiBGoiCC0AACICQTBrQf8BcUEKSQ0ACyAGQTBGQQAgBxsNACABIAM2AgAgCCEFCyAFCzEBA38DQCAAIAJBA3QiA2oiBCAEKQMAIAEgA2opAwCFNwMAIAJBAWoiAkGAAUcNAAsLDAAgACABQYAIEAUaC14BAn8jAEFAaiICJABBfyEDAkAgAEUNACABQQFrQcAATwRAIAAQNwwBCyACQQE6AAMgAkGAAjsAASACIAE6AAAgAkEEckEAQTwQCxogACACEDwhAwsgAkFAayQAIAMLpAoCA38RfiMAQYACayIDJAADQCACQQN0IgQgA0GAAWpqIAEgBGopAAA3AwAgAkEBaiICQRBHDQALIAMgAEHAABAFIQEgACkDWEL5wvibkaOz8NsAhSELIAApA1BC6/qG2r+19sEfhSEMIAApA0hCn9j52cKR2oKbf4UhDSAAKQNAQtGFmu/6z5SH0QCFIQ5C8e30+KWn/aelfyEPQqvw0/Sv7ry3PCESQrvOqqbY0Ouzu38hEEKIkvOd/8z5hOoAIQVBACEDIAEpAzghBiABKQMYIRQgASkDMCEHIAEpAxAhFSABKQMoIQggASkDCCERIAEpAyAhCSABKQMAIQoDQCAJIAUgDiABQYABaiADQQZ0IgJBwAhqKAIAQQN0aikDACAJIAp8fCIKhUEgEAIiDnwiE4VBGBACIQUgBSATIA4gAUGAAWogAkHECGooAgBBA3RqKQMAIAUgCnx8IgqFQRAQAiIOfCIThUE/EAIhCSAIIBAgDSABQYABaiACQcgIaigCAEEDdGopAwAgCCARfHwiEYVBIBACIg18IhCFQRgQAiEFIAUgECANIAFBgAFqIAJBzAhqKAIAQQN0aikDACAFIBF8fCIRhUEQEAIiDXwiEIVBPxACIQUgEiAMIAFBgAFqIAJB0AhqKAIAQQN0aikDACAHIBV8fCIIhUEgEAIiDHwiEiAHhUEYEAIhByAHIBIgDCABQYABaiACQdQIaigCAEEDdGopAwAgByAIfHwiFYVBEBACIgx8IgiFQT8QAiEHIA8gCyABQYABaiACQdgIaigCAEEDdGopAwAgBiAUfHwiEoVBIBACIgt8Ig8gBoVBGBACIQYgBiALIAFBgAFqIAJB3AhqKAIAQQN0aikDACAGIBJ8fCIUhUEQEAIiCyAPfCIPhUE/EAIhBiAFIAggCyABQYABaiACQeAIaigCAEEDdGopAwAgBSAKfHwiCoVBIBACIgt8IgiFQRgQAiEFIAUgCCALIAFBgAFqIAJB5AhqKAIAQQN0aikDACAFIAp8fCIKhUEQEAIiC3wiEoVBPxACIQggByAPIA4gAUGAAWogAkHoCGooAgBBA3RqKQMAIAcgEXx8Ig+FQSAQAiIOfCIRhUEYEAIhBSAFIBEgDiABQYABaiACQewIaigCAEEDdGopAwAgBSAPfHwiEYVBEBACIg58Ig+FQT8QAiEHIAYgDSABQYABaiACQfAIaigCAEEDdGopAwAgBiAVfHwiBYVBIBACIg0gE3wiE4VBGBACIQYgBiATIA0gAUGAAWogAkH0CGooAgBBA3RqKQMAIAUgBnx8IhWFQRAQAiINfCIFhUE/EAIhBiAJIBAgDCABQYABaiACQfgIaigCAEEDdGopAwAgCSAUfHwiEIVBIBACIgx8IhOFQRgQAiEJIAkgEyAMIAFBgAFqIAJB/AhqKAIAQQN0aikDACAJIBB8fCIUhUEQEAIiDHwiEIVBPxACIQkgA0EBaiIDQQxHDQALIAEgDjcDYCABIAk3AyAgASANNwNoIAEgCDcDKCABIBE3AwggASAQNwNIIAEgDDcDcCABIAc3AzAgASAVNwMQIAEgEjcDUCABIAs3A3ggASAGNwM4IAEgFDcDGCABIA83A1ggASAFNwNAIAEgCjcDACAAIAogACkDAIUgBYU3AwBBASECA0AgACACQQN0IgNqIgQgASADaiIDKQMAIAQpAwCFIANBQGspAwCFNwMAIAJBAWoiAkEIRw0ACyABQYACaiQACyYBAX4gACABIAApA0AiAXwiAjcDQCAAIAApA0ggASACVq18NwNIC6AUAhB/An4jAEHQAGsiBiQAIAZByg42AkwgBkE3aiETIAZBOGohEANAAkAgDkEASA0AQf////8HIA5rIARIBEBB3B5BPTYCAEF/IQ4MAQsgBCAOaiEOCyAGKAJMIgchBAJAAkACQAJAAkACQAJAAkAgBgJ/AkAgBy0AACIFBEADQAJAAkAgBUH/AXEiBUUEQCAEIQUMAQsgBUElRw0BIAQhBQNAIAQtAAFBJUcNASAGIARBAmoiCDYCTCAFQQFqIQUgBC0AAiELIAghBCALQSVGDQALCyAFIAdrIQQgAARAIAAgByAEEA4LIAQNDSAGKAJMLAABEA8hBSAGKAJMIQQgBUUNAyAELQACQSRHDQMgBCwAAUEwayEPQQEhESAEQQNqDAQLIAYgBEEBaiIINgJMIAQtAAEhBSAIIQQMAAsACyAOIQwgAA0IIBFFDQJBASEEA0AgAyAEQQJ0aigCACIABEAgAiAEQQN0aiAAIAEQJEEBIQwgBEEBaiIEQQpHDQEMCgsLQQEhDCAEQQpPDQgDQCADIARBAnRqKAIADQggBEEBaiIEQQpHDQALDAgLQX8hDyAEQQFqCyIENgJMQQAhCAJAIAQsAAAiDUEgayIFQR9LDQBBASAFdCIFQYnRBHFFDQADQAJAIAYgBEEBaiIINgJMIAQsAAEiDUEgayIEQSBPDQBBASAEdCIEQYnRBHFFDQAgBCAFciEFIAghBAwBCwsgCCEEIAUhCAsCQCANQSpGBEAgBgJ/AkAgBCwAARAPRQ0AIAYoAkwiBC0AAkEkRw0AIAQsAAFBAnQgA2pBwAFrQQo2AgAgBCwAAUEDdCACakGAA2soAgAhCkEBIREgBEEDagwBCyARDQhBACERQQAhCiAABEAgASABKAIAIgRBBGo2AgAgBCgCACEKCyAGKAJMQQFqCyIENgJMIApBf0oNAUEAIAprIQogCEGAwAByIQgMAQsgBkHMAGoQIyIKQQBIDQYgBigCTCEEC0F/IQkCQCAELQAAQS5HDQAgBC0AAUEqRgRAAkAgBCwAAhAPRQ0AIAYoAkwiBC0AA0EkRw0AIAQsAAJBAnQgA2pBwAFrQQo2AgAgBCwAAkEDdCACakGAA2soAgAhCSAGIARBBGoiBDYCTAwCCyARDQcgAAR/IAEgASgCACIEQQRqNgIAIAQoAgAFQQALIQkgBiAGKAJMQQJqIgQ2AkwMAQsgBiAEQQFqNgJMIAZBzABqECMhCSAGKAJMIQQLQQAhBQNAIAUhEkF/IQwgBCwAAEHBAGtBOUsNByAGIARBAWoiDTYCTCAELAAAIQUgDSEEIAUgEkE6bGpBzxhqLQAAIgVBAWtBCEkNAAsgBUETRg0CIAVFDQYgD0EATgRAIAMgD0ECdGogBTYCACAGIAIgD0EDdGopAwA3A0AMBAsgAA0BC0EAIQwMBQsgBkFAayAFIAEQJCAGKAJMIQ0MAgsgD0F/Sg0DC0EAIQQgAEUNBAsgCEH//3txIgsgCCAIQYDAAHEbIQVBACEMQcAOIQ8gECEIAkACQAJAAn8CQAJAAkACQAJ/AkACQAJAAkACQAJAAkAgDUEBaywAACIEQV9xIAQgBEEPcUEDRhsgBCASGyIEQdgAaw4hBBISEhISEhISDhIPBg4ODhIGEhISEgIFAxISCRIBEhIEAAsCQCAEQcEAaw4HDhILEg4ODgALIARB0wBGDQkMEQsgBikDQCEUQcAODAULQQAhBAJAAkACQAJAAkACQAJAIBJB/wFxDggAAQIDBBcFBhcLIAYoAkAgDjYCAAwWCyAGKAJAIA42AgAMFQsgBigCQCAOrDcDAAwUCyAGKAJAIA47AQAMEwsgBigCQCAOOgAADBILIAYoAkAgDjYCAAwRCyAGKAJAIA6sNwMADBALIAlBCCAJQQhLGyEJIAVBCHIhBUH4ACEECyAQIQcgBEEgcSELIAYpA0AiFFBFBEADQCAHQQFrIgcgFKdBD3FB4BxqLQAAIAtyOgAAIBRCD1YhDSAUQgSIIRQgDQ0ACwsgBUEIcUUgBikDQFByDQMgBEEEdkHADmohD0ECIQwMAwsgECEEIAYpA0AiFFBFBEADQCAEQQFrIgQgFKdBB3FBMHI6AAAgFEIHViEHIBRCA4ghFCAHDQALCyAEIQcgBUEIcUUNAiAJIBAgB2siBEEBaiAEIAlIGyEJDAILIAYpA0AiFEJ/VwRAIAZCACAUfSIUNwNAQQEhDEHADgwBCyAFQYAQcQRAQQEhDEHBDgwBC0HCDkHADiAFQQFxIgwbCyEPIBAhBAJAIBRCgICAgBBUBEAgFCEVDAELA0AgBEEBayIEIBQgFEIKgCIVQgp+fadBMHI6AAAgFEL/////nwFWIQcgFSEUIAcNAAsLIBWnIgcEQANAIARBAWsiBCAHIAdBCm4iC0EKbGtBMHI6AAAgB0EJSyENIAshByANDQALCyAEIQcLIAVB//97cSAFIAlBf0obIQUgBikDQCIUQgBSIAlyRQRAQQAhCSAQIQcMCgsgCSAUUCAQIAdraiIEIAQgCUgbIQkMCQsCfyAJIgRBAEchCAJAAkACQCAGKAJAIgVB4xYgBRsiByIFQQNxRSAERXINAANAIAUtAABFDQIgBEEBayIEQQBHIQggBUEBaiIFQQNxRQ0BIAQNAAsLIAhFDQELAkAgBS0AAEUgBEEESXINAANAIAUoAgAiCEF/cyAIQYGChAhrcUGAgYKEeHENASAFQQRqIQUgBEEEayIEQQNLDQALCyAERQ0AA0AgBSAFLQAARQ0CGiAFQQFqIQUgBEEBayIEDQALC0EACyIEIAcgCWogBBshCCALIQUgBCAHayAJIAQbIQkMCAsgCQRAIAYoAkAMAgtBACEEIABBICAKQQAgBRANDAILIAZBADYCDCAGIAYpA0A+AgggBiAGQQhqNgJAQX8hCSAGQQhqCyEIQQAhBAJAA0AgCCgCACIHRQ0BIAZBBGogBxAiIgdBAEgiCyAHIAkgBGtLckUEQCAIQQRqIQggCSAEIAdqIgRLDQEMAgsLQX8hDCALDQULIABBICAKIAQgBRANIARFBEBBACEEDAELQQAhCCAGKAJAIQ0DQCANKAIAIgdFDQEgBkEEaiAHECIiByAIaiIIIARKDQEgACAGQQRqIAcQDiANQQRqIQ0gBCAISw0ACwsgAEEgIAogBCAFQYDAAHMQDSAKIAQgBCAKSBshBAwFCyAAIAYrA0AgCiAJIAUgBEEAEQwAIQQMBAsgBiAGKQNAPAA3QQEhCSATIQcgCyEFDAILQX8hDAsgBkHQAGokACAMDwsgAEEgIAwgCCAHayILIAkgCSALSBsiCWoiCCAKIAggCkobIgQgCCAFEA0gACAPIAwQDiAAQTAgBCAIIAVBgIAEcxANIABBMCAJIAtBABANIAAgByALEA4gAEEgIAQgCCAFQYDAAHMQDQwACwALkwIBAn8gAEUEQEFnDwsgACgCAEUEQEF/DwsCQAJ/QX4gACgCBEEESQ0AGiAAKAIIRQRAQW4gACgCDA0BGgsgACgCFCEBIAAoAhBFDQFBeiABQQhJDQAaIAAoAhhFBEBBbCAAKAIcDQEaCyAAKAIgRQRAQWsgACgCJA0BGgtBciAAKAIsIgFBCEkNABpBcSABQYCAgAFLDQAaQXIgASAAKAIwIgJBA3RJDQAaIAAoAihFBEBBdA8LIAJFBEBBcA8LQW8gAkH///8HSw0AGiAAKAI0IgFFBEBBZA8LQWMgAUH///8HSw0AGiAAKAJAIQECQCAAKAI8BEAgAQ0BQWkPC0FoIAENARoLQQALDwtBbUF6IAEbCzgBAX8jAEEQayICJAAgAiAANgIMIAIgATYCCCACKAIMQQAgAigCCEH8FygCABEAABogAkEQaiQAC4MSAhN/An4jAEEwayIJJAACQCAAEBwiBA0AQWYhBCABQQJLDQAgACgCLCEDIAAoAjAhBCAAKAI4IQIgCUEANgIAIAkgAjYCBCAAKAIoIQIgCSAENgIYIAkgAjYCCCAJIARBA3QiAiADIAIgA0sbIARBAnQiAm4iAzYCECAJIANBAnQ2AhQgCSACIANsNgIMIAAoAjQhAyAJIAE2AiAgCSADNgIcIAMgBEsEQCAJIAQ2AhwLIwBB0ABrIgskAEFnIQQCQCAJIgFFIAAiA0VyDQAgASADNgIoIAMhBSABKAIMIQZBaiECAkAgASIERQ0AIAatQgqGIhVCIIinDQAgFachAgJAIAUoAjwiBQRAIAQgAiAFEQMAGiAEKAIAIQIMAQsgBCACEAkiAjYCAAtBAEFqIAIbIQILIAIiBA0AIAEoAiAhBSMAQYACayICJAAgA0UgCyIERXJFBEAgAkEQakHAABAYGiACQQxqIAMoAjAQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAgQQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAiwQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAigQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAjgQByACQRBqIAJBDGpBBBAGGiACQQxqIAUQByACQRBqIAJBDGpBBBAGGiACQQxqIAMoAgwQByACQRBqIAJBDGpBBBAGGgJAIAMoAggiBUUNACACQRBqIAUgAygCDBAGGiADLQBEQQFxRQ0AIAMoAgggAygCDBAdIANBADYCDAsgAkEMaiADKAIUEAcgAkEQaiACQQxqQQQQBhogAygCECIFBEAgAkEQaiAFIAMoAhQQBhoLIAJBDGogAygCHBAHIAJBEGogAkEMakEEEAYaAkAgAygCGCIFRQ0AIAJBEGogBSADKAIcEAYaIAMtAERBAnFFDQAgAygCGCADKAIcEB0gA0EANgIcCyACQQxqIAMoAiQQByACQRBqIAJBDGpBBBAGGiADKAIgIgUEQCACQRBqIAUgAygCJBAGGgsgAkEQaiAEQcAAEBIaCyACQYACaiQAIAtBQGtBCBAEQQAhAiMAQYAIayIDJAAgASgCGARAIARBxABqIQYgBEFAayEFA0AgBUEAEAcgBiACEAcgA0GACCAEQcgAECAgASgCACABKAIUIAJsQQp0aiADEC4gBUEBEAcgA0GACCAEQcgAECAgASgCACABKAIUIAJsQQp0akGACGogAxAuIAJBAWoiAiABKAIYSQ0ACwsgA0GACBAEIANBgAhqJAAgC0HIABAEQQAhBAsgC0HQAGokACAEDQBBZyEEAkAgCUUNACABKAIYRQ0AIwBBIGsiBSQAIAEiCygCCARAIAsoAhghBANAIAQhA0EAIQ8DQEEAIRBBACECIAMEQANAIAUgDzoAGCAFQQA2AhwgBSAFKQMYNwMIIAUgEjYCECAFIBA2AhQgBSAFKQMQNwMAIAUhBEEAIREjAEGAGGsiByQAAkAgCyIDRQ0AAkACQAJAAn8CfwJAAkACQCADKAIgQQFrDgICAQALIAQoAgAhCEEADAMLIAQoAgANA0EAIAQtAAgiDEECSQ0BGiAELQAIIghFQQF0IQwMBQsgBC0ACCEMIAQoAgALIQggBxAvIAdBgAhqEC8gByAIrTcDgAggBDUCBCEVIAcgDK1C/wGDNwOQCCAHIBU3A4gIIAcgAzUCDDcDmAggByADNQIINwOgCCAHIAM1AiA3A6gIQQELIREgCEUNAQsgBC0ACCEIQQAhDAwBCyAELQAIIghFQQF0IQwgCCARRXINACAHQYAQaiAHQYAIaiAHECZBAiEMQQAhCAsgDCADKAIQIgZPDQBBfyADKAIUIgJBAWsgAiAEKAIEbCAMaiAGIAhB/wFxbGoiCCACcBsgCGohBgNAIAhBAWsgBiAIIAJwQQFGGyEOAn8gEQRAIAxB/wBxIgJFBEAgB0GAEGogB0GACGogBxAmCyAHQYAQaiACQQN0agwBCyADKAIAIA5BCnRqCyECIAMoAhghCiACKQMAIRUgBCAMNgIMIAMhBiAVpyEUIBVCIIinIApwrSIVIBUgBDUCBCIVIAQtAAgbIAQoAgAbIhYgFVEhCgJ+IAQiAigCAEUEQCACLQAIIg1FBEAgAigCDEEBayEKQgAMAgsgBigCECANbCENIAIoAgwhAiAKBEAgAiANakEBayEKQgAMAgsgDSACRWshCkIADAELIAYoAhAhDSAGKAIUIRMCfyAKBEAgAigCDCATIA1Bf3NqagwBCyATIA1rIAIoAgxFawshCkIAIAItAAgiAkEDRg0AGiANIAJBAWpsrQshFSAVIApBAWutfCAKrSAUrSIVIBV+QiCIfkIgiH0gBjUCFIKnIQYgAygCACICIAMoAhQgFqdsQQp0aiAGQQp0aiEGIAIgCEEKdGohCgJAIAMoAgRBEEYEQCACIA5BCnRqIAYgCkEAEBEMAQsgAiAOQQp0aiECIAQoAgBFBEAgAiAGIApBABARDAELIAIgBiAKQQEQEQsgDEEBaiIMIAMoAhBPDQEgCEEBaiEIIA5BAWohBiADKAIUIQIMAAsACyAHQYAYaiQAIAsoAhgiBCECIBBBAWoiECAESQ0ACwsgAiEDIA9BAWoiD0EERw0ACyASQQFqIhIgCygCCEkNAAsLIAVBIGokAEEAIQQLIAQNACMAQYAQayIDJAAgAEUgCUVyRQRAIANBgAhqIAEoAgAgASgCFEEKdGpBgAhrEBcgASgCGEECTwRAQQEhBANAIANBgAhqIAEoAgAgASgCFCICIAIgBGxqQQp0akGACGsQFiAEQQFqIgQgASgCGEkNAAsLIAMiAkGACGohC0EAIQQDQCACIARBA3QiBWogBSALaikDABAyIARBAWoiBEGAAUcNAAsgACgCACAAKAIEIANBgAgQICADQYAIakGACBAEIANBgAgQBCABKAIAIgQgASgCDEEKdCIBEAQCQCAAKAJAIgAEQCAEIAEgABECAAwBCyAEEAgLCyADQYAQaiQAQQAhBAsgCUEwaiQAIAQLJwEBfwJAAkACQAJAIAAOAwABAgMLQdATDwtBixEPC0GeEyEBCyABC48DAQF/IwBBgANrIgQkACAEQQA2AowBIARBjAFqIAEQBwJAIAFBwABNBEAgBEGQAWogARAYQQBIDQEgBEGQAWogBEGMAWpBBBAGQQBIDQEgBEGQAWogAiADEAZBAEgNASAEQZABaiAAIAEQEhoMAQsgBEGQAWpBwAAQGEEASA0AIARBkAFqIARBjAFqQQQQBkEASA0AIARBkAFqIAIgAxAGQQBIDQAgBEGQAWogBEFAa0HAABASQQBIDQAgACAEKQNANwAAIAAgBCkDSDcACCAAIAQpA1g3ABggACAEKQNQNwAQIABBIGohACABQSBrIgJBwQBPBEADQCAEIARBQGtBwAAQBSIBQUBrQcAAIAEQMUEASA0CIAAgASkDQDcAACAAIAEpA0g3AAggACAEKQNYNwAYIAAgBCkDUDcAECAAQSBqIQAgAkEgayICQcAASw0ACwsgBCAEQUBrQcAAEAUiAUFAayACIAEQMUEASA0AIAAgAUFAayACEAUaCyAEQZABakHwARAEIARBgANqJAALAwABC5kCACAARQRAQQAPCwJ/AkAgAAR/IAFB/wBNDQECQEGgHigCACgCAEUEQCABQYB/cUGAvwNGDQMMAQsgAUH/D00EQCAAIAFBP3FBgAFyOgABIAAgAUEGdkHAAXI6AABBAgwECyABQYCwA09BACABQYBAcUGAwANHG0UEQCAAIAFBP3FBgAFyOgACIAAgAUEMdkHgAXI6AAAgACABQQZ2QT9xQYABcjoAAUEDDAQLIAFBgIAEa0H//z9NBEAgACABQT9xQYABcjoAAyAAIAFBEnZB8AFyOgAAIAAgAUEGdkE/cUGAAXI6AAIgACABQQx2QT9xQYABcjoAAUEEDAQLC0HcHkEZNgIAQX8FQQELDAELIAAgAToAAEEBCwtQAQN/AkAgACgCACwAABAPRQRADAELA0AgACgCACICLAAAIQMgACACQQFqNgIAIAEgA2pBMGshASACLAABEA9FDQEgAUEKbCEBDAALAAsgAQu7AgACQCABQRRLDQACQAJAAkACQAJAAkACQAJAAkACQCABQQlrDgoAAQIDBAUGBwgJCgsgAiACKAIAIgFBBGo2AgAgACABKAIANgIADwsgAiACKAIAIgFBBGo2AgAgACABNAIANwMADwsgAiACKAIAIgFBBGo2AgAgACABNQIANwMADwsgAiACKAIAQQdqQXhxIgFBCGo2AgAgACABKQMANwMADwsgAiACKAIAIgFBBGo2AgAgACABMgEANwMADwsgAiACKAIAIgFBBGo2AgAgACABMwEANwMADwsgAiACKAIAIgFBBGo2AgAgACABMAAANwMADwsgAiACKAIAIgFBBGo2AgAgACABMQAANwMADwsgAiACKAIAQQdqQXhxIgFBCGo2AgAgACABKwMAOQMADwsgACACQQARAgALCxkAIAAtAOgBBEAgAEJ/NwNYCyAAQn83A1ALIwAgASABKQMwQgF8NwMwIAIgASAAQQAQESACIAAgAEEAEBELOQECfyAAQQNuIgJBAnQhAQJAAkACQCACQQNsQX9zIABqDgIBAAILIAFBAXIhAQsgAUECaiEBCyABC3oBAn8gAEHA/wBzQQFqQQh2QX9zQS9xIABBwf8Ac0EBakEIdkF/c0ErcSAAQeb/A2pBCHZB/wFxIgEgAEHBAGpxcnIgAEHM/wNqQQh2IgIgAEHHAGpxIAFB/wFzcXIgAEH8AWogAEHC/wNqQQh2cSACQX9zcUH/AXFyC9YBAQV/QX8hBCADQQNuIgZBAnQhBQJAAkACQCAGQQNsQX9zIANqDgIBAAILIAVBAXIhBQsgBUECaiEFCyABIAVLBH8CQCADRQ0AQQAhAUEIIQQDQCABIAItAAAiCHIhBwNAIAAiASAHIAQiBkEGayIEdkE/cRAoOgAAIAFBAWohACAEQQVLDQALIANBAWsiAwRAIAJBAWohAiAHQQh0IQEgBEEIaiEEDAELCyAERQ0AIAEgCEEMIAZrdEE/cRAoOgABIAFBAmohAAsgAEEAOgAAIAUFIAQLC8oEAQN/IwBB4ABrIgQkACADEB8hBSACEBwhAwJAAkAgBUUNACADDQEgAUECSQ0AIABBJDsAACABQQFrIgMgBRAKIgFNDQAgAEEBaiAFIAFBAWoQBSEAIAMgAWsiA0EESQ0AIAAgAWoiAUGk7PUBNgAAIAQgAigCODYCMCAEQUBrIARBMGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGk2vUBNgAAIAQgAigCLDYCICAEQUBrIARBIGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGs6PUBNgAAIAQgAigCKDYCECAEQUBrIARBEGoQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0EESQ0AIAAgAWoiAUGs4PUBNgAAIAQgAigCMDYCACAEQUBrIAQQEyADQQNrIgMgBEFAaxAKIgBNDQAgAUEDaiAEQUBrIABBAWoQBSEBIAMgAGsiA0ECSQ0AIAAgAWoiAEEkOwAAIABBAWoiACADQQFrIgYgAigCECACKAIUECkiAUF/RiIFDQBBYSEDIAZBACABIAUbayIGQQJJDQEgACAAIAFqIAUbIgBBJDsAACAAQQFqIAZBAWsgAigCACACKAIEECkhACAEQeAAaiQAQWFBACAAQX9GGw8LQWEhAwsgBEHgAGokACADC7gBAQF/QQAgAEEEaiAAQdD/A2pBCHZBf3NxQTkgAGtBCHZBf3NxQf8BcSAAQcEAayIBIAFBCHZBf3NxQdoAIABrQQh2QX9zcUH/AXEgAEG5AWogAEGf/wNqQQh2QX9zcUH6ACAAa0EIdkF/c3FB/wFxIABB0P8Ac0EBakEIdkF/c0E/cSAAQdT/AHNBAWpBCHZBf3NBPnFycnJyIgFrQQh2QX9zIABBvv8Dc0EBakEIdnFB/wFxIAFyC64BAQR/An8CfyACLAAAECsiBkH/AUYEQEF/DAELA0AgBCAGaiEEAkAgA0EGaiIGQQhJBEAgBiEDDAELIAEoAgAgBU0EQEEADwsgACAEIANBAmsiA3Y6AAAgAEEBaiEAIAVBAWohBQsgAkEBaiICLAAAECsiBkH/AUcEQCAEQQZ0IQQMAQsLQQAgA0EESw0BGkF/IAN0CyEDQQAgBCADQX9zcQ0AGiABIAU2AgAgAgsLrAMBBX8jAEEQayIDJAAgACgCBCEGIAAoAhQhBwJAIAIQHyIERQRAQWYhAgwBC0FgIQIgAS0AACIFQSRHDQAgAUEBaiABIAVBJEYbIgEgBCAEEAoiBBAQIgUNACAAQRA2AjggASABIARqIgEgBRsiBEHfFEEDEBBFBEAgBEEDaiADQQxqEBUiAUUNASAAIAMoAgw2AjgLIAFB6xRBAxAQDQAgAUEDaiADQQxqEBUiAUUNACAAIAMoAgw2AiwgAUHjFEEDEBANACABQQNqIANBDGoQFSIBRQ0AIAAgAygCDDYCKCABQecUQQMQEA0AIAFBA2ogA0EMahAVIgFFDQAgACADKAIMIgQ2AjAgACAENgI0IAEtAABBJEcNACADIAc2AgwgACgCECADQQxqIAFBAWoQLCIBRQ0AIAAgAygCDDYCFCABLQAAQSRHDQAgAyAGNgIMIAAoAgAgA0EMaiABQQFqECwiAUUNACAAIAMoAgw2AgQgAEEANgJEIABCADcCPCAAQgA3AhggAEIANwIgIAAQHCICDQBBYEEAIAEtAAAbIQILIANBEGokACACCykBAn8DQCAAIAJBA3QiA2ogASADaikAADcDACACQQFqIgJBgAFHDQALCwwAIABBAEGACBALGgtlAQJ/IAAgAhAeIgIEfyACBUFdQQACfyAAKAIAIQRBACECIAAoAgQiAAR/A0AgAyACIARqLQAAIAEgAmotAABzciEDIAJBAWoiAiAARw0ACyADQQFrQQh2QQFxQQFrBUEACwsbCwtdAQJ/IwBB8AFrIgMkAEF/IQQCQCACRSAARSABRXJyIAFBwABLcg0AIAMgARAYQQBIDQAgAyACQcAAEAZBAEgNACADIAAgARASIQQLIANB8AEQBCADQfABaiQAIAQLCQAgACABNwAACxAAIwAgAGtBcHEiACQAIAALMwEBfyAAKAIUIgMgASACIAAoAhAgA2siASABIAJLGyIBEAUaIAAgACgCFCABajYCFCACC9oBAQR/IwBB0ABrIggkAAJAIABFBEBBYCEADAELIAggABAKIgk2AgwgCCAJNgIcIAggCRAJIgo2AhggCCAJEAkiCzYCCEEAIQkCQAJAIApFIAtFcg0AIAggAjYCFCAIIAE2AhAgCEEIaiAAIAcQLSIADQEgCCgCCCEJIAggCCgCDBAJIgA2AgggAEUNACAIIAY2AiwgCCAFNgIoIAggBDYCJCAIIAM2AiAgCEEIaiAJIAcQMCEADAELQWohAAsgCCgCGBAIIAgoAggQCCAJEAgLIAhB0ABqJAAgAAuQAgEDfyMAQdAAayIRJABBfiETAkAgCEEESQ0AIAgQCSISRQRAQWohEwwBCyARQQA2AkwgEUIANwJEIBEgAjYCPCARIAI2AjggESABNgI0IBEgADYCMCARIA82AiwgESAONgIoIBEgDTYCJCARIAw2AiAgESAGNgIcIBEgBTYCGCARIAQ2AhQgESADNgIQIBEgCDYCDCARIBI2AgggESAQNgJAAkAgEUEIaiALEB4iEwRAIBIgCBAEDAELIAcEQCAHIBIgCBAFGgsCQCAJRSAKRXINACAJIAogEUEIaiALECpFDQAgEiAIEAQgCSAKEARBYSETDAELIBIgCBAEQQAhEwsgEhAICyARQdAAaiQAIBMLDQAgAEHwARAEIAAQJQspACAFEB8QCiAAEBRqIAEQFGogAhAUaiADECdqIAQQJ2pBExAUakEQagsfACAAQSNqIgBBI00EQCAAQQJ0QewWaigCAA8LQYsTC74BAQR/IwBB0ABrIgQkAAJAIABFBEBBYCEADAELIAQgABAKIgU2AgwgBCAFNgIcIAQgBRAJIgY2AhggBCAFEAkiBzYCCEEAIQUCQAJAIAZFIAdFcg0AIAQgAjYCFCAEIAE2AhAgBEEIaiAAIAMQLSIADQEgBCgCCCEFIAQgBCgCDBAJIgA2AgggAEUNACAEQQhqIAUgAxAwIQAMAQtBaiEACyAEKAIYEAggBCgCCBAIIAUQCAsgBEHQAGokACAAC4ICAQN/IwBB0ABrIg0kAEF+IQ8CQCAIQQRJDQAgCBAJIg5FBEBBaiEPDAELIA1CADcDKCANQgA3AyAgDSAGNgIcIA0gBTYCGCANIAQ2AhQgDSADNgIQIA0gCDYCDCANIA42AgggDUEANgJMIA1CADcCRCANIAI2AjwgDSACNgI4IA0gATYCNCANIAA2AjAgDSAMNgJAAkAgDUEIaiALEB4iDwRAIA4gCBAEDAELIAcEQCAHIA4gCBAFGgsCQCAJRSAKRXINACAJIAogDUEIaiALECpFDQAgDiAIEAQgCSAKEARBYSEPDAELIA4gCBAEQQAhDwsgDhAICyANQdAAaiQAIA8LYgEDfyABRSAARXIEf0F/BSAAQUBrQQBBsAEQCxogAEGACEHAABAFGgNAIAAgAkEDdCIDaiIEIAEgA2opAAAgBCkDAIU3AwAgAkEBaiICQQhHDQALIAAgAS0AADYC5AFBAAsLC/ISFABBgAgLuQUIybzzZ+YJajunyoSFrme7K/iU/nLzbjzxNh1fOvVPpdGC5q1/Ug5RH2w+K4xoBZtrvUH7q9mDH3khfhMZzeBbAAAAAAEAAAACAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACQAAAAoAAAALAAAADAAAAA0AAAAOAAAADwAAAA4AAAAKAAAABAAAAAgAAAAJAAAADwAAAA0AAAAGAAAAAQAAAAwAAAAAAAAAAgAAAAsAAAAHAAAABQAAAAMAAAALAAAACAAAAAwAAAAAAAAABQAAAAIAAAAPAAAADQAAAAoAAAAOAAAAAwAAAAYAAAAHAAAAAQAAAAkAAAAEAAAABwAAAAkAAAADAAAAAQAAAA0AAAAMAAAACwAAAA4AAAACAAAABgAAAAUAAAAKAAAABAAAAAAAAAAPAAAACAAAAAkAAAAAAAAABQAAAAcAAAACAAAABAAAAAoAAAAPAAAADgAAAAEAAAALAAAADAAAAAYAAAAIAAAAAwAAAA0AAAACAAAADAAAAAYAAAAKAAAAAAAAAAsAAAAIAAAAAwAAAAQAAAANAAAABwAAAAUAAAAPAAAADgAAAAEAAAAJAAAADAAAAAUAAAABAAAADwAAAA4AAAANAAAABAAAAAoAAAAAAAAABwAAAAYAAAADAAAACQAAAAIAAAAIAAAACwAAAA0AAAALAAAABwAAAA4AAAAMAAAAAQAAAAMAAAAJAAAABQAAAAAAAAAPAAAABAAAAAgAAAAGAAAAAgAAAAoAAAAGAAAADwAAAA4AAAAJAAAACwAAAAMAAAAAAAAACAAAAAwAAAACAAAADQAAAAcAAAABAAAABAAAAAoAAAAFAAAACgAAAAIAAAAIAAAABAAAAAcAAAAGAAAAAQAAAAUAAAAPAAAACwAAAAkAAAAOAAAAAwAAAAwAAAANAEHEDQu5CgEAAAACAAAAAwAAAAQAAAAFAAAABgAAAAcAAAAIAAAACQAAAAoAAAALAAAADAAAAA0AAAAOAAAADwAAAA4AAAAKAAAABAAAAAgAAAAJAAAADwAAAA0AAAAGAAAAAQAAAAwAAAAAAAAAAgAAAAsAAAAHAAAABQAAAAMAAAAtKyAgIDBYMHgAJWx1AE91dHB1dCBpcyB0b28gc2hvcnQAU2FsdCBpcyB0b28gc2hvcnQAU2VjcmV0IGlzIHRvbyBzaG9ydABQYXNzd29yZCBpcyB0b28gc2hvcnQAQXNzb2NpYXRlZCBkYXRhIGlzIHRvbyBzaG9ydABTb21lIG9mIGVuY29kZWQgcGFyYW1ldGVycyBhcmUgdG9vIGxvbmcgb3IgdG9vIHNob3J0AE1pc3NpbmcgYXJndW1lbnRzAFRvbyBtYW55IGxhbmVzAFRvbyBmZXcgbGFuZXMAVG9vIG1hbnkgdGhyZWFkcwBOb3QgZW5vdWdoIHRocmVhZHMATWVtb3J5IGFsbG9jYXRpb24gZXJyb3IATWVtb3J5IGNvc3QgaXMgdG9vIHNtYWxsAFRpbWUgY29zdCBpcyB0b28gc21hbGwAYXJnb24yaQBBcmdvbjJpAFRoZSBwYXNzd29yZCBkb2VzIG5vdCBtYXRjaCB0aGUgc3VwcGxpZWQgaGFzaABPdXRwdXQgcG9pbnRlciBtaXNtYXRjaABPdXRwdXQgaXMgdG9vIGxvbmcAU2FsdCBpcyB0b28gbG9uZwBTZWNyZXQgaXMgdG9vIGxvbmcAUGFzc3dvcmQgaXMgdG9vIGxvbmcAQXNzb2NpYXRlZCBkYXRhIGlzIHRvbyBsb25nAFRocmVhZGluZyBmYWlsdXJlAE1lbW9yeSBjb3N0IGlzIHRvbyBsYXJnZQBUaW1lIGNvc3QgaXMgdG9vIGxhcmdlAFVua25vd24gZXJyb3IgY29kZQBhcmdvbjJpZABBcmdvbjJpZABFbmNvZGluZyBmYWlsZWQARGVjb2RpbmcgZmFpbGVkAGFyZ29uMmQAQXJnb24yZABBcmdvbjJfQ29udGV4dCBjb250ZXh0IGlzIE5VTEwAT3V0cHV0IHBvaW50ZXIgaXMgTlVMTABUaGUgYWxsb2NhdGUgbWVtb3J5IGNhbGxiYWNrIGlzIE5VTEwAVGhlIGZyZWUgbWVtb3J5IGNhbGxiYWNrIGlzIE5VTEwAT0sAJHY9ACx0PQAscD0AJG09AFRoZXJlIGlzIG5vIHN1Y2ggdmVyc2lvbiBvZiBBcmdvbjIAU2FsdCBwb2ludGVyIGlzIE5VTEwsIGJ1dCBzYWx0IGxlbmd0aCBpcyBub3QgMABTZWNyZXQgcG9pbnRlciBpcyBOVUxMLCBidXQgc2VjcmV0IGxlbmd0aCBpcyBub3QgMABQYXNzd29yZCBwb2ludGVyIGlzIE5VTEwsIGJ1dCBwYXNzd29yZCBsZW5ndGggaXMgbm90IDAAQXNzb2NpYXRlZCBkYXRhIHBvaW50ZXIgaXMgTlVMTCwgYnV0IGFkIGxlbmd0aCBpcyBub3QgMAAobnVsbCkAAACbCAAAuwcAAEkJAADACQAAsAkAAPAHAAAfCAAAMAgAAMkIAABvCgAA4AkAABYKAAA7CgAAQwgAACsLAADBCgAAkgoAAPQKAAACCAAAEQgAAFsJAABbCAAAdAkAAHQIAAAFCQAAdAcAAC0JAACeBwAA9AgAAGIHAAAYCQAAiAcAAOEIAABOBwAA/wkAAFwKAAABAEGkGAsBAgBByxgLBf//////AEGQGQtBEQAKABEREQAAAAAFAAAAAAAACQAAAAALAAAAAAAAAAARAA8KERERAwoHAAEACQsLAAAJBgsAAAsABhEAAAAREREAQeEZCyELAAAAAAAAAAARAAoKERERAAoAAAIACQsAAAAJAAsAAAsAQZsaCwEMAEGnGgsVDAAAAAAMAAAAAAkMAAAAAAAMAAAMAEHVGgsBDgBB4RoLFQ0AAAAEDQAAAAAJDgAAAAAADgAADgBBjxsLARAAQZsbCx4PAAAAAA8AAAAACRAAAAAAABAAABAAABIAAAASEhIAQdIbCw4SAAAAEhISAAAAAAAACQBBgxwLAQsAQY8cCxUKAAAAAAoAAAAACQsAAAAAAAsAAAsAQb0cCwEMAEHJHAsnDAAAAAAMAAAAAAkMAAAAAAAMAAAMAAAwMTIzNDU2Nzg5QUJDREVGAEHwHAsBAQBBoB4LAogPAEHYHgsDkBFQ"},145:()=>{},967:()=>{}},B={};function Q(A){var I=B[A];if(void 0!==I)return I.exports;var C=B[A]={exports:{}};return g[A].call(C.exports,C,C.exports,Q),C.exports}return I=Object.getPrototypeOf?A=>Object.getPrototypeOf(A):A=>A.__proto__,Q.t=function(g,B){if(1&B&&(g=this(g)),8&B)return g;if("object"==typeof g&&g){if(4&B&&g.__esModule)return g;if(16&B&&"function"==typeof g.then)return g}var C=Object.create(null);Q.r(C);var E={};A=A||[null,I({}),I([]),I(I)];for(var i=2&B&&g;"object"==typeof i&&!~A.indexOf(i);i=I(i))Object.getOwnPropertyNames(i).forEach((A=>E[A]=()=>g[A]));return E.default=()=>g,Q.d(C,E),C},Q.d=(A,I)=>{for(var g in I)Q.o(I,g)&&!Q.o(A,g)&&Object.defineProperty(A,g,{enumerable:!0,get:I[g]})},Q.o=(A,I)=>Object.prototype.hasOwnProperty.call(A,I),Q.r=A=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(A,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(A,"__esModule",{value:!0})},Q(631)})()}));
\ No newline at end of file
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm
new file mode 100755
index 0000000..75c3111
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/static/vendor/argon2.wasm