@cello-protocol/daemon 0.0.181 → 0.0.183

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (197) hide show
  1. package/dist/agent-id-migration.d.ts +9 -0
  2. package/dist/agent-id-migration.d.ts.map +1 -1
  3. package/dist/agent-id-migration.js +73 -1
  4. package/dist/agent-id-migration.js.map +1 -1
  5. package/dist/agent-selection.d.ts +73 -0
  6. package/dist/agent-selection.d.ts.map +1 -0
  7. package/dist/agent-selection.js +80 -0
  8. package/dist/agent-selection.js.map +1 -0
  9. package/dist/agent-settings-keys.d.ts.map +1 -1
  10. package/dist/agent-settings-keys.js +18 -0
  11. package/dist/agent-settings-keys.js.map +1 -1
  12. package/dist/assignment-verify.d.ts +62 -0
  13. package/dist/assignment-verify.d.ts.map +1 -0
  14. package/dist/assignment-verify.js +185 -0
  15. package/dist/assignment-verify.js.map +1 -0
  16. package/dist/backup-restore.d.ts +102 -0
  17. package/dist/backup-restore.d.ts.map +1 -0
  18. package/dist/backup-restore.js +340 -0
  19. package/dist/backup-restore.js.map +1 -0
  20. package/dist/bin/cello-daemon.js +91 -49
  21. package/dist/bin/cello-daemon.js.map +1 -1
  22. package/dist/close-commitment.d.ts +67 -0
  23. package/dist/close-commitment.d.ts.map +1 -0
  24. package/dist/close-commitment.js +78 -0
  25. package/dist/close-commitment.js.map +1 -0
  26. package/dist/close-session-handler.d.ts +20 -0
  27. package/dist/close-session-handler.d.ts.map +1 -1
  28. package/dist/close-session-handler.js +351 -58
  29. package/dist/close-session-handler.js.map +1 -1
  30. package/dist/consortium-bootstrap.d.ts +2 -0
  31. package/dist/consortium-bootstrap.d.ts.map +1 -1
  32. package/dist/consortium-bootstrap.js +182 -9
  33. package/dist/consortium-bootstrap.js.map +1 -1
  34. package/dist/content-encryption-status.d.ts +97 -0
  35. package/dist/content-encryption-status.d.ts.map +1 -0
  36. package/dist/content-encryption-status.js +122 -0
  37. package/dist/content-encryption-status.js.map +1 -0
  38. package/dist/content-park-client.d.ts +10 -0
  39. package/dist/content-park-client.d.ts.map +1 -1
  40. package/dist/content-park-client.js +84 -3
  41. package/dist/content-park-client.js.map +1 -1
  42. package/dist/content-park.d.ts.map +1 -1
  43. package/dist/content-park.js +323 -21
  44. package/dist/content-park.js.map +1 -1
  45. package/dist/daemon.d.ts +13 -1
  46. package/dist/daemon.d.ts.map +1 -1
  47. package/dist/daemon.js +1168 -141
  48. package/dist/daemon.js.map +1 -1
  49. package/dist/delivery-session-suspects.d.ts.map +1 -1
  50. package/dist/delivery-session-suspects.js +5 -0
  51. package/dist/delivery-session-suspects.js.map +1 -1
  52. package/dist/directory-auth-posture.d.ts +87 -0
  53. package/dist/directory-auth-posture.d.ts.map +1 -0
  54. package/dist/directory-auth-posture.js +134 -0
  55. package/dist/directory-auth-posture.js.map +1 -0
  56. package/dist/directory-bootstrap.d.ts +66 -3
  57. package/dist/directory-bootstrap.d.ts.map +1 -1
  58. package/dist/directory-bootstrap.js +133 -7
  59. package/dist/directory-bootstrap.js.map +1 -1
  60. package/dist/document-delivery-transport.d.ts +22 -2
  61. package/dist/document-delivery-transport.d.ts.map +1 -1
  62. package/dist/document-delivery-transport.js +11 -3
  63. package/dist/document-delivery-transport.js.map +1 -1
  64. package/dist/document-handlers.d.ts.map +1 -1
  65. package/dist/document-handlers.js +119 -0
  66. package/dist/document-handlers.js.map +1 -1
  67. package/dist/document-layer.d.ts +0 -2
  68. package/dist/document-layer.d.ts.map +1 -1
  69. package/dist/document-layer.js.map +1 -1
  70. package/dist/inbound-sessions.d.ts +31 -1
  71. package/dist/inbound-sessions.d.ts.map +1 -1
  72. package/dist/inbound-sessions.js +276 -16
  73. package/dist/inbound-sessions.js.map +1 -1
  74. package/dist/index.d.ts +2 -0
  75. package/dist/index.d.ts.map +1 -1
  76. package/dist/index.js +3 -0
  77. package/dist/index.js.map +1 -1
  78. package/dist/initiate-session-handler.d.ts.map +1 -1
  79. package/dist/initiate-session-handler.js +34 -3
  80. package/dist/initiate-session-handler.js.map +1 -1
  81. package/dist/ipc-server.d.ts +5 -1
  82. package/dist/ipc-server.d.ts.map +1 -1
  83. package/dist/ipc-server.js +19 -3
  84. package/dist/ipc-server.js.map +1 -1
  85. package/dist/manifest-deps.d.ts +0 -11
  86. package/dist/manifest-deps.d.ts.map +1 -1
  87. package/dist/manifest-deps.js +28 -2
  88. package/dist/manifest-deps.js.map +1 -1
  89. package/dist/manifest-validity.d.ts +153 -0
  90. package/dist/manifest-validity.d.ts.map +1 -0
  91. package/dist/manifest-validity.js +268 -0
  92. package/dist/manifest-validity.js.map +1 -0
  93. package/dist/notification-handlers.d.ts.map +1 -1
  94. package/dist/notification-handlers.js +15 -0
  95. package/dist/notification-handlers.js.map +1 -1
  96. package/dist/outbound-sessions.d.ts +31 -0
  97. package/dist/outbound-sessions.d.ts.map +1 -1
  98. package/dist/outbound-sessions.js +217 -17
  99. package/dist/outbound-sessions.js.map +1 -1
  100. package/dist/park-envelope.d.ts +95 -1
  101. package/dist/park-envelope.d.ts.map +1 -1
  102. package/dist/park-envelope.js +195 -4
  103. package/dist/park-envelope.js.map +1 -1
  104. package/dist/refusal-reasons.d.ts +72 -0
  105. package/dist/refusal-reasons.d.ts.map +1 -0
  106. package/dist/refusal-reasons.js +69 -0
  107. package/dist/refusal-reasons.js.map +1 -0
  108. package/dist/register-handler.d.ts.map +1 -1
  109. package/dist/register-handler.js +76 -0
  110. package/dist/register-handler.js.map +1 -1
  111. package/dist/registration-manager.d.ts.map +1 -1
  112. package/dist/registration-manager.js +20 -1
  113. package/dist/registration-manager.js.map +1 -1
  114. package/dist/relay-only.d.ts +133 -0
  115. package/dist/relay-only.d.ts.map +1 -0
  116. package/dist/relay-only.js +183 -0
  117. package/dist/relay-only.js.map +1 -0
  118. package/dist/restart-seal-resolver.d.ts.map +1 -1
  119. package/dist/restart-seal-resolver.js +6 -0
  120. package/dist/restart-seal-resolver.js.map +1 -1
  121. package/dist/retry-queue.d.ts +49 -2
  122. package/dist/retry-queue.d.ts.map +1 -1
  123. package/dist/retry-queue.js +55 -10
  124. package/dist/retry-queue.js.map +1 -1
  125. package/dist/roster-freshness.d.ts +169 -0
  126. package/dist/roster-freshness.d.ts.map +1 -0
  127. package/dist/roster-freshness.js +249 -0
  128. package/dist/roster-freshness.js.map +1 -0
  129. package/dist/seal-certificate-pull.d.ts +17 -1
  130. package/dist/seal-certificate-pull.d.ts.map +1 -1
  131. package/dist/seal-certificate-pull.js +37 -3
  132. package/dist/seal-certificate-pull.js.map +1 -1
  133. package/dist/seal-coordinator.d.ts +17 -1
  134. package/dist/seal-coordinator.d.ts.map +1 -1
  135. package/dist/seal-coordinator.js +71 -0
  136. package/dist/seal-coordinator.js.map +1 -1
  137. package/dist/seal-failure-store.d.ts +104 -0
  138. package/dist/seal-failure-store.d.ts.map +1 -0
  139. package/dist/seal-failure-store.js +126 -0
  140. package/dist/seal-failure-store.js.map +1 -0
  141. package/dist/seal-flows.d.ts.map +1 -1
  142. package/dist/seal-flows.js +35 -6
  143. package/dist/seal-flows.js.map +1 -1
  144. package/dist/seal-upgrade.d.ts +20 -5
  145. package/dist/seal-upgrade.d.ts.map +1 -1
  146. package/dist/seal-upgrade.js +28 -5
  147. package/dist/seal-upgrade.js.map +1 -1
  148. package/dist/session-assignment-parser.d.ts +41 -5
  149. package/dist/session-assignment-parser.d.ts.map +1 -1
  150. package/dist/session-assignment-parser.js +77 -14
  151. package/dist/session-assignment-parser.js.map +1 -1
  152. package/dist/session-ceremony.d.ts +35 -0
  153. package/dist/session-ceremony.d.ts.map +1 -1
  154. package/dist/session-ceremony.js +97 -0
  155. package/dist/session-ceremony.js.map +1 -1
  156. package/dist/session-connection-gater.d.ts +46 -7
  157. package/dist/session-connection-gater.d.ts.map +1 -1
  158. package/dist/session-connection-gater.js +163 -12
  159. package/dist/session-connection-gater.js.map +1 -1
  160. package/dist/session-content-handlers.d.ts +12 -0
  161. package/dist/session-content-handlers.d.ts.map +1 -1
  162. package/dist/session-content-handlers.js +149 -8
  163. package/dist/session-content-handlers.js.map +1 -1
  164. package/dist/session-node-manager.d.ts +653 -40
  165. package/dist/session-node-manager.d.ts.map +1 -1
  166. package/dist/session-node-manager.js +5938 -374
  167. package/dist/session-node-manager.js.map +1 -1
  168. package/dist/session-read-handlers.d.ts +27 -0
  169. package/dist/session-read-handlers.d.ts.map +1 -1
  170. package/dist/session-read-handlers.js +127 -6
  171. package/dist/session-read-handlers.js.map +1 -1
  172. package/dist/session-relay-client.d.ts +177 -2
  173. package/dist/session-relay-client.d.ts.map +1 -1
  174. package/dist/session-relay-client.js +564 -16
  175. package/dist/session-relay-client.js.map +1 -1
  176. package/dist/session-salt-agreement.d.ts +338 -0
  177. package/dist/session-salt-agreement.d.ts.map +1 -0
  178. package/dist/session-salt-agreement.js +478 -0
  179. package/dist/session-salt-agreement.js.map +1 -0
  180. package/dist/signal-submission.d.ts.map +1 -1
  181. package/dist/signal-submission.js +10 -1
  182. package/dist/signal-submission.js.map +1 -1
  183. package/dist/signaling-connect.d.ts +18 -1
  184. package/dist/signaling-connect.d.ts.map +1 -1
  185. package/dist/signaling-connect.js +206 -6
  186. package/dist/signaling-connect.js.map +1 -1
  187. package/dist/types.d.ts +75 -0
  188. package/dist/types.d.ts.map +1 -1
  189. package/dist/types.js.map +1 -1
  190. package/dist/vocabulary.d.ts.map +1 -1
  191. package/dist/vocabulary.js +10 -0
  192. package/dist/vocabulary.js.map +1 -1
  193. package/dist/wire-content-hash.d.ts +68 -0
  194. package/dist/wire-content-hash.d.ts.map +1 -1
  195. package/dist/wire-content-hash.js +83 -0
  196. package/dist/wire-content-hash.js.map +1 -1
  197. package/package.json +5 -5
@@ -15,6 +15,7 @@ import type { SessionNodeManager } from "./session-node-manager.js";
15
15
  import type { Logger } from "./types.js";
16
16
  import type { ConnState } from "./contact-handlers.js";
17
17
  import { type FrontierMismatchStore } from "./frontier-mismatch.js";
18
+ import { type SealFailure } from "./seal-failure-store.js";
18
19
  export interface SessionReadDeps {
19
20
  /** DOD-FRONTIER-STRAND-1 AC3: retained mismatches, surfaced on the session LIST (the AC's surface). */
20
21
  frontierMismatches: FrontierMismatchStore;
@@ -32,6 +33,31 @@ export interface SessionReadDeps {
32
33
  who: string;
33
34
  whoKnown: boolean;
34
35
  };
36
+ /**
37
+ * Is a seal ceremony in flight for this session — `DOD-M15-CLOSEWAIT-1` review HIGH-2.
38
+ *
39
+ * `cello_status` has carried this since `DOD-M12B-CLOSE-SILENT-WAIT-1`; the session LIST never
40
+ * did, and before CLOSEWAIT-1 nobody could observe the gap because the caller was blocked for the
41
+ * whole ceremony. Now "committed, notarizing in the background" is the normal state for up to
42
+ * eleven minutes — and without this the agent's own session list is byte-identical to a session it
43
+ * never closed. The likely agent response is to close again, which lands on a refusal.
44
+ *
45
+ * The DoD's own counterbalance clause requires it: *"the session must keep reading as sealing
46
+ * until it is not."*
47
+ */
48
+ isSealing: (agentName: string, sessionId: string) => boolean;
49
+ /**
50
+ * DOD-M15-SEAL-FAILED-TERMINAL-1: the last background ceremony failure, if one is remembered.
51
+ *
52
+ * Checked AFTER `isSealing` — a running ceremony outranks an old verdict, because a re-close is
53
+ * the remedy and its marker is cleared on start.
54
+ */
55
+ /**
56
+ * REQUIRED — review HIGH-3. As an optional dep, deleting the daemon's wiring for it left tests,
57
+ * lint and typecheck green while the whole unit was inert. One composition root; make the
58
+ * compiler catch it.
59
+ */
60
+ getSealFailure: (agentName: string, sessionId: string) => SealFailure | undefined;
35
61
  /** Never vaults a cursor/watermark past a hole in the delivered sequence. */
36
62
  safeCursorAdvance: (connectionId: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
37
63
  safeWatermarkAdvance: (agentName: string, sessionId: string, deliveredSeqs: ReadonlySet<number>) => void;
@@ -54,6 +80,7 @@ export interface SessionReadDeps {
54
80
  pullSealCertificate?: (agentName: string, sessionIdHex: string) => Promise<{
55
81
  ok: boolean;
56
82
  reason?: string;
83
+ verified?: boolean;
57
84
  }>;
58
85
  }
59
86
  export declare function registerSessionReadHandlers(deps: SessionReadDeps): void;
@@ -1 +1 @@
1
- {"version":3,"file":"session-read-handlers.d.ts","sourceRoot":"","sources":["../src/session-read-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAwD,MAAM,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE5F,MAAM,WAAW,eAAe;IAC9B,uGAAuG;IACvG,kBAAkB,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,6FAA6F;IAC7F,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/G,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzG,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzG;;;;;OAKG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,wBAAwB,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAuXvE"}
1
+ {"version":3,"file":"session-read-handlers.d.ts","sourceRoot":"","sources":["../src/session-read-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAwD,MAAM,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAG/E,MAAM,WAAW,eAAe;IAC9B,uGAAuG;IACvG,kBAAkB,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,YAAY,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,GAAG,SAAS,CAAC;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjG,yBAAyB,EAAE,OAAO,CAAC;IACnC,6FAA6F;IAC7F,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/G;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7D;;;;;OAKG;IACH;;;;OAIG;IACH,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAClF,6EAA6E;IAC7E,iBAAiB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzG,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACzG;;;;;OAKG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/C,wBAAwB,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CACpB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACpE;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAmfvE"}
@@ -1,8 +1,10 @@
1
1
  import { classifySession } from "./session-category.js";
2
2
  import { validateSessionName } from "./session-name.js";
3
3
  import { renderFrontierMismatch } from "./frontier-mismatch.js";
4
+ import { describeSealFailed } from "./seal-failure-store.js";
5
+ import { contentEncryptionGuidanceFor } from "./content-encryption-status.js";
4
6
  export function registerSessionReadHandlers(deps) {
5
- const { handlers, logger, sessionNodeManager, loadedAgents, getConnState, resolveCurrentAgent, NO_CURRENT_AGENT_RESPONSE, resolveWho, safeCursorAdvance, safeWatermarkAdvance, attendanceCount, reapDeadHalfOpenSessions, frontierMismatches, } = deps;
7
+ const { handlers, logger, sessionNodeManager, loadedAgents, getConnState, resolveCurrentAgent, NO_CURRENT_AGENT_RESPONSE, resolveWho, safeCursorAdvance, safeWatermarkAdvance, attendanceCount, reapDeadHalfOpenSessions, frontierMismatches, isSealing, getSealFailure, } = deps;
6
8
  // ─── M7-SESSION-004 (AC-005/AC-006): read the sealed certificate's legibility ───
7
9
  // The cert-read surface: returns the receipt-not-assent certificate for a sealed session —
8
10
  // per-party content frontiers, attestation modes, and whether the final message was answered.
@@ -44,12 +46,30 @@ export function registerSessionReadHandlers(deps) {
44
46
  // (content AND the control leaves the seal itself appends). `content_leaf_count` is the
45
47
  // messages, and it is the one comparable to a transcript length — conflating them would make
46
48
  // the check drift by the number of ctrl leaves and read as a defect when nothing is wrong.
47
- const leaves = sessionNodeManager.getSessionTree(agentName, sessionId).leaves();
49
+ const tree = sessionNodeManager.getSessionTree(agentName, sessionId);
50
+ const leaves = tree.leaves();
48
51
  return {
49
52
  ok: true,
50
53
  session_id: sessionId,
51
54
  session_name: sessionName,
52
55
  sealed_root: cert.sealed_root,
56
+ /**
57
+ * DOD-M15-SEALWIRE-1 bullet 8: THIS SIDE'S OWN ROOT, computed from its own leaves — never
58
+ * copied from the certificate.
59
+ *
60
+ * `sealed_root` above is the CERTIFICATE's root. Every spine journey asserted that both
61
+ * parties' `sealed_root` matched, and that assertion is hollow: both sides read the same
62
+ * field out of the same certificate, so it stays green **even if the directory certified a
63
+ * root over a completely different leaf set than the one either party actually holds**. It
64
+ * proves the two clients received identical bytes, which was never the question.
65
+ *
66
+ * The question is whether the certificate covers THIS party's conversation. Only a root
67
+ * derived locally can answer that, and until now nothing exposed one — so no test could
68
+ * make the assertion, which is why ten of them made the weaker one instead.
69
+ *
70
+ * Read-only and derived: `rootHex()` recomputes from the stored leaves.
71
+ */
72
+ local_tree_root: tree.rootHex(),
53
73
  leaf_count: leaves.length,
54
74
  content_leaf_count: leaves.filter((l) => l.kind === "msg").length,
55
75
  legibility: cert.legibility,
@@ -65,8 +85,18 @@ export function registerSessionReadHandlers(deps) {
65
85
  // apart: the session genuinely has not sealed, or it sealed and the `session_sealed` push never
66
86
  // reached this daemon. The second is the divergence, and answering `not_sealed_yet` for it is
67
87
  // how an operator got sent round the loop into a force-abandon that destroyed their half of a
68
- // receipt that existed. The pull is what distinguishes them — and it distinguishes them by
69
- // VERIFYING a certificate, not by trusting an answer.
88
+ // receipt that existed. The pull is what distinguishes them — and it does so by fetching a
89
+ // certificate rather than trusting an answer.
90
+ //
91
+ // ⚠️ IT DOES NOT ALWAYS VERIFY IT, and this comment used to say it did (review N3). The pull
92
+ // refuses a certificate whose signature FAILS. It ACCEPTS one whose signature it cannot check
93
+ // at all — when this daemon holds no key for the signer — and that case stopped being rare
94
+ // once `cello_contact_remove` began clearing a counterparty's pinned identity.
95
+ //
96
+ // Logging that was not enough (review F5). The response below is what the AGENT reads, and it
97
+ // used to be byte-for-byte identical either way — so an operator could clear a contact, pull
98
+ // an old receipt, and hand it to a third party as proof. It is not proof. `verified` now rides
99
+ // on the response, with guidance naming the way back.
70
100
  if (deps.pullSealCertificate) {
71
101
  const pulled = await deps.pullSealCertificate(agentName, sessionId);
72
102
  if (pulled.ok) {
@@ -86,15 +116,64 @@ export function registerSessionReadHandlers(deps) {
86
116
  leaf_count: recoveredLeaves.length,
87
117
  content_leaf_count: recoveredLeaves.filter((l) => l.kind === "msg").length,
88
118
  legibility: recovered.legibility,
119
+ verified: pulled.verified === true,
120
+ ...(pulled.verified === true
121
+ ? {}
122
+ : {
123
+ verification_note: "THIS RECEIPT'S SIGNATURE WAS NOT CHECKED. It was recovered from the directory " +
124
+ "and recorded on the counterparty's word, because this agent holds no signing " +
125
+ "key for them — most often because their pinned identity was cleared with " +
126
+ "cello_contact_remove. Do not present it to a third party as proof.",
127
+ guidance: "To get a verifiable receipt: start a new session with them, which re-pins " +
128
+ "their identity, then ask them to re-seal. Nothing is wrong with the session " +
129
+ "itself — only with what this side can independently prove about it.",
130
+ }),
89
131
  };
90
132
  }
91
133
  }
92
134
  }
93
- // The session is THIS agent's — it simply has no seal certificate yet.
135
+ /**
136
+ * IS THE CEREMONY STILL RUNNING? — `DOD-M15-CLOSEWAIT-1` review HIGH-1.
137
+ *
138
+ * `not_sealed_yet` used to mean one thing, because the close blocked until the ceremony ended:
139
+ * if you were reading this, nothing was in flight. CLOSEWAIT-1 made "committed, notarizing in
140
+ * the background" the normal state for up to eleven minutes, and this answer could not tell
141
+ * that apart from "it finished and failed" — while the daemon knew, in the very maps
142
+ * `cello_status` already reads.
143
+ *
144
+ * Worse, the remedy below became UNREACHABLE by the same change: it says *"close it and
145
+ * confirm it reports sealed"*, and a close can no longer report sealed on this path. The two
146
+ * surfaces contradicted each other — the close said an empty answer means "still running, not
147
+ * failed", this one called it a known daemon defect.
148
+ */
149
+ if (isSealing(agentName, sessionId)) {
150
+ return {
151
+ ok: false,
152
+ reason: "seal_in_progress",
153
+ seal_status: "committed",
154
+ guidance: "The seal ceremony for this session is RUNNING RIGHT NOW — this is not a failure and " +
155
+ "there is nothing to retry. Your SEAL commitment is recorded; the receipt appears here " +
156
+ "once the counterparty co-closes, or after the escalation to a unilateral seal. Wait and " +
157
+ "call cello_sealed_receipt again. Do NOT close again (it will be refused as already in " +
158
+ "progress) and do NOT use { force: true } — forcing ABANDONS the session and forfeits " +
159
+ "the receipt this ceremony is about to produce.",
160
+ };
161
+ }
162
+ /**
163
+ * DOD-M15-SEAL-FAILED-TERMINAL-1 — a ceremony that DIED, which is neither of the two states
164
+ * above. Ordering is load-bearing: `isSealing` was checked first, so a re-close that started a
165
+ * fresh ceremony reports as running rather than as the old failure.
166
+ */
167
+ const failure = getSealFailure(agentName, sessionId);
168
+ if (failure)
169
+ return describeSealFailed({ sessionId, failure });
170
+ // The session is THIS agent's — it simply has no seal certificate yet, no ceremony is running
171
+ // for it, and none is remembered as having failed.
94
172
  return {
95
173
  ok: false,
96
174
  reason: "not_sealed_yet",
97
- guidance: "This session exists but is not sealed yet. Close it with cello_close_session and confirm it reports sealed (or wait for the counterparty to co-seal), then retry. " +
175
+ guidance: "This session exists but is not sealed yet, and no seal ceremony is currently running for it. " +
176
+ "Close it with cello_close_session (it will answer immediately with seal_status \"committed\" and notarize in the background), then retry this once that finishes. " +
98
177
  "IF cello_close_session ALREADY reported session_already_sealed, do not close again — both answers are true and they point at each other. The seal completion never reached this side, so no local certificate exists and none can be produced here. " +
99
178
  "Do NOT use { force: true } to break out: it PERMANENTLY forfeits this side's half, and a receipt you cannot yet verify is still recoverable where a forfeited one never is. Leave the session as it is and tell the operator the session id and the counterparty's pubkey — this is a known daemon defect (the seal completion is pushed with no pull twin), not an error they caused.",
100
179
  };
@@ -227,6 +306,23 @@ export function registerSessionReadHandlers(deps) {
227
306
  ...resolveWho(row.agent_name, row.counterparty_pubkey, row.session_id),
228
307
  status: row.status,
229
308
  category,
309
+ // DOD-M15-REFUSED-INBOUND-SILENT-1: surfaced only when NOT salted. `selectSessions` is a
310
+ // WHITELIST — adding the field to the session record alone left it invisible here, which is
311
+ // the no-reader defect this whole line is about, reproduced inside the fix for it.
312
+ ...(row.content_hashes_salted === false ? { contentHashesSalted: false } : {}),
313
+ // 006-CRYPTO: same whitelist, same trap — a field on the record alone never reaches the agent.
314
+ // Carries the GUIDANCE, not the reason code: the code is for a log, and an agent reading this
315
+ // has to be able to tell an operator what it means without looking anything up.
316
+ ...(row.content_encrypted === false
317
+ ? {
318
+ contentEncrypted: false,
319
+ ...(row.content_encryption_reason
320
+ ? { contentEncryptionGuidance: contentEncryptionGuidanceFor(row.content_encryption_reason) }
321
+ : {}),
322
+ }
323
+ : {}),
324
+ // Review HIGH-2: present only while a ceremony is actually in flight, so it stays a signal.
325
+ ...(isSealing(row.agent_name, row.session_id) ? { sealing: true } : {}),
230
326
  messageCount,
231
327
  createdAt: new Date(row.created_at).toISOString(),
232
328
  updatedAt: new Date(row.updated_at).toISOString(),
@@ -243,6 +339,31 @@ export function registerSessionReadHandlers(deps) {
243
339
  const m = frontierMismatches.get(row.agent_name, row.session_id);
244
340
  return m ? { frontierMismatch: renderFrontierMismatch(m, row.session_id) } : {};
245
341
  })(),
342
+ /**
343
+ * `DOD-M15-SEALWIRE-1` — THE STATE THE INVARIANT ASKED FOR, and it is a FIELD, not an alert.
344
+ *
345
+ * B2b-2 turned salting on. When a session cannot agree a salt it falls back to the hashing
346
+ * every shipped build uses and logs `session.content.unsalted` once — which satisfies the
347
+ * "loud in the log" half of the invariant and nothing at all of the "and in the agent
348
+ * response" half. An operator reading tool output had no way to tell a protected conversation
349
+ * from an unprotected one.
350
+ *
351
+ * ⚠️ PRESENT ON EVERY ROW, INCLUDING THE TRUE ONE — the one place this list breaks its own
352
+ * present-only-when-interesting convention (`sealing`, `frontierMismatch`), and deliberately.
353
+ * Those two say *something is happening*; absence means nothing is. This says *what protects
354
+ * this conversation*, and for that, absence is unreadable: a missing field on an older daemon
355
+ * and a missing field meaning "unprotected" would look identical, which is the collapse
356
+ * Decision #15 spends a whole wire discriminator avoiding. A security property must not be
357
+ * inferable from a gap.
358
+ *
359
+ * Deliberately NOT urgent, per the DoD: an unsalted session is exactly as verifiable as every
360
+ * session shipped before the feature existed. This is the difference between *knowing* and
361
+ * *working*, and it costs one boolean per row rather than an event per message.
362
+ */
363
+ // `isContentSaltActive`, NOT `getSessionContentSalt` — pass 2, F3. Possession is not
364
+ // protection: a SUSPENDED session still holds its salt and deliberately does not use it, so
365
+ // the possession read reported `true` for a session hashing sha256 on every message.
366
+ contentSalted: sessionNodeManager.isContentSaltActive(row.agent_name, row.session_id),
246
367
  }));
247
368
  return { ok: true, filter, limit, totalMatched: matched.length, sessions };
248
369
  }
@@ -1 +1 @@
1
- {"version":3,"file":"session-read-handlers.js","sourceRoot":"","sources":["../src/session-read-handlers.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAA8B,MAAM,wBAAwB,CAAC;AAoC5F,MAAM,UAAU,2BAA2B,CAAC,IAAqB;IAC/D,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EACrF,yBAAyB,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAC/F,wBAAwB,EACtB,kBAAkB,GACvB,GAAG,IAAI,CAAC;IAEP,mFAAmF;IACnF,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,0FAA0F;IAC1F,uFAAuF;IACvF,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACtE,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,CAAuB,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,+FAA+F,EAAE,CAAC;QAChK,CAAC;QACD,0FAA0F;QAC1F,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,4FAA4F;QAC5F,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,IAAI,EAAE,CAAC;YACT,4FAA4F;YAC5F,4FAA4F;YAC5F,gEAAgE;YAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;YACpG,mEAAmE;YACnE,EAAE;YACF,6FAA6F;YAC7F,2FAA2F;YAC3F,6FAA6F;YAC7F,2FAA2F;YAC3F,0EAA0E;YAC1E,EAAE;YACF,8FAA8F;YAC9F,wFAAwF;YACxF,6FAA6F;YAC7F,2FAA2F;YAC3F,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;YAChF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;gBACjE,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,2FAA2F;QAC3F,qGAAqG;QACrG,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,wEAAwE;YACxE,EAAE;YACF,4FAA4F;YAC5F,gGAAgG;YAChG,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,sDAAsD;YACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAC9E,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,aAAa,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;wBACtG,MAAM,eAAe,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;wBACzF,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;4BAChD,SAAS,EAAE,SAAS;4BACpB,MAAM,EAAE,8EAA8E;yBACvF,CAAC,CAAC;wBACH,OAAO;4BACL,EAAE,EAAE,IAAI;4BACR,UAAU,EAAE,SAAS;4BACrB,YAAY,EAAE,aAAa;4BAC3B,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,UAAU,EAAE,eAAe,CAAC,MAAM;4BAClC,kBAAkB,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;4BAC1E,UAAU,EAAE,SAAS,CAAC,UAAU;yBACjC,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uEAAuE;YACvE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EACN,oKAAoK;oBACpK,sPAAsP;oBACtP,wXAAwX;aAC3X,CAAC;QACJ,CAAC;QACD,uFAAuF;QACvF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,kCAAkC,KAAK,CAAC,IAAI,6BAA6B,SAAS,4BAA4B,KAAK,CAAC,IAAI,qCAAqC;aACxK,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,MAAM,SAAS,GAAG,kBAAkB;aACjC,mBAAmB,CAAC,SAAS,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7F,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,4HAA4H;aACvI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,wHAAwH;SACnI,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,mGAAmG;IACnG,oGAAoG;IACpG,sGAAsG;IACtG,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,CAAuB,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,4EAA4E,EAAE,CAAC;QAC7I,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,kGAAkG;QAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5F,iGAAiG;QACjG,8DAA8D;QAC9D,+FAA+F;QAC/F,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,iBAAiB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1D,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,mCAAmC;QACnC,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1D,6FAA6F;QAC7F,MAAM,cAAc,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;QACvG,2FAA2F;QAC3F,+FAA+F;QAC/F,4FAA4F;QAC5F,4FAA4F;QAC5F,4BAA4B;QAC5B,EAAE;QACF,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,EAAE;QACF,oFAAoF;QACpF,4FAA4F;QAC5F,6FAA6F;QAC7F,kEAAkE;QAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,KAAc,EAAE,CAAC,CAAC;YACzE,wBAAwB,EACtB,GAAG,KAAK,CAAC,MAAM,+EAA+E;gBAC9F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,oDAAoD;SACvD,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC;IACzK,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,iFAAiF;IACjF,+EAA+E;IAC/E,oEAAoE;IACpE,0FAA0F;IAC1F,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,kBAAkB,GAAG,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;IAC3B,SAAS,cAAc,CACrB,IAAqB,EACrB,MAA2C;QAE3C,MAAM,SAAS,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,MAAM,GACV,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,kBAAkB,CAAC;QACrE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAoB,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAuB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACrG,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,4FAA4F;YAC5F,iGAAiG;YACjG,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,6FAA6F;YAC7F,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,UAAU,CAAC;YACtE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ;YACR,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACjD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACjD,uEAAuE;YACvE,sDAAsD;YACtD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YACzC,0FAA0F;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,iFAAiF;YACjF,4FAA4F;YAC5F,qFAAqF;YACrF,GAAG,CAAC,GAAG,EAAE;gBACP,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,CAAC,CAAC,EAAE;SACL,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7E,CAAC;IAED,0FAA0F;IAC1F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,kGAAkG;QAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,iEAAiE;QACtG,OAAO,cAAc,CACnB,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EACjD,MAA6C,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iGAAiG;IACjG,2FAA2F;IAC3F,gGAAgG;IAChG,mGAAmG;IACnG,mFAAmF;IACnF,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS;YAAE,OAAO,yBAAyB,CAAC;QAEjD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAgC,CAAC;QAC3D,8FAA8F;QAC9F,gGAAgG;QAChG,8CAA8C;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,oGAAoG;aAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,OAAO,EAAE,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ;gBACxG,UAAU,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aACxF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6FAA6F;YAC7F,oDAAoD;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,qGAAqG;aAChH,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,2FAA2F;QAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACpF,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,qFAAqF;IACrF,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS;YAAE,OAAO,yBAAyB,CAAC;QAEjD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAgC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,gEAAgE;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBACpD,CAAC,CAAC,qGAAqG;gBACvG,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,sBAAsB;oBACxC,CAAC,CAAC,oJAAoJ;oBACtJ,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,6FAA6F;IAC7F,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7C,OAAO,cAAc,CACnB,kBAAkB,CAAC,cAAc,EAAE,EACnC,MAA6C,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;AACxE,CAAC"}
1
+ {"version":3,"file":"session-read-handlers.js","sourceRoot":"","sources":["../src/session-read-handlers.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAA8B,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAoB,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAgE9E,MAAM,UAAU,2BAA2B,CAAC,IAAqB;IAC/D,MAAM,EACJ,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EACrF,yBAAyB,EAAE,UAAU,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,EAC/F,wBAAwB,EACtB,kBAAkB,EAClB,SAAS,EAAE,cAAc,GAC9B,GAAG,IAAI,CAAC;IAEP,mFAAmF;IACnF,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,0FAA0F;IAC1F,uFAAuF;IACvF,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACtE,4FAA4F;QAC5F,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,CAAuB,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,+FAA+F,EAAE,CAAC;QAChK,CAAC;QACD,0FAA0F;QAC1F,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,4FAA4F;QAC5F,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,IAAI,EAAE,CAAC;YACT,4FAA4F;YAC5F,4FAA4F;YAC5F,gEAAgE;YAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;YACpG,mEAAmE;YACnE,EAAE;YACF,6FAA6F;YAC7F,2FAA2F;YAC3F,6FAA6F;YAC7F,2FAA2F;YAC3F,0EAA0E;YAC1E,EAAE;YACF,8FAA8F;YAC9F,wFAAwF;YACxF,6FAA6F;YAC7F,2FAA2F;YAC3F,MAAM,IAAI,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,WAAW;gBACzB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B;;;;;;;;;;;;;;;mBAeG;gBACH,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC/B,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;gBACjE,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,2FAA2F;QAC3F,qGAAqG;QACrG,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,wEAAwE;YACxE,EAAE;YACF,4FAA4F;YAC5F,gGAAgG;YAChG,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,8CAA8C;YAC9C,EAAE;YACF,6FAA6F;YAC7F,8FAA8F;YAC9F,2FAA2F;YAC3F,+EAA+E;YAC/E,EAAE;YACF,8FAA8F;YAC9F,6FAA6F;YAC7F,+FAA+F;YAC/F,sDAAsD;YACtD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACpE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,MAAM,SAAS,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAC9E,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,aAAa,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;wBACtG,MAAM,eAAe,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;wBACzF,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;4BAChD,SAAS,EAAE,SAAS;4BACpB,MAAM,EAAE,8EAA8E;yBACvF,CAAC,CAAC;wBACH,OAAO;4BACL,EAAE,EAAE,IAAI;4BACR,UAAU,EAAE,SAAS;4BACrB,YAAY,EAAE,aAAa;4BAC3B,WAAW,EAAE,SAAS,CAAC,WAAW;4BAClC,UAAU,EAAE,eAAe,CAAC,MAAM;4BAClC,kBAAkB,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;4BAC1E,UAAU,EAAE,SAAS,CAAC,UAAU;4BAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,IAAI;4BAClC,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI;gCAC1B,CAAC,CAAC,EAAE;gCACJ,CAAC,CAAC;oCACE,iBAAiB,EACf,gFAAgF;wCAChF,+EAA+E;wCAC/E,2EAA2E;wCAC3E,oEAAoE;oCACtE,QAAQ,EACN,4EAA4E;wCAC5E,8EAA8E;wCAC9E,qEAAqE;iCACxE,CAAC;yBACP,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD;;;;;;;;;;;;;eAaG;YACH,IAAI,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,WAAW,EAAE,WAAW;oBACxB,QAAQ,EACN,sFAAsF;wBACtF,wFAAwF;wBACxF,0FAA0F;wBAC1F,wFAAwF;wBACxF,uFAAuF;wBACvF,gDAAgD;iBACnD,CAAC;YACJ,CAAC;YAED;;;;eAIG;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,OAAO;gBAAE,OAAO,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YAE/D,8FAA8F;YAC9F,mDAAmD;YACnD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EACN,+FAA+F;oBAC/F,oKAAoK;oBACpK,sPAAsP;oBACtP,wXAAwX;aAC3X,CAAC;QACJ,CAAC;QACD,uFAAuF;QACvF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACvH,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,kCAAkC,KAAK,CAAC,IAAI,6BAA6B,SAAS,4BAA4B,KAAK,CAAC,IAAI,qCAAqC;aACxK,CAAC;QACJ,CAAC;QACD,wFAAwF;QACxF,MAAM,SAAS,GAAG,kBAAkB;aACjC,mBAAmB,CAAC,SAAS,CAAC;aAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7F,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,4HAA4H;aACvI,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,iBAAiB;YACzB,QAAQ,EAAE,wHAAwH;SACnI,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,mGAAmG;IACnG,oGAAoG;IACpG,sGAAsG;IACtG,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,YAAY,CAAuB,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,4EAA4E,EAAE,CAAC;QAC7I,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,kGAAkG;QAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5F,iGAAiG;QACjG,8DAA8D;QAC9D,+FAA+F;QAC/F,0FAA0F;QAC1F,6FAA6F;QAC7F,8FAA8F;QAC9F,yFAAyF;QACzF,6FAA6F;QAC7F,6FAA6F;QAC7F,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/D,iBAAiB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1D,6FAA6F;QAC7F,+FAA+F;QAC/F,gGAAgG;QAChG,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,mCAAmC;QACnC,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAC1D,6FAA6F;QAC7F,MAAM,cAAc,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;QACvG,2FAA2F;QAC3F,+FAA+F;QAC/F,4FAA4F;QAC5F,4FAA4F;QAC5F,4BAA4B;QAC5B,EAAE;QACF,+FAA+F;QAC/F,+FAA+F;QAC/F,6BAA6B;QAC7B,EAAE;QACF,oFAAoF;QACpF,4FAA4F;QAC5F,6FAA6F;QAC7F,kEAAkE;QAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,KAAc,EAAE,CAAC,CAAC;YACzE,wBAAwB,EACtB,GAAG,KAAK,CAAC,MAAM,+EAA+E;gBAC9F,6FAA6F;gBAC7F,6FAA6F;gBAC7F,oDAAoD;SACvD,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC;IACzK,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,iFAAiF;IACjF,+EAA+E;IAC/E,oEAAoE;IACpE,0FAA0F;IAC1F,+FAA+F;IAC/F,0FAA0F;IAC1F,4FAA4F;IAC5F,2FAA2F;IAC3F,MAAM,kBAAkB,GAAG,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;IAC3B,SAAS,cAAc,CACrB,IAAqB,EACrB,MAA2C;QAE3C,MAAM,SAAS,GAAG,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,MAAM,MAAM,GACV,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,kBAAkB,CAAC;QACrE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAoB,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC5E,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GACX,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAuB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACrG,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,+FAA+F;YAC/F,+FAA+F;YAC/F,4FAA4F;YAC5F,4FAA4F;YAC5F,iGAAiG;YACjG,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,kBAAkB,EAAE,GAAG,CAAC,mBAAmB;YAC3C,6FAA6F;YAC7F,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,UAAU,CAAC;YACtE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ;YACR,yFAAyF;YACzF,4FAA4F;YAC5F,mFAAmF;YACnF,GAAG,CAAC,GAAG,CAAC,qBAAqB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,+FAA+F;YAC/F,8FAA8F;YAC9F,gFAAgF;YAChF,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,KAAK;gBACjC,CAAC,CAAC;oBACE,gBAAgB,EAAE,KAAc;oBAChC,GAAG,CAAC,GAAG,CAAC,yBAAyB;wBAC/B,CAAC,CAAC,EAAE,yBAAyB,EAAE,4BAA4B,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE;wBAC5F,CAAC,CAAC,EAAE,CAAC;iBACR;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,4FAA4F;YAC5F,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,YAAY;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACjD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE;YACjD,uEAAuE;YACvE,sDAAsD;YACtD,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YACzC,0FAA0F;YAC1F,6FAA6F;YAC7F,4FAA4F;YAC5F,iFAAiF;YACjF,4FAA4F;YAC5F,qFAAqF;YACrF,GAAG,CAAC,GAAG,EAAE;gBACP,MAAM,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBACjE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,CAAC,CAAC,EAAE;YACJ;;;;;;;;;;;;;;;;;;;;eAoBG;YACH,qFAAqF;YACrF,4FAA4F;YAC5F,qFAAqF;YACrF,aAAa,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;SACtF,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7E,CAAC;IAED,0FAA0F;IAC1F,gGAAgG;IAChG,iGAAiG;IACjG,iGAAiG;IACjG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QACjE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,kGAAkG;QAClG,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,iEAAiE;QACtG,OAAO,cAAc,CACnB,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EACjD,MAA6C,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iGAAiG;IACjG,2FAA2F;IAC3F,gGAAgG;IAChG,mGAAmG;IACnG,mFAAmF;IACnF,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS;YAAE,OAAO,yBAAyB,CAAC;QAEjD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAgC,CAAC;QAC3D,8FAA8F;QAC9F,gGAAgG;QAChG,8CAA8C;QAC9C,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,oGAAoG;aAC/G,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,OAAO,EAAE,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ;gBACxG,UAAU,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;aACxF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6FAA6F;YAC7F,oDAAoD;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,qGAAqG;aAChH,CAAC;QACJ,CAAC;QAED,sFAAsF;QACtF,2FAA2F;QAC3F,MAAM,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC;QACpF,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,sFAAsF;IACtF,qFAAqF;IACrF,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAA2B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS;YAAE,OAAO,yBAAyB,CAAC;QAEjD,MAAM,SAAS,GAAG,MAAM,EAAE,UAAgC,CAAC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,gEAAgE;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBACpD,CAAC,CAAC,qGAAqG;gBACvG,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,sBAAsB;oBACxC,CAAC,CAAC,oJAAoJ;oBACtJ,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjF,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,kBAAkB,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,6FAA6F;IAC7F,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7C,OAAO,cAAc,CACnB,kBAAkB,CAAC,cAAc,EAAE,EACnC,MAA6C,CAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,sEAAsE;AACxE,CAAC"}
@@ -24,6 +24,37 @@ export declare const RELAY_AUTH_DOMAIN = "CELLO-RELAY-AUTH-v1";
24
24
  export declare const TERMINAL_RELAY_REFUSALS: ReadonlySet<string>;
25
25
  /** True when the relay has ended this session and no later submit can succeed. */
26
26
  export declare function isTerminalRelayRefusal(reason: string | undefined): boolean;
27
+ /**
28
+ * DOD-M15-RELAYSLOTS-1 — why a relay refused to let this agent hold a reservation slot, in the
29
+ * shape the daemon and the operator both need.
30
+ *
31
+ * `reason` is the relay's own code, unmodified. `advice` is what the person reading it should DO,
32
+ * chosen for that specific cause. `tryAnotherRelay` is the machine half of the same question.
33
+ */
34
+ export interface RelayAuthRefusal {
35
+ reason: string;
36
+ advice: string;
37
+ tryAnotherRelay: boolean;
38
+ /** Present when the relay said how many slots are held and what its cap is. */
39
+ slotsHeld?: number;
40
+ slotCap?: number;
41
+ /** Present when the relay said when to come back. */
42
+ retryAfterMs?: number;
43
+ }
44
+ /**
45
+ * Classify a relay's auth refusal: what to tell the operator, and whether another relay would help.
46
+ *
47
+ * Everything not in `RELAY_SIDE_REFUSALS` defaults to "do not try another", and that default is the
48
+ * safe direction. A token problem reproduces identically on every relay in the fleet, so retrying
49
+ * around the fleet spends real time turning a client fault into an apparent outage — and a slot cap
50
+ * IS satisfiable elsewhere, but spreading to another relay papers over sessions that leaked and
51
+ * brings the same wall back on the next one.
52
+ */
53
+ export declare function classifyRelayAuthRefusal(reason: string, extra?: {
54
+ slotsHeld?: number;
55
+ slotCap?: number;
56
+ retryAfterMs?: number;
57
+ }): RelayAuthRefusal;
27
58
  export declare const LEAF_KIND_MSG = 0;
28
59
  /** Control leaf (SEAL etc.) — two distinct-sender ctrl leaves trigger directory notarization. */
29
60
  export declare const LEAF_KIND_CTRL = 2;
@@ -63,9 +94,44 @@ export type SubmitResult = {
63
94
  sequence_number: number;
64
95
  structure1_cbor?: Uint8Array;
65
96
  structure2_cbor?: Uint8Array;
97
+ /**
98
+ * DOD-M15-SEALWIRE-1 bullet 5, SENT half — OUR signature over `structure1_cbor`.
99
+ *
100
+ * It is already computed on the submit path (`keyProvider.sign(structure1)`) and put on the
101
+ * wire as `sender_signature`; it simply was not handed back, so the transcript row for a
102
+ * message THIS agent sent stored no proof of authorship at all.
103
+ *
104
+ * Why that matters and is not symmetry for its own sake: a RECEIVED row carries the
105
+ * counterparty's pubkey and signature, so a third party can check it. A SENT row carried
106
+ * `attribution: "self_authored"` and nothing else — fine for its owner, who already knows, and
107
+ * **worth nothing to the auditor the bullet exists for.** Half a transcript was provable.
108
+ *
109
+ * Undefined on the relay-degraded path, where no submit happens and there is nothing to sign.
110
+ */
111
+ sender_signature?: Uint8Array;
66
112
  } | {
67
113
  ok: false;
68
114
  reason: string;
115
+ /**
116
+ * The relay's own words about what went wrong — `relay-types.ts`'s stated invariant is
117
+ * *"`reason` is the class, `detail` is what happened."*
118
+ *
119
+ * ⚠️ THAT INVARIANT HAD NEVER BEEN TRUE END TO END. The relay composed a `detail` on every
120
+ * `hash_submit_error`, and this client read `reason` and **dropped it on the floor** — so the
121
+ * only sentence naming a cause never reached an operator. It defeats two things at once:
122
+ * `DOD-M15-SEALWIRE-1`'s refusal detail (which rule, which leaf kind), and
123
+ * `DOD-M15-TERMINAL-REASON-1`'s F6, where `detail` exists specifically to carry the
124
+ * DIRECTORY's refusal cause out from behind a `seal_refused`.
125
+ *
126
+ * Optional, because an older relay sends none.
127
+ */
128
+ detail?: string;
129
+ /**
130
+ * DOD-M15-RELAYABUSE-1: milliseconds until the relay's rate-limit window clears, present only
131
+ * with `reason: "rate_limited"`. The relay computes it; nobody guesses it. `#doSubmit` waits
132
+ * this out and resubmits rather than surfacing a throttle — see the retry loop there.
133
+ */
134
+ retry_after_ms?: number;
69
135
  };
70
136
  export interface AgentRelayClientOpts {
71
137
  relayPeerId: string;
@@ -88,6 +154,20 @@ export interface AgentRelayClientOpts {
88
154
  * directory's OFFLINE tree rebuild. Optional — when absent, no leaf log is kept.
89
155
  */
90
156
  sealLeafStore?: SessionSealLeafStore;
157
+ /**
158
+ * DOD-M15-RELAYSLOTS-1: the current directory-issued online token for this agent, or `undefined`
159
+ * when the directory has not issued one (not connected yet, or this key is not a registered
160
+ * agent). A relay refuses an auth without it, and refuses to let the peer hold a reservation slot.
161
+ *
162
+ * ⚠️ A FUNCTION, NOT A VALUE, and that is the whole point. The token is short-lived and reissued
163
+ * on every signaling reconnect — which happens far more often than a relay auth. A client
164
+ * constructed with a snapshot would work for the first hour of an agent's life and then present
165
+ * an expired token forever, losing its slot for a reason nothing on this side reports.
166
+ *
167
+ * Optional so a caller with no directory connection at all (tests of unrelated paths) still
168
+ * compiles; production always supplies it.
169
+ */
170
+ onlineToken?: () => Uint8Array | undefined;
91
171
  }
92
172
  /**
93
173
  * The directory-signed relay assignment a client presents to its chosen relay (a
@@ -119,6 +199,8 @@ export declare class AgentRelayClient {
119
199
  #private;
120
200
  /** The cause of the most recent reader end, or null if it has not ended. */
121
201
  getLastReaderError(): string | null;
202
+ /** The last classified auth refusal from this relay, or null if the last attempt succeeded. */
203
+ getLastAuthRefusal(): RelayAuthRefusal | null;
122
204
  constructor(opts: AgentRelayClientOpts);
123
205
  /** The agent's K_local public key as hex — the responder identity for auto-acknowledge. */
124
206
  get senderPubkeyHex(): string;
@@ -128,15 +210,63 @@ export declare class AgentRelayClient {
128
210
  * the shared stream if the node that originally dialed is torn down.
129
211
  */
130
212
  registerSession(sessionIdHex: string, node: CelloNode, onLeafDeliver?: (frame: LeafDeliverFrame) => void, assignment?: RelayAssignmentCarry): void;
213
+ /**
214
+ * DOD-M15-RELAYAUTH-1 review H1 — **present the assignment and WAIT for the relay to say it
215
+ * recorded it.**
216
+ *
217
+ * `registerSession` above presents eagerly and forgets: the record is queued onto the submit chain
218
+ * and nobody can observe when it lands. That is correct for the witness relay, where the only
219
+ * requirement is "before the first submit". It is NOT sufficient for the relay that GATES A DIAL,
220
+ * because there the record is a precondition of an action we are about to take on another thread
221
+ * of the protocol — and losing that race denies a legitimate dial (review H1).
222
+ *
223
+ * Chained on `#submitChain` exactly like `#doSubmit`, so it cannot interleave with a submit on the
224
+ * same stream. Idempotent by construction: `#doRecord` returns `true` immediately once the session
225
+ * is recorded, so calling this straight after `registerSession` waits for the record that call
226
+ * already queued rather than sending a second one.
227
+ *
228
+ * Returns whether the relay recorded it. NEVER throws — a caller must be free to proceed on false
229
+ * (a dial that might be denied still beats no dial at all).
230
+ */
231
+ recordAssignmentAndWait(node: CelloNode, sessionIdHex: string): Promise<boolean>;
131
232
  /** Remove a session; caller closes the client when no sessions remain. */
132
233
  unregisterSession(sessionIdHex: string): void;
133
234
  hasSessions(): boolean;
235
+ /**
236
+ * Is THIS session already registered on this client?
237
+ *
238
+ * DOD-M15-RELAYLEAK-1 (review MEDIUM-5). The detached seal transport releases its registration
239
+ * when the submit finishes, and "did I register it, or did I find it already there?" is the
240
+ * difference between releasing my own and **pulling a live one out from under a concurrent
241
+ * caller** — which closes the client that caller is mid-`submitLeaf` on. `hasSessions()` cannot
242
+ * answer it: it is a count, and by then the id is in the set either way.
243
+ */
244
+ hasSession(sessionIdHex: string): boolean;
134
245
  /**
135
246
  * Proactively establish the authenticated stream from `node`. The RECEIVER must connect
136
247
  * before the counterparty submits, so the relay has its stream to deliver `leaf_deliver`
137
248
  * to (otherwise the relay queues until the recipient connects). Best-effort.
138
249
  */
139
250
  connect(node: CelloNode): Promise<boolean>;
251
+ /**
252
+ * DOD-M15-RELAYAUTH-1 review HIGH-1 — prove key possession FROM THIS NODE, on its own stream.
253
+ *
254
+ * ⚠️ **`connect()` CANNOT be used for this, and using it was the defect.** `#ensureConnected`
255
+ * returns `true` the moment `#stream` is non-null, and `#stream` belongs to whichever node
256
+ * connected FIRST. An agent legitimately runs several nodes against one relay — the node promoted
257
+ * into a live session, plus the replacement standing receiver built behind it — and they share
258
+ * one `AgentRelayClient` because the cache is keyed `${agent}::${relay}`. So calling `connect()`
259
+ * from the replacement receiver short-circuited on the session node's stream, sent nothing, and
260
+ * the relay never saw that receiver's transport identity: it revoked the reservation ~15s later,
261
+ * the watchdog rebuilt, and the agent churned on a ~45s loop holding no usable circuit address
262
+ * for as long as the conversation lasted. Any future "reuse the existing connection" optimisation
263
+ * here reintroduces exactly that.
264
+ *
265
+ * So this always opens its own short-lived stream from `node`, and marks it
266
+ * `purpose: "reservation"` so the relay proves possession WITHOUT rebinding the agent's delivery
267
+ * stream (which would steal the live session's inbound leaves — see the relay-side dispatch).
268
+ */
269
+ proveReservation(node: CelloNode): Promise<boolean>;
140
270
  /**
141
271
  * Submit a session's CONTENT-leaf hash to the relay. Connects/re-connects from `node` if needed.
142
272
  * Globally FIFO across the agent's sessions (the ack has no session_id).
@@ -147,13 +277,58 @@ export declare class AgentRelayClient {
147
277
  * `final_message` and from `answered` — guards that could never fire while this method hardcoded
148
278
  * MSG for every caller. See `document-leaf-kind-on-the-wire.test.ts` for what that cost.
149
279
  */
150
- submitMessageHash(node: CelloNode, sessionId: Uint8Array, contentHash: Uint8Array, leafKind?: number): Promise<SubmitResult>;
280
+ submitMessageHash(node: CelloNode, sessionId: Uint8Array, contentHash: Uint8Array,
281
+ /**
282
+ * REQUIRED — `DOD-M15-SEALWIRE-1` B2b-1 pass-2 F3. This default was the last one on the path,
283
+ * and it is the reason a test passing `undefined` for `leafKind` looked correct: the value was
284
+ * silently rebuilt as MESSAGE one hop below the parameter the fix had just made required. Its
285
+ * one production caller always passes explicitly, so the default was dead and misleading.
286
+ */
287
+ leafKind: number): Promise<SubmitResult>;
151
288
  /**
152
289
  * Submit a leaf hash of a given kind (0x00 message / 0x02 control) to the relay. The SEAL
153
290
  * ctrl leaf rides this path: two distinct-sender ctrl leaves in the relay's
154
291
  * log trigger the directory's FROST notarization (relay `#maybeProcessSeal`).
292
+ *
293
+ * ─── `contentBytes` — `DOD-M15-SEALWIRE-1` bullets 3+4, THE SENDER LEG ───────────────────────
294
+ *
295
+ * The SEAL leaf's own payload, carried alongside its hash. Without it the directory holds a
296
+ * SHA-256 pre-image and nothing else, so the client's SIGNED `final_root` — the one value in the
297
+ * whole seal that the relay cannot produce — is unrecoverable, and every root check the directory
298
+ * can make compares the relay against itself.
299
+ *
300
+ * ⚠️ THIS PARAMETER PUTS LEAF CONTENT ON THE RELAY, AND THE RELAY IS THE PARTY THIS PROTOCOL
301
+ * EXISTS TO KEEP CONTENT AWAY FROM (INV-3: a forwarding relay sees ciphertext).
302
+ *
303
+ * It is safe for a SEAL ctrl leaf and for nothing else. The payload is `[session_id, final_root,
304
+ * close_timestamp, "PENDING"]` and the relay already knows all four — it assigned the session,
305
+ * built the tree the root comes from, and stamped the leaf. Nothing is disclosed. That reasoning
306
+ * stops dead at the next leaf kind: a `msg` leaf's content is the operator's plaintext and a `doc`
307
+ * leaf's is their document.
308
+ *
309
+ * So both directions are REFUSED rather than tidied, and refused HERE rather than at the relay:
310
+ *
311
+ * - content on a non-ctrl leaf → the relay would refuse the whole frame, but only after the
312
+ * operator's words had already crossed the wire to the party that must not have them, and the
313
+ * refusal would destroy their send rather than protect it.
314
+ * - a ctrl leaf with NO payload → this was the actual defect. `submitSealLeaf` computed the
315
+ * payload, hashed it, and had nowhere to put it, so it was dropped. The seal still succeeded,
316
+ * the relay still acked, and three hops later the directory reported `not_carried` and blamed
317
+ * the relay's build version — for a value the client never sent. Four reviewed legs shipped
318
+ * over that silence. A dropped argument now fails on the machine that dropped it.
319
+ *
320
+ * ⚠️ REQUIRED, AND `| null` RATHER THAN `?` — THE TYPE IS THE GUARD.
321
+ *
322
+ * I first wrote this optional and covered it with tests. Then I ran the revert test that mattered:
323
+ * drop the argument at the one call site that must pass it, exactly reproducing the original
324
+ * defect. **All five new tests stayed green.** An optional parameter makes the defect a silent,
325
+ * type-legal omission — which is precisely how it shipped through four reviews the first time.
326
+ *
327
+ * Required means the omission is a COMPILE ERROR, caught by the gate on the machine that made it,
328
+ * before any test runs. Every caller must now say what this leaf carries, and `submitMessageHash`
329
+ * says `null` in one visible place instead of by saying nothing at all.
155
330
  */
156
- submitLeaf(node: CelloNode, sessionId: Uint8Array, contentHash: Uint8Array, leafKind: number): Promise<SubmitResult>;
331
+ submitLeaf(node: CelloNode, sessionId: Uint8Array, contentHash: Uint8Array, leafKind: number, contentBytes: Uint8Array | null): Promise<SubmitResult>;
157
332
  /** The highest relay-assigned sequence observed for a given session (ack or deliver). */
158
333
  lastSeenSeq(sessionIdHex: string): number;
159
334
  close(): void;
@@ -1 +1 @@
1
- {"version":3,"file":"session-relay-client.d.ts","sourceRoot":"","sources":["../src/session-relay-client.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,iFAAiF;AACjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAAoD,CAAC;AAE7G,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,iGAAiG;AACjG,eAAO,MAAM,cAAc,IAAO,CAAC;AACnC,uFAAuF;AACvF,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,IAAO,CAAC;AAKrC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAIvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,UAAU,EACvB,YAAY,EAAE,UAAU,EACxB,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,UAAU,CAEZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,eAAe,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IAKxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;CAC9B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGlC,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,WAAW,EAAE,WAAW,CAAC;IACzB,iFAAiF;IACjF,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUxD;AA8BD;;;;GAIG;AACH,qBAAa,gBAAgB;;IAO3B,4EAA4E;IAC5E,kBAAkB,IAAI,MAAM,GAAG,IAAI;gBA+DvB,IAAI,EAAE,oBAAoB;IAUtC,2FAA2F;IAC3F,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED;;;;OAIG;IACH,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,SAAS,EACf,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EACjD,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI;IAgGP,0EAA0E;IAC1E,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK7C,WAAW,IAAI,OAAO;IAuNtB;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAiKhD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,YAAY,CAAC;IAIxB;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IA8K1H,yFAAyF;IACzF,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIzC,KAAK,IAAI,IAAI;CAWd"}
1
+ {"version":3,"file":"session-relay-client.d.ts","sourceRoot":"","sources":["../src/session-relay-client.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,iFAAiF;AACjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAgBtD,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,gBAAgB,CA+DlB;AAED,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,iGAAiG;AACjG,eAAO,MAAM,cAAc,IAAO,CAAC;AACnC,uFAAuF;AACvF,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,IAAO,CAAC;AAKrC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAIvF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,UAAU,EACvB,YAAY,EAAE,UAAU,EACxB,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,UAAU,CAEZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,eAAe,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IAKxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC;CAC/B,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAGN,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,WAAW,EAAE,WAAW,CAAC;IACzB,iFAAiF;IACjF,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUxD;AA8BD;;;;GAIG;AACH,qBAAa,gBAAgB;;IAO3B,4EAA4E;IAC5E,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAoBnC,+FAA+F;IAC/F,kBAAkB,IAAI,gBAAgB,GAAG,IAAI;gBA8DjC,IAAI,EAAE,oBAAoB;IAWtC,2FAA2F;IAC3F,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED;;;;OAIG;IACH,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,SAAS,EACf,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EACjD,UAAU,CAAC,EAAE,oBAAoB,GAChC,IAAI;IAsBP;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgFtF,0EAA0E;IAC1E,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK7C,WAAW,IAAI,OAAO;IAItB;;;;;;;;OAQG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAmRzC;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;;;;;;;;;;;;;OAiBG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAoQzD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU;IACvB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC;IAQxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,UAAU,CACd,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,UAAU,GAAG,IAAI,GAC9B,OAAO,CAAC,YAAY,CAAC;IA+UxB,yFAAyF;IACzF,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIzC,KAAK,IAAI,IAAI;CAWd"}