@cello-protocol/daemon 0.0.182 → 0.0.184

package/dist/signaling-connect.js

@@ -59,6 +59,17 @@ async function safeStop(node) {
         /* best-effort teardown */
     }
 }
+/** A directory node the daemon can dial, resolved from bootstrap config or a manifest. */
+/**
+ * DOD-M15-STEP6-REPLAY-1 — how far out of date a directory identity proof may be.
+ *
+ * ±5 minutes: wide enough for ordinary clock skew between an operator's machine and a directory
+ * node without requiring either to be time-synced, narrow enough that a captured proof stops being
+ * useful in minutes rather than never. An UNPARSEABLE timestamp is treated as out of window — the
+ * NaN-comparison lesson from the manifest gate, where `new Date("nonsense") <= x` is false and a
+ * garbage value sailed through a check that looked like it covered it.
+ */
+const IDENTITY_PROOF_MAX_SKEW_MS = 5 * 60_000;
 /**
  * Parse signaling_auth_ok's optional `relay_endpoints` field. Per-entry strict:
  * a malformed entry is dropped (auth must never fail on a bad hint), a valid one
@@ -92,6 +103,20 @@ function parseRelayEndpoints(raw) {
  * transport SignalingManager catches the throw and schedules a reconnect.
  */
 export function createSignalingConnect(deps) {
+    /**
+     * DOD-M15-DIRAUTH-1 — directory peers already told about a skipped identity check.
+     *
+     * Mirrors `consortium-bootstrap`'s `lapsedMembershipReportedFor` idiom: the fact is about a PEER,
+     * not about a connection, so reporting it per connection says the same true thing ~48 times an
+     * hour forever. Keyed on the peer this daemon DIALLED — never on the peer's own claim about
+     * itself, which on this path is precisely the thing that was not verified.
+     *
+     * ⚠️ SCOPED TO THE FACTORY, not the module. A module-level set is shared by every daemon wiring in
+     * the process and never resets, which makes the suppression outlive the thing it describes and
+     * makes test order load-bearing — my first version did exactly that and a later test silently lost
+     * its warning to an earlier one.
+     */
+    const authSkipReportedFor = new Set();
     return async function connect() {
         const endpoint = await deps.getDirectoryEndpoint();
         if (!endpoint) {
@@ -218,6 +243,52 @@ export function createSignalingConnect(deps) {
             // Runs only when a challengeVerifier is configured. M6 ran without one.
             let directoryNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : endpoint.peerId;
             const verifier = deps.challengeVerifier;
+            if (!verifier) {
+                /**
+                 * DOD-M15-DIRAUTH-1 — **A DISARMED CHECK MUST NOT LOOK LIKE A HEALTHY ONE.**
+                 *
+                 * With no verifier configured, step 6 does not run at all: this daemon takes the
+                 * directory's word for which directory it is. Until now the only trace of that was
+                 * `verified: false` — a boolean field inside the **info** line at the bottom of a successful
+                 * connect. Every other connect logged the same event at the same level, so the disarmed
+                 * state and the enforced state were distinguishable only by reading one field of one line,
+                 * which nothing alerts on and no operator reads.
+                 *
+                 * ⚠️ THIS IS NOT THE FIX AND MUST NOT BE MISTAKEN FOR ONE — this entry's own conclusion is
+                 * that **a log is not a control**, and a WARN is still a log. What it buys is that the
+                 * absence has a name and a level of its own, so "authentication is off" can be seen without
+                 * knowing to look for it. The control is `CELLO_REQUIRE_DIRECTORY_AUTH`, which refuses at
+                 * startup; this is what tells an operator who has not set it what they are running.
+                 */
+                /**
+                 * ⚠️ ONCE PER DIRECTORY, NOT ONCE PER CONNECT — review F3, and the number is the argument.
+                 * The signaling stream turns over roughly every 70 seconds and reconnects forever, so a
+                 * per-connect WARN is ~48 an hour PER AGENT, indefinitely, and the daemon's stdout logger
+                 * has no level filtering. Three agents is ~3,400 identical lines a day. **A signal that
+                 * fires on the normal case is not a signal** — this repo's own rule — and it would bury the
+                 * public-directory case this exists to raise.
+                 *
+                 * ⚠️ AND THE FIELD IS NAMED FOR WHAT IT IS — review F4. On this path `directoryNodeId` is
+                 * `ackFrame["nodeId"]`: a string the REMOTE sent about itself, with nothing checked. Printing
+                 * it under that name inside a line whose whole subject is *"we did not check which directory
+                 * this is"* presents the peer's own answer as the answer. `dialedPeerId` sits beside it as
+                 * the thing this daemon actually chose.
+                 */
+                const claimedNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : null;
+                if (!authSkipReportedFor.has(endpoint.peerId)) {
+                    authSkipReportedFor.add(endpoint.peerId);
+                    deps.logger.warn("directory.auth.skipped", {
+                        dialedPeerId: endpoint.peerId,
+                        claimedNodeId,
+                        agentPubkey: identity.pubkeyHex,
+                        impact: "no directory identity verifier is configured, so this connection did NOT check which " +
+                            "directory it reached — the peer's claim of its own identity was accepted as given. " +
+                            "Set CELLO_CONSORTIUM_ROOT_KEYS (with CELLO_CONSORTIUM_THRESHOLD) to enable " +
+                            "verification, or CELLO_REQUIRE_DIRECTORY_AUTH=1 to refuse at startup instead of " +
+                            "connecting unverified. Reported ONCE per directory peer, not per reconnect.",
+                    });
+                }
+            }
             if (verifier) {
                 const nodeId = ackFrame["nodeId"];
                 const signature = ackFrame["signature"];
@@ -237,8 +308,55 @@ export function createSignalingConnect(deps) {
                     deps.logger.error("directory.auth.challenge.failed", { directoryNodeId: nodeId, reason: result.reason });
                     throw new Error(`directory_challenge_failed: ${result.reason}`);
                 }
+                /**
+                 * DOD-M15-STEP6-REPLAY-1 — A VALID SIGNATURE IS NOT A FRESH ONE.
+                 *
+                 * The TBS covers `nodeId ‖ agent pubkey ‖ nonce ‖ timestamp`, and until this check the
+                 * client verified the signature over that tuple and looked at **neither** the timestamp nor
+                 * the nonce. So **any party that once obtained a valid tuple for this agent could replay it
+                 * indefinitely.**
+                 *
+                 * ─── WHY THE NONCE CANNOT CARRY THE FRESHNESS, WHICH IS THE PART THAT SURPRISED ME ──────
+                 *
+                 * The obvious answer is "check the nonce is the one we just sent". **We did not send it.**
+                 * The nonce here is `challengeFrame["nonce"]` — the DIRECTORY's own, from step 1-2. The
+                 * client contributes no fresh value to this exchange at all, so it holds nothing of its own
+                 * to bind against. A replaying party simply replays the captured nonce in step 2 and the
+                 * captured ack in step 5, and both halves agree.
+                 *
+                 * **That leaves the timestamp as the only freshness anchor**, and it is a real one: it is
+                 * inside the signed bytes, so a replayer cannot move it without invalidating the signature
+                 * they are replaying.
+                 *
+                 * ─── AFTER the signature, deliberately ─────────────────────────────────────────────────
+                 *
+                 * A stale proof and a forged one are different facts and must not collapse into one
+                 * message. Checking freshness only once the signature verifies means `identity_proof_stale`
+                 * always describes a GENUINE proof that is too old — never a forgery — which is what makes
+                 * it diagnostic rather than another exit-point label.
+                 *
+                 * **The window, and what it does NOT fix.** ±5 minutes tolerates ordinary client/directory
+                 * clock skew without a time-sync dependency. It BOUNDS replay to that window; it does not
+                 * eliminate it, because with no client-chosen nonce there is nothing to make a proof
+                 * single-use. Closing the remainder needs either a client contribution in the challenge or a
+                 * seen-nonce cache — both wire or state changes, and neither is this line.
+                 */
+                const proofMs = Date.parse(timestamp);
+                const skewMs = Number.isFinite(proofMs) ? Math.abs(Date.now() - proofMs) : Number.NaN;
+                if (!Number.isFinite(skewMs) || skewMs > IDENTITY_PROOF_MAX_SKEW_MS) {
+                    deps.logger.error("directory.auth.challenge.failed", {
+                        directoryNodeId: nodeId,
+                        reason: "identity_proof_stale",
+                        timestamp,
+                        skewMs: Number.isFinite(skewMs) ? Math.round(skewMs) : null,
+                        maxSkewMs: IDENTITY_PROOF_MAX_SKEW_MS,
+                        detail: "the directory's identity proof carries a valid signature over a timestamp outside the " +
+                            "freshness window — either a replayed proof, or a clock that is badly out on one side.",
+                    });
+                    throw new Error("directory_challenge_failed: identity_proof_stale");
+                }
                 directoryNodeId = nodeId;
-                deps.logger.info("directory.auth.challenge.verified", { directoryNodeId });
+                deps.logger.info("directory.auth.challenge.verified", { directoryNodeId, skewMs: Math.round(skewMs) });
             }
             // DOD-NAT-REACHABILITY-1 (Phase 2): the directory's relay pool rides
             // signaling_auth_ok so the standing receiver can reserve BEFORE any
@@ -254,6 +372,51 @@ export function createSignalingConnect(deps) {
                     deps.onRelayEndpoints(endpoints);
                 }
             }
+            /**
+             * DOD-M15-RELAYSLOTS-1: the online token rides the same frame as the relay pool above, for
+             * the same reason — a standing receiver needs both before any session exists: WHERE to ask
+             * for a reservation slot, and the credential that lets it keep one.
+             *
+             * A field of the wrong type is dropped rather than failing the handshake, exactly as a
+             * malformed relay endpoint is. The consequence is bounded and visible (this agent gets no
+             * slot on any relay, and the relay names the reason when it refuses), whereas failing the
+             * handshake would also cost session offers, which arrive on this same stream.
+             */
+            if (deps.onOnlineToken) {
+                const raw = ackFrame["online_token"];
+                const token = raw instanceof Uint8Array ? raw : Buffer.isBuffer(raw) ? new Uint8Array(raw) : undefined;
+                if (token && token.length > 0) {
+                    deps.logger.info("directory.online_token.received", { directoryNodeId, bytes: token.length });
+                    deps.onOnlineToken(token);
+                }
+                else {
+                    /**
+                     * Review M1: the directory names WHICH absence, so this is no longer one label for three
+                     * different problems. `not_registered_here` in particular is a payload fact, and reporting
+                     * it as a generic "no token" sent the operator to check a directory connection that is
+                     * working perfectly.
+                     */
+                    const raw = ackFrame["online_token_absent_reason"];
+                    const absentReason = raw === "not_registered_here" || raw === "issue_failed" ? raw : undefined;
+                    deps.onOnlineTokenAbsent?.(absentReason);
+                    deps.logger.warn("directory.online_token.absent", {
+                        directoryNodeId,
+                        agentPubkey: identity.pubkeyHex,
+                        reason: absentReason ?? "unstated",
+                        impact: absentReason === "not_registered_here"
+                            ? "this directory holds no agent profile for this key, so it issued no online token " +
+                                "and no relay will grant this agent a reservation. The directory connection is FINE " +
+                                "— either this agent registered against a different sovereign node and its profile " +
+                                "has not replicated here yet, or it is not registered at all."
+                            : absentReason === "issue_failed"
+                                ? "this directory could not issue an online token — its own lookup or signing failed. " +
+                                    "That is a fault on the directory, not on this agent or on any relay."
+                                : "this directory issued no online token, so no relay will let this agent hold a " +
+                                    "circuit reservation and it will be reachable only over a direct connection. It " +
+                                    "stated no reason, which means it predates the token.",
+                    });
+                }
+            }
             // ── Step 7: announce our peer info so the directory can broker sessions ──
             const peerInfo = encodeCbor({
                 type: "peer_info_announce",

package/dist/signaling-connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"signaling-connect.js","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAInC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3D,OAAQ,CAA6B,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,IAAsB,EAAE,SAAiB;IACzE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KAClG,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAgED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,OAAO,KAAK,UAAU,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,+FAA+F;QAC/F,2DAA2D;QAC3D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,gDAAgD;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;YACnC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,CAAC,MAAM,UAAU,CAAC;gBACf,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA4BG;gBACH,eAAe,EAAE,EAAE;gBACnB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/B,yFAAyF;gBACzF,qFAAqF;gBACrF,iFAAiF;gBACjF,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aACrC,CAAC,CAAC;QAEP,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,8EAA8E;gBAC9E,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,yEAAyE;oBACzE,uDAAuD;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;wBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,EAA+B,CAAC;QAEnH,IAAI,CAAC;YACH,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAErE,6EAA6E;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC;gBAC9B,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,GAAG;gBACd,iGAAiG;gBACjG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAE/C,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACzD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAA4B,CAAC;YACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,eAAe,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;gBACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACtF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,QAAQ,GAAG,aAAa,CAAC;oBAC7B,MAAM;oBACN,cAAc,EAAE,QAAQ,CAAC,SAAS;oBAClC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC5C,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBACzG,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,uBAAuB;YACvB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACrD,eAAe;wBACf,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;qBAC7C,CAAC,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE;aACnC,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,eAAe;gBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;gBAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YAEH,4EAA4E;YAC5E,0DAA0D;YAC1D,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YAEzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,OAAO;gBACL,MAAM;gBACN,eAAe;gBACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iFAAiF;YACjF,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,IAA+B,EAC/B,IAAe,EACf,MAAc,EACd,WAA8C;IAE9C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAc;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAe,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,OAAiC;YACzC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,SAAS,CAAC;wBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC1C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM;wBACvC,IAAI,KAAc,CAAC;wBACnB,IAAI,CAAC;4BACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,gEAAgE;4BAChE,SAAS;wBACX,CAAC;wBACD,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,wDAAwD;oBACxD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,4EAA4E;YAC5E,wDAAwD;YACxD,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"signaling-connect.js","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAInC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3D,OAAQ,CAA6B,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,IAAsB,EAAE,SAAiB;IACzE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KAClG,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAkF9C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D;;;;;;;;;;;;OAYG;IACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,OAAO,KAAK,UAAU,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,+FAA+F;QAC/F,2DAA2D;QAC3D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,gDAAgD;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;YACnC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,CAAC,MAAM,UAAU,CAAC;gBACf,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA4BG;gBACH,eAAe,EAAE,EAAE;gBACnB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/B,yFAAyF;gBACzF,qFAAqF;gBACrF,iFAAiF;gBACjF,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aACrC,CAAC,CAAC;QAEP,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,8EAA8E;gBAC9E,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,yEAAyE;oBACzE,uDAAuD;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;wBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,EAA+B,CAAC;QAEnH,IAAI,CAAC;YACH,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAErE,6EAA6E;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC;gBAC9B,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,GAAG;gBACd,iGAAiG;gBACjG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAE/C,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACzD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAA4B,CAAC;YACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,eAAe,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd;;;;;;;;;;;;;;;mBAeG;gBACH;;;;;;;;;;;;;mBAaG;gBACH,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;wBACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;wBAC7B,aAAa;wBACb,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EACJ,uFAAuF;4BACvF,qFAAqF;4BACrF,6EAA6E;4BAC7E,kFAAkF;4BAClF,6EAA6E;qBAChF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;gBACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACtF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,QAAQ,GAAG,aAAa,CAAC;oBAC7B,MAAM;oBACN,cAAc,EAAE,QAAQ,CAAC,SAAS;oBAClC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC5C,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBACzG,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAgCG;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,0BAA0B,EAAE,CAAC;oBACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;wBACnD,eAAe,EAAE,MAAM;wBACvB,MAAM,EAAE,sBAAsB;wBAC9B,SAAS;wBACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC3D,SAAS,EAAE,0BAA0B;wBACrC,MAAM,EACJ,wFAAwF;4BACxF,uFAAuF;qBAC1F,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,uBAAuB;YACvB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACrD,eAAe;wBACf,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;qBAC7C,CAAC,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvG,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN;;;;;uBAKG;oBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBACnD,MAAM,YAAY,GAAG,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/F,IAAI,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBAChD,eAAe;wBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EAAE,YAAY,IAAI,UAAU;wBAClC,MAAM,EAAE,YAAY,KAAK,qBAAqB;4BAC5C,CAAC,CAAC,mFAAmF;gCACnF,qFAAqF;gCACrF,oFAAoF;gCACpF,8DAA8D;4BAChE,CAAC,CAAC,YAAY,KAAK,cAAc;gCAC/B,CAAC,CAAC,qFAAqF;oCACrF,sEAAsE;gCACxE,CAAC,CAAC,gFAAgF;oCAChF,iFAAiF;oCACjF,sDAAsD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE;aACnC,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,eAAe;gBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;gBAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YAEH,4EAA4E;YAC5E,0DAA0D;YAC1D,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YAEzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,OAAO;gBACL,MAAM;gBACN,eAAe;gBACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iFAAiF;YACjF,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,IAA+B,EAC/B,IAAe,EACf,MAAc,EACd,WAA8C;IAE9C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAc;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAe,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,OAAiC;YACzC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,SAAS,CAAC;wBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC1C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM;wBACvC,IAAI,KAAc,CAAC;wBACnB,IAAI,CAAC;4BACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,gEAAgE;4BAChE,SAAS;wBACX,CAAC;wBACD,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,wDAAwD;oBACxD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,4EAA4E;YAC5E,wDAAwD;YACxD,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/submission-retry.d.ts

@@ -0,0 +1,208 @@
+/**
+ * DOD-M15-ENDORSE-RETRY-1 — a sealed submission survives the directory node going away.
+ *
+ * An operator mints a trust signal, the one directory node this daemon holds a signaling stream to
+ * is down or restarting, and the command fails and it is over: nothing queues the submission,
+ * nothing retries it, and the operator has to notice and run it again. The consortium has three
+ * nodes, and surviving one of them being unavailable is the entire reason there are three.
+ *
+ * THIS IS THE RETRY, NOT THE ROUTING, AND THAT DISTINCTION IS RULED. `sendSealedSubmission` says so
+ * in its own header: the daemon holds ONE signaling stream, registration already works this way
+ * (the client sends to the connected node and the DIRECTORY fans out), and inventing a client-side
+ * multi-node write here would duplicate the SignalingManager's reconnect. So the failover mechanism
+ * is that existing reconnect — this module never chooses a node, never holds an endpoint, and never
+ * learns which node answered. It waits to be told the stream is up again and sends the same bytes.
+ *
+ * WHY A RETRY IS SAFE, and it is the load-bearing fact for the whole design: `submission_id` is
+ * sha256 of the SIGNED PLAINTEXT body, so the same submission produces the same id however many
+ * times it is sent. A node stores it once (`ON CONFLICT DO NOTHING` on the id) and the portal mints
+ * once (`processed_submissions`, checked before the mint path). Nothing here may ever re-COMPOSE a
+ * submission: the sealed bytes are captured at compose time and re-sent verbatim, because a re-seal
+ * is randomised and a re-compose could pick up a different `issued_at` — which changes the id, and
+ * a changed id is a second endorsement rather than a retry.
+ *
+ * SERIAL AND STAGGERED, on the `RestartSealResolver`'s pattern, and one of its lessons is carried
+ * over wholesale: a refusal that is a precondition OF OURS is not a verdict on the submission, so it
+ * must not spend the attempt budget. There the population was `standing_receiver_unavailable` on a
+ * fresh boot; here it is a signaling stream that is reconnecting. Production turns that stream over
+ * roughly every 70 seconds, so charging each reconnect an attempt would burn a five-attempt budget
+ * in six minutes and give up on a submission whose only problem was that the network moved.
+ *
+ * IN MEMORY, FOR THE LIFE OF THE PROCESS, and stated rather than implied. The queue holds sealed
+ * ciphertext, and persisting it would mean a new table, a client-side migration, and a blob at rest
+ * whose retention outlives the intake key it is sealed to. A daemon restart therefore loses the
+ * pending retries — the operator sees them disappear from `cello_attestations_issued` rather than
+ * seeing a lie, they are NAMED in the log on the way out (`retry.dropped_on_shutdown`), and
+ * re-submitting is safe by the same content-derived id.
+ *
+ * THE INTAKE KEY IS CHECKED BY THE CALLER, not assumed here. An earlier version of this paragraph
+ * asserted that the retry window "is far shorter than any manifest validity window, so a queued
+ * blob cannot outlive the intake key it was sealed to" — which is only true when the manifest has
+ * more than a window left at compose time. The enqueue site in `daemon.ts` holds the manifest and
+ * refuses to hold a submission whose intake key would expire inside the window; see
+ * `DEFAULT_RETRY_WINDOW_MS` below for what goes wrong when nothing checks.
+ */
+import type { SubmissionOp } from "@cello-protocol/protocol-types";
+import type { SendSubmissionResult, SubmissionSendFailure } from "./signal-submission.js";
+import type { Logger } from "./types.js";
+export declare function isRetryableSendFailure(reason: SubmissionSendFailure): boolean;
+/**
+ * Why a retry stopped. FOUR names, because they lead to four different operator actions and this is
+ * the field a machine consumer branches on.
+ *
+ * `refused_by_node` and `agent_unloaded` exist because of review H3: a refusal arriving on retry
+ * attempt 1 used to be stamped `attempts_exhausted` with `attempts: 0` printed beside it. The
+ * node's own words survived in `guidance`, but EVERY machine-readable field said transport — so an
+ * operator grepping the log for exhaustion found a quota refusal, and one grepping for refusals
+ * found it filed under a transport give-up. The work order's recorded trap is exactly this: *"the
+ * operator must be able to tell 'the network is flaky, hold on' from 'the directory said no.'"*
+ */
+export type SubmissionGiveUpReason = 
+/** Failures that REACHED a node and got no usable answer, until the budget ran out. */
+"attempts_exhausted"
+/** Only ever local preconditions — the stream never came back inside the window. */
+ | "retry_window_elapsed"
+/** A node decoded it, evaluated it, and said no. Nothing about waiting changes that. */
+ | "refused_by_node"
+/** This daemon can no longer sign as the submitting agent, so nobody can send these bytes. */
+ | "agent_unloaded";
+/** One submission this daemon composed, sealed, and has not yet handed to a directory node. */
+export interface PendingSubmission {
+    agentName: string;
+    /** The STABLE key. `agentName` is a display label and is reusable after a retire; the surface
+     *  that lists these is scoped by id. */
+    agentId: string;
+    /** Content-derived. Never recomputed here — see the header. */
+    submissionId: string;
+    intakeKeyId: string;
+    /** The sealed blob, re-sent verbatim. */
+    ciphertext: Uint8Array;
+    op: SubmissionOp;
+    subject: string;
+}
+export type SubmissionDelivery = {
+    state: "retrying";
+    attempts: number;
+    lastReason: SubmissionSendFailure;
+    nextAttemptAt: number;
+    guidance: string;
+} | {
+    state: "gave_up";
+    attempts: number;
+    lastReason: SubmissionSendFailure;
+    gaveUpBecause: SubmissionGiveUpReason;
+    guidance: string;
+};
+export interface PendingSubmissionView {
+    submissionId: string;
+    op: SubmissionOp;
+    subject: string;
+    intakeKeyId: string;
+    delivery: SubmissionDelivery;
+}
+export interface ScheduledTask {
+    cancel: () => void;
+}
+export interface SubmissionRetryQueueDeps {
+    logger: Logger;
+    /**
+     * Re-send THESE bytes on whatever stream the agent's SignalingManager currently holds. The queue
+     * does not know or care which node that is — that is the point of the ruling in the header.
+     */
+    send: (item: PendingSubmission) => Promise<SendSubmissionResult>;
+    /**
+     * A retry landed. The caller writes the same local record a first-pass send writes, or a later
+     * withdrawal has no handle to name. Called on the retry path only; the first-pass send records
+     * its own.
+     */
+    onAccepted: (item: PendingSubmission, stored: boolean) => void;
+    now?: () => number;
+    schedule?: (fn: () => void, ms: number) => ScheduledTask;
+    /** Gap between two attempts, so a queue of submissions is not a burst of frames. */
+    staggerMs?: number;
+    /** Ceiling on attempts that reached a node. */
+    maxAttempts?: number;
+    /** Wall-clock ceiling for a submission whose failures were all local preconditions. */
+    retryWindowMs?: number;
+    /**
+     * Gap before re-trying a LOCAL PRECONDITION failure. Injectable because it and `baseBackoffMs`
+     * were the only two intervals a test could not vary — which is why the live wiring test's green
+     * depended on a real reconnect ladder racing a real 5-second timer.
+     */
+    localPreconditionRetryMs?: number;
+    /** First non-local backoff; doubles from here. */
+    baseBackoffMs?: number;
+    /** Ceiling on pending submissions held at once, across all agents. */
+    queueCap?: number;
+}
+/**
+ * One hour. Chosen against the intake key, not against patience: the queued blob is sealed to the
+ * intake key the manifest published at compose time, and a manifest window is measured in weeks.
+ *
+ * THIS COMMENT USED TO ASSERT THAT AN HOUR "CANNOT OUTLIVE THE KEY", AND THAT WAS AN UNCHECKED
+ * CLAIM (review M4). It holds only when the manifest has more than an hour left at compose time.
+ * `composeSealedSubmission` refuses an already-expired manifest, but nothing stopped a submission
+ * composed one minute before expiry from being held and re-sent for the next fifty-nine — and the
+ * portal's rotated-key retention does not cover it either, because that rule keeps a retired key
+ * "until no undrained row references it" (M10B-D11) and a HELD submission has no row at any node.
+ * The result is exactly the state the expiry gate exists to prevent: a blob the portal cannot open
+ * and cannot attribute, arriving as poison with no reply possible — while the operator has been
+ * told it is held and needs nothing from them.
+ *
+ * So the CALLER checks rather than this comment asserting. See the enqueue site in `daemon.ts`,
+ * which has the manifest in hand and refuses to hold a submission whose intake key would expire
+ * inside this window.
+ */
+export declare const DEFAULT_RETRY_WINDOW_MS: number;
+/**
+ * The retry queue. One per daemon; keyed by (agentId, submissionId) because two agents on one
+ * daemon can each submit about the same subject and the rows are per-agent facts.
+ */
+export declare class SubmissionRetryQueue {
+    #private;
+    constructor(deps: SubmissionRetryQueueDeps);
+    /**
+     * Take ownership of a submission whose send failed for a retryable reason.
+     *
+     * Returns `false` when the queue is full, and the caller then reports the plain failure — an
+     * operator who is told "the daemon has it" about a submission the daemon dropped is worse off
+     * than one who is told it failed, because only the second knows to act.
+     */
+    enqueue(item: PendingSubmission, lastReason: SubmissionSendFailure): boolean;
+    /**
+     * The agent's directory signaling stream reached 'connected' — the first connect and every
+     * reconnect after a drop. THIS IS THE FAILOVER. Which node it landed on is not this module's
+     * business and is deliberately not read.
+     */
+    onSignalingConnected(agentName: string): void;
+    /**
+     * What this agent still has in flight, and what was given up on. Read by `wallet_list_issued`,
+     * which is the surface behind `cello_attestations_issued` — the verb whose whole question is
+     * "what happened to what I sent?".
+     */
+    list(agentId: string): PendingSubmissionView[];
+    /**
+     * A submission finally landed by some other route — the operator re-issued it, and the
+     * first-pass send succeeded. Drop any give-up recorded for it (review L9).
+     *
+     * The id is content-derived, so re-issuing the SAME words about the SAME subject produces the
+     * SAME id: this is precisely the "I wrote it again and it worked" case. Without it the operator
+     * sees the old failure and the new accepted row side by side for the life of the daemon, with no
+     * way to dismiss the one that is no longer true.
+     */
+    clearGaveUp(agentId: string, submissionId: string): void;
+    /**
+     * Stop, and start nothing further.
+     *
+     * EVERY DROPPED SUBMISSION IS NAMED (review H2). The queue is in memory by design, but the
+     * operator was told in as many words "you do NOT need to run this again" — and before this, a
+     * restart left no durable trace anywhere naming what had been lost. A comment in the composition
+     * root asserting "in memory by design" is not a record; these lines are.
+     *
+     * The SUBJECT is logged and the body is not: the subject is a pubkey or a signal hash, and the
+     * body is the operator's own words about a third party, which this whole path exists to keep out
+     * of the clear on disk.
+     */
+    stop(): void;
+}
+//# sourceMappingURL=submission-retry.d.ts.map

package/dist/submission-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-retry.d.ts","sourceRoot":"","sources":["../src/submission-retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AA2DzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,sBAAsB;AAChC,uFAAuF;AACrF,oBAAoB;AACtB,oFAAoF;GAClF,sBAAsB;AACxB,wFAAwF;GACtF,iBAAiB;AACnB,8FAA8F;GAC5F,gBAAgB,CAAC;AAErB,+FAA+F;AAC/F,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB;4CACwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,UAAU,EAAE,UAAU,CAAC;IACvB,EAAE,EAAE,YAAY,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,qBAAqB,CAAC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,qBAAqB,CAAC;IAClC,aAAa,EAAE,sBAAsB,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEN,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,YAAY,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE;;;;OAIG;IACH,UAAU,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,aAAa,CAAC;IACzD,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,uBAAuB,QAAc,CAAC;AAmEnD;;;GAGG;AACH,qBAAa,oBAAoB;;gBAwBnB,IAAI,EAAE,wBAAwB;IAY1C;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,qBAAqB,GAAG,OAAO;IA6C5E;;;;OAIG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAuB7C;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAe9C;;;;;;;;OAQG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAaxD;;;;;;;;;;;OAWG;IACH,IAAI,IAAI,IAAI;CAsNb"}