@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-ceremony.d.ts

@@ -1,297 +0,0 @@
-/**
- * Session-signing FROST ceremony participation — daemon side (DOD-SPINE-5, increment 3).
- *
- * When an initiator's `cello_initiate_session` reaches the directory, the directory
- * FROST-signs the SessionAssignment by DELEGATING to the initiator: its
- * `ClientDelegatedSigner.participateInCeremony` sends a `ceremony_request`
- * {ceremony_id, tbs, context} over the initiator's authenticated signaling stream and
- * awaits a `ceremony_result` {ceremony_id, signature}. The initiator (coordinator) runs
- * the FROST ceremony with its share + the directory's K_server_X shares, and replies.
- *
- * This wires that handler onto a PER-AGENT signaling stream (the same per-agent routing used for
- * registration).
- *
- * The threshold signer is reconstructed lazily from the agent's persisted
- * `frost-share.json` (the daemon holds no FrostThresholdSigner after registration —
- * the registration-time signer was on the disposed RegistrationContext).
- */
-import { type LegibilityForHash } from "./seal-legibility-tbs.js";
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { IThresholdSigner } from "@cello-protocol/crypto";
-import type { CelloNode } from "@cello-protocol/transport";
-import type { ConsortiumEndpoint } from "./directory-bootstrap.js";
-import type { DaemonRegistrationPersistence } from "./registration-persistence.js";
-import type { SignalingSeam } from "./registration-context.js";
-import type { Logger } from "./types.js";
-/**
- * WIRE-002: answer the directory's `session_offer` on a per-agent signaling stream. When an
- * initiator's session_request names this agent as the target, the directory sends a
- * `session_offer {session_id}` before it builds the FROST-signed assignment; the agent must
- * reply `session_offer_accept` advertising its SESSION endpoint (its standing receiver, which
- * `acceptSession` reuses as the receiver-side session node) so the directory can fold the
- * counterparty endpoint into the assignment and the initiator can reach it. Without this, the
- * assignment carries an empty counterparty endpoint and content delivery can never connect.
- */
-export declare function wireSessionOfferHandler(deps: {
-    agentName: string;
-    getStandingReceiverEndpoint: () => {
-        peerId: string;
-        addrs: string[];
-    } | null;
-    /**
-     * DOD-M15-ASSIGN-1: name the one peer allowed to dial this agent's standing receiver. Called
-     * with the offer's `initiator_session_peer_id` BEFORE the accept advertises our address, so the
-     * gate is already narrowed by the time anyone could know where to dial. Returns false when
-     * there is no receiver or the offer named nobody.
-     */
-    admitOfferedDialer: (initiatorSessionPeerId: string, sessionIdHex: string) => "narrowed" | "no_receiver" | "no_peer_named";
-    /**
-     * DOD-M15-RELAYONLY-1: is relay-only on for this agent? Optional, defaulting to FALSE, so every
-     * existing caller and test keeps its exact behaviour — the guard below must only fire when the
-     * setting is what emptied the address list, never when a receiver simply has none yet.
-     */
-    isRelayOnly?: () => boolean;
-    /**
-     * 055-ONDEMAND — **take a reservation on the relay the directory named, right now.**
-     *
-     * An idle agent holds none, so this is what gives it a circuit address to advertise in the
-     * accept. Resolves whether one was granted; a `false` is not fatal — the agent can still be
-     * reached directly, and relay-only is the one mode where it is not (see the guard below).
-     *
-     * ⚠️ **REQUIRED, AND IT WAS OPTIONAL — 056-SLOTDEAD, review F14.** "Optional, defaulting to a
-     * no-op, so every existing caller and test keeps its exact behaviour" is how it shipped, and the
-     * cost was not behaviour: it was that a fixture omitting this dep skipped the reserve ENTIRELY
-     * and still went green. The reserve is the capacity change — the one thing unit 3 exists to do —
-     * so a handler that never performed it passed the whole suite, and the next fixture written
-     * without the dep would have done the same thing silently. Required, the type checker names
-     * every caller that has to think about it, and there is no version of this handler that quietly
-     * does not reserve.
-     */
-    reserveOnDemand: (circuitAddr: string, sessionIdHex: string) => Promise<boolean>;
-    /**
-     * M16: is THIS agent a broadcast channel? A channel never holds a session, so it rejects the offer
-     * before taking a relay slot or advertising where it can be dialled. Required, so no caller can
-     * forget it (the lesson of `reserveOnDemand` above).
-     */
-    isChannelAgent: () => boolean;
-    signaling: SignalingSeam;
-    logger: Logger;
-}): () => void;
-export interface CeremonyWiringDeps {
-    agentName: string;
-    /**
-     * PERSIST-002: the agent's identity persistence (DB-backed) — the FROST share is loaded from the
-     * encrypted `agents` row, not a `frost-share.json` file.
-     */
-    persistence: DaemonRegistrationPersistence;
-    agentPubkeyHex: string;
-    /**
-     * DOD-M15-SEALWIRE-1 bullet 2 — THE CO-SIGNING HALF, which the line calls the worst moment:
-     * *"your key signs a root you never checked."*
-     *
-     * Review F1: the first cut installed the root check only on the RECEIVING path
-     * (`seal-coordinator.ts`), and left this one — where this agent's FROST key actually endorses the
-     * root — untouched. A directory certifying a root over a different leaf set still got the
-     * initiator's signature on it, and the resulting artifact is durable, valid and non-repudiable.
-     * The receiving-side check then runs AFTER that signature already exists.
-     *
-     * Required, not optional: an unwired check here is the defect this bullet exists to close.
-     */
-    verifyCertifiedRoot: (agentPubkeyHex: string, sessionIdHex: string, certifiedRoot: Uint8Array, certifiedLeafCount: number, 
-    /** The request's own signed leaf set — used only when this side's carry cannot judge. */
-    evidence?: readonly unknown[]) => {
-        verdict: "match";
-    } | {
-        verdict: "mismatch";
-        ownRootHex: string | null;
-        detail: string;
-    } | {
-        verdict: "cannot_judge";
-        reason: string;
-    };
-    /**
-     * SEC-2: the agent's K_local signer — authenticates every FROST commit/sign request the ceremony
-     * sends to the directory (the directory verifies it against agentPubkeyHex before touching its share).
-     */
-    keyProvider: KeyProvider;
-    /** The agent's directory-connected libp2p node (the per-agent signaling node). */
-    getNode: () => CelloNode | null;
-    /** Resolve the directory endpoint to open FROST streams on (single-node / primary). */
-    getDirectoryEndpoint: () => Promise<{
-        peerId: string;
-        multiaddr?: string;
-    } | null>;
-    /**
-     * DOD-SIGN-1: resolve the FULL consortium directory-node roster from the verified manifest at
-     * ceremony time, or NULL when no consortium manifest is configured. A non-null roster ⇒ the
-     * threshold signer coordinates the FROST ceremony across ALL these nodes (T-of-N — it excludes
-     * a node that's down and reaches any T). Null ⇒ single-node (M6/M7 back-compat).
-     */
-    getConsortiumEndpoints: () => Promise<ConsortiumEndpoint[] | null>;
-    /** The agent's per-agent signaling seam (where ceremony_request arrives + result is sent). */
-    signaling: SignalingSeam;
-    logger: Logger;
-    /**
-     * DOD-M15-SEALPARTIES-1: leave a mark when the seal ceremony dies, so the answer outlives it.
-     *
-     * `if (!frostSignature) return;` was the whole handling of a ceremony that produced no signature
-     * — no log line, no record, nothing. Requiring the co-signing directories to judge the leaves adds
-     * a NEW way to land there (they refuse), and a refusal nobody hears is indistinguishable from the
-     * seal simply never happening. It also covers the paths that were already silent: a root this
-     * agent cannot confirm, an inflated frontier, a share it cannot load.
-     *
-     * REQUIRED rather than optional, deliberately: an optional sink is one a call site forgets, and
-     * the whole class of defect this unit is closing is a check that quietly stopped being wired.
-     */
-    recordSealFailure: (agentName: string, sessionId: string, reason: string, kind: "unresolved" | "refused") => void;
-}
-export declare function reconstructThresholdSigner(deps: CeremonyWiringDeps, 
-/**
- * DOD-M15-SEALPARTIES-1: the signed leaves this ceremony's TBS is a root over, forwarded to every
- * directory node so each reaches its own verdict instead of signing a claim. Supplied on the seal
- * ceremony and on nothing else — a co-signer requires it under the seal context and ignores it
- * everywhere else.
- */
-sealEvidence?: import("./network-directory-node.js").SealCeremonyEvidence): Promise<IThresholdSigner | null>;
-/**
- * M8B DOD-REFRESH-1: run a proactive share refresh for an already-registered agent. Rotates the client's
- * + every directory node's share to the next epoch (group public key unchanged), then persists the
- * client's new share as the active one so subsequent signing uses the new epoch and old-epoch shares die.
- */
-export declare function runAgentRefresh(deps: CeremonyWiringDeps): Promise<{
-    ok: true;
-    toEpochN: number;
-    primaryPubkey: string;
-    verifyingSharesDigest: string;
-} | {
-    ok: false;
-    reason: string;
-}>;
-/**
- * Register a `ceremony_request` handler on the agent's signaling seam. On the directory's
- * delegated-signing request, run the agent's threshold signer's participateInCeremony and
- * reply with `ceremony_result`. The signer is reconstructed lazily and cached. Returns the
- * unregister function. SI-001: tbs/signature never logged.
- */
-/**
- * DOD-SPINE-7: register a `seal_verified` handler on the agent's signaling seam. After the
- * directory rebuilds + verifies the bilateral seal's signed Merkle chain (relay-mediated
- * processSeal FROST path), it sends the SEAL INITIATOR a `seal_verified` {session_id,
- * sealed_root, leaf_count, timestamp} and waits for the initiator to COORDINATE the seal FROST
- * ceremony. This handler reconstructs the agent's threshold signer (same machinery as the
- * session ceremony), runs participateInCeremony over buildSealTbs with context
- * "cello-frost-seal-v1", and replies `seal_frost_signature` {session_id, frost_signature}. The
- * directory's #processSealFrostSignature then completes notarization and delivers
- * `session_sealed` (the byte-identical sealed_root) to both parties.
- *
- * SI-001: tbs/signature never logged.
- */
-export declare function wireSealCeremonyHandler(deps: CeremonyWiringDeps): () => void;
-/**
- * DOD-SENDRAW-1: deliver the co-signed seal FROST signature to the directory, branching on the
- * seam's RESOLVED result. The production seam (transport SignalingManager.sendRaw) never throws —
- * it resolves {ok:false, reason} on every failure — so the old try/catch logged `.sent` for a
- * signature that never left the machine, inside the non-repudiation ceremony, and the failure
- * event was unreachable. Exported so the send contract is testable without a live FROST ceremony.
- */
-export declare function sendSealFrostSignature(deps: {
-    agentName: string;
-    signaling: SignalingSeam;
-    logger: Logger;
-}, sessionId: Uint8Array, sidHex: string, frostSignature: Uint8Array): Promise<void>;
-/**
- * SESSION-002 (DOD-SEAL-3): verify a unilateral seal certificate WITHOUT trusting the
- * channel. Rebuilds the canonical seal TBS from the cert fields and verifies the signature
- * against a key trusted independently of the delivering frame: the session primary_pubkey
- * (commitments[0] of this agent's FROST share) for 'frost'. A channel-swapped sealed_root
- * (or any TBS-bound field) fails this check (SI-003).
- *
- * 'single' is not a second variant this function is missing — it is a DOWNGRADE, refused by name
- * before a session exists (`assignment_signature_type_downgraded`, assignment-verify.ts, checked
- * against the directory's only producer of `signature_type`). A cert carrying it is a shape no
- * honest peer can produce, so the branch below refuses rather than verifying. Do not "finish" it
- * by adding a manifest-key path: that would make the downgrade verifiable instead of refused,
- * which is the outcome the upstream check exists to prevent.
- */
-export declare function verifyUnilateralCertificate(deps: {
-    persistence: DaemonRegistrationPersistence;
-    agentPubkeyHex: string;
-    logger: Logger;
-}, cert: {
-    sessionId: Uint8Array;
-    sealedRoot: Uint8Array;
-    leafCount: number;
-    closeTimestamp: number;
-    frostSignature: Uint8Array;
-    signatureType: "frost" | "single";
-}): Promise<{
-    ok: true;
-} | {
-    ok: false;
-    reason: string;
-}>;
-/**
- * M7 legibility-TBS-binding: verify a BILATERAL session_sealed certificate's signature over the
- * legibility-bound TBS, channel-independently.
- *
- * KEY STRUCTURE (why verifiability is asymmetric TODAY): the seal's FROST signature is produced by
- * the group key (commitments[0] of the DKG share) of whichever party CLOSED THE SESSION FIRST — the
- * directory designates the sender of the first SEAL ctrl leaf as the "seal initiator" and signs
- * against that party's primary (directory-node.ts). This is NOT a fixed initiator/responder role:
- * either the session initiator or the responder can be the first closer.
- *
- * A party can channel-independently verify here only against a group primary it HOLDS locally:
- *  - its OWN primary — loaded from its own DKG share (`signer_pubkey === own primary`); or
- *  - the counterparty's primary — recorded via recordCounterpartyPrimary (see below).
- * It then verifies the FROST signature over `buildSealTbs ‖ legibilityHash`. A tampered legibility
- * (answered / content_frontier_seq / attestation_mode — carried unsigned on the frame) changes the
- * hash → the signature fails → REJECT.
- *
- * When the signer's key is NOT held locally, the party ACCEPTS (`verified:false`, with a `reason`).
- * This is sound for the LIVE path: session_sealed arrives over the daemon↔directory libp2p Noise
- * channel (authenticated + encrypted), so it is not MITM-tamperable in transit; the binding's
- * primary value is OUT-OF-BAND (any holder of the signer's primary — e.g. an arbitrator — can verify
- * an exported cert's legibility).
- *
- * SYMMETRY: both closing orders verify locally, and it takes BOTH bindings to stay that way. The
- * initiator learns the responder's primary from `participant_b_primary_pubkey` with a binding
- * signed by participant_b's own K_local, recorded by `initiate-session-handler.ts`; the responder
- * learns the initiator's from `signer_pubkey` with `participant_a_key_binding`, verified before the
- * assignment's threshold signature is checked at all and recorded by `inbound-sessions.ts`. Both
- * are refused by name when absent or invalid (`assignment-verify.ts`).
- *
- * The binding, not the key, is the load-bearing part: carrying a group key alone would let a
- * directory name one of its choosing, so a change that keeps either key and drops its binding
- * breaks verification while appearing to work.
- *
- * `signer_key_not_held` is therefore NOT the ordinary responder-first outcome. It remains reachable
- * for a session row that predates the recording, or one whose assignment never reached this path,
- * and it is the honest answer there, which is why the branch stays.
- *
- * `legibility` MUST be the AS-RECEIVED wire object (not a normalised copy) — the directory signed
- * over the canonical hash of exactly what it sent.
- */
-export declare function verifyBilateralSealCertificate(deps: {
-    persistence: DaemonRegistrationPersistence;
-    agentPubkeyHex: string;
-    logger: Logger;
-    counterpartyPrimaryHex?: string | null;
-}, cert: {
-    sessionId: Uint8Array;
-    sealedRoot: Uint8Array;
-    leafCount: number;
-    closeTimestamp: number;
-    frostSignature: Uint8Array;
-    signerPubkey: Uint8Array;
-    signatureType: "frost" | "single";
-    legibility: LegibilityForHash | null;
-}): Promise<{
-    ok: true;
-    verified: boolean;
-    reason?: string;
-} | {
-    ok: false;
-    reason: string;
-}>;
-export declare function wireSessionCeremonyHandler(deps: CeremonyWiringDeps): () => void;
-//# sourceMappingURL=session-ceremony.d.ts.map

package/dist/session-ceremony.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-ceremony.d.ts","sourceRoot":"","sources":["../src/session-ceremony.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B,EAAE,MAAM;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9E;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,sBAAsB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;IAC3H;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,IAAI,CAmPb;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,6BAA6B,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,KAC1B;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7I;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,kFAAkF;IAClF,OAAO,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IAChC,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnF;;;;;OAKG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,8FAA8F;IAC9F,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,SAAS,KAAK,IAAI,CAAC;CACnH;AAwHD,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,kBAAkB;AACxB;;;;;GAKG;AACH,YAAY,CAAC,EAAE,OAAO,6BAA6B,EAAE,oBAAoB,GACxE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQlC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6E/H;AAED;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,IAAI,CA4N5E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACrE,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,WAAW,EAAE,6BAA6B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC5F,IAAI,EAAE;IACJ,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,UAAU,CAAC;IAC3B,aAAa,EAAE,OAAO,GAAG,QAAQ,CAAC;CACnC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE;IAAE,WAAW,EAAE,6BAA6B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACpI,IAAI,EAAE;IACJ,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmD3F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAwE/E"}