@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-leaf-records.d.ts

@@ -1,159 +0,0 @@
-/**
- * CELLO Daemon — THE TWO DURABLE FACTS ABOUT A SESSION'S LEAVES
- *
- * Split out of `session-node-manager.ts` by 037-SESSIONCORE. Both are DURABLE PER-SESSION LEAF
- * FACTS that outlive the process, which is why they are here together rather than with the
- * in-memory tree:
- *
- * ⚠️ NOT "both are read at seal time" — that was the first wording and it is false of both halves.
- * The genesis is read at session OPEN and at SEND (`#signOwnContentClaim`), never at seal; the
- * certified leaf set is written at seal and read at PROOF time. The distinction matters because
- * this header is the rule the next extraction obeys when deciding what belongs here.
- *
- *   - the GENESIS prev-root — where this two-party chain starts. It is a defined 32 bytes derived
- *     from both keys, the session id and the session timestamp, NOT 32 zeros: a constant identical
- *     across every session is one an attacker could present for any session, which would make the
- *     one position most exposed to a forged acknowledgement the only one nobody could check.
- *   - the CERTIFIED LEAF SET — which leaves the directory actually attested, and the state of that
- *     answer when it could not be obtained.
- *
- * Moved verbatim, comments included.
- */
-import type { Logger } from "./types.js";
-import type { SessionQueries } from "./session-queries.js";
-import type { ActiveSessionEntry } from "./session-node-types.js";
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { RelayAssignmentCarry } from "./session-relay-client.js";
-import type { SealFrontierLeaf } from "./seal-frontier-verify.js";
-/** What the leaf records need from the manager — six things, none of them session state. */
-export interface SessionLeafRecordContext {
-    readonly logger: Logger;
-    readonly queries: SessionQueries;
-    /** A function: the manager opens its database after construction. Re-exposed below as `#db`. */
-    db(): DaemonDatabase | null;
-    sessionKey(agentName: string, sessionId: string): string;
-    requireAgentId(agentName: string): string;
-    activeEntry(key: string): ActiveSessionEntry | undefined;
-}
-export declare class SessionLeafRecords {
-    #private;
-    constructor(ctx: SessionLeafRecordContext);
-    /**
-     * The session's genesis prev_root — what its FIRST message acknowledges, before anything has been
-     * received (033-ACKEMIT).
-     *
-     * DERIVED FIRST, STORED SECOND — and this docblock used to say "derived, never stored", which
-     * stopped being true inside this same unit. Rewritten rather than deleted: a reader who believed
-     * the first sentence would delete the column read below as redundant, and take the restart case
-     * with it.
-     *
-     * The live assignment is authoritative, because it is the thing the value is defined by. The
-     * stored column covers the one case the derivation cannot: a session restored after a restart
-     * re-registers with no assignment, and the session TIMESTAMP the genesis needs lives nowhere
-     * else.
-     *
-     * `undefined` when neither is available. The callers do not paper over that — they say, in the
-     * log and in the claim itself, that this session acknowledges nothing yet.
-     */
-    sessionGenesisPrevRoot(agentName: string, sessionId: string): Uint8Array | undefined;
-    /**
-     * 069-ORDERPROOF — the relay key this session's ordering attestations are checked against.
-     *
-     * Read in the SAME ORDER as the genesis next door, and for the same reasons: the live assignment
-     * first because it is authoritative, then the in-memory record (written before the session ROW
-     * exists), then the row (the restart case, where nothing else holds it).
-     *
-     * `undefined` means this session has no anchor — a direct session, or one opened before this
-     * order. The caller does not paper over that: an attestation arriving on such a session is
-     * refused by name rather than verified against whatever key it supplies.
-     */
-    sessionRelayAnchor(agentName: string, sessionId: string): string | undefined;
-    /**
-     * Record the relay anchor, in memory first and durably second — the same split, and the same
-     * reason, as `persistGenesisPrevRoot`: the value is read when the session registers, which is
-     * before the session row exists.
-     */
-    persistRelayAnchor(agentName: string, sessionId: string, relayAnchorHex: string | undefined): void;
-    persistGenesisPrevRoot(agentName: string, sessionId: string, assignment: RelayAssignmentCarry): void;
-    /**
-     * Persist the session's genesis prev_root, once, at the moment the assignment arrives.
-     *
-     * `WHERE genesis_prev_root IS NULL` rather than a plain update: the value cannot legitimately
-     * change for the life of a session, so the second writer is either redundant or wrong, and the
-     * first write is the one derived closest to the assignment that opened the session.
-     */
-    /**
-     * Record the session's starting point from the ASSIGNMENT — `DOD-M15-SELFCHAIN-1`.
-     *
-     * ⚠️ **CALL THIS BEFORE `createSessionNode` / `acceptSession`, NOT AFTER.** Registering the
-     * session is what seeds the relay client's acknowledgement state, so the value has to exist by
-     * then; recorded afterwards, the first message of the session has nothing to chain to and is
-     * refused. Both the initiator and the responder derive this from the same FROST-signed assignment
-     * before they build anything.
-     *
-     * ⚠️ THE ANCHOR BELONGS TO THE SESSION, NOT TO THE RELAY, and treating it as the relay's was a
-     * real gap. It was derived only when a relay assignment CARRY was present — and that carry is
-     * built only for a relay-mode assignment that also carries a per-node relay signature. So a
-     * direct-mode session, brokered and FROST-signed exactly like any other, recorded no starting
-     * point at all, and every message on it had nothing to chain to.
-     *
-     * Both transport modes get their assignment from the same ceremony and derive the same value from
-     * it. The relay is how the conversation travels; it is not what makes the conversation provable.
-     */
-    recordSessionGenesis(agentName: string, sessionId: string, participantA: Uint8Array, participantB: Uint8Array, sessionTimestamp: number, sessionSignature: Uint8Array | undefined, relayAnchorHex?: string): void;
-    /**
-     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
-     * 033-ACKEMIT.
-     *
-     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
-     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
-     *
-     * In production this value is derived from the directory-signed relay assignment and written to
-     * the session row the moment the session learns it, so every real session has one. A fixture that
-     * builds a session node directly never sees an assignment — so without this seam every content
-     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
-     * the thing it was written for, and would report that as a pass or a mysterious failure depending
-     * on which side of the send it sat on.
-     */
-    setSessionGenesisForTest(agentName: string, sessionId: string, genesis: Uint8Array): void;
-    /**
-     * DOD-M15-INCLUSION-1: keep the leaf set the certificate is signed over, so one message can later
-     * be proved to sit under it.
-     *
-     * REFUSES unless the hashes reproduce `sealedRootHex` — `certifiedLeafSetFrom` does that check and
-     * this method never bypasses it. That is what separates "the leaves the directory sent" from "the
-     * leaves the consortium signed", and only the second is worth storing: a proof built on the first
-     * would inherit whatever the directory chose to say.
-     *
-     * Idempotent (INSERT OR REPLACE keyed on leaf_index) so a re-delivered seal frame, or a unilateral
-     * seal later upgraded to bilateral, rewrites the same rows instead of failing or doubling them.
-     *
-     * @returns whether the set was accepted and stored.
-     */
-    recordCertifiedLeafSet(agentName: string, sessionId: string, signedLeaves: readonly SealFrontierLeaf[], sealedRootHex: string, correlationId?: string): boolean;
-    /**
-     * Record WHY this session does or does not have a certified leaf set.
-     *
-     * Public for the one case the manager cannot see: a seal frame that carried no signed leaves at
-     * all never reaches `recordCertifiedLeafSet`, and that absence is a permanent fact about the
-     * session for the party that observed it.
-     */
-    noteCertifiedLeafSetUnavailable(agentName: string, sessionId: string, state: "not_carried_absent_party" | "not_carried_present_party", detail: string): void;
-    getCertifiedLeafSet(agentName: string, sessionId: string): string[] | null;
-    getCertifiedLeafSetState(agentName: string, sessionId: string): {
-        state: string;
-        detail: string | null;
-    } | null;
-    /** The in-memory genesis prev-root for a session, when one has been recorded. */
-    genesisFor(agentName: string, sessionId: string): Uint8Array | undefined;
-    /**
-     * The in-memory relay anchor for a session — the counterpart of `genesisFor`, and read at the
-     * same moment for the same reason: the session ROW is inserted after the anchor is recorded, so
-     * the INSERT carries the value rather than an UPDATE trying to find a row that is not there yet.
-     *
-     * Deliberately NOT `sessionRelayAnchor`: that one reads the row as its last resort, which at
-     * insert time is the row being written. This is the memory copy only.
-     */
-    relayAnchorFor(agentName: string, sessionId: string): string | undefined;
-}
-//# sourceMappingURL=session-leaf-records.d.ts.map

package/dist/session-leaf-records.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-leaf-records.d.ts","sourceRoot":"","sources":["../src/session-leaf-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,4FAA4F;AAC5F,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,gGAAgG;IAChG,EAAE,IAAI,cAAc,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;CAC1D;AAED,qBAAa,kBAAkB;;gBAGjB,GAAG,EAAE,wBAAwB;IAmCzC;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAyCpF;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAc5E;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAiClG,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAwDpG;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,UAAU,EACxB,YAAY,EAAE,UAAU,EACxB,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,EAAE,UAAU,GAAG,SAAS,EACxC,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI;IAQP;;;;;;;;;;;;;OAaG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IA0BzF;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,gBAAgB,EAAE,EACzC,aAAa,EAAE,MAAM,EACrB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO;IAqFV;;;;;;OAMG;IACH,+BAA+B,CAC7B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,0BAA0B,GAAG,2BAA2B,EAC/D,MAAM,EAAE,MAAM,GACb,IAAI;IAGP,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAC1E,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAE/G,iFAAiF;IACjF,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIxE;;;;;;;OAOG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAGzE"}

package/dist/session-leaf-records.js

@@ -1,408 +0,0 @@
-import { computeGenesisPrevRoot, computeChainAnchor } from "@cello-protocol/protocol-types";
-import { extractErrorMessage } from "./error-message.js";
-import { certifiedLeafSetFrom } from "./sealed-leaf-set.js";
-export class SessionLeafRecords {
-    #ctx;
-    constructor(ctx) {
-        this.#ctx = ctx;
-    }
-    /** A getter so the moved queries still read `this.#db` and narrow exactly as they did. */
-    get #db() {
-        return this.#ctx.db();
-    }
-    /**
-     * The starting point of each live session's chain, in memory.
-     *
-     * ⚠️ NOT A CACHE OF THE DATABASE — it is the only copy that exists at the moment the value is
-     * first needed. It is recorded before the session node is built, and the session ROW does not
-     * exist until that build inserts it (`#insertSessionRow` writes the column from here). The row is
-     * what survives a restart; this is what the session open itself reads.
-     *
-     * ⚠️ **DELIBERATELY NOT EVICTED, and this module ships no `evictSession` because of it.** Every
-     * other collaborator has one, so the absence reads as an oversight — it is not. Dropping this on
-     * teardown would lose the in-memory genesis for any session whose `UPDATE sessions SET
-     * genesis_prev_root` FAILED, which is exactly the case `persistGenesisPrevRoot`'s error log says
-     * survives until a restart. Adding an `evictSession` here for symmetry would delete the only copy.
-     *
-     * ⚠️ IT THEREFORE GROWS FOR THE LIFE OF THE PROCESS — pre-existing, and stated rather than fixed.
-     * "each live session's chain" above is what it is FOR, not what it holds: entries are set and read
-     * and never removed, so it is roughly 200 bytes per session ever opened. Bounding it is not
-     * obviously safe for the reason directly above, so it wants a decision rather than a tidy-up.
-     */
-    #sessionGenesis = new Map();
-    /**
-     * 069-ORDERPROOF — session key → the assigned relay's ack-signing pubkey, hex. The in-memory half
-     * of the anchor, written before the session row exists for exactly the reason the genesis map
-     * above is.
-     */
-    #sessionRelayAnchor = new Map();
-    /**
-     * The session's genesis prev_root — what its FIRST message acknowledges, before anything has been
-     * received (033-ACKEMIT).
-     *
-     * DERIVED FIRST, STORED SECOND — and this docblock used to say "derived, never stored", which
-     * stopped being true inside this same unit. Rewritten rather than deleted: a reader who believed
-     * the first sentence would delete the column read below as redundant, and take the restart case
-     * with it.
-     *
-     * The live assignment is authoritative, because it is the thing the value is defined by. The
-     * stored column covers the one case the derivation cannot: a session restored after a restart
-     * re-registers with no assignment, and the session TIMESTAMP the genesis needs lives nowhere
-     * else.
-     *
-     * `undefined` when neither is available. The callers do not paper over that — they say, in the
-     * log and in the claim itself, that this session acknowledges nothing yet.
-     */
-    sessionGenesisPrevRoot(agentName, sessionId) {
-        const assignment = this.#ctx.activeEntry(this.#ctx.sessionKey(agentName, sessionId))?.relayAssignment;
-        if (assignment?.sessionSignature) {
-            return computeChainAnchor(computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp), assignment.sessionSignature);
-        }
-        /**
-         * ⚠️ THE IN-MEMORY RECORD, READ BEFORE THE DATABASE — and this ordering is the fix, not a
-         * cache.
-         *
-         * `recordSessionGenesis` is called BEFORE the session node exists, because registering the
-         * session is what seeds the relay client's acknowledgement state and the seed has to be
-         * available by then. At that moment there is no session ROW to write to — `createSessionNode`
-         * inserts it — so a database-only record would still be empty at the one moment it is read.
-         * The row is written from this map when the insert happens, and read back after a restart.
-         */
-        const recorded = this.#sessionGenesis.get(this.#ctx.sessionKey(agentName, sessionId));
-        if (recorded)
-            return recorded;
-        /**
-         * THE RESTART CASE. A session restored from the database re-registers with no assignment, so
-         * the derivation above has nothing to work from and the stored copy is the only answer. Read
-         * second, never first: the live assignment is authoritative, and a stored value that ever
-         * disagreed with it would be the more dangerous of the two to prefer.
-         */
-        const row = this.#db
-            ?.prepare("SELECT genesis_prev_root FROM sessions WHERE agent_id = ? AND session_id = ?")
-            .get(this.#ctx.requireAgentId(agentName), sessionId);
-        const stored = row?.genesis_prev_root;
-        const bytes = stored instanceof Uint8Array ? stored : Buffer.isBuffer(stored) ? new Uint8Array(stored) : null;
-        // A stored value of the wrong width is not a genesis. Refusing it here sends the caller down its
-        // own named refusal, which is a better outcome than signing an acknowledgement of 17 bytes.
-        if (bytes && bytes.length === 32)
-            return bytes;
-        return undefined;
-    }
-    /**
-     * 069-ORDERPROOF — the relay key this session's ordering attestations are checked against.
-     *
-     * Read in the SAME ORDER as the genesis next door, and for the same reasons: the live assignment
-     * first because it is authoritative, then the in-memory record (written before the session ROW
-     * exists), then the row (the restart case, where nothing else holds it).
-     *
-     * `undefined` means this session has no anchor — a direct session, or one opened before this
-     * order. The caller does not paper over that: an attestation arriving on such a session is
-     * refused by name rather than verified against whatever key it supplies.
-     */
-    sessionRelayAnchor(agentName, sessionId) {
-        const live = this.#ctx.activeEntry(this.#ctx.sessionKey(agentName, sessionId))?.relayAssignment?.relayPubkeyHex;
-        if (live)
-            return live;
-        const recorded = this.#sessionRelayAnchor.get(this.#ctx.sessionKey(agentName, sessionId));
-        if (recorded)
-            return recorded;
-        const row = this.#db
-            ?.prepare("SELECT relay_anchor_hex FROM sessions WHERE agent_id = ? AND session_id = ?")
-            .get(this.#ctx.requireAgentId(agentName), sessionId);
-        const stored = row?.relay_anchor_hex;
-        // A stored value of the wrong shape is not a key. Refusing it here sends the caller down its
-        // own named refusal rather than verifying signatures against 17 bytes.
-        return typeof stored === "string" && /^[0-9a-f]{64}$/i.test(stored) ? stored : undefined;
-    }
-    /**
-     * Record the relay anchor, in memory first and durably second — the same split, and the same
-     * reason, as `persistGenesisPrevRoot`: the value is read when the session registers, which is
-     * before the session row exists.
-     */
-    persistRelayAnchor(agentName, sessionId, relayAnchorHex) {
-        if (!relayAnchorHex || !/^[0-9a-f]{64}$/i.test(relayAnchorHex))
-            return;
-        this.#sessionRelayAnchor.set(this.#ctx.sessionKey(agentName, sessionId), relayAnchorHex);
-        if (!this.#db)
-            return;
-        /**
-         * WRITE-ONCE ON DISK, overwritable in memory — an asymmetry worth naming rather than leaving to
-         * be discovered. If a session is ever handed to a SECOND relay (resume/handover, which nothing
-         * requests today), the row keeps the FIRST relay's key. Read order prefers the live assignment,
-         * so this only shows after a restart, and it shows as a named refusal — attestations checked
-         * against the old key fail loud — never as evidence accepted against the wrong witness. Whoever
-         * ships handover owns making this follow the handover.
-         */
-        try {
-            this.#db
-                .prepare("UPDATE sessions SET relay_anchor_hex = ? WHERE agent_id = ? AND session_id = ? AND relay_anchor_hex IS NULL")
-                .run(relayAnchorHex, this.#ctx.requireAgentId(agentName), sessionId);
-        }
-        catch (err) {
-            /**
-             * LOUD, AND IT DOES NOT BLOCK. Losing this row costs the session its ordering evidence after
-             * a restart — every send is then refused for want of an anchor — and that is a smaller harm
-             * than failing the session open in progress. ERROR because it is invisible until a restart.
-             */
-            this.#ctx.logger.error("session.relay_anchor.persist.failed", {
-                agentName, sessionId,
-                error: extractErrorMessage(err),
-                impact: "the relay this session is witnessed by was not written to the database. Everything works " +
-                    "until this daemon restarts; after that every message on this session is refused because " +
-                    "the daemon cannot say which relay's ordering signature to trust.",
-            });
-        }
-    }
-    persistGenesisPrevRoot(agentName, sessionId, assignment) {
-        let genesis;
-        try {
-            // The chain starts from the genesis bound to the opening FROST signature (computeChainAnchor).
-            if (!assignment.sessionSignature)
-                throw new Error("the assignment carries no session FROST signature to anchor the chain");
-            genesis = computeChainAnchor(computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp), assignment.sessionSignature);
-        }
-        catch (err) {
-            /**
-             * The DERIVATION failed, which is a different failure from the write below and must not be
-             * reported as one. It means the assignment's own fields are not what this function needs, and
-             * no amount of database health would help.
-             */
-            this.#ctx.logger.error("session.genesis.derive.failed", {
-                agentName, sessionId,
-                error: extractErrorMessage(err),
-                impact: "this session's starting point could not be computed from its assignment, so nothing " +
-                    "sent on it can be chained and every send will be refused by name. The session open " +
-                    "continues; the conversation cannot.",
-            });
-            return;
-        }
-        // The in-memory record FIRST, and unconditionally: it is what the session open reads, and it
-        // must not depend on a database write that may not have anywhere to land yet.
-        this.#sessionGenesis.set(this.#ctx.sessionKey(agentName, sessionId), genesis);
-        if (!this.#db)
-            return;
-        try {
-            this.#db
-                .prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ? AND genesis_prev_root IS NULL")
-                .run(Buffer.from(genesis), this.#ctx.requireAgentId(agentName), sessionId);
-        }
-        catch (err) {
-            /**
-             * LOUD, AND IT DOES NOT BLOCK. Losing this row costs the session its acknowledgements after a
-             * restart — sends are then refused by name until the counterparty speaks — and that is a far
-             * smaller harm than failing the session open that is in progress. Reported at ERROR because
-             * the failure is invisible until a restart that may be days away.
-             */
-            this.#ctx.logger.error("session.genesis.persist.failed", {
-                agentName, sessionId,
-                error: extractErrorMessage(err),
-                impact: "this session's starting point was not written to the database. Everything works until " +
-                    "this daemon restarts; after that, a send on this session is refused until the " +
-                    "counterparty has sent something, because the daemon cannot say what its first message " +
-                    "acknowledges.",
-            });
-        }
-    }
-    /**
-     * Persist the session's genesis prev_root, once, at the moment the assignment arrives.
-     *
-     * `WHERE genesis_prev_root IS NULL` rather than a plain update: the value cannot legitimately
-     * change for the life of a session, so the second writer is either redundant or wrong, and the
-     * first write is the one derived closest to the assignment that opened the session.
-     */
-    /**
-     * Record the session's starting point from the ASSIGNMENT — `DOD-M15-SELFCHAIN-1`.
-     *
-     * ⚠️ **CALL THIS BEFORE `createSessionNode` / `acceptSession`, NOT AFTER.** Registering the
-     * session is what seeds the relay client's acknowledgement state, so the value has to exist by
-     * then; recorded afterwards, the first message of the session has nothing to chain to and is
-     * refused. Both the initiator and the responder derive this from the same FROST-signed assignment
-     * before they build anything.
-     *
-     * ⚠️ THE ANCHOR BELONGS TO THE SESSION, NOT TO THE RELAY, and treating it as the relay's was a
-     * real gap. It was derived only when a relay assignment CARRY was present — and that carry is
-     * built only for a relay-mode assignment that also carries a per-node relay signature. So a
-     * direct-mode session, brokered and FROST-signed exactly like any other, recorded no starting
-     * point at all, and every message on it had nothing to chain to.
-     *
-     * Both transport modes get their assignment from the same ceremony and derive the same value from
-     * it. The relay is how the conversation travels; it is not what makes the conversation provable.
-     */
-    recordSessionGenesis(agentName, sessionId, participantA, participantB, sessionTimestamp, sessionSignature, relayAnchorHex) {
-        this.persistGenesisPrevRoot(agentName, sessionId, {
-            participantA, participantB, sessionTimestamp, sessionSignature,
-        });
-        // 069-ORDERPROOF: the anchor is recorded at the same moment and from the same signed
-        // assignment, so a session can never hold one without the other.
-        this.persistRelayAnchor(agentName, sessionId, relayAnchorHex);
-    }
-    /**
-     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
-     * 033-ACKEMIT.
-     *
-     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
-     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
-     *
-     * In production this value is derived from the directory-signed relay assignment and written to
-     * the session row the moment the session learns it, so every real session has one. A fixture that
-     * builds a session node directly never sees an assignment — so without this seam every content
-     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
-     * the thing it was written for, and would report that as a pass or a mysterious failure depending
-     * on which side of the send it sat on.
-     */
-    setSessionGenesisForTest(agentName, sessionId, genesis) {
-        /**
-         * ⚠️ WRITES THE SAME MAP PRODUCTION WRITES, deliberately — `DOD-M15-SELFCHAIN-1`.
-         *
-         * This seam exists because a fixture builds a session below the paths that derive a starting
-         * point from a directory assignment; it does NOT exist to install a second, quieter source of
-         * the value. Sharing the map means a fixture and a real session read through exactly the same
-         * lookup, so a change to that lookup cannot pass the tests while breaking production.
-         *
-         * ⚠️ CALL IT BEFORE `createSessionNode`, the same rule production follows: registering the
-         * session is what seeds the relay client's acknowledgement state, and a value recorded after
-         * that leaves the first send with nothing to chain to.
-         */
-        this.#sessionGenesis.set(this.#ctx.sessionKey(agentName, sessionId), Uint8Array.from(genesis));
-        /**
-         * The durable half is BEST EFFORT. Some fixtures run against a database whose schema was never
-         * created, and a seam that threw there would turn "this fixture has no sessions table" into a
-         * failure of whatever it was actually testing. Harmless when the row does not exist yet either:
-         * `#insertSessionRow` writes the column from the map above.
-         */
-        try {
-            this.#db
-                ?.prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ?")
-                .run(Buffer.from(genesis), this.#ctx.requireAgentId(agentName), sessionId);
-        }
-        catch { /* see above — the in-memory half is the load-bearing one */ }
-    }
-    /**
-     * DOD-M15-INCLUSION-1: keep the leaf set the certificate is signed over, so one message can later
-     * be proved to sit under it.
-     *
-     * REFUSES unless the hashes reproduce `sealedRootHex` — `certifiedLeafSetFrom` does that check and
-     * this method never bypasses it. That is what separates "the leaves the directory sent" from "the
-     * leaves the consortium signed", and only the second is worth storing: a proof built on the first
-     * would inherit whatever the directory chose to say.
-     *
-     * Idempotent (INSERT OR REPLACE keyed on leaf_index) so a re-delivered seal frame, or a unilateral
-     * seal later upgraded to bilateral, rewrites the same rows instead of failing or doubling them.
-     *
-     * @returns whether the set was accepted and stored.
-     */
-    recordCertifiedLeafSet(agentName, sessionId, signedLeaves, sealedRootHex, correlationId) {
-        if (!this.#db)
-            return false;
-        const resolved = certifiedLeafSetFrom(signedLeaves, sealedRootHex);
-        if (!resolved.ok) {
-            // The CAUSE is written where the proof surface can read it — fallback-finder finding 1. Without
-            // this row, `sealed_leaves_root_disagrees` (a directory contradicting its own FROST signature)
-            // and "this side was simply absent" are the same `null` downstream, and the operator is told
-            // the second.
-            this.#ctx.queries.noteCertifiedLeafState(agentName, sessionId, resolved.reason, resolved.detail);
-            // LOUD, and it names which of the two it is. `sealed_leaves_root_disagrees` in particular is
-            // the directory shipping a leaf set that is not the one it signed — the receipt still stands
-            // (its own signature is checked elsewhere), but nothing in this session can be proved at
-            // message granularity until a set that reproduces the root arrives.
-            this.#ctx.logger.error("seal.certified_leaves.refused", {
-                agentName,
-                sessionId,
-                reason: resolved.reason,
-                detail: resolved.detail,
-                correlationId,
-                impact: "the leaf set shipped with this seal is not the one the certificate is signed over, so no " +
-                    "inclusion proof can be issued for this session; the sealed receipt itself is unaffected",
-                guidance: "cello_get_inclusion_proof will refuse this session by name (certified_leaves_unavailable). " +
-                    "Nothing local repairs it — the set has to arrive with a seal frame that reproduces the " +
-                    "signed root.",
-            });
-            return false;
-        }
-        const now = Date.now();
-        try {
-            const agentId = this.#ctx.requireAgentId(agentName);
-            /**
-             * DELETE THEN INSERT, INSIDE A TRANSACTION — fallback-finder finding 5.
-             *
-             * `INSERT OR REPLACE` alone is idempotent only for a set of the SAME length: a shorter
-             * re-delivery overwrites 0..k-1 and leaves stale rows at k..n-1, and an un-transacted loop that
-             * throws halfway leaves a truncated set that `getCertifiedLeafSet` still returns (it tests
-             * `rows.length > 0`, not completeness). Both produce a set that no longer hashes to the
-             * certified root — caught on read, but reported to the operator as *"the local copy has
-             * changed since the seal"*, which points at tampering for a write that never finished.
-             */
-            // `BEGIN` / `COMMIT` / `ROLLBACK` via exec — this file's and `db-identity-store.ts`'s idiom.
-            // `DaemonDatabase` has no `transaction()` helper (node:sqlite's handle does not provide one),
-            // and reaching for better-sqlite3's would compile against the adapter and fail on the other.
-            this.#db.exec("BEGIN");
-            try {
-                this.#db.prepare("DELETE FROM session_certified_leaves WHERE agent_id = ? AND session_id = ?")
-                    .run(agentId, sessionId);
-                const stmt = this.#db.prepare(`INSERT INTO session_certified_leaves
-             (agent_id, session_id, leaf_index, content_hash_hex, recorded_at)
-           VALUES (?, ?, ?, ?, ?)`);
-                for (let i = 0; i < resolved.leafHashes.length; i++) {
-                    stmt.run(agentId, sessionId, i, resolved.leafHashes[i], now);
-                }
-                this.#db.exec("COMMIT");
-            }
-            catch (err) {
-                try {
-                    this.#db.exec("ROLLBACK");
-                }
-                catch { /* the failing statement may have aborted it already */ }
-                throw err;
-            }
-        }
-        catch (err) {
-            this.#ctx.queries.noteCertifiedLeafState(agentName, sessionId, "persist_failed", extractErrorMessage(err));
-            this.#ctx.logger.error("seal.certified_leaves.persist.failed", {
-                agentName,
-                sessionId,
-                reason: extractErrorMessage(err),
-                correlationId,
-                impact: "this session's certified leaf set was verified but not written, so cello_get_inclusion_proof " +
-                    "will refuse it by name until a later seal frame re-delivers the set",
-            });
-            return false;
-        }
-        this.#ctx.queries.noteCertifiedLeafState(agentName, sessionId, "stored", null);
-        this.#ctx.logger.info("seal.certified_leaves.recorded", {
-            agentName,
-            sessionId,
-            leafCount: resolved.leafHashes.length,
-            sealedRoot: sealedRootHex,
-            correlationId,
-        });
-        return true;
-    }
-    /**
-     * Record WHY this session does or does not have a certified leaf set.
-     *
-     * Public for the one case the manager cannot see: a seal frame that carried no signed leaves at
-     * all never reaches `recordCertifiedLeafSet`, and that absence is a permanent fact about the
-     * session for the party that observed it.
-     */
-    noteCertifiedLeafSetUnavailable(agentName, sessionId, state, detail) {
-        this.#ctx.queries.noteCertifiedLeafState(agentName, sessionId, state, detail);
-    }
-    getCertifiedLeafSet(agentName, sessionId) { return this.#ctx.queries.getCertifiedLeafSet(agentName, sessionId); }
-    getCertifiedLeafSetState(agentName, sessionId) { return this.#ctx.queries.getCertifiedLeafSetState(agentName, sessionId); }
-    /** The in-memory genesis prev-root for a session, when one has been recorded. */
-    genesisFor(agentName, sessionId) {
-        return this.#sessionGenesis.get(this.#ctx.sessionKey(agentName, sessionId));
-    }
-    /**
-     * The in-memory relay anchor for a session — the counterpart of `genesisFor`, and read at the
-     * same moment for the same reason: the session ROW is inserted after the anchor is recorded, so
-     * the INSERT carries the value rather than an UPDATE trying to find a row that is not there yet.
-     *
-     * Deliberately NOT `sessionRelayAnchor`: that one reads the row as its last resort, which at
-     * insert time is the row being written. This is the memory copy only.
-     */
-    relayAnchorFor(agentName, sessionId) {
-        return this.#sessionRelayAnchor.get(this.#ctx.sessionKey(agentName, sessionId));
-    }
-}
-//# sourceMappingURL=session-leaf-records.js.map

package/dist/session-leaf-records.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-leaf-records.js","sourceRoot":"","sources":["../src/session-leaf-records.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAa5D,MAAM,OAAO,kBAAkB;IACpB,IAAI,CAA2B;IAExC,YAAY,GAA6B;QACvC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,0FAA0F;IAC1F,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACzD;;;;OAIG;IACM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzD;;;;;;;;;;;;;;;;OAgBG;IACH,sBAAsB,CAAC,SAAiB,EAAE,SAAiB;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC;QACtG,IAAI,UAAU,EAAE,gBAAgB,EAAE,CAAC;YACjC,OAAO,kBAAkB,CACvB,sBAAsB,CACpB,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAC9C,UAAU,CAAC,gBAAgB,CAC5B,EACD,UAAU,CAAC,gBAAgB,CAC5B,CAAC;QACJ,CAAC;QACD;;;;;;;;;WASG;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACtF,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B;;;;;WAKG;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;YAClB,EAAE,OAAO,CAAC,8EAA8E,CAAC;aACxF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAgD,CAAC;QACtG,MAAM,MAAM,GAAG,GAAG,EAAE,iBAAiB,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,YAAY,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,iGAAiG;QACjG,4FAA4F;QAC5F,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC;QAChH,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;YAClB,EAAE,OAAO,CAAC,6EAA6E,CAAC;aACvF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAA+C,CAAC;QACrG,MAAM,MAAM,GAAG,GAAG,EAAE,gBAAgB,CAAC;QACrC,6FAA6F;QAC7F,uEAAuE;QACvE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,SAAiB,EAAE,SAAiB,EAAE,cAAkC;QACzF,IAAI,CAAC,cAAc,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO;QACvE,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB;;;;;;;WAOG;QACH,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CAAC,6GAA6G,CAAC;iBACtH,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;eAIG;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBAC5D,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EACJ,2FAA2F;oBAC3F,0FAA0F;oBAC1F,kEAAkE;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB,CAAC,SAAiB,EAAE,SAAiB,EAAE,UAAgC;QAC3F,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,+FAA+F;YAC/F,IAAI,CAAC,UAAU,CAAC,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3H,OAAO,GAAG,kBAAkB,CAC1B,sBAAsB,CACpB,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAC9C,UAAU,CAAC,gBAAgB,CAC5B,EACD,UAAU,CAAC,gBAAgB,CAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;eAIG;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACtD,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EACJ,sFAAsF;oBACtF,qFAAqF;oBACrF,qCAAqC;aACxC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,6FAA6F;QAC7F,8EAA8E;QAC9E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CAAC,+GAA+G,CAAC;iBACxH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;;eAKG;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBACvD,SAAS,EAAE,SAAS;gBACpB,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EACJ,wFAAwF;oBACxF,gFAAgF;oBAChF,wFAAwF;oBACxF,eAAe;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAClB,SAAiB,EACjB,SAAiB,EACjB,YAAwB,EACxB,YAAwB,EACxB,gBAAwB,EACxB,gBAAwC,EACxC,cAAuB;QAEvB,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE;YAChD,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB;SACvC,CAAC,CAAC;QAC3B,qFAAqF;QACrF,iEAAiE;QACjE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,wBAAwB,CAAC,SAAiB,EAAE,SAAiB,EAAE,OAAmB;QAChF;;;;;;;;;;;WAWG;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/F;;;;;WAKG;QACH,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;gBACN,EAAE,OAAO,CAAC,iFAAiF,CAAC;iBAC3F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;IAC1E,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CACpB,SAAiB,EACjB,SAAiB,EACjB,YAAyC,EACzC,aAAqB,EACrB,aAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,gGAAgG;YAChG,+FAA+F;YAC/F,6FAA6F;YAC7F,cAAc;YACd,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,6FAA6F;YAC7F,6FAA6F;YAC7F,yFAAyF;YACzF,oEAAoE;YACpE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE;gBACtD,SAAS;gBACT,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,aAAa;gBACb,MAAM,EACJ,2FAA2F;oBAC3F,yFAAyF;gBAC3F,QAAQ,EACN,6FAA6F;oBAC7F,yFAAyF;oBACzF,cAAc;aACjB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YACpD;;;;;;;;;eASG;YACH,6FAA6F;YAC7F,8FAA8F;YAC9F,6FAA6F;YAC7F,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4EAA4E,CAAC;qBAC3F,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAC3B;;kCAEwB,CACzB,CAAC;gBACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACpD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC;gBACpG,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBAC7D,SAAS;gBACT,SAAS;gBACT,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAChC,aAAa;gBACb,MAAM,EACJ,+FAA+F;oBAC/F,qEAAqE;aACxE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;YACtD,SAAS;YACT,SAAS;YACT,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;YACrC,UAAU,EAAE,aAAa;YACzB,aAAa;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD;;;;;;OAMG;IACH,+BAA+B,CAC7B,SAAiB,EACjB,SAAiB,EACjB,KAA+D,EAC/D,MAAc;QAEd,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IACD,mBAAmB,CAAC,SAAiB,EAAE,SAAiB,IAAqB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAClJ,wBAAwB,CAAC,SAAiB,EAAE,SAAiB,IAAqD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAE5L,iFAAiF;IACjF,UAAU,CAAC,SAAiB,EAAE,SAAiB;QAC7C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,SAAiB,EAAE,SAAiB;QACjD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;CACF"}