@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/signal-submission.js

@@ -1,368 +0,0 @@
-/**
- * M10B / DOD-END-SUBMIT-1 — the daemon side of the sealed submission queue (M10B-D2).
- *
- * Bob's daemon composes a submission, signs it with his agent's K_local, and seals it to the
- * portal's intake key. A directory node then carries a blob it cannot read until the portal drains
- * it. **The daemon never talks to the portal** — that is the decision this whole path exists to
- * honour, and it is what keeps a later move to per-node intake a routing change rather than a
- * migration of every installed client.
- *
- * WHAT THIS MODULE IS RESPONSIBLE FOR, and why it is separable from the send: everything here is
- * pure given its inputs, and it is where the invariants live. The transport can retry, fail over, or
- * be replaced; none of that can make an unsealed blob safe or a forged attribution valid.
- *
- *   INV-ATTRIBUTION — `submitter_pubkey` is read from the SIGNING key provider, and there is no
- *                     parameter to override it. A caller cannot name someone else, because the field
- *                     is not an input. Precedent: `accepting_node` in DOD-DIR-WRITE-1, "written by
- *                     the node itself, never accepted from the request".
- *   INV-CONSENT     — the plaintext is sealed to the intake key before it ever reaches the
- *                     directory, so a node operator learns nothing about who endorsed whom.
- *   §5a ABSENT      — a missing OR malformed intake key REFUSES, with the reason named. There is no
- *                     code path here that emits an unsealed submission; that is a structural
- *                     property of this file, not a policy someone remembered to apply.
- *
- * Crypto: Ed25519 → RFC 8032, CBOR → RFC 8949, SHA-256 → FIPS 180-4.
- */
-import { sealToRecipient } from "@cello-protocol/crypto";
-import { buildSubmissionTbs, encodeSubmission, submissionId, } from "@cello-protocol/protocol-types";
-/** The wire version this daemon emits. Signed, so it cannot be downgraded in flight. */
-const SUBMISSION_VERSION = 1;
-/** Ed25519 public keys are 32 bytes — 64 lowercase hex characters. */
-const INTAKE_PUBKEY_RE = /^[0-9a-f]{64}$/;
-const INV_ATTRIBUTION_NO_OVERRIDE = true;
-void INV_ATTRIBUTION_NO_OVERRIDE;
-/**
- * Compose → sign → seal. Returns the exact three values a queue row needs, or a named refusal.
- *
- * Note what this function does NOT do: it does not send, and it does not scan. Sending is the
- * caller's, so a failed node is a retry rather than a re-sign. Scanning is the PORTAL's (spec §7,
- * `DOD-END-SCAN-1`) — scanning here would be theatre, because the operator's own daemon is the
- * party whose content is in question.
- */
-export async function composeSealedSubmission(opts) {
-    const { manifest, keyProvider, logger } = opts;
-    if (!manifest) {
-        logger.warn("signal.submission.refused", {
-            reason: "manifest_unavailable",
-            op: opts.op,
-            subjectKind: opts.subjectKind,
-        });
-        return {
-            ok: false,
-            reason: "manifest_unavailable",
-            guidance: "No verified consortium manifest is loaded, so the portal's intake key is unknown. " +
-                "A submission is never sent unsealed. Check the daemon's manifest configuration and retry.",
-        };
-    }
-    // THE MANIFEST IS A STARTUP SNAPSHOT, AND ITS VALIDITY IS TIME-LIMITED.
-    //
-    // `verifyStartupManifest` checked the signatures, the window and the anti-rollback ONCE, at daemon
-    // start, and the daemon then holds that object for its whole lifetime — nothing refreshes it. So
-    // the startup gate's guarantee decays: three weeks later the window may have closed and the portal
-    // may have rotated the intake key, while this code would still happily seal to the retired one.
-    //
-    // The operator would be told the message was sent. The portal could not open it. By this module's
-    // own definition that arrives as unattributable POISON with no reply possible — the message simply
-    // vanishes, with no error anywhere. An EXPIRED input is an UNVERIFIED input (§5a), so it refuses
-    // and names the cause rather than trusting a check whose expiry has passed.
-    const now = (opts.nowMs ?? Date.now)();
-    const expiresAt = Date.parse(manifest.expires);
-    if (!Number.isFinite(expiresAt) || expiresAt <= now) {
-        logger.warn("signal.submission.refused", {
-            reason: "manifest_expired",
-            manifestVersion: manifest.version,
-            expiresAt: manifest.expires,
-            op: opts.op,
-        });
-        return {
-            ok: false,
-            reason: "manifest_expired",
-            guidance: `The consortium manifest verified at daemon start (v${manifest.version}) expired at ` +
-                `${manifest.expires}, so its portal intake key can no longer be trusted — sealing to a ` +
-                "retired key produces a message the portal cannot open and cannot even attribute. " +
-                // DOD-M15-MANIFEST-EXPIRY-LIVE-1 review F4: this used to say "Restart the daemon to load and
-                // verify a current manifest, then retry." That is the one move that must NOT be made here.
-                // Startup fails closed on an expired manifest (ADV-002), so a restart without a REPLACEMENT
-                // does not reload anything — the daemon refuses to come back and every agent goes offline.
-                // The instruction turned a refused submission into a dead daemon, and it contradicted the
-                // guidance `cello_status` gives for the identical condition.
-                "Replace the manifest first — a new file at CELLO_CONSORTIUM_MANIFEST, or an " +
-                "@cello-protocol/connect upgrade if this daemon uses the compiled-in one — and then restart. " +
-                "Do NOT restart without one: startup refuses an expired manifest, so the daemon will not " +
-                "come back up. Run cello_status for the full picture.",
-        };
-    }
-    const intakeKey = manifest.intake_key;
-    if (!intakeKey) {
-        logger.warn("signal.submission.refused", {
-            reason: "intake_key_absent",
-            manifestVersion: manifest.version,
-            op: opts.op,
-        });
-        return {
-            ok: false,
-            reason: "intake_key_absent",
-            guidance: `Consortium manifest v${manifest.version} publishes no portal intake key, so this submission ` +
-                "cannot be sealed. It is NOT sent unsealed — the directory must not be able to read it. " +
-                "This needs a manifest that carries `intake_key`.",
-        };
-    }
-    // Malformed is refused for the same reason absent is. Sealing to a non-key produces a blob nobody
-    // can open, which reaches the portal as unattributable POISON with no reply possible (M10B-D22b) —
-    // so the operator would watch the submission vanish with no error anywhere. Uppercase hex is
-    // refused rather than lowercased: the key_id/pubkey pair comes from a SIGNED document, and quietly
-    // repairing a signed value hides a manifest-generation bug instead of surfacing it.
-    if (!intakeKey.key_id || !INTAKE_PUBKEY_RE.test(intakeKey.pubkey ?? "")) {
-        logger.warn("signal.submission.refused", {
-            reason: "intake_key_malformed",
-            manifestVersion: manifest.version,
-            keyId: intakeKey.key_id,
-            op: opts.op,
-        });
-        return {
-            ok: false,
-            reason: "intake_key_malformed",
-            guidance: `Consortium manifest v${manifest.version} carries an unusable intake key ` +
-                `(key_id: ${JSON.stringify(intakeKey.key_id)}) — the pubkey must be a 32-byte Ed25519 key as ` +
-                "64 lowercase hex characters. Refusing rather than sealing to an unopenable value.",
-        };
-    }
-    // INV-ATTRIBUTION: taken from the signer, never from a parameter.
-    const submitterPubkey = Buffer.from(await keyProvider.getPublicKey()).toString("hex");
-    const body = {
-        v: SUBMISSION_VERSION,
-        op: opts.op,
-        subject_kind: opts.subjectKind,
-        subject: opts.subject,
-        submitter_pubkey: submitterPubkey,
-        body: opts.body,
-        issued_at: opts.issuedAt,
-    };
-    const signature = await keyProvider.sign(buildSubmissionTbs(body));
-    const encoded = encodeSubmission(body, signature);
-    // Derived from the PLAINTEXT submission, not the ciphertext. Sealing is randomised, so a
-    // ciphertext-derived id would change on every re-seal and a failover retry would look like a
-    // second submission — two mints, double quota consumption.
-    const id = submissionId(encoded);
-    const ciphertext = sealToRecipient(Buffer.from(intakeKey.pubkey, "hex"), encoded);
-    logger.info("signal.submission.sealed", {
-        submissionId: id,
-        intakeKeyId: intakeKey.key_id,
-        op: opts.op,
-        subjectKind: opts.subjectKind,
-        manifestVersion: manifest.version,
-        // The body is NEVER logged — it is the operator's own words about a third party, and this log
-        // line would be the one place it existed in the clear on disk.
-        bodyBytes: Buffer.byteLength(opts.body, "utf8"),
-    });
-    return { ok: true, submissionId: id, intakeKeyId: intakeKey.key_id, ciphertext };
-}
-const DEFAULT_ACK_TIMEOUT_MS = 15_000;
-/**
- * Hand a sealed submission to the directory node this agent is connected to, and await its ack.
- *
- * ONE node, deliberately. The daemon holds a single signaling stream, and registration already works
- * this way — it sends `register_request` to the connected node and the DIRECTORY fans out to the
- * quorum. There is no client-side multi-node write path, and inventing one here would duplicate the
- * SignalingManager's reconnect. So "failover" for a submission is that existing reconnect, and a
- * retry afterwards is safe because `submission_id` is content-derived: the same body produces the
- * same id, so a second node stores it once and the portal mints once (M10B-D20, M10B-D21).
- */
-export async function sendSealedSubmission(deps) {
-    const { signaling, submissionId: id, intakeKeyId, ciphertext, logger } = deps;
-    const timeoutMs = deps.timeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
-    // Advisory only — see the handler. Never resolves the send; it sharpens the TIMEOUT's diagnosis.
-    let sawNotAuthenticated = false;
-    let resolveFrame;
-    const pending = new Promise((r) => { resolveFrame = r; });
-    const unregister = signaling.registerInboundHandler((frame) => {
-        const t = frame["type"];
-        // A result for a DIFFERENT submission must be ignored: the handler sees every frame on a shared
-        // stream, and accepting someone else's ack would report success for a write that never happened.
-        // EVERY resolve path is id-gated. The handler sees every frame on a SHARED stream, so an
-        // ungated one resolves this submission with someone else's outcome — and two concurrent
-        // submissions is not an exotic case, it is the second endorsement.
-        if (t === "submission_write_result" && frame["submission_id"] === id)
-            resolveFrame(frame);
-        else if (t === "submission_write_error" && frame["submission_id"] === id)
-            resolveFrame(frame);
-        // `not_authenticated` is DELIBERATELY NOT a resolve path. An older node replies it when its
-        // decoder returns null (M10B-D25r), so it is the version-skew symptom — but it is also what the
-        // node sends for a frame that arrives before auth completes, and for ANY other component's
-        // undecodable frame on this same stream. Resolving on it would let an unrelated
-        // `manifest_poll_request` to an older node report THIS submission as unsupported, while the real
-        // result arrives afterwards and is dropped on the floor. It is recorded as advisory context and
-        // the timeout decides.
-        else if (t === "not_authenticated")
-            sawNotAuthenticated = true;
-    });
-    try {
-        const sent = await signaling.sendRaw({
-            type: "submission_write",
-            submission_id: id,
-            intake_key_id: intakeKeyId,
-            ciphertext,
-        });
-        if (!sent.ok) {
-            // The reason CODE carries the transport's own cause when it has one. `directory_unreachable`
-            // is an exit-point label — a machine consumer branching on it cannot tell "reconnecting" from
-            // "lost", and those want different operator actions.
-            const cause = sent.reason ?? "directory_unreachable";
-            logger.warn("signal.submission.refused", { submissionId: id, reason: cause });
-            return {
-                ok: false,
-                reason: cause,
-                // STATED AS IT IS: this submission was NOT delivered and NOTHING here retries it. An earlier
-                // draft said "it was not lost", which asserted a retry no code performs — the caller would
-                // have to re-invoke, and until DOD-END-SURFACE-1 there is no caller at all. What IS true is
-                // that re-submitting is SAFE, which is a different claim.
-                guidance: `The submission was NOT handed to a directory node (${cause}) and nothing has retried it. ` +
-                    "Re-submitting is safe: it produces the SAME submission_id, so the retry is stored once, " +
-                    "not twice.",
-            };
-        }
-        let timer;
-        const timeout = new Promise((r) => {
-            timer = setTimeout(() => r({ type: "__timeout__" }), timeoutMs);
-        });
-        const frame = await Promise.race([pending, timeout]);
-        clearTimeout(timer);
-        if (frame["type"] === "__timeout__") {
-            // F2: NAME THE AMBIGUITY RATHER THAN RESOLVING IT. `not_authenticated` has THREE producers on
-            // the directory side — an undecodable frame from a node that has not deployed this frame kind
-            // (the version-skew case), an undecodable frame from a node that HAS (i.e. our own bug: a
-            // malformed id or an empty ciphertext), and a frame that genuinely arrived before auth
-            // completed. An earlier draft asserted the first with certainty and told the operator it was
-            // "NOT an authentication problem" — which, in the third case, sends them away from the actual
-            // cause and towards a deploy that will never fix it.
-            const reason = sawNotAuthenticated ? "submission_unsupported_by_node" : "submission_write_timeout";
-            logger.warn("signal.submission.refused", { submissionId: id, reason, timeoutMs, sawNotAuthenticated });
-            return {
-                ok: false,
-                reason,
-                guidance: sawNotAuthenticated
-                    ? "The directory node did not recognise the frame and never acknowledged the submission. " +
-                        "MOST LIKELY it has not deployed submission support yet — nodes deploy independently per " +
-                        "region, so check this node's version first. Two other conditions produce the same reply: " +
-                        "a malformed submission from this client, and a frame rejected because authentication had " +
-                        "not completed (if the signaling stream also dropped, look there). Re-submitting is safe."
-                    : `The directory node accepted the frame but did not acknowledge the submission within ${timeoutMs}ms. ` +
-                        "Whether it was stored is unknown; re-submitting is safe (same submission_id, stored once).",
-            };
-        }
-        if (frame["type"] === "submission_write_error") {
-            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "unspecified";
-            logger.warn("signal.submission.refused", { submissionId: id, reason: "submission_refused_by_node", nodeReason: reason });
-            return {
-                ok: false,
-                reason: "submission_refused_by_node",
-                // The upstream reason SURVIVES into the payload rather than being flattened into this
-                // function's own exit label (§5b).
-                guidance: `The directory node refused the submission: ${reason}.`,
-            };
-        }
-        const stored = frame["stored"] === true;
-        logger.info(stored ? "signal.submission.queued" : "signal.submission.duplicate", {
-            submissionId: id,
-            intakeKeyId,
-            stored,
-        });
-        return { ok: true, submissionId: id, stored };
-    }
-    finally {
-        unregister();
-    }
-}
-/**
- * M10B / `M10B-D25r2` — ask the directory what happened to what this agent submitted.
- *
- * THE REQUEST CARRIES NO IDENTITY, and that absence is the point: the directory scopes the answer to
- * the key that authenticated the stream. A pubkey parameter would be a parameter to forge, and would
- * let any agent that can dial a node collect another's outcomes — including refusal ciphertexts
- * sealed to somebody else, unopenable by them but never theirs to hold.
- *
- * ONE TIMEOUT, NO RETRY. An outcome is durable at the directory until acked, so a caller that missed
- * it simply asks again — a retry loop here would only add load to a node that is already slow.
- */
-export async function fetchSubmissionResults(opts) {
-    const { signaling, keyProvider, logger } = opts;
-    const timeoutMs = opts.timeoutMs ?? DEFAULT_ACK_TIMEOUT_MS;
-    let resolveFrame;
-    const pending = new Promise((r) => { resolveFrame = r; });
-    const unregister = signaling.registerInboundHandler((frame) => {
-        const t = frame["type"];
-        if (t === "submission_results" || t === "submission_results_error")
-            resolveFrame(frame);
-    });
-    try {
-        const sent = await signaling.sendRaw({ type: "submission_results_request" });
-        if (!sent.ok) {
-            const cause = sent.reason ?? "directory_unreachable";
-            return {
-                ok: false,
-                reason: cause,
-                guidance: `The request was not handed to a directory node (${cause}). Outcomes are held until you ` +
-                    "collect them, so nothing is lost — try again once the stream is back.",
-            };
-        }
-        let timer;
-        const timeoutP = new Promise((r) => { timer = setTimeout(() => r({ type: "__timeout__" }), timeoutMs); });
-        const frame = await Promise.race([pending, timeoutP]);
-        clearTimeout(timer);
-        if (frame["type"] === "__timeout__") {
-            return {
-                ok: false,
-                reason: "submission_results_timeout",
-                guidance: `The node did not answer within ${timeoutMs}ms. Your outcomes are still held — this is a ` +
-                    "slow or old node, not a lost result. An older node that does not know the frame answers " +
-                    "nothing at all, which looks the same from here.",
-            };
-        }
-        if (frame["type"] === "submission_results_error") {
-            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "unspecified";
-            return { ok: false, reason, guidance: `The directory could not serve your results: ${reason}.` };
-        }
-        const raw = Array.isArray(frame["results"]) ? frame["results"] : [];
-        const results = [];
-        for (const r of raw) {
-            const submissionId = typeof r["submission_id"] === "string" ? r["submission_id"] : null;
-            const outcome = typeof r["outcome"] === "string" ? r["outcome"] : null;
-            // A row missing its id or outcome is unusable — there is nothing to correlate it against and
-            // nothing to report. Dropped LOUDLY rather than surfaced as a result with empty fields.
-            if (!submissionId || !outcome) {
-                logger.warn("signal.results.malformed_row", {});
-                continue;
-            }
-            // THE MESSAGE IS OPENED HERE, by k_local, and a failure to open is NOT a failure of the
-            // result: the outcome and reason are still true and still worth reporting. Swallowing the
-            // whole row because its message would not decrypt would hide a refusal behind a key problem.
-            let message = null;
-            const ct = r["ciphertext"];
-            if (ct instanceof Uint8Array && ct.length > 0 && keyProvider.openContentSeal) {
-                try {
-                    const opened = await keyProvider.openContentSeal(ct);
-                    message = opened ? new TextDecoder().decode(opened) : null;
-                    if (!opened)
-                        logger.warn("signal.results.seal_unopenable", { submissionId });
-                }
-                catch {
-                    logger.warn("signal.results.seal_unopenable", { submissionId });
-                }
-            }
-            results.push({
-                submissionId,
-                outcome,
-                reason: typeof r["reason"] === "string" ? r["reason"] : null,
-                signalHash: typeof r["signal_hash"] === "string" ? r["signal_hash"] : null,
-                message,
-                createdAt: typeof r["created_at"] === "string" ? r["created_at"] : "",
-            });
-        }
-        logger.info("signal.results.fetched", { count: results.length });
-        return { ok: true, results };
-    }
-    finally {
-        unregister();
-    }
-}
-//# sourceMappingURL=signal-submission.js.map

package/dist/signal-submission.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signal-submission.js","sourceRoot":"","sources":["../src/signal-submission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,GAKb,MAAM,gCAAgC,CAAC;AAGxC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AA2E1C,MAAM,2BAA2B,GAAgC,IAAI,CAAC;AACtE,KAAK,2BAA2B,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,sBAAsB;YAC9B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EACN,oFAAoF;gBACpF,2FAA2F;SAC9F,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,EAAE;IACF,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,gGAAgG;IAChG,EAAE;IACF,kGAAkG;IAClG,mGAAmG;IACnG,iGAAiG;IACjG,4EAA4E;IAC5E,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,kBAAkB;YAC1B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,SAAS,EAAE,QAAQ,CAAC,OAAO;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EACN,sDAAsD,QAAQ,CAAC,OAAO,eAAe;gBACrF,GAAG,QAAQ,CAAC,OAAO,qEAAqE;gBACxF,mFAAmF;gBACnF,6FAA6F;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,0FAA0F;gBAC1F,6DAA6D;gBAC7D,8EAA8E;gBAC9E,8FAA8F;gBAC9F,0FAA0F;gBAC1F,sDAAsD;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,mBAAmB;YAC3B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EACN,wBAAwB,QAAQ,CAAC,OAAO,sDAAsD;gBAC9F,yFAAyF;gBACzF,kDAAkD;SACrD,CAAC;IACJ,CAAC;IAED,kGAAkG;IAClG,mGAAmG;IACnG,6FAA6F;IAC7F,mGAAmG;IACnG,oFAAoF;IACpF,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxE,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YACvC,MAAM,EAAE,sBAAsB;YAC9B,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EACN,wBAAwB,QAAQ,CAAC,OAAO,kCAAkC;gBAC1E,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,kDAAkD;gBAC9F,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEtF,MAAM,IAAI,GAAmB;QAC3B,CAAC,EAAE,kBAAkB;QACrB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,gBAAgB,EAAE,eAAe;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,QAAQ;KACzB,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAClD,yFAAyF;IACzF,6FAA6F;IAC7F,2DAA2D;IAC3D,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAElF,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;QACtC,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,SAAS,CAAC,MAAM;QAC7B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,QAAQ,CAAC,OAAO;QACjC,8FAA8F;QAC9F,+DAA+D;QAC/D,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;KAChD,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAqDD,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAO1C;IACC,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAE3D,iGAAiG;IACjG,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,YAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,gGAAgG;QAChG,iGAAiG;QACjG,yFAAyF;QACzF,wFAAwF;QACxF,mEAAmE;QACnE,IAAI,CAAC,KAAK,yBAAyB,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;aACrF,IAAI,CAAC,KAAK,wBAAwB,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9F,4FAA4F;QAC5F,gGAAgG;QAChG,2FAA2F;QAC3F,gFAAgF;QAChF,iGAAiG;QACjG,gGAAgG;QAChG,uBAAuB;aAClB,IAAI,CAAC,KAAK,mBAAmB;YAAE,mBAAmB,GAAG,IAAI,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;YACnC,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,WAAW;YAC1B,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,6FAA6F;YAC7F,8FAA8F;YAC9F,qDAAqD;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAA8B;gBACtC,6FAA6F;gBAC7F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,0DAA0D;gBAC1D,QAAQ,EACN,sDAAsD,KAAK,gCAAgC;oBAC3F,0FAA0F;oBAC1F,YAAY;aACf,CAAC;QACJ,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE;YACzD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACpC,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,uFAAuF;YACvF,6FAA6F;YAC7F,8FAA8F;YAC9F,qDAAqD;YACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,0BAA0B,CAAC;YACnG,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACvG,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM;gBACN,QAAQ,EAAE,mBAAmB;oBAC3B,CAAC,CAAC,wFAAwF;wBACxF,0FAA0F;wBAC1F,2FAA2F;wBAC3F,2FAA2F;wBAC3F,0FAA0F;oBAC5F,CAAC,CAAC,uFAAuF,SAAS,MAAM;wBACtG,4FAA4F;aACjG,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,wBAAwB,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrF,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACzH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,sFAAsF;gBACtF,mCAAmC;gBACnC,QAAQ,EAAE,8CAA8C,MAAM,GAAG;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,6BAA6B,EAAE;YAC/E,YAAY,EAAE,EAAE;YAChB,WAAW;YACX,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAeD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,sBAAsB,CAAC;IAE3D,IAAI,YAAmD,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5D,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,0BAA0B;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAuB,CAAC;YACrD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,KAAK;gBACb,QAAQ,EACN,mDAAmD,KAAK,iCAAiC;oBACzF,uEAAuE;aAC1E,CAAC;QACJ,CAAC;QAED,IAAI,KAAqC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,OAAO,CAA0B,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtD,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EACN,kCAAkC,SAAS,+CAA+C;oBAC1F,0FAA0F;oBAC1F,iDAAiD;aACpD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,+CAA+C,MAAM,GAAG,EAAE,CAAC;QACnG,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,SAAS,CAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxF,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,6FAA6F;YAC7F,wFAAwF;YACxF,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,wFAAwF;YACxF,0FAA0F;YAC1F,6FAA6F;YAC7F,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,EAAE,YAAY,UAAU,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;oBACrD,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBAC3D,IAAI,CAAC,MAAM;wBAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAC/E,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY;gBACZ,OAAO;gBACP,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC5D,UAAU,EAAE,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1E,OAAO;gBACP,SAAS,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,UAAU,EAAE,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/signaling-connect.d.ts

@@ -1,118 +0,0 @@
-/**
- * M7 Keystone (Part 2) — production `signalingConnect` for the daemon.
- *
- * This is the daemon's directory-facing dialer. It establishes ONE authenticated
- * signaling stream to a directory node and returns it as a transport
- * `ConnectResult`. The transport `SignalingManager` owns everything after connect:
- * heartbeat, reconnect (it calls connect() again on a fresh attempt), the outbound
- * queue, and optional manifest polling.
- *
- * The 7-step handshake below is the wire protocol the directory speaks. It is not negotiable from
- * this side: change a step and registration, the DKG ceremony, and session sealing all break.
- *
- * Architecture note (2026-06-11 daemon-transport doc): this is the *directory-facing
- * node* — one per daemon, signaling only. A FRESH libp2p node (and therefore a fresh
- * transport key / Peer ID) is created on every connect, which is exactly the
- * reconnect-rotation behavior the architecture calls for. Per-session data exchange
- * uses separate ephemeral session nodes, not this node.
- *
- * Step-5/6 directory identity verification (the consortium-manifest "directory proves
- * itself back" hardening) is OPTIONAL here: it runs only when a `challengeVerifier`
- * is supplied. M6 ran with it off (challengeVerifier = null) and connected fine; the
- * hardening layers on later without changing this path.
- *
- * Crypto reference: agent→directory auth signs SHA-256(domain ‖ nonce ‖ pubkey) with
- * the agent's K_local Ed25519 key (RFC 8032). K_local never leaves the KeyProvider.
- */
-import { type CelloNode, type ConnectResult, type IDirectoryChallengeVerifier } from "@cello-protocol/transport";
-import type { KeyProvider } from "@cello-protocol/crypto";
-import type { Logger } from "./types.js";
-/** A directory node the daemon can dial, resolved from bootstrap config or a manifest. */
-export interface DirectoryEndpoint {
-    peerId: string;
-    /** A dialable multiaddr (e.g. /dns4/host/tcp/443/wss/p2p/<peerId>). Optional if already connected. */
-    multiaddr?: string;
-}
-/** The agent identity that authenticates this signaling stream (steps 3-4). */
-export interface SignalingAuthIdentity {
-    keyProvider: KeyProvider;
-    pubkeyHex: string;
-}
-export interface SignalingConnectDeps {
-    /**
-     * Resolve the directory node to dial. Returns null when no endpoint is known yet.
-     * May be async — production re-resolves the bootstrap (GET /bootstrap) per connect
-     * so a directory address change is picked up on the next reconnect.
-     */
-    getDirectoryEndpoint: () => DirectoryEndpoint | null | Promise<DirectoryEndpoint | null>;
-    /** Resolve the agent identity to authenticate as. Returns null when no agent exists yet. */
-    getAuthIdentity: () => SignalingAuthIdentity | null;
-    logger: Logger;
-    /**
-     * Optional directory identity verifier (consortium-manifest step-6 hardening).
-     * When absent, directory verification is skipped — the M6 backward-compat path.
-     */
-    challengeVerifier?: IDirectoryChallengeVerifier;
-    /** Verified consortium manifest version, surfaced in ConnectResult. Defaults to 0 (no manifest). */
-    getManifestVersion?: () => number;
-    /**
-     * Test seam: inject a node factory. Production uses `createNode` to mint a fresh
-     * directory-facing node per connect.
-     */
-    createDirectoryNode?: (keyProvider: KeyProvider) => Promise<CelloNode>;
-    /**
-     * M7 Action 2: publish the live directory-facing node to the daemon so subsystems
-     * that must reach the directory on the SAME node — registration's FROST DKG
-     * (NetworkDirectoryNode), ceremonies, seal — can use it. Called with the node on a
-     * successful connect, and with `null` when the stream closes. The daemon keeps the
-     * latest reference and gates use on the signaling status being `connected`.
-     */
-    publishNode?: (node: CelloNode | null) => void;
-    /**
-     * Cross-node topology (item 3): mark this a VISITING connection. Set true ONLY for the transient
-     * connection a client opens into a node that is NOT its home, to broker a cross-node session. The
-     * flag rides in signaling_auth_response; the directory then gives this stream a #streams entry (so
-     * the same-node session flow sees the agent) but writes NO presence — so the transient connection
-     * never re-homes the agent or falsely marks it offline. Home connections omit it. Not signature-
-     * bound (the auth TBS is unchanged) — the flag rides the encrypted libp2p channel.
-     */
-    visiting?: boolean;
-    /**
-     * DOD-NAT-REACHABILITY-1 (Phase 2): receives the directory's healthy relay-pool
-     * endpoints when signaling_auth_ok carries `relay_endpoints`. Fires once per
-     * successful connect (so every reconnect refreshes the set). The endpoints ride
-     * the authenticated, directory-verified signaling channel — the same trust rail
-     * as session_assignment frames. Absent field (old directory) → never called.
-     */
-    onRelayEndpoints?: (endpoints: Array<{
-        peerId: string;
-        addrs: string[];
-    }>) => void;
-    /**
-     * DOD-M15-RELAYSLOTS-1: receives the directory's online token — the credential the relays above
-     * now require before they will let this agent hold a circuit reservation slot. Rides the same
-     * frame and the same cadence as `relay_endpoints`: every connect and every reconnect, which is
-     * what keeps a short-lived token current.
-     *
-     * Absent field → never called. That is the honest signal in two different situations, and the
-     * daemon cannot tell them apart from here: an older directory that does not issue tokens, or a
-     * key this directory does not know as a registered agent. Either way there is no slot.
-     */
-    onOnlineToken?: (token: Uint8Array) => void;
-    /**
-     * DOD-M15-RELAYSLOTS-1 review M1: fired instead of `onOnlineToken` when the directory issued
-     * none, carrying WHICH absence it was. `undefined` means the directory stated no reason, i.e. it
-     * predates the token — which is itself the third distinct answer and must not be folded into the
-     * other two.
-     */
-    onOnlineTokenAbsent?: (reason: "not_registered_here" | "issue_failed" | undefined) => void;
-}
-/**
- * Build a production `signalingConnect` for `DaemonConfig.signalingConnect`.
- *
- * The returned function performs one full connect attempt. It throws on any failure
- * (no endpoint, no identity, dial failure, auth rejection, challenge failure); the
- * transport SignalingManager catches the throw and schedules a reconnect.
- */
-export declare function createSignalingConnect(deps: SignalingConnectDeps): () => Promise<ConnectResult>;
-//# sourceMappingURL=signaling-connect.d.ts.map

package/dist/signaling-connect.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signaling-connect.d.ts","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EAElB,KAAK,2BAA2B,EACjC,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AA+CzC,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACzF,4FAA4F;IAC5F,eAAe,EAAE,MAAM,qBAAqB,GAAG,IAAI,CAAC;IACpD,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAClC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,KAAK,IAAI,CAAC;IACnF;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;CAC5F;AAuBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CA0X/F"}