@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/signaling-connect.js

@@ -1,538 +0,0 @@
-/**
- * M7 Keystone (Part 2) — production `signalingConnect` for the daemon.
- *
- * This is the daemon's directory-facing dialer. It establishes ONE authenticated
- * signaling stream to a directory node and returns it as a transport
- * `ConnectResult`. The transport `SignalingManager` owns everything after connect:
- * heartbeat, reconnect (it calls connect() again on a fresh attempt), the outbound
- * queue, and optional manifest polling.
- *
- * The 7-step handshake below is the wire protocol the directory speaks. It is not negotiable from
- * this side: change a step and registration, the DKG ceremony, and session sealing all break.
- *
- * Architecture note (2026-06-11 daemon-transport doc): this is the *directory-facing
- * node* — one per daemon, signaling only. A FRESH libp2p node (and therefore a fresh
- * transport key / Peer ID) is created on every connect, which is exactly the
- * reconnect-rotation behavior the architecture calls for. Per-session data exchange
- * uses separate ephemeral session nodes, not this node.
- *
- * Step-5/6 directory identity verification (the consortium-manifest "directory proves
- * itself back" hardening) is OPTIONAL here: it runs only when a `challengeVerifier`
- * is supplied. M6 ran with it off (challengeVerifier = null) and connected fine; the
- * hardening layers on later without changing this path.
- *
- * Crypto reference: agent→directory auth signs SHA-256(domain ‖ nonce ‖ pubkey) with
- * the agent's K_local Ed25519 key (RFC 8032). K_local never leaves the KeyProvider.
- */
-import { createHash } from "node:crypto";
-import { decode } from "cbor-x";
-import { encodeCbor } from "@cello-protocol/protocol-types";
-import * as lp from "it-length-prefixed";
-import { createNode, buildStep5Tbs, } from "@cello-protocol/transport";
-import { extractErrorMessage } from "./error-message.js";
-const SIGNALING_PROTOCOL_ID = "/cello/signaling/1.0.0";
-const AUTH_DOMAIN_DIR = "CELLO-DIR-AUTH-v1";
-const AUTH_TIMEOUT_MS = 5_000;
-function toU8(v) {
-    if (v instanceof Uint8Array)
-        return v;
-    if (Buffer.isBuffer(v))
-        return new Uint8Array(v);
-    if (typeof v.slice === "function") {
-        return v.slice();
-    }
-    throw new Error(`expected bytes, got ${typeof v}`);
-}
-function errMsg(err) {
-    return extractErrorMessage(err);
-}
-async function nextWithTimeout(iter, timeoutMs) {
-    return Promise.race([
-        iter.next(),
-        new Promise((_, reject) => setTimeout(() => reject(new Error("auth_timeout")), timeoutMs)),
-    ]);
-}
-async function safeStop(node) {
-    try {
-        await node.stop();
-    }
-    catch {
-        /* best-effort teardown */
-    }
-}
-/**
- * DOD-M15-STEP6-REPLAY-1 — how far out of date a directory identity proof may be.
- *
- * ±5 minutes: wide enough for ordinary clock skew between an operator's machine and a directory
- * node without requiring either to be time-synced, narrow enough that a captured proof stops being
- * useful in minutes rather than never. An UNPARSEABLE timestamp is treated as out of window — the
- * NaN-comparison lesson from the manifest gate, where `new Date("nonsense") <= x` is false and a
- * garbage value sailed through a check that looked like it covered it.
- */
-const IDENTITY_PROOF_MAX_SKEW_MS = 5 * 60_000;
-/**
- * Parse signaling_auth_ok's optional `relay_endpoints` field. Per-entry strict:
- * a malformed entry is dropped (auth must never fail on a bad hint), a valid one
- * survives. Returns [] when the field is absent or not an array.
- */
-function parseRelayEndpoints(raw) {
-    if (!Array.isArray(raw))
-        return [];
-    const out = [];
-    for (const entry of raw) {
-        if (typeof entry !== "object" || entry === null)
-            continue;
-        const e = entry;
-        const peerId = e["peer_id"];
-        const multiaddrs = e["multiaddrs"];
-        if (typeof peerId !== "string" || peerId.length === 0)
-            continue;
-        if (!Array.isArray(multiaddrs) || multiaddrs.length === 0)
-            continue;
-        if (!multiaddrs.every((a) => typeof a === "string" && a.length > 0))
-            continue;
-        out.push({ peerId, addrs: multiaddrs });
-    }
-    return out;
-}
-/**
- * Build a production `signalingConnect` for `DaemonConfig.signalingConnect`.
- *
- * The returned function performs one full connect attempt. It throws on any failure
- * (no endpoint, no identity, dial failure, auth rejection, challenge failure); the
- * transport SignalingManager catches the throw and schedules a reconnect.
- */
-export function createSignalingConnect(deps) {
-    /**
-     * DOD-M15-DIRAUTH-1 — directory peers already told about a skipped identity check.
-     *
-     * Mirrors `consortium-bootstrap`'s `lapsedMembershipReportedFor` idiom: the fact is about a PEER,
-     * not about a connection, so reporting it per connection says the same true thing ~48 times an
-     * hour forever. Keyed on the peer this daemon DIALLED — never on the peer's own claim about
-     * itself, which on this path is precisely the thing that was not verified.
-     *
-     * ⚠️ SCOPED TO THE FACTORY, not the module. A module-level set is shared by every daemon wiring in
-     * the process and never resets, which makes the suppression outlive the thing it describes and
-     * makes test order load-bearing — my first version did exactly that and a later test silently lost
-     * its warning to an earlier one.
-     */
-    const authSkipReportedFor = new Set();
-    return async function connect() {
-        const endpoint = await deps.getDirectoryEndpoint();
-        if (!endpoint) {
-            throw new Error("directory_endpoint_unknown");
-        }
-        const identity = deps.getAuthIdentity();
-        if (!identity) {
-            throw new Error("no_agent_identity");
-        }
-        // Fresh directory-facing node per connect → fresh transport key / Peer ID.
-        //
-        // DOD-NAT-REACHABILITY-1: relayServer disabled, and the opt-out is NOT made redundant by this
-        // node listening on nothing (see below). Leaving `nodeType` unset takes the service-node
-        // default, which adds `circuitRelayServer` to the service map and advertises HOP — and HOP is
-        // advertised over connections WE opened, not only over ones we accept. A node with no listener
-        // still holds a live outbound connection to the directory.
-        //
-        // (This comment described the node as "bound on 0.0.0.0" until DOD-M15-SURFACE-1 removed the
-        // binding. Rewritten rather than deleted: the constraint it records is still load-bearing, and
-        // leaving it in past tense put two comments in one expression contradicting each other about
-        // the exact fact this unit changed — which is how the binding gets "restored" by a later
-        // session that stops reading at the first one.)
-        const node = deps.createDirectoryNode
-            ? await deps.createDirectoryNode(identity.keyProvider)
-            : await createNode({
-                keyProvider: identity.keyProvider,
-                /**
-                 * DOD-M15-SURFACE-1 — LISTEN ON NOTHING. This node had a real open port on every
-                 * interface, for no reason.
-                 *
-                 * It bound `/ip4/0.0.0.0/tcp/0` while registering **no protocol handler at all**, and the
-                 * directory never dials a client — every directory connection is one this daemon opened.
-                 * So the port accepted connections that could reach no CELLO protocol, on an operator's
-                 * machine, for the life of the daemon. Not listening is strictly stronger than filtering
-                 * who may connect: there is no socket, nothing to scan, and nothing to gate. (A
-                 * `DirectoryConnectionGater` exists for the filtering approach and is constructed only in
-                 * tests — it is the consolation prize, not the fix.)
-                 *
-                 * FALSIFIED BEFORE REMOVING, because `listenAddresses()` IS sent to the directory at step
-                 * 7 below, in `peer_info_announce`, under a comment saying it is so the directory can
-                 * broker sessions. Traced to the consumer: the directory stores it and its own code says
-                 * this address is *"its per-agent DIRECTORY node, NOT its standing-receiver session node,
-                 * so it is NOT a valid content endpoint (using it yields 'could not negotiate
-                 * /cello/content')"*. A counterparty's session endpoint reaches the other side through the
-                 * `session_offer` → `session_offer_accept` round-trip, never through this announce. No
-                 * client reads `participant_a/b.multiaddrs` at all.
-                 *
-                 * The announce still matters and still happens: `#peerInfoAnnounced` gates `session_request`
-                 * on the directory side, and it is set by the frame ARRIVING, not by what is in it. The
-                 * peer id still goes with it, and a peer id needs no listener.
-                 *
-                 * INBOUND SESSIONS ARE UNAFFECTED. They arrive on the standing receiver, which is a
-                 * different node and keeps its socket deliberately (relay-audit Decision 2 — it is
-                 * load-bearing for same-machine and same-LAN sessions).
-                 */
-                listenAddresses: [],
-                relayServer: { enabled: false },
-                // Same reason as relayServer above: this is a CLIENT node that leaves nodeType unset, so
-                // the service-node default would leave the AutoNAT responder on -- and answering one
-                // dial-back tears down this very connection, killing signaling mid-registration.
-                autonatResponder: { enabled: false },
-            });
-        let sigStream;
-        try {
-            // L1: start() is inside the try so a start failure is caught and the
-            // partially-started node is torn down (safeStop) rather than leaked.
-            await node.start();
-            if (endpoint.multiaddr) {
-                // Best-effort dial; newStream below surfaces the real failure if unreachable.
-                try {
-                    await node.dial(endpoint.multiaddr);
-                }
-                catch (dialErr) {
-                    // L2: non-fatal (dial-by-peerId may still work / already connected), but
-                    // keep the real reason — newStream's error is generic.
-                    deps.logger.debug("directory.dial.failed", {
-                        multiaddr: endpoint.multiaddr,
-                        error: errMsg(dialErr),
-                    });
-                }
-            }
-            sigStream = await node.newStream(endpoint.peerId, SIGNALING_PROTOCOL_ID);
-        }
-        catch (err) {
-            await safeStop(node);
-            throw new Error(`directory_dial_failed: ${errMsg(err)}`);
-        }
-        const iter = lp.decode(sigStream)[Symbol.asyncIterator]();
-        try {
-            // ── Steps 1-2: receive the directory's auth challenge (32-byte nonce) ──
-            const challenge = await nextWithTimeout(iter, AUTH_TIMEOUT_MS);
-            if (challenge.done || challenge.value === undefined)
-                throw new Error("directory_auth_no_challenge");
-            const challengeFrame = decode(toU8(challenge.value));
-            if (challengeFrame["type"] !== "signaling_auth_challenge") {
-                throw new Error(`directory_auth_unexpected_frame: ${String(challengeFrame["type"])}`);
-            }
-            const nonce = toU8(challengeFrame["nonce"]);
-            if (nonce.length !== 32)
-                throw new Error("directory_auth_bad_nonce");
-            // ── Steps 3-4: sign SHA-256(domain ‖ nonce ‖ pubkey), send auth response ──
-            const myPubkey = Buffer.from(identity.pubkeyHex, "hex");
-            const domain = Buffer.from(AUTH_DOMAIN_DIR, "utf8");
-            const authMsg = new Uint8Array(Buffer.concat([domain, nonce, myPubkey]));
-            const msgHash = new Uint8Array(createHash("sha256").update(authMsg).digest());
-            const sig = await identity.keyProvider.sign(msgHash);
-            const authResponse = encodeCbor({
-                type: "signaling_auth_response",
-                pubkey: myPubkey,
-                signature: sig,
-                // Cross-node item 3: only the transient visiting connection sets this; home connections omit it.
-                ...(deps.visiting ? { visiting: true } : {}),
-            });
-            sigStream.send(lp.encode.single(authResponse));
-            // ── Step 5: receive signaling_auth_ok ──
-            const ack = await nextWithTimeout(iter, AUTH_TIMEOUT_MS);
-            if (ack.done || ack.value === undefined)
-                throw new Error("directory_auth_no_ack");
-            const ackFrame = decode(toU8(ack.value));
-            if (ackFrame["type"] !== "signaling_auth_ok") {
-                throw new Error(`directory_auth_rejected: ${String(ackFrame["type"])}`);
-            }
-            // ── Step 6 (optional hardening): verify the directory's identity proof ──
-            // Runs only when a challengeVerifier is configured. M6 ran without one.
-            let directoryNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : endpoint.peerId;
-            const verifier = deps.challengeVerifier;
-            if (!verifier) {
-                /**
-                 * DOD-M15-DIRAUTH-1 — **A DISARMED CHECK MUST NOT LOOK LIKE A HEALTHY ONE.**
-                 *
-                 * With no verifier configured, step 6 does not run at all: this daemon takes the
-                 * directory's word for which directory it is. Until now the only trace of that was
-                 * `verified: false` — a boolean field inside the **info** line at the bottom of a successful
-                 * connect. Every other connect logged the same event at the same level, so the disarmed
-                 * state and the enforced state were distinguishable only by reading one field of one line,
-                 * which nothing alerts on and no operator reads.
-                 *
-                 * ⚠️ THIS IS NOT THE FIX AND MUST NOT BE MISTAKEN FOR ONE — this entry's own conclusion is
-                 * that **a log is not a control**, and a WARN is still a log. What it buys is that the
-                 * absence has a name and a level of its own, so "authentication is off" can be seen without
-                 * knowing to look for it. The control is `CELLO_REQUIRE_DIRECTORY_AUTH`, which refuses at
-                 * startup; this is what tells an operator who has not set it what they are running.
-                 */
-                /**
-                 * ⚠️ ONCE PER DIRECTORY, NOT ONCE PER CONNECT — review F3, and the number is the argument.
-                 * The signaling stream turns over roughly every 70 seconds and reconnects forever, so a
-                 * per-connect WARN is ~48 an hour PER AGENT, indefinitely, and the daemon's stdout logger
-                 * has no level filtering. Three agents is ~3,400 identical lines a day. **A signal that
-                 * fires on the normal case is not a signal** — this repo's own rule — and it would bury the
-                 * public-directory case this exists to raise.
-                 *
-                 * ⚠️ AND THE FIELD IS NAMED FOR WHAT IT IS — review F4. On this path `directoryNodeId` is
-                 * `ackFrame["nodeId"]`: a string the REMOTE sent about itself, with nothing checked. Printing
-                 * it under that name inside a line whose whole subject is *"we did not check which directory
-                 * this is"* presents the peer's own answer as the answer. `dialedPeerId` sits beside it as
-                 * the thing this daemon actually chose.
-                 */
-                const claimedNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : null;
-                if (!authSkipReportedFor.has(endpoint.peerId)) {
-                    authSkipReportedFor.add(endpoint.peerId);
-                    deps.logger.warn("directory.auth.skipped", {
-                        dialedPeerId: endpoint.peerId,
-                        claimedNodeId,
-                        agentPubkey: identity.pubkeyHex,
-                        impact: "no directory identity verifier is configured, so this connection did NOT check which " +
-                            "directory it reached — the peer's claim of its own identity was accepted as given. " +
-                            "Set CELLO_CONSORTIUM_ROOT_KEYS (with CELLO_CONSORTIUM_THRESHOLD) to enable " +
-                            "verification, or CELLO_REQUIRE_DIRECTORY_AUTH=1 to refuse at startup instead of " +
-                            "connecting unverified. Reported ONCE per directory peer, not per reconnect.",
-                    });
-                }
-            }
-            if (verifier) {
-                const nodeId = ackFrame["nodeId"];
-                const signature = ackFrame["signature"];
-                const timestamp = ackFrame["timestamp"];
-                if (!nodeId || !signature || !timestamp) {
-                    deps.logger.error("directory.auth.challenge.failed", { reason: "no_identity_proof" });
-                    throw new Error("directory_challenge_no_identity_proof");
-                }
-                const tbsBytes = buildStep5Tbs({
-                    nodeId,
-                    agentPubkeyHex: identity.pubkeyHex,
-                    nonceHex: Buffer.from(nonce).toString("hex"),
-                    isoTimestamp: timestamp,
-                });
-                const result = verifier.verifyChallenge(nodeId, tbsBytes, signature);
-                if (!result.valid) {
-                    deps.logger.error("directory.auth.challenge.failed", { directoryNodeId: nodeId, reason: result.reason });
-                    throw new Error(`directory_challenge_failed: ${result.reason}`);
-                }
-                /**
-                 * DOD-M15-STEP6-REPLAY-1 — A VALID SIGNATURE IS NOT A FRESH ONE.
-                 *
-                 * The TBS covers `nodeId ‖ agent pubkey ‖ nonce ‖ timestamp`, and until this check the
-                 * client verified the signature over that tuple and looked at **neither** the timestamp nor
-                 * the nonce. So **any party that once obtained a valid tuple for this agent could replay it
-                 * indefinitely.**
-                 *
-                 * ─── WHY THE NONCE CANNOT CARRY THE FRESHNESS, WHICH IS THE PART THAT SURPRISED ME ──────
-                 *
-                 * The obvious answer is "check the nonce is the one we just sent". **We did not send it.**
-                 * The nonce here is `challengeFrame["nonce"]` — the DIRECTORY's own, from step 1-2. The
-                 * client contributes no fresh value to this exchange at all, so it holds nothing of its own
-                 * to bind against. A replaying party simply replays the captured nonce in step 2 and the
-                 * captured ack in step 5, and both halves agree.
-                 *
-                 * **That leaves the timestamp as the only freshness anchor**, and it is a real one: it is
-                 * inside the signed bytes, so a replayer cannot move it without invalidating the signature
-                 * they are replaying.
-                 *
-                 * ─── AFTER the signature, deliberately ─────────────────────────────────────────────────
-                 *
-                 * A stale proof and a forged one are different facts and must not collapse into one
-                 * message. Checking freshness only once the signature verifies means `identity_proof_stale`
-                 * always describes a GENUINE proof that is too old — never a forgery — which is what makes
-                 * it diagnostic rather than another exit-point label.
-                 *
-                 * **The window, and what it does NOT fix.** ±5 minutes tolerates ordinary client/directory
-                 * clock skew without a time-sync dependency. It BOUNDS replay to that window; it does not
-                 * eliminate it, because with no client-chosen nonce there is nothing to make a proof
-                 * single-use. Closing the remainder needs either a client contribution in the challenge or a
-                 * seen-nonce cache — both wire or state changes, and neither is this line.
-                 */
-                const proofMs = Date.parse(timestamp);
-                const skewMs = Number.isFinite(proofMs) ? Math.abs(Date.now() - proofMs) : Number.NaN;
-                if (!Number.isFinite(skewMs) || skewMs > IDENTITY_PROOF_MAX_SKEW_MS) {
-                    deps.logger.error("directory.auth.challenge.failed", {
-                        directoryNodeId: nodeId,
-                        reason: "identity_proof_stale",
-                        timestamp,
-                        skewMs: Number.isFinite(skewMs) ? Math.round(skewMs) : null,
-                        maxSkewMs: IDENTITY_PROOF_MAX_SKEW_MS,
-                        detail: "the directory's identity proof carries a valid signature over a timestamp outside the " +
-                            "freshness window — either a replayed proof, or a clock that is badly out on one side.",
-                    });
-                    throw new Error("directory_challenge_failed: identity_proof_stale");
-                }
-                directoryNodeId = nodeId;
-                deps.logger.info("directory.auth.challenge.verified", { directoryNodeId, skewMs: Math.round(skewMs) });
-            }
-            // DOD-NAT-REACHABILITY-1 (Phase 2): the directory's relay pool rides
-            // signaling_auth_ok, so an agent knows WHERE it could reserve before any
-            // session exists. 056-SLOTDEAD: it used to say the receiver reserves here;
-            // since 055-ONDEMAND this is a candidate list and the slot is taken at
-            // offer time. Surfaced via callback; parse failures drop entries, never
-            // the handshake.
-            if (deps.onRelayEndpoints) {
-                const endpoints = parseRelayEndpoints(ackFrame["relay_endpoints"]);
-                if (endpoints.length > 0) {
-                    deps.logger.info("directory.relay_endpoints.received", {
-                        directoryNodeId,
-                        relayPeerIds: endpoints.map((e) => e.peerId),
-                    });
-                    deps.onRelayEndpoints(endpoints);
-                }
-            }
-            /**
-             * DOD-M15-RELAYSLOTS-1: the online token rides the same frame as the relay pool above, for
-             * the same reason — a standing receiver needs both before any session exists: WHERE to ask
-             * for a reservation slot, and the credential that lets it keep one.
-             *
-             * A field of the wrong type is dropped rather than failing the handshake, exactly as a
-             * malformed relay endpoint is. The consequence is bounded and visible (this agent gets no
-             * slot on any relay, and the relay names the reason when it refuses), whereas failing the
-             * handshake would also cost session offers, which arrive on this same stream.
-             */
-            if (deps.onOnlineToken) {
-                const raw = ackFrame["online_token"];
-                const token = raw instanceof Uint8Array ? raw : Buffer.isBuffer(raw) ? new Uint8Array(raw) : undefined;
-                if (token && token.length > 0) {
-                    deps.logger.info("directory.online_token.received", { directoryNodeId, bytes: token.length });
-                    deps.onOnlineToken(token);
-                }
-                else {
-                    /**
-                     * Review M1: the directory names WHICH absence, so this is no longer one label for three
-                     * different problems. `not_registered_here` in particular is a payload fact, and reporting
-                     * it as a generic "no token" sent the operator to check a directory connection that is
-                     * working perfectly.
-                     */
-                    const raw = ackFrame["online_token_absent_reason"];
-                    const absentReason = raw === "not_registered_here" || raw === "issue_failed" ? raw : undefined;
-                    deps.onOnlineTokenAbsent?.(absentReason);
-                    deps.logger.warn("directory.online_token.absent", {
-                        directoryNodeId,
-                        agentPubkey: identity.pubkeyHex,
-                        reason: absentReason ?? "unstated",
-                        impact: absentReason === "not_registered_here"
-                            ? "this directory holds no agent profile for this key, so it issued no online token " +
-                                "and no relay will grant this agent a reservation. The directory connection is FINE " +
-                                "— either this agent registered against a different sovereign node and its profile " +
-                                "has not replicated here yet, or it is not registered at all."
-                            : absentReason === "issue_failed"
-                                ? "this directory could not issue an online token — its own lookup or signing failed. " +
-                                    "That is a fault on the directory, not on this agent or on any relay."
-                                : "this directory issued no online token, so no relay will let this agent hold a " +
-                                    "circuit reservation and it will be reachable only over a direct connection. It " +
-                                    "stated no reason, which means it predates the token.",
-                    });
-                }
-            }
-            // ── Step 7: announce our peer info so the directory can broker sessions ──
-            const peerInfo = encodeCbor({
-                type: "peer_info_announce",
-                peer_id: node.getPeerId(),
-                multiaddrs: node.listenAddresses(),
-            });
-            sigStream.send(lp.encode.single(peerInfo));
-            /**
-             * ⚠️ **RENAMED FROM `directory.signaling.connected` — 058-LOGNAME, AND THE OLD NAME COST AN
-             * HOUR OF THE WRONG INVESTIGATION.**
-             *
-             * `SignalingManager.runConnectedPhase` logs `directory.signaling.connected` too, for a
-             * different fact: the manager has entered the connected STATE, carrying `manifestVersion`.
-             * This line is about the HANDSHAKE — who it was for, and whether the directory's challenge
-             * verified. Two meanings, one name, emitted in the same millisecond, so the event could not be
-             * counted at all.
-             *
-             * What that cost, concretely: reading 361 `directory.signaling.connected` in 90 minutes off a
-             * real daemon and spending an hour on connection churn, when the number was doubled by this
-             * collision and the actual defect was a credential that never refreshed (057-STALECRED).
-             *
-             * Keep them distinct. `connected` is the transport's state transition; `authenticated` is this
-             * — the daemon's per-agent handshake result, and the only one of the two that knows WHO.
-             */
-            deps.logger.info("directory.signaling.authenticated", {
-                directoryNodeId,
-                agentPubkey: identity.pubkeyHex,
-                verified: !!verifier,
-            });
-            // Publish the live, directory-connected node so registration/FROST/seal can
-            // open further streams to the directory on the same node.
-            deps.publishNode?.(node);
-            const stream = wrapSignalingStream(sigStream, iter, node, deps.logger, deps.publishNode);
-            return {
-                stream,
-                directoryNodeId,
-                manifestVersion: deps.getManifestVersion?.() ?? 0,
-            };
-        }
-        catch (err) {
-            // Symmetry with publishNode(node): if anything threw after we published (or in a
-            // reconnect attempt), clear the daemon's reference so it never points at a node
-            // we're about to stop. No-op when nothing was published this attempt.
-            deps.publishNode?.(null);
-            try {
-                sigStream.abort(new Error("directory_auth_error"));
-            }
-            catch {
-                /* stream may already be torn down */
-            }
-            await safeStop(node);
-            throw err instanceof Error ? err : new Error(errMsg(err));
-        }
-    };
-}
-/**
- * Adapt the post-handshake libp2p stream to the transport `SignalingStream`
- * interface the SignalingManager drives. Frames are CBOR objects; the wire is
- * length-prefixed CBOR, matching the directory and the M6 client exactly.
- *
- * The read loop continues from the SAME iterator the handshake used, so no inbound
- * frame is dropped between auth_ok and the manager registering its handler.
- */
-function wrapSignalingStream(sigStream, iter, node, logger, publishNode) {
-    let closed = false;
-    return {
-        async send(frame) {
-            const encoded = encodeCbor(frame);
-            sigStream.send(lp.encode.single(encoded));
-        },
-        onMessage(handler) {
-            void (async () => {
-                try {
-                    for (;;) {
-                        const { value, done } = await iter.next();
-                        if (done || value === undefined)
-                            break;
-                        let frame;
-                        try {
-                            frame = decode(toU8(value));
-                        }
-                        catch {
-                            // Skip undecodable frames rather than killing the whole stream.
-                            continue;
-                        }
-                        handler(frame);
-                    }
-                    logger.debug("directory.signaling.stream.ended", { expected: true });
-                }
-                catch (err) {
-                    // M8C-ONBOARD-LOGNOISE-1 (F11): routine reconnect churn (the reader loop ends when the
-                    // directory rotates/drops the stream, ~every 40–70 min, and the caller reconnects). At
-                    // `warn` a healthy daemon looked like it was failing. Log it quietly + marked expected; a
-                    // genuine SUSTAINED outage still stands out via the `reconnecting`→`lost` state escalation
-                    // (getAgentSignaling retry budget), which is unchanged.
-                    logger.debug("directory.signaling.reader.error", { error: errMsg(err), expected: true });
-                }
-            })();
-        },
-        close() {
-            if (closed)
-                return;
-            closed = true;
-            // Clear the daemon's reference before tearing the node down — registration/
-            // FROST/seal must not use a node that is being stopped.
-            publishNode?.(null);
-            try {
-                sigStream.abort(new Error("signaling_closed"));
-            }
-            catch {
-                /* already closed */
-            }
-            void safeStop(node);
-        },
-    };
-}
-//# sourceMappingURL=signaling-connect.js.map

package/dist/signaling-connect.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signaling-connect.js","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3D,OAAQ,CAA6B,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,IAAsB,EAAE,SAAiB;IACzE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KAClG,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAmF9C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D;;;;;;;;;;;;OAYG;IACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,OAAO,KAAK,UAAU,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,+FAA+F;QAC/F,2DAA2D;QAC3D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,gDAAgD;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;YACnC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,CAAC,MAAM,UAAU,CAAC;gBACf,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA4BG;gBACH,eAAe,EAAE,EAAE;gBACnB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/B,yFAAyF;gBACzF,qFAAqF;gBACrF,iFAAiF;gBACjF,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aACrC,CAAC,CAAC;QAEP,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,8EAA8E;gBAC9E,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,yEAAyE;oBACzE,uDAAuD;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;wBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,EAA+B,CAAC;QAEnH,IAAI,CAAC;YACH,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAErE,6EAA6E;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC;gBAC9B,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,GAAG;gBACd,iGAAiG;gBACjG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAE/C,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACzD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAA4B,CAAC;YACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,eAAe,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd;;;;;;;;;;;;;;;mBAeG;gBACH;;;;;;;;;;;;;mBAaG;gBACH,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;wBACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;wBAC7B,aAAa;wBACb,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EACJ,uFAAuF;4BACvF,qFAAqF;4BACrF,6EAA6E;4BAC7E,kFAAkF;4BAClF,6EAA6E;qBAChF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;gBACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACtF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,QAAQ,GAAG,aAAa,CAAC;oBAC7B,MAAM;oBACN,cAAc,EAAE,QAAQ,CAAC,SAAS;oBAClC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC5C,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBACzG,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAgCG;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,0BAA0B,EAAE,CAAC;oBACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;wBACnD,eAAe,EAAE,MAAM;wBACvB,MAAM,EAAE,sBAAsB;wBAC9B,SAAS;wBACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC3D,SAAS,EAAE,0BAA0B;wBACrC,MAAM,EACJ,wFAAwF;4BACxF,uFAAuF;qBAC1F,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,uEAAuE;YACvE,wEAAwE;YACxE,iBAAiB;YACjB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACrD,eAAe;wBACf,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;qBAC7C,CAAC,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvG,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN;;;;;uBAKG;oBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBACnD,MAAM,YAAY,GAAG,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/F,IAAI,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBAChD,eAAe;wBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EAAE,YAAY,IAAI,UAAU;wBAClC,MAAM,EAAE,YAAY,KAAK,qBAAqB;4BAC5C,CAAC,CAAC,mFAAmF;gCACnF,qFAAqF;gCACrF,oFAAoF;gCACpF,8DAA8D;4BAChE,CAAC,CAAC,YAAY,KAAK,cAAc;gCAC/B,CAAC,CAAC,qFAAqF;oCACrF,sEAAsE;gCACxE,CAAC,CAAC,gFAAgF;oCAChF,iFAAiF;oCACjF,sDAAsD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE;aACnC,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAE3C;;;;;;;;;;;;;;;;eAgBG;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,eAAe;gBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;gBAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YAEH,4EAA4E;YAC5E,0DAA0D;YAC1D,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YAEzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,OAAO;gBACL,MAAM;gBACN,eAAe;gBACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iFAAiF;YACjF,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,IAA+B,EAC/B,IAAe,EACf,MAAc,EACd,WAA8C;IAE9C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAc;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAe,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,OAAiC;YACzC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,SAAS,CAAC;wBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC1C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM;wBACvC,IAAI,KAAc,CAAC;wBACnB,IAAI,CAAC;4BACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,gEAAgE;4BAChE,SAAS;wBACX,CAAC;wBACD,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,wDAAwD;oBACxD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,4EAA4E;YAC5E,wDAAwD;YACxD,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}