@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/trust-signal-store.d.ts

@@ -1,406 +0,0 @@
-/**
- * M10 / DOD-STORE-CLIENT-1 — the daemon's two trust-signal tables.
- *
- * TWO tables, never one with a role flag (M10-D4). They answer different questions and obey
- * different scoping rules, and a single table with a `role` column is how one set of rules ends up
- * applied to the other's rows.
- *
- *   `wallet_trust_signals`  — signals ABOUT this daemon's agents, held so they can be PRESENTED.
- *   `contact_trust_signals` — signals OTHER agents PRESENTED TO one of my agents.
- *
- * THE WALLET CARRIES NO AGENT ASSOCIATION (M10-D14). PK = `signal_hash`; one row per signal per
- * daemon, and nothing more. It is the envelope's own HASHED `subject_kind`/`subject` that decides
- * who may present it, evaluated at presentation time — not a local attribution decided at delivery
- * time. That is the whole point: an account-subject signal (phone, email) serves every agent under
- * the account, so **adding an agent to an existing daemon is ZERO signal work** — no assignment
- * sweep, no re-attribution at renewal, no copies to keep in step at expiry. A per-agent column
- * would quietly reintroduce every one of those chores.
- *
- * THE RECEIVED STORE IS PER-AGENT, AND THE DATABASE ENFORCES IT (INV-AGENT-SCOPED). Consent is
- * genuinely per-agent here: a signal Bob showed to my agent `alice` must be invisible to my agent
- * `bob` on the same daemon. `agent_id` is NOT NULL and the row hangs off a contact row by composite
- * FK, so an unscoped row cannot be written at all — as opposed to being merely discouraged by a
- * query convention that every future caller must remember. (This requires `PRAGMA foreign_keys = ON`,
- * set at open in sqlcipher-db.ts — M10-D19. Without it the FK is decorative.) This is where the M8
- * scaffold's `agent_id = null` defect dies.
- *
- * EVIDENCE, NOT AN INPUT (M10-D4 / INV-STATELESS-RECIPIENT). Received rows are re-checkable evidence
- * of what was presented and when we verified it. They are NEVER an input to policy evaluation, which
- * consumes only the currently-presented set, and they are never trusted for freshness (that is
- * re-checked on use). This module therefore exposes no "is this contact trusted?" read — the absence
- * is deliberate and structural. Do not add one.
- *
- * OPAQUE THROUGHOUT (INV-ZERO-BUMP / INV-TYPE-CARRY). `type` is a TEXT column with no CHECK, no
- * enum, and no index predicated on a type value; `payload` is a BLOB that is never parsed and whose
- * fields are never hoisted into columns. A type string this code has never seen stores, reads, and
- * presents exactly like a known one. Adding a signal type must require no change to this file.
- */
-import { type TrustSignalEnvelope } from "@cello-protocol/protocol-types";
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import { type ConsentState } from "./consent-migration.js";
-import type { Logger } from "./types.js";
-/** Status lives OUTSIDE the hash — it is mutable after minting, which is exactly why it is not in
- *  the preimage. If it were hashed, revoking a signal would change its hash and the directory could
- *  never find it again. */
-export type SignalStatus = "active" | "revoked" | "superseded";
-/**
- * A delivery the holder REFUSED at its own chokepoint. A TYPED error so the delivery consumer (the M8
- * retirement's `inbound-sessions` re-point) can branch on it: a refused delivery must NEVER be ACKed
- * — the directory should re-deliver, or the operator investigate. A plain `Error` swallowed by a
- * best-effort `catch { return }` could accidentally fall through to an ACK; this cannot.
- */
-export type SignalDeliveryRejection = "claimed_hash_malformed" | "hash_mismatch";
-export declare class SignalDeliveryRejected extends Error {
-    readonly reason: SignalDeliveryRejection;
-    constructor(reason: SignalDeliveryRejection, detail: string);
-}
-/** The envelope, as this store takes and returns it. Mirrors `TrustSignalEnvelope` in
- *  protocol-types, plus the two non-hashed local columns. */
-export interface WalletSignalInput {
-    signalHash: string;
-    subjectKind: "account" | "agent";
-    subject: string;
-    issuerKind: "portal" | "agent";
-    issuerPubkey: string;
-    /** OPAQUE. Never gated on, never enumerated. */
-    type: string;
-    schemaVersion: number;
-    /** OPAQUE bytes. Never parsed. */
-    payload: Uint8Array;
-    issuedAt: number;
-    expiresAt: number | null;
-    supersedesHash: string | null;
-    status: SignalStatus | string;
-    /** Whether this signal is included in the default presentation bundle. When absent, derived from type suffix. */
-    defaultPresent?: boolean;
-    /** Envelope slot 12 (policy D-29). Defaults false — absent means "not co-owned", never "unknown". */
-    sameOperator?: boolean;
-}
-export interface WalletSignalRow extends WalletSignalInput {
-    receivedAt: number;
-    /** M10B-D14r2 — may this be presented at all. Distinct from `defaultPresent`, which answers the
-     *  different question of whether to include it BY DEFAULT once it may be presented.
-     *
-     *  NULLABLE, because the COLUMN is (SQLite cannot ADD COLUMN NOT NULL without a default). Declaring
-     *  it non-null would be a type that lies to every future consumer — and the consumer who then
-     *  writes `!== "refused"` ships a NULL straight through as presentable. The predicate tests for
-     *  exactly `accepted`, so NULL fails closed; the type must say so too. */
-    consentState: ConsentState | null;
-    /** Envelope slot 12: issuer and subject are the same operator (policy D-29). */
-    sameOperator: boolean;
-    /** True = included in the default presentation bundle. _id signals default false; everything else true. */
-    defaultPresent: boolean;
-}
-/**
- * A signal a contact PRESENTED to one of my agents, as it is stored after verification.
- *
- * ⚠️ NOTE WHAT IS ABSENT: there is no `status` field, and this type deliberately does NOT extend
- * `WalletSignalInput`.
- *
- * `status` is outside the hash preimage — that is what makes it mutable, and it also means it is
- * **NOT AUTHENTICATED BY THE SIGNAL HASH**. A presenter can claim any status they like. If this type
- * simply extended the wallet's, the peer's claimed `status` would ride in the same struct as the
- * envelope fields and the natural call site would pass it straight through to the database.
- *
- * The attack that permits: Bob presents signal H; we verify it, find it REVOKED at the directory,
- * and store that as evidence. Next session Bob re-presents the same hash claiming `status: active`.
- * An upsert on the peer's value overwrites the one durable record that says we caught it — the party
- * a revocation indicts gets to erase the indictment. Evidence an adversary can rewrite is not
- * evidence.
- *
- * So the stored status is OUR verification verdict (`verdict`), produced by the verification seam
- * (DOD-VERIFY-1) from what the DIRECTORY said — never a field the peer controls. Removing `status`
- * from the input type makes that structural: there is no pass-through to forget to block.
- */
-export interface ReceivedSignalInput extends Omit<WalletSignalInput, "status"> {
-    agentId: string;
-    contactPubkey: string;
-    verifiedAt: number;
-    /** OUR verdict from re-checking the directory — never the presenter's claim. */
-    verdict: SignalStatus;
-}
-/**
- * The submission verbs. Mirrors protocol-types' `SubmissionOp` without importing it into storage.
- *
- * MIRRORED, SO IT DRIFTS. Widening `SubmissionOp` and not this one is a type error at the call
- * site rather than a silent divergence — which is how `revoke` was caught. Keep them in step.
- */
-export type SubmissionOpName = "submit" | "withdraw" | "refuse" | "revoke";
-export interface IssuedSubmissionInput {
-    agentId: string;
-    /** Content-derived sha256 of the signed body (`M10B-D20`) — the handle a withdrawal names. */
-    submissionId: string;
-    subjectPubkey: string;
-    op: SubmissionOpName;
-    intakeKeyId: string;
-    /** What the accepting node said: false = it already held this id. */
-    stored: boolean;
-}
-export interface IssuedSubmissionRow extends IssuedSubmissionInput {
-    submittedAt: number;
-}
-export interface ReceivedSignalRow extends ReceivedSignalInput {
-    receivedAt: number;
-}
-export declare function ensureTrustSignalSchema(db: DaemonDatabase, _logger: Logger): void;
-export declare class TrustSignalStore {
-    #private;
-    /**
-     * Does NOT create the schema. `SessionNodeManager.initialize()` owns it, and must — the received
-     * table's FK parent is `contacts`, which that init creates. A store that created its own schema
-     * would happily build `contact_trust_signals` on any handle lacking `contacts`, producing a
-     * dangling FK that then fails on the first INSERT with `no such table: main.contacts` — an error
-     * that names the wrong subsystem, at the wrong time, far from the cause.
-     */
-    constructor(db: DaemonDatabase, logger: Logger);
-    /**
-     * Store a signal this daemon holds about one of its agents.
-     *
-     * `INSERT OR IGNORE`, and that is a correctness property, not a convenience: the row is keyed by
-     * its own content hash, so a second delivery of the same hash is by definition the same signal.
-     * If the bytes really differed, the hash would differ. A differing payload under an identical hash
-     * is therefore a liar, and it must not overwrite the truth. This is also what makes duplicate
-     * delivery a no-op and wallet rows safely mergeable across a user's daemons (spec §14.11).
-     */
-    /** Returns true iff a NEW row was inserted (false = the content-addressed row already existed, a
-     *  benign duplicate). */
-    putWalletSignal(s: WalletSignalInput): boolean;
-    /**
-     * Accept a trust-signal envelope delivered to this holder: RE-VERIFY its hash, then store it.
-     *
-     * This is the holder's own chokepoint (INV-CANONICAL / M10-D4): the daemon does not trust the
-     * `claimedHash` the delivery frame carried — it re-derives the hash from the envelope with the SAME
-     * canonical component every party uses, and REFUSES a mismatch. A delivered envelope whose bytes do
-     * not hash to the claim is a corrupted or tampered delivery; storing it would let the wallet present
-     * a signal the directory never notarized.
-     *
-     * Storage is idempotent (content-addressed PK) — a re-delivery is a no-op (§14.11). Returns whether
-     * a new row was stored, so the caller can ACK only a genuinely-accepted delivery.
-     */
-    deliverWalletSignal(envelope: TrustSignalEnvelope, claimedHash: string): {
-        stored: boolean;
-    };
-    getWalletSignal(signalHash: string): WalletSignalRow | null;
-    /**
-     * Status is the ONE mutable field — it lives outside the hash precisely so this is possible.
-     *
-     * REVOCATION IS TERMINAL. A revoked signal can never go back to `active`. Without that guard this
-     * is a blind UPDATE, and a stale or replayed directory read reporting `active` for a hash we
-     * already revoked would resurrect it — and `listPresentable` would start offering it again. The
-     * directory is the authority on revocation, but a LATE answer from it is not a NEW answer; the
-     * monotonic rule makes out-of-order responses harmless instead of dangerous.
-     *
-     * `superseded` may still be overtaken by `revoked` (a superseded signal can also be revoked), but
-     * never the reverse, and never back to `active`.
-     */
-    setWalletStatus(signalHash: string, status: SignalStatus): void;
-    /**
-     * The signals an agent may present, resolved from the ENVELOPE, not from a stored attribution:
-     * an `account`-subject row is presentable by every agent under `accountId`; an `agent`-subject row
-     * only by its own subject (M10-D5/M10-D14).
-     *
-     * **`agentPubkeyHex` is the K_local pubkey hex, NOT the daemon's device-local `agent_id`.** An
-     * agent-subject envelope's `subject` holds the pubkey — that is the value the directory joins on
-     * (`ap.k_local_pubkey = sr.subject`) — and a UUID compared against it matches nothing at all.
-     *
-     * NOTE (`DOD-END-SCOPE-FIX-1`): this method has no production callers; the live wire path is
-     * `listAllActive`, which now carries the agent-subject half of this scoping. Kept because it is
-     * the only implementation of the ACCOUNT-subject half, which is deferred behind a named
-     * prerequisite — the daemon holds no `accountId` anywhere in production code.
-     *
-     * Excludes expired and non-active rows. Selective disclosure (all / some / none) is the CALLER's
-     * choice on top of this — DOD-PRESENT-1; this returns what is *eligible*, never what to send.
-     */
-    listPresentable(opts: {
-        agentPubkeyHex: string;
-        accountId: string;
-        nowSec?: number;
-    }): WalletSignalRow[];
-    /**
-     * All wallet signals regardless of status — for operator inspection via `cello trust-signals list`.
-     * Ordered by issued_at DESC so the most recent signal of each type appears first.
-     */
-    listAllWalletSignals(): WalletSignalRow[];
-    /**
-     * Look up a wallet signal by hash prefix (minimum 8 chars). Returns the unique matching signal,
-     * or null if no match, or throws if the prefix is ambiguous (multiple matches).
-     */
-    getWalletSignalByPrefix(prefix: string): WalletSignalRow | null;
-    /**
-     * Hard-delete a wallet signal by hash (GDPR removal). Returns true if a row was deleted.
-     *
-     * This is a permanent DELETE, not a status transition. Revocation is directory-driven and leaves
-     * the row for audit; this is the operator exercising their own right to remove a signal from their
-     * own device with no directory involvement.
-     */
-    removeWalletSignal(signalHash: string): boolean;
-    /**
-     * Active, non-expired wallet signals THIS agent is eligible to present — the live wire path
-     * (`outbound-sessions.ts`).
-     *
-     * `presentingAgentPubkeyHex` is the presenting agent's K_local pubkey hex, and it is REQUIRED.
-     * An `agent`-subject row is presentable only by its own subject (M10-D5/M10-D14); the wallet is
-     * daemon-wide and shared by every agent on the device, so without this predicate each agent
-     * offers every co-resident agent's agent-subject signals to its own counterparties —
-     * `INV-AGENT-SCOPED`, which is what `DOD-END-SCOPE-FIX-1` closes. The scoping is in the SQL, not
-     * a JS filter, because `include` already routes around `default_present` and a JS branch would
-     * route around this the same way.
-     *
-     * **`lower(subject)`, because hex has a case and this comparison is byte-exact.** SQLite `TEXT`
-     * uses BINARY collation, so `AABB…` and `aabb…` — the same key — do not match, and the row would
-     * be silently un-presented with no error. The daemon's own `k_local_pubkey` is always lowercase
-     * (`agent-loader.ts` derives it with `.toString("hex")`), so only the STORED side can vary, and it
-     * can: `putWalletSignal` already names "a directory version-skew emitting uppercase hex" as a real
-     * condition. Comparing case-insensitively is the correct equality for hex, not a fallback that
-     * papers over a mismatch.
-     *
-     * Note the residual, because it is NOT closed here — it is `DOD-M15-HEXCASE-MINT-1`: the directory's
-     * `JOIN agent_profiles ap ON ap.k_local_pubkey = sr.subject` is case-sensitive too, so an
-     * uppercase-hex subject that ever got minted would still be invisible THERE. Closing that means
-     * constraining the value where it is produced (the portal's mint) — which spans three components
-     * and is its own decision, not something to smuggle into a presentation-scoping unit.
-     *
-     * **ACCOUNT-subject rows are deliberately NOT scoped here, and that half is deferred, not done.**
-     * `listPresentable` scopes them on `accountId` — but the daemon holds no `accountId` anywhere in
-     * production code, so there is nothing to compare against and inventing one is a separate
-     * decision (M10B fourth review F5). Today's behavior for account rows is therefore unchanged:
-     * every agent on the daemon may present them, which is also what M10-D5 says for agents under the
-     * same account. It becomes wrong only when one daemon holds agents of two different accounts,
-     * and that trigger is the whole of `DOD-M15-ACCOUNT-SCOPE-1` — which is where this gets closed,
-     * not by inventing a daemon-side `accountId` to satisfy the predicate.
-     *
-     * Default behavior: returns only signals where `default_present = 1`.
-     * `include` overrides the default — only the listed types are returned regardless of `default_present`.
-     * `exclude` removes types from the default set.
-     * Both `include` and `exclude` are type strings. Unknown types cause a validation error at the
-     * IPC layer (the caller must pre-validate against listAllWalletSignals before calling this).
-     */
-    listAllActive(opts: {
-        presentingAgentPubkeyHex: string;
-        nowSec?: number;
-        include?: string[];
-        exclude?: string[];
-    }): WalletSignalRow[];
-    /**
-     * The distinct signal TYPES this agent could present — active, unexpired, and scoped to the
-     * presenting agent exactly as `listAllActive` scopes rows.
-     *
-     * Deliberately ignores `default_present`, because this answers "may this type be named in a
-     * filter", and `include` exists precisely to override the default. Validating a filter against
-     * `listAllActive`'s output would reject a type the operator holds but has defaulted off — the
-     * filter rejecting the thing it was built to select.
-     *
-     * The scoping is the point: the wallet is daemon-wide, so validating a filter against the whole
-     * wallet accepts a type only a CO-RESIDENT agent holds, and the session then presents nothing with
-     * no error (review MEDIUM-4).
-     */
-    listPresentableTypes(presentingAgentPubkeyHex: string, nowSec?: number): string[];
-    /**
-     * Record the subject's consent decision (D-23). The ONLY writer of this column after insert.
-     *
-     * `refused` is terminal in spirit but not enforced as one-way here: `M10B-D4` allows Bob to issue a
-     * CORRECTED endorsement after a refusal, and that is a NEW signal with its own hash — it does not
-     * reuse this row. What must never happen is a refusal being silently undone, which is why the
-     * migration is birth-gated rather than NULL-driven.
-     */
-    setConsentState(signalHash: string, state: ConsentState): boolean;
-    /**
-     * DOD-END-PENDING-1 — the decisions this agent still owes (`M10B-D5`).
-     *
-     * Its OWN surface, deliberately not the transcript inbox: an inbox item is cleared by reading or
-     * dismissing a transcript, and an endorsement awaiting consent has no transcript, so it would be an
-     * item the operator could never clear the normal way.
-     *
-     * Keyed by CONSENT STATE, never by type — that is what makes a whole new queue legal under
-     * INV-ZEROBUMP, and it is why a future client-sourced type appears here with no code change.
-     *
-     * SCOPING, STATED HONESTLY. Agent-subject items are scoped to their subject, on the same axis as
-     * presentation (DOD-END-SCOPE-FIX-1). ACCOUNT-subject items are visible to every agent on the
-     * daemon — the same deferred residual `listAllActive` carries, because the daemon holds no
-     * `accountId` anywhere in production code and per M10-D5 account signals serve every agent under
-     * the account.
-     *
-     * ⚠️ BUT THE RESIDUAL CHANGES CHARACTER HERE, and that is worth naming rather than inheriting
-     * silently: in `listAllActive` the consequence is SHOWING the wrong signal; here it is DECIDING.
-     * Any agent on the daemon can accept an account-subject endorsement on another's behalf, and
-     * acceptance runs a destructive supersession. Nobody has ruled on whether account-subject consent
-     * should be per-agent or per-account — M10B-D9 says acceptance is recorded once per account-subject
-     * SIGNAL, which points at "any agent may decide", but it was written about the operator surface,
-     * not about authority. Recorded as an open question on `DOD-END-SURFACE-1` rather than settled by
-     * whichever predicate got copied first.
-     */
-    /**
-     * Find a consent item this agent may DECIDE ON — pending, or ALREADY ACCEPTED.
-     *
-     * Refusal used to be reachable only while an item was `pending`, so "I accepted this endorsement
-     * and now I want it gone" had no path at all. This widens it, and the widening is the whole point:
-     * a refused signal is inert everywhere it is checked, which is the mechanism for taking back
-     * something you previously agreed to show.
-     *
-     * ── `issuer_kind <> 'portal'` IS THE LOAD-BEARING CLAUSE, NOT A TIDY-UP ────────────────────────
-     * Refusal makes a signal inert. So widening refusal without this filter would hand every operator
-     * a back door to suppressing their own MANDATORY signals — refuse your `track_record` and it stops
-     * being presented, achieving by consent exactly what revocation is forbidden from doing. The
-     * behavioural record is portal-issued; peer-claimed attestations are not. That is the axis, and it
-     * is the same one the DIRECTORY uses (`issuer_kind`), rather than a list of type names the client
-     * would have to keep in step.
-     *
-     * Deliberately NOT filtered by type: a hostile peer can issue a signal it CALLS `track_record`, and
-     * refusing a stranger's claim about you is precisely what this is for. The mandatory rule protects
-     * the portal's behavioural record, never a third party's assertion.
-     *
-     * Same agent-scoping predicate as `listPendingConsent` — including its unresolved question about
-     * who may decide for an account-subject item. Copied rather than diverged: two different answers to
-     * "may this agent decide" would be worse than one unresolved answer.
-     */
-    findDecidableConsent(agentPubkeyHex: string, prefix: string): WalletSignalRow | null;
-    listPendingConsent(agentPubkeyHex: string): WalletSignalRow[];
-    /**
-     * How many pending decisions this agent has NOT yet been told about.
-     *
-     * Asked on every agent selection, so it must go quiet once the operator has been told — while the
-     * ITEM stays in `listPendingConsent` until they actually decide. A new arrival raises it again,
-     * because the silence is per-item and not a permanent "already notified" flag on the agent.
-     */
-    countUnnotifiedConsent(agentPubkeyHex: string): number;
-    /** Record that the operator has been told about this agent's currently-pending decisions. */
-    markConsentNotified(agentPubkeyHex: string): number;
-    /** Set the persistent default-presentation flag for a wallet signal. */
-    setDefaultPresent(signalHash: string, value: boolean): boolean;
-    /**
-     * Store a signal a contact PRESENTED to one of my agents, after it was verified.
-     *
-     * The FK refuses a row for a contact that does not exist — an unscoped received signal is not
-     * merely discouraged, it is unwritable. `verified_at` is RE-STAMPED on re-presentation: it records
-     * when WE last re-verified, and a stale value that looked fresh would be worse than no value at
-     * all (freshness is re-checked on use — M10-D4).
-     */
-    /**
-     * Record a submission THIS daemon sent. Idempotent on (agent_id, submission_id): the id is
-     * content-derived, so a safe re-submit is the SAME row rather than a second one — which is what
-     * makes "re-sending is safe" true at this layer too, not just at the directory's.
-     *
-     * `stored` is UPDATED on conflict, and that direction is deliberate: a retry that finally lands as
-     * newly-stored should not keep reporting the earlier duplicate answer.
-     */
-    recordIssuedSubmission(s: IssuedSubmissionInput): void;
-    /** What this agent has submitted, newest first. No body — see the table comment. */
-    listIssuedSubmissions(agentId: string): IssuedSubmissionRow[];
-    putReceivedSignal(s: ReceivedSignalInput): void;
-    /**
-     * Mark a received signal as superseded. Same monotonic rules as setWalletStatus: revoked wins,
-     * and a superseded signal never goes back to active.
-     */
-    setReceivedStatus(opts: {
-        agentId: string;
-        contactPubkey: string;
-        signalHash: string;
-        status: SignalStatus;
-    }): void;
-    /** Evidence only. Never an input to policy — see the header. */
-    listReceived(opts: {
-        agentId: string;
-        contactPubkey: string;
-    }): ReceivedSignalRow[];
-}
-//# sourceMappingURL=trust-signal-store.d.ts.map

package/dist/trust-signal-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"trust-signal-store.d.ts","sourceRoot":"","sources":["../src/trust-signal-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAkD,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;2BAE2B;AAC3B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,GAAG,eAAe,CAAC;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB;gBAA/B,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM;CAIrE;AAED;6DAC6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,iHAAiH;IACjH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;8EAM0E;IAC1E,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,gFAAgF;IAChF,YAAY,EAAE,OAAO,CAAC;IACtB,2GAA2G;IAC3G,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,gBAAgB,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAwHD,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA8DjF;AAyFD,qBAAa,gBAAgB;;IAI3B;;;;;;OAMG;gBACS,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAK9C;;;;;;;;OAQG;IACH;6BACyB;IACzB,eAAe,CAAC,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAsC9C;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE;IAiH5F,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAO3D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI;IA0B/D;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe,EAAE;IAsBxG;;;OAGG;IACH,oBAAoB,IAAI,eAAe,EAAE;IAOzC;;;OAGG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAY/D;;;;;;OAMG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAW/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,CAAC,IAAI,EAAE;QAClB,wBAAwB,EAAE,MAAM,CAAC;QACjC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,GAAG,eAAe,EAAE;IAgCrB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAcjF;;;;;;;OAOG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IA+BjE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAiBpF,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,EAAE;IAe7D;;;;;;OAMG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAetD,6FAA6F;IAC7F,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAqBnD,wEAAwE;IACxE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAW9D;;;;;;;OAOG;IACH;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,EAAE,qBAAqB,GAAG,IAAI;IActD,oFAAoF;IACpF,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAkB7D,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,IAAI;IAoC/C;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI;IAgBnH,gEAAgE;IAChE,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB,EAAE;CAiBpF"}