@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/gateway-config-handlers.js

@@ -1,429 +0,0 @@
-/**
- * DOD-M9B-SURFACE-1 — the security layer's control surface (policy D-4).
- *
- * The gateway's config store has enforced tighten-free / loosen-confirmed since June 2026, and
- * NOTHING in the product could ever satisfy the confirmation — there was no CLI, no MCP tool, no
- * portal page. A `confirmed` flag that only tests set is a gate nobody can pass and nobody can
- * open. These three verbs are the surface, and the confirmation is a human at a terminal.
- *
- * INV-10 — WHAT THIS GATE ACTUALLY GUARANTEES, stated honestly (audit finding, 2026-07-29).
- *
- * Every loosening flows through the versioned store, and `confirmed` is honored only from a
- * connection whose declared `clientType` is exactly `cli` — an MCP caller, or one that never
- * handshook at all, is refused with the command a human must run.
- *
- * **That is not an authentication boundary, and it must not be described as one.** `clientType` is
- * SELF-DECLARED: the daemon records whatever string arrives in `ipc.connect`. Any process running
- * as the operator can open `~/.cello/daemon.sock` (mode 0600), announce `clientType: "cli"`, and
- * pass `confirmed: true`. That includes an agent with a shell tool. The TTY check that represents
- * the human lives in the CLI process (`confirmAtTty`), and the daemon has no way to verify it —
- * a same-uid process is indistinguishable from the operator by any local mechanism, so no amount
- * of daemon-side checking closes this.
- *
- * What it therefore DOES do, which is worth having: it removes every path an agent reaches by
- * ORDINARY means — the MCP tools it is given, and the CLI it can invoke (which refuses on a
- * non-TTY stdin). An agent must go out of its way, speaking raw IPC and misrepresenting itself,
- * and that is a different and much louder act than calling a tool it was handed.
- *
- * The real boundary is the one D-4 already names as the destination: the portal passkey. A
- * confirmation the operator performs on a surface the local machine cannot forge is the only thing
- * that makes "and nothing else produces this flag" true. Until then, this is a friction gate with
- * a versioned, hash-chained audit trail — not a lock.
- *
- * STORE HANDLES ARE HELD OPEN FOR THE PROCESS LIFETIME. They were originally opened per call, on
- * the reasoning that config commands are rare and a second long-lived handle buys only lock
- * contention. That was wrong, and it cost the entire audit trail — proven against the shipped
- * daemon on 2026-07-29:
- *
- *   1. sidecar screens a message  -> record written, visible, `-wal` present
- *   2. a reader opens and CLOSES  -> `-wal`/`-shm` unlinked out from under the sidecar
- *   3. sidecar screens again      -> the write lands in the now-orphaned WAL
- *   4. a fresh reader sees        -> only the FIRST record. Everything after step 2 is lost.
- *
- * PRECISION ADDED 2026-07-30 (review M1): step 2 only unlinks when that reader is the LAST
- * connection open — a non-last close is harmless, which is measurable in one script. The reason the
- * live sequence hit it anyway is `cello config set`, which SIGTERMs the sidecar to apply the change:
- * during the restart the per-call handle IS the last one. Do not soften the rule below on the
- * strength of the correction — "only sometimes destroys the audit trail" is not a design.
- *
- * So `cello policy log` and `cello config list` — the surfaces that exist to show what the layer
- * did — were silently destroying the record of what it did next. Holding the handle open means no
- * connection ever performs the last-connection close while the sidecar is alive, which is the
- * event that removes the WAL. The handles are deliberately not closed per call; process exit
- * releases them, and the sidecar is torn down before the daemon exits (INV-9 shutdown ordering).
- */
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { GatewayConfigStore, GatewayRecordStore } from "@cello-protocol/gateway";
-import { dbKeyPathFor } from "./sqlcipher-db.js";
-import { extractErrorMessage } from "./error-message.js";
-/** The five keys the gateway reads. Kept here so the surface can list them without a store open. */
-export const GATEWAY_CONFIG_KEYS = [
-    "autonomous_override",
-    "pii_whitelist",
-    "language_allow",
-    "rate_max_per_window",
-    "rate_window_ms",
-];
-/** What each key controls, in the words an operator needs to decide whether to change it. */
-const KEY_HELP = {
-    autonomous_override: "whether the agent may send a flagged value with no human present",
-    pii_whitelist: "values (e.g. your own email) that pass outbound without a warning",
-    language_allow: "which languages are accepted inbound",
-    rate_max_per_window: "how many outbound messages are allowed per window (0 = no cap)",
-    rate_window_ms: "the window the outbound cap applies to, in milliseconds",
-};
-/** Parse a wire value into the type the store's validator expects for that key. */
-function coerce(key, raw) {
-    if (key === "autonomous_override") {
-        if (typeof raw === "boolean")
-            return { ok: true, value: raw };
-        if (raw === "true" || raw === "false")
-            return { ok: true, value: raw === "true" };
-        return { ok: false, reason: "autonomous_override is a boolean — pass true or false." };
-    }
-    if (key === "pii_whitelist" || key === "language_allow") {
-        if (Array.isArray(raw) && raw.every((v) => typeof v === "string"))
-            return { ok: true, value: raw };
-        // A comma-separated string is what a CLI argument looks like. An EMPTY string means the empty
-        // list (the tightest value), not [""] — a stray empty member would whitelist nothing but would
-        // read as a loosening in the version history.
-        if (typeof raw === "string") {
-            return { ok: true, value: raw.split(",").map((s) => s.trim()).filter(Boolean) };
-        }
-        return { ok: false, reason: `${key} is a list — pass comma-separated values, or an empty string to clear it.` };
-    }
-    const n = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
-    if (!Number.isFinite(n))
-        return { ok: false, reason: `${key} is a number.` };
-    // Mirror the store's own range rules HERE (review F6). Without this, `rate_window_ms 0` reached
-    // the store's validator, which THROWS — and an uncaught throw becomes `internal_error: an
-    // unexpected error occurred, check daemon logs`. The operator asked for something out of range
-    // and was told the daemon broke.
-    if (key === "rate_max_per_window" && n < 0) {
-        return { ok: false, reason: "rate_max_per_window cannot be negative (0 means no cap)." };
-    }
-    if (key === "rate_window_ms" && n <= 0) {
-        return { ok: false, reason: "rate_window_ms must be greater than 0 milliseconds." };
-    }
-    return { ok: true, value: n };
-}
-/**
- * Map a store-layer throw onto a named cause. An exit-point label on a corrupt security store is
- * the error-substitution defect this project keeps finding (review F7).
- */
-function storeFault(message) {
-    if (/SQLITE_CORRUPT|malformed|SQLITE_IOERR/i.test(message)) {
-        return {
-            ok: false,
-            reason: "store_corrupt",
-            guidance: "The security layer's store could not be read — the file is damaged. Screening still runs " +
-                "and still fails closed, but the config history and the audit trail are unreadable. Stop " +
-                `the daemon, move ~/.cello/gateway.db aside, and restart to begin a fresh store. (${message})`,
-        };
-    }
-    if (/SQLITE_BUSY|locked/i.test(message)) {
-        return {
-            ok: false,
-            reason: "store_locked",
-            guidance: "The security layer's store is locked by another process — usually an orphaned gateway " +
-                `from a previous daemon. Stop it and retry. (${message})`,
-        };
-    }
-    return {
-        ok: false,
-        reason: "store_read_failed",
-        guidance: `The security layer's store could not be read. (${message})`,
-    };
-}
-export function registerGatewayConfigHandlers(deps) {
-    const { handlers, celloDir, logger, getClientType, restartSecurityGateway } = deps;
-    // ONE handle, opened lazily, never closed per call — see the header. Never closing means this
-    // handle can never be the last-closer that unlinks the WAL while the sidecar is mid-restart.
-    let configStore;
-    const openStore = () => {
-        if (!configStore) {
-            configStore = new GatewayConfigStore(join(celloDir, "gateway.db"), dbKeyPathFor(join(celloDir, "sessions.db")), 
-            // INV-7: the daemon logs through its injected logger and nowhere else. Without this sink the
-            // store would write raw lines to the daemon's stderr.
-            (event, context) => logger.info(event, context));
-        }
-        return configStore;
-    };
-    let recordStore;
-    const openRecordStore = () => {
-        if (!recordStore) {
-            recordStore = new GatewayRecordStore(join(celloDir, "gateway.db"), dbKeyPathFor(join(celloDir, "sessions.db")), (event, context) => logger.info(event, context));
-        }
-        return recordStore;
-    };
-    /** Every store open can fail closed (missing key, locked file). Report the CAUSE, not a label. */
-    const withStore = (fn) => {
-        let store;
-        try {
-            store = openStore();
-        }
-        catch (err) {
-            const code = err?.code ?? "config_store_unavailable";
-            const guidance = err?.guidance
-                ?? "The security layer's config store could not be opened. Check the daemon log.";
-            // Review M4: LOG IT. This is the worst failure this surface has — the governance store
-            // unopenable, locked, or plaintext — and it used to exist ONLY in a CLI response the operator
-            // may never have run. "Check the daemon log" while writing nothing to the daemon log is a
-            // dead end, and the project's error-path-coverage rule exists for exactly this.
-            logger.error("gateway.config.store_unavailable", {
-                reason: code, error: extractErrorMessage(err), store: "config",
-            });
-            return { ok: false, reason: code, guidance };
-        }
-        try {
-            return fn(store);
-        }
-        catch (err) {
-            // The store validates too, and it THROWS. A validation fault is the caller's input being
-            // wrong, not the daemon being broken — surfacing it as `internal_error` sends the operator
-            // to the logs for a problem they can fix in the command they just typed.
-            const message = extractErrorMessage(err);
-            if (/invalid value for config key|unknown config key/i.test(message)) {
-                return { ok: false, reason: "invalid_value", guidance: message };
-            }
-            // Review F7: a READ that throws used to escape as `internal_error: an unexpected error
-            // occurred, check daemon logs` — sending the operator to the logs for a corrupted security
-            // store, with no remedy named, while the OPEN path carefully produces store_plaintext_file /
-            // store_locked / store_key_mismatch. The read path deserves the same.
-            return storeFault(message);
-        }
-        // NO `finally { store.close() }`. The close is the defect: closed as the last connection during
-        // a sidecar restart, it unlinks the WAL and every record written afterwards is lost.
-    };
-    // Read the whole surface. Shows the GOVERNANCE, not just the value (M9B-D18): after an incident
-    // the question is not "what is this set to" but "who weakened it, and did a human agree".
-    handlers.set("cello_config_list", async () => withStore((store) => ({
-        ok: true,
-        config: GATEWAY_CONFIG_KEYS.map((key) => {
-            const history = store.history(key);
-            const latest = history[history.length - 1];
-            return {
-                key,
-                describes: KEY_HELP[key],
-                // `null`, never a fabricated default: the gateway applies its own tightest default for an
-                // unset key, and echoing that value here would make "never configured" indistinguishable
-                // from "deliberately set to the same value".
-                value: latest ? latest.value : null,
-                version: latest?.version ?? 0,
-                lastChange: latest?.direction ?? null,
-                confirmed: latest?.confirmed ?? false,
-                // WHEN, and whether the version chain still verifies. `list` is the command someone runs
-                // AFTER an incident, and until now it showed neither — so it could not answer "who
-                // weakened this, when, and did a human agree" (review F9 of the earlier pass).
-                changedAt: latest?.changedAt ?? null,
-                // `null` for a key with NO rows, not `true` (review L5). An empty chain verifies
-                // vacuously, and "nothing to verify" must not read the same as "verified intact" on the
-                // one field whose whole job is tamper detection.
-                chainValid: latest ? store.verifyChain(key) : null,
-            };
-        }),
-    })));
-    handlers.set("cello_config_get", async (params) => {
-        const key = typeof params?.key === "string" ? params.key : undefined;
-        if (!key || !GATEWAY_CONFIG_KEYS.includes(key)) {
-            return {
-                ok: false,
-                reason: "unknown_key",
-                guidance: `Provide one of: ${GATEWAY_CONFIG_KEYS.join(", ")}.`,
-            };
-        }
-        return withStore((store) => {
-            const history = store.history(key);
-            const latest = history[history.length - 1];
-            return {
-                ok: true,
-                key,
-                describes: KEY_HELP[key],
-                value: latest ? latest.value : null,
-                version: latest?.version ?? 0,
-                lastChange: latest?.direction ?? null,
-                confirmed: latest?.confirmed ?? false,
-                // Review L4: `get` is the NARROWER, more natural command ("what is autonomous_override
-                // set to?"), and it was the one that could not answer WHEN. Same two fields as `list`.
-                changedAt: latest?.changedAt ?? null,
-                chainValid: latest ? store.verifyChain(key) : null,
-            };
-        });
-    });
-    // DOD-M9B-AUDIT-1 (policy D-11) — "what did my policy do?"
-    //
-    // This ships WITH the enforcement flip, by decision, and not later: it is the concrete answer to
-    // the question D-2 raised — *"I have ongoing development everywhere, and if a new error appears
-    // I won't know whether it came from the flip or from my own work."* Attribution should be a
-    // lookup, not a guess, so every screened message is already recorded with its disposition and
-    // the rule that fired. This reads that record. Deliberately a list, not a dashboard.
-    //
-    // Newest first, because the question is almost always "what just happened".
-    handlers.set("cello_policy_log", async (params) => {
-        const rawLimit = params?.limit;
-        const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0
-            ? Math.min(Math.floor(rawLimit), 500)
-            : 50;
-        const since = typeof params?.since_ms === "number" && Number.isFinite(params.since_ms)
-            ? params.since_ms
-            : undefined;
-        let store;
-        try {
-            store = openRecordStore();
-        }
-        catch (err) {
-            const code = err?.code ?? "record_store_unavailable";
-            const guidance = err?.guidance
-                ?? "The security layer's record store could not be opened. Check the daemon log.";
-            // Review M4, and worse here than for config: an unopenable RECORD store means the audit trail
-            // itself is unreadable, which is the one failure that must never be quiet.
-            logger.error("gateway.config.store_unavailable", {
-                reason: code, error: extractErrorMessage(err), store: "records",
-            });
-            return { ok: false, reason: code, guidance };
-        }
-        try {
-            const all = store.all();
-            const filtered = since === undefined ? all : all.filter((r) => r.recordedAt >= since);
-            const page = filtered.slice(-limit).reverse();
-            return {
-                ok: true,
-                // `source` is here from day one so the reachability half (refusals, tier gates, away
-                // responses — policy audit §15 items 5-8) can join this list later without changing its
-                // shape. A consumer that learns to read one source reads both.
-                entries: page.map((r) => ({
-                    source: "security",
-                    at: r.recordedAt,
-                    direction: r.direction,
-                    disposition: r.disposition,
-                    reason: r.reason ?? null,
-                    correlationId: r.correlationId ?? null,
-                    contentHash: r.contentHash,
-                })),
-                total: filtered.length,
-                returned: page.length,
-                // A broken chain means the log itself was tampered with, which the operator must be told
-                // BEFORE they reason from its contents.
-                chainValid: store.verifyChain(),
-            };
-        }
-        catch (err) {
-            return storeFault(extractErrorMessage(err));
-        }
-    });
-    handlers.set("cello_config_set", async (params, connectionId) => {
-        // One id for the whole fan-out: changed -> applied | restart_failed, AND the restarted sidecar's
-        // own boot lines — the last of those was claimed before it was true (review M2), so the id is now
-        // actually passed to the restart and into the child's environment. This is the multi-event async
-        // flow the project's correlationId rule exists for, and the config path had none because it has
-        // no inbound id to inherit — so mint one (review F12).
-        const correlationId = randomUUID();
-        const key = typeof params?.key === "string" ? params.key : undefined;
-        if (!key || !GATEWAY_CONFIG_KEYS.includes(key)) {
-            return { ok: false, reason: "unknown_key", guidance: `Provide one of: ${GATEWAY_CONFIG_KEYS.join(", ")}.` };
-        }
-        if (!params || !("value" in params)) {
-            return { ok: false, reason: "missing_params", guidance: `Provide 'value' — ${KEY_HELP[key]}.` };
-        }
-        const parsed = coerce(key, params.value);
-        if (!parsed.ok)
-            return { ok: false, reason: "invalid_value", guidance: parsed.reason };
-        // F1 (review, BLOCKING): the permissive side must not be the DEFAULT. `getClientType` returns
-        // undefined for a connection that never sent `ipc.connect`, and the daemon itself defaults a
-        // handshake with no clientType to "cli" — so `!== "mcp"` meant a raw socket write could carry
-        // `confirmed: true` and land a human-confirmed loosening with no human anywhere near it. Ten
-        // lines of node against ~/.cello/daemon.sock was the whole attack.
-        //
-        // And the justification for the original shape was FALSE in the direction that mattered: an
-        // agent running `cello config set …` from a Bash tool gets a NON-TTY stdin and is refused, so
-        // the raw socket was not "the same as just running the CLI" — it was the only route that worked
-        // for a non-human. Now only an EXPLICIT `cli` handshake may confirm; everything else is an
-        // untrusted surface.
-        const clientType = getClientType(connectionId);
-        const surface = clientType === "cli" ? "cli" : clientType === "mcp" ? "mcp" : "unknown";
-        const confirmed = params.confirmed === true;
-        return withStore((store) => {
-            // Ask the store to classify WITHOUT confirmation first. Its classifier is the authority on
-            // what counts as a loosening — re-deriving that here would be a second opinion that drifts.
-            const attempt = store.set(key, parsed.value);
-            if (attempt.ok) {
-                logger.info("gateway.config.changed", {
-                    key, direction: attempt.direction, version: attempt.version, confirmed: false, surface, correlationId,
-                });
-                return applied(key, attempt.direction, attempt.version, false);
-            }
-            // It is a loosening. Three ways to be refused, and they are different failures.
-            if (surface !== "cli") {
-                logger.warn("gateway.config.loosen_refused", { key, surface, reason: "loosen_requires_cli", correlationId });
-                return {
-                    ok: false,
-                    reason: "loosen_requires_cli",
-                    guidance: `Changing '${key}' this way makes the security layer LESS protective, so it needs a ` +
-                        `human at a terminal — an agent cannot weaken its own guards. Ask the operator to run: ` +
-                        `cello config set ${key} ${String(params.value)}`,
-                };
-            }
-            if (!confirmed) {
-                logger.warn("gateway.config.loosen_refused", { key, surface, reason: "needs_confirmation", correlationId });
-                const history = store.history(key);
-                const latest = history[history.length - 1];
-                return {
-                    ok: false,
-                    reason: "needs_confirmation",
-                    direction: "loosen",
-                    // The CURRENT value travels with the refusal (review F7). `set` REPLACES a list, so
-                    // `cello config set pii_whitelist new@x.example` against a five-entry whitelist drops
-                    // four of them — and a prompt that shows only the new value hides that entirely.
-                    // `null` means never configured, i.e. the built-in tightest default applies.
-                    from: latest ? latest.value : null,
-                    guidance: `This makes ${KEY_HELP[key]} LESS restrictive.`,
-                };
-            }
-            const result = store.set(key, parsed.value, { confirmed: true });
-            if (!result.ok) {
-                // The store refused a confirmed loosening — it should not, so do not paper over it.
-                return { ok: false, reason: result.reason, guidance: "The config store rejected a confirmed change. Check the daemon log." };
-            }
-            logger.info("gateway.config.changed", {
-                key, direction: result.direction, version: result.version, confirmed: true, surface, correlationId,
-            });
-            return applied(key, result.direction, result.version, true);
-        });
-        /** Store the change, then make it REAL — the gateway reads config only at boot (M9B-D17). */
-        function applied(k, direction, version, wasConfirmed) {
-            const base = { ok: true, key: k, direction, version, confirmed: wasConfirmed };
-            if (!restartSecurityGateway)
-                return { ...base, applied: false };
-            return restartSecurityGateway(correlationId).then(() => {
-                logger.info("gateway.config.applied", { key: k, restarted: true, correlationId });
-                return { ...base, applied: true };
-            }, (err) => {
-                // STORED BUT NOT APPLIED. Never a bare ok: the operator would believe a guard changed
-                // when the running gateway still holds the old value.
-                const error = extractErrorMessage(err);
-                logger.error("gateway.config.restart_failed", { key: k, error, correlationId });
-                return {
-                    ...base,
-                    applied: false,
-                    warning: "stored_but_not_applied",
-                    guidance: "The change is recorded but the screening process did not restart, so it is NOT yet " +
-                        `in effect. Restart the daemon to apply it. Cause: ${error}`,
-                };
-            });
-        }
-    });
-    return () => {
-        try {
-            configStore?.close();
-        }
-        catch { /* best-effort */ }
-        try {
-            recordStore?.close();
-        }
-        catch { /* best-effort */ }
-        configStore = undefined;
-        recordStore = undefined;
-    };
-}
-//# sourceMappingURL=gateway-config-handlers.js.map

package/dist/gateway-config-handlers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway-config-handlers.js","sourceRoot":"","sources":["../src/gateway-config-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAwB,MAAM,yBAAyB,CAAC;AAGvG,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;CACR,CAAC;AAEX,6FAA6F;AAC7F,MAAM,QAAQ,GAA2B;IACvC,mBAAmB,EAAE,kEAAkE;IACvF,aAAa,EAAE,mEAAmE;IAClF,cAAc,EAAE,sCAAsC;IACtD,mBAAmB,EAAE,gEAAgE;IACrF,cAAc,EAAE,yDAAyD;CAC1E,CAAC;AAeF,mFAAmF;AACnF,SAAS,MAAM,CAAC,GAAW,EAAE,GAAY;IACvC,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;QAClC,IAAI,OAAO,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QACnG,8FAA8F;QAC9F,+FAA+F;QAC/F,8CAA8C;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,2EAA2E,EAAE,CAAC;IAClH,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;IAC7E,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,iCAAiC;IACjC,IAAI,GAAG,KAAK,qBAAqB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,QAAQ,EACN,2FAA2F;gBAC3F,0FAA0F;gBAC1F,oFAAoF,OAAO,GAAG;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,QAAQ,EACN,wFAAwF;gBACxF,+CAA+C,OAAO,GAAG;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kDAAkD,OAAO,GAAG;KACvE,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,6BAA6B,CAAC,IAA8B;IAC1E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAEnF,8FAA8F;IAC9F,6FAA6F;IAC7F,IAAI,WAA2C,CAAC;IAChD,MAAM,SAAS,GAAG,GAAuB,EAAE;QACzC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,kBAAkB,CAClC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC3C,6FAA6F;YAC7F,sDAAsD;YACtD,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,WAA2C,CAAC;IAChD,MAAM,eAAe,GAAG,GAAuB,EAAE;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,kBAAkB,CAClC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAC3C,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,kGAAkG;IAClG,MAAM,SAAS,GAAG,CAAI,EAAoC,EAAuD,EAAE;QACjH,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,0BAA0B,CAAC;YACnF,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ;mBAC3D,8EAA8E,CAAC;YACpF,uFAAuF;YACvF,8FAA8F;YAC9F,0FAA0F;YAC1F,gFAAgF;YAChF,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ;aAC/D,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yFAAyF;YACzF,2FAA2F;YAC3F,yEAAyE;YACzE,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACnE,CAAC;YACD,uFAAuF;YACvF,2FAA2F;YAC3F,6FAA6F;YAC7F,sEAAsE;YACtE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,gGAAgG;QAChG,qFAAqF;IACvF,CAAC,CAAC;IAEF,gGAAgG;IAChG,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAC3C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,GAAG;gBACH,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACxB,0FAA0F;gBAC1F,yFAAyF;gBACzF,6CAA6C;gBAC7C,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC;gBAC7B,UAAU,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACrC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;gBACrC,yFAAyF;gBACzF,mFAAmF;gBACnF,+EAA+E;gBAC/E,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACpC,iFAAiF;gBACjF,wFAAwF;gBACxF,iDAAiD;gBACjD,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CAAC;QACJ,CAAC,CAAC;KACH,CAAC,CAAC,CACJ,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC/D,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,GAAG;gBACH,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC;gBAC7B,UAAU,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACrC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;gBACrC,uFAAuF;gBACvF,uFAAuF;gBACvF,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACpC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,4FAA4F;IAC5F,8FAA8F;IAC9F,qFAAqF;IACrF,EAAE;IACF,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,KAAK,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACrF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,0BAA0B,CAAC;YACnF,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ;mBAC3D,8EAA8E,CAAC;YACpF,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS;aAChE,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,qFAAqF;gBACrF,wFAAwF;gBACxF,+DAA+D;gBAC/D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxB,MAAM,EAAE,UAAmB;oBAC3B,EAAE,EAAE,CAAC,CAAC,UAAU;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;oBACxB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;oBACtC,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;gBACH,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,yFAAyF;gBACzF,wCAAwC;gBACxC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC9D,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,gGAAgG;QAChG,uDAAuD;QACvD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,qBAAqB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAEvF,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,mEAAmE;QACnE,EAAE;QACF,4FAA4F;QAC5F,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,qBAAqB;QACrB,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QAE5C,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,2FAA2F;YAC3F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACpC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa;iBACtG,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjE,CAAC;YAED,gFAAgF;YAChF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC7G,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EACN,aAAa,GAAG,qEAAqE;wBACrF,wFAAwF;wBACxF,oBAAoB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACpD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5G,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,oBAAoB;oBAC5B,SAAS,EAAE,QAA2B;oBACtC,oFAAoF;oBACpF,sFAAsF;oBACtF,iFAAiF;oBACjF,6EAA6E;oBAC7E,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;oBAClC,QAAQ,EAAE,cAAc,QAAQ,CAAC,GAAG,CAAC,oBAAoB;iBAC1D,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,oFAAoF;gBACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,qEAAqE,EAAE,CAAC;YAC/H,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACpC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa;aACnG,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,SAAS,OAAO,CAAC,CAAS,EAAE,SAA0B,EAAE,OAAe,EAAE,YAAqB;YAC5F,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAa,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;YACxF,IAAI,CAAC,sBAAsB;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAc,EAAE,CAAC;YACzE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC,IAAI,CAC/C,GAAG,EAAE;gBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAClF,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;YAC7C,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;gBACf,sFAAsF;gBACtF,sDAAsD;gBACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBACvC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;gBAChF,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAE,KAAc;oBACvB,OAAO,EAAE,wBAAwB;oBACjC,QAAQ,EACN,qFAAqF;wBACrF,qDAAqD,KAAK,EAAE;iBAC/D,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAS,EAAE;QAChB,IAAI,CAAC;YAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC;YAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACzD,WAAW,GAAG,SAAS,CAAC;QACxB,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/held-content.d.ts

@@ -1,145 +0,0 @@
-/**
- * CELLO Daemon — CONTENT WE HAVE BUT CANNOT SHOW YET
- *
- * Split out of `session-node-manager.ts` by 037-SESSIONCORE. A message that arrives out of order is
- * verified and kept, not delivered: showing it would put the conversation in the wrong sequence, and
- * dropping it would lose a message the sender believes landed. It is HELD until the gap ahead of it
- * closes, then released down the path it came from.
- *
- * Moved verbatim, comments included.
- *
- * ⚠️ `origin` DECIDES THE RELEASE PATH, AND GETTING IT WRONG IS NOT COSMETIC. A held frame of OUR OWN
- * must be released down the SENT path — appended and transcribed as sent. Releasing it down the
- * received path would put our own words in the counterparty's mouth in the sealed record, and hand
- * them back to our own agent through `cello_receive` as though they had just arrived.
- */
-import type { Logger } from "./types.js";
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { SessionQueries } from "./session-queries.js";
-import type { SessionRecords } from "./session-records.js";
-import type { SessionTree, WritableSessionTreeLeafKind } from "./session-tree.js";
-import type { SentAuthorship } from "./session-node-types.js";
-/**
- * One piece of content held behind an ordering gap.
- *
- * Exported because the content pipeline shares the very same map — see the note on `heldContent`
- * below. Two files spelling one shape out separately is how they stop agreeing.
- */
-export type HeldEntry = {
-    content: Uint8Array;
-    originalContent?: Uint8Array;
-    contentHashHex: string;
-    correlationId?: string;
-    screenedOut?: boolean;
-    origin?: "sent";
-    kind?: WritableSessionTreeLeafKind;
-    authorship?: SentAuthorship;
-    restoredAcrossRestart?: boolean;
-};
-/** What held content needs from the manager. */
-export interface HeldContentContext {
-    readonly logger: Logger;
-    readonly queries: SessionQueries;
-    readonly records: SessionRecords;
-    /** A function: the manager opens its database after construction. Re-exposed below as `#db`. */
-    db(): DaemonDatabase | null;
-    sessionKey(agentName: string, sessionId: string): string;
-    requireAgentId(agentName: string): string;
-    /**
-     * ⚠️ THE HELD MAP ITSELF, shared by reference rather than owned here — `ingestReceivedContent`,
-     * `placeOwnLeaf`, `sealReadiness` and `getUndeliverableSeqs` all read it and all stayed behind.
-     * Splitting the map would have meant two sources of truth for "what are we holding", which is
-     * worse than sharing one. It is only ever ASSIGNED once, at construction, so there is one Map
-     * object and no two-writer divergence.
-     */
-    readonly heldContent: Map<string, Map<number, HeldEntry>>;
-    readonly witnessedSeq: Map<string, Map<string, number>>;
-    getSessionTree(agentName: string, sessionId: string): SessionTree;
-    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
-        leafIndex: number;
-        newRootHex: string;
-    };
-    appendVerifiedContent(agentName: string, sessionId: string, content: Uint8Array, contentHashHex: string, senderPubkey: string, correlationId?: string, originalContent?: Uint8Array, verifiedAuthorship?: {
-        senderPubkey: Uint8Array;
-        senderSig: Uint8Array;
-    }): {
-        leafIndex: number;
-    };
-}
-export declare class HeldContent {
-    #private;
-    constructor(ctx: HeldContentContext);
-    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
-     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
-     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
-     *  exceeding it once #releaseHeld drains them. */
-    getHeldBytesTotal(agentName: string, sessionId: string): number;
-    /**
-     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
-     *
-     * Called when a session node is (re)created, which is the moment the session becomes able to
-     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
-     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
-     *
-     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
-     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
-     * the two counters are different spaces and this file documents them drifting, so the index
-     * comparison alone would destroy a frame the tree never held. See the drift branch below.
-     */
-    ensureHeldRestored(agentName: string, sessionId: string, opts?: {
-        release?: boolean;
-    }): void;
-    restoreHeldContent(agentName: string, sessionId: string): void;
-    /**
-     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
-     * held entry whose canonical sequence equals the new next-expected index is now in order — append
-     * it, then check again (a single fill can release a run of consecutive held messages).
-     */
-    releaseHeld(agentName: string, sessionId: string, senderPubkey: string): number;
-    /**
-     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
-     *
-     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
-     * exists on this side and is not in the tree, while the counterparty already has it from the relay
-     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
-     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
-     * it.
-     */
-    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
-    /**
-     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
-     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
-     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
-     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
-     * verbatim rather than dropping a sentence that is true of SOMETHING.
-     *
-     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
-     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
-     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
-     * identified, or reattach it then.
-     */
-    /**
-     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
-     *
-     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
-     * join that chain (appending behind a committed root is not an option, and ingest refuses a
-     * terminal session outright), but it is still the operator's mail and no other copy exists —
-     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
-     * content that arrives for an ended session; this is the same content arriving slightly earlier.
-     *
-     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
-     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
-     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
-     */
-    annexHeldContentOnTerminal(agentName: string, sessionId: string, status: "sealed" | "abandoned"): void;
-    /**
-     * Forget the restore/release bookkeeping for a torn-down session.
-     *
-     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
-     * owns that line. What goes is this module's memory of whether a session was already hydrated from
-     * disk and already released, which must not survive a teardown: a revived session has to re-read
-     * from durable state rather than trust a flag about a process that is gone.
-     */
-    evictSession(agentName: string, sessionId: string): void;
-}
-//# sourceMappingURL=held-content.d.ts.map

package/dist/held-content.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"held-content.d.ts","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,CAAC,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAClG,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACxG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,gGAAgG;IAChG,EAAE,IAAI,cAAc,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,2BAA2B,EACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,UAAU,EAC5B,kBAAkB,CAAC,EAAE;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GACvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAED,qBAAa,WAAW;;gBAGV,GAAG,EAAE,kBAAkB;IAWnC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAW/D;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA8B5F,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAsG9D;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAuF/E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAM5G;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI;IAkDtG;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAKzD"}