@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/session-ceremony.d.ts

@@ -0,0 +1,297 @@
+/**
+ * Session-signing FROST ceremony participation — daemon side (DOD-SPINE-5, increment 3).
+ *
+ * When an initiator's `cello_initiate_session` reaches the directory, the directory
+ * FROST-signs the SessionAssignment by DELEGATING to the initiator: its
+ * `ClientDelegatedSigner.participateInCeremony` sends a `ceremony_request`
+ * {ceremony_id, tbs, context} over the initiator's authenticated signaling stream and
+ * awaits a `ceremony_result` {ceremony_id, signature}. The initiator (coordinator) runs
+ * the FROST ceremony with its share + the directory's K_server_X shares, and replies.
+ *
+ * This wires that handler onto a PER-AGENT signaling stream (the same per-agent routing used for
+ * registration).
+ *
+ * The threshold signer is reconstructed lazily from the agent's persisted
+ * `frost-share.json` (the daemon holds no FrostThresholdSigner after registration —
+ * the registration-time signer was on the disposed RegistrationContext).
+ */
+import { type LegibilityForHash } from "./seal-legibility-tbs.js";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { IThresholdSigner } from "@cello-protocol/crypto";
+import type { CelloNode } from "@cello-protocol/transport";
+import type { ConsortiumEndpoint } from "./directory-bootstrap.js";
+import type { DaemonRegistrationPersistence } from "./registration-persistence.js";
+import type { SignalingSeam } from "./registration-context.js";
+import type { Logger } from "./types.js";
+/**
+ * WIRE-002: answer the directory's `session_offer` on a per-agent signaling stream. When an
+ * initiator's session_request names this agent as the target, the directory sends a
+ * `session_offer {session_id}` before it builds the FROST-signed assignment; the agent must
+ * reply `session_offer_accept` advertising its SESSION endpoint (its standing receiver, which
+ * `acceptSession` reuses as the receiver-side session node) so the directory can fold the
+ * counterparty endpoint into the assignment and the initiator can reach it. Without this, the
+ * assignment carries an empty counterparty endpoint and content delivery can never connect.
+ */
+export declare function wireSessionOfferHandler(deps: {
+    agentName: string;
+    getStandingReceiverEndpoint: () => {
+        peerId: string;
+        addrs: string[];
+    } | null;
+    /**
+     * DOD-M15-ASSIGN-1: name the one peer allowed to dial this agent's standing receiver. Called
+     * with the offer's `initiator_session_peer_id` BEFORE the accept advertises our address, so the
+     * gate is already narrowed by the time anyone could know where to dial. Returns false when
+     * there is no receiver or the offer named nobody.
+     */
+    admitOfferedDialer: (initiatorSessionPeerId: string, sessionIdHex: string) => "narrowed" | "no_receiver" | "no_peer_named";
+    /**
+     * DOD-M15-RELAYONLY-1: is relay-only on for this agent? Optional, defaulting to FALSE, so every
+     * existing caller and test keeps its exact behaviour — the guard below must only fire when the
+     * setting is what emptied the address list, never when a receiver simply has none yet.
+     */
+    isRelayOnly?: () => boolean;
+    /**
+     * 055-ONDEMAND — **take a reservation on the relay the directory named, right now.**
+     *
+     * An idle agent holds none, so this is what gives it a circuit address to advertise in the
+     * accept. Resolves whether one was granted; a `false` is not fatal — the agent can still be
+     * reached directly, and relay-only is the one mode where it is not (see the guard below).
+     *
+     * ⚠️ **REQUIRED, AND IT WAS OPTIONAL — 056-SLOTDEAD, review F14.** "Optional, defaulting to a
+     * no-op, so every existing caller and test keeps its exact behaviour" is how it shipped, and the
+     * cost was not behaviour: it was that a fixture omitting this dep skipped the reserve ENTIRELY
+     * and still went green. The reserve is the capacity change — the one thing unit 3 exists to do —
+     * so a handler that never performed it passed the whole suite, and the next fixture written
+     * without the dep would have done the same thing silently. Required, the type checker names
+     * every caller that has to think about it, and there is no version of this handler that quietly
+     * does not reserve.
+     */
+    reserveOnDemand: (circuitAddr: string, sessionIdHex: string) => Promise<boolean>;
+    /**
+     * M16: is THIS agent a broadcast channel? A channel never holds a session, so it rejects the offer
+     * before taking a relay slot or advertising where it can be dialled. Required, so no caller can
+     * forget it (the lesson of `reserveOnDemand` above).
+     */
+    isChannelAgent: () => boolean;
+    signaling: SignalingSeam;
+    logger: Logger;
+}): () => void;
+export interface CeremonyWiringDeps {
+    agentName: string;
+    /**
+     * PERSIST-002: the agent's identity persistence (DB-backed) — the FROST share is loaded from the
+     * encrypted `agents` row, not a `frost-share.json` file.
+     */
+    persistence: DaemonRegistrationPersistence;
+    agentPubkeyHex: string;
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 2 — THE CO-SIGNING HALF, which the line calls the worst moment:
+     * *"your key signs a root you never checked."*
+     *
+     * Review F1: the first cut installed the root check only on the RECEIVING path
+     * (`seal-coordinator.ts`), and left this one — where this agent's FROST key actually endorses the
+     * root — untouched. A directory certifying a root over a different leaf set still got the
+     * initiator's signature on it, and the resulting artifact is durable, valid and non-repudiable.
+     * The receiving-side check then runs AFTER that signature already exists.
+     *
+     * Required, not optional: an unwired check here is the defect this bullet exists to close.
+     */
+    verifyCertifiedRoot: (agentPubkeyHex: string, sessionIdHex: string, certifiedRoot: Uint8Array, certifiedLeafCount: number, 
+    /** The request's own signed leaf set — used only when this side's carry cannot judge. */
+    evidence?: readonly unknown[]) => {
+        verdict: "match";
+    } | {
+        verdict: "mismatch";
+        ownRootHex: string | null;
+        detail: string;
+    } | {
+        verdict: "cannot_judge";
+        reason: string;
+    };
+    /**
+     * SEC-2: the agent's K_local signer — authenticates every FROST commit/sign request the ceremony
+     * sends to the directory (the directory verifies it against agentPubkeyHex before touching its share).
+     */
+    keyProvider: KeyProvider;
+    /** The agent's directory-connected libp2p node (the per-agent signaling node). */
+    getNode: () => CelloNode | null;
+    /** Resolve the directory endpoint to open FROST streams on (single-node / primary). */
+    getDirectoryEndpoint: () => Promise<{
+        peerId: string;
+        multiaddr?: string;
+    } | null>;
+    /**
+     * DOD-SIGN-1: resolve the FULL consortium directory-node roster from the verified manifest at
+     * ceremony time, or NULL when no consortium manifest is configured. A non-null roster ⇒ the
+     * threshold signer coordinates the FROST ceremony across ALL these nodes (T-of-N — it excludes
+     * a node that's down and reaches any T). Null ⇒ single-node (M6/M7 back-compat).
+     */
+    getConsortiumEndpoints: () => Promise<ConsortiumEndpoint[] | null>;
+    /** The agent's per-agent signaling seam (where ceremony_request arrives + result is sent). */
+    signaling: SignalingSeam;
+    logger: Logger;
+    /**
+     * DOD-M15-SEALPARTIES-1: leave a mark when the seal ceremony dies, so the answer outlives it.
+     *
+     * `if (!frostSignature) return;` was the whole handling of a ceremony that produced no signature
+     * — no log line, no record, nothing. Requiring the co-signing directories to judge the leaves adds
+     * a NEW way to land there (they refuse), and a refusal nobody hears is indistinguishable from the
+     * seal simply never happening. It also covers the paths that were already silent: a root this
+     * agent cannot confirm, an inflated frontier, a share it cannot load.
+     *
+     * REQUIRED rather than optional, deliberately: an optional sink is one a call site forgets, and
+     * the whole class of defect this unit is closing is a check that quietly stopped being wired.
+     */
+    recordSealFailure: (agentName: string, sessionId: string, reason: string, kind: "unresolved" | "refused") => void;
+}
+export declare function reconstructThresholdSigner(deps: CeremonyWiringDeps, 
+/**
+ * DOD-M15-SEALPARTIES-1: the signed leaves this ceremony's TBS is a root over, forwarded to every
+ * directory node so each reaches its own verdict instead of signing a claim. Supplied on the seal
+ * ceremony and on nothing else — a co-signer requires it under the seal context and ignores it
+ * everywhere else.
+ */
+sealEvidence?: import("./network-directory-node.js").SealCeremonyEvidence): Promise<IThresholdSigner | null>;
+/**
+ * M8B DOD-REFRESH-1: run a proactive share refresh for an already-registered agent. Rotates the client's
+ * + every directory node's share to the next epoch (group public key unchanged), then persists the
+ * client's new share as the active one so subsequent signing uses the new epoch and old-epoch shares die.
+ */
+export declare function runAgentRefresh(deps: CeremonyWiringDeps): Promise<{
+    ok: true;
+    toEpochN: number;
+    primaryPubkey: string;
+    verifyingSharesDigest: string;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Register a `ceremony_request` handler on the agent's signaling seam. On the directory's
+ * delegated-signing request, run the agent's threshold signer's participateInCeremony and
+ * reply with `ceremony_result`. The signer is reconstructed lazily and cached. Returns the
+ * unregister function. SI-001: tbs/signature never logged.
+ */
+/**
+ * DOD-SPINE-7: register a `seal_verified` handler on the agent's signaling seam. After the
+ * directory rebuilds + verifies the bilateral seal's signed Merkle chain (relay-mediated
+ * processSeal FROST path), it sends the SEAL INITIATOR a `seal_verified` {session_id,
+ * sealed_root, leaf_count, timestamp} and waits for the initiator to COORDINATE the seal FROST
+ * ceremony. This handler reconstructs the agent's threshold signer (same machinery as the
+ * session ceremony), runs participateInCeremony over buildSealTbs with context
+ * "cello-frost-seal-v1", and replies `seal_frost_signature` {session_id, frost_signature}. The
+ * directory's #processSealFrostSignature then completes notarization and delivers
+ * `session_sealed` (the byte-identical sealed_root) to both parties.
+ *
+ * SI-001: tbs/signature never logged.
+ */
+export declare function wireSealCeremonyHandler(deps: CeremonyWiringDeps): () => void;
+/**
+ * DOD-SENDRAW-1: deliver the co-signed seal FROST signature to the directory, branching on the
+ * seam's RESOLVED result. The production seam (transport SignalingManager.sendRaw) never throws —
+ * it resolves {ok:false, reason} on every failure — so the old try/catch logged `.sent` for a
+ * signature that never left the machine, inside the non-repudiation ceremony, and the failure
+ * event was unreachable. Exported so the send contract is testable without a live FROST ceremony.
+ */
+export declare function sendSealFrostSignature(deps: {
+    agentName: string;
+    signaling: SignalingSeam;
+    logger: Logger;
+}, sessionId: Uint8Array, sidHex: string, frostSignature: Uint8Array): Promise<void>;
+/**
+ * SESSION-002 (DOD-SEAL-3): verify a unilateral seal certificate WITHOUT trusting the
+ * channel. Rebuilds the canonical seal TBS from the cert fields and verifies the signature
+ * against a key trusted independently of the delivering frame: the session primary_pubkey
+ * (commitments[0] of this agent's FROST share) for 'frost'. A channel-swapped sealed_root
+ * (or any TBS-bound field) fails this check (SI-003).
+ *
+ * 'single' is not a second variant this function is missing — it is a DOWNGRADE, refused by name
+ * before a session exists (`assignment_signature_type_downgraded`, assignment-verify.ts, checked
+ * against the directory's only producer of `signature_type`). A cert carrying it is a shape no
+ * honest peer can produce, so the branch below refuses rather than verifying. Do not "finish" it
+ * by adding a manifest-key path: that would make the downgrade verifiable instead of refused,
+ * which is the outcome the upstream check exists to prevent.
+ */
+export declare function verifyUnilateralCertificate(deps: {
+    persistence: DaemonRegistrationPersistence;
+    agentPubkeyHex: string;
+    logger: Logger;
+}, cert: {
+    sessionId: Uint8Array;
+    sealedRoot: Uint8Array;
+    leafCount: number;
+    closeTimestamp: number;
+    frostSignature: Uint8Array;
+    signatureType: "frost" | "single";
+}): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * M7 legibility-TBS-binding: verify a BILATERAL session_sealed certificate's signature over the
+ * legibility-bound TBS, channel-independently.
+ *
+ * KEY STRUCTURE (why verifiability is asymmetric TODAY): the seal's FROST signature is produced by
+ * the group key (commitments[0] of the DKG share) of whichever party CLOSED THE SESSION FIRST — the
+ * directory designates the sender of the first SEAL ctrl leaf as the "seal initiator" and signs
+ * against that party's primary (directory-node.ts). This is NOT a fixed initiator/responder role:
+ * either the session initiator or the responder can be the first closer.
+ *
+ * A party can channel-independently verify here only against a group primary it HOLDS locally:
+ *  - its OWN primary — loaded from its own DKG share (`signer_pubkey === own primary`); or
+ *  - the counterparty's primary — recorded via recordCounterpartyPrimary (see below).
+ * It then verifies the FROST signature over `buildSealTbs ‖ legibilityHash`. A tampered legibility
+ * (answered / content_frontier_seq / attestation_mode — carried unsigned on the frame) changes the
+ * hash → the signature fails → REJECT.
+ *
+ * When the signer's key is NOT held locally, the party ACCEPTS (`verified:false`, with a `reason`).
+ * This is sound for the LIVE path: session_sealed arrives over the daemon↔directory libp2p Noise
+ * channel (authenticated + encrypted), so it is not MITM-tamperable in transit; the binding's
+ * primary value is OUT-OF-BAND (any holder of the signer's primary — e.g. an arbitrator — can verify
+ * an exported cert's legibility).
+ *
+ * SYMMETRY: both closing orders verify locally, and it takes BOTH bindings to stay that way. The
+ * initiator learns the responder's primary from `participant_b_primary_pubkey` with a binding
+ * signed by participant_b's own K_local, recorded by `initiate-session-handler.ts`; the responder
+ * learns the initiator's from `signer_pubkey` with `participant_a_key_binding`, verified before the
+ * assignment's threshold signature is checked at all and recorded by `inbound-sessions.ts`. Both
+ * are refused by name when absent or invalid (`assignment-verify.ts`).
+ *
+ * The binding, not the key, is the load-bearing part: carrying a group key alone would let a
+ * directory name one of its choosing, so a change that keeps either key and drops its binding
+ * breaks verification while appearing to work.
+ *
+ * `signer_key_not_held` is therefore NOT the ordinary responder-first outcome. It remains reachable
+ * for a session row that predates the recording, or one whose assignment never reached this path,
+ * and it is the honest answer there, which is why the branch stays.
+ *
+ * `legibility` MUST be the AS-RECEIVED wire object (not a normalised copy) — the directory signed
+ * over the canonical hash of exactly what it sent.
+ */
+export declare function verifyBilateralSealCertificate(deps: {
+    persistence: DaemonRegistrationPersistence;
+    agentPubkeyHex: string;
+    logger: Logger;
+    counterpartyPrimaryHex?: string | null;
+}, cert: {
+    sessionId: Uint8Array;
+    sealedRoot: Uint8Array;
+    leafCount: number;
+    closeTimestamp: number;
+    frostSignature: Uint8Array;
+    signerPubkey: Uint8Array;
+    signatureType: "frost" | "single";
+    legibility: LegibilityForHash | null;
+}): Promise<{
+    ok: true;
+    verified: boolean;
+    reason?: string;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export declare function wireSessionCeremonyHandler(deps: CeremonyWiringDeps): () => void;
+//# sourceMappingURL=session-ceremony.d.ts.map

package/dist/session-ceremony.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-ceremony.d.ts","sourceRoot":"","sources":["../src/session-ceremony.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B,EAAE,MAAM;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9E;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,sBAAsB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,GAAG,aAAa,GAAG,eAAe,CAAC;IAC3H;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,IAAI,CAmPb;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,6BAA6B,CAAC;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CACnB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,KAC1B;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7I;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,kFAAkF;IAClF,OAAO,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IAChC,uFAAuF;IACvF,oBAAoB,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACnF;;;;;OAKG;IACH,sBAAsB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,8FAA8F;IAC9F,SAAS,EAAE,aAAa,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,SAAS,KAAK,IAAI,CAAC;CACnH;AAwHD,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,kBAAkB;AACxB;;;;;GAKG;AACH,YAAY,CAAC,EAAE,OAAO,6BAA6B,EAAE,oBAAoB,GACxE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAQlC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6E/H;AAED;;;;;GAKG;AACH;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,IAAI,CA4N5E;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACrE,SAAS,EAAE,UAAU,EACrB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,WAAW,EAAE,6BAA6B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC5F,IAAI,EAAE;IACJ,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,UAAU,CAAC;IAC3B,aAAa,EAAE,OAAO,GAAG,QAAQ,CAAC;CACnC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAiCvD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE;IAAE,WAAW,EAAE,6BAA6B,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACpI,IAAI,EAAE;IACJ,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,UAAU,CAAC;IAC3B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACtC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmD3F;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,IAAI,CAwE/E"}