@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/trust-signal-store.d.ts

@@ -0,0 +1,406 @@
+/**
+ * M10 / DOD-STORE-CLIENT-1 — the daemon's two trust-signal tables.
+ *
+ * TWO tables, never one with a role flag (M10-D4). They answer different questions and obey
+ * different scoping rules, and a single table with a `role` column is how one set of rules ends up
+ * applied to the other's rows.
+ *
+ *   `wallet_trust_signals`  — signals ABOUT this daemon's agents, held so they can be PRESENTED.
+ *   `contact_trust_signals` — signals OTHER agents PRESENTED TO one of my agents.
+ *
+ * THE WALLET CARRIES NO AGENT ASSOCIATION (M10-D14). PK = `signal_hash`; one row per signal per
+ * daemon, and nothing more. It is the envelope's own HASHED `subject_kind`/`subject` that decides
+ * who may present it, evaluated at presentation time — not a local attribution decided at delivery
+ * time. That is the whole point: an account-subject signal (phone, email) serves every agent under
+ * the account, so **adding an agent to an existing daemon is ZERO signal work** — no assignment
+ * sweep, no re-attribution at renewal, no copies to keep in step at expiry. A per-agent column
+ * would quietly reintroduce every one of those chores.
+ *
+ * THE RECEIVED STORE IS PER-AGENT, AND THE DATABASE ENFORCES IT (INV-AGENT-SCOPED). Consent is
+ * genuinely per-agent here: a signal Bob showed to my agent `alice` must be invisible to my agent
+ * `bob` on the same daemon. `agent_id` is NOT NULL and the row hangs off a contact row by composite
+ * FK, so an unscoped row cannot be written at all — as opposed to being merely discouraged by a
+ * query convention that every future caller must remember. (This requires `PRAGMA foreign_keys = ON`,
+ * set at open in sqlcipher-db.ts — M10-D19. Without it the FK is decorative.) This is where the M8
+ * scaffold's `agent_id = null` defect dies.
+ *
+ * EVIDENCE, NOT AN INPUT (M10-D4 / INV-STATELESS-RECIPIENT). Received rows are re-checkable evidence
+ * of what was presented and when we verified it. They are NEVER an input to policy evaluation, which
+ * consumes only the currently-presented set, and they are never trusted for freshness (that is
+ * re-checked on use). This module therefore exposes no "is this contact trusted?" read — the absence
+ * is deliberate and structural. Do not add one.
+ *
+ * OPAQUE THROUGHOUT (INV-ZERO-BUMP / INV-TYPE-CARRY). `type` is a TEXT column with no CHECK, no
+ * enum, and no index predicated on a type value; `payload` is a BLOB that is never parsed and whose
+ * fields are never hoisted into columns. A type string this code has never seen stores, reads, and
+ * presents exactly like a known one. Adding a signal type must require no change to this file.
+ */
+import { type TrustSignalEnvelope } from "@cello-protocol/protocol-types";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import { type ConsentState } from "./consent-migration.js";
+import type { Logger } from "./types.js";
+/** Status lives OUTSIDE the hash — it is mutable after minting, which is exactly why it is not in
+ *  the preimage. If it were hashed, revoking a signal would change its hash and the directory could
+ *  never find it again. */
+export type SignalStatus = "active" | "revoked" | "superseded";
+/**
+ * A delivery the holder REFUSED at its own chokepoint. A TYPED error so the delivery consumer (the M8
+ * retirement's `inbound-sessions` re-point) can branch on it: a refused delivery must NEVER be ACKed
+ * — the directory should re-deliver, or the operator investigate. A plain `Error` swallowed by a
+ * best-effort `catch { return }` could accidentally fall through to an ACK; this cannot.
+ */
+export type SignalDeliveryRejection = "claimed_hash_malformed" | "hash_mismatch";
+export declare class SignalDeliveryRejected extends Error {
+    readonly reason: SignalDeliveryRejection;
+    constructor(reason: SignalDeliveryRejection, detail: string);
+}
+/** The envelope, as this store takes and returns it. Mirrors `TrustSignalEnvelope` in
+ *  protocol-types, plus the two non-hashed local columns. */
+export interface WalletSignalInput {
+    signalHash: string;
+    subjectKind: "account" | "agent";
+    subject: string;
+    issuerKind: "portal" | "agent";
+    issuerPubkey: string;
+    /** OPAQUE. Never gated on, never enumerated. */
+    type: string;
+    schemaVersion: number;
+    /** OPAQUE bytes. Never parsed. */
+    payload: Uint8Array;
+    issuedAt: number;
+    expiresAt: number | null;
+    supersedesHash: string | null;
+    status: SignalStatus | string;
+    /** Whether this signal is included in the default presentation bundle. When absent, derived from type suffix. */
+    defaultPresent?: boolean;
+    /** Envelope slot 12 (policy D-29). Defaults false — absent means "not co-owned", never "unknown". */
+    sameOperator?: boolean;
+}
+export interface WalletSignalRow extends WalletSignalInput {
+    receivedAt: number;
+    /** M10B-D14r2 — may this be presented at all. Distinct from `defaultPresent`, which answers the
+     *  different question of whether to include it BY DEFAULT once it may be presented.
+     *
+     *  NULLABLE, because the COLUMN is (SQLite cannot ADD COLUMN NOT NULL without a default). Declaring
+     *  it non-null would be a type that lies to every future consumer — and the consumer who then
+     *  writes `!== "refused"` ships a NULL straight through as presentable. The predicate tests for
+     *  exactly `accepted`, so NULL fails closed; the type must say so too. */
+    consentState: ConsentState | null;
+    /** Envelope slot 12: issuer and subject are the same operator (policy D-29). */
+    sameOperator: boolean;
+    /** True = included in the default presentation bundle. _id signals default false; everything else true. */
+    defaultPresent: boolean;
+}
+/**
+ * A signal a contact PRESENTED to one of my agents, as it is stored after verification.
+ *
+ * ⚠️ NOTE WHAT IS ABSENT: there is no `status` field, and this type deliberately does NOT extend
+ * `WalletSignalInput`.
+ *
+ * `status` is outside the hash preimage — that is what makes it mutable, and it also means it is
+ * **NOT AUTHENTICATED BY THE SIGNAL HASH**. A presenter can claim any status they like. If this type
+ * simply extended the wallet's, the peer's claimed `status` would ride in the same struct as the
+ * envelope fields and the natural call site would pass it straight through to the database.
+ *
+ * The attack that permits: Bob presents signal H; we verify it, find it REVOKED at the directory,
+ * and store that as evidence. Next session Bob re-presents the same hash claiming `status: active`.
+ * An upsert on the peer's value overwrites the one durable record that says we caught it — the party
+ * a revocation indicts gets to erase the indictment. Evidence an adversary can rewrite is not
+ * evidence.
+ *
+ * So the stored status is OUR verification verdict (`verdict`), produced by the verification seam
+ * (DOD-VERIFY-1) from what the DIRECTORY said — never a field the peer controls. Removing `status`
+ * from the input type makes that structural: there is no pass-through to forget to block.
+ */
+export interface ReceivedSignalInput extends Omit<WalletSignalInput, "status"> {
+    agentId: string;
+    contactPubkey: string;
+    verifiedAt: number;
+    /** OUR verdict from re-checking the directory — never the presenter's claim. */
+    verdict: SignalStatus;
+}
+/**
+ * The submission verbs. Mirrors protocol-types' `SubmissionOp` without importing it into storage.
+ *
+ * MIRRORED, SO IT DRIFTS. Widening `SubmissionOp` and not this one is a type error at the call
+ * site rather than a silent divergence — which is how `revoke` was caught. Keep them in step.
+ */
+export type SubmissionOpName = "submit" | "withdraw" | "refuse" | "revoke";
+export interface IssuedSubmissionInput {
+    agentId: string;
+    /** Content-derived sha256 of the signed body (`M10B-D20`) — the handle a withdrawal names. */
+    submissionId: string;
+    subjectPubkey: string;
+    op: SubmissionOpName;
+    intakeKeyId: string;
+    /** What the accepting node said: false = it already held this id. */
+    stored: boolean;
+}
+export interface IssuedSubmissionRow extends IssuedSubmissionInput {
+    submittedAt: number;
+}
+export interface ReceivedSignalRow extends ReceivedSignalInput {
+    receivedAt: number;
+}
+export declare function ensureTrustSignalSchema(db: DaemonDatabase, _logger: Logger): void;
+export declare class TrustSignalStore {
+    #private;
+    /**
+     * Does NOT create the schema. `SessionNodeManager.initialize()` owns it, and must — the received
+     * table's FK parent is `contacts`, which that init creates. A store that created its own schema
+     * would happily build `contact_trust_signals` on any handle lacking `contacts`, producing a
+     * dangling FK that then fails on the first INSERT with `no such table: main.contacts` — an error
+     * that names the wrong subsystem, at the wrong time, far from the cause.
+     */
+    constructor(db: DaemonDatabase, logger: Logger);
+    /**
+     * Store a signal this daemon holds about one of its agents.
+     *
+     * `INSERT OR IGNORE`, and that is a correctness property, not a convenience: the row is keyed by
+     * its own content hash, so a second delivery of the same hash is by definition the same signal.
+     * If the bytes really differed, the hash would differ. A differing payload under an identical hash
+     * is therefore a liar, and it must not overwrite the truth. This is also what makes duplicate
+     * delivery a no-op and wallet rows safely mergeable across a user's daemons (spec §14.11).
+     */
+    /** Returns true iff a NEW row was inserted (false = the content-addressed row already existed, a
+     *  benign duplicate). */
+    putWalletSignal(s: WalletSignalInput): boolean;
+    /**
+     * Accept a trust-signal envelope delivered to this holder: RE-VERIFY its hash, then store it.
+     *
+     * This is the holder's own chokepoint (INV-CANONICAL / M10-D4): the daemon does not trust the
+     * `claimedHash` the delivery frame carried — it re-derives the hash from the envelope with the SAME
+     * canonical component every party uses, and REFUSES a mismatch. A delivered envelope whose bytes do
+     * not hash to the claim is a corrupted or tampered delivery; storing it would let the wallet present
+     * a signal the directory never notarized.
+     *
+     * Storage is idempotent (content-addressed PK) — a re-delivery is a no-op (§14.11). Returns whether
+     * a new row was stored, so the caller can ACK only a genuinely-accepted delivery.
+     */
+    deliverWalletSignal(envelope: TrustSignalEnvelope, claimedHash: string): {
+        stored: boolean;
+    };
+    getWalletSignal(signalHash: string): WalletSignalRow | null;
+    /**
+     * Status is the ONE mutable field — it lives outside the hash precisely so this is possible.
+     *
+     * REVOCATION IS TERMINAL. A revoked signal can never go back to `active`. Without that guard this
+     * is a blind UPDATE, and a stale or replayed directory read reporting `active` for a hash we
+     * already revoked would resurrect it — and `listPresentable` would start offering it again. The
+     * directory is the authority on revocation, but a LATE answer from it is not a NEW answer; the
+     * monotonic rule makes out-of-order responses harmless instead of dangerous.
+     *
+     * `superseded` may still be overtaken by `revoked` (a superseded signal can also be revoked), but
+     * never the reverse, and never back to `active`.
+     */
+    setWalletStatus(signalHash: string, status: SignalStatus): void;
+    /**
+     * The signals an agent may present, resolved from the ENVELOPE, not from a stored attribution:
+     * an `account`-subject row is presentable by every agent under `accountId`; an `agent`-subject row
+     * only by its own subject (M10-D5/M10-D14).
+     *
+     * **`agentPubkeyHex` is the K_local pubkey hex, NOT the daemon's device-local `agent_id`.** An
+     * agent-subject envelope's `subject` holds the pubkey — that is the value the directory joins on
+     * (`ap.k_local_pubkey = sr.subject`) — and a UUID compared against it matches nothing at all.
+     *
+     * NOTE (`DOD-END-SCOPE-FIX-1`): this method has no production callers; the live wire path is
+     * `listAllActive`, which now carries the agent-subject half of this scoping. Kept because it is
+     * the only implementation of the ACCOUNT-subject half, which is deferred behind a named
+     * prerequisite — the daemon holds no `accountId` anywhere in production code.
+     *
+     * Excludes expired and non-active rows. Selective disclosure (all / some / none) is the CALLER's
+     * choice on top of this — DOD-PRESENT-1; this returns what is *eligible*, never what to send.
+     */
+    listPresentable(opts: {
+        agentPubkeyHex: string;
+        accountId: string;
+        nowSec?: number;
+    }): WalletSignalRow[];
+    /**
+     * All wallet signals regardless of status — for operator inspection via `cello trust-signals list`.
+     * Ordered by issued_at DESC so the most recent signal of each type appears first.
+     */
+    listAllWalletSignals(): WalletSignalRow[];
+    /**
+     * Look up a wallet signal by hash prefix (minimum 8 chars). Returns the unique matching signal,
+     * or null if no match, or throws if the prefix is ambiguous (multiple matches).
+     */
+    getWalletSignalByPrefix(prefix: string): WalletSignalRow | null;
+    /**
+     * Hard-delete a wallet signal by hash (GDPR removal). Returns true if a row was deleted.
+     *
+     * This is a permanent DELETE, not a status transition. Revocation is directory-driven and leaves
+     * the row for audit; this is the operator exercising their own right to remove a signal from their
+     * own device with no directory involvement.
+     */
+    removeWalletSignal(signalHash: string): boolean;
+    /**
+     * Active, non-expired wallet signals THIS agent is eligible to present — the live wire path
+     * (`outbound-sessions.ts`).
+     *
+     * `presentingAgentPubkeyHex` is the presenting agent's K_local pubkey hex, and it is REQUIRED.
+     * An `agent`-subject row is presentable only by its own subject (M10-D5/M10-D14); the wallet is
+     * daemon-wide and shared by every agent on the device, so without this predicate each agent
+     * offers every co-resident agent's agent-subject signals to its own counterparties —
+     * `INV-AGENT-SCOPED`, which is what `DOD-END-SCOPE-FIX-1` closes. The scoping is in the SQL, not
+     * a JS filter, because `include` already routes around `default_present` and a JS branch would
+     * route around this the same way.
+     *
+     * **`lower(subject)`, because hex has a case and this comparison is byte-exact.** SQLite `TEXT`
+     * uses BINARY collation, so `AABB…` and `aabb…` — the same key — do not match, and the row would
+     * be silently un-presented with no error. The daemon's own `k_local_pubkey` is always lowercase
+     * (`agent-loader.ts` derives it with `.toString("hex")`), so only the STORED side can vary, and it
+     * can: `putWalletSignal` already names "a directory version-skew emitting uppercase hex" as a real
+     * condition. Comparing case-insensitively is the correct equality for hex, not a fallback that
+     * papers over a mismatch.
+     *
+     * Note the residual, because it is NOT closed here — it is `DOD-M15-HEXCASE-MINT-1`: the directory's
+     * `JOIN agent_profiles ap ON ap.k_local_pubkey = sr.subject` is case-sensitive too, so an
+     * uppercase-hex subject that ever got minted would still be invisible THERE. Closing that means
+     * constraining the value where it is produced (the portal's mint) — which spans three components
+     * and is its own decision, not something to smuggle into a presentation-scoping unit.
+     *
+     * **ACCOUNT-subject rows are deliberately NOT scoped here, and that half is deferred, not done.**
+     * `listPresentable` scopes them on `accountId` — but the daemon holds no `accountId` anywhere in
+     * production code, so there is nothing to compare against and inventing one is a separate
+     * decision (M10B fourth review F5). Today's behavior for account rows is therefore unchanged:
+     * every agent on the daemon may present them, which is also what M10-D5 says for agents under the
+     * same account. It becomes wrong only when one daemon holds agents of two different accounts,
+     * and that trigger is the whole of `DOD-M15-ACCOUNT-SCOPE-1` — which is where this gets closed,
+     * not by inventing a daemon-side `accountId` to satisfy the predicate.
+     *
+     * Default behavior: returns only signals where `default_present = 1`.
+     * `include` overrides the default — only the listed types are returned regardless of `default_present`.
+     * `exclude` removes types from the default set.
+     * Both `include` and `exclude` are type strings. Unknown types cause a validation error at the
+     * IPC layer (the caller must pre-validate against listAllWalletSignals before calling this).
+     */
+    listAllActive(opts: {
+        presentingAgentPubkeyHex: string;
+        nowSec?: number;
+        include?: string[];
+        exclude?: string[];
+    }): WalletSignalRow[];
+    /**
+     * The distinct signal TYPES this agent could present — active, unexpired, and scoped to the
+     * presenting agent exactly as `listAllActive` scopes rows.
+     *
+     * Deliberately ignores `default_present`, because this answers "may this type be named in a
+     * filter", and `include` exists precisely to override the default. Validating a filter against
+     * `listAllActive`'s output would reject a type the operator holds but has defaulted off — the
+     * filter rejecting the thing it was built to select.
+     *
+     * The scoping is the point: the wallet is daemon-wide, so validating a filter against the whole
+     * wallet accepts a type only a CO-RESIDENT agent holds, and the session then presents nothing with
+     * no error (review MEDIUM-4).
+     */
+    listPresentableTypes(presentingAgentPubkeyHex: string, nowSec?: number): string[];
+    /**
+     * Record the subject's consent decision (D-23). The ONLY writer of this column after insert.
+     *
+     * `refused` is terminal in spirit but not enforced as one-way here: `M10B-D4` allows Bob to issue a
+     * CORRECTED endorsement after a refusal, and that is a NEW signal with its own hash — it does not
+     * reuse this row. What must never happen is a refusal being silently undone, which is why the
+     * migration is birth-gated rather than NULL-driven.
+     */
+    setConsentState(signalHash: string, state: ConsentState): boolean;
+    /**
+     * DOD-END-PENDING-1 — the decisions this agent still owes (`M10B-D5`).
+     *
+     * Its OWN surface, deliberately not the transcript inbox: an inbox item is cleared by reading or
+     * dismissing a transcript, and an endorsement awaiting consent has no transcript, so it would be an
+     * item the operator could never clear the normal way.
+     *
+     * Keyed by CONSENT STATE, never by type — that is what makes a whole new queue legal under
+     * INV-ZEROBUMP, and it is why a future client-sourced type appears here with no code change.
+     *
+     * SCOPING, STATED HONESTLY. Agent-subject items are scoped to their subject, on the same axis as
+     * presentation (DOD-END-SCOPE-FIX-1). ACCOUNT-subject items are visible to every agent on the
+     * daemon — the same deferred residual `listAllActive` carries, because the daemon holds no
+     * `accountId` anywhere in production code and per M10-D5 account signals serve every agent under
+     * the account.
+     *
+     * ⚠️ BUT THE RESIDUAL CHANGES CHARACTER HERE, and that is worth naming rather than inheriting
+     * silently: in `listAllActive` the consequence is SHOWING the wrong signal; here it is DECIDING.
+     * Any agent on the daemon can accept an account-subject endorsement on another's behalf, and
+     * acceptance runs a destructive supersession. Nobody has ruled on whether account-subject consent
+     * should be per-agent or per-account — M10B-D9 says acceptance is recorded once per account-subject
+     * SIGNAL, which points at "any agent may decide", but it was written about the operator surface,
+     * not about authority. Recorded as an open question on `DOD-END-SURFACE-1` rather than settled by
+     * whichever predicate got copied first.
+     */
+    /**
+     * Find a consent item this agent may DECIDE ON — pending, or ALREADY ACCEPTED.
+     *
+     * Refusal used to be reachable only while an item was `pending`, so "I accepted this endorsement
+     * and now I want it gone" had no path at all. This widens it, and the widening is the whole point:
+     * a refused signal is inert everywhere it is checked, which is the mechanism for taking back
+     * something you previously agreed to show.
+     *
+     * ── `issuer_kind <> 'portal'` IS THE LOAD-BEARING CLAUSE, NOT A TIDY-UP ────────────────────────
+     * Refusal makes a signal inert. So widening refusal without this filter would hand every operator
+     * a back door to suppressing their own MANDATORY signals — refuse your `track_record` and it stops
+     * being presented, achieving by consent exactly what revocation is forbidden from doing. The
+     * behavioural record is portal-issued; peer-claimed attestations are not. That is the axis, and it
+     * is the same one the DIRECTORY uses (`issuer_kind`), rather than a list of type names the client
+     * would have to keep in step.
+     *
+     * Deliberately NOT filtered by type: a hostile peer can issue a signal it CALLS `track_record`, and
+     * refusing a stranger's claim about you is precisely what this is for. The mandatory rule protects
+     * the portal's behavioural record, never a third party's assertion.
+     *
+     * Same agent-scoping predicate as `listPendingConsent` — including its unresolved question about
+     * who may decide for an account-subject item. Copied rather than diverged: two different answers to
+     * "may this agent decide" would be worse than one unresolved answer.
+     */
+    findDecidableConsent(agentPubkeyHex: string, prefix: string): WalletSignalRow | null;
+    listPendingConsent(agentPubkeyHex: string): WalletSignalRow[];
+    /**
+     * How many pending decisions this agent has NOT yet been told about.
+     *
+     * Asked on every agent selection, so it must go quiet once the operator has been told — while the
+     * ITEM stays in `listPendingConsent` until they actually decide. A new arrival raises it again,
+     * because the silence is per-item and not a permanent "already notified" flag on the agent.
+     */
+    countUnnotifiedConsent(agentPubkeyHex: string): number;
+    /** Record that the operator has been told about this agent's currently-pending decisions. */
+    markConsentNotified(agentPubkeyHex: string): number;
+    /** Set the persistent default-presentation flag for a wallet signal. */
+    setDefaultPresent(signalHash: string, value: boolean): boolean;
+    /**
+     * Store a signal a contact PRESENTED to one of my agents, after it was verified.
+     *
+     * The FK refuses a row for a contact that does not exist — an unscoped received signal is not
+     * merely discouraged, it is unwritable. `verified_at` is RE-STAMPED on re-presentation: it records
+     * when WE last re-verified, and a stale value that looked fresh would be worse than no value at
+     * all (freshness is re-checked on use — M10-D4).
+     */
+    /**
+     * Record a submission THIS daemon sent. Idempotent on (agent_id, submission_id): the id is
+     * content-derived, so a safe re-submit is the SAME row rather than a second one — which is what
+     * makes "re-sending is safe" true at this layer too, not just at the directory's.
+     *
+     * `stored` is UPDATED on conflict, and that direction is deliberate: a retry that finally lands as
+     * newly-stored should not keep reporting the earlier duplicate answer.
+     */
+    recordIssuedSubmission(s: IssuedSubmissionInput): void;
+    /** What this agent has submitted, newest first. No body — see the table comment. */
+    listIssuedSubmissions(agentId: string): IssuedSubmissionRow[];
+    putReceivedSignal(s: ReceivedSignalInput): void;
+    /**
+     * Mark a received signal as superseded. Same monotonic rules as setWalletStatus: revoked wins,
+     * and a superseded signal never goes back to active.
+     */
+    setReceivedStatus(opts: {
+        agentId: string;
+        contactPubkey: string;
+        signalHash: string;
+        status: SignalStatus;
+    }): void;
+    /** Evidence only. Never an input to policy — see the header. */
+    listReceived(opts: {
+        agentId: string;
+        contactPubkey: string;
+    }): ReceivedSignalRow[];
+}
+//# sourceMappingURL=trust-signal-store.d.ts.map

package/dist/trust-signal-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-signal-store.d.ts","sourceRoot":"","sources":["../src/trust-signal-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAkD,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC;;2BAE2B;AAC3B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,GAAG,eAAe,CAAC;AACjF,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB;gBAA/B,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM;CAIrE;AAED;6DAC6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC;IAC9B,iHAAiH;IACjH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qGAAqG;IACrG,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;8EAM0E;IAC1E,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAClC,gFAAgF;IAChF,YAAY,EAAE,OAAO,CAAC;IACtB,2GAA2G;IAC3G,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3E,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,EAAE,EAAE,gBAAgB,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAwHD,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA8DjF;AAyFD,qBAAa,gBAAgB;;IAI3B;;;;;;OAMG;gBACS,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAK9C;;;;;;;;OAQG;IACH;6BACyB;IACzB,eAAe,CAAC,CAAC,EAAE,iBAAiB,GAAG,OAAO;IAsC9C;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE;IAiH5F,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAO3D;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI;IA0B/D;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,eAAe,EAAE;IAsBxG;;;OAGG;IACH,oBAAoB,IAAI,eAAe,EAAE;IAOzC;;;OAGG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAY/D;;;;;;OAMG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAW/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,aAAa,CAAC,IAAI,EAAE;QAClB,wBAAwB,EAAE,MAAM,CAAC;QACjC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,GAAG,eAAe,EAAE;IAgCrB;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,wBAAwB,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE;IAcjF;;;;;;;OAOG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;IA+BjE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAiBpF,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,eAAe,EAAE;IAe7D;;;;;;OAMG;IACH,sBAAsB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAetD,6FAA6F;IAC7F,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAqBnD,wEAAwE;IACxE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO;IAW9D;;;;;;;OAOG;IACH;;;;;;;OAOG;IACH,sBAAsB,CAAC,CAAC,EAAE,qBAAqB,GAAG,IAAI;IActD,oFAAoF;IACpF,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAkB7D,iBAAiB,CAAC,CAAC,EAAE,mBAAmB,GAAG,IAAI;IAoC/C;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI;IAgBnH,gEAAgE;IAChE,YAAY,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,iBAAiB,EAAE;CAiBpF"}