@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/consent-migration.js

@@ -0,0 +1,128 @@
+/**
+ * M10B / DOD-END-ACCEPT-1 — the `consent_state` column on `wallet_trust_signals` (`M10B-D14r2`).
+ *
+ * WHY THIS IS ITS OWN FILE AND NOT A LINE IN `ensureTrustSignalSchema`. That function runs on EVERY
+ * `startDaemon` and ends in a bare `catch {}` ("Column already exists — safe to ignore"). A consent
+ * migration written as a sibling `ALTER`/`UPDATE` in there would have its failures swallowed AND its
+ * backfill run unconditionally — so an operator who REFUSES an endorsement would have it flipped
+ * back to `accepted` on the next restart, silently, and it would become presentable again. The
+ * client DB has no migration versioning to catch that.
+ *
+ * So this follows the pattern the repo already proved for exactly this hazard
+ * (`contacts-tier-migration.ts`):
+ *   - a `PRAGMA table_info` COLUMN-BIRTH gate, so the one-time step is tied to the column being
+ *     created rather than to a NULL that could reappear later;
+ *   - NO column DEFAULT, so the backfill has a real discriminator — with a DEFAULT every existing
+ *     row gets a value the instant the column exists and the backfill matches nothing;
+ *   - the ALTER and the backfill in ONE transaction, so a crash between them cannot leave the
+ *     column present and the rows un-backfilled, which would skip the one-time step FOREVER;
+ *   - a RETHROW, because a migration that fails silently is a schema nobody can trust.
+ *
+ * DIRECTION OF THE BACKFILL — ENFORCED BY THE SQL, NOT BY AN ARGUMENT ABOUT THE PAST.
+ * Portal-issued rows become `accepted`: they were minted about the operator, for the operator, at
+ * their own action, so there was never a third party whose decision was pending, and making them
+ * `pending` would silently render every phone/email signal already in every wallet unpresentable —
+ * a data-loss-shaped bug that raises no error. Agent-issued rows become `pending`, because somebody
+ * else authored them.
+ *
+ * An earlier version backfilled everything to `accepted` on the reasoning that nothing agent-issued
+ * could exist yet. That was true only by RELEASE TIMING — the daemon has accepted
+ * `issuer_kind: agent` since M10 — so a dev or staging wallet that picked one up during M10B
+ * integration testing would have had it backfilled to presentable at boot, which is exactly the
+ * D-23 violation this file exists to prevent. Two WHERE clauses make it a property of the code.
+ *
+ * NEW rows are handled at the write path on the same axis: `putWalletSignal` inserts `pending` for
+ * `issuer_kind: agent` and `accepted` otherwise.
+ */
+import { extractErrorMessage } from "./error-message.js";
+/** Present-tense truth for the reader: this is what gates presentation. */
+export const CONSENT_ACCEPTED = "accepted";
+export function migrateWalletAddConsentState(db, logger) {
+    const columns = new Set(db.prepare("PRAGMA table_info(wallet_trust_signals)").all().map((c) => c.name));
+    // BIRTH GATE. Idempotent, and deliberately NOT "backfill wherever the value is NULL": a NULL that
+    // appears later is not a legacy row, and promoting it would be the clobber this file prevents.
+    //
+    // IT GATES ON BOTH COLUMNS, and gating on only `consent_state` was a real bug that shipped: every
+    // database that ran the previous release already had `consent_state`, so this returned here and
+    // `consent_notified_at` was NEVER ADDED on upgrade. Fresh installs got it, upgrades did not —
+    // exactly the fresh-vs-migrated divergence the suite has a test for, on a column that test did not
+    // cover. It stayed green because the partial-migration test asserted only NEGATIVES, which are
+    // satisfied by returning before any of the code under test runs.
+    if (columns.has("consent_state") && columns.has("consent_notified_at"))
+        return;
+    // BEGIN IMMEDIATE, not DEFERRED: a deferred transaction takes no write lock, so two daemons on one
+    // DB — a named real condition in this project — can both pass the gate above and the loser dies at
+    // boot on `duplicate column name`. It does not clobber, but it is a baffling crash. The lock also
+    // makes the re-read below meaningful.
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        // Re-read the gate under the lock: the PRAGMA above is a check-then-act outside any transaction.
+        const underLock = new Set(db.prepare("PRAGMA table_info(wallet_trust_signals)").all().map((c) => c.name));
+        // EACH COLUMN IS GATED INDEPENDENTLY. An earlier version added both under one gate keyed on
+        // `consent_state`, so a database holding one but not the other hit `duplicate column name`, the
+        // migration rethrew, and the daemon refused to start — a self-inflicted boot failure on a
+        // recoverable state. Caught by the legacy-backfill test, which constructs exactly that shape.
+        const needsConsent = !underLock.has("consent_state");
+        const needsNotified = !underLock.has("consent_notified_at");
+        if (!needsConsent && !needsNotified) {
+            db.exec("COMMIT");
+            return;
+        }
+        // No DEFAULT — see the header. The rows are given their value by the explicit backfill below.
+        if (needsConsent)
+            db.exec("ALTER TABLE wallet_trust_signals ADD COLUMN consent_state TEXT");
+        // DOD-END-PENDING-1 / M10B-D5 — the NOTIFICATION's lifetime, which is NOT the item's. The item
+        // persists until accepted or refused; the notification is raised once and stops once seen. One
+        // flag cannot carry both: a single seen-bit would either dismiss the pending decision (losing it)
+        // or re-fire on every agent selection (nagging). Two facts, two columns.
+        if (needsNotified)
+            db.exec("ALTER TABLE wallet_trust_signals ADD COLUMN consent_notified_at INTEGER");
+        if (!needsConsent) {
+            // The backfill belongs to consent_state's BIRTH. If only the notification column was missing,
+            // the rows already carry their consent and must not be re-judged — that is the clobber this
+            // file exists to prevent, and it would arrive by the back door of a partially-migrated schema.
+            db.exec("COMMIT");
+            logger.info("signal.consent.migrated", { backfilled: 0, added: "consent_notified_at" });
+            return;
+        }
+        // THE DIRECTION IS ENFORCED, NOT ARGUED (review F5). The header's reasoning — "everything
+        // predating this column is portal-issued" — is true TODAY only by release timing: the daemon has
+        // accepted `issuer_kind: agent` since M10, and a dev or staging wallet that picked one up during
+        // M10B integration testing would be backfilled straight to `accepted` and presentable, which is
+        // the D-23 violation this unit exists to prevent, silently, at boot. Two WHERE clauses make the
+        // claim a property of the code instead of a property of the calendar.
+        const acceptedRes = db
+            .prepare(`UPDATE wallet_trust_signals SET consent_state = '${CONSENT_ACCEPTED}' WHERE issuer_kind <> 'agent'`)
+            .run();
+        const pendingRes = db
+            .prepare("UPDATE wallet_trust_signals SET consent_state = 'pending' WHERE issuer_kind = 'agent'")
+            .run();
+        const res = { changes: Number(acceptedRes.changes) + Number(pendingRes.changes) };
+        db.exec("COMMIT");
+        logger.info("signal.consent.migrated", {
+            backfilled: res.changes,
+            accepted: Number(acceptedRes.changes),
+            pending: Number(pendingRes.changes),
+            reason: "portal-issued rows were minted for the operator at their own action; agent-issued rows need consent",
+        });
+    }
+    catch (err) {
+        // A FAILING ROLLBACK MUST NOT MASK THE REAL ERROR (review F6, and the pattern this file claims to
+        // follow guards it — `contacts-tier-migration.ts` — I copied the shape minus its most important
+        // two lines). SQLite auto-aborts the transaction on SQLITE_FULL/SQLITE_IOERR, so a bare ROLLBACK
+        // then throws "cannot rollback - no transaction is active" — BEFORE the log and BEFORE the
+        // rethrow. The operator gets a transaction-layer message for a full disk, and
+        // `signal.consent.migration_failed` never fires at all.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch { /* the failing statement may already have aborted the txn */ }
+        // RETHROW. A swallowed failure here leaves the daemon running against a schema it believes has
+        // consent and does not — which presents unconsented endorsements while every test passes.
+        logger.error("signal.consent.migration_failed", {
+            reason: extractErrorMessage(err),
+        });
+        throw err;
+    }
+}
+//# sourceMappingURL=consent-migration.js.map

package/dist/consent-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-migration.js","sourceRoot":"","sources":["../src/consent-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAUzD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,MAAM,UAAU,4BAA4B,CAAC,EAAkB,EAAE,MAAc;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5G,CAAC;IAEF,kGAAkG;IAClG,+FAA+F;IAC/F,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO;IAE/E,mGAAmG;IACnG,mGAAmG;IACnG,kGAAkG;IAClG,sCAAsC;IACtC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,iGAAiG;QACjG,MAAM,SAAS,GAAG,IAAI,GAAG,CACtB,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5G,CAAC;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,aAAa,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAEnE,8FAA8F;QAC9F,IAAI,YAAY;YAAE,EAAE,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,kGAAkG;QAClG,yEAAyE;QACzE,IAAI,aAAa;YAAE,EAAE,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAEtG,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,8FAA8F;YAC9F,4FAA4F;YAC5F,+FAA+F;YAC/F,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,0FAA0F;QAC1F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,gGAAgG;QAChG,sEAAsE;QACtE,MAAM,WAAW,GAAG,EAAE;aACnB,OAAO,CAAC,oDAAoD,gBAAgB,gCAAgC,CAAC;aAC7G,GAAG,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,EAAE;aAClB,OAAO,CAAC,uFAAuF,CAAC;aAChG,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,UAAU,EAAE,GAAG,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;YACrC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YACnC,MAAM,EAAE,qGAAqG;SAC9G,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,2FAA2F;QAC3F,8EAA8E;QAC9E,wDAAwD;QACxD,IAAI,CAAC;YAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QACnG,+FAA+F;QAC/F,0FAA0F;QAC1F,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/consortium-bootstrap.d.ts

@@ -0,0 +1,138 @@
+/**
+ * The startup consortium gate, and the routing it feeds.
+ *
+ * Two functions, and the split between them is the point:
+ *
+ *   1. verifyStartupManifest — loads and verifies the consortium manifest, checks its validity
+ *      window and anti-rollback, and resolves the verified node set to live directory endpoints.
+ *      It REPORTS what it found. It does NOT decide what to do about a failure.
+ *
+ *   2. createConsortiumRouting — builds the roster-aware failover resolver and starts the HTTP
+ *      manifest poll.
+ *
+ * They are separate because startDaemon must be able to REFUSE TO START between them (ADV-002:
+ * a configured manifestProvider that fails verification is fatal). That refusal has to close the
+ * DB and release the singleton lock — both owned by startDaemon, neither this module's business —
+ * and it must happen BEFORE the manifest poll starts, or a refused startup leaks a live timer.
+ * Fusing these into one call would either drag the lock in here or leak that timer.
+ */
+import type { Logger } from "./types.js";
+import type { ConsortiumManifest } from "@cello-protocol/protocol-types";
+import type { IManifestProvider, IManifestVersionStore, IManifestPollScheduler } from "@cello-protocol/transport";
+import type { DirectoryEndpoint } from "./signaling-connect.js";
+import { type NodeResolveFailure, type ConsortiumEndpoint } from "./directory-bootstrap.js";
+export interface ManifestGateDeps {
+    manifestProvider?: IManifestProvider;
+    manifestRootKeys?: readonly string[];
+    manifestThreshold?: number;
+    manifestVersionStore: IManifestVersionStore;
+    logger: Logger;
+    /** Injectable fetch, threaded to the /bootstrap probes. Defaults to global fetch. */
+    fetchFn?: typeof fetch;
+}
+export interface ManifestGateResult {
+    /** True only when a manifest was loaded, verified, in-window, and not a rollback. */
+    manifestVerified: boolean;
+    /** The verified manifest's version — 0 on the no-manifest back-compat path. */
+    verifiedManifestVersion: number;
+    /**
+     * The verified node set resolved to REACHABLE directory endpoints. May be shorter than the
+     * manifest's node list (a down node is skipped, not fatal — a T-of-N ceremony needs only T),
+     * and is empty on the back-compat path or when nothing resolved.
+     */
+    consortiumEndpoints: ConsortiumEndpoint[];
+    /**
+     * The VERIFIED manifest itself, or null on every path that did not verify one.
+     *
+     * Returned because a sealed submission needs the manifest's `intake_key` at request time, long
+     * after startup (M10B / DOD-END-SURFACE-1, the refusal-message carrier). Set ONLY alongside
+     * `manifestVerified = true`, so an unverified manifest can never reach a consumer: a sealing key
+     * read off an unverified manifest is a key an attacker chose, which would seal the operator's
+     * words to the attacker instead of the portal.
+     */
+    verifiedManifest: ConsortiumManifest | null;
+    /**
+     * WHICH nodes did not resolve, and why — the operator-facing counterpart to the count above.
+     *
+     * This sweep runs at boot, and for the failure it exists to describe that is the only sweep that
+     * has run when the operator first looks. It used to log `directory.consortium.partial` with a
+     * count and discard the detail, so `cello status` could say nothing at all while every session
+     * failed. That is the 2026-07-31 incident: `dns_error` in the log 26 times per node from startup,
+     * the operator shown `counterparty_offline` → `directory_below_threshold` → `ceremony_exhausted`,
+     * and an hour spent concluding the protocol was broken.
+     *
+     * Empty on every path that resolved nothing to complain about — including the back-compat path,
+     * where an empty list means "no sweep ran", not "all healthy". The status surface says which
+     * nodes failed rather than asserting all-good, for exactly that reason.
+     */
+    unresolvedNodes: NodeResolveFailure[];
+    /**
+     * When the sweep above ran (ISO), or null if none did.
+     *
+     * A reading with no timestamp asserts the PRESENT. On 2026-08-09 all three endpoints failed with
+     * ENETUNREACH — a real network blip on the operator's machine, gone within a minute — and the
+     * status block went on reporting "this daemon cannot resolve these directory endpoints" as a
+     * current fact long after it had recovered. True when taken, false when read.
+     */
+    unresolvedSweptAt: string | null;
+}
+/**
+ * Load + verify the manifest, then resolve its node set to live endpoints.
+ *
+ * Every failure is REPORTED (manifestVerified: false) and logged, never thrown — the caller owns
+ * the refuse-to-start decision, because only it can release what a refusal must release.
+ */
+export declare function verifyStartupManifest(deps: ManifestGateDeps): Promise<ManifestGateResult>;
+export interface ConsortiumRoutingDeps {
+    manifestProvider?: IManifestProvider;
+    manifestRootKeys?: readonly string[];
+    manifestThreshold?: number;
+    manifestVersionStore: IManifestVersionStore;
+    manifestPollScheduler?: IManifestPollScheduler;
+    directoryHttpUrl?: string;
+    directoryEndpointResolver?: () => Promise<DirectoryEndpoint | null>;
+    logger: Logger;
+    fetchFn?: typeof fetch;
+    /**
+     * What the startup sweep already found unresolvable, so the operator surface is populated from
+     * boot rather than from whenever the first ceremony happens to run. See the seeding note inside.
+     */
+    initialUnresolvedNodes?: readonly NodeResolveFailure[];
+    /** When that startup sweep ran, so the surface can say how old the reading is. */
+    initialUnresolvedSweptAt?: string | null;
+}
+export interface ConsortiumRouting {
+    /**
+     * The roster for a session/seal FROST ceremony, re-resolved at ceremony time from the CURRENT
+     * verified manifest. NULL (not []) when no manifest is configured — the difference is
+     * load-bearing: null means "single-node ceremony, M6/M7 back-compat"; [] means "a consortium
+     * whose nodes are all unreachable", which the ceremony layer must refuse.
+     */
+    resolveConsortiumRoster: () => Promise<ConsortiumEndpoint[] | null>;
+    /**
+     * Roster-aware failover over the injected primary resolver (FINDING-4, the bootstrap SPOF).
+     * ONE instance, so signaling and ceremonies share sticky state and fail over TOGETHER — they
+     * must not end up talking to two different directory nodes. Undefined on the in-process test
+     * path, where there is no primary resolver to wrap.
+     */
+    failoverEndpointResolver: (() => Promise<DirectoryEndpoint | null>) | undefined;
+    /**
+     * Which consortium nodes this daemon currently cannot resolve, and why.
+     *
+     * Exists so `cello status` can answer "can I actually reach the directory?" rather than only
+     * "is my signaling socket up?". Those differ: libp2p signaling dials multiaddrs from the bundled
+     * manifest and stays connected, so every agent reports online while anything needing the HTTP
+     * endpoint — the roster, and therefore every threshold ceremony — fails.
+     */
+    getUnresolvedNodes: () => NodeResolveFailure[];
+    /** When the reading getUnresolvedNodes returns was taken (ISO), or null if no sweep has run. */
+    getUnresolvedSweptAt: () => string | null;
+    /** Nodes the VERIFIED manifest declares — the denominator a threshold is computed from. */
+    getDeclaredNodeCount: () => number | null;
+    /** Null-safe accessor for the ceremony/handler getDirectoryEndpoint sites. */
+    getFailoverEndpoint: () => Promise<DirectoryEndpoint | null>;
+    /** Stops the daemon-level HTTP manifest poll. Undefined when no poll was started. */
+    stopHttpManifestPoll: (() => void) | undefined;
+}
+export declare function createConsortiumRouting(deps: ConsortiumRoutingDeps): ConsortiumRouting;
+//# sourceMappingURL=consortium-bootstrap.d.ts.map

package/dist/consortium-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-bootstrap.d.ts","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAGlC,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+EAA+E;IAC/E,uBAAuB,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,gBAAgB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC5C;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkI/F;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,qBAAqB,CAAC;IAC5C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACvD,kFAAkF;IAClF,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,wBAAwB,EAAE,CAAC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IAChF;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,kBAAkB,EAAE,CAAC;IAC/C,gGAAgG;IAChG,oBAAoB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,2FAA2F;IAC3F,oBAAoB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC1C,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAC7D,qFAAqF;IACrF,oBAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAyNtF"}

package/dist/consortium-bootstrap.js

@@ -0,0 +1,339 @@
+import { randomUUID } from "node:crypto";
+import { startHttpManifestPoll } from "./http-manifest-poll.js";
+import { classifyManifestValidity } from "./manifest-validity.js";
+import { resolveDirectoryUrl, manifestNodesToEndpoints, FAST_PROBE, createRosterAwareEndpointResolver, } from "./directory-bootstrap.js";
+import { extractErrorMessage } from "./error-message.js";
+/**
+ * Load + verify the manifest, then resolve its node set to live endpoints.
+ *
+ * Every failure is REPORTED (manifestVerified: false) and logged, never thrown — the caller owns
+ * the refuse-to-start decision, because only it can release what a refusal must release.
+ */
+export async function verifyStartupManifest(deps) {
+    const { manifestProvider, manifestRootKeys, manifestThreshold, manifestVersionStore, logger, fetchFn } = deps;
+    let manifestVerified = false;
+    let verifiedManifestVersion = 0;
+    let consortiumEndpoints = [];
+    let verifiedManifest = null;
+    const unresolvedNodes = [];
+    let unresolvedSweptAt = null;
+    if (!manifestProvider || !manifestRootKeys || manifestThreshold === undefined) {
+        return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+    }
+    try {
+        const manifest = await manifestProvider.loadAndVerify(manifestRootKeys, manifestThreshold);
+        /**
+         * DOD-M15-EXPIRY-CONSUMER-POLICY-1 — THIS GATE HAD THE NaN HOLE ITS OWN CLASSIFIER WAS WRITTEN
+         * TO CLOSE, and the whole line's premise rested on it.
+         *
+         * It was `new Date(manifest.expires)` compared with `<=`. `new Date("nonsense")` is Invalid
+         * Date, and **every comparison against NaN is false** — so a manifest with an unparseable
+         * `expires` passed BOTH checks, set `manifestVerified = true`, and started the daemon on an
+         * artefact nobody can date. `manifest-validity.ts` says exactly this about exactly this code —
+         * *"the startup check's own shape waves a garbage timestamp through as though it were
+         * in-window"* — and fixed it for the RUNTIME classifier while leaving the startup gate as it
+         * found it. `signal-submission.ts` and `preauth-capability.ts` both get it right; this was the
+         * odd one out.
+         *
+         * **It also falsified the argument the rest of this line rests on.** Everything else here reasons
+         * that a lapsed manifest exists only inside a LONG-RUNNING daemon, so refusing would strand a
+         * live operator. For the unparseable case that was untrue: such a daemon starts FRESH into the
+         * lapsed-equivalent state and stays there permanently — while both new events tell the operator
+         * *"do not restart, it will not come back."* It comes back cleanly, forever, on the same broken
+         * file. Wrong advice, in the one case where refusing costs nothing.
+         *
+         * Now one policy object for the startup gate and the runtime surface, which is what this DoD
+         * line is about. Refuses anything that is not affirmatively in-window.
+         */
+        const validity = classifyManifestValidity(manifest, Date.now());
+        if (validity.state === "unreadable_window" || (validity.state === "expired" && !Number.isFinite(Date.parse(manifest.expires)))) {
+            logger.error("directory.auth.manifest.unreadable.window", {
+                manifestVersion: manifest.version,
+                notBefore: manifest.not_before,
+                expires: manifest.expires,
+                detail: "a validity-window field does not parse — the artefact is malformed, not merely stale. " +
+                    "A hand-edited file or a broken generator is the usual cause. Refusing rather than treating " +
+                    "an undateable manifest as in-window.",
+            });
+            return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+        }
+        const now = new Date();
+        const notBefore = new Date(manifest.not_before);
+        const expiresAt = new Date(manifest.expires);
+        if (validity.state === "not_yet_valid" || now < notBefore) {
+            logger.error("directory.auth.manifest.not.yet.valid", {
+                manifestVersion: manifest.version,
+                notBefore: manifest.not_before,
+            });
+            return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+        }
+        if (validity.state === "expired" || expiresAt <= now) {
+            logger.error("directory.auth.manifest.expired", {
+                manifestVersion: manifest.version,
+                expiresAt: manifest.expires,
+            });
+            return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+        }
+        // Anti-rollback. Equal versions are fine (a restart on an unchanged manifest); only a STRICTLY
+        // older version is a rollback attempt.
+        const lastSeen = await manifestVersionStore.getLastSeenVersion();
+        if (lastSeen !== null && manifest.version < lastSeen) {
+            logger.error("directory.auth.manifest.version.rollback", {
+                manifestVersion: manifest.version,
+                lastSeenVersion: lastSeen,
+            });
+            return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+        }
+        await manifestVersionStore.persistVersion(manifest.version);
+        manifestVerified = true;
+        verifiedManifestVersion = manifest.version;
+        // Retained ONLY here — on the one path where the signatures, the window, and the anti-rollback
+        // check have all passed.
+        verifiedManifest = manifest;
+        logger.info("directory.auth.manifest.verified", {
+            manifestVersion: manifest.version,
+            signerCount: manifest.signatures.length,
+        });
+        // DOD-MANIFEST-1: resolve the FULL verified node set — this is the roster a T-of-N ceremony
+        // fans out to. Availability-aware: a down node is skipped and the rest still resolve. The
+        // threshold gate lives in the ceremony layer (DOD-DKG-1); it NEVER falls back to the single
+        // hardcoded endpoint for a missing node, which would mask a down/forged node as healthy.
+        consortiumEndpoints = await manifestNodesToEndpoints(manifest.nodes, {
+            logger,
+            fetchFn,
+            // The detail this sweep used to throw away. See ManifestGateResult.unresolvedNodes.
+            onNodeUnresolved: (f) => unresolvedNodes.push(f),
+        });
+        unresolvedSweptAt = new Date().toISOString();
+        const declaredNodes = manifest.nodes.length;
+        const resolvedNodes = consortiumEndpoints.length;
+        // Carry the nodeId↔peerId pairing (not just peerIds) so a consumer can verify each manifest
+        // identity is bound to the right live directory, not merely that the set has the right size.
+        const consortiumLog = {
+            manifestVersion: manifest.version,
+            declaredNodes,
+            resolvedNodes,
+            nodes: consortiumEndpoints.map((e) => ({ nodeId: e.nodeId, peerId: e.peerId })),
+        };
+        // Degraded ≠ healthy: a shrunken or empty roster must be loud, never buried at info.
+        if (resolvedNodes === 0) {
+            logger.error("directory.consortium.none", consortiumLog);
+        }
+        else if (resolvedNodes < declaredNodes) {
+            logger.warn("directory.consortium.partial", consortiumLog);
+        }
+        else {
+            logger.info("directory.consortium.resolved", consortiumLog);
+        }
+    }
+    catch (err) {
+        logger.error("directory.auth.manifest.load.failed", {
+            error: extractErrorMessage(err),
+        });
+    }
+    return { manifestVerified, verifiedManifestVersion, consortiumEndpoints, verifiedManifest, unresolvedNodes, unresolvedSweptAt };
+}
+export function createConsortiumRouting(deps) {
+    const { manifestProvider, manifestRootKeys, manifestThreshold, manifestVersionStore, manifestPollScheduler, directoryHttpUrl, directoryEndpointResolver, logger, fetchFn, } = deps;
+    // LAST failure per node, not a running count — the operator needs the current state, and a node
+    // that has started resolving again must drop out rather than linger as a stale complaint. Cleared
+    // per sweep: every resolve attempt rebuilds this from what actually failed that time.
+    //
+    // SEEDED from the startup sweep, because otherwise this is empty until some ceremony happens to
+    // resolve a roster — and the operator's first `cello status` after boot lands squarely in that
+    // window. That silence is the whole reason item 6 exists. The seed is a starting value, not a
+    // floor: the first real sweep replaces it, so a node that has recovered stops being reported.
+    let unresolvedNodes = [...(deps.initialUnresolvedNodes ?? [])];
+    let unresolvedSweptAt = deps.initialUnresolvedSweptAt ?? null;
+    const getUnresolvedNodes = () => [...unresolvedNodes];
+    const getUnresolvedSweptAt = () => unresolvedSweptAt;
+    /**
+     * When the reading currently held was STARTED (epoch ms), so a slow sweep cannot overwrite a
+     * newer one — `DOD-M15-STALEROSTER-1` review F6.
+     */
+    let unresolvedStartedAtMs = deps.initialUnresolvedSweptAt ? Date.parse(deps.initialUnresolvedSweptAt) : 0;
+    const resolveConsortiumRoster = async (budget) => {
+        const m = manifestProvider?.getCurrentManifest();
+        if (!m) {
+            // DOD-M15-STALEROSTER-1 review F13: this returns before the write and used to return before
+            // any log too, so "there is no manifest to probe" was indistinguishable from a clean sweep —
+            // the background sweep would tick forever, succeed every time, and never move the reading.
+            logger.warn("directory.roster.sweep.no_manifest", {
+                impact: "no roster measurement was taken — there is no verified manifest to enumerate nodes from, " +
+                    "so cello_status keeps whatever reading it already had.",
+            });
+            return null;
+        }
+        /**
+         * STAMP THE START, NOT THE FINISH — review F6.
+         *
+         * `unresolvedSweptAt = new Date()` after the await recorded when the sweep COMPLETED, and there
+         * is no mutual exclusion between the ten callers. The background sweep uses the patient probe
+         * (up to ~16 s) while the failover resolver uses FAST_PROBE (2 s), so the two overlap routinely:
+         * a slow-but-healthy node is marked unresolved by the fast sweep, the patient sweep finishes
+         * later and resolves it — or the reverse — and whichever lands last is stamped "measured now, 0
+         * seconds old". The operator gets a confidently fresh reading assembled from a race.
+         *
+         * Recording the start time and discarding a completion that began before the reading currently
+         * held makes last-writer-wins into newest-measurement-wins.
+         */
+        const startedAtMs = Date.now();
+        const failures = [];
+        const endpoints = await manifestNodesToEndpoints(m.nodes, {
+            logger,
+            fetchFn,
+            onNodeUnresolved: (f) => failures.push(f),
+            ...(budget ? { probeBudget: budget } : {}),
+        });
+        if (startedAtMs >= unresolvedStartedAtMs) {
+            unresolvedNodes = failures;
+            unresolvedSweptAt = new Date(startedAtMs).toISOString();
+            unresolvedStartedAtMs = startedAtMs;
+        }
+        else {
+            // Not an error — a slower sweep that began earlier finished later. Its endpoints are still
+            // returned to ITS caller; only the shared reading is left alone.
+            logger.info("directory.roster.sweep.superseded", {
+                startedAt: new Date(startedAtMs).toISOString(),
+                heldReadingStartedAt: new Date(unresolvedStartedAtMs).toISOString(),
+                impact: "this sweep's result was discarded for the status reading because a newer measurement is already held.",
+            });
+        }
+        return endpoints;
+    };
+    /**
+     * How many nodes the VERIFIED MANIFEST declares — no probe, no derivation.
+     *
+     * DOD-M15-ERRSTRING-1 (review MEDIUM-2). The roster-shortfall note first computed
+     * `declared = reachable + unresolved`, which silently undercounts: `manifestNodesToEndpoints`
+     * also drops nodes for an invalid endpoint and for a peer-id mismatch, and neither calls
+     * `onNodeUnresolved`. With 5 declared, 2 peer-id mismatches and 1 probe failure, that arithmetic
+     * yields a threshold of 2 and the note reports ceremonies CAN complete — when the real threshold
+     * is 3 and they cannot. The line whose job is to name a shortfall would have denied it.
+     *
+     * Worse, when every drop is a silent one the note is empty — mute on exactly the security-relevant
+     * case, since a peer-id mismatch is a node you most want named.
+     */
+    const getDeclaredNodeCount = () => manifestProvider?.getCurrentManifest()?.nodes.length ?? null;
+    // DECLARED membership, straight off the verified manifest — no probe. Lets the resolver reject a
+    // primary that resolves but belongs to a different consortium (the compiled-in default URL after
+    // a consortium move) without mistaking a momentarily-down member for a non-member.
+    /**
+     * DOD-M15-EXPIRY-CONSUMER-POLICY-1 — THE FOURTH CONSUMER, missed by the line's own enumeration and
+     * found by its review. The line named three; this is where the residual risk actually lives.
+     *
+     * This is the consortium MEMBERSHIP set: it lets the resolver reject a directory endpoint that
+     * resolves but belongs to a different consortium. Read from a lapsed manifest, a node REMOVED
+     * since the lapse is still a member here — so it can still be accepted as the endpoint this daemon
+     * talks to, which is the seat that coordinates a ceremony and declares the participant count.
+     *
+     * **Same verdict as the other two permitting consumers, for the same reason.** Refusing means the
+     * resolver can accept no endpoint at all, which takes a running daemon offline for a manifest that
+     * was valid when it started — the identical bricking cost, and this one is reached inside the 10 s
+     * signaling wait, so it fails fast and silently.
+     *
+     * **Reported once per manifest version.** This runs per resolution attempt, not per challenge, so
+     * a version key is the right granularity — unlike the challenge verifier, where a per-node key was
+     * needed because `nodeId` is in the payload.
+     */
+    let lapsedMembershipReportedFor = null;
+    const getManifestPeerIds = () => {
+        const m = manifestProvider?.getCurrentManifest();
+        if (!m)
+            return null;
+        const ids = m.nodes.map((n) => n.peerId).filter((p) => typeof p === "string" && p.length > 0);
+        /**
+         * ⚠️ REPORT ONLY IF A MEMBERSHIP SET IS ACTUALLY PRODUCED — pass 2, and this is the over-claim
+         * class that the register-handler rewording had just fixed, reintroduced by me in the consumer
+         * that review asked for.
+         *
+         * The first version reported BEFORE this filter. `ids.length === 0` returns `null`, and the
+         * caller treats `null` as **skip the membership check entirely** — so the event announced that
+         * "the set deciding which endpoints this daemon will accept came from a lapsed manifest" when no
+         * set was produced and nothing was decided. Not an edge case: `peerId` is OPTIONAL, and
+         * manifests written before the field existed carry none — for those the claim is ALWAYS false,
+         * and the once-per-version budget is spent saying it.
+         *
+         * `members` is the FILTERED count for the same reason: the member set is what survives the
+         * filter, not how many nodes the manifest lists.
+         */
+        const validity = classifyManifestValidity(m, Date.now());
+        if (ids.length > 0 && validity.state !== "valid" && validity.state !== "expiring_soon" && lapsedMembershipReportedFor !== m.version) {
+            lapsedMembershipReportedFor = m.version;
+            logger.warn("directory.membership.manifest.lapsed", {
+                manifestVersion: m.version,
+                state: validity.state,
+                members: ids.length,
+                impact: "the set deciding WHICH directory endpoints this daemon will accept came from a manifest " +
+                    "outside its validity window. A node removed from the consortium since then is still a " +
+                    "member by this reckoning, so it can still be accepted as the directory this daemon talks " +
+                    "to — the seat that coordinates a ceremony and declares the participant count.",
+                guidance: "Endpoint selection was NOT blocked — refusing here accepts no directory at all and takes " +
+                    "a running daemon offline. cello_status reports the window and where the manifest came from.",
+            });
+        }
+        return ids.length > 0 ? new Set(ids) : null;
+    };
+    const failoverEndpointResolver = directoryEndpointResolver
+        ? createRosterAwareEndpointResolver({
+            primaryResolver: directoryEndpointResolver,
+            // FAST_PROBE (review HIGH-1): this resolver runs inside the 10 s signaling wait, and the
+            // roster sweep is its slowest leg — Promise.all waits for the slowest node, so one
+            // unreachable node cost 16 s here while the failover path had already spent 8 s on the
+            // primary. Persistence belongs to startup and the background poll, where nothing waits.
+            getConsortiumRoster: () => resolveConsortiumRoster(FAST_PROBE),
+            getManifestPeerIds,
+            logger,
+        })
+        : undefined;
+    const getFailoverEndpoint = async () => failoverEndpointResolver ? await failoverEndpointResolver() : null;
+    // CELLO-M7-CONN-001 (DOD-CONN-3): the daemon-level manifest poll — it adopts a newer manifest
+    // independent of any agent identity, and so runs even with ZERO agents (the keystone it replaced
+    // could not). Off on the M6 back-compat path (no scheduler), and off without real root keys: a
+    // poll that verifies against an empty key set verifies against nothing.
+    let stopHttpManifestPoll;
+    /**
+     * DOD-M15-DIRAUTH-1 (Andre's quick win #3) — **AN EMPTY KEY SET MUST NOT DISABLE THE POLL IN
+     * SILENCE.**
+     *
+     * The condition below is correct and stays correct: a poll that verifies against no keys verifies
+     * against nothing, so it must not run. What was wrong is what happened when that triggered —
+     * nothing at all. The daemon started, looked healthy, and simply never adopted a new manifest
+     * again, which is the failure mode you discover months later when a rotated directory key is not
+     * picked up.
+     *
+     * ⚠️ THE DISTINCTION THAT MAKES THIS SAFE, and the reason it is not a blanket throw: **"no
+     * scheduler" is a legitimate configuration** — the M6 back-compat path deliberately runs without
+     * one, and failing startup there would brick a supported setup. **"Scheduler and provider are
+     * wired, but the keys are empty" is a MISCONFIGURATION** — someone intended verification and
+     * supplied nothing to verify with. Only the second refuses.
+     */
+    if (manifestPollScheduler && manifestProvider) {
+        const keyCount = manifestRootKeys?.length ?? 0;
+        if (keyCount === 0 || !manifestThreshold || manifestThreshold < 1) {
+            const detail = `rootKeys=${String(keyCount)} threshold=${String(manifestThreshold ?? 0)}`;
+            logger.error("directory.manifest.poll.misconfigured", {
+                rootKeyCount: keyCount,
+                threshold: manifestThreshold ?? 0,
+                impact: "the manifest poll is wired but has no key set to verify against, so it would adopt " +
+                    "manifests unverified or never adopt one at all — refusing at startup instead of running " +
+                    "with directory-key rotation silently dead",
+            });
+            throw new Error(`directory_manifest_poll_misconfigured: ${detail}`);
+        }
+    }
+    if (manifestPollScheduler && manifestProvider && manifestRootKeys && manifestRootKeys.length > 0 && manifestThreshold && manifestThreshold >= 1) {
+        stopHttpManifestPoll = startHttpManifestPoll({
+            scheduler: manifestPollScheduler,
+            directoryUrl: directoryHttpUrl ?? resolveDirectoryUrl(process.env),
+            manifestProvider,
+            manifestVersionStore,
+            rootKeys: manifestRootKeys,
+            threshold: manifestThreshold,
+            logger,
+            mintCorrelationId: () => randomUUID(),
+        });
+    }
+    return { resolveConsortiumRoster, failoverEndpointResolver, getFailoverEndpoint, getUnresolvedNodes, getUnresolvedSweptAt, getDeclaredNodeCount, stopHttpManifestPoll };
+}
+//# sourceMappingURL=consortium-bootstrap.js.map

package/dist/consortium-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consortium-bootstrap.js","sourceRoot":"","sources":["../src/consortium-bootstrap.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EAAE,UAAU,EAEpC,iCAAiC,GAElC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA2DzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAsB;IAChE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE9G,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,uBAAuB,GAAG,CAAC,CAAC;IAChC,IAAI,mBAAmB,GAAyB,EAAE,CAAC;IACnD,IAAI,gBAAgB,GAA8B,IAAI,CAAC;IACvD,MAAM,eAAe,GAAyB,EAAE,CAAC;IACjD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAE5C,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;IAClI,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAE3F;;;;;;;;;;;;;;;;;;;;;;WAsBG;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,KAAK,KAAK,mBAAmB,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/H,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBACxD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,UAAU;gBAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,wFAAwF;oBAC9F,6FAA6F;oBAC7F,sCAAsC;aACzC,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAClI,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,QAAQ,CAAC,KAAK,KAAK,eAAe,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAClI,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;gBAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,SAAS,EAAE,QAAQ,CAAC,OAAO;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAClI,CAAC;QAED,+FAA+F;QAC/F,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,kBAAkB,EAAE,CAAC;QACjE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBACvD,eAAe,EAAE,QAAQ,CAAC,OAAO;gBACjC,eAAe,EAAE,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAClI,CAAC;QAED,MAAM,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5D,gBAAgB,GAAG,IAAI,CAAC;QACxB,uBAAuB,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3C,+FAA+F;QAC/F,yBAAyB;QACzB,gBAAgB,GAAG,QAAQ,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC9C,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM;SACxC,CAAC,CAAC;QAEH,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,mBAAmB,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE;YACnE,MAAM;YACN,OAAO;YACP,oFAAoF;YACpF,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;SACjD,CAAC,CAAC;QACH,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC;QACjD,4FAA4F;QAC5F,6FAA6F;QAC7F,MAAM,aAAa,GAAG;YACpB,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,aAAa;YACb,aAAa;YACb,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChF,CAAC;QACF,qFAAqF;QACrF,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,aAAa,GAAG,aAAa,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE;YAClD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AAClI,CAAC;AAuDD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,EACJ,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,EAC3E,qBAAqB,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,EAAE,OAAO,GACpF,GAAG,IAAI,CAAC;IAET,gGAAgG;IAChG,kGAAkG;IAClG,sFAAsF;IACtF,EAAE;IACF,gGAAgG;IAChG,+FAA+F;IAC/F,8FAA8F;IAC9F,8FAA8F;IAC9F,IAAI,eAAe,GAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,IAAI,iBAAiB,GAAkB,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;IAC7E,MAAM,kBAAkB,GAAG,GAAyB,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC,CAAC;IAC5E,MAAM,oBAAoB,GAAG,GAAkB,EAAE,CAAC,iBAAiB,CAAC;IAEpE;;;OAGG;IACH,IAAI,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1G,MAAM,uBAAuB,GAAG,KAAK,EAAE,MAAoB,EAAwC,EAAE;QACnG,MAAM,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAChD,MAAM,EACJ,2FAA2F;oBAC3F,wDAAwD;aAC3D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD;;;;;;;;;;;;WAYG;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAyB,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,CAAC,CAAC,KAAK,EAAE;YACxD,MAAM;YACN,OAAO;YACP,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,WAAW,IAAI,qBAAqB,EAAE,CAAC;YACzC,eAAe,GAAG,QAAQ,CAAC;YAC3B,iBAAiB,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,qBAAqB,GAAG,WAAW,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,2FAA2F;YAC3F,iEAAiE;YACjE,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC/C,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;gBAC9C,oBAAoB,EAAE,IAAI,IAAI,CAAC,qBAAqB,CAAC,CAAC,WAAW,EAAE;gBACnE,MAAM,EAAE,uGAAuG;aAChH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH,MAAM,oBAAoB,GAAG,GAAkB,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;IAE/G,iGAAiG;IACjG,iGAAiG;IACjG,mFAAmF;IACnF;;;;;;;;;;;;;;;;;OAiBG;IACH,IAAI,2BAA2B,GAAkB,IAAI,CAAC;IACtD,MAAM,kBAAkB,GAAG,GAAuB,EAAE;QAClD,MAAM,CAAC,GAAG,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3G;;;;;;;;;;;;;;WAcG;QACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,eAAe,IAAI,2BAA2B,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YACpI,2BAA2B,GAAG,CAAC,CAAC,OAAO,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBAClD,eAAe,EAAE,CAAC,CAAC,OAAO;gBAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,GAAG,CAAC,MAAM;gBACnB,MAAM,EACJ,0FAA0F;oBAC1F,wFAAwF;oBACxF,2FAA2F;oBAC3F,+EAA+E;gBACjF,QAAQ,EACN,2FAA2F;oBAC3F,6FAA6F;aAChG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,yBAAyB;QACxD,CAAC,CAAC,iCAAiC,CAAC;YAChC,eAAe,EAAE,yBAAyB;YAC1C,yFAAyF;YACzF,mFAAmF;YACnF,uFAAuF;YACvF,wFAAwF;YACxF,mBAAmB,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,UAAU,CAAC;YAC9D,kBAAkB;YAClB,MAAM;SACP,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,mBAAmB,GAAG,KAAK,IAAuC,EAAE,CACxE,wBAAwB,CAAC,CAAC,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,8FAA8F;IAC9F,iGAAiG;IACjG,+FAA+F;IAC/F,wEAAwE;IACxE,IAAI,oBAA8C,CAAC;IACnD;;;;;;;;;;;;;;;OAeG;IACH,IAAI,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,YAAY,MAAM,CAAC,QAAQ,CAAC,cAAc,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,YAAY,EAAE,QAAQ;gBACtB,SAAS,EAAE,iBAAiB,IAAI,CAAC;gBACjC,MAAM,EACJ,qFAAqF;oBACrF,0FAA0F;oBAC1F,2CAA2C;aAC9C,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,IAAI,gBAAgB,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;QAChJ,oBAAoB,GAAG,qBAAqB,CAAC;YAC3C,SAAS,EAAE,qBAAqB;YAChC,YAAY,EAAE,gBAAgB,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,gBAAgB;YAChB,oBAAoB;YACpB,QAAQ,EAAE,gBAAgB;YAC1B,SAAS,EAAE,iBAAiB;YAC5B,MAAM;YACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;AAC1K,CAAC"}