@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/attendance-wiring.js

@@ -0,0 +1,248 @@
+/**
+ * What an UNATTENDED agent does when someone CALLS it: answer the call once, say so plainly, and
+ * leave the rest to the operator who comes back.
+ *
+ * ⚠️ IT ANSWERS CALLS, NEVER CONVERSATIONS (DOD-M15-AWAYSCOPE-1). An answering machine is for a
+ * call nobody picked up. Once two agents are in an accepted session, a daemon that types into it is
+ * putting a status announcement in a record that attests what the two PARTIES said — and on
+ * session `e7dd3f43…` that one greeting cost a completed, witnessed conversation its receipt on
+ * both machines, permanently. A daemon's assertion about itself is a fact ABOUT the session and
+ * rides the out-of-band liveness frame; it never takes a chain leaf. The only trigger left here is
+ * an inbound session REQUEST.
+ *
+ * "Attended" means a live client has claimed the agent with `cello_use_agent`. Several sessions
+ * attending one agent at once is legitimate and permanent — co-attendance, not exclusivity — which
+ * is why the COUNT is kept separate from the boolean and both read the same `currentAgent` map the
+ * doorbell routes on. They cannot disagree about who is present.
+ *
+ * ⚠️ IT PLACES ITS OWN LEAVES. The greeting is content: it is sent, it takes a leaf and it records
+ * a transcript row, exactly as a voicemail outgoing message belongs on the tape. So this file stays
+ * in the seal call-site enforcer's CALLERS list — that guard stops SCANNING a file that leaves the
+ * list rather than going red.
+ */
+import { randomUUID } from "node:crypto";
+import { countAttendance } from "./co-attendance.js";
+import { markAsAutoReply, systemAwayText } from "./away-detection.js";
+import { LEAF_KIND_MSG } from "./session-relay-client.js";
+import { sentAuthorship } from "./session-content-handlers.js";
+import { extractErrorMessage } from "./error-message.js";
+export function createAttendanceWiring(deps) {
+    const { logger, sessionNodeManager, perConnectionState, securityGateway } = deps;
+    // M8C-AWAY-1: away response — an unattended Primary auto-answers session requests
+    // with the default transparent away text and queues them (the DoD's own mandated default).
+    // CORE ships now; the operator-configurable custom-text / opaque-privacy-mode SWITCH is PARKED
+    // on M9-CFG-001, journaled as D15 (M8C-DECISIONS.md, mirrors D14) — a genuine per-agent operator
+    // preference that needs the deferred config store, whereas transparent is already the correct,
+    // non-fake default this unit must ship regardless.
+    // "Attended" per the design doc (2026-07-01 command-surface discussion, Agent State Model):
+    // Primary + a live client session has claimed the agent via use_agent. Scanning
+    // perConnectionState is cheap (a handful of connections) and needs no separate tracked state.
+    function isAttended(agentName) {
+        for (const s of perConnectionState.values())
+            if (s.currentAgent === agentName)
+                return true;
+        return false;
+    }
+    // DOD-COATTEND-VISIBLE-1: the COUNT, deliberately kept separate from the boolean above. Several
+    // sessions attending one agent is legitimate and permanent (co-attendance, not exclusivity — spec
+    // §3); what was missing is that nobody was ever TOLD. `isAttended` is left byte-identical because
+    // M8C-AWAY-1's auto-ack suppression hangs off its early return, and both read the same
+    // `currentAgent` map the doorbell routes on, so the count can never disagree with who gets woken.
+    function attendanceCount(agentName) {
+        return countAttendance(perConnectionState, agentName);
+    }
+    /**
+     * In-flight background seal ceremonies — `DOD-M15-CLOSEWAIT-1` review MEDIUM-6.
+     *
+     * The close now answers at commitment and finishes the ceremony detached. Without this the tail
+     * was the ONE background task `stop()` could cut at an arbitrary point, while it cancels or awaits
+     * every other one.
+     */
+    const backgroundSeals = new Set();
+    // Coalescing: one away ack per (agent, session, kind) per away period — cleared when the agent
+    // becomes attended again (cello_use_agent) so the NEXT away period gets a fresh ack rather than
+    // staying silent forever. Known imprecision (journaled, not silent): clearing fires on ANY
+    // use_agent selecting this name, even if another connection kept it attended throughout — an
+    // edge case, not a correctness gap in the core "queue + one calm ack while genuinely away" promise.
+    const awayAckSent = new Set();
+    /**
+     * DOD-M15-AWAYSCOPE-1 — THIS ANSWERS A CALL. It does not answer a conversation.
+     *
+     * There is one caller left, the inbound session-REQUEST path, and the `kind` parameter is gone
+     * rather than defaulted: a second value is what let this function be reached from an existing
+     * session, and a default would leave that call compiling.
+     */
+    /**
+     * "WE GREETED THEM" — DOD-INBOX-ONESHOT-1, NOT the same fact as `dedupKey`, which is set before the
+     * send and stays set on the screened-out branch where nothing reached the caller. The one-shot
+     * closes a visit for having told the caller the rule, so it keys off a greeting that went out; a
+     * queued one counts — witnessed, leafed, on its way.
+     */
+    const markGreeted = (agentName, sessionId) => void awayAckSent.add(`${agentName}:${sessionId}:greeted`);
+    async function sendAwayResponse(agentName, sessionId) {
+        if (isAttended(agentName))
+            return;
+        /**
+         * The log keeps saying which kind it was, and that is deliberate now that there is only one.
+         * The live failure this order closes is READ OFF a daemon log line — `kind: "message"` at
+         * 16:13:28.804 is the whole tell — so a log that still names the kind is what makes the absence
+         * of the deleted one provable from a production log rather than only from the source.
+         */
+        const kind = "request";
+        const dedupKey = `${agentName}:${sessionId}:${kind}`;
+        if (awayAckSent.has(dedupKey))
+            return;
+        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
+        if (!record || record.status !== "active")
+            return;
+        // The inbound accept path does NOT auto-add the sender: an unattended stranger STAYS unknown
+        // across every inbound interaction. Promotion requires operator engagement — an outbound
+        // initiate, a cello_send reply, or an explicit contact add. Nothing depends on its ordering.
+        const isKnown = sessionNodeManager.isKnown(agentName, record.counterparty_pubkey);
+        awayAckSent.add(dedupKey); // guard BEFORE the async send — concurrent arrivals must not double-ack
+        try {
+            // DOD-AWAY-TIER-1: resolve most-specific-first — per-contact away_message → per-tier away
+            // (settings) → agent default (settings) → the system default (code, per kind). Total.
+            // DOD-M12B-AWAY-MARK-1: THE choke point. Every away reply this daemon sends passes through
+            // this one expression — the per-contact message, the per-tier message, the agent default, the
+            // system default and the stranger ack — so marking here is what makes "an operator's
+            // CONFIGURED away message is indistinguishable from a person" go away, which is the half
+            // exact-text matching could not reach by construction. markAsAutoReply is idempotent, so the
+            // system defaults (already marked at their source) do not pick up a second token.
+            const awayText = sessionNodeManager.resolveAwayMessage(agentName, record.counterparty_pubkey)
+                ?? systemAwayText(agentName, isKnown);
+            // AWAYSALT-1 review MEDIUM-3: the salt wait widens the window in which BOTH acks are computed
+            // before either is a leaf, so the tree check below would pass both through. Claim the TEXT first.
+            const txtKey = `${agentName}:${sessionId}:txt:${awayText}`;
+            if (awayAckSent.has(txtKey)) {
+                logger.info("session.away.response.suppressed_duplicate", { agentName, sessionId, kind, reason: "identical_ack_already_in_flight" });
+                return;
+            }
+            awayAckSent.add(txtKey);
+            const draftBytes = new TextEncoder().encode(awayText);
+            // SI (AWAY-TIER-1): an away message is now operator-configurable, i.e. an outbound DISCLOSURE.
+            // Screen it on the outbound path like any content — it does NOT bypass the gateway. A block/warn
+            // verdict means it is not sent (the dedup guard stays set — one screen per away period, no spam);
+            // a redact verdict sends the ALTERED bytes.
+            const awayVerdict = await securityGateway.screenOutbound(draftBytes, {
+                direction: "outbound", agentName, sessionId, correlationId: randomUUID(),
+            });
+            if (awayVerdict.disposition === "block" || awayVerdict.disposition === "warn") {
+                logger.info("session.away.response.screened_out", { agentName, sessionId, kind, disposition: awayVerdict.disposition });
+                return;
+            }
+            if (awayVerdict.disposition === "redact" && awayVerdict.content === undefined) {
+                logger.error("session.away.response.redact_without_content", { agentName, sessionId, kind });
+                return;
+            }
+            // DOD-M12B-AWAY-MARK-1: mark AFTER screening, never before. A redact verdict REPLACES the
+            // bytes, and marking the draft would let that replacement silently strip the marker — an away
+            // reply back on the wire indistinguishable from a person, with no log line saying so. Marking
+            // here also means the gateway screens the OPERATOR-CONFIGURED message — the only unmarked
+            // input — rather than a daemon token bolted to its front. Every system default, the stranger
+            // ack included since AWAYLEAF-1, is marked at source; markAsAutoReply is idempotent.
+            const screenedBytes = awayVerdict.disposition === "redact" && awayVerdict.content !== undefined
+                ? new Uint8Array(awayVerdict.content)
+                : draftBytes;
+            const contentBytes = new TextEncoder().encode(markAsAutoReply(new TextDecoder().decode(screenedBytes)));
+            // AWAYSALT-1 — BEFORE hashing: unsalted here closes salt adoption for the whole session, and every later message from the peer is refused. See `markSaltPending`.
+            sessionNodeManager.expectSaltAgreement(agentName, sessionId);
+            // B2b: one decision point for the hash AND its algorithm — see `contentHashForSession`.
+            const away = await sessionNodeManager.contentHashForSession(agentName, sessionId, contentBytes);
+            // DOD-M15-AWAYLEAF-1 — the DURABLE half of the no-duplicate-leaf rule; `txtKey` is the in-flight
+            // half. Both acks carry the same bytes whenever the away text does not vary by kind, and a leaf
+            // only one side holds is never co-signed: measured on 9b4d89f9, 4 against 3, `leaf_count_mismatch`.
+            const awayHashHex = Buffer.from(away.hash).toString("hex");
+            if (sessionNodeManager.getSessionTree(agentName, sessionId).indexOfHash(awayHashHex) >= 0) {
+                logger.info("session.away.response.suppressed_duplicate", {
+                    agentName, sessionId, kind, contentHashHex: awayHashHex, reason: "identical_leaf_already_in_this_session",
+                    impact: "no second ack is sent; two leaves with one content hash leave this session unable to seal",
+                });
+                return;
+            }
+            const sendResult = await sessionNodeManager.sendContent(agentName, sessionId, contentBytes, new Uint8Array(away.hash), randomUUID(), LEAF_KIND_MSG, away.alg);
+            if (!sendResult.ok && !sendResult.durable) {
+                // ⚠️ NO TRIGGER REACHES THIS RETRY TODAY, and the comment used to promise one.
+                //
+                // It cleared the guard so "the next inbound arrival retries the ack". The next inbound
+                // arrival was a MESSAGE, and DOD-M15-AWAYSCOPE-1 deleted that trigger. A session request
+                // arrives once per session, so nothing re-enters `sendAwayResponse` for this session and the
+                // greeting is simply lost — the consequence that order accepted, said here in the code
+                // rather than only in its commit message.
+                //
+                // The clears stay because they are correct and free the moment a re-trigger exists (a
+                // reconnect sweep, or the attendance work in units 2-4). Both guards, because AWAYLEAF-1's
+                // in-flight claim would otherwise suppress that retry as its own duplicate.
+                awayAckSent.delete(dedupKey);
+                awayAckSent.delete(txtKey);
+                // M12-P13: this branch now means the reply is GONE, not merely late (the queued case is
+                // handled below), so it is an error and it says what the consequence is. It was a bare warn
+                // when it fired live on 2026-08-05 and read as routine churn.
+                logger.error("session.away.response.failed", {
+                    agentName, sessionId, kind, reason: sendResult.reason, cause: sendResult.cause,
+                    impact: "the away reply is lost and was NOT queued — the counterparty gets no acknowledgement",
+                });
+                return;
+            }
+            const contentHashHex = Buffer.from(away.hash).toString("hex");
+            if (!sendResult.ok) {
+                // M12-P13 (found live 2026-08-05, M12 Entry 89): the reply is durably queued and already
+                // owns the sequence the relay witnessed for it, so its leaf MUST be committed here. Without
+                // it this side's tree stays one short of that sequence, and since `nextExpected` is the tree
+                // size, every message the counterparty sends afterwards is held behind a gap nothing can
+                // fill. That is exactly how the receiver stranded its own session at sequence 0.
+                //
+                // The dedup guard deliberately STAYS SET: a queued reply is coming, and re-sending on the
+                // next arrival would mint a second greeting at a second sequence.
+                // DOD-M12B-INDEX-1: the queued reply owns the position the relay witnessed for it, and
+                // that is where its leaf goes.
+                // Witnessed and SIGNED — only the direct hand-off failed — so the proof exists and must
+                // reach the leaf. This is the site `sentAuthorship`'s own comment calls dead-by-construction
+                // under an `ok`-gated read; the same reasoning applies to the leaf, not just the row.
+                const placedQueued = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
+                if (placedQueued.placed) {
+                    sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedQueued.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
+                }
+                logger.info("session.away.response.deferred", {
+                    agentName, sessionId, kind, isKnown,
+                    sequenceNumber: placedQueued.placed ? placedQueued.leafIndex : placedQueued.heldAt,
+                    committed: placedQueued.placed,
+                    reason: sendResult.reason, cause: sendResult.cause,
+                });
+                markGreeted(agentName, sessionId);
+                return;
+            }
+            // DOD-M12B-INDEX-1: the away responder fires while inbound is still arriving, so it is the
+            // path most likely to have a gap open under it — exactly where a tail append does damage.
+            const placedReply = sessionNodeManager.placeOwnLeaf(agentName, sessionId, contentHashHex, contentBytes, sendResult.sequenceNumber, randomUUID(), "msg", sentAuthorship(sendResult));
+            if (placedReply.placed) {
+                sessionNodeManager.recordTranscriptMessage(agentName, sessionId, placedReply.leafIndex, "sent", contentBytes, randomUUID(), sentAuthorship(sendResult));
+            }
+            logger.info("session.away.response.sent", {
+                agentName, sessionId, kind, isKnown,
+                sequenceNumber: placedReply.placed ? placedReply.leafIndex : placedReply.heldAt,
+                committed: placedReply.placed,
+            });
+            markGreeted(agentName, sessionId);
+        }
+        catch (err) {
+            // Same as above: the clear is correct and currently unreachable — nothing re-enters this
+            // function for a session whose request has already been answered. `txtKey` is deliberately
+            // not cleared here and was not before; moot while nothing retries, and noted so the asymmetry
+            // is not read as intent by whoever restores a trigger.
+            awayAckSent.delete(dedupKey);
+            // A DISTINCT NAME, and a distinct LEVEL. This threw somewhere unexpected; the branch above is
+            // a send that reported failure. Two different causes with two different remedies were sharing
+            // one event name at two levels, so a log reader matching on the name got whichever fired.
+            logger.error("session.away.response.threw", {
+                agentName, sessionId, kind, error: extractErrorMessage(err),
+                impact: "the away greeting was never sent and this caller gets no acknowledgement at all",
+            });
+        }
+    }
+    // `isAttended` is NOT returned: its only caller in the repo is `sendAwayResponse`, which moved
+    // with it. Returning it would make a private local reachable through an exported factory for no
+    // consumer — new surface, which Rule D forbids.
+    return { attendanceCount, sendAwayResponse, backgroundSeals, awayAckSent };
+}
+//# sourceMappingURL=attendance-wiring.js.map

package/dist/attendance-wiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attendance-wiring.js","sourceRoot":"","sources":["../src/attendance-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAczD,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEjF,kFAAkF;IAClF,2FAA2F;IAC3F,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,mDAAmD;IACnD,4FAA4F;IAC5F,gFAAgF;IAChF,8FAA8F;IAC9F,SAAS,UAAU,CAAC,SAAiB;QACnC,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,gGAAgG;IAChG,kGAAkG;IAClG,kGAAkG;IAClG,uFAAuF;IACvF,kGAAkG;IAClG,SAAS,eAAe,CAAC,SAAiB;QACxC,OAAO,eAAe,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IACD;;;;;;OAMG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;IACpD,+FAA+F;IAC/F,gGAAgG;IAChG,2FAA2F;IAC3F,6FAA6F;IAC7F,oGAAoG;IACpG,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC;;;;;;OAMG;IACH;;;;;OAKG;IACH,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAQ,EAAE,CAAC,KAAK,WAAW,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,SAAS,UAAU,CAAC,CAAC;IAE9H,KAAK,UAAU,gBAAgB,CAAC,SAAiB,EAAE,SAAiB;QAClE,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAClC;;;;;WAKG;QACH,MAAM,IAAI,GAAG,SAAkB,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACrD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAClD,6FAA6F;QAC7F,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClF,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,wEAAwE;QACnG,IAAI,CAAC;YACH,0FAA0F;YAC1F,sFAAsF;YACtF,2FAA2F;YAC3F,8FAA8F;YAC9F,qFAAqF;YACrF,yFAAyF;YACzF,6FAA6F;YAC7F,kFAAkF;YAClF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC;mBACxF,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACxC,8FAA8F;YAC9F,kGAAkG;YAClG,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,QAAQ,QAAQ,EAAE,CAAC;YAC3D,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9K,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtD,+FAA+F;YAC/F,iGAAiG;YACjG,kGAAkG;YAClG,4CAA4C;YAC5C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,UAAU,EAAE;gBACnE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE;aACzE,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,WAAW,KAAK,OAAO,IAAI,WAAW,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBAC9E,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;gBACxH,OAAO;YACT,CAAC;YACD,IAAI,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9E,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YACD,0FAA0F;YAC1F,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,aAAa,GAAG,WAAW,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,KAAK,SAAS;gBAC7F,CAAC,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC;gBACrC,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CACzD,CAAC;YACF,kKAAkK;YAClK,kBAAkB,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAC7D,wFAAwF;YACxF,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YAChG,iGAAiG;YACjG,gGAAgG;YAChG,oGAAoG;YACpG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,kBAAkB,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBACxD,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,wCAAwC;oBACzG,MAAM,EAAE,2FAA2F;iBACpG,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9J,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC1C,+EAA+E;gBAC/E,EAAE;gBACF,uFAAuF;gBACvF,yFAAyF;gBACzF,6FAA6F;gBAC7F,uFAAuF;gBACvF,0CAA0C;gBAC1C,EAAE;gBACF,sFAAsF;gBACtF,2FAA2F;gBAC3F,4EAA4E;gBAC5E,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzD,wFAAwF;gBACxF,4FAA4F;gBAC5F,8DAA8D;gBAC9D,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBAC3C,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK;oBAC9E,MAAM,EAAE,sFAAsF;iBAC/F,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,yFAAyF;gBACzF,4FAA4F;gBAC5F,6FAA6F;gBAC7F,yFAAyF;gBACzF,iFAAiF;gBACjF,EAAE;gBACF,0FAA0F;gBAC1F,kEAAkE;gBAClE,uFAAuF;gBACvF,+BAA+B;gBAC/B,wFAAwF;gBACxF,6FAA6F;gBAC7F,sFAAsF;gBACtF,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;gBACrL,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;oBACxB,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC3J,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;oBAC5C,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO;oBACnC,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM;oBAClF,SAAS,EAAE,YAAY,CAAC,MAAM;oBAC9B,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK;iBACnD,CAAC,CAAC;gBACL,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,0FAA0F;YAC1F,MAAM,WAAW,GAAG,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC,cAAc,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;YACpL,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvB,kBAAkB,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1J,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACxC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO;gBACnC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;gBAC/E,SAAS,EAAE,WAAW,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEpC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yFAAyF;YACzF,2FAA2F;YAC3F,8FAA8F;YAC9F,uDAAuD;YACvD,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,8FAA8F;YAC9F,8FAA8F;YAC9F,0FAA0F;YAC1F,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC3D,MAAM,EAAE,iFAAiF;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,gGAAgG;IAChG,gDAAgD;IAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;AAC7E,CAAC"}

package/dist/attestation-body.d.ts

@@ -0,0 +1,47 @@
+/**
+ * What an endorsement body may contain — checked HERE, before it is signed and sent.
+ *
+ * ─── WHY THIS EXISTS ON THE CLIENT AT ALL ─────────────────────────────────────────────────────
+ *
+ * The portal is the authority and stays the authority: a client can be edited, so anything only the
+ * client enforces is not enforced. This is not enforcement. It is the difference between learning
+ * the rule now and learning it after a round trip that answers `scanner_charset` with no message.
+ *
+ * That round trip really happened (047-ENDORSETEXT): a 926-character endorsement was rejected for
+ * its two paragraph breaks, the refusal named a category rather than a character, and the blame
+ * landed on the punctuation for an hour.
+ *
+ * ─── THE RULE IS DEFINED IN TWO REPOSITORIES AND THAT IS A HAZARD ─────────────────────────────
+ *
+ * The portal's copy is `DISALLOWED_CHARSET` / `INTAKE_LENGTH_CAP` in
+ * `cello-portal/src/server/trust/submission-scan.ts`. They must agree, and nothing at build time
+ * can check that across a repo boundary — the same skew shape as `trust_signal_drain_complete`.
+ *
+ * **So each side pins the other in a test.** `attestation-body.test.ts` asserts these exact values
+ * and names its twin; the portal's `m10b-scan-1-submission-scan.test.ts` does the same. Change one
+ * without the other and a test fails rather than an operator discovering it.
+ */
+/** Characters below U+0080 that may not appear. Everything above passes — non-English bodies are
+ *  legal and this rule must never become an ASCII gate. `\n` is allowed; a tab is not. */
+export declare const ATTESTATION_DISALLOWED_CHARSET: RegExp;
+/** CHARACTERS, not bytes: a byte cap gives a Chinese endorsement a third of the room. */
+export declare const ATTESTATION_LENGTH_CAP = 500;
+/**
+ * Normalise line endings BEFORE signing, because this is the only place the text can change and
+ * still be the text that was signed. The portal cannot do it — the body arrives inside a signed
+ * submission, so rewriting it there would invalidate the signature that makes it attributable.
+ */
+export declare function normalizeAttestationBody(body: string): string;
+export interface BodyRefusal {
+    reason: "body_too_long" | "body_disallowed_character";
+    guidance: string;
+}
+/**
+ * Returns a refusal, or null when the body is acceptable.
+ *
+ * Every guidance string says three things, in this order: that it was NOT sent, what exactly is
+ * wrong, and what to do. The first matters most — an operator who cannot tell whether a copy is in
+ * flight will either resend a duplicate or wait for something that never left.
+ */
+export declare function checkAttestationBody(body: string): BodyRefusal | null;
+//# sourceMappingURL=attestation-body.d.ts.map

package/dist/attestation-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-body.d.ts","sourceRoot":"","sources":["../src/attestation-body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;0FAC0F;AAC1F,eAAO,MAAM,8BAA8B,QAA+B,CAAC;AAE3E,yFAAyF;AACzF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,eAAe,GAAG,2BAA2B,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CA6BrE"}

package/dist/attestation-body.js

@@ -0,0 +1,71 @@
+/**
+ * What an endorsement body may contain — checked HERE, before it is signed and sent.
+ *
+ * ─── WHY THIS EXISTS ON THE CLIENT AT ALL ─────────────────────────────────────────────────────
+ *
+ * The portal is the authority and stays the authority: a client can be edited, so anything only the
+ * client enforces is not enforced. This is not enforcement. It is the difference between learning
+ * the rule now and learning it after a round trip that answers `scanner_charset` with no message.
+ *
+ * That round trip really happened (047-ENDORSETEXT): a 926-character endorsement was rejected for
+ * its two paragraph breaks, the refusal named a category rather than a character, and the blame
+ * landed on the punctuation for an hour.
+ *
+ * ─── THE RULE IS DEFINED IN TWO REPOSITORIES AND THAT IS A HAZARD ─────────────────────────────
+ *
+ * The portal's copy is `DISALLOWED_CHARSET` / `INTAKE_LENGTH_CAP` in
+ * `cello-portal/src/server/trust/submission-scan.ts`. They must agree, and nothing at build time
+ * can check that across a repo boundary — the same skew shape as `trust_signal_drain_complete`.
+ *
+ * **So each side pins the other in a test.** `attestation-body.test.ts` asserts these exact values
+ * and names its twin; the portal's `m10b-scan-1-submission-scan.test.ts` does the same. Change one
+ * without the other and a test fails rather than an operator discovering it.
+ */
+/** Characters below U+0080 that may not appear. Everything above passes — non-English bodies are
+ *  legal and this rule must never become an ASCII gate. `\n` is allowed; a tab is not. */
+export const ATTESTATION_DISALLOWED_CHARSET = /[\x00-\x09\x0b-\x1f\x7f<>]/;
+/** CHARACTERS, not bytes: a byte cap gives a Chinese endorsement a third of the room. */
+export const ATTESTATION_LENGTH_CAP = 500;
+/**
+ * Normalise line endings BEFORE signing, because this is the only place the text can change and
+ * still be the text that was signed. The portal cannot do it — the body arrives inside a signed
+ * submission, so rewriting it there would invalidate the signature that makes it attributable.
+ */
+export function normalizeAttestationBody(body) {
+    return body.replace(/\r\n?/g, "\n").trim();
+}
+/**
+ * Returns a refusal, or null when the body is acceptable.
+ *
+ * Every guidance string says three things, in this order: that it was NOT sent, what exactly is
+ * wrong, and what to do. The first matters most — an operator who cannot tell whether a copy is in
+ * flight will either resend a duplicate or wait for something that never left.
+ */
+export function checkAttestationBody(body) {
+    if (body.length > ATTESTATION_LENGTH_CAP) {
+        return {
+            reason: "body_too_long",
+            guidance: `Not sent — nothing left this machine. The body is ${body.length} characters and the limit ` +
+                `is ${ATTESTATION_LENGTH_CAP}. An endorsement is a testimonial, not a document: say the one ` +
+                `thing you would want a stranger to know, and run cello_attestations_issue again.`,
+        };
+    }
+    const index = body.search(ATTESTATION_DISALLOWED_CHARSET);
+    if (index >= 0) {
+        const code = body.charCodeAt(index);
+        const named = code === 0x09 ? "a tab" :
+            code === 0x0d ? "a carriage return" :
+                code === 0x3c ? "a '<'" :
+                    code === 0x3e ? "a '>'" :
+                        `U+${code.toString(16).toUpperCase().padStart(4, "0")}`;
+        return {
+            reason: "body_disallowed_character",
+            guidance: `Not sent — nothing left this machine. The body contains ${named} at position ${index}. ` +
+                `Line breaks are fine; other control characters and angle brackets are not, because they ` +
+                `hide content from a reader while a parser still sees it. Remove it and run ` +
+                `cello_attestations_issue again.`,
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=attestation-body.js.map

package/dist/attestation-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-body.js","sourceRoot":"","sources":["../src/attestation-body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;0FAC0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,4BAA4B,CAAC;AAE3E,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,QAAQ,EACN,qDAAqD,IAAI,CAAC,MAAM,4BAA4B;gBAC5F,MAAM,sBAAsB,iEAAiE;gBAC7F,kFAAkF;SACrF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;IAC1D,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GACT,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBACrC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACzB,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;wBACzB,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,2BAA2B;YACnC,QAAQ,EACN,2DAA2D,KAAK,gBAAgB,KAAK,IAAI;gBACzF,0FAA0F;gBAC1F,6EAA6E;gBAC7E,iCAAiC;SACpC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/authorship-verification.d.ts

@@ -0,0 +1,91 @@
+/**
+ * CELLO Daemon — WHO SENT THIS, AND DID THEY SEE WHAT THEY CLAIM
+ *
+ * Split out of `session-node-manager.ts` by 036-GODFILE, Part 1. Two questions about one signed
+ * blob: did this really come from this conversation's counterparty, and is what they say they saw
+ * actually what we sent. Everything is moved verbatim — the comments are the asset and several of
+ * them record a defect that came back once already.
+ *
+ * ⚠️ THE ORDER OF THE CHECKS IS ITSELF A SECURITY PROPERTY — decode → signature → signer → what the
+ * proof is about. Everything after the signer answers `unusable`, which refuses the message and
+ * leaves the session alive; signature and signer answer `refuted`, which FREEZES it. A check that
+ * can answer before the signature is verified hands a peer a switch for choosing the softer
+ * outcome. Do not reorder these, and do not add a cheap early check above the signature.
+ *
+ * ⚠️ THIS CLASS OWNS ITS OWN STATE, which is what made it a seam rather than a split.
+ * `#receivedFromCounterparty` and `#lastFromCounterparty` are read and written nowhere else in the
+ * daemon, so they moved with the code that maintains them. Everything else it needs arrives through
+ * `AuthorshipContext` — a narrow, explicit list. No field of the manager was widened to make this
+ * possible, and the manager is not passed in as a whole.
+ */
+import type { Logger, SessionRecord } from "./types.js";
+import type { SessionTree } from "./session-tree.js";
+import { type AuthorshipVerdict } from "./session-node-types.js";
+/**
+ * Everything the verifier needs from the manager, stated explicitly rather than handed the manager
+ * itself. If this list ever grows long, that is the signal the seam has moved — not a reason to
+ * widen it.
+ */
+export interface AuthorshipContext {
+    readonly logger: Logger;
+    sessionKey(agentName: string, sessionId: string): string;
+    getSessionRecord(agentName: string, sessionId: string): SessionRecord | null;
+    getSessionTree(agentName: string, sessionId: string): SessionTree;
+    isSessionDiverged(agentName: string, sessionId: string): boolean;
+    sessionGenesisPrevRoot(agentName: string, sessionId: string): Uint8Array | undefined;
+    /** The relay's session id for this session, when a live node holds one. */
+    relaySessionIdBytes(agentName: string, sessionId: string): Uint8Array | undefined;
+    /**
+     * Content received and verified but not yet appended, because it sits behind an ordering gap.
+     *
+     * ⚠️ RETURNS THE MAP, not a flattened list, and that is deliberate: the call site's expression
+     * (`[...heldHere.values()].some(...)`) moves across unchanged. Handing back a pre-computed array
+     * of hashes would read as a tidy-up and would be a behaviour change wearing a refactor's clothes.
+     */
+    heldContentFor(agentName: string, sessionId: string): ReadonlyMap<number, {
+        contentHashHex: string;
+    }> | undefined;
+}
+export declare class AuthorshipVerifier {
+    #private;
+    constructor(ctx: AuthorshipContext);
+    /**
+       * `DOD-M15-AUTHORSHIP-ABSENT-1` — DID THIS SENDER PROVE THEY WROTE THIS MESSAGE?
+       *
+       * The one place that answers it, for both callers, so "checked" cannot mean two different things
+       * in two places. It takes the signature as an ARGUMENT rather than digging it out of a structure,
+       * which is the whole of the fix: the signature used to be read only from `structure2_cbor` — the
+       * RELAY's record — so a receiver could not check authorship without a relay record, and refusing
+       * on its absence would have made the relay a precondition for reading mail. The content frame now
+       * carries the signature beside the bytes it signs, exactly as `hash_submit` always has, and this
+       * method does not care which of the two handed it over.
+       *
+       * It VERIFIES and it does not LOG. The severity of each verdict differs by caller — the content
+       * frame refuses an `unusable`, the park path shrugs at one — and a method that logged its own
+       * conclusion would either report a refusal that did not happen or stay silent on one that did.
+       */
+    verifyAuthorshipClaim(agentName: string, sessionId: string, structure1Cbor: Uint8Array, senderSignature: Uint8Array, contentHash: Uint8Array): AuthorshipVerdict;
+    /**
+     * DOD-M15-SELFCHAIN-GAP-1 — has this session's self-chain gap been open longer than the grace?
+     *
+     * `false` also when there is no gap at all, which is the ordinary answer. The caller freezes on
+     * `true` and defers on `false`; the frame is refused either way.
+     */
+    selfChainGapExpired(agentName: string, sessionId: string, graceMs: number, now?: number): boolean;
+    /** Age of this session's open self-chain gap, for the log line. `null` when there is no gap. */
+    selfChainGapAgeMs(agentName: string, sessionId: string, now?: number): number | null;
+    /**
+     * DOD-M15-SELFCHAIN-GAP-1 — **THE ESCALATION DECISION, kept beside the state it reads.**
+     *
+     * `true` freezes the session, `false` defers. Called only after a `self_chain_mismatch`, so the
+     * gap this reads was opened by the verify call that produced that verdict.
+     *
+     * ⚠️ THE DEFERRAL IS LOGGED, and that is not decoration. A silent wait is indistinguishable from
+     * the self-chain check not running at all, which is exactly the state this milestone spent a day
+     * failing to tell apart. The frame is REFUSED either way — the caller has already done that — so
+     * nothing enters the transcript on evidence this side cannot check.
+     */
+    noteSelfChainGapAndShouldFreeze(agentName: string, sessionId: string, correlationId?: string): boolean;
+    noteReceivedFromCounterparty(agentName: string, sessionId: string, contentHash: Uint8Array): void;
+}
+//# sourceMappingURL=authorship-verification.d.ts.map

package/dist/authorship-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorship-verification.d.ts","sourceRoot":"","sources":["../src/authorship-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,OAAO,EACL,KAAK,iBAAiB,EASvB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC;IAC7E,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACjE,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACrF,2EAA2E;IAC3E,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAClF;;;;;;OAMG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CACnH;AAED,qBAAa,kBAAkB;;gBAGjB,GAAG,EAAE,iBAAiB;IA2BpC;;;;;;;;;;;;;;SAcK;IACH,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,UAAU,EAC1B,eAAe,EAAE,UAAU,EAC3B,WAAW,EAAE,UAAU,GACtB,iBAAiB;IAkRpB;;;;;OAKG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAK7G,gGAAgG;IAChG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI;IAKhG;;;;;;;;;;OAUG;IACH,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO;IAoCxG,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI;CA0JhG"}