@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/signaling-connect.js

@@ -0,0 +1,538 @@
+/**
+ * M7 Keystone (Part 2) — production `signalingConnect` for the daemon.
+ *
+ * This is the daemon's directory-facing dialer. It establishes ONE authenticated
+ * signaling stream to a directory node and returns it as a transport
+ * `ConnectResult`. The transport `SignalingManager` owns everything after connect:
+ * heartbeat, reconnect (it calls connect() again on a fresh attempt), the outbound
+ * queue, and optional manifest polling.
+ *
+ * The 7-step handshake below is the wire protocol the directory speaks. It is not negotiable from
+ * this side: change a step and registration, the DKG ceremony, and session sealing all break.
+ *
+ * Architecture note (2026-06-11 daemon-transport doc): this is the *directory-facing
+ * node* — one per daemon, signaling only. A FRESH libp2p node (and therefore a fresh
+ * transport key / Peer ID) is created on every connect, which is exactly the
+ * reconnect-rotation behavior the architecture calls for. Per-session data exchange
+ * uses separate ephemeral session nodes, not this node.
+ *
+ * Step-5/6 directory identity verification (the consortium-manifest "directory proves
+ * itself back" hardening) is OPTIONAL here: it runs only when a `challengeVerifier`
+ * is supplied. M6 ran with it off (challengeVerifier = null) and connected fine; the
+ * hardening layers on later without changing this path.
+ *
+ * Crypto reference: agent→directory auth signs SHA-256(domain ‖ nonce ‖ pubkey) with
+ * the agent's K_local Ed25519 key (RFC 8032). K_local never leaves the KeyProvider.
+ */
+import { createHash } from "node:crypto";
+import { decode } from "cbor-x";
+import { encodeCbor } from "@cello-protocol/protocol-types";
+import * as lp from "it-length-prefixed";
+import { createNode, buildStep5Tbs, } from "@cello-protocol/transport";
+import { extractErrorMessage } from "./error-message.js";
+const SIGNALING_PROTOCOL_ID = "/cello/signaling/1.0.0";
+const AUTH_DOMAIN_DIR = "CELLO-DIR-AUTH-v1";
+const AUTH_TIMEOUT_MS = 5_000;
+function toU8(v) {
+    if (v instanceof Uint8Array)
+        return v;
+    if (Buffer.isBuffer(v))
+        return new Uint8Array(v);
+    if (typeof v.slice === "function") {
+        return v.slice();
+    }
+    throw new Error(`expected bytes, got ${typeof v}`);
+}
+function errMsg(err) {
+    return extractErrorMessage(err);
+}
+async function nextWithTimeout(iter, timeoutMs) {
+    return Promise.race([
+        iter.next(),
+        new Promise((_, reject) => setTimeout(() => reject(new Error("auth_timeout")), timeoutMs)),
+    ]);
+}
+async function safeStop(node) {
+    try {
+        await node.stop();
+    }
+    catch {
+        /* best-effort teardown */
+    }
+}
+/**
+ * DOD-M15-STEP6-REPLAY-1 — how far out of date a directory identity proof may be.
+ *
+ * ±5 minutes: wide enough for ordinary clock skew between an operator's machine and a directory
+ * node without requiring either to be time-synced, narrow enough that a captured proof stops being
+ * useful in minutes rather than never. An UNPARSEABLE timestamp is treated as out of window — the
+ * NaN-comparison lesson from the manifest gate, where `new Date("nonsense") <= x` is false and a
+ * garbage value sailed through a check that looked like it covered it.
+ */
+const IDENTITY_PROOF_MAX_SKEW_MS = 5 * 60_000;
+/**
+ * Parse signaling_auth_ok's optional `relay_endpoints` field. Per-entry strict:
+ * a malformed entry is dropped (auth must never fail on a bad hint), a valid one
+ * survives. Returns [] when the field is absent or not an array.
+ */
+function parseRelayEndpoints(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        if (typeof entry !== "object" || entry === null)
+            continue;
+        const e = entry;
+        const peerId = e["peer_id"];
+        const multiaddrs = e["multiaddrs"];
+        if (typeof peerId !== "string" || peerId.length === 0)
+            continue;
+        if (!Array.isArray(multiaddrs) || multiaddrs.length === 0)
+            continue;
+        if (!multiaddrs.every((a) => typeof a === "string" && a.length > 0))
+            continue;
+        out.push({ peerId, addrs: multiaddrs });
+    }
+    return out;
+}
+/**
+ * Build a production `signalingConnect` for `DaemonConfig.signalingConnect`.
+ *
+ * The returned function performs one full connect attempt. It throws on any failure
+ * (no endpoint, no identity, dial failure, auth rejection, challenge failure); the
+ * transport SignalingManager catches the throw and schedules a reconnect.
+ */
+export function createSignalingConnect(deps) {
+    /**
+     * DOD-M15-DIRAUTH-1 — directory peers already told about a skipped identity check.
+     *
+     * Mirrors `consortium-bootstrap`'s `lapsedMembershipReportedFor` idiom: the fact is about a PEER,
+     * not about a connection, so reporting it per connection says the same true thing ~48 times an
+     * hour forever. Keyed on the peer this daemon DIALLED — never on the peer's own claim about
+     * itself, which on this path is precisely the thing that was not verified.
+     *
+     * ⚠️ SCOPED TO THE FACTORY, not the module. A module-level set is shared by every daemon wiring in
+     * the process and never resets, which makes the suppression outlive the thing it describes and
+     * makes test order load-bearing — my first version did exactly that and a later test silently lost
+     * its warning to an earlier one.
+     */
+    const authSkipReportedFor = new Set();
+    return async function connect() {
+        const endpoint = await deps.getDirectoryEndpoint();
+        if (!endpoint) {
+            throw new Error("directory_endpoint_unknown");
+        }
+        const identity = deps.getAuthIdentity();
+        if (!identity) {
+            throw new Error("no_agent_identity");
+        }
+        // Fresh directory-facing node per connect → fresh transport key / Peer ID.
+        //
+        // DOD-NAT-REACHABILITY-1: relayServer disabled, and the opt-out is NOT made redundant by this
+        // node listening on nothing (see below). Leaving `nodeType` unset takes the service-node
+        // default, which adds `circuitRelayServer` to the service map and advertises HOP — and HOP is
+        // advertised over connections WE opened, not only over ones we accept. A node with no listener
+        // still holds a live outbound connection to the directory.
+        //
+        // (This comment described the node as "bound on 0.0.0.0" until DOD-M15-SURFACE-1 removed the
+        // binding. Rewritten rather than deleted: the constraint it records is still load-bearing, and
+        // leaving it in past tense put two comments in one expression contradicting each other about
+        // the exact fact this unit changed — which is how the binding gets "restored" by a later
+        // session that stops reading at the first one.)
+        const node = deps.createDirectoryNode
+            ? await deps.createDirectoryNode(identity.keyProvider)
+            : await createNode({
+                keyProvider: identity.keyProvider,
+                /**
+                 * DOD-M15-SURFACE-1 — LISTEN ON NOTHING. This node had a real open port on every
+                 * interface, for no reason.
+                 *
+                 * It bound `/ip4/0.0.0.0/tcp/0` while registering **no protocol handler at all**, and the
+                 * directory never dials a client — every directory connection is one this daemon opened.
+                 * So the port accepted connections that could reach no CELLO protocol, on an operator's
+                 * machine, for the life of the daemon. Not listening is strictly stronger than filtering
+                 * who may connect: there is no socket, nothing to scan, and nothing to gate. (A
+                 * `DirectoryConnectionGater` exists for the filtering approach and is constructed only in
+                 * tests — it is the consolation prize, not the fix.)
+                 *
+                 * FALSIFIED BEFORE REMOVING, because `listenAddresses()` IS sent to the directory at step
+                 * 7 below, in `peer_info_announce`, under a comment saying it is so the directory can
+                 * broker sessions. Traced to the consumer: the directory stores it and its own code says
+                 * this address is *"its per-agent DIRECTORY node, NOT its standing-receiver session node,
+                 * so it is NOT a valid content endpoint (using it yields 'could not negotiate
+                 * /cello/content')"*. A counterparty's session endpoint reaches the other side through the
+                 * `session_offer` → `session_offer_accept` round-trip, never through this announce. No
+                 * client reads `participant_a/b.multiaddrs` at all.
+                 *
+                 * The announce still matters and still happens: `#peerInfoAnnounced` gates `session_request`
+                 * on the directory side, and it is set by the frame ARRIVING, not by what is in it. The
+                 * peer id still goes with it, and a peer id needs no listener.
+                 *
+                 * INBOUND SESSIONS ARE UNAFFECTED. They arrive on the standing receiver, which is a
+                 * different node and keeps its socket deliberately (relay-audit Decision 2 — it is
+                 * load-bearing for same-machine and same-LAN sessions).
+                 */
+                listenAddresses: [],
+                relayServer: { enabled: false },
+                // Same reason as relayServer above: this is a CLIENT node that leaves nodeType unset, so
+                // the service-node default would leave the AutoNAT responder on -- and answering one
+                // dial-back tears down this very connection, killing signaling mid-registration.
+                autonatResponder: { enabled: false },
+            });
+        let sigStream;
+        try {
+            // L1: start() is inside the try so a start failure is caught and the
+            // partially-started node is torn down (safeStop) rather than leaked.
+            await node.start();
+            if (endpoint.multiaddr) {
+                // Best-effort dial; newStream below surfaces the real failure if unreachable.
+                try {
+                    await node.dial(endpoint.multiaddr);
+                }
+                catch (dialErr) {
+                    // L2: non-fatal (dial-by-peerId may still work / already connected), but
+                    // keep the real reason — newStream's error is generic.
+                    deps.logger.debug("directory.dial.failed", {
+                        multiaddr: endpoint.multiaddr,
+                        error: errMsg(dialErr),
+                    });
+                }
+            }
+            sigStream = await node.newStream(endpoint.peerId, SIGNALING_PROTOCOL_ID);
+        }
+        catch (err) {
+            await safeStop(node);
+            throw new Error(`directory_dial_failed: ${errMsg(err)}`);
+        }
+        const iter = lp.decode(sigStream)[Symbol.asyncIterator]();
+        try {
+            // ── Steps 1-2: receive the directory's auth challenge (32-byte nonce) ──
+            const challenge = await nextWithTimeout(iter, AUTH_TIMEOUT_MS);
+            if (challenge.done || challenge.value === undefined)
+                throw new Error("directory_auth_no_challenge");
+            const challengeFrame = decode(toU8(challenge.value));
+            if (challengeFrame["type"] !== "signaling_auth_challenge") {
+                throw new Error(`directory_auth_unexpected_frame: ${String(challengeFrame["type"])}`);
+            }
+            const nonce = toU8(challengeFrame["nonce"]);
+            if (nonce.length !== 32)
+                throw new Error("directory_auth_bad_nonce");
+            // ── Steps 3-4: sign SHA-256(domain ‖ nonce ‖ pubkey), send auth response ──
+            const myPubkey = Buffer.from(identity.pubkeyHex, "hex");
+            const domain = Buffer.from(AUTH_DOMAIN_DIR, "utf8");
+            const authMsg = new Uint8Array(Buffer.concat([domain, nonce, myPubkey]));
+            const msgHash = new Uint8Array(createHash("sha256").update(authMsg).digest());
+            const sig = await identity.keyProvider.sign(msgHash);
+            const authResponse = encodeCbor({
+                type: "signaling_auth_response",
+                pubkey: myPubkey,
+                signature: sig,
+                // Cross-node item 3: only the transient visiting connection sets this; home connections omit it.
+                ...(deps.visiting ? { visiting: true } : {}),
+            });
+            sigStream.send(lp.encode.single(authResponse));
+            // ── Step 5: receive signaling_auth_ok ──
+            const ack = await nextWithTimeout(iter, AUTH_TIMEOUT_MS);
+            if (ack.done || ack.value === undefined)
+                throw new Error("directory_auth_no_ack");
+            const ackFrame = decode(toU8(ack.value));
+            if (ackFrame["type"] !== "signaling_auth_ok") {
+                throw new Error(`directory_auth_rejected: ${String(ackFrame["type"])}`);
+            }
+            // ── Step 6 (optional hardening): verify the directory's identity proof ──
+            // Runs only when a challengeVerifier is configured. M6 ran without one.
+            let directoryNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : endpoint.peerId;
+            const verifier = deps.challengeVerifier;
+            if (!verifier) {
+                /**
+                 * DOD-M15-DIRAUTH-1 — **A DISARMED CHECK MUST NOT LOOK LIKE A HEALTHY ONE.**
+                 *
+                 * With no verifier configured, step 6 does not run at all: this daemon takes the
+                 * directory's word for which directory it is. Until now the only trace of that was
+                 * `verified: false` — a boolean field inside the **info** line at the bottom of a successful
+                 * connect. Every other connect logged the same event at the same level, so the disarmed
+                 * state and the enforced state were distinguishable only by reading one field of one line,
+                 * which nothing alerts on and no operator reads.
+                 *
+                 * ⚠️ THIS IS NOT THE FIX AND MUST NOT BE MISTAKEN FOR ONE — this entry's own conclusion is
+                 * that **a log is not a control**, and a WARN is still a log. What it buys is that the
+                 * absence has a name and a level of its own, so "authentication is off" can be seen without
+                 * knowing to look for it. The control is `CELLO_REQUIRE_DIRECTORY_AUTH`, which refuses at
+                 * startup; this is what tells an operator who has not set it what they are running.
+                 */
+                /**
+                 * ⚠️ ONCE PER DIRECTORY, NOT ONCE PER CONNECT — review F3, and the number is the argument.
+                 * The signaling stream turns over roughly every 70 seconds and reconnects forever, so a
+                 * per-connect WARN is ~48 an hour PER AGENT, indefinitely, and the daemon's stdout logger
+                 * has no level filtering. Three agents is ~3,400 identical lines a day. **A signal that
+                 * fires on the normal case is not a signal** — this repo's own rule — and it would bury the
+                 * public-directory case this exists to raise.
+                 *
+                 * ⚠️ AND THE FIELD IS NAMED FOR WHAT IT IS — review F4. On this path `directoryNodeId` is
+                 * `ackFrame["nodeId"]`: a string the REMOTE sent about itself, with nothing checked. Printing
+                 * it under that name inside a line whose whole subject is *"we did not check which directory
+                 * this is"* presents the peer's own answer as the answer. `dialedPeerId` sits beside it as
+                 * the thing this daemon actually chose.
+                 */
+                const claimedNodeId = typeof ackFrame["nodeId"] === "string" ? ackFrame["nodeId"] : null;
+                if (!authSkipReportedFor.has(endpoint.peerId)) {
+                    authSkipReportedFor.add(endpoint.peerId);
+                    deps.logger.warn("directory.auth.skipped", {
+                        dialedPeerId: endpoint.peerId,
+                        claimedNodeId,
+                        agentPubkey: identity.pubkeyHex,
+                        impact: "no directory identity verifier is configured, so this connection did NOT check which " +
+                            "directory it reached — the peer's claim of its own identity was accepted as given. " +
+                            "Set CELLO_CONSORTIUM_ROOT_KEYS (with CELLO_CONSORTIUM_THRESHOLD) to enable " +
+                            "verification, or CELLO_REQUIRE_DIRECTORY_AUTH=1 to refuse at startup instead of " +
+                            "connecting unverified. Reported ONCE per directory peer, not per reconnect.",
+                    });
+                }
+            }
+            if (verifier) {
+                const nodeId = ackFrame["nodeId"];
+                const signature = ackFrame["signature"];
+                const timestamp = ackFrame["timestamp"];
+                if (!nodeId || !signature || !timestamp) {
+                    deps.logger.error("directory.auth.challenge.failed", { reason: "no_identity_proof" });
+                    throw new Error("directory_challenge_no_identity_proof");
+                }
+                const tbsBytes = buildStep5Tbs({
+                    nodeId,
+                    agentPubkeyHex: identity.pubkeyHex,
+                    nonceHex: Buffer.from(nonce).toString("hex"),
+                    isoTimestamp: timestamp,
+                });
+                const result = verifier.verifyChallenge(nodeId, tbsBytes, signature);
+                if (!result.valid) {
+                    deps.logger.error("directory.auth.challenge.failed", { directoryNodeId: nodeId, reason: result.reason });
+                    throw new Error(`directory_challenge_failed: ${result.reason}`);
+                }
+                /**
+                 * DOD-M15-STEP6-REPLAY-1 — A VALID SIGNATURE IS NOT A FRESH ONE.
+                 *
+                 * The TBS covers `nodeId ‖ agent pubkey ‖ nonce ‖ timestamp`, and until this check the
+                 * client verified the signature over that tuple and looked at **neither** the timestamp nor
+                 * the nonce. So **any party that once obtained a valid tuple for this agent could replay it
+                 * indefinitely.**
+                 *
+                 * ─── WHY THE NONCE CANNOT CARRY THE FRESHNESS, WHICH IS THE PART THAT SURPRISED ME ──────
+                 *
+                 * The obvious answer is "check the nonce is the one we just sent". **We did not send it.**
+                 * The nonce here is `challengeFrame["nonce"]` — the DIRECTORY's own, from step 1-2. The
+                 * client contributes no fresh value to this exchange at all, so it holds nothing of its own
+                 * to bind against. A replaying party simply replays the captured nonce in step 2 and the
+                 * captured ack in step 5, and both halves agree.
+                 *
+                 * **That leaves the timestamp as the only freshness anchor**, and it is a real one: it is
+                 * inside the signed bytes, so a replayer cannot move it without invalidating the signature
+                 * they are replaying.
+                 *
+                 * ─── AFTER the signature, deliberately ─────────────────────────────────────────────────
+                 *
+                 * A stale proof and a forged one are different facts and must not collapse into one
+                 * message. Checking freshness only once the signature verifies means `identity_proof_stale`
+                 * always describes a GENUINE proof that is too old — never a forgery — which is what makes
+                 * it diagnostic rather than another exit-point label.
+                 *
+                 * **The window, and what it does NOT fix.** ±5 minutes tolerates ordinary client/directory
+                 * clock skew without a time-sync dependency. It BOUNDS replay to that window; it does not
+                 * eliminate it, because with no client-chosen nonce there is nothing to make a proof
+                 * single-use. Closing the remainder needs either a client contribution in the challenge or a
+                 * seen-nonce cache — both wire or state changes, and neither is this line.
+                 */
+                const proofMs = Date.parse(timestamp);
+                const skewMs = Number.isFinite(proofMs) ? Math.abs(Date.now() - proofMs) : Number.NaN;
+                if (!Number.isFinite(skewMs) || skewMs > IDENTITY_PROOF_MAX_SKEW_MS) {
+                    deps.logger.error("directory.auth.challenge.failed", {
+                        directoryNodeId: nodeId,
+                        reason: "identity_proof_stale",
+                        timestamp,
+                        skewMs: Number.isFinite(skewMs) ? Math.round(skewMs) : null,
+                        maxSkewMs: IDENTITY_PROOF_MAX_SKEW_MS,
+                        detail: "the directory's identity proof carries a valid signature over a timestamp outside the " +
+                            "freshness window — either a replayed proof, or a clock that is badly out on one side.",
+                    });
+                    throw new Error("directory_challenge_failed: identity_proof_stale");
+                }
+                directoryNodeId = nodeId;
+                deps.logger.info("directory.auth.challenge.verified", { directoryNodeId, skewMs: Math.round(skewMs) });
+            }
+            // DOD-NAT-REACHABILITY-1 (Phase 2): the directory's relay pool rides
+            // signaling_auth_ok, so an agent knows WHERE it could reserve before any
+            // session exists. 056-SLOTDEAD: it used to say the receiver reserves here;
+            // since 055-ONDEMAND this is a candidate list and the slot is taken at
+            // offer time. Surfaced via callback; parse failures drop entries, never
+            // the handshake.
+            if (deps.onRelayEndpoints) {
+                const endpoints = parseRelayEndpoints(ackFrame["relay_endpoints"]);
+                if (endpoints.length > 0) {
+                    deps.logger.info("directory.relay_endpoints.received", {
+                        directoryNodeId,
+                        relayPeerIds: endpoints.map((e) => e.peerId),
+                    });
+                    deps.onRelayEndpoints(endpoints);
+                }
+            }
+            /**
+             * DOD-M15-RELAYSLOTS-1: the online token rides the same frame as the relay pool above, for
+             * the same reason — a standing receiver needs both before any session exists: WHERE to ask
+             * for a reservation slot, and the credential that lets it keep one.
+             *
+             * A field of the wrong type is dropped rather than failing the handshake, exactly as a
+             * malformed relay endpoint is. The consequence is bounded and visible (this agent gets no
+             * slot on any relay, and the relay names the reason when it refuses), whereas failing the
+             * handshake would also cost session offers, which arrive on this same stream.
+             */
+            if (deps.onOnlineToken) {
+                const raw = ackFrame["online_token"];
+                const token = raw instanceof Uint8Array ? raw : Buffer.isBuffer(raw) ? new Uint8Array(raw) : undefined;
+                if (token && token.length > 0) {
+                    deps.logger.info("directory.online_token.received", { directoryNodeId, bytes: token.length });
+                    deps.onOnlineToken(token);
+                }
+                else {
+                    /**
+                     * Review M1: the directory names WHICH absence, so this is no longer one label for three
+                     * different problems. `not_registered_here` in particular is a payload fact, and reporting
+                     * it as a generic "no token" sent the operator to check a directory connection that is
+                     * working perfectly.
+                     */
+                    const raw = ackFrame["online_token_absent_reason"];
+                    const absentReason = raw === "not_registered_here" || raw === "issue_failed" ? raw : undefined;
+                    deps.onOnlineTokenAbsent?.(absentReason);
+                    deps.logger.warn("directory.online_token.absent", {
+                        directoryNodeId,
+                        agentPubkey: identity.pubkeyHex,
+                        reason: absentReason ?? "unstated",
+                        impact: absentReason === "not_registered_here"
+                            ? "this directory holds no agent profile for this key, so it issued no online token " +
+                                "and no relay will grant this agent a reservation. The directory connection is FINE " +
+                                "— either this agent registered against a different sovereign node and its profile " +
+                                "has not replicated here yet, or it is not registered at all."
+                            : absentReason === "issue_failed"
+                                ? "this directory could not issue an online token — its own lookup or signing failed. " +
+                                    "That is a fault on the directory, not on this agent or on any relay."
+                                : "this directory issued no online token, so no relay will let this agent hold a " +
+                                    "circuit reservation and it will be reachable only over a direct connection. It " +
+                                    "stated no reason, which means it predates the token.",
+                    });
+                }
+            }
+            // ── Step 7: announce our peer info so the directory can broker sessions ──
+            const peerInfo = encodeCbor({
+                type: "peer_info_announce",
+                peer_id: node.getPeerId(),
+                multiaddrs: node.listenAddresses(),
+            });
+            sigStream.send(lp.encode.single(peerInfo));
+            /**
+             * ⚠️ **RENAMED FROM `directory.signaling.connected` — 058-LOGNAME, AND THE OLD NAME COST AN
+             * HOUR OF THE WRONG INVESTIGATION.**
+             *
+             * `SignalingManager.runConnectedPhase` logs `directory.signaling.connected` too, for a
+             * different fact: the manager has entered the connected STATE, carrying `manifestVersion`.
+             * This line is about the HANDSHAKE — who it was for, and whether the directory's challenge
+             * verified. Two meanings, one name, emitted in the same millisecond, so the event could not be
+             * counted at all.
+             *
+             * What that cost, concretely: reading 361 `directory.signaling.connected` in 90 minutes off a
+             * real daemon and spending an hour on connection churn, when the number was doubled by this
+             * collision and the actual defect was a credential that never refreshed (057-STALECRED).
+             *
+             * Keep them distinct. `connected` is the transport's state transition; `authenticated` is this
+             * — the daemon's per-agent handshake result, and the only one of the two that knows WHO.
+             */
+            deps.logger.info("directory.signaling.authenticated", {
+                directoryNodeId,
+                agentPubkey: identity.pubkeyHex,
+                verified: !!verifier,
+            });
+            // Publish the live, directory-connected node so registration/FROST/seal can
+            // open further streams to the directory on the same node.
+            deps.publishNode?.(node);
+            const stream = wrapSignalingStream(sigStream, iter, node, deps.logger, deps.publishNode);
+            return {
+                stream,
+                directoryNodeId,
+                manifestVersion: deps.getManifestVersion?.() ?? 0,
+            };
+        }
+        catch (err) {
+            // Symmetry with publishNode(node): if anything threw after we published (or in a
+            // reconnect attempt), clear the daemon's reference so it never points at a node
+            // we're about to stop. No-op when nothing was published this attempt.
+            deps.publishNode?.(null);
+            try {
+                sigStream.abort(new Error("directory_auth_error"));
+            }
+            catch {
+                /* stream may already be torn down */
+            }
+            await safeStop(node);
+            throw err instanceof Error ? err : new Error(errMsg(err));
+        }
+    };
+}
+/**
+ * Adapt the post-handshake libp2p stream to the transport `SignalingStream`
+ * interface the SignalingManager drives. Frames are CBOR objects; the wire is
+ * length-prefixed CBOR, matching the directory and the M6 client exactly.
+ *
+ * The read loop continues from the SAME iterator the handshake used, so no inbound
+ * frame is dropped between auth_ok and the manager registering its handler.
+ */
+function wrapSignalingStream(sigStream, iter, node, logger, publishNode) {
+    let closed = false;
+    return {
+        async send(frame) {
+            const encoded = encodeCbor(frame);
+            sigStream.send(lp.encode.single(encoded));
+        },
+        onMessage(handler) {
+            void (async () => {
+                try {
+                    for (;;) {
+                        const { value, done } = await iter.next();
+                        if (done || value === undefined)
+                            break;
+                        let frame;
+                        try {
+                            frame = decode(toU8(value));
+                        }
+                        catch {
+                            // Skip undecodable frames rather than killing the whole stream.
+                            continue;
+                        }
+                        handler(frame);
+                    }
+                    logger.debug("directory.signaling.stream.ended", { expected: true });
+                }
+                catch (err) {
+                    // M8C-ONBOARD-LOGNOISE-1 (F11): routine reconnect churn (the reader loop ends when the
+                    // directory rotates/drops the stream, ~every 40–70 min, and the caller reconnects). At
+                    // `warn` a healthy daemon looked like it was failing. Log it quietly + marked expected; a
+                    // genuine SUSTAINED outage still stands out via the `reconnecting`→`lost` state escalation
+                    // (getAgentSignaling retry budget), which is unchanged.
+                    logger.debug("directory.signaling.reader.error", { error: errMsg(err), expected: true });
+                }
+            })();
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            // Clear the daemon's reference before tearing the node down — registration/
+            // FROST/seal must not use a node that is being stopped.
+            publishNode?.(null);
+            try {
+                sigStream.abort(new Error("signaling_closed"));
+            }
+            catch {
+                /* already closed */
+            }
+            void safeStop(node);
+        },
+    };
+}
+//# sourceMappingURL=signaling-connect.js.map

package/dist/signaling-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signaling-connect.js","sourceRoot":"","sources":["../src/signaling-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEzC,OAAO,EACL,UAAU,EACV,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AACvD,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC3D,OAAQ,CAA6B,CAAC,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,eAAe,CAAI,IAAsB,EAAE,SAAiB;IACzE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,EAAE;QACX,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KAClG,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,0BAA0B,GAAG,CAAC,GAAG,MAAM,CAAC;AAmF9C;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,GAAG,GAA+C,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,SAAS;QAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D;;;;;;;;;;;;OAYG;IACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,OAAO,KAAK,UAAU,OAAO;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QAED,2EAA2E;QAC3E,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,8FAA8F;QAC9F,+FAA+F;QAC/F,2DAA2D;QAC3D,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,gDAAgD;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB;YACnC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtD,CAAC,CAAC,MAAM,UAAU,CAAC;gBACf,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA4BG;gBACH,eAAe,EAAE,EAAE;gBACnB,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/B,yFAAyF;gBACzF,qFAAqF;gBACrF,iFAAiF;gBACjF,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;aACrC,CAAC,CAAC;QAEP,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,8EAA8E;gBAC9E,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,OAAgB,EAAE,CAAC;oBAC1B,yEAAyE;oBACzE,uDAAuD;oBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;wBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;qBACvB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAA4B,CAAC,MAAM,CAAC,aAAa,CAAC,EAA+B,CAAC;QAEnH,IAAI,CAAC;YACH,0EAA0E;YAC1E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACpG,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAA4B,CAAC;YAChF,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,0BAA0B,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAErE,6EAA6E;YAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,UAAU,CAAC;gBAC9B,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,GAAG;gBACd,iGAAiG;gBACjG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YAE/C,0CAA0C;YAC1C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACzD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAClF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAA4B,CAAC;YACpE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,eAAe,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd;;;;;;;;;;;;;;;mBAeG;gBACH;;;;;;;;;;;;;mBAaG;gBACH,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACrG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;wBACzC,YAAY,EAAE,QAAQ,CAAC,MAAM;wBAC7B,aAAa;wBACb,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EACJ,uFAAuF;4BACvF,qFAAqF;4BACrF,6EAA6E;4BAC7E,kFAAkF;4BAClF,6EAA6E;qBAChF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;gBACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAuB,CAAC;gBAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACtF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,QAAQ,GAAG,aAAa,CAAC;oBAC7B,MAAM;oBACN,cAAc,EAAE,QAAQ,CAAC,SAAS;oBAClC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAC5C,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;oBACzG,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,CAAC;gBACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAgCG;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,0BAA0B,EAAE,CAAC;oBACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;wBACnD,eAAe,EAAE,MAAM;wBACvB,MAAM,EAAE,sBAAsB;wBAC9B,SAAS;wBACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC3D,SAAS,EAAE,0BAA0B;wBACrC,MAAM,EACJ,wFAAwF;4BACxF,uFAAuF;qBAC1F,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,uEAAuE;YACvE,wEAAwE;YACxE,iBAAiB;YACjB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;wBACrD,eAAe;wBACf,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;qBAC7C,CAAC,CAAC;oBACH,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,GAAG,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACvG,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN;;;;;uBAKG;oBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,4BAA4B,CAAC,CAAC;oBACnD,MAAM,YAAY,GAAG,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/F,IAAI,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBAChD,eAAe;wBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;wBAC/B,MAAM,EAAE,YAAY,IAAI,UAAU;wBAClC,MAAM,EAAE,YAAY,KAAK,qBAAqB;4BAC5C,CAAC,CAAC,mFAAmF;gCACnF,qFAAqF;gCACrF,oFAAoF;gCACpF,8DAA8D;4BAChE,CAAC,CAAC,YAAY,KAAK,cAAc;gCAC/B,CAAC,CAAC,qFAAqF;oCACrF,sEAAsE;gCACxE,CAAC,CAAC,gFAAgF;oCAChF,iFAAiF;oCACjF,sDAAsD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE;aACnC,CAAe,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAE3C;;;;;;;;;;;;;;;;eAgBG;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACpD,eAAe;gBACf,WAAW,EAAE,QAAQ,CAAC,SAAS;gBAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YAEH,4EAA4E;YAC5E,0DAA0D;YAC1D,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YAEzB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACzF,OAAO;gBACL,MAAM;gBACN,eAAe;gBACf,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,iFAAiF;YACjF,gFAAgF;YAChF,sEAAsE;YACtE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,SAAiB,EACjB,IAA+B,EAC/B,IAAe,EACf,MAAc,EACd,WAA8C;IAE9C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAc;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAe,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,OAAiC;YACzC,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,SAAS,CAAC;wBACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC1C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;4BAAE,MAAM;wBACvC,IAAI,KAAc,CAAC;wBACnB,IAAI,CAAC;4BACH,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC9B,CAAC;wBAAC,MAAM,CAAC;4BACP,gEAAgE;4BAChE,SAAS;wBACX,CAAC;wBACD,OAAO,CAAC,KAAK,CAAC,CAAC;oBACjB,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,uFAAuF;oBACvF,0FAA0F;oBAC1F,2FAA2F;oBAC3F,wDAAwD;oBACxD,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3F,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,4EAA4E;YAC5E,wDAAwD;YACxD,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}