@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/gateway-config-handlers.js

@@ -0,0 +1,454 @@
+/**
+ * DOD-M9B-SURFACE-1 — the security layer's control surface (policy D-4).
+ *
+ * The gateway's config store has enforced tighten-free / loosen-confirmed since June 2026, and
+ * NOTHING in the product could ever satisfy the confirmation — there was no CLI, no MCP tool, no
+ * portal page. A `confirmed` flag that only tests set is a gate nobody can pass and nobody can
+ * open. These three verbs are the surface, and the confirmation is a human at a terminal.
+ *
+ * INV-10 — WHAT THIS GATE ACTUALLY GUARANTEES, stated honestly (audit finding, 2026-07-29).
+ *
+ * Every loosening flows through the versioned store, and `confirmed` is honored only from a
+ * connection whose declared `clientType` is exactly `cli` — an MCP caller, or one that never
+ * handshook at all, is refused with the command a human must run.
+ *
+ * **That is not an authentication boundary, and it must not be described as one.** `clientType` is
+ * SELF-DECLARED: the daemon records whatever string arrives in `ipc.connect`. Any process running
+ * as the operator can open `~/.cello/daemon.sock` (mode 0600), announce `clientType: "cli"`, and
+ * pass `confirmed: true`. That includes an agent with a shell tool. The TTY check that represents
+ * the human lives in the CLI process (`confirmAtTty`), and the daemon has no way to verify it —
+ * a same-uid process is indistinguishable from the operator by any local mechanism, so no amount
+ * of daemon-side checking closes this.
+ *
+ * What it therefore DOES do, which is worth having: it removes every path an agent reaches by
+ * ORDINARY means — the MCP tools it is given, and the CLI it can invoke (which refuses on a
+ * non-TTY stdin). An agent must go out of its way, speaking raw IPC and misrepresenting itself,
+ * and that is a different and much louder act than calling a tool it was handed.
+ *
+ * The real boundary is the one D-4 already names as the destination: the portal passkey. A
+ * confirmation the operator performs on a surface the local machine cannot forge is the only thing
+ * that makes "and nothing else produces this flag" true. Until then, this is a friction gate with
+ * a versioned, hash-chained audit trail — not a lock.
+ *
+ * STORE HANDLES ARE HELD OPEN FOR THE PROCESS LIFETIME. They were originally opened per call, on
+ * the reasoning that config commands are rare and a second long-lived handle buys only lock
+ * contention. That was wrong, and it cost the entire audit trail — proven against the shipped
+ * daemon on 2026-07-29:
+ *
+ *   1. sidecar screens a message  -> record written, visible, `-wal` present
+ *   2. a reader opens and CLOSES  -> `-wal`/`-shm` unlinked out from under the sidecar
+ *   3. sidecar screens again      -> the write lands in the now-orphaned WAL
+ *   4. a fresh reader sees        -> only the FIRST record. Everything after step 2 is lost.
+ *
+ * PRECISION ADDED 2026-07-30 (review M1): step 2 only unlinks when that reader is the LAST
+ * connection open — a non-last close is harmless, which is measurable in one script. The reason the
+ * live sequence hit it anyway is `cello config set`, which SIGTERMs the sidecar to apply the change:
+ * during the restart the per-call handle IS the last one. Do not soften the rule below on the
+ * strength of the correction — "only sometimes destroys the audit trail" is not a design.
+ *
+ * So `cello policy log` and `cello config list` — the surfaces that exist to show what the layer
+ * did — were silently destroying the record of what it did next. Holding the handle open means no
+ * connection ever performs the last-connection close while the sidecar is alive, which is the
+ * event that removes the WAL. The handles are deliberately not closed per call; process exit
+ * releases them, and the sidecar is torn down before the daemon exits (INV-9 shutdown ordering).
+ */
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { GatewayConfigStore, GatewayRecordStore } from "@cello-protocol/gateway";
+import { SCRIPTS, isScript } from "@cello-protocol/gateway";
+import { dbKeyPathFor } from "./sqlcipher-db.js";
+import { extractErrorMessage } from "./error-message.js";
+/** The keys the gateway reads. Kept here so the surface can list them without a store open. */
+export const GATEWAY_CONFIG_KEYS = [
+    "autonomous_override",
+    "pii_whitelist",
+    "language_allow",
+    "language_enforce",
+    "rate_max_per_window",
+    "rate_window_ms",
+];
+/** What each key controls, in the words an operator needs to decide whether to change it. */
+const KEY_HELP = {
+    autonomous_override: "whether the agent may send a flagged value with no human present",
+    pii_whitelist: "values (e.g. your own email) that pass outbound without a warning",
+    language_allow: "which scripts count as your languages (latin, cyrillic, greek, arabic, hebrew, han, kana, hangul, devanagari, thai) — only used when language_enforce is on",
+    language_enforce: "refuse mail outside your languages instead of delivering it with a note (default: off)",
+    rate_max_per_window: "how many outbound messages are allowed per window (0 = no cap)",
+    rate_window_ms: "the window the outbound cap applies to, in milliseconds",
+};
+/** Parse a wire value into the type the store's validator expects for that key. */
+function coerce(key, raw) {
+    if (key === "autonomous_override" || key === "language_enforce") {
+        if (typeof raw === "boolean")
+            return { ok: true, value: raw };
+        if (raw === "true" || raw === "false")
+            return { ok: true, value: raw === "true" };
+        return { ok: false, reason: `${key} is a boolean — pass true or false.` };
+    }
+    if (key === "pii_whitelist" || key === "language_allow") {
+        const asList = Array.isArray(raw) && raw.every((v) => typeof v === "string")
+            ? raw
+            // A comma-separated string is what a CLI argument looks like. An EMPTY string means the empty
+            // list (the tightest value), not [""] — a stray empty member would whitelist nothing but would
+            // read as a loosening in the version history.
+            : typeof raw === "string" ? raw.split(",").map((v) => v.trim()).filter(Boolean) : null;
+        if (asList === null) {
+            return { ok: false, reason: `${key} is a list — pass comma-separated values, or an empty string to clear it.` };
+        }
+        // This branch must mirror the STORE's validator (review F6). It stopped doing so when
+        // language_allow gained real validation, and the operator got the store's raw JSON dump
+        // instead of a sentence naming the valid scripts.
+        if (key === "language_allow") {
+            if (asList.length === 0) {
+                return {
+                    ok: false,
+                    reason: "language_allow cannot be empty. An empty list is not 'accept nothing suspicious' — with " +
+                        "language_enforce on it refuses every language including your own, which silently stops " +
+                        `all mail. Pass the scripts you read, e.g. "latin,greek". Valid: ${SCRIPTS.join(", ")}.`,
+                };
+            }
+            const unknown = asList.filter((v) => !isScript(v));
+            if (unknown.length > 0) {
+                return {
+                    ok: false,
+                    reason: `not a script: ${unknown.join(", ")}. language_allow takes SCRIPTS, not language names — ` +
+                        `Greek is "greek", Japanese is "kana", Chinese is "han". Valid: ${SCRIPTS.join(", ")}.`,
+                };
+            }
+        }
+        return { ok: true, value: asList };
+    }
+    const n = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+    if (!Number.isFinite(n))
+        return { ok: false, reason: `${key} is a number.` };
+    // Mirror the store's own range rules HERE (review F6). Without this, `rate_window_ms 0` reached
+    // the store's validator, which THROWS — and an uncaught throw becomes `internal_error: an
+    // unexpected error occurred, check daemon logs`. The operator asked for something out of range
+    // and was told the daemon broke.
+    if (key === "rate_max_per_window" && n < 0) {
+        return { ok: false, reason: "rate_max_per_window cannot be negative (0 means no cap)." };
+    }
+    if (key === "rate_window_ms" && n <= 0) {
+        return { ok: false, reason: "rate_window_ms must be greater than 0 milliseconds." };
+    }
+    return { ok: true, value: n };
+}
+/**
+ * Map a store-layer throw onto a named cause. An exit-point label on a corrupt security store is
+ * the error-substitution defect this project keeps finding (review F7).
+ */
+function storeFault(message) {
+    if (/SQLITE_CORRUPT|malformed|SQLITE_IOERR/i.test(message)) {
+        return {
+            ok: false,
+            reason: "store_corrupt",
+            guidance: "The security layer's store could not be read — the file is damaged. Screening still runs " +
+                "and still fails closed, but the config history and the audit trail are unreadable. Stop " +
+                `the daemon, move ~/.cello/gateway.db aside, and restart to begin a fresh store. (${message})`,
+        };
+    }
+    if (/SQLITE_BUSY|locked/i.test(message)) {
+        return {
+            ok: false,
+            reason: "store_locked",
+            guidance: "The security layer's store is locked by another process — usually an orphaned gateway " +
+                `from a previous daemon. Stop it and retry. (${message})`,
+        };
+    }
+    return {
+        ok: false,
+        reason: "store_read_failed",
+        guidance: `The security layer's store could not be read. (${message})`,
+    };
+}
+export function registerGatewayConfigHandlers(deps) {
+    const { handlers, celloDir, logger, getClientType, restartSecurityGateway } = deps;
+    // ONE handle, opened lazily, never closed per call — see the header. Never closing means this
+    // handle can never be the last-closer that unlinks the WAL while the sidecar is mid-restart.
+    let configStore;
+    const openStore = () => {
+        if (!configStore) {
+            configStore = new GatewayConfigStore(join(celloDir, "gateway.db"), dbKeyPathFor(join(celloDir, "sessions.db")), 
+            // INV-7: the daemon logs through its injected logger and nowhere else. Without this sink the
+            // store would write raw lines to the daemon's stderr.
+            (event, context) => logger.info(event, context));
+        }
+        return configStore;
+    };
+    let recordStore;
+    const openRecordStore = () => {
+        if (!recordStore) {
+            recordStore = new GatewayRecordStore(join(celloDir, "gateway.db"), dbKeyPathFor(join(celloDir, "sessions.db")), (event, context) => logger.info(event, context));
+        }
+        return recordStore;
+    };
+    /** Every store open can fail closed (missing key, locked file). Report the CAUSE, not a label. */
+    const withStore = (fn) => {
+        let store;
+        try {
+            store = openStore();
+        }
+        catch (err) {
+            const code = err?.code ?? "config_store_unavailable";
+            const guidance = err?.guidance
+                ?? "The security layer's config store could not be opened. Check the daemon log.";
+            // Review M4: LOG IT. This is the worst failure this surface has — the governance store
+            // unopenable, locked, or plaintext — and it used to exist ONLY in a CLI response the operator
+            // may never have run. "Check the daemon log" while writing nothing to the daemon log is a
+            // dead end, and the project's error-path-coverage rule exists for exactly this.
+            logger.error("gateway.config.store_unavailable", {
+                reason: code, error: extractErrorMessage(err), store: "config",
+            });
+            return { ok: false, reason: code, guidance };
+        }
+        try {
+            return fn(store);
+        }
+        catch (err) {
+            // The store validates too, and it THROWS. A validation fault is the caller's input being
+            // wrong, not the daemon being broken — surfacing it as `internal_error` sends the operator
+            // to the logs for a problem they can fix in the command they just typed.
+            const message = extractErrorMessage(err);
+            if (/invalid value for config key|unknown config key/i.test(message)) {
+                return { ok: false, reason: "invalid_value", guidance: message };
+            }
+            // Review F7: a READ that throws used to escape as `internal_error: an unexpected error
+            // occurred, check daemon logs` — sending the operator to the logs for a corrupted security
+            // store, with no remedy named, while the OPEN path carefully produces store_plaintext_file /
+            // store_locked / store_key_mismatch. The read path deserves the same.
+            return storeFault(message);
+        }
+        // NO `finally { store.close() }`. The close is the defect: closed as the last connection during
+        // a sidecar restart, it unlinks the WAL and every record written afterwards is lost.
+    };
+    // Read the whole surface. Shows the GOVERNANCE, not just the value (M9B-D18): after an incident
+    // the question is not "what is this set to" but "who weakened it, and did a human agree".
+    handlers.set("cello_config_list", async () => withStore((store) => ({
+        ok: true,
+        config: GATEWAY_CONFIG_KEYS.map((key) => {
+            const history = store.history(key);
+            const latest = history[history.length - 1];
+            return {
+                key,
+                describes: KEY_HELP[key],
+                // `null`, never a fabricated default: the gateway applies its own tightest default for an
+                // unset key, and echoing that value here would make "never configured" indistinguishable
+                // from "deliberately set to the same value".
+                value: latest ? latest.value : null,
+                version: latest?.version ?? 0,
+                lastChange: latest?.direction ?? null,
+                confirmed: latest?.confirmed ?? false,
+                // WHEN, and whether the version chain still verifies. `list` is the command someone runs
+                // AFTER an incident, and until now it showed neither — so it could not answer "who
+                // weakened this, when, and did a human agree" (review F9 of the earlier pass).
+                changedAt: latest?.changedAt ?? null,
+                // `null` for a key with NO rows, not `true` (review L5). An empty chain verifies
+                // vacuously, and "nothing to verify" must not read the same as "verified intact" on the
+                // one field whose whole job is tamper detection.
+                chainValid: latest ? store.verifyChain(key) : null,
+            };
+        }),
+    })));
+    handlers.set("cello_config_get", async (params) => {
+        const key = typeof params?.key === "string" ? params.key : undefined;
+        if (!key || !GATEWAY_CONFIG_KEYS.includes(key)) {
+            return {
+                ok: false,
+                reason: "unknown_key",
+                guidance: `Provide one of: ${GATEWAY_CONFIG_KEYS.join(", ")}.`,
+            };
+        }
+        return withStore((store) => {
+            const history = store.history(key);
+            const latest = history[history.length - 1];
+            return {
+                ok: true,
+                key,
+                describes: KEY_HELP[key],
+                value: latest ? latest.value : null,
+                version: latest?.version ?? 0,
+                lastChange: latest?.direction ?? null,
+                confirmed: latest?.confirmed ?? false,
+                // Review L4: `get` is the NARROWER, more natural command ("what is autonomous_override
+                // set to?"), and it was the one that could not answer WHEN. Same two fields as `list`.
+                changedAt: latest?.changedAt ?? null,
+                chainValid: latest ? store.verifyChain(key) : null,
+            };
+        });
+    });
+    // DOD-M9B-AUDIT-1 (policy D-11) — "what did my policy do?"
+    //
+    // This ships WITH the enforcement flip, by decision, and not later: it is the concrete answer to
+    // the question D-2 raised — *"I have ongoing development everywhere, and if a new error appears
+    // I won't know whether it came from the flip or from my own work."* Attribution should be a
+    // lookup, not a guess, so every screened message is already recorded with its disposition and
+    // the rule that fired. This reads that record. Deliberately a list, not a dashboard.
+    //
+    // Newest first, because the question is almost always "what just happened".
+    handlers.set("cello_policy_log", async (params) => {
+        const rawLimit = params?.limit;
+        const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0
+            ? Math.min(Math.floor(rawLimit), 500)
+            : 50;
+        const since = typeof params?.since_ms === "number" && Number.isFinite(params.since_ms)
+            ? params.since_ms
+            : undefined;
+        let store;
+        try {
+            store = openRecordStore();
+        }
+        catch (err) {
+            const code = err?.code ?? "record_store_unavailable";
+            const guidance = err?.guidance
+                ?? "The security layer's record store could not be opened. Check the daemon log.";
+            // Review M4, and worse here than for config: an unopenable RECORD store means the audit trail
+            // itself is unreadable, which is the one failure that must never be quiet.
+            logger.error("gateway.config.store_unavailable", {
+                reason: code, error: extractErrorMessage(err), store: "records",
+            });
+            return { ok: false, reason: code, guidance };
+        }
+        try {
+            const all = store.all();
+            const filtered = since === undefined ? all : all.filter((r) => r.recordedAt >= since);
+            const page = filtered.slice(-limit).reverse();
+            return {
+                ok: true,
+                // `source` is here from day one so the reachability half (refusals, tier gates, away
+                // responses — policy audit §15 items 5-8) can join this list later without changing its
+                // shape. A consumer that learns to read one source reads both.
+                entries: page.map((r) => ({
+                    source: "security",
+                    at: r.recordedAt,
+                    direction: r.direction,
+                    disposition: r.disposition,
+                    reason: r.reason ?? null,
+                    correlationId: r.correlationId ?? null,
+                    contentHash: r.contentHash,
+                })),
+                total: filtered.length,
+                returned: page.length,
+                // A broken chain means the log itself was tampered with, which the operator must be told
+                // BEFORE they reason from its contents.
+                chainValid: store.verifyChain(),
+            };
+        }
+        catch (err) {
+            return storeFault(extractErrorMessage(err));
+        }
+    });
+    handlers.set("cello_config_set", async (params, connectionId) => {
+        // One id for the whole fan-out: changed -> applied | restart_failed, AND the restarted sidecar's
+        // own boot lines — the last of those was claimed before it was true (review M2), so the id is now
+        // actually passed to the restart and into the child's environment. This is the multi-event async
+        // flow the project's correlationId rule exists for, and the config path had none because it has
+        // no inbound id to inherit — so mint one (review F12).
+        const correlationId = randomUUID();
+        const key = typeof params?.key === "string" ? params.key : undefined;
+        if (!key || !GATEWAY_CONFIG_KEYS.includes(key)) {
+            return { ok: false, reason: "unknown_key", guidance: `Provide one of: ${GATEWAY_CONFIG_KEYS.join(", ")}.` };
+        }
+        if (!params || !("value" in params)) {
+            return { ok: false, reason: "missing_params", guidance: `Provide 'value' — ${KEY_HELP[key]}.` };
+        }
+        const parsed = coerce(key, params.value);
+        if (!parsed.ok)
+            return { ok: false, reason: "invalid_value", guidance: parsed.reason };
+        // F1 (review, BLOCKING): the permissive side must not be the DEFAULT. `getClientType` returns
+        // undefined for a connection that never sent `ipc.connect`, and the daemon itself defaults a
+        // handshake with no clientType to "cli" — so `!== "mcp"` meant a raw socket write could carry
+        // `confirmed: true` and land a human-confirmed loosening with no human anywhere near it. Ten
+        // lines of node against ~/.cello/daemon.sock was the whole attack.
+        //
+        // And the justification for the original shape was FALSE in the direction that mattered: an
+        // agent running `cello config set …` from a Bash tool gets a NON-TTY stdin and is refused, so
+        // the raw socket was not "the same as just running the CLI" — it was the only route that worked
+        // for a non-human. Now only an EXPLICIT `cli` handshake may confirm; everything else is an
+        // untrusted surface.
+        const clientType = getClientType(connectionId);
+        const surface = clientType === "cli" ? "cli" : clientType === "mcp" ? "mcp" : "unknown";
+        const confirmed = params.confirmed === true;
+        return withStore((store) => {
+            // Ask the store to classify WITHOUT confirmation first. Its classifier is the authority on
+            // what counts as a loosening — re-deriving that here would be a second opinion that drifts.
+            const attempt = store.set(key, parsed.value);
+            if (attempt.ok) {
+                logger.info("gateway.config.changed", {
+                    key, direction: attempt.direction, version: attempt.version, confirmed: false, surface, correlationId,
+                });
+                return applied(key, attempt.direction, attempt.version, false);
+            }
+            // It is a loosening. Three ways to be refused, and they are different failures.
+            if (surface !== "cli") {
+                logger.warn("gateway.config.loosen_refused", { key, surface, reason: "loosen_requires_cli", correlationId });
+                return {
+                    ok: false,
+                    reason: "loosen_requires_cli",
+                    guidance: `Changing '${key}' this way makes the security layer LESS protective, so it needs a ` +
+                        `human at a terminal — an agent cannot weaken its own guards. Ask the operator to run: ` +
+                        `cello config set ${key} ${String(params.value)}`,
+                };
+            }
+            if (!confirmed) {
+                logger.warn("gateway.config.loosen_refused", { key, surface, reason: "needs_confirmation", correlationId });
+                const history = store.history(key);
+                const latest = history[history.length - 1];
+                return {
+                    ok: false,
+                    reason: "needs_confirmation",
+                    direction: "loosen",
+                    // The CURRENT value travels with the refusal (review F7). `set` REPLACES a list, so
+                    // `cello config set pii_whitelist new@x.example` against a five-entry whitelist drops
+                    // four of them — and a prompt that shows only the new value hides that entirely.
+                    // `null` means never configured, i.e. the built-in tightest default applies.
+                    from: latest ? latest.value : null,
+                    guidance: `This makes ${KEY_HELP[key]} LESS restrictive.`,
+                };
+            }
+            const result = store.set(key, parsed.value, { confirmed: true });
+            if (!result.ok) {
+                // The store refused a confirmed loosening — it should not, so do not paper over it.
+                return { ok: false, reason: result.reason, guidance: "The config store rejected a confirmed change. Check the daemon log." };
+            }
+            logger.info("gateway.config.changed", {
+                key, direction: result.direction, version: result.version, confirmed: true, surface, correlationId,
+            });
+            return applied(key, result.direction, result.version, true);
+        });
+        /** Store the change, then make it REAL — the gateway reads config only at boot (M9B-D17). */
+        function applied(k, direction, version, wasConfirmed) {
+            const base = { ok: true, key: k, direction, version, confirmed: wasConfirmed };
+            if (!restartSecurityGateway)
+                return { ...base, applied: false };
+            return restartSecurityGateway(correlationId).then(() => {
+                logger.info("gateway.config.applied", { key: k, restarted: true, correlationId });
+                return { ...base, applied: true };
+            }, (err) => {
+                // STORED BUT NOT APPLIED. Never a bare ok: the operator would believe a guard changed
+                // when the running gateway still holds the old value.
+                const error = extractErrorMessage(err);
+                logger.error("gateway.config.restart_failed", { key: k, error, correlationId });
+                return {
+                    ...base,
+                    applied: false,
+                    warning: "stored_but_not_applied",
+                    guidance: "The change is recorded but the screening process did not restart, so it is NOT yet " +
+                        `in effect. Restart the daemon to apply it. Cause: ${error}`,
+                };
+            });
+        }
+    });
+    return () => {
+        try {
+            configStore?.close();
+        }
+        catch { /* best-effort */ }
+        try {
+            recordStore?.close();
+        }
+        catch { /* best-effort */ }
+        configStore = undefined;
+        recordStore = undefined;
+    };
+}
+//# sourceMappingURL=gateway-config-handlers.js.map

package/dist/gateway-config-handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-config-handlers.js","sourceRoot":"","sources":["../src/gateway-config-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAwB,MAAM,yBAAyB,CAAC;AAGvG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;IAClB,qBAAqB;IACrB,gBAAgB;CACR,CAAC;AAEX,6FAA6F;AAC7F,MAAM,QAAQ,GAA2B;IACvC,mBAAmB,EAAE,kEAAkE;IACvF,aAAa,EAAE,mEAAmE;IAClF,cAAc,EAAE,6JAA6J;IAC7K,gBAAgB,EAAE,wFAAwF;IAC1G,mBAAmB,EAAE,gEAAgE;IACrF,cAAc,EAAE,yDAAyD;CAC1E,CAAC;AAeF,mFAAmF;AACnF,SAAS,MAAM,CAAC,GAAW,EAAE,GAAY;IACvC,IAAI,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;QAChE,IAAI,OAAO,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;QAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,qCAAqC,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC1E,CAAC,CAAC,GAAe;YACjB,8FAA8F;YAC9F,+FAA+F;YAC/F,8CAA8C;YAC9C,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,2EAA2E,EAAE,CAAC;QAClH,CAAC;QACD,sFAAsF;QACtF,wFAAwF;QACxF,kDAAkD;QAClD,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EACJ,0FAA0F;wBAC1F,yFAAyF;wBACzF,mEAAmE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC3F,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EACJ,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;wBAC1F,kEAAkE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC1F,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,eAAe,EAAE,CAAC;IAC7E,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,iCAAiC;IACjC,IAAI,GAAG,KAAK,qBAAqB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,QAAQ,EACN,2FAA2F;gBAC3F,0FAA0F;gBAC1F,oFAAoF,OAAO,GAAG;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,cAAc;YACtB,QAAQ,EACN,wFAAwF;gBACxF,+CAA+C,OAAO,GAAG;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kDAAkD,OAAO,GAAG;KACvE,CAAC;AACJ,CAAC;AAWD,MAAM,UAAU,6BAA6B,CAAC,IAA8B;IAC1E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAEnF,8FAA8F;IAC9F,6FAA6F;IAC7F,IAAI,WAA2C,CAAC;IAChD,MAAM,SAAS,GAAG,GAAuB,EAAE;QACzC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,kBAAkB,CAClC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC3C,6FAA6F;YAC7F,sDAAsD;YACtD,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,WAA2C,CAAC;IAChD,MAAM,eAAe,GAAG,GAAuB,EAAE;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,IAAI,kBAAkB,CAClC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC5B,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAC3C,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAChD,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,kGAAkG;IAClG,MAAM,SAAS,GAAG,CAAI,EAAoC,EAAuD,EAAE;QACjH,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,0BAA0B,CAAC;YACnF,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ;mBAC3D,8EAA8E,CAAC;YACpF,uFAAuF;YACvF,8FAA8F;YAC9F,0FAA0F;YAC1F,gFAAgF;YAChF,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ;aAC/D,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yFAAyF;YACzF,2FAA2F;YAC3F,yEAAyE;YACzE,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACnE,CAAC;YACD,uFAAuF;YACvF,2FAA2F;YAC3F,6FAA6F;YAC7F,sEAAsE;YACtE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,gGAAgG;QAChG,qFAAqF;IACvF,CAAC,CAAC;IAEF,gGAAgG;IAChG,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAC3C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,GAAG;gBACH,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACxB,0FAA0F;gBAC1F,yFAAyF;gBACzF,6CAA6C;gBAC7C,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC;gBAC7B,UAAU,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACrC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;gBACrC,yFAAyF;gBACzF,mFAAmF;gBACnF,+EAA+E;gBAC/E,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACpC,iFAAiF;gBACjF,wFAAwF;gBACxF,iDAAiD;gBACjD,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CAAC;QACJ,CAAC,CAAC;KACH,CAAC,CAAC,CACJ,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC/D,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,GAAG;gBACH,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,CAAC;gBAC7B,UAAU,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACrC,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;gBACrC,uFAAuF;gBACvF,uFAAuF;gBACvF,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI;gBACpC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aACnD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,EAAE;IACF,iGAAiG;IACjG,gGAAgG;IAChG,4FAA4F;IAC5F,8FAA8F;IAC9F,qFAAqF;IACrF,EAAE;IACF,4EAA4E;IAC5E,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,KAAK,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;YACrF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,eAAe,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,IAAI,0BAA0B,CAAC;YACnF,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ;mBAC3D,8EAA8E,CAAC;YACpF,8FAA8F;YAC9F,2EAA2E;YAC3E,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS;aAChE,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,qFAAqF;gBACrF,wFAAwF;gBACxF,+DAA+D;gBAC/D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxB,MAAM,EAAE,UAAmB;oBAC3B,EAAE,EAAE,CAAC,CAAC,UAAU;oBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;oBACxB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;oBACtC,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC;gBACH,KAAK,EAAE,QAAQ,CAAC,MAAM;gBACtB,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,yFAAyF;gBACzF,wCAAwC;gBACxC,UAAU,EAAE,KAAK,CAAC,WAAW,EAAE;aAChC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC9D,iGAAiG;QACjG,kGAAkG;QAClG,iGAAiG;QACjG,gGAAgG;QAChG,uDAAuD;QACvD,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,CAAC,GAAG,IAAI,CAAE,mBAAyC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,mBAAmB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,qBAAqB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAEvF,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,6FAA6F;QAC7F,mEAAmE;QACnE,EAAE;QACF,4FAA4F;QAC5F,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,qBAAqB;QACrB,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC;QAE5C,OAAO,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACzB,2FAA2F;YAC3F,4FAA4F;YAC5F,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACpC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa;iBACtG,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjE,CAAC;YAED,gFAAgF;YAChF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC7G,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EACN,aAAa,GAAG,qEAAqE;wBACrF,wFAAwF;wBACxF,oBAAoB,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACpD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC5G,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,oBAAoB;oBAC5B,SAAS,EAAE,QAA2B;oBACtC,oFAAoF;oBACpF,sFAAsF;oBACtF,iFAAiF;oBACjF,6EAA6E;oBAC7E,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;oBAClC,QAAQ,EAAE,cAAc,QAAQ,CAAC,GAAG,CAAC,oBAAoB;iBAC1D,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,oFAAoF;gBACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,qEAAqE,EAAE,CAAC;YAC/H,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACpC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa;aACnG,CAAC,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,SAAS,OAAO,CAAC,CAAS,EAAE,SAA0B,EAAE,OAAe,EAAE,YAAqB;YAC5F,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAa,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;YACxF,IAAI,CAAC,sBAAsB;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAc,EAAE,CAAC;YACzE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC,IAAI,CAC/C,GAAG,EAAE;gBACH,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAClF,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;YAC7C,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;gBACf,sFAAsF;gBACtF,sDAAsD;gBACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBACvC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;gBAChF,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAE,KAAc;oBACvB,OAAO,EAAE,wBAAwB;oBACjC,QAAQ,EACN,qFAAqF;wBACrF,qDAAqD,KAAK,EAAE;iBAC/D,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAS,EAAE;QAChB,IAAI,CAAC;YAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC;YAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACzD,WAAW,GAAG,SAAS,CAAC;QACxB,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/held-content.d.ts

@@ -0,0 +1,145 @@
+/**
+ * CELLO Daemon — CONTENT WE HAVE BUT CANNOT SHOW YET
+ *
+ * Split out of `session-node-manager.ts` by 037-SESSIONCORE. A message that arrives out of order is
+ * verified and kept, not delivered: showing it would put the conversation in the wrong sequence, and
+ * dropping it would lose a message the sender believes landed. It is HELD until the gap ahead of it
+ * closes, then released down the path it came from.
+ *
+ * Moved verbatim, comments included.
+ *
+ * ⚠️ `origin` DECIDES THE RELEASE PATH, AND GETTING IT WRONG IS NOT COSMETIC. A held frame of OUR OWN
+ * must be released down the SENT path — appended and transcribed as sent. Releasing it down the
+ * received path would put our own words in the counterparty's mouth in the sealed record, and hand
+ * them back to our own agent through `cello_receive` as though they had just arrived.
+ */
+import type { Logger } from "./types.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { SessionQueries } from "./session-queries.js";
+import type { SessionRecords } from "./session-records.js";
+import type { SessionTree, WritableSessionTreeLeafKind } from "./session-tree.js";
+import type { SentAuthorship } from "./session-node-types.js";
+/**
+ * One piece of content held behind an ordering gap.
+ *
+ * Exported because the content pipeline shares the very same map — see the note on `heldContent`
+ * below. Two files spelling one shape out separately is how they stop agreeing.
+ */
+export type HeldEntry = {
+    content: Uint8Array;
+    originalContent?: Uint8Array;
+    contentHashHex: string;
+    correlationId?: string;
+    screenedOut?: boolean;
+    origin?: "sent";
+    kind?: WritableSessionTreeLeafKind;
+    authorship?: SentAuthorship;
+    restoredAcrossRestart?: boolean;
+};
+/** What held content needs from the manager. */
+export interface HeldContentContext {
+    readonly logger: Logger;
+    readonly queries: SessionQueries;
+    readonly records: SessionRecords;
+    /** A function: the manager opens its database after construction. Re-exposed below as `#db`. */
+    db(): DaemonDatabase | null;
+    sessionKey(agentName: string, sessionId: string): string;
+    requireAgentId(agentName: string): string;
+    /**
+     * ⚠️ THE HELD MAP ITSELF, shared by reference rather than owned here — `ingestReceivedContent`,
+     * `placeOwnLeaf`, `sealReadiness` and `getUndeliverableSeqs` all read it and all stayed behind.
+     * Splitting the map would have meant two sources of truth for "what are we holding", which is
+     * worse than sharing one. It is only ever ASSIGNED once, at construction, so there is one Map
+     * object and no two-writer divergence.
+     */
+    readonly heldContent: Map<string, Map<number, HeldEntry>>;
+    readonly witnessedSeq: Map<string, Map<string, number>>;
+    getSessionTree(agentName: string, sessionId: string): SessionTree;
+    appendSessionLeaf(agentName: string, sessionId: string, kind: WritableSessionTreeLeafKind, leafHashHex: string, correlationId?: string): {
+        leafIndex: number;
+        newRootHex: string;
+    };
+    appendVerifiedContent(agentName: string, sessionId: string, content: Uint8Array, contentHashHex: string, senderPubkey: string, correlationId?: string, originalContent?: Uint8Array, verifiedAuthorship?: {
+        senderPubkey: Uint8Array;
+        senderSig: Uint8Array;
+    }): {
+        leafIndex: number;
+    };
+}
+export declare class HeldContent {
+    #private;
+    constructor(ctx: HeldContentContext);
+    /** M8C-ABUSE-1 (reviewer HIGH fix, D18): bytes currently sitting in the out-of-order hold
+     *  buffer for this session — NOT yet committed leaves, but real bytes in memory that would
+     *  otherwise let multiple held chunks each individually pass the size gate while cumulatively
+     *  exceeding it once #releaseHeld drains them. */
+    getHeldBytesTotal(agentName: string, sessionId: string): number;
+    /**
+     * DOD-M12B-STRAND-1 — restore this session's held frames into memory.
+     *
+     * Called when a session node is (re)created, which is the moment the session becomes able to
+     * append again. Loading at daemon boot instead would be wrong for the same reason the old code
+     * was wrong: a frame is only releasable against a tree, and the tree is loaded per session.
+     *
+     * A frame whose content the tree ALREADY HOLDS at that position is dropped — re-appending it
+     * would change the root a seal signs over. That test is `hashAt`, not `canonical_seq < frontier`:
+     * the two counters are different spaces and this file documents them drifting, so the index
+     * comparison alone would destroy a frame the tree never held. See the drift branch below.
+     */
+    ensureHeldRestored(agentName: string, sessionId: string, opts?: {
+        release?: boolean;
+    }): void;
+    restoreHeldContent(agentName: string, sessionId: string): void;
+    /**
+     * DOD-MSG-4: drain held out-of-order content in canonical order. After a leaf is appended, any
+     * held entry whose canonical sequence equals the new next-expected index is now in order — append
+     * it, then check again (a single fill can release a run of consecutive held messages).
+     */
+    releaseHeld(agentName: string, sessionId: string, senderPubkey: string): number;
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
+    /**
+     * ⚠️ **ORPHANED COMMENT, OWNER UNKNOWN — do not attach it to the method below.** It reads
+     * *"@returns true iff the UPDATE was executed without error (a failed write is logged, never
+     * thrown)"*, and `annexHeldContentOnTerminal` returns `void` and runs no such UPDATE. It was
+     * already stranded in `session-node-manager.ts` before 037 moved this code, and Rule C carried it
+     * verbatim rather than dropping a sentence that is true of SOMETHING.
+     *
+     * Kept, marked, and NOT reattached: the nearest candidate by behaviour is
+     * `SessionQueries.markCounterpartyAbandoned`, which already has its own doc — so attaching it
+     * there on a guess is the same defect this marker exists to stop. Delete it only once its owner is
+     * identified, or reattach it then.
+     */
+    /**
+     * DOD-M12B-STRAND-1 — move a terminal session's held frames to the annex.
+     *
+     * A held frame is content this agent RECEIVED and VERIFIED. When its session ends it can never
+     * join that chain (appending behind a committed root is not an option, and ingest refuses a
+     * terminal session outright), but it is still the operator's mail and no other copy exists —
+     * the sender was never acknowledged for it. `sealed_session_annex` is where M12-P17 already puts
+     * content that arrives for an ended session; this is the same content arriving slightly earlier.
+     *
+     * ANNEX FIRST, DELETE SECOND, per row. A crash between them costs a duplicate the annex's
+     * INSERT OR IGNORE absorbs; the other order costs the message. A row whose annex write fails is
+     * KEPT — the retention sweep will find it again, and a leftover row is cheaper than a lost one.
+     */
+    annexHeldContentOnTerminal(agentName: string, sessionId: string, status: "sealed" | "abandoned"): void;
+    /**
+     * Forget the restore/release bookkeeping for a torn-down session.
+     *
+     * The held CONTENT itself is not dropped here — the map is shared and the manager's eviction still
+     * owns that line. What goes is this module's memory of whether a session was already hydrated from
+     * disk and already released, which must not survive a teardown: a revived session has to re-read
+     * from durable state rather than trust a flag about a process that is gone.
+     */
+    evictSession(agentName: string, sessionId: string): void;
+}
+//# sourceMappingURL=held-content.d.ts.map

package/dist/held-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"held-content.d.ts","sourceRoot":"","sources":["../src/held-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,UAAU,CAAC;IAAC,eAAe,CAAC,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAClG,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IACxG,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,gGAAgG;IAChG,EAAE,IAAI,cAAc,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACzD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAAC;IAClE,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,2BAA2B,EACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,qBAAqB,CACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,UAAU,EAC5B,kBAAkB,CAAC,EAAE;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GACvE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAED,qBAAa,WAAW;;gBAGV,GAAG,EAAE,kBAAkB;IAWnC;;;sDAGkD;IAClD,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAW/D;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA8B5F,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAsG9D;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAuF/E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAM5G;;;;;;;;;;;OAWG;IACH;;;;;;;;;;;;OAYG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,IAAI;IAkDtG;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAKzD"}