@cello-protocol/daemon 0.0.23 → 0.0.25

package/dist/directory-bootstrap.d.ts

@@ -86,6 +86,17 @@ export interface DirectoryEndpointResolverOptions {
     directoryUrl?: string;
     /** Injectable fetch for testing. */
     fetchFn?: typeof fetch;
+    /**
+     * Whether a fresh /bootstrap failure falls back to the last known-good endpoint (default true).
+     *
+     * FINDING-4: set FALSE when this resolver is used as the PRIMARY probe inside
+     * createRosterAwareEndpointResolver. There, the stale-last-known-good fallback is HARMFUL — it
+     * masks a dead primary (a fresh failure returns the cached dead endpoint, so the wrapper never
+     * observes the primary as "down" and never fails over to the roster). With staleFallback:false a
+     * fresh failure returns null, and the roster becomes the real (and only) fallback. The default
+     * (true) preserves the M6/single-node backward-compat behavior for callers that are NOT wrapped.
+     */
+    staleFallback?: boolean;
 }
 /**
  * Build an async `getDirectoryEndpoint` for createSignalingConnect.
@@ -97,4 +108,58 @@ export interface DirectoryEndpointResolverOptions {
  * known-good endpoint so a transient /bootstrap blip doesn't strand a working daemon.
  */
 export declare function createDirectoryEndpointResolver(opts: DirectoryEndpointResolverOptions): () => Promise<DirectoryEndpoint | null>;
+export interface RosterAwareResolverOptions {
+    /**
+     * Resolve the PRIMARY (configured) directory endpoint — typically the result of
+     * createDirectoryEndpointResolver (probes CELLO_DIRECTORY_URL's /bootstrap).
+     */
+    primaryResolver: () => Promise<DirectoryEndpoint | null>;
+    /**
+     * Resolve the CURRENTLY-REACHABLE consortium roster. Each member returned has already
+     * had its /bootstrap probed (manifestNodesToEndpoints skips unreachable nodes), so a
+     * member's presence in the returned array IS its reachability. NULL on the M6/M7
+     * back-compat path (no consortium manifest configured) → no failover, primary-only.
+     */
+    getConsortiumRoster: () => Promise<ConsortiumEndpoint[] | null>;
+    logger: Logger;
+    /**
+     * Test seam: order the fallback candidates. Production defaults to a Fisher-Yates
+     * shuffle so clients don't stampede one node when the primary goes down (CLAUDE.md
+     * redundancy invariant). Tests inject an identity shuffle for deterministic ordering.
+     */
+    shuffle?: <T>(items: T[]) => T[];
+}
+/**
+ * Wrap a single-node primary resolver with the consortium roster so the signaling
+ * dialer (and the ceremony endpoint that shares this instance) route AROUND a down
+ * primary directory node instead of retrying the single primary URL forever — the
+ * FINDING-4 bootstrap SPOF fix, honoring the sovereign-node REDUNDANCY invariant.
+ *
+ * Selection policy, per getDirectoryEndpoint() call:
+ *   1. Sticky-until-fail — while riding a non-primary fallback, KEEP it as long as it's
+ *      still in the reachable roster. Do NOT churn back to the primary when it recovers
+ *      (no flapping / reconnect storm). The fallback's multiaddr is refreshed from the
+ *      fresh roster match each call.
+ *   2. Primary-first — otherwise try the configured node. This is also the healthy
+ *      steady state: when the primary resolves, we return WITHOUT probing the roster
+ *      (no per-connect roster cost while everything is nominal).
+ *   3. Fallback — if the primary is down, fail over to a reachable roster member. The
+ *      order is randomized (across the members other than the dead primary) so clients
+ *      spread across the survivors. Emits directory.bootstrap.failover on a change so an
+ *      operator sees the client is now running on a non-home node.
+ *   4. Return null only when NOTHING resolves (primary down AND roster empty/absent) —
+ *      the unchanged all-nodes-down failure mode, no crash.
+ *
+ * ONE instance is shared across the daemon's signaling connect and its ceremony
+ * getDirectoryEndpoint so signaling + ceremonies stay on the SAME directory node and
+ * fail over together (a coherent per-daemon directory selection).
+ *
+ * Scope note (FINDING-4 sufficiency, unproven): stickiness here is by ROSTER
+ * REACHABILITY, not by observed connect success — the resolver is not told whether a
+ * dial/auth against the returned endpoint actually succeeded. A node whose /bootstrap
+ * resolves is served by that same node, so resolvable ≈ connectable in practice; the
+ * live kill-primary failover test is the real proof that presence resolution, relay
+ * assignment, and the FROST ceremony all work against a non-home directory.
+ */
+export declare function createRosterAwareEndpointResolver(opts: RosterAwareResolverOptions): () => Promise<DirectoryEndpoint | null>;
 //# sourceMappingURL=directory-bootstrap.d.ts.map

package/dist/directory-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-bootstrap.d.ts","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,2CAA2C,CAAC;AAEjF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAEjG;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKzE;AAID,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgC/B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA4BzC"}
+{"version":3,"file":"directory-bootstrap.d.ts","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,2CAA2C,CAAC;AAEjF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAEjG;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBxB;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKzE;AAID,0FAA0F;AAC1F,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,SAAS,cAAc,EAAE,EAChC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAgC/B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA+BzC;AAID,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,eAAe,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;CAClC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,0BAA0B,GAC/B,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA8DzC"}

package/dist/directory-bootstrap.js

@@ -136,6 +136,7 @@ export async function manifestNodesToEndpoints(nodes, opts) {
 export function createDirectoryEndpointResolver(opts) {
     const directoryUrl = opts.directoryUrl ?? resolveDirectoryUrl();
     const fetchFn = opts.fetchFn ?? fetch;
+    const staleFallback = opts.staleFallback ?? true;
     let lastGood = null;
     return async function getDirectoryEndpoint() {
         const multiaddr = await fetchBootstrapMultiaddr(directoryUrl, fetchFn);
@@ -154,12 +155,114 @@ export function createDirectoryEndpointResolver(opts) {
         else {
             opts.logger.warn("directory.bootstrap.unavailable", { directoryUrl });
         }
-        // Fresh resolution failed — reuse the last known-good endpoint if we have one.
-        if (lastGood) {
+        // Fresh resolution failed — reuse the last known-good endpoint if we have one AND stale fallback
+        // is enabled. When disabled (the failover-wrapper's primary probe), a fresh failure is reported
+        // as null so the roster can take over instead of the caller looping on a dead endpoint.
+        if (staleFallback && lastGood) {
             opts.logger.warn("directory.bootstrap.using_last_known", { directoryUrl, peerId: lastGood.peerId });
             return lastGood;
         }
         return null;
     };
 }
+/** In-place-safe Fisher-Yates shuffle returning a NEW array (never mutates the input). */
+function fisherYatesShuffle(items) {
+    const out = items.slice();
+    for (let i = out.length - 1; i > 0; i--) {
+        const j = Math.floor(Math.random() * (i + 1));
+        [out[i], out[j]] = [out[j], out[i]];
+    }
+    return out;
+}
+/**
+ * Wrap a single-node primary resolver with the consortium roster so the signaling
+ * dialer (and the ceremony endpoint that shares this instance) route AROUND a down
+ * primary directory node instead of retrying the single primary URL forever — the
+ * FINDING-4 bootstrap SPOF fix, honoring the sovereign-node REDUNDANCY invariant.
+ *
+ * Selection policy, per getDirectoryEndpoint() call:
+ *   1. Sticky-until-fail — while riding a non-primary fallback, KEEP it as long as it's
+ *      still in the reachable roster. Do NOT churn back to the primary when it recovers
+ *      (no flapping / reconnect storm). The fallback's multiaddr is refreshed from the
+ *      fresh roster match each call.
+ *   2. Primary-first — otherwise try the configured node. This is also the healthy
+ *      steady state: when the primary resolves, we return WITHOUT probing the roster
+ *      (no per-connect roster cost while everything is nominal).
+ *   3. Fallback — if the primary is down, fail over to a reachable roster member. The
+ *      order is randomized (across the members other than the dead primary) so clients
+ *      spread across the survivors. Emits directory.bootstrap.failover on a change so an
+ *      operator sees the client is now running on a non-home node.
+ *   4. Return null only when NOTHING resolves (primary down AND roster empty/absent) —
+ *      the unchanged all-nodes-down failure mode, no crash.
+ *
+ * ONE instance is shared across the daemon's signaling connect and its ceremony
+ * getDirectoryEndpoint so signaling + ceremonies stay on the SAME directory node and
+ * fail over together (a coherent per-daemon directory selection).
+ *
+ * Scope note (FINDING-4 sufficiency, unproven): stickiness here is by ROSTER
+ * REACHABILITY, not by observed connect success — the resolver is not told whether a
+ * dial/auth against the returned endpoint actually succeeded. A node whose /bootstrap
+ * resolves is served by that same node, so resolvable ≈ connectable in practice; the
+ * live kill-primary failover test is the real proof that presence resolution, relay
+ * assignment, and the FROST ceremony all work against a non-home directory.
+ */
+export function createRosterAwareEndpointResolver(opts) {
+    const shuffle = opts.shuffle ?? fisherYatesShuffle;
+    // The endpoint we last returned, and whether it is a non-primary fallback we're riding.
+    let current = null;
+    let stuckToFallback = false;
+    // The primary's own identity, learned whenever the primary last resolved. Used to EXCLUDE the
+    // primary from the fallback set even when `current` no longer points at it — a flapping primary
+    // whose independent roster probe still lists it must never be re-picked as its own fallback.
+    let primaryPeerId = null;
+    return async function getDirectoryEndpoint() {
+        // 1. Sticky-until-fail: keep the current fallback while it is still reachable.
+        if (stuckToFallback && current) {
+            const roster = await opts.getConsortiumRoster();
+            const match = roster?.find((e) => e.peerId === current.peerId);
+            if (match) {
+                // Refresh the multiaddr from the fresh roster resolution; identity is unchanged.
+                current = { peerId: match.peerId, multiaddr: match.multiaddr };
+                return current;
+            }
+            // The fallback fell out of the reachable roster → re-select below.
+            opts.logger.warn("directory.bootstrap.failover.lost", { peerId: current.peerId });
+        }
+        // 2. Primary-first (and the healthy steady state — no roster probe when it resolves).
+        const primary = await opts.primaryResolver();
+        if (primary) {
+            if (stuckToFallback) {
+                opts.logger.info("directory.bootstrap.failover", { to: primary.peerId, restored: true });
+            }
+            current = primary;
+            primaryPeerId = primary.peerId;
+            stuckToFallback = false;
+            return primary;
+        }
+        // 3. Primary is down → fail over to a reachable roster member (randomized order).
+        const roster = await opts.getConsortiumRoster();
+        if (roster && roster.length > 0) {
+            // Exclude the (now-dead/flapping) primary and the current pointer; any OTHER reachable member
+            // is valid. Falls back to the full roster only if excluding leaves nothing (all members are
+            // the excluded ones — e.g. the roster is just the primary itself).
+            const excluded = new Set([current?.peerId, primaryPeerId].filter((p) => !!p));
+            const others = roster.filter((e) => !excluded.has(e.peerId));
+            const ordered = shuffle(others.length > 0 ? others : roster);
+            const chosen = ordered[0];
+            const next = { peerId: chosen.peerId, multiaddr: chosen.multiaddr };
+            if (!current || current.peerId !== chosen.peerId) {
+                opts.logger.warn("directory.bootstrap.failover", {
+                    from: current?.peerId ?? null,
+                    to: chosen.peerId,
+                    nodeId: chosen.nodeId,
+                });
+            }
+            current = next;
+            stuckToFallback = true;
+            return next;
+        }
+        // 4. Nothing resolves.
+        return null;
+    };
+}
 //# sourceMappingURL=directory-bootstrap.js.map

package/dist/directory-bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"directory-bootstrap.js","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,wCAAwC,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,OAAO,GAAG,CAAC,qBAAqB,CAAC,IAAI,wBAAwB,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAwB,KAAK;IAE7B,MAAM,YAAY,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC;IACpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgC,EAChC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAsC,EAAE;QAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4EAA4E;YAC5E,+EAA+E;YAC/E,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,IAAI,QAAQ,GAA6B,IAAI,CAAC;IAE9C,OAAO,KAAK,UAAU,oBAAoB;QACxC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,mFAAmF;gBACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,+EAA+E;QAC/E,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"directory-bootstrap.js","sourceRoot":"","sources":["../src/directory-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG,wCAAwC,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,OAAO,GAAG,CAAC,qBAAqB,CAAC,IAAI,wBAAwB,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,UAAwB,KAAK;IAE7B,MAAM,YAAY,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC;IACpE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,SAAS,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,OAAO,CAAC;IACpF,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAgC,EAChC,IAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAsC,EAAE;QAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,4EAA4E;YAC5E,+EAA+E;YAC/E,6DAA6D;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACzE,CAAC,CAAC,CACH,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IACjD,IAAI,QAAQ,GAA6B,IAAI,CAAC;IAE9C,OAAO,KAAK,UAAU,oBAAoB;QACxC,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,mFAAmF;gBACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;oBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBACD,QAAQ,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACjC,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,iGAAiG;QACjG,gGAAgG;QAChG,wFAAwF;QACxF,IAAI,aAAa,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpG,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AA0BD,0FAA0F;AAC1F,SAAS,kBAAkB,CAAI,KAAU;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAgC;IAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACnD,wFAAwF;IACxF,IAAI,OAAO,GAA6B,IAAI,CAAC;IAC7C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,8FAA8F;IAC9F,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,OAAO,KAAK,UAAU,oBAAoB;QACxC,+EAA+E;QAC/E,IAAI,eAAe,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAQ,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,iFAAiF;gBACjF,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,sFAAsF;QACtF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,GAAG,OAAO,CAAC;YAClB,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;YAC/B,eAAe,GAAG,KAAK,CAAC;YACxB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,8FAA8F;YAC9F,4FAA4F;YAC5F,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;oBAC/C,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;oBAC7B,EAAE,EAAE,MAAM,CAAC,MAAM;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,GAAG,IAAI,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB;QACvB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/file-manifest-provider.d.ts

@@ -1,4 +1,5 @@
 import type { ConsortiumManifest } from "@cello-protocol/protocol-types";
+import { type ConsortiumManifestInput } from "@cello-protocol/crypto";
 import type { IManifestProvider } from "@cello-protocol/transport";
 export declare class ManifestLoadError extends Error {
     readonly reason: string;
@@ -15,4 +16,22 @@ export declare class FileManifestProvider implements IManifestProvider {
     getCurrentManifest(): ConsortiumManifest | null;
     updateManifest(manifest: ConsortiumManifest): void;
 }
+/**
+ * EmbeddedManifestProvider — the production provider for the COMPILED-IN consortium roster
+ * (FINDING-4). Identical trust gate to FileManifestProvider (threshold officer-signature
+ * verification via `verifyManifest`, rejects an empty node set) but the manifest is an in-memory
+ * constant compiled into the client rather than a file on disk. This is what the daemon wires by
+ * default (no CELLO_CONSORTIUM_MANIFEST override), so the roster and step-6 directory-auth anchor
+ * are always present — they cannot be lost by a missing package file or a skipped build-copy step,
+ * and a corrupt/mis-signed embedded manifest fails CLOSED at load (ADV-002) rather than silently
+ * degrading. Expiry / version monotonicity remain the daemon's policy layer, exactly as for
+ * FileManifestProvider (see that class's note) — this provider does structure + signatures only.
+ */
+export declare class EmbeddedManifestProvider implements IManifestProvider {
+    #private;
+    constructor(input: ConsortiumManifestInput);
+    loadAndVerify(rootKeys: readonly string[], threshold: number): Promise<ConsortiumManifest>;
+    getCurrentManifest(): ConsortiumManifest | null;
+    updateManifest(manifest: ConsortiumManifest): void;
+}
 //# sourceMappingURL=file-manifest-provider.d.ts.map

package/dist/file-manifest-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-manifest-provider.d.ts","sourceRoot":"","sources":["../src/file-manifest-provider.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK5C;AAED,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;;gBAIhD,IAAI,EAAE,wBAAwB;IAIpC,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2BhG,kBAAkB,IAAI,kBAAkB,GAAG,IAAI;IAI/C,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAGnD"}
+{"version":3,"file":"file-manifest-provider.d.ts","sourceRoot":"","sources":["../src/file-manifest-provider.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAkB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK5C;AAED,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;;gBAIhD,IAAI,EAAE,wBAAwB;IAIpC,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2BhG,kBAAkB,IAAI,kBAAkB,GAAG,IAAI;IAI/C,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAGnD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;;gBAIpD,KAAK,EAAE,uBAAuB;IAI1C,aAAa,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAS1F,kBAAkB,IAAI,kBAAkB,GAAG,IAAI;IAI/C,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAGnD"}

package/dist/file-manifest-provider.js

@@ -69,4 +69,36 @@ export class FileManifestProvider {
         this.#manifest = manifest;
     }
 }
+/**
+ * EmbeddedManifestProvider — the production provider for the COMPILED-IN consortium roster
+ * (FINDING-4). Identical trust gate to FileManifestProvider (threshold officer-signature
+ * verification via `verifyManifest`, rejects an empty node set) but the manifest is an in-memory
+ * constant compiled into the client rather than a file on disk. This is what the daemon wires by
+ * default (no CELLO_CONSORTIUM_MANIFEST override), so the roster and step-6 directory-auth anchor
+ * are always present — they cannot be lost by a missing package file or a skipped build-copy step,
+ * and a corrupt/mis-signed embedded manifest fails CLOSED at load (ADV-002) rather than silently
+ * degrading. Expiry / version monotonicity remain the daemon's policy layer, exactly as for
+ * FileManifestProvider (see that class's note) — this provider does structure + signatures only.
+ */
+export class EmbeddedManifestProvider {
+    #input;
+    #manifest = null;
+    constructor(input) {
+        this.#input = input;
+    }
+    loadAndVerify(rootKeys, threshold) {
+        const result = verifyManifest(this.#input, rootKeys, threshold);
+        if (!result.ok) {
+            return Promise.reject(new ManifestLoadError("manifest_signature_invalid", result.detail));
+        }
+        this.#manifest = this.#input;
+        return Promise.resolve(this.#manifest);
+    }
+    getCurrentManifest() {
+        return this.#manifest;
+    }
+    updateManifest(manifest) {
+        this.#manifest = manifest;
+    }
+}
 //# sourceMappingURL=file-manifest-provider.js.map

package/dist/file-manifest-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-manifest-provider.js","sourceRoot":"","sources":["../src/file-manifest-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAgC,MAAM,wBAAwB,CAAC;AAGtF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,MAAe;QACzC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,OAAO,oBAAoB;IACtB,KAAK,CAAS;IACvB,SAAS,GAA8B,IAAI,CAAC;IAE5C,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,SAAiB;QAChE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtG,CAAC;QAED,2EAA2E;QAC3E,kFAAkF;QAClF,oEAAoE;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,MAA4C,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,QAA4B;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"file-manifest-provider.js","sourceRoot":"","sources":["../src/file-manifest-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAgC,MAAM,wBAAwB,CAAC;AAGtF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,MAAe;QACzC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,OAAO,oBAAoB;IACtB,KAAK,CAAS;IACvB,SAAS,GAA8B,IAAI,CAAC;IAE5C,YAAY,IAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,SAAiB;QAChE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QACjD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtG,CAAC;QAED,2EAA2E;QAC3E,kFAAkF;QAClF,oEAAoE;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,MAA4C,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,QAA4B;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IAC1B,MAAM,CAA0B;IACzC,SAAS,GAA8B,IAAI,CAAC;IAE5C,YAAY,KAA8B;QACxC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,aAAa,CAAC,QAA2B,EAAE,SAAiB;QAC1D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAuC,CAAC;QAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,QAA4B;QACzC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC5B,CAAC;CACF"}

package/dist/manifest-deps.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
+ *
+ * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
+ * top-level main() (which spawns a live daemon on import).
+ *
+ * Two modes:
+ *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
+ *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
+ *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
+ *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
+ *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
+ */
+import { type IManifestProvider, type IDirectoryChallengeVerifier, type IManifestVersionStore, type IManifestPollScheduler } from "@cello-protocol/transport";
+import type { Logger } from "./types.js";
+export interface ManifestDeps {
+    manifestProvider?: IManifestProvider;
+    manifestRootKeys?: readonly string[];
+    manifestThreshold?: number;
+    challengeVerifier?: IDirectoryChallengeVerifier;
+    manifestVersionStore?: IManifestVersionStore;
+    manifestPollScheduler?: IManifestPollScheduler;
+}
+/**
+ * Build the consortium-manifest deps.
+ *
+ *   CELLO_CONSORTIUM_MANIFEST    absolute path to an override manifest JSON (opt-in)
+ *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex) — override path only
+ *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer) — override path only
+ *   CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS   optional background poll window — override path only
+ *
+ * The single manifestProvider instance is shared between startDaemon's loadAndVerify call and the
+ * ManifestDirectoryChallengeVerifier, so step-6 reads the same cached, verified manifest.
+ */
+export declare function buildManifestDeps(logger: Logger): ManifestDeps;
+//# sourceMappingURL=manifest-deps.d.ts.map

package/dist/manifest-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-deps.d.ts","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AASnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAYzC,MAAM,WAAW,YAAY;IAC3B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;CAChD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAgF9D"}

package/dist/manifest-deps.js

@@ -0,0 +1,111 @@
+/**
+ * Composition helper for the daemon's consortium-manifest dependencies (M7 J-AUTH / FINDING-4).
+ *
+ * Extracted from bin/cello-daemon.ts so it can be unit-tested without triggering the bin's
+ * top-level main() (which spawns a live daemon on import).
+ *
+ * Two modes:
+ *   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST): load the COMPILED-IN consortium roster
+ *     (bundled-consortium-manifest.ts) with step-6 directory identity auth ON — the full production
+ *     posture that makes cold-boot directory failover possible (FINDING-4 redundancy invariant).
+ *   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set): operator-supplied manifest FILE + env root keys /
+ *     threshold, plus the optional background /manifest poll. The pre-FINDING-4 opt-in path.
+ */
+import { ManifestDirectoryChallengeVerifier, } from "@cello-protocol/transport";
+import { FileManifestProvider, EmbeddedManifestProvider } from "./file-manifest-provider.js";
+import { BUNDLED_CONSORTIUM_MANIFEST, BUNDLED_CONSORTIUM_ROOT_KEYS, BUNDLED_CONSORTIUM_THRESHOLD, } from "./bundled-consortium-manifest.js";
+import { resolveDirectoryUrl } from "./directory-bootstrap.js";
+import { RandomizedPollScheduler } from "./manifest-poll-scheduler.js";
+/** Normalize a directory URL for comparison (trim, drop trailing slashes, lowercase). */
+function normalizeUrl(u) {
+    return u.trim().replace(/\/+$/, "").toLowerCase();
+}
+/** The set of directory endpoints the bundled roster describes (normalized). */
+const BUNDLED_ENDPOINTS = new Set(BUNDLED_CONSORTIUM_MANIFEST.nodes.map((n) => normalizeUrl(String(n["endpoint"]))));
+/**
+ * Build the consortium-manifest deps.
+ *
+ *   CELLO_CONSORTIUM_MANIFEST    absolute path to an override manifest JSON (opt-in)
+ *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex) — override path only
+ *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer) — override path only
+ *   CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS   optional background poll window — override path only
+ *
+ * The single manifestProvider instance is shared between startDaemon's loadAndVerify call and the
+ * ManifestDirectoryChallengeVerifier, so step-6 reads the same cached, verified manifest.
+ */
+export function buildManifestDeps(logger) {
+    const manifestPath = process.env.CELLO_CONSORTIUM_MANIFEST;
+    if (!manifestPath) {
+        // FINDING-4 default: load the COMPILED-IN consortium roster so the daemon already knows every
+        // sovereign directory — and can fail over to a reachable one — even when its primary is down
+        // (the redundancy invariant), AND enforces step-6 directory identity auth against the bundled
+        // node pubkeys (defeats a /bootstrap MITM redirecting failover to a rogue directory). This is
+        // the full production posture with zero operator config. The manifest is re-verified against the
+        // pinned root keys at load by startDaemon (ADV-002 — a corrupt embedded manifest fails CLOSED,
+        // never a silent downgrade). No poll scheduler: the bundled roster is static; adopting runtime
+        // manifest updates via the /manifest poll is a separate opt-in reachable through the env path.
+        //
+        // GATE (do NOT enable step-6 against a directory the bundle can't authenticate): the bundled
+        // manifest is the trust anchor for the PRODUCTION consortium ONLY (the mygentic.ai directories
+        // it lists). When the operator has pointed CELLO_DIRECTORY_URL at a directory that is NOT in the
+        // bundle — local dev (`CELLO_ENV=local`) and the e2e spine harness both run their own local
+        // directory on 127.0.0.1 — the bundled node pubkeys don't describe it, so enforcing step-6 would
+        // wrongly reject every connection (key_not_in_manifest). In that case fall through to the M6
+        // backward-compat path (no roster, no step-6); those deployments opt into step-6 explicitly by
+        // supplying a matching manifest via CELLO_CONSORTIUM_MANIFEST. Unset URL → the production default
+        // (directory-us1.cello.mygentic.ai), which IS in the bundle, so real operators get the full posture.
+        const directoryUrl = normalizeUrl(resolveDirectoryUrl());
+        if (!BUNDLED_ENDPOINTS.has(directoryUrl)) {
+            logger.info("daemon.manifest.bundled.skipped", { directoryUrl, reason: "directory_not_in_bundled_roster" });
+            return {};
+        }
+        const manifestProvider = new EmbeddedManifestProvider(BUNDLED_CONSORTIUM_MANIFEST);
+        const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider);
+        logger.info("daemon.manifest.bundled", {
+            version: BUNDLED_CONSORTIUM_MANIFEST.version,
+            nodeCount: BUNDLED_CONSORTIUM_MANIFEST.nodes.length,
+            rootKeyCount: BUNDLED_CONSORTIUM_ROOT_KEYS.length,
+            threshold: BUNDLED_CONSORTIUM_THRESHOLD,
+        });
+        return {
+            manifestProvider,
+            manifestRootKeys: BUNDLED_CONSORTIUM_ROOT_KEYS,
+            manifestThreshold: BUNDLED_CONSORTIUM_THRESHOLD,
+            challengeVerifier,
+        };
+    }
+    const rootKeysRaw = process.env.CELLO_CONSORTIUM_ROOT_KEYS ?? "";
+    const manifestRootKeys = rootKeysRaw.split(",").map((k) => k.trim()).filter((k) => k.length > 0);
+    const manifestThreshold = Number.parseInt(process.env.CELLO_CONSORTIUM_THRESHOLD ?? "", 10);
+    if (manifestRootKeys.length === 0 || Number.isNaN(manifestThreshold)) {
+        throw new Error("CELLO_CONSORTIUM_MANIFEST is set but CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD are missing or invalid");
+    }
+    const manifestProvider = new FileManifestProvider({ path: manifestPath });
+    const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider);
+    // DOD-AUTH-2: background manifest poll. The directory is re-polled on a randomized 6–12h interval
+    // (thundering-herd avoidance) and a newer signed manifest is adopted. The interval is env-injectable
+    // so the live binary test can poll sub-second instead of waiting hours; production leaves these
+    // unset → the 6–12h default window. Both-or-neither, positive, min <= max — a partial/invalid
+    // override fails LOUDLY rather than silently reverting or producing a negative (tight-loop) delay.
+    const rawPollMin = process.env.CELLO_MANIFEST_POLL_MIN_MS;
+    const rawPollMax = process.env.CELLO_MANIFEST_POLL_MAX_MS;
+    let pollOpts;
+    if (rawPollMin !== undefined || rawPollMax !== undefined) {
+        const minMs = Number.parseInt(rawPollMin ?? "", 10);
+        const maxMs = Number.parseInt(rawPollMax ?? "", 10);
+        if (Number.isNaN(minMs) || Number.isNaN(maxMs) || minMs <= 0 || maxMs < minMs) {
+            throw new Error("CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS must BOTH be set to positive integers with min <= max");
+        }
+        pollOpts = { minMs, maxMs };
+    }
+    const manifestPollScheduler = new RandomizedPollScheduler(pollOpts);
+    logger.info("daemon.manifest.configured", {
+        manifestPath,
+        rootKeyCount: manifestRootKeys.length,
+        threshold: manifestThreshold,
+        pollMinMs: pollOpts?.minMs ?? null,
+        pollMaxMs: pollOpts?.maxMs ?? null,
+    });
+    return { manifestProvider, manifestRootKeys, manifestThreshold, challengeVerifier, manifestPollScheduler };
+}
+//# sourceMappingURL=manifest-deps.js.map

package/dist/manifest-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-deps.js","sourceRoot":"","sources":["../src/manifest-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACL,kCAAkC,GAKnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,yFAAyF;AACzF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAE,CAA6B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC/G,CAAC;AAWF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,8FAA8F;QAC9F,6FAA6F;QAC7F,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,iGAAiG;QACjG,4FAA4F;QAC5F,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,kGAAkG;QAClG,qGAAqG;QACrG,MAAM,YAAY,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC5G,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;QACnF,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;YACrC,OAAO,EAAE,2BAA2B,CAAC,OAAO;YAC5C,SAAS,EAAE,2BAA2B,CAAC,KAAK,CAAC,MAAM;YACnD,YAAY,EAAE,4BAA4B,CAAC,MAAM;YACjD,SAAS,EAAE,4BAA4B;SACxC,CAAC,CAAC;QACH,OAAO;YACL,gBAAgB;YAChB,gBAAgB,EAAE,4BAA4B;YAC9C,iBAAiB,EAAE,4BAA4B;YAC/C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;IACnF,kGAAkG;IAClG,qGAAqG;IACrG,gGAAgG;IAChG,8FAA8F;IAC9F,mGAAmG;IACnG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,IAAI,QAAsD,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,YAAY;QACZ,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AAC7G,CAAC"}

package/dist/seal-frontier-verify.d.ts

@@ -55,4 +55,49 @@ export declare function findInflatedFrontier(participants: ReadonlyArray<{
     publishedFrontier: number;
     derivedFrontier: number;
 } | null;
+export interface UnilateralFrontierParticipant {
+    pubkey: string;
+    content_frontier_seq: number;
+    attestation_mode: string;
+}
+export interface UnilateralFrontierCheck {
+    /**
+     *  - verified:           leaves present, no CLIENT-VERIFIABLE ('live') frontier exceeded its leaves.
+     *  - corrected:          leaves present, one or more 'live' frontiers were inflated and overridden
+     *                        DOWN to the re-derived value (see `corrections`).
+     *  - directory_attested: no frontier_leaves shipped (a pre-FINDING-5 directory) — the cert stays
+     *                        directory-attested (FINDING-3 behavior). No correction possible.
+     *  - leaves_invalid:     frontier_leaves are forged / cross-session (reDeriveFrontiers failed) — a
+     *                        tamper signal; persist the directory-attested frontiers, log loudly. NEVER
+     *                        rejected (the unilateral dedup guard makes rejection an unrecoverable
+     *                        dead-end — cascade-2 reviewer Critical 2).
+     */
+    status: "verified" | "corrected" | "directory_attested" | "leaves_invalid";
+    /** lowercased pubkey → corrected content_frontier_seq, for inflated 'live' parties. The caller
+     *  lowers the persisted frontier to this before recording the receipt. Empty unless status is 'corrected'. */
+    corrections: Map<string, number>;
+    reason?: string;
+}
+/**
+ * FINDING-5 — the present party independently re-verifies (and CORRECTS) the UNILATERAL receipt's
+ * frontiers. OVERRIDE, never reject.
+ *
+ * The unilateral legibility is FROST-notarized by the directory but the frontier VALUES are NOT bound
+ * into the seal signature (unlike the bilateral seal, whose signer binds the legibility hash), so the
+ * client must not trust them blindly. Because the directory-side dedup guard makes a client REJECTION
+ * of a unilateral cert unrecoverable (a retry close is silently ignored — no receipt ever produced,
+ * worse than FINDING-3), the client CORRECTS rather than rejects:
+ *   - CLIENT-VERIFIABLE ('live') party: the present (submitting) party carries all its own signed
+ *     leaves, so its content_frontier_seq is fully re-derivable. The directory cannot forge signed
+ *     leaves, so the re-derived value is the provable truth → an inflated published value is OVERRIDDEN
+ *     DOWN to it (inflation neutralized, receipt still persisted).
+ *   - DIRECTORY-ATTESTED ('absent' / anything not 'live') party: its received-frontier remainder
+ *     (acks of the present party's content) lives with the absent party and was never provided, so a
+ *     published value ABOVE what the present party can derive is not provably inflation — left
+ *     untouched, directory-attested (already marked per-participant).
+ *
+ * The caller applies `corrections` to the persisted legibility and logs per `status`; it ALWAYS
+ * persists a receipt (never dead-ends the close).
+ */
+export declare function checkUnilateralFrontier(participants: ReadonlyArray<UnilateralFrontierParticipant>, frontierLeaves: SealFrontierLeaf[] | undefined, sessionId: Uint8Array): UnilateralFrontierCheck;
 //# sourceMappingURL=seal-frontier-verify.d.ts.map

package/dist/seal-frontier-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal-frontier-verify.d.ts","sourceRoot":"","sources":["../src/seal-frontier-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,UAAU,CAAC;IAC5B,aAAa,EAAE,UAAU,CAAC;IAC1B,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,GAAG,gBAAgB,GAAG,uBAAuB,CAAA;CAAE,CAAC;AAQjG;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,iBAAiB,EAAE,UAAU,GAAG,cAAc,CA0B3G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ9E"}
+{"version":3,"file":"seal-frontier-verify.d.ts","sourceRoot":"","sources":["../src/seal-frontier-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,UAAU,CAAC;IAC5B,aAAa,EAAE,UAAU,CAAC;IAC1B,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,GAAG,gBAAgB,GAAG,uBAAuB,CAAA;CAAE,CAAC;AAQjG;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,iBAAiB,EAAE,UAAU,GAAG,cAAc,CA0B3G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQ9E;AAID,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;OAUG;IACH,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;IAC3E;kHAC8G;IAC9G,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,aAAa,CAAC,6BAA6B,CAAC,EAC1D,cAAc,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAC9C,SAAS,EAAE,UAAU,GACpB,uBAAuB,CAyBzB"}

package/dist/seal-frontier-verify.js

@@ -84,4 +84,53 @@ export function findInflatedFrontier(participants, derived) {
     }
     return null;
 }
+/**
+ * FINDING-5 — the present party independently re-verifies (and CORRECTS) the UNILATERAL receipt's
+ * frontiers. OVERRIDE, never reject.
+ *
+ * The unilateral legibility is FROST-notarized by the directory but the frontier VALUES are NOT bound
+ * into the seal signature (unlike the bilateral seal, whose signer binds the legibility hash), so the
+ * client must not trust them blindly. Because the directory-side dedup guard makes a client REJECTION
+ * of a unilateral cert unrecoverable (a retry close is silently ignored — no receipt ever produced,
+ * worse than FINDING-3), the client CORRECTS rather than rejects:
+ *   - CLIENT-VERIFIABLE ('live') party: the present (submitting) party carries all its own signed
+ *     leaves, so its content_frontier_seq is fully re-derivable. The directory cannot forge signed
+ *     leaves, so the re-derived value is the provable truth → an inflated published value is OVERRIDDEN
+ *     DOWN to it (inflation neutralized, receipt still persisted).
+ *   - DIRECTORY-ATTESTED ('absent' / anything not 'live') party: its received-frontier remainder
+ *     (acks of the present party's content) lives with the absent party and was never provided, so a
+ *     published value ABOVE what the present party can derive is not provably inflation — left
+ *     untouched, directory-attested (already marked per-participant).
+ *
+ * The caller applies `corrections` to the persisted legibility and logs per `status`; it ALWAYS
+ * persists a receipt (never dead-ends the close).
+ */
+export function checkUnilateralFrontier(participants, frontierLeaves, sessionId) {
+    const corrections = new Map();
+    const haveLeaves = Array.isArray(frontierLeaves) && frontierLeaves.length > 0;
+    // Pre-FINDING-5 directory (no leaves): keep FINDING-3's directory-attested behavior. Never reject —
+    // rejecting would regress the shipped FINDING-3 receipt and break unilateral seals against a
+    // not-yet-upgraded directory during rollout.
+    if (!haveLeaves)
+        return { status: "directory_attested", corrections };
+    const rederived = reDeriveFrontiers(frontierLeaves, sessionId);
+    // Forged / cross-session leaves are the STRONGEST tamper evidence, so they get the strongest
+    // correction — treat them as ZERO trustworthy evidence (an empty derived map), which drives any
+    // 'live' frontier > 0 down to 0. (Leaving the published value untouched would make malformed leaves
+    // an EASIER inflation bypass than shipping none — cascade-2 re-review.) We still never REJECT
+    // (the directory dedup guard makes rejection an unrecoverable dead-end); the caller logs loudly.
+    const derived = rederived.ok ? rederived.frontiers : new Map();
+    // Only CLIENT-VERIFIABLE ('live') parties are re-derivable; override any value above the provable
+    // one DOWN to it. The absent party is directory-attested (its remainder is not re-derivable here).
+    for (const p of participants) {
+        if (p.attestation_mode !== "live")
+            continue;
+        const d = derived.get(p.pubkey.toLowerCase()) ?? 0;
+        if (p.content_frontier_seq > d)
+            corrections.set(p.pubkey.toLowerCase(), d);
+    }
+    if (!rederived.ok)
+        return { status: "leaves_invalid", corrections, reason: rederived.reason };
+    return { status: corrections.size > 0 ? "corrected" : "verified", corrections };
+}
 //# sourceMappingURL=seal-frontier-verify.js.map

package/dist/seal-frontier-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"seal-frontier-verify.js","sourceRoot":"","sources":["../src/seal-frontier-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAYhC,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,iBAA6B;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,4FAA4F;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,mCAAmC;QACnG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA6E,EAC7E,OAA4B;IAE5B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"seal-frontier-verify.js","sourceRoot":"","sources":["../src/seal-frontier-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAYhC,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,iBAA6B;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QACzD,CAAC;QACD,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACjD,CAAC;QACD,4FAA4F;QAC5F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,mCAAmC;QACnG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,GAAG,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,YAA6E,EAC7E,OAA4B;IAE5B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA6BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAA0D,EAC1D,cAA8C,EAC9C,SAAqB;IAErB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,oGAAoG;IACpG,6FAA6F;IAC7F,6CAA6C;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,iBAAiB,CAAC,cAAoC,EAAE,SAAS,CAAC,CAAC;IACrF,6FAA6F;IAC7F,gGAAgG;IAChG,oGAAoG;IACpG,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IAE/E,kGAAkG;IAClG,mGAAmG;IACnG,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,gBAAgB,KAAK,MAAM;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,oBAAoB,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IAC9F,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC;AAClF,CAAC"}