@cello-protocol/daemon 0.0.44 → 0.0.46

package/dist/agent-id-migration.d.ts

@@ -0,0 +1,61 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+import type { Logger } from "./types.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+export interface AgentIdMigrationResult {
+    readonly migrated: boolean;
+    /** Rows copied, per rebuilt table. Absent tables are omitted. */
+    readonly rowCounts: Readonly<Record<string, number>>;
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export declare function migrateSessionTablesToAgentId(db: DaemonDatabase, logger: Logger): AgentIdMigrationResult;
+//# sourceMappingURL=agent-id-migration.d.ts.map

package/dist/agent-id-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.d.ts","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoJxD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD;AAyDD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CA0HxG"}

package/dist/agent-id-migration.js

@@ -0,0 +1,331 @@
+/**
+ * DOD-AGENT-ID-JOINKEY-1 — finish the migration REMOVE-001 started.
+ *
+ * `agent_name` was the original PRIMARY KEY of `agents`. REMOVE-001 added the stable surrogate
+ * `agent_id` **specifically to make names reusable** (retire keeps the rows and FREES the name), and
+ * migrated only the parent table. SEVEN child tables were left joining on the column that had just
+ * become a mutable, reusable attribute:
+ *
+ *   sessions · seal_interrupted_artifacts · session_tree_leaves · transcript · message_watermarks ·
+ *   contacts · retry_queue
+ *
+ * (`retry_queue` is the seventh — it predates REMOVE-001, so REMOVE-001 skipped seven, not six.)
+ *
+ * The hazard is not stale data. Retire an agent, create a new one with the freed name — a different
+ * agent_id and a different K_local keypair — and every `WHERE agent_name = ?` hands the new identity
+ * the dead one's transcript, its contact whitelist (an ACCESS-CONTROL list), and its interrupted
+ * sessions. Resuming one would seal with the wrong keypair.
+ *
+ * This module carries `agent_id` into all seven and demotes `agent_name` to what it always was after
+ * REMOVE-001: a display label on the parent table, with exactly one source of truth.
+ *
+ * ── Why this is safe, and why it deletes nothing ────────────────────────────────────────────────
+ * Purely client-side. The directory has no `agent_name` column and never sees one (AC1's wire proof:
+ * parties are identified by pubkey + session_id; a name reaches the wire only as the self-declared
+ * `offered_moniker` display label, which this migration does not touch). No row content is destroyed:
+ * every row is COPIED into the new table before the old one is dropped. Retire-reuse orphans need no
+ * purge either — once joined on `agent_id`, a new same-named agent simply never matches them.
+ *
+ * ── Why one transaction ─────────────────────────────────────────────────────────────────────────
+ * SQLite cannot alter a PRIMARY KEY, so each table must be REBUILT (create, copy, drop, rename).
+ * SQLite DDL is transactional, so all seven rebuilds run inside ONE `BEGIN…COMMIT`: a crash rolls the
+ * entire migration back atomically and the daemon reopens on the untouched original schema. There is
+ * no half-migrated state to recover from, and therefore no recovery code to get wrong.
+ *
+ * ── Why the target schema is pinned literally here ──────────────────────────────────────────────
+ * The DDL below duplicates what `session-node-manager` / `retry-queue` create on a fresh database.
+ * That duplication is DELIBERATE. A migration must migrate to a FIXED target: if it read its target
+ * from the live schema, a future column added upstream would silently change what this migration
+ * produces on an old database, and the two shapes would drift apart unnoticed. The drift is instead
+ * caught by a test that asserts a MIGRATED database's schema is byte-identical to a FRESH one.
+ */
+const REKEY_TARGETS = [
+    {
+        table: "sessions",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        session_id TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        counterparty_pubkey TEXT NOT NULL,
+        status TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL,
+        message_count INTEGER NOT NULL DEFAULT 0,
+        interrupted_at TEXT,
+        relay_peer_id TEXT,
+        relay_addrs TEXT,
+        seal_legibility TEXT,
+        sealed_root_hex TEXT,
+        counterparty_primary_pubkey TEXT,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "seal_interrupted_artifacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        own_leaf TEXT NOT NULL,
+        counterparty_leaf TEXT NOT NULL,
+        merkle_root TEXT NOT NULL,
+        nonce TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "session_tree_leaves",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        leaf_index INTEGER NOT NULL,
+        leaf_kind TEXT NOT NULL,
+        leaf_hash_hex TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, leaf_index)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "transcript",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        sequence INTEGER NOT NULL,
+        direction TEXT NOT NULL,
+        blob BLOB NOT NULL,
+        created_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, sequence, direction)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "message_watermarks",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        last_delivered_seq INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        table: "contacts",
+        backfill: "strict",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        agent_id TEXT NOT NULL,
+        pubkey TEXT NOT NULL,
+        added_at INTEGER NOT NULL,
+        moniker TEXT,
+        PRIMARY KEY (agent_id, pubkey)
+      )`,
+        indexSql: () => [],
+    },
+    {
+        // The SEVENTH. DOD-LOOP-1 added `agent_name` here so two of the operator's agents could hold
+        // awaiting content for the SAME session_id without colliding — then left the agent OUT of the
+        // uniqueness constraint, which stayed `UNIQUE(session_id, nonce_hex)`. For an awaiting row,
+        // nonce_hex IS the content hash, so two local agents parking identical content in one session
+        // collided, and the collision was swallowed into memory and lost on the next restart.
+        //
+        // The correct constraint falls out of the re-key. It is expressed as a UNIQUE INDEX over
+        // COALESCE(agent_id, '') rather than a table constraint, because SQLite treats NULLs as DISTINCT
+        // in a UNIQUE constraint: with a bare UNIQUE(agent_id, session_id, nonce_hex), the legacy
+        // agent-less direct-retry rows (agent_id NULL) would lose the (session_id, nonce_hex) dedup they
+        // have always had. COALESCE folds every agent-less row into one bucket, preserving exactly the
+        // old semantics for them while giving each agent its own namespace.
+        table: "retry_queue",
+        backfill: "nullable",
+        createSql: (t) => `
+      CREATE TABLE ${t} (
+        id              INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id      TEXT    NOT NULL,
+        agent_id        TEXT,
+        nonce_hex       TEXT    NOT NULL,
+        content_blob    BLOB    NOT NULL,
+        queued_at       INTEGER NOT NULL,
+        attempts        INTEGER NOT NULL DEFAULT 1,
+        position        INTEGER NOT NULL,
+        awaiting_ack    INTEGER NOT NULL DEFAULT 0,
+        content_hash_hex TEXT
+      )`,
+        indexSql: (t) => [
+            `CREATE INDEX IF NOT EXISTS retry_queue_by_session_position ON ${t}(session_id, position ASC)`,
+            `CREATE UNIQUE INDEX IF NOT EXISTS retry_queue_agent_session_nonce ON ${t}(COALESCE(agent_id, ''), session_id, nonce_hex)`,
+        ],
+    },
+];
+function columnsOf(db, table) {
+    return db.prepare(`PRAGMA table_info(${table})`).all().map((c) => c.name);
+}
+function tableExists(db, table) {
+    return (db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(table) !== undefined);
+}
+/**
+ * The `agent_name → agent_id` map, over ALL agent rows INCLUDING retired ones (a retired agent's rows
+ * must backfill to its OWN id and then sit inert — never be re-attributed to the live agent that
+ * reused its name).
+ *
+ * If any name resolves to more than one agent_id the map is AMBIGUOUS and the migration ABORTS. It
+ * does not guess, does not prefer the newest, does not prefer the oldest. A wrong attribution here
+ * would silently bind one identity's transcript, contacts and interrupted sessions to a DIFFERENT
+ * keypair — which is precisely the defect this migration exists to remove, except made permanent,
+ * unauditable, and blessed by a migration. A loud abort costs a wipe on a single-operator machine; a
+ * silent guess costs correctness forever.
+ *
+ * (A timestamp-based disambiguation is available in principle — rows written after the new agent's
+ * creation must belong to it, since a retired agent cannot write. It is deliberately NOT used: it
+ * depends on all seven tables carrying a trustworthy timestamp, and cleverness buys nothing on a
+ * database we would happily wipe.)
+ */
+function buildNameToAgentId(db) {
+    const rows = db
+        .prepare("SELECT agent_name, agent_id FROM agents")
+        .all();
+    const map = new Map();
+    const ambiguous = new Set();
+    for (const r of rows) {
+        if (map.has(r.agent_name))
+            ambiguous.add(r.agent_name);
+        map.set(r.agent_name, r.agent_id);
+    }
+    if (ambiguous.size > 0) {
+        throw new Error(`agent_id_backfill_ambiguous: agent name(s) [${[...ambiguous].sort().join(", ")}] resolve to more ` +
+            `than one agent_id (a retired agent's name was reused). The migration cannot know which identity ` +
+            `owns the existing session rows and refuses to guess — attributing them to the wrong keypair is ` +
+            `the very defect it exists to remove. Resolve by hand or start from a fresh database.`);
+    }
+    return map;
+}
+/** Does this table still need re-keying? True iff it exists and has no `agent_id` column. */
+function needsRekey(db, table) {
+    if (!tableExists(db, table))
+        return false;
+    return !columnsOf(db, table).includes("agent_id");
+}
+/**
+ * Re-key the seven child tables from `agent_name` to `agent_id`. Idempotent: a table that already has
+ * an `agent_id` column is skipped, so a second call is a no-op. All rebuilds share ONE transaction.
+ *
+ * Throws (leaving the database untouched) on:
+ *   - an ambiguous `agent_name → agent_id` map (a reused retired name),
+ *   - any row whose non-null `agent_name` does not resolve to an agent,
+ *   - any row count that does not match pre-migration.
+ *
+ * Never half-commits, never silently drops a row, never invents an agent_id.
+ */
+export function migrateSessionTablesToAgentId(db, logger) {
+    const pending = REKEY_TARGETS.filter((t) => needsRekey(db, t.table));
+    if (pending.length === 0)
+        return { migrated: false, rowCounts: {} };
+    // Ambiguity is checked BEFORE the transaction opens: nothing has been touched when it throws. It
+    // is logged with the same failure event as an in-transaction abort — a refusal to migrate is a
+    // loud event regardless of WHERE in the process it was detected.
+    let nameToId;
+    try {
+        nameToId = buildNameToAgentId(db);
+    }
+    catch (err) {
+        logger.error("daemon.migration.agent_id_backfill.failed", {
+            tables: pending.map((t) => t.table),
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    const before = new Map();
+    for (const t of pending) {
+        before.set(t.table, db.prepare(`SELECT COUNT(*) AS n FROM ${t.table}`).get().n);
+    }
+    const rowCounts = {};
+    db.exec("BEGIN");
+    try {
+        for (const target of pending) {
+            const oldCols = columnsOf(db, target.table);
+            const tmp = `${target.table}_rekey_new`;
+            db.exec(target.createSql(tmp));
+            // Copy every column the OLD table has that the NEW table also has (minus agent_name, which is
+            // replaced by agent_id). A pre-DOD-LOOP-1 retry_queue lacks agent_name/awaiting_ack entirely;
+            // taking the intersection handles every historical shape without a per-version special case.
+            const newCols = columnsOf(db, tmp);
+            const carried = oldCols.filter((c) => c !== "agent_name" && c !== "id" && newCols.includes(c));
+            const hasName = oldCols.includes("agent_name");
+            if (hasName) {
+                // Resolve through a JOIN on the parent so the mapping is the database's, not this process's.
+                // An unresolvable row is DROPPED by the inner join and caught by the count check below —
+                // for `strict` tables. For `nullable` (retry_queue), a NULL name must survive, so LEFT JOIN.
+                const join = target.backfill === "strict" ? "JOIN" : "LEFT JOIN";
+                db.exec(`INSERT INTO ${tmp} (agent_id${carried.length ? ", " + carried.join(", ") : ""})
+           SELECT a.agent_id${carried.length ? ", " + carried.map((c) => `t.${c}`).join(", ") : ""}
+           FROM ${target.table} t ${join} agents a ON a.agent_name = t.agent_name`);
+            }
+            else {
+                // No name to resolve (pre-DOD-LOOP-1 retry_queue): agent_id stays NULL — "not agent-scoped".
+                if (target.backfill === "strict") {
+                    throw new Error(`agent_id_backfill_impossible: table '${target.table}' has neither agent_name nor agent_id`);
+                }
+                db.exec(`INSERT INTO ${tmp} (${carried.join(", ")}) SELECT ${carried.map((c) => `t.${c}`).join(", ")} FROM ${target.table} t`);
+            }
+            const after = db.prepare(`SELECT COUNT(*) AS n FROM ${tmp}`).get().n;
+            const expected = before.get(target.table);
+            if (after !== expected) {
+                throw new Error(`agent_id_backfill_row_count_mismatch: table '${target.table}' had ${expected} row(s) before and ` +
+                    `${after} after the copy. A row failed to resolve to an agent_id (orphaned ${target.table}.agent_name ` +
+                    `with no matching agents row), or a name matched more than one agent. Refusing to commit.`);
+            }
+            // Completeness. `strict` → every row must carry an agent_id. `nullable` → only rows that HAD a
+            // name must; a row that was always agent-less legitimately stays NULL.
+            const unresolved = target.backfill === "strict"
+                ? db.prepare(`SELECT COUNT(*) AS n FROM ${tmp} WHERE agent_id IS NULL`).get().n
+                : hasName
+                    ? db
+                        .prepare(`SELECT COUNT(*) AS n FROM ${target.table} t WHERE t.agent_name IS NOT NULL
+                     AND NOT EXISTS (SELECT 1 FROM agents a WHERE a.agent_name = t.agent_name)`)
+                        .get().n
+                    : 0;
+            if (unresolved > 0) {
+                throw new Error(`agent_id_backfill_incomplete: table '${target.table}' has ${unresolved} row(s) whose agent could not ` +
+                    `be resolved to a stable agent_id. Refusing to commit a table with an unattributable row.`);
+            }
+            db.exec(`DROP TABLE ${target.table}`);
+            db.exec(`ALTER TABLE ${tmp} RENAME TO ${target.table}`);
+            for (const sql of target.indexSql(target.table))
+                db.exec(sql);
+            rowCounts[target.table] = after;
+        }
+        db.exec("COMMIT");
+    }
+    catch (err) {
+        // SQLite may have already aborted the transaction; a failing ROLLBACK must not mask the real error.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            /* the failing statement may have already aborted the txn */
+        }
+        logger.error("daemon.migration.agent_id_backfill.failed", {
+            tables: pending.map((t) => t.table),
+            reason: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    logger.info("daemon.migration.agent_id_backfill", {
+        tables: Object.keys(rowCounts),
+        rowCounts,
+        agentsMapped: nameToId.size,
+    });
+    return { migrated: true, rowCounts };
+}
+//# sourceMappingURL=agent-id-migration.js.map

package/dist/agent-id-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-id-migration.js","sourceRoot":"","sources":["../src/agent-id-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAqBH,MAAM,aAAa,GAA2B;IAC5C;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;;;;;QAed;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,4BAA4B;QACnC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;QAUd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;QAQd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;QAKd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;QAMd;QACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;KACnB;IACD;QACE,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,8FAA8F;QAC9F,sFAAsF;QACtF,EAAE;QACF,yFAAyF;QACzF,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,EAAE,aAAa;QACpB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;qBACD,CAAC;;;;;;;;;;;QAWd;QACJ,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACf,iEAAiE,CAAC,4BAA4B;YAC9F,wEAAwE,CAAC,iDAAiD;SAC3H;KACF;CACO,CAAC;AAQX,SAAS,SAAS,CAAC,EAAkB,EAAE,KAAa;IAClD,OAAQ,EAAE,CAAC,OAAO,CAAC,qBAAqB,KAAK,GAAG,CAAC,CAAC,GAAG,EAAyC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,EAAkB,EAAE,KAAa;IACpD,OAAO,CACL,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,SAAS,CACrG,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB,CAAC,EAAkB;IAC5C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,yCAAyC,CAAC;SAClD,GAAG,EAAgE,CAAC;IAEvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,EAAkB,EAAE,KAAa;IACnD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAAC,EAAkB,EAAE,MAAc;IAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEpE,iGAAiG;IACjG,+FAA+F;IAC/F,iEAAiE;IACjE,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAG,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAE7C,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,YAAY,CAAC;YAExC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/B,8FAA8F;YAC9F,8FAA8F;YAC9F,6FAA6F;YAC7F,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAE/F,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,6FAA6F;gBAC7F,yFAAyF;gBACzF,6FAA6F;gBAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;gBACjE,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,aAAa,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;8BAC1D,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;kBAChF,MAAM,CAAC,KAAK,MAAM,IAAI,0CAA0C,CACzE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,uCAAuC,CAC5F,CAAC;gBACJ,CAAC;gBACD,EAAE,CAAC,IAAI,CACL,eAAe,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,IAAI,CACtH,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC,CAAC;YACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,CAAC;YAC3C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,gDAAgD,MAAM,CAAC,KAAK,SAAS,QAAQ,qBAAqB;oBAChG,GAAG,KAAK,qEAAqE,MAAM,CAAC,KAAK,cAAc;oBACvG,0FAA0F,CAC7F,CAAC;YACJ,CAAC;YAED,+FAA+F;YAC/F,uEAAuE;YACvE,MAAM,UAAU,GACd,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAE,EAAE,CAAC,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAoB,CAAC,CAAC;gBAClG,CAAC,CAAC,OAAO;oBACP,CAAC,CACG,EAAE;yBACC,OAAO,CACN,6BAA6B,MAAM,CAAC,KAAK;+FACkC,CAC5E;yBACA,GAAG,EACP,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,KAAK,SAAS,UAAU,gCAAgC;oBACrG,0FAA0F,CAC7F,CAAC;YACJ,CAAC;YAED,EAAE,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACtC,EAAE,CAAC,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE9D,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAClC,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oGAAoG;QACpG,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACxD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;QAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,SAAS;QACT,YAAY,EAAE,QAAQ,CAAC,IAAI;KAC5B,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC"}

package/dist/agent-settings-keys.d.ts

@@ -0,0 +1,52 @@
+/**
+ * CELLO Daemon — the agent_settings key namespace (DOD-SETTINGS-1).
+ *
+ * A single source for every valid per-agent reachability-policy setting key, so the handler (which
+ * REFUSES an unknown key) and the consumers (TIER-BOUNDS-SETTINGS reads the bound overrides,
+ * AWAY-TIER-1 reads the away texts) can never drift. Keys are lower-snake, dotted namespaces:
+ *
+ *   bounds.<tier>.max_sessions   bounds.<tier>.max_bytes    — per-tier bound overrides
+ *   away.default                                            — the agent's default away text
+ *   away.tier.<tier>                                        — a per-tier away text
+ *
+ * `<tier>` is a tier NAME (not the integer), for legibility in the store. BLOCKED is deliberately NOT
+ * settable — 0/0 is fixed (you cannot "raise" a block), and it has no away text (a blocked sender is
+ * refused before any reply). So the settable tiers are unknown / known / whitelisted / vip.
+ */
+/** The tiers whose bounds and away texts are settable (BLOCKED is fixed, never overridable). */
+export declare const SETTABLE_TIER_NAMES: readonly ["unknown", "known", "whitelisted", "vip"];
+export type SettableTierName = (typeof SETTABLE_TIER_NAMES)[number];
+/** The tier NAME for a tier integer, or null for an unknown/unsettable value (e.g. BLOCKED=0).
+ *  Keyed off the TIER constants (review F3) so a renumbering in contacts-tier-migration can never
+ *  silently desync the settings namespace from the grid. */
+export declare function settableTierName(tier: number): SettableTierName | null;
+export type BoundField = "max_sessions" | "max_bytes";
+/** The setting key for a per-tier bound override. */
+export declare function boundSettingKey(tier: SettableTierName, field: BoundField): string;
+/** The setting key for a per-tier away text. */
+export declare function awayTierSettingKey(tier: SettableTierName): string;
+/** The setting key for the agent's default away text (the fallback below any per-tier text). */
+export declare const AWAY_DEFAULT_KEY = "away.default";
+/** True iff `key` is a known, settable reachability-policy key. An unknown key is REFUSED by the
+ *  handler (never silently stored — a typo'd key that persisted would be a setting that never takes
+ *  effect, invisible to the operator). */
+export declare function isValidSettingKey(key: string): boolean;
+/** The full list of valid keys (for surfacing in a settings-list / help). */
+export declare function allSettingKeys(): string[];
+/** True iff the key is a per-tier BOUND override (its value must be a positive integer). */
+export declare function isBoundKey(key: string): boolean;
+/**
+ * Validate a setting's VALUE for its key (DOD-TIER-BOUNDS-SETTINGS AC2). A bound override may only be
+ * a FINITE POSITIVE INTEGER — INV-TIER-BOUND: a setting can RAISE or lower a bound within finite
+ * limits, never REMOVE one. So `Infinity`, negatives, zero, non-integers, and non-numeric strings are
+ * refused (an unbounded tier is exactly what the grid forbids). Away-text values are free-form strings.
+ */
+export declare function validateSettingValue(key: string, value: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Max length of an away message (per-contact or per-tier/agent-default) — an answering-machine line. */
+export declare const AWAY_MESSAGE_MAX_LEN = 2048;
+//# sourceMappingURL=agent-settings-keys.d.ts.map

package/dist/agent-settings-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-settings-keys.d.ts","sourceRoot":"","sources":["../src/agent-settings-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,gGAAgG;AAChG,eAAO,MAAM,mBAAmB,qDAAqE,CAAC;AACtG,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;4DAE4D;AAC5D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAQtE;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;AAEtD,qDAAqD;AACrD,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAEjF;AAED,gDAAgD;AAChD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAEjE;AAED,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAa/C;;0CAE0C;AAC1C,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuB7G;AAED,yGAAyG;AACzG,eAAO,MAAM,oBAAoB,OAAO,CAAC"}

package/dist/agent-settings-keys.js

@@ -0,0 +1,96 @@
+/**
+ * CELLO Daemon — the agent_settings key namespace (DOD-SETTINGS-1).
+ *
+ * A single source for every valid per-agent reachability-policy setting key, so the handler (which
+ * REFUSES an unknown key) and the consumers (TIER-BOUNDS-SETTINGS reads the bound overrides,
+ * AWAY-TIER-1 reads the away texts) can never drift. Keys are lower-snake, dotted namespaces:
+ *
+ *   bounds.<tier>.max_sessions   bounds.<tier>.max_bytes    — per-tier bound overrides
+ *   away.default                                            — the agent's default away text
+ *   away.tier.<tier>                                        — a per-tier away text
+ *
+ * `<tier>` is a tier NAME (not the integer), for legibility in the store. BLOCKED is deliberately NOT
+ * settable — 0/0 is fixed (you cannot "raise" a block), and it has no away text (a blocked sender is
+ * refused before any reply). So the settable tiers are unknown / known / whitelisted / vip.
+ */
+import { TIER } from "./contacts-tier-migration.js";
+/** The tiers whose bounds and away texts are settable (BLOCKED is fixed, never overridable). */
+export const SETTABLE_TIER_NAMES = Object.freeze(["unknown", "known", "whitelisted", "vip"]);
+/** The tier NAME for a tier integer, or null for an unknown/unsettable value (e.g. BLOCKED=0).
+ *  Keyed off the TIER constants (review F3) so a renumbering in contacts-tier-migration can never
+ *  silently desync the settings namespace from the grid. */
+export function settableTierName(tier) {
+    switch (tier) {
+        case TIER.UNKNOWN: return "unknown";
+        case TIER.KNOWN: return "known";
+        case TIER.WHITELISTED: return "whitelisted";
+        case TIER.VIP: return "vip";
+        default: return null; // BLOCKED or out-of-range — not settable
+    }
+}
+/** The setting key for a per-tier bound override. */
+export function boundSettingKey(tier, field) {
+    return `bounds.${tier}.${field}`;
+}
+/** The setting key for a per-tier away text. */
+export function awayTierSettingKey(tier) {
+    return `away.tier.${tier}`;
+}
+/** The setting key for the agent's default away text (the fallback below any per-tier text). */
+export const AWAY_DEFAULT_KEY = "away.default";
+const BOUND_FIELDS = Object.freeze(["max_sessions", "max_bytes"]);
+/** Every valid setting key, precomputed. The handler validates a `set` against this exact set. */
+const VALID_KEYS = new Set([
+    AWAY_DEFAULT_KEY,
+    ...SETTABLE_TIER_NAMES.flatMap((t) => [
+        ...BOUND_FIELDS.map((f) => boundSettingKey(t, f)),
+        awayTierSettingKey(t),
+    ]),
+]);
+/** True iff `key` is a known, settable reachability-policy key. An unknown key is REFUSED by the
+ *  handler (never silently stored — a typo'd key that persisted would be a setting that never takes
+ *  effect, invisible to the operator). */
+export function isValidSettingKey(key) {
+    return VALID_KEYS.has(key);
+}
+/** The full list of valid keys (for surfacing in a settings-list / help). */
+export function allSettingKeys() {
+    return [...VALID_KEYS];
+}
+/** True iff the key is a per-tier BOUND override (its value must be a positive integer). */
+export function isBoundKey(key) {
+    return key.startsWith("bounds.");
+}
+/**
+ * Validate a setting's VALUE for its key (DOD-TIER-BOUNDS-SETTINGS AC2). A bound override may only be
+ * a FINITE POSITIVE INTEGER — INV-TIER-BOUND: a setting can RAISE or lower a bound within finite
+ * limits, never REMOVE one. So `Infinity`, negatives, zero, non-integers, and non-numeric strings are
+ * refused (an unbounded tier is exactly what the grid forbids). Away-text values are free-form strings.
+ */
+export function validateSettingValue(key, value) {
+    if (isBoundKey(key)) {
+        // `^[1-9][0-9]*$` — a positive integer with no sign, decimal, or `Infinity`/`NaN` spelling.
+        if (!/^[1-9][0-9]*$/.test(value)) {
+            return { ok: false, reason: "a bound must be a finite positive integer (no 0, negative, decimal, or Infinity)" };
+        }
+        // Number.MAX_SAFE_INTEGER guard — a value past it loses precision and is meaningless as a cap.
+        if (Number(value) > Number.MAX_SAFE_INTEGER) {
+            return { ok: false, reason: "a bound must be <= Number.MAX_SAFE_INTEGER" };
+        }
+        return { ok: true };
+    }
+    // Away-text (review F2/F3): an EMPTY / whitespace-only away text is refused — to CLEAR, use null
+    // (cello_contact_set_away) or omit the key; storing "" would silently blank every away reply,
+    // including the minimal stranger disclosure. Bounded to a sane length (an answering-machine line,
+    // not a document).
+    if (value.trim().length === 0) {
+        return { ok: false, reason: "an away message cannot be empty or whitespace-only (omit the key or pass null to clear)" };
+    }
+    if (value.length > AWAY_MESSAGE_MAX_LEN) {
+        return { ok: false, reason: `an away message must be <= ${AWAY_MESSAGE_MAX_LEN} characters` };
+    }
+    return { ok: true };
+}
+/** Max length of an away message (per-contact or per-tier/agent-default) — an answering-machine line. */
+export const AWAY_MESSAGE_MAX_LEN = 2048;
+//# sourceMappingURL=agent-settings-keys.js.map

package/dist/agent-settings-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-settings-keys.js","sourceRoot":"","sources":["../src/agent-settings-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AAEpD,gGAAgG;AAChG,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,CAAU,CAAC,CAAC;AAGtG;;4DAE4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,SAAS,CAAC;QACpC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC;QAChC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,aAAa,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5B,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,yCAAyC;IACjE,CAAC;AACH,CAAC;AAID,qDAAqD;AACrD,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,KAAiB;IACvE,OAAO,UAAU,IAAI,IAAI,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,OAAO,aAAa,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C,MAAM,YAAY,GAA0B,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzF,kGAAkG;AAClG,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAS;IACtD,gBAAgB;IAChB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,kBAAkB,CAAC,CAAC,CAAC;KACtB,CAAC;CACH,CAAC,CAAC;AAEH;;0CAE0C;AAC1C,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAa;IAC7D,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,4FAA4F;QAC5F,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;QACnH,CAAC;QACD,+FAA+F;QAC/F,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IACD,iGAAiG;IACjG,8FAA8F;IAC9F,kGAAkG;IAClG,mBAAmB;IACnB,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yFAAyF,EAAE,CAAC;IAC1H,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,oBAAoB,aAAa,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC"}