@optimystic/db-core 0.13.5 → 0.14.0

package/dist/src/matchmaking/voting-quorum.js

@@ -0,0 +1,238 @@
+/**
+ * Matchmaking — voting-quorum assembler (db-core, discovery-only composition).
+ *
+ * The voting subsystem's **discovery** flow, built as a thin composition over the matchmaking module
+ * (`docs/matchmaking.md` §Voting-quorum assembly). Matchmaking already provides "find the peers": the
+ * stable {@link import("./topic-anchor.js").MatchTopicAnchor}, the signed provider registration
+ * ({@link MatchmakingProvider}), the single-cohort hang-out walk and the hot-topic multi-cohort sweep,
+ * and the reply-side per-entry `registrationSig` re-validation ({@link verifyProviderEntry}). This
+ * module adds the small amount of glue that turns that surface into "assemble a quorum of eligible
+ * voters for proposal `P`".
+ *
+ * **No matchmaking wire-protocol change is introduced.** The genuinely voting-layer pieces are injected
+ * or left out of scope entirely:
+ *
+ * - **Eligibility proof minting** — the caller mints an opaque proof (a signature over the proposal from
+ *   a stake-bearing key, etc.) and supplies the {@link VotingQuorumRequest.verifyEligibility} predicate
+ *   over it. Matchmaking treats the proof as opaque bytes carried in the provider's `capabilities`.
+ * - **The quorum selection rule** (random sample, stake-weighted, geographic) — injected via
+ *   {@link VotingQuorumRequest.select}; the default is first-`targetSize`.
+ * - **Ballots, tally, dispute, ballot privacy** — out of scope; a separate forthcoming voting doc.
+ *
+ * ## Resolved design decisions (`docs/matchmaking.md` §Voting-quorum assembly)
+ *
+ * 1. **Reply-side per-entry verification is the default and required path; a client-side reputation
+ *    pre-filter is optional and additive.** Quorum-assembly *liveness* must never depend on
+ *    reputation-subsystem *availability*, so reputation is an optimization, never a dependency.
+ *    Matchmaking forwards each entry's `registrationSig` plus the eligibility proof in `capabilities`,
+ *    so reply-side verification is effectively free; the cohort returns ineligible entries the
+ *    coordinator discards (bandwidth bounded by `query_limit_max × swept-cohort-count`).
+ * 2. **Flash-vote fairness among competing coordinators is a voting-layer concern; no matchmaking signal
+ *    is added.** Matchmaking returns an advisory *candidate set*, never an allocation — overlapping sets
+ *    are expected and quorum non-collision is decided by the voting protocol.
+ * 3. **No matchmaking protocol additions are needed.** `AggregateCountV1` is threshold-signed (an
+ *    attested *registered*-provider count); an attested *eligible*-voter count, if voting needs one, is a
+ *    voting-layer aggregate computed after discovery+verification, not a matchmaking message.
+ * 4. **Quorum-assembler delegation.** The seeker role may be held by the coordinator itself or by a
+ *    delegated assembler peer; whoever holds it owns `patienceMs` and the reply-side re-validation duty.
+ *    A delegated assembler returns an already-validated {@link ProviderEntryV1}`[]`; because every entry
+ *    carries `registrationSig` + the proof in `capabilities`, the set is independently checkable, so the
+ *    coordinator MAY re-validate (trust-but-verify) on receipt by re-running the verify→select pipeline.
+ *
+ * ## Architecture seam
+ *
+ * db-core is transport-free, so the actual discovery I/O (the register/query/renew walk, the root
+ * `AggregateCountV1` sweep) is **injected** as a {@link QuorumDiscovery} port — exactly as the seeker
+ * walk client and entry verifier are injected elsewhere in this module. db-p2p binds the port to
+ * `MatchmakingSeeker.walk` (single-cohort) and `multi-cohort-seeker` (sweep). The assembler itself never
+ * dials voters, never collects ballots, never tallies.
+ */
+import { createMatchTopicAnchor } from "./topic-anchor.js";
+import { MatchmakingProvider } from "./provider.js";
+import { verifyProviderEntry } from "./wire.js";
+/** Default concurrent-vote-collection budget for a registered voter — accepts one vote-collection RPC. */
+export const DEFAULT_VOTER_CAPACITY_BUDGET = 1;
+/**
+ * Indicative `patienceMs` range for voting-quorum assembly (`docs/matchmaking.md` §Patience budgeting).
+ * Advisory only — the layer does not dictate; {@link VotingQuorumAssembler.assembleQuorum} requires a
+ * positive budget but does not clamp to this window.
+ */
+export const VOTING_PATIENCE_MIN_MS = 30_000;
+export const VOTING_PATIENCE_MAX_MS = 300_000;
+/**
+ * Reserved capability-tag prefix carrying a voter's opaque eligibility proof. The proof is bound into the
+ * provider `capabilities`, which {@link import("./wire.js").providerSigningPayload} covers, so the
+ * provider's `registrationSig` attests the proof verbatim. The caller's `verifyEligibility` predicate
+ * reads it back from the forwarded entry via {@link eligibilityProofOf}.
+ */
+export const ELIGIBILITY_TAG_PREFIX = "voter-eligibility:";
+/** Encode an opaque eligibility proof as the reserved capability tag. */
+export function eligibilityTag(proof) {
+    return ELIGIBILITY_TAG_PREFIX + proof;
+}
+/** Extract the eligibility proof from a capability set, or `undefined` if no eligibility tag is present. */
+export function eligibilityProofFromCapabilities(capabilities) {
+    const tag = capabilities.find((c) => c.startsWith(ELIGIBILITY_TAG_PREFIX));
+    return tag === undefined ? undefined : tag.slice(ELIGIBILITY_TAG_PREFIX.length);
+}
+/** Extract the eligibility proof carried by a forwarded {@link ProviderEntryV1} (`undefined` if absent). */
+export function eligibilityProofOf(entry) {
+    return eligibilityProofFromCapabilities(entry.capabilities);
+}
+/**
+ * Discovery-only voting-quorum assembler over the matchmaking module. One instance can act in either
+ * role: a voter calls {@link registerEligibleVoter}; a coordinator (or delegated assembler) calls
+ * {@link assembleQuorum}. Deps are role-specific and asserted per method, so a coordinator need not
+ * supply `sign`/`registerProvider` and a voter need not supply `discovery`/`verifyEntrySig`.
+ */
+export class VotingQuorumAssembler {
+    anchor;
+    deps;
+    clock;
+    constructor(deps = {}) {
+        this.deps = deps;
+        this.anchor = deps.anchor ?? createMatchTopicAnchor();
+        this.clock = deps.clock ?? (() => Date.now());
+    }
+    /**
+     * The quorum topic anchor for a proposal: `kind = "quorum"`, `label = proposalHash`, yielding
+     * `topicId = H("quorum" ‖ proposalHash ‖ "match")` via the matchmaking topic anchor.
+     */
+    static quorumTopic(proposalHash) {
+        return { kind: "quorum", label: proposalHash };
+    }
+    /** Resolve the cohort-topic `topicId` for a proposal's quorum topic. */
+    topicIdFor(proposalHash) {
+        const { kind, label } = VotingQuorumAssembler.quorumTopic(proposalHash);
+        return this.anchor.topicId(kind, label);
+    }
+    /**
+     * Voter side: bind the caller-minted eligibility proof into `capabilities`, build the signed provider
+     * registration, and register it at the quorum topic (cohort-topic T2). The proof is opaque to
+     * matchmaking; the provider `signature` covers `(topicId, capabilities, capacityBudget)`, so it binds
+     * the proof to the registration.
+     */
+    async registerEligibleVoter(req) {
+        const sign = this.requireSign();
+        const registerProvider = this.requireRegisterProvider();
+        const topicId = this.topicIdFor(req.proposalHash);
+        const capacityBudget = req.capacityBudget ?? DEFAULT_VOTER_CAPACITY_BUDGET;
+        const capabilities = mergeEligibilityCapabilities(req.capabilityTags ?? [], req.eligibilityProof);
+        const provider = new MatchmakingProvider({
+            topicId,
+            capabilities,
+            capacityBudget,
+            contactHint: req.contactHint,
+            sign,
+            ...(req.serviceUntil !== undefined ? { serviceUntil: req.serviceUntil } : {}),
+            ...(this.deps.randomBytes !== undefined ? { randomBytes: this.deps.randomBytes } : {}),
+        });
+        await registerProvider({ topicId, appPayloadBytes: await provider.appPayloadBytes() });
+    }
+    /**
+     * Coordinator / delegated-assembler side: discover → verify → select. Drives the single-cohort walk,
+     * escalates to the multi-cohort sweep on a hot topic (`childCohortCount > 0`) or when `preferSweep`,
+     * dedups by `participantId`, applies the optional reputation pre-filter, re-validates each entry's
+     * `registrationSig` **and** `verifyEligibility`, then applies the selection rule. Passes the *draining*
+     * patience budget to each discovery hop (walk, then sweep) — the deadline is fixed at entry and each
+     * hop receives the remaining slice — and on exhaustion returns whatever matched with `metTarget = false`.
+     * (Both legs honour `patienceMs`: the walk enforces a wall-clock deadline across hops and hang-out; the
+     * sweep stops starting new shard queries once the budget drains. The residual is at most one in-flight
+     * shard RPC — assembly never blocks materially past `patienceMs`.)
+     */
+    async assembleQuorum(req) {
+        const discovery = this.requireDiscovery();
+        const verifyEntrySig = this.requireVerifyEntrySig();
+        const targetSize = requireTargetSize(req.targetSize);
+        requirePositivePatience(req.patienceMs);
+        const topicId = this.topicIdFor(req.proposalHash);
+        const deadline = this.clock() + req.patienceMs;
+        const remaining = () => Math.max(0, deadline - this.clock());
+        // Step 2: single-cohort walk, then the single-vs-sweep decision.
+        const walkSlice = await discovery.walk({ topicId, wantCount: targetSize, patienceMs: remaining() });
+        const swept = req.preferSweep === true || walkSlice.childCohortCount > 0;
+        const slices = [walkSlice];
+        if (swept) {
+            slices.push(await discovery.sweep({ topicId, wantCount: targetSize, patienceMs: remaining() }));
+        }
+        // Step 3: dedup the unioned candidate set by participantId (defensive — promotion/redirect overlap).
+        const candidates = dedupByParticipant(slices.flatMap((s) => [...s.entries]));
+        // Step 4: optional, additive reputation pre-filter (bandwidth/quality trim; never a dependency).
+        const prefiltered = req.reputationPrefilter ? req.reputationPrefilter([...candidates]) : candidates;
+        // Step 5: reply-side default — both registrationSig re-validation AND verifyEligibility must pass.
+        const eligible = prefiltered.filter((entry) => verifyProviderEntry(topicId, entry, verifyEntrySig) && req.verifyEligibility(entry));
+        // Step 6: selection rule (default first targetSize), deduped defensively.
+        const select = req.select ?? defaultSelect;
+        const quorum = dedupByParticipant(select([...eligible], targetSize));
+        return {
+            quorum,
+            candidates: candidates.length,
+            eligible: eligible.length,
+            metTarget: quorum.length >= targetSize,
+            swept,
+        };
+    }
+    requireDiscovery() {
+        if (this.deps.discovery === undefined) {
+            throw new Error("VotingQuorumAssembler.assembleQuorum requires a `discovery` dependency");
+        }
+        return this.deps.discovery;
+    }
+    requireVerifyEntrySig() {
+        if (this.deps.verifyEntrySig === undefined) {
+            throw new Error("VotingQuorumAssembler.assembleQuorum requires a `verifyEntrySig` dependency");
+        }
+        return this.deps.verifyEntrySig;
+    }
+    requireSign() {
+        if (this.deps.sign === undefined) {
+            throw new Error("VotingQuorumAssembler.registerEligibleVoter requires a `sign` dependency");
+        }
+        return this.deps.sign;
+    }
+    requireRegisterProvider() {
+        if (this.deps.registerProvider === undefined) {
+            throw new Error("VotingQuorumAssembler.registerEligibleVoter requires a `registerProvider` dependency");
+        }
+        return this.deps.registerProvider;
+    }
+}
+/** The default selection rule: take the first `targetSize` eligible entries (the discovery order). */
+export function defaultSelect(eligible, targetSize) {
+    return eligible.slice(0, targetSize);
+}
+/**
+ * Merge application capability tags with the eligibility proof tag: drop any caller-supplied tag that
+ * already uses the reserved prefix (the proof is authoritative), then append exactly one proof tag.
+ * Order is preserved end-to-end (the cohort forwards `capabilities` verbatim), so the provider signature
+ * reconstructs byte-for-byte on the seeker side.
+ */
+function mergeEligibilityCapabilities(tags, proof) {
+    const appTags = tags.filter((tag) => !tag.startsWith(ELIGIBILITY_TAG_PREFIX));
+    return [...appTags, eligibilityTag(proof)];
+}
+/** Dedup entries by `participantId`, keeping the first occurrence (preserves discovery/FCFS order). */
+function dedupByParticipant(entries) {
+    const seen = new Map();
+    for (const entry of entries) {
+        if (!seen.has(entry.participantId)) {
+            seen.set(entry.participantId, entry);
+        }
+    }
+    return [...seen.values()];
+}
+/** Validate `targetSize` is an integer `>= 1`. */
+function requireTargetSize(targetSize) {
+    if (!Number.isInteger(targetSize) || targetSize < 1) {
+        throw new RangeError(`voting quorum: targetSize must be an integer >= 1, got ${targetSize}`);
+    }
+    return targetSize;
+}
+/** Validate `patienceMs` is a finite number `> 0` (the voting 30–300 s range is advisory, not enforced). */
+function requirePositivePatience(patienceMs) {
+    if (!Number.isFinite(patienceMs) || patienceMs <= 0) {
+        throw new RangeError(`voting quorum: patienceMs must be a finite number > 0, got ${patienceMs}`);
+    }
+    return patienceMs;
+}
+//# sourceMappingURL=voting-quorum.js.map

package/dist/src/matchmaking/voting-quorum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voting-quorum.js","sourceRoot":"","sources":["../../../src/matchmaking/voting-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,sBAAsB,EAAyB,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAA+C,MAAM,WAAW,CAAC;AAE7F,0GAA0G;AAC1G,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,OAAO,sBAAsB,GAAG,KAAK,CAAC;AACvC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,gCAAgC,CAAC,YAA+B;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC3E,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACxD,OAAO,gCAAgC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AA8HD;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IAChB,MAAM,CAAmB;IACzB,IAAI,CAA4B;IAChC,KAAK,CAAe;IAErC,YAAY,OAAkC,EAAE;QAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,sBAAsB,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,YAAoB;QACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,UAAU,CAAC,YAAoB;QAC9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,GAAiC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,6BAA6B,CAAC;QAC3E,MAAM,YAAY,GAAG,4BAA4B,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAElG,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC;YACxC,OAAO;YACP,YAAY;YACZ,cAAc;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI;YACJ,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC,CAAC;QAEH,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAAC,GAAwB;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;QAC/C,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAErE,iEAAiE;QACjE,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,SAAS,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACzE,MAAM,MAAM,GAA2B,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;QAED,qGAAqG;QACrG,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAE7E,iGAAiG;QACjG,MAAM,WAAW,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAEpG,mGAAmG;QACnG,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAClC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAC9F,CAAC;QAEF,0EAA0E;QAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;QAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAErE,OAAO;YACN,MAAM;YACN,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,UAAU;YACtC,KAAK;SACL,CAAC;IACH,CAAC;IAEO,gBAAgB;QACvB,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAC5B,CAAC;IAEO,qBAAqB;QAC5B,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IACjC,CAAC;IAEO,WAAW;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,uBAAuB;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACnC,CAAC;CACD;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,QAA2B,EAAE,UAAkB;IAC5E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,IAAuB,EAAE,KAAa;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,OAAmC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,kDAAkD;AAClD,SAAS,iBAAiB,CAAC,UAAkB;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,0DAA0D,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,4GAA4G;AAC5G,SAAS,uBAAuB,CAAC,UAAkB;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,8DAA8D,UAAU,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC"}

package/dist/src/matchmaking/wire.d.ts

@@ -0,0 +1,259 @@
+/**
+ * Matchmaking — V1 wire types, codecs, and per-message validation.
+ *
+ * Transcribed from `docs/matchmaking.md` §Wire formats. Matchmaking reuses the cohort-topic
+ * `RegisterV1` / `RenewV1` envelopes **unchanged**; the matchmaking-specific shape lives in two
+ * places:
+ *
+ *  1. **App payloads** ({@link ProviderAppPayloadV1} / {@link SeekerAppPayloadV1}) carried opaquely
+ *     inside `RegisterV1.appPayload`. These are serialized to UTF-8 JSON bytes and handed to the
+ *     cohort-topic {@link import("../cohort-topic/service.js").RegisterRequest}`.appPayload` slot,
+ *     which base64url-encodes them on the wire. They are therefore **not** length-framed here — the
+ *     cohort-topic `RegisterV1` frame wraps them.
+ *
+ *  2. **Query-protocol messages** ({@link QueryV1} / {@link QueryReplyV1} / {@link AggregateCountV1})
+ *     sent as standalone RPCs over the matchmaking application protocol. These ride the same
+ *     length-prefixed UTF-8 JSON framing as cohort-topic messages ({@link encodeCohortMessage}).
+ *
+ * Conventions (matching the cohort-topic wire conventions): all JSON, byte fields base64url (no
+ * padding), unix-millisecond timestamps, per-message structural validation on decode. Byte fidelity
+ * round-trips (encode→decode→encode is stable). The query-protocol producers (cohort-side reply,
+ * root-cohort aggregate sweep) land in later tickets; their decoders live here so the seeker side can
+ * be unit-tested against fixtures.
+ */
+import type { TopicTrafficV1 } from "../cohort-topic/wire/types.js";
+/** A provider's registration payload (`SubscribeAppPayloadV1.appPayload`, `kind == "match-provider"`). */
+export interface ProviderAppPayloadV1 {
+    kind: "match-provider";
+    /** Application-defined attribute tags. */
+    capabilities: string[];
+    /** Concurrent tasks accepted; `0` == "listed but full". */
+    capacityBudget: number;
+    /** Unix ms, soft expiry hint to seekers. */
+    serviceUntil?: number;
+    /** Multiaddr or PeerId-based callback. */
+    contactHint: string;
+    /** base64url, over `(topicId, capabilities, capacityBudget)` — see {@link providerSigningPayload}. */
+    signature: string;
+}
+/** A seeker's registration payload (`SubscribeAppPayloadV1.appPayload`, `kind == "match-seeker"`). */
+export interface SeekerAppPayloadV1 {
+    kind: "match-seeker";
+    /** Number of providers desired. */
+    wantCount: number;
+    /** Optional capability filter. */
+    filter?: CapabilityFilter;
+    /** For collective-assembly use. */
+    contactHint: string;
+    /** Opt into arrival pushes; default false (poll path). */
+    pushOnArrival?: boolean;
+    /** base64url. */
+    signature: string;
+}
+/** A capability filter, evaluated locally at the cohort (advisory — the seeker re-validates). */
+export interface CapabilityFilter {
+    /** Tags that must all be present. */
+    must: string[];
+    /** Tags that must not be present. */
+    mustNot: string[];
+    /** Skip providers whose `capacityBudget` is below this. */
+    minBudget?: number;
+}
+/** A seeker's query against a cohort for the providers/seekers it holds. */
+export interface QueryV1 {
+    v: 1;
+    /** Topic id, base64url. */
+    topicId: string;
+    includeProviders: boolean;
+    includeSeekers: boolean;
+    filter?: CapabilityFilter;
+    /** `<= query_limit_max` (256). */
+    limit: number;
+    /** Requesting PeerId. */
+    requesterId: string;
+    /** Unix ms. */
+    timestamp: number;
+    /** base64url. */
+    signature: string;
+}
+/** A cohort's advisory reply to a {@link QueryV1} (signed by the cohort primary, not threshold). */
+export interface QueryReplyV1 {
+    v: 1;
+    providers?: ProviderEntryV1[];
+    seekers?: SeekerEntryV1[];
+    truncated: boolean;
+    /** base64url. */
+    cohortEpoch: string;
+    /** From cohort-topic; consumed by the hang-out engine (next ticket). */
+    topicTraffic: TopicTrafficV1;
+    /** Cohort PRIMARY single-member signature (NOT threshold), base64url. */
+    signature: string;
+}
+/** A provider entry in a {@link QueryReplyV1}. */
+export interface ProviderEntryV1 {
+    /** PeerId. */
+    participantId: string;
+    capabilities: string[];
+    capacityBudget: number;
+    contactHint: string;
+    /** Unix ms. */
+    attachedAt: number;
+    /** Provider's original signature, forwarded for seeker re-validation, base64url. */
+    registrationSig: string;
+}
+/** A seeker entry in a {@link QueryReplyV1} (collective-assembly discovery). */
+export interface SeekerEntryV1 {
+    /** PeerId. */
+    participantId: string;
+    wantCount: number;
+    contactHint: string;
+    /** Unix ms. */
+    attachedAt: number;
+    /** base64url. */
+    registrationSig: string;
+}
+/**
+ * Root-cohort multi-cohort-sweep summary (`docs/matchmaking.md` §Aggregated provider counts).
+ *
+ * Unlike {@link QueryReplyV1}, this is **threshold-signed** — it attests a cohort-agreed *registered*
+ * provider count, not one primary's advisory view — so it carries the same `(thresholdSig, signers)`
+ * envelope the cohort-topic {@link import("../cohort-topic/wire/types.js").PromotionNoticeV1} uses:
+ * `signature` is the concatenated cohort multisig blob and `signers` is the distinct `>= minSigs` member
+ * subset that produced it. A verifier splits the blob by `signers` and checks the subset against the
+ * cohort membership certificate (db-p2p binds the crypto). `signers` is required precisely because a
+ * threshold blob is unverifiable without the signer set that aligns chunk `i` ↔ `signers[i]`.
+ */
+export interface AggregateCountV1 {
+    v: 1;
+    /** Topic id, base64url. */
+    topicId: string;
+    /** `count` is log-bucketed (see {@link logBucketCount}). */
+    bucketCounts: AggregateBucketV1[];
+    /** Cohort threshold-signature blob over {@link aggregateCountSigningPayload}, base64url. */
+    signature: string;
+    /** PeerIds of the `>= minSigs` threshold signers, base64url (aligns the `signature` blob). */
+    signers: string[];
+    /** base64url. */
+    cohortEpoch: string;
+}
+/** One bucketed shard count inside an {@link AggregateCountV1}. */
+export interface AggregateBucketV1 {
+    targetTier: number;
+    prefixSlot: number;
+    /** Log-bucketed. */
+    count: number;
+}
+/** Ceiling for an opaque app payload (provider/seeker), guarding decode allocation. */
+export declare const DEFAULT_MAX_APP_PAYLOAD_BYTES: number;
+/** Narrow an already-parsed value to {@link ProviderAppPayloadV1}, throwing on any defect. */
+export declare function validateProviderAppPayloadV1(value: unknown): ProviderAppPayloadV1;
+/** Narrow an already-parsed value to {@link SeekerAppPayloadV1}, throwing on any defect. */
+export declare function validateSeekerAppPayloadV1(value: unknown): SeekerAppPayloadV1;
+/** Serialize a {@link ProviderAppPayloadV1} to the opaque UTF-8 JSON bytes for `RegisterV1.appPayload`. */
+export declare function encodeProviderAppPayload(payload: ProviderAppPayloadV1): Uint8Array;
+/** Decode opaque `RegisterV1.appPayload` bytes back to a validated {@link ProviderAppPayloadV1}. */
+export declare function decodeProviderAppPayload(bytes: Uint8Array, maxBytes?: number): ProviderAppPayloadV1;
+/** Serialize a {@link SeekerAppPayloadV1} to the opaque UTF-8 JSON bytes for `RegisterV1.appPayload`. */
+export declare function encodeSeekerAppPayload(payload: SeekerAppPayloadV1): Uint8Array;
+/** Decode opaque `RegisterV1.appPayload` bytes back to a validated {@link SeekerAppPayloadV1}. */
+export declare function decodeSeekerAppPayload(bytes: Uint8Array, maxBytes?: number): SeekerAppPayloadV1;
+/** Either matchmaking registration payload, discriminated by `kind`. */
+export type MatchAppPayloadV1 = ProviderAppPayloadV1 | SeekerAppPayloadV1;
+/**
+ * Decode an opaque `RegisterV1.appPayload` to whichever matchmaking payload it carries, dispatched on
+ * `kind` (parsed once — no exception-as-control-flow). The cohort query handler uses this to classify a
+ * registration record into a provider vs. seeker entry. Throws {@link CohortWireError} on an unknown
+ * `kind` or a malformed payload.
+ */
+export declare function decodeMatchAppPayload(bytes: Uint8Array, maxBytes?: number): MatchAppPayloadV1;
+/** Narrow an already-parsed value to {@link QueryV1}, throwing on any defect. */
+export declare function validateQueryV1(value: unknown): QueryV1;
+/** Narrow an already-parsed value to {@link QueryReplyV1}, throwing on any defect. */
+export declare function validateQueryReplyV1(value: unknown): QueryReplyV1;
+/** Narrow an already-parsed value to {@link AggregateCountV1}, throwing on any defect. */
+export declare function validateAggregateCountV1(value: unknown): AggregateCountV1;
+/** Encode a {@link QueryV1} as a length-prefixed UTF-8 JSON frame. */
+export declare function encodeQueryV1(msg: QueryV1, maxMessageBytes?: number): Uint8Array;
+/** Decode a length-prefixed {@link QueryV1} frame. */
+export declare function decodeQueryV1(bytes: Uint8Array, maxMessageBytes?: number): QueryV1;
+/** Encode a {@link QueryReplyV1} as a length-prefixed UTF-8 JSON frame. */
+export declare function encodeQueryReplyV1(msg: QueryReplyV1, maxMessageBytes?: number): Uint8Array;
+/** Decode a length-prefixed {@link QueryReplyV1} frame. */
+export declare function decodeQueryReplyV1(bytes: Uint8Array, maxMessageBytes?: number): QueryReplyV1;
+/** Encode an {@link AggregateCountV1} as a length-prefixed UTF-8 JSON frame. */
+export declare function encodeAggregateCountV1(msg: AggregateCountV1, maxMessageBytes?: number): Uint8Array;
+/** Decode a length-prefixed {@link AggregateCountV1} frame. */
+export declare function decodeAggregateCountV1(bytes: Uint8Array, maxMessageBytes?: number): AggregateCountV1;
+/**
+ * Canonical signed byte image of a provider registration — `(topicId, capabilities, capacityBudget)`
+ * per `docs/matchmaking.md` §Wire formats.
+ *
+ * **Signing scope (resolved):** the signed image deliberately excludes the matchmaking
+ * `correlationId`. The advisory trust model (matchmaking.md §Wire formats) requires a seeker to
+ * re-validate each forwarded {@link ProviderEntryV1}'s `registrationSig`, and a {@link ProviderEntryV1}
+ * carries **no** `correlationId` field — so binding the signature over `correlationId` would leave the
+ * seeker unable to reconstruct the exact signed image. Dropping it (option (b) of the implement ticket)
+ * keeps the signed image fully self-contained in the forwarded entry: `topicId` (the topic the seeker
+ * queried) + `capabilities` + `capacityBudget`. Replay-binding of the *registration* is handled
+ * independently by the cohort-topic `RegisterV1` envelope (its own `correlationId` + replay guard +
+ * peer-key signature); the matchmaking signature only attests provider authorship of the advertised
+ * capabilities, which the participant peer key (the entry's `participantId`) anchors.
+ *
+ * Determinism comes from an explicitly-ordered array (stable, unlike object key order), exactly like
+ * the cohort-topic `registerSigningPayload`. `topicId` is passed as raw bytes and emitted as base64url
+ * so signer and verifier agree byte-for-byte.
+ */
+export declare function providerSigningPayload(topicId: Uint8Array, capabilities: readonly string[], capacityBudget: number): Uint8Array;
+/**
+ * Canonical signed byte image of a seeker registration — `(topicId, wantCount)`. Mirrors the provider
+ * scope (option (b), see {@link providerSigningPayload}): the image excludes `correlationId` so it is
+ * fully reconstructable from a forwarded {@link SeekerEntryV1} (`participantId` + `wantCount`) for
+ * collective-assembly re-validation.
+ */
+export declare function seekerSigningPayload(topicId: Uint8Array, wantCount: number): Uint8Array;
+/**
+ * Verifies a forwarded entry's `registrationSig`. db-core is crypto-free, so the actual peer-key check
+ * is injected (db-p2p binds it to {@link import("@optimystic/db-p2p").verifyPeerSig} over the
+ * participant's Ed25519 peer key). `signerId` is the entry's `participantId` (a peer-id string); the
+ * verifier resolves the public key from it. Returns `false` (never throws) on a malformed signature.
+ */
+export type EntrySigVerifier = (signerId: string, payload: Uint8Array, signature: Uint8Array) => boolean;
+/**
+ * Re-validate a forwarded {@link ProviderEntryV1} against the topic it was returned for: reconstruct the
+ * provider signing image from the entry's own fields and verify `registrationSig` against the entry's
+ * `participantId`. This is the seeker-side check the advisory trust model hinges on — the cohort vouches
+ * only for "these were the registrations I held", never for provider authenticity.
+ */
+export declare function verifyProviderEntry(topicId: Uint8Array, entry: ProviderEntryV1, verify: EntrySigVerifier): boolean;
+/** Re-validate a forwarded {@link SeekerEntryV1} (collective-assembly discovery), mirroring {@link verifyProviderEntry}. */
+export declare function verifySeekerEntry(topicId: Uint8Array, entry: SeekerEntryV1, verify: EntrySigVerifier): boolean;
+/**
+ * Canonical signed byte image of a {@link QueryReplyV1} — the cohort **primary's** single-member
+ * signature (not threshold), per `docs/matchmaking.md` §Wire formats. The primary vouches only for the
+ * *set it held*; provider authenticity is re-validated per entry via {@link verifyProviderEntry}. The
+ * image binds the epoch, truncation flag, traffic snapshot, and the participant ids of each returned
+ * entry (order-sensitive) so a tampered reply is detectable, while staying independent of the
+ * advisory per-entry signatures.
+ */
+export declare function queryReplySigningPayload(reply: Omit<QueryReplyV1, "signature">): Uint8Array;
+/**
+ * Log-bucket a raw provider count for an {@link AggregateCountV1} bucket: the largest power of two
+ * `<= n` (and `0` for `n <= 0`). The root reports bucketed, not exact, per-shard populations
+ * (`docs/matchmaking.md` §Multi-cohort sweep) — both to compress the summary and to avoid leaking exact
+ * counts.
+ *
+ * The bucketing rounds **down** and is monotonic non-decreasing, so a consumer summing bucketed counts
+ * (`multi-cohort-seeker.selectShards`) *under*-estimates the true population. That bias is the safe
+ * direction for shard selection: the real population is always `>=` the reported one, so selecting until
+ * the bucketed sum reaches `wantCount` naturally over-provisions rather than under-selecting.
+ */
+export declare function logBucketCount(n: number): number;
+/**
+ * Canonical threshold-signed byte image of an {@link AggregateCountV1} — covers the semantic fields
+ * (`v`, `topicId`, `cohortEpoch`, and the bucket set) but never the `signature`/`signers` envelope,
+ * exactly as the cohort-topic `sig/payloads.ts` builders do for their threshold-signed notices. The
+ * bucket set is sorted by `(targetTier, prefixSlot)` so the image is independent of bucket emission
+ * order — signer and verifier recompute identical bytes.
+ */
+export declare function aggregateCountSigningPayload(unsigned: Omit<AggregateCountV1, "signature" | "signers">): Uint8Array;
+//# sourceMappingURL=wire.d.ts.map

package/dist/src/matchmaking/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/matchmaking/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAKpE,0GAA0G;AAC1G,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAChC,qCAAqC;IACrC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,4EAA4E;AAC5E,MAAM,WAAW,OAAO;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,oGAAoG;AACpG,MAAM,WAAW,YAAY;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,cAAc,CAAC;IAC7B,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC/B,cAAc;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC7B,cAAc;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAChC,CAAC,EAAE,CAAC,CAAC;IACL,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB;IACjB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACd;AAOD,uFAAuF;AACvF,eAAO,MAAM,6BAA6B,QAAY,CAAC;AA2GvD,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAkBjF;AAED,4FAA4F;AAC5F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAoB7E;AAED,2GAA2G;AAC3G,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CAElF;AAED,oGAAoG;AACpG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,GAAE,MAAsC,GAAG,oBAAoB,CAElI;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,UAAU,CAE9E;AAED,kGAAkG;AAClG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,GAAE,MAAsC,GAAG,kBAAkB,CAE9H;AAED,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAE1E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,GAAE,MAAsC,GAAG,iBAAiB,CAU5H;AAsBD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAkBvD;AAsCD,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAwBjE;AAYD,0FAA0F;AAC1F,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAoBzE;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,GAAE,MAAkC,GAAG,UAAU,CAE3G;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAElF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,eAAe,GAAE,MAAkC,GAAG,UAAU,CAErH;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAE5F;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,EAAE,eAAe,GAAE,MAAkC,GAAG,UAAU,CAE7H;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAEpG;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,UAAU,CAO/H;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,CAMvF;AAID;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC;AAEzG;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAQlH;AAED,4HAA4H;AAC5H,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAQ9G;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG,UAAU,CAgB3F;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,SAAS,CAAC,GAAG,UAAU,CAWlH"}