@optimystic/db-p2p 0.13.5 → 0.14.0

package/dist/src/cohort-topic/host.d.ts

@@ -0,0 +1,573 @@
+/**
+ * Cohort-topic FRET host (`docs/cohort-topic.md` §FRET integration L768-803).
+ *
+ * Composes the db-core substrate (participant-facing {@link CohortTopicService} + cohort-side
+ * {@link CohortMemberEngine}) over the FRET + libp2p ports and runs it as a service on one node:
+ *
+ * - registers the four `/optimystic/cohort-topic/1.0.0/*` protocols on the libp2p node;
+ * - sets FRET's activity handler so a `RouteAndMaybeAct`-routed `RegisterV1` runs the cohort decision;
+ * - binds the db-core ports to the FRET-backed adapters (router, gossip, membership, size estimator).
+ *
+ * **Per-served-coord scoping.** A topic's responsible cohort sits at `coord_0(_, topicId)` (and at
+ * `coord_d(P, topicId)` for `d ≥ 1`), which is unrelated to any node's own ring position. A node
+ * genuinely belongs to *many* cohorts — one per coord FRET routes to it — so this host keeps a lazy
+ * {@link CoordRegistry}: a `Map<servedCoord, CoordEngine>` where each {@link CoordEngine} owns the
+ * per-coord slice of state (its own store, gossip bus, willingness/traffic/renewal/cold-start, a
+ * {@link PromotionLifecycle} with coord-derived tier inputs, a {@link CohortMemberEngine}, its own
+ * {@link MembershipCertPublisher}, and its own real `k − x` threshold signer) and threshold-signs with
+ * the FRET cohort *around the served coord*. The node-wide collaborators (`hash`, `slots`, `barometer`,
+ * the FRET ports, the participant-facing service, and the verify-only verifier signer) stay singletons
+ * and are injected into each engine. The host recomputes the served coord from each decoded `RegisterV1`
+ * (`addressing.coord(treeTier, participantCoord, topicId)`), so both the activity callback and the direct
+ * `register` protocol handler dispatch to the right cohort.
+ *
+ * **Real threshold signatures.** Each coord engine assembles a genuine `k − x` cohort signature
+ * (a collected per-member Ed25519 multisig) over the new `/sign` protocol — see
+ * {@link FretCohortThresholdCrypto} — and drives a {@link MembershipCertPublisher}, so a remote
+ * `MembershipVerifier` can verify the served `MembershipCertV1` for real. Assembly needs the node's
+ * `options.privateKey`; key-less hosts compose but cannot threshold-sign (the publisher/promotion paths
+ * are simply not driven). The periodic membership refresh is exposed as the per-engine
+ * {@link CoordEngine.pumpMembership} / {@link CoordEngine.onStabilized} hooks for the gossip-cadence
+ * driver to call.
+ *
+ * **Anti-DoS + cold-start (gaps 6–7).** Each {@link CoordEngine} is injected its own per-coord anti-DoS
+ * guards — a `RegisterRateLimiter` (4/min per peer-topic), a `CorrelationReplayGuard` (60 s freshness),
+ * and a `TopicBudget` (2048 topics, LRU) — so a budget/limit at one coord is independent of another. The
+ * node-level {@link BootstrapEvidence} policy (one tier→verifier policy, no per-coord state) is built once
+ * and shared. db-core embeds no PoW / reputation scheme, so the host supplies the real verifiers
+ * ({@link createPoWVerifier} / {@link createReputationVerifier}) and the participant-side PoW minter
+ * ({@link createBootstrapEvidenceBuilder}): once configured, a node gates cold-root `bootstrap: true` at
+ * T2/T3 (PoW, or a referee reputation endorsement when offered, or a signed parent reference) and at T0/T1
+ * once a committed-existence backing is wired (a signed parent reference); a configured node with no such
+ * backing keeps T0/T1 permissive-but-logged so cold-root origination is not blocked
+ * (`cohort-topic-bootstrap-coldstart-origination-regression`), and an entirely unconfigured host stays
+ * permissive-but-logged at every tier (never an undefined gate). A cold-started tier-`d > 0` forwarder registers with
+ * its tier-`(d − 1)` parent by routing a forwarder-link frame over the router (gap 7), staying
+ * `awaiting_parent` until the ack.
+ *
+ * **Scope.** `followOn` derivation for a promoted-redirect arrival is parked in backlog
+ * (`cohort-topic-followon-derivation`); this milestone serves a **single tier-0 cohort**, so `followOn`
+ * stays `false` and tier-0 bootstrap instantiation goes through the `bootstrap: true` path. The
+ * behavioral substrate is validated at mock-tier by `test/cohort-topic/service.spec.ts` and end-to-end
+ * across a real multi-node cohort (real Ed25519 keys, mock transport routing the five protocols + FRET
+ * `routeAct`/`assembleCohort`) by `test/cohort-topic/live-tier.spec.ts`.
+ */
+import type { Libp2p } from "libp2p";
+import type { PrivateKey } from "@libp2p/interface";
+import type { FretService } from "p2p-fret";
+import { LruMap, type BootstrapEvidenceDeps, type CohortGossipV1, type CohortTopicService, type CohortMemberEngine, type CohortSnapshotView, type CohortView, type CorrelationReplayGuardConfig, type DemotionNoticeV1, type Forwarder, type MembershipCertV1, type MembershipVerifier, type NodeProfile, type PromotionConfig, type PromotionNoticeV1, type RegisterRateLimiter, type RegisterRateLimiterConfig, type RegistrationRecord, type RenewReplyV1, type RenewV1, type RingCoord, type SignReplyV1, type SignRequestV1, type TopicBudgetConfig, type TopicTrafficV1, type TrustRoot } from "@optimystic/db-core";
+import { FretCohortGossipTransport } from "./cohort-gossip-transport.js";
+import { type BootstrapReputationView } from "./bootstrap-evidence-verifiers.js";
+import { type BootstrapParentTopicView } from "./bootstrap-parent-reference.js";
+import { type CohortTopicProtocols } from "./protocols.js";
+export interface CohortTopicHostOptions {
+    /** Per-node tier profile. Default {@link coreProfile}. */
+    readonly profile?: NodeProfile;
+    /** Network name (namespaces the four protocol IDs); default uses the canonical IDs. */
+    readonly protocols?: CohortTopicProtocols;
+    /** Requested cohort size `wantK`. Default 16. */
+    readonly wantK?: number;
+    /** Threshold signers `minSigs = k − x`. Default {@link DEFAULT_MIN_SIGS}. */
+    readonly minSigs?: number;
+    /** Fan-out per tier `F`. Default 16. */
+    readonly fanout?: number;
+    /** Per-frame ceiling. Default {@link DEFAULT_STREAM_MAX_BYTES}. */
+    readonly maxBytes?: number;
+    /**
+     * Gossip-round cadence in ms (the periodic driver tick). Default {@link DEFAULT_GOSSIP_INTERVAL_MS}
+     * (~one round). Each tick drives every live {@link CoordEngine}'s gossip broadcast, TTL sweep,
+     * membership-cert refresh, and demotion check; the refresh (5 min) and demotion hysteresis (5 min)
+     * self-gate on elapsed time, so a fast tick is safe.
+     */
+    readonly gossipIntervalMs?: number;
+    /**
+     * The node's libp2p Ed25519 private key. Required for the live participant signer: register/renew
+     * bodies are peer-key-signed over their canonical image, and inbound register/`reattach` signatures
+     * are verified against the participant's claimed peer id. libp2p does not expose the key off
+     * `node.peerId`, so it is threaded explicitly (mirrors `clusterMember` / `DisputeService`, sourced
+     * from `options.privateKey ?? generateKeyPair('Ed25519')` in `libp2p-node-base.ts`). When omitted,
+     * the host falls back to the interim empty-string signer (one-time warn) and does **not** enforce
+     * inbound participant-signature verification, so unit tests compose without a key.
+     */
+    readonly privateKey?: PrivateKey;
+    /**
+     * Anti-DoS guard wiring (gap 6). The per-{@link CoordEngine} guards (rate limiter, replay guard,
+     * topic budget) and the node-level bootstrap-evidence policy are always constructed with documented
+     * defaults; this lets a caller (or a test) tune them. Omit for production defaults.
+     */
+    readonly antiDos?: CohortTopicAntiDosOptions;
+    /**
+     * Promotion / demotion lifecycle tuning (`cap_promote`, hysteresis windows, slope lookahead) applied
+     * to every {@link CoordEngine}'s {@link PromotionLifecycle}. Omit for the production defaults
+     * (`cap_promote = 64`, …); supply a lowered `capPromote` to drive promotion with a small participant
+     * count (the live-tier e2e). The single-cohort milestone never overrides `childCohortCount` / `treeTier`
+     * — those stay coord-derived — so only the count/load thresholds are tunable here.
+     */
+    readonly promotion?: PromotionConfig;
+    /**
+     * Optional committed-state existence reader backing the **committed-tier (T0/T1)** parent-reference
+     * bootstrap-evidence check (`cohort-topic-bootstrap-parent-reference`). Given `coord_0(parentTopicId)`,
+     * returns whether the node locally knows the parent topic's committed cohort exists. Threaded from
+     * node-base when a coord-keyed committed-membership index is available; when omitted, T0/T1 parent-ref
+     * existence fails closed (a FRET-cached cert must not vouch for committed-tier existence — committed-tier
+     * integrity) while T2/T3 parent-ref still consults the FRET membership cache. See
+     * {@link createDefaultParentTopicView}.
+     */
+    readonly committedParentTopicReader?: (coord: RingCoord) => boolean;
+    /**
+     * The participant's initial trust roots: the genesis-block-related cohorts, validated against the
+     * genesis block hash **out-of-band by the caller before seeding** (`docs/cohort-topic.md`
+     * §Bootstrapping trust). They are the base case of every attestation chain — a cert matching a root by
+     * `(coord, epoch, member-set)` is trusted directly, ahead of the FRET-ring direct anchor — so a forged
+     * cert for a genesis cohort is rejected even before the ring is consulted. Threaded straight into
+     * `createMembershipVerifier({ trustRoots })`.
+     *
+     * **Network-config, empty by default.** The concrete genesis-cohort set is a property of a specific
+     * network's genesis block; this is the typed seam, not a fabricated value. Omitted (the default `[]`)
+     * the verifier behaves exactly as with no roots — the chain bottoms out at the direct anchor / TOFU, so
+     * a network with no genesis cohort configured is never broken. Do **not** seed fake roots here.
+     */
+    readonly genesisTrustRoots?: readonly TrustRoot[];
+    /**
+     * Wall clock (ms) the `/sign` membership endorser uses for its `stabilizedAt` far-future sanity bound
+     * (a member refuses to co-sign a cert whose `stabilizedAt` is more than a few seconds ahead of its own
+     * clock — `cohort-topic-sign-endorsement-payload-binding`). Defaults to {@link Date.now}, the right
+     * choice for a production node. A **virtual-time** test harness (which drives publish `stabilizedAt`
+     * from arbitrary explicit timestamps rather than wall clock) injects a clock that does not trip the
+     * bound — e.g. `() => Number.POSITIVE_INFINITY` — so its synthetic future timestamps are not rejected.
+     */
+    readonly now?: () => number;
+}
+export type { BootstrapReputationView } from "./bootstrap-evidence-verifiers.js";
+/**
+ * Anti-DoS wiring overrides for a {@link CohortTopicHost} (`docs/cohort-topic.md` §Anti-DoS).
+ *
+ * The rate limiter, replay guard, and topic budget are **per-served-coord** (they key on
+ * `(peer, topic)` / per-cohort topic state, which is coord-scoped) — one set is built per
+ * {@link CoordEngine} from these configs. The bootstrap-evidence policy is **node-level** (a
+ * tier→verifier policy with no per-coord state) and is shared by every engine.
+ */
+export interface CohortTopicAntiDosOptions {
+    /** Per-`(peer, topic)` register rate limiter. Default `register_rate_per_peer = 4 / 60 s`, exponential back-off. */
+    readonly rateLimiter?: RegisterRateLimiterConfig;
+    /** Correlation-id freshness + replay guard. Default `maxAge = 60 s`, `futureSkew = 5 s`. */
+    readonly replayGuard?: CorrelationReplayGuardConfig;
+    /** Per-cohort forwarder-state budget. Default `topics_max = 2048`, LRU by participant count. */
+    readonly topicBudget?: TopicBudgetConfig;
+    /**
+     * Bootstrap-evidence verifiers for cold-root instantiation. db-core embeds no PoW / reputation /
+     * committed-work scheme; inject the real checks here. Any verifier supplied wins over the defaults
+     * below; the gate is **never** left undefined (an unset gate means cold-root bootstrap is
+     * unauthenticated — `docs/cohort-topic.md` §Anti-DoS).
+     */
+    readonly bootstrapEvidence?: BootstrapEvidenceDeps;
+    /**
+     * Optional peer-reputation view backing the **reputation-endorsement** evidence path: a *referee*
+     * peer-key-signs the bootstrap bound image, and the cohort admits it iff the signature verifies and
+     * the referee is sufficiently reputable here (not banned **and** below the deprioritize threshold).
+     * `PeerReputationService` satisfies this `{ isBanned, getScore }` shape directly. Supplying it (or any
+     * `bootstrapEvidence` override) makes the gate **configured**: the real PoW verifier runs, the referee
+     * verifier backs the reputation path, the real signed-parent-reference verifier backs the parent-ref path
+     * (permissive-but-logged only at T0/T1 when this host has no committed-existence backing — see
+     * {@link createBootstrapEvidencePolicy}), and any otherwise-unfilled verifier fails closed — so a
+     * banned/low-rep referee cannot slip the T2/T3 `PoW || reputation || parent-ref` disjunction. When omitted
+     * (and no `bootstrapEvidence` verifier is supplied), the gate is permissive-but-logged (the
+     * entirely-unconfigured interim node).
+     */
+    readonly reputation?: BootstrapReputationView;
+    /**
+     * Proof-of-work difficulty (leading zero bits) the real PoW verifier requires. Default the db-core
+     * `DEFAULT_POW_DIFFICULTY_BITS`. A low value (e.g. `0`) keeps minting fast/deterministic in tests.
+     * Applies to both the cohort-side PoW verifier and this node's participant-side PoW builder.
+     */
+    readonly powDifficultyBits?: number;
+    /**
+     * Strict "sufficient reputation" cutoff for a bootstrap referee — a referee with `getScore < this` is
+     * accepted. Default the reputation service's `deprioritize` threshold.
+     */
+    readonly deprioritizeThreshold?: number;
+    /**
+     * Existence view backing the **signed parent-reference** evidence path (`verifyParentReference`). A test
+     * seam: when supplied it overrides *which* existence view the real verifier consults (the host default is
+     * built from the FRET membership cache + addressing + the optional
+     * {@link CohortTopicHostOptions.committedParentTopicReader}). It does **not** by itself make the gate
+     * "configured" — only a `reputation` view or a `bootstrapEvidence` override flips that (see
+     * {@link createBootstrapEvidencePolicy}); an unconfigured host stays permissive and never consults this
+     * view. Pair it with `reputation`/`bootstrapEvidence` to exercise the real parent-reference verifier. See
+     * {@link createDefaultParentTopicView} / {@link createParentReferenceVerifier}.
+     */
+    readonly parentTopicView?: BootstrapParentTopicView;
+}
+/**
+ * One cohort the node serves, bound to a FRET-routed coordinate. Owns the per-coord slice of cohort
+ * state; the node-wide collaborators are injected (see {@link CoordEngineContext}).
+ */
+export interface CoordEngine {
+    /** The served ring coordinate this engine is the cohort for. */
+    readonly servedCoord: RingCoord;
+    /** Tree tier `d` the served coord was instantiated at (fixed by the first register). */
+    readonly treeTier: number;
+    /** Cohort-side register/renew/sweep engine driven by the protocol handlers + activity callback. */
+    readonly engine: CohortMemberEngine;
+    /** The FRET-assembled cohort around {@link servedCoord} (self prepended, deduped) + epoch. */
+    cohort(): CohortSnapshotView;
+    /**
+     * The cohort member peer-id strings this engine served under `epoch` (the **current** or the
+     * immediately-**prior** observed epoch), or `undefined` if it tracked no such epoch. Drives the `/sign`
+     * `"rotation"` endorsement gate: a member endorses a hand-off from `prevEpoch` only when it was a member
+     * of the cohort at that epoch. Returns `undefined` past the two-deep history (a rapid double rotation —
+     * the requester then re-anchors). See `cohort-topic-trust-anchor-rotation-production`.
+     */
+    cohortIdentityAt(epoch: Uint8Array): readonly string[] | undefined;
+    /** True iff this engine currently holds any registration record (a cold probe leaves it empty). */
+    hasState(): boolean;
+    /** True iff this engine holds the record for `(topicId, participantId)` — the renewal lookup key. */
+    holds(topicId: Uint8Array, participantId: Uint8Array): boolean;
+    /**
+     * This cohort's locally-known direct registration records for `topicId` (the cohort-side read the
+     * matchmaking `QueryV1` handler / aggregate-count producer serve from — `docs/matchmaking.md`
+     * §Seeker query). A renewed record is live; a TTL-swept one is gone after the next `gossipRound`.
+     */
+    records(topicId: Uint8Array): readonly RegistrationRecord[];
+    /**
+     * This cohort's current gossip-derived traffic barometer for `topicId` (own last-published counts +
+     * siblings' last-gossiped summaries + `directParticipants` from the store). The matchmaking `QueryV1`
+     * reply attaches it and the seeker hang-out decision consumes it (`docs/matchmaking.md` §Hang-out vs.
+     * continue). Non-mutating — a synchronous read over the same in-memory state a `gossipRound` mutates,
+     * lagging at most one gossip round (it reflects the last frozen summaries, never raw mid-round counts).
+     */
+    topicTraffic(topicId: Uint8Array): TopicTrafficV1;
+    /**
+     * Publish a fresh threshold-signed `MembershipCertV1` on a cohort-membership-change / stabilization
+     * event (republishes only when the first `k − x` members changed). Returns the cert if published.
+     * Resolves `undefined` if no republish was needed or the quorum was unreachable this round.
+     */
+    onStabilized(now: number): Promise<MembershipCertV1 | undefined>;
+    /**
+     * Periodic membership-cert refresh hook for the gossip-cadence driver to call (republishes once
+     * `T_membership_refresh` has elapsed). Returns the cert if (re)published, else `undefined`.
+     */
+    pumpMembership(now: number): Promise<MembershipCertV1 | undefined>;
+    /**
+     * One gossip round: TTL-sweep stale records (firing the `evicted` deltas), freeze the per-topic
+     * traffic summaries, drain the accumulated record/eviction deltas, and broadcast a signed
+     * {@link CohortGossipV1} (willingness/load/traffic + deltas) to the cohort. Returns the broadcast
+     * frame, or `undefined` when the engine is idle (no resident topics and no deltas → nothing to send).
+     */
+    gossipRound(now: number): Promise<CohortGossipV1 | undefined>;
+    /**
+     * Time-driven demotion check across this engine's resident topics; broadcasts any threshold-signed
+     * {@link DemotionNoticeV1} the lifecycle returns (root tier-0 cohorts never demote). No-op without a
+     * signing key (the verify-only per-coord signer cannot assemble a notice).
+     */
+    demotionTick(now: number): Promise<void>;
+    /** The merged per-member gossip view (willingness / load / per-topic summaries) for this cohort. */
+    cohortView(): CohortView;
+    /** True iff this engine currently serves `topicId` (holds a record or a cold-start forwarder for it). */
+    servesTopic(topicId: Uint8Array): boolean;
+    /**
+     * Whether `topicId` currently occupies a slot in this coord's anti-DoS topic budget. A drained topic
+     * stays resident-but-cold (`{@link budgetParticipantCount} === 0`) until a new topic reuses its slot;
+     * after that reuse `budgetHasTopic` is `false`. Test/diagnostic introspection over the per-coord budget
+     * (distinct from {@link servesTopic}, which a never-demoted cold-start forwarder keeps `true`).
+     */
+    budgetHasTopic(topicId: Uint8Array): boolean;
+    /**
+     * The direct-participant count the topic budget last recorded for a resident `topicId` (its LRU
+     * eviction key), or `undefined` when `topicId` holds no budget slot. A resident reporting `0` has
+     * drained and is the next coldest-evictable candidate. Test/diagnostic introspection.
+     */
+    budgetParticipantCount(topicId: Uint8Array): number | undefined;
+    /**
+     * The cold-start {@link Forwarder} this engine instantiated for `topicId`, or `undefined` if none.
+     * Exposes the parent-link lifecycle (`awaiting_parent` → `serving`) for the cold-start wiring (gap 7).
+     */
+    forwarder(topicId: Uint8Array): Forwarder | undefined;
+    /** Whether `topicId` is in promoted mode here — reflects both locally-originated and remotely-applied state. */
+    isPromoted(topicId: Uint8Array): boolean;
+    /** Adopt a verified promotion notice into this cohort's local state (see {@link NoticeApplyTarget}). */
+    applyPromotionNotice(notice: PromotionNoticeV1, now: number): void;
+    /** Adopt a verified demotion notice into this cohort's local state (see {@link NoticeApplyTarget}). */
+    applyDemotionNotice(notice: DemotionNoticeV1, now: number): void;
+    /** Tear down the per-coord gossip subscription. */
+    close(): void;
+}
+/** Lazy `servedCoord → CoordEngine` registry: one engine per coord FRET routes to this node. */
+export interface CoordRegistry {
+    /**
+     * The {@link CoordEngine} for `coord`, creating + caching it on first touch. `treeTier` and
+     * `participantCoord` seed a freshly-created engine's coord-derived tier inputs (ignored if the
+     * engine already exists). Synchronous, so concurrent activity callbacks for the same coord share
+     * one engine without a second being constructed.
+     */
+    forCoord(coord: RingCoord, treeTier: number, participantCoord: Uint8Array): CoordEngine;
+    /** The engine holding the record for `(topicId, participantId)`, or `undefined` (renewal dispatch). */
+    findHolder(topicId: Uint8Array, participantId: Uint8Array): CoordEngine | undefined;
+    /**
+     * The already-instantiated engine for `coord`, or `undefined` — a pure lookup that (unlike
+     * {@link forCoord}) never creates one. The `/sign` `"rotation"` endorsement gate uses it to consult this
+     * node's prior-epoch membership for the requested coord without spuriously instantiating a cohort it
+     * does not serve.
+     */
+    findByCoord(coord: RingCoord): CoordEngine | undefined;
+    /**
+     * The engine serving `topicId` at `treeTier`, or `undefined` (inbound promote/demote notice dispatch).
+     * A served coord embeds `(tier, topic)`, so at most one engine matches — the cohort the notice's
+     * signers belong to. `undefined` means this node serves no such cohort (e.g. a demotion arriving at a
+     * parent that does not track the child), so the notice is dropped rather than applied.
+     */
+    findServing(topicId: Uint8Array, treeTier: number): CoordEngine | undefined;
+    /** Every live engine (stop + sweep). */
+    all(): readonly CoordEngine[];
+    /** Close every engine's gossip subscription. */
+    close(): void;
+}
+/** A running cohort-topic node: the participant service plus the per-coord cohort registry, on one FRET node. */
+export interface CohortTopicHost {
+    /** Participant-facing substrate API (node scope, not a coord). */
+    readonly service: CohortTopicService;
+    /** Per-served-coord cohort engines (driven by the protocol handlers + activity callback). */
+    readonly registry: CoordRegistry;
+    /** The four registered protocol IDs. */
+    readonly protocols: CohortTopicProtocols;
+    /**
+     * The node's effective {@link NodeProfile} (Edge / Core). Exposed so a layered application (reactivity)
+     * can apply the same profile gate the host configured its engines with (e.g. Edge ⇒ subscriber-only).
+     */
+    readonly profile: NodeProfile;
+    /**
+     * The intra-cohort gossip transport. Exposed so a layered application (reactivity push-state gossip) can
+     * ride its `broadcastOver` seam — the same one the promote-notice broadcast reuses — rather than standing
+     * up a second transport with duplicate cohort peer resolution.
+     */
+    readonly gossipTransport: FretCohortGossipTransport;
+    /**
+     * The node-level `promote`-handler anti-abuse gate (per-`(peer, topic)` rate limiter + per-`(topic, tier)`
+     * `effectiveAt` high-water). Exposed for test/diagnostic introspection over its bounded-memory state — the
+     * limiter's `size` and the `highWater` `LruMap` — and so the gossip-cadence sweep wiring is observable.
+     */
+    readonly promoteGate: PromoteGate;
+    /** Unregister the four protocols and tear down every coord engine. */
+    stop(): Promise<void>;
+}
+/**
+ * Build and start a {@link CohortTopicHost} on `node` over `fret`. Registers the four protocols and
+ * sets FRET's activity handler. Async because the node's ring coordinate is derived via FRET's
+ * `hashPeerId`.
+ */
+export declare function createCohortTopicHost(node: Libp2p, fret: FretService, options?: CohortTopicHostOptions): Promise<CohortTopicHost>;
+/**
+ * Resolve an inbound `RenewV1` to the coord engine holding its record and run the renewal. A `RenewV1`
+ * carries no `treeTier`, so the held record — not a recomputed coord — names the cohort. If no engine
+ * on this host holds it (cross-node renewal, post-restart eviction, or replication lag), reply
+ * `unknown_registration` so the participant's failover loop tries its backups and ultimately re-runs
+ * the `d_max` lookup (§TTL and renewal) — never throw.
+ */
+export declare function resolveRenew(registry: CoordRegistry, renew: RenewV1, now: number): RenewReplyV1;
+/** Dependencies for the `/sign` endorsement policy ({@link handleSignRequest}). */
+export interface SignEndorsementDeps {
+    /** The node's libp2p key (signs the endorsement). Absent → every request is refused (no key to sign with). */
+    readonly privateKey: PrivateKey | undefined;
+    /** Self's dialable member id (UTF-8 peer-id string bytes). */
+    readonly selfMember: Uint8Array;
+    /** Cohort member peer-id strings around `coord` (self included). */
+    readonly cohortMembersAround: (coord: RingCoord) => string[];
+    /** Current cohort epoch (raw bytes) for `coord`. */
+    readonly currentEpoch: (coord: RingCoord) => Uint8Array;
+    /**
+     * For a `"rotation"` request: the cohort member peer-id strings this node served under `epoch` (the
+     * predecessor epoch carried as `request.cohortEpoch`), or `undefined` if it tracked no such epoch. The
+     * host wires it to the served coord's {@link CoordEngine.cohortIdentityAt}; absent → rotation
+     * endorsement is unavailable (a node with no per-coord rotation history refuses the hand-off).
+     */
+    readonly priorCohortMembersAt?: (coord: RingCoord, epoch: Uint8Array) => readonly string[] | undefined;
+    /**
+     * The endorser's own canonical `MembershipCertV1` signable fields for `coord` at its **current** epoch,
+     * re-derived from its own cohort snapshot ({@link membershipCertSignable} with `stabilizedAt`
+     * omitted/ignored). Binds a `membership` endorsement to the endorser's independent view so a cohort
+     * insider cannot collect honest signatures over a cert the cohort never agreed to (falsified `members`
+     * or `cohortCoord`). `cohortEpoch` here MUST equal `bytesToB64url(currentEpoch(coord))`; `members` is the
+     * ascending-sorted base64url cohort set (the cert / sharding order). Absent → a `membership` request is
+     * refused (no view to bind the cert against). See `cohort-topic-sign-endorsement-payload-binding`.
+     */
+    readonly expectedMembershipFields?: (coord: RingCoord) => {
+        cohortCoord: string;
+        cohortEpoch: string;
+        members: string[];
+    };
+    /**
+     * Wall clock (ms) for the `stabilizedAt` far-future sanity bound on a `membership` payload. The host
+     * wires {@link Date.now}; tests inject a fixed clock. Absent → the far-future bound is skipped (only
+     * finiteness is enforced), keeping minimal / key-less composition working.
+     */
+    readonly now?: () => number;
+}
+/**
+ * The `/sign` endorsement policy: decide whether to endorse a {@link SignRequestV1} and, if so, return
+ * this node's Ed25519 peer-key signature over the **exact** request payload. A member endorses only when
+ * both it and the requester are members of the cohort around `coord` under the request's epoch, **and**
+ * the payload bytes re-derive to something this node independently agrees to attest — so it never signs
+ * for outsiders and never blindly signs requester-supplied bytes. It still signs the exact image (no
+ * re-canonicalization), so the assembled signature verifies against what the requester collected.
+ *
+ * **Payload binding (cohort-topic-sign-endorsement-payload-binding).** The cohort + wire-epoch gates never
+ * inspect `request.payload`; without binding it an insider could collect honest signatures over a cert the
+ * cohort never agreed to. After those gates the endorser decodes the canonical signable image
+ * (`sig/payloads.ts` — a `JSON.parse`d array, NOT a `CohortMessageV1`) and refuses unless:
+ *
+ * - **all kinds** — the image tag matches the kind (`membership`→`MembershipCertV1`, etc.) and the
+ *   payload-internal `cohortEpoch` equals this node's current epoch for `coord`; and
+ * - **`membership`** — `cohortCoord`, the full `members` list (deep-equal to the endorser's own ascending
+ *   re-derived set), and a finite, not-far-future `stabilizedAt` all match its independent view
+ *   ({@link SignEndorsementDeps.expectedMembershipFields}). Because epoch = H(members) in this host, the
+ *   members and internal-epoch checks are mutually reinforcing: a forged member list cannot also carry the
+ *   honest epoch. The participant verifier still independently re-checks `signers ⊆ cert.members`.
+ *
+ * The kind-specific **hot/cold** refinement for `promotion` / `demotion` (the endorser additionally
+ * requiring its own replicated `directParticipants` to be hot / cold) remains deferred: it needs a
+ * per-topic binding the `(payload, minSigs)` port can't carry and gossip record replication that is still
+ * interim. Parked in `cohort-topic-sign-endorsement-hotcold-refinement` (backlog).
+ *
+ * **`"rotation"` (epoch hand-off).** A rotation request carries the **prior** epoch as `cohortEpoch` and
+ * asks the outgoing cohort to sign the *successor* cert. The gate therefore checks **prior**-epoch
+ * membership instead of current: the endorser must have served the cohort at `prevEpoch`, and the
+ * requester must have been a member of that prior cohort too (the genuinely outgoing set). The verifier
+ * still independently re-checks `rotationSigners ⊆ predecessor-cert.members`, so this gate is the
+ * load-shedding sanity check, not the trust root. See `cohort-topic-trust-anchor-rotation-production`.
+ */
+export declare function handleSignRequest(request: SignRequestV1, fromPeerStr: string, deps: SignEndorsementDeps): Promise<SignReplyV1>;
+/** A decoded `promote`-protocol frame, tagged by which notice it is. */
+export type InboundNotice = {
+    readonly kind: "promotion";
+    readonly notice: PromotionNoticeV1;
+} | {
+    readonly kind: "demotion";
+    readonly notice: DemotionNoticeV1;
+};
+/** Outcome of {@link verifyAndApplyNotice}. */
+export type NoticeOutcome = "applied" | "untrusted" | "dropped";
+/**
+ * Outcome of {@link handleInboundNotice} — the {@link NoticeOutcome}s plus the cheap pre-verify drops the
+ * anti-abuse gate adds before any signature work runs:
+ *
+ * - `"undecodable"`  — the frame is neither a promotion nor a demotion notice.
+ * - `"rate-limited"` — the dialing `(peer, topic)` is over its `register_rate_per_peer` ceiling.
+ * - `"stale"`        — the notice's `effectiveAt` is at or below the last *applied* notice for its
+ *   `(topic, tier)` (a replay / out-of-order frame); dropped before `verifyMessage`.
+ */
+export type InboundNoticeResult = NoticeOutcome | "undecodable" | "rate-limited" | "stale";
+/**
+ * Node-level anti-abuse state for the `promote` handler (`cohort-topic-promote-handler-verify-amplification`).
+ * The handler is node-level (one per node, not per coord), so unlike the per-{@link CoordEngine} register-path
+ * guards it owns its own instances here.
+ */
+export interface PromoteGate {
+    /**
+     * Per-`(peer, topic)` inbound-notice rate limiter (reuses the register-path limiter). A peer streaming
+     * forged notices at one topic is dropped once it exceeds the ceiling, before any verify / membership work.
+     */
+    readonly rateLimiter: RegisterRateLimiter;
+    /**
+     * Per-`(topicId, tier)` high-water of the last *applied* notice's `effectiveAt`. A notice at or below the
+     * water is a replay / out-of-order frame and is dropped before verification. Updated **only** on an
+     * `"applied"` outcome (never on an unverified frame), so a forged notice carrying `effectiveAt = Infinity`
+     * cannot poison the water and lock out legitimate notices.
+     *
+     * **Bounded.** An {@link LruMap} capped at {@link PROMOTE_HIGHWATER_MAX_KEYS} so the retain-forever shape
+     * cannot leak on a long-lived node. Unlike the limiter this is *not* attacker-growable (it is written only
+     * on an `"applied"` outcome, which needs a verified `≥ minSigs` cohort signature — reads of forged
+     * `topicId`s via `.get` create nothing), so it never evicts under legitimate load; the cap is the
+     * belt-and-suspenders bound. Evicting an entry is safe: the engine's {@link PromotionLifecycle} is
+     * independently idempotent and `effectiveAt`-ordered (`PromotionState.lastEffectiveAt`), so an
+     * evicted-then-replayed older notice re-verifies (one bounded, rate-capped `verifyMessage`) and then
+     * **no-ops at the engine** rather than (re-)applying. Water absence only *opens* the gate, never closes it.
+     */
+    readonly highWater: LruMap<string, number>;
+}
+/**
+ * Hard cap on tracked `(topicId, tier)` high-water entries; the least-recently-touched are evicted beyond
+ * this. A modest bound is plenty — only verified applies grow the map, so it never evicts under legitimate
+ * load — but it caps the otherwise retain-forever shape on a long-lived node.
+ */
+export declare const PROMOTE_HIGHWATER_MAX_KEYS = 8192;
+/** Build the default {@link PromoteGate} from the (optional) anti-DoS rate-limiter config. */
+export declare function createPromoteGate(rateLimiterConfig?: RegisterRateLimiterConfig): PromoteGate;
+/**
+ * The slice of a {@link CoordEngine} the inbound notice path needs: the cohort coord the signers should
+ * belong to (for verification) and the apply hooks. {@link CoordEngine} satisfies this; tests can pass a
+ * minimal stand-in.
+ */
+export interface NoticeApplyTarget {
+    readonly servedCoord: RingCoord;
+    applyPromotionNotice(notice: PromotionNoticeV1, now: number): void;
+    applyDemotionNotice(notice: DemotionNoticeV1, now: number): void;
+}
+/**
+ * Decode a `promote`-protocol frame as a {@link PromotionNoticeV1} or {@link DemotionNoticeV1} (try one,
+ * then the other), or `undefined` if it is neither. The two shapes are disjoint — a promotion carries
+ * `fromTier`/`toTier`, a demotion carries `parentCohortCoord` — so the structural validators cleanly
+ * discriminate.
+ */
+export declare function decodeInboundNotice(frame: Uint8Array, maxBytes?: number): InboundNotice | undefined;
+/**
+ * Per-coord minimum interval (ms) between membership refetches on the inbound `promote` path. Caps the
+ * amplification a flood of forged notices can drive: a stream of verify-misses triggers at most one
+ * `source.fetch()` per coord per this window, while a cold cache / membership rotation still re-fetches
+ * once it elapses (eventual refetch preserved). 60 s mirrors the anti-DoS rate window.
+ */
+export declare const PROMOTE_REFETCH_MIN_INTERVAL_MS = 60000;
+/**
+ * Verify an inbound notice's threshold signature against the cohort `MembershipCertV1` for
+ * `target.servedCoord` and, on success, apply it to the target's promotion lifecycle. Returns:
+ *
+ * - `"dropped"`  — no local engine serves the notice's `(topic, tier)` (e.g. a demotion arriving at a
+ *   parent that does not track the child); nothing to apply to.
+ * - `"untrusted"` — the `signers` are not a `≥ minSigs` subset of the cohort cert, or the multisig does
+ *   not verify (a forged single-signer / short-quorum notice); local state is left unchanged.
+ * - `"applied"`  — verified and applied.
+ *
+ * The payload is rebuilt with the canonical `sig/payloads` image the signer used — never re-canonicalized
+ * independently. The verifier owns the cert lookup; this function never re-verifies inside the apply step
+ * (db-core trusts this gate).
+ *
+ * **Bounded refetch (anti-amplification).** Both verify calls pass a {@link PROMOTE_REFETCH_MIN_INTERVAL_MS}
+ * refetch bound, so a stream of forged notices drives at most **one** membership `source.fetch()` per coord
+ * per interval rather than one dial per message. Eventual refetch is preserved (full suppression was
+ * rejected: a legitimate sibling-adopt / demotion-to-parent notice whose cohort cert is not yet locally
+ * cached must still be able to fetch it once — see `live-tier.spec.ts` test 4). A node that has cached its
+ * own cohort cert via `onCertPublished` verifies a sibling-adopt notice from cache with zero fetches; a
+ * cold-cache receiver pays one bounded fetch. Per `cohort-topic-promote-handler-verify-amplification`.
+ */
+export declare function verifyAndApplyNotice(inbound: InboundNotice, target: NoticeApplyTarget | undefined, verifier: MembershipVerifier, now: number): Promise<NoticeOutcome>;
+/**
+ * Full inbound `promote`-frame pipeline with the anti-abuse gate, exported so it is unit-testable without a
+ * live node (`cohort-topic-promote-handler-verify-amplification`). Runs the cheapest checks first — each
+ * step strictly cheaper than the next — so a flood of forged frames is shed before any signature / network
+ * work:
+ *
+ * ```
+ *   decode → per-(peer,topic) rate limit → findServing → effectiveAt high-water → verify+apply
+ * ```
+ *
+ * - **Rate limit** (`gate.rateLimiter`) keys on `(from, topicId)`; an over-rate peer is dropped before the
+ *   `findServing` map scan and the verify, so a peer cannot amplify junk into verify/network work.
+ * - **High-water** (`gate.highWater`, per `(topicId, tier)`) drops a notice whose `effectiveAt` is at or
+ *   below the last *applied* one — a replay / out-of-order frame — before `verifyMessage`. It is advanced
+ *   **only** on an `"applied"` outcome, so a forged frame (which never verifies) cannot poison it.
+ * - The receiver-side `cohortEpoch` is intentionally **not** gated on: the epoch rotates on every
+ *   membership change, so a legitimately in-flight notice can briefly carry the prior epoch right after a
+ *   rotation — making an epoch check a brittle, false-positive-prone filter. The rate limiter + high-water
+ *   are the load-bearing defenses; the bounded refetch (in {@link verifyAndApplyNotice}) caps the network
+ *   amplification on the verify itself.
+ *
+ * `from` is the dialing peer's substrate bytes ({@link peerIdToBytes}); the node handler converts the
+ * libp2p `PeerId` before calling. One-way contract: the caller sends no ack regardless of outcome.
+ */
+export declare function handleInboundNotice(frame: Uint8Array, from: Uint8Array, registry: CoordRegistry, verifier: MembershipVerifier, gate: PromoteGate, now: number, maxBytes?: number): Promise<InboundNoticeResult>;
+/**
+ * The cohort coords a notice is broadcast to over the `promote` protocol: always the cohort around
+ * `servedCoord` (siblings adopt the state); for a demotion, additionally the parent cohort coord (so the
+ * parent's `childCohortCount` bookkeeping converges). Pure — exported for testing the fan-out targets.
+ */
+export declare function noticeBroadcastCoords(notice: PromotionNoticeV1 | DemotionNoticeV1, servedCoord: RingCoord): RingCoord[];
+//# sourceMappingURL=host.d.ts.map

package/dist/src/cohort-topic/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,KAAK,EAAsB,UAAU,EAAU,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAsBN,MAAM,EA2BN,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EAEnB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAEvB,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EACf,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,KAAK,SAAS,EAGd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAEhB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAG9B,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,SAAS,EAGd,KAAK,WAAW,EAChB,KAAK,aAAa,EAElB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEnB,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,yBAAyB,EAA2B,MAAM,8BAA8B,CAAC;AASlG,OAAO,EAA+C,KAAK,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC9H,OAAO,EAA+D,KAAK,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE7I,OAAO,EAA2D,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAMpH,MAAM,WAAW,sBAAsB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,OAAO,CAAC;IACpE;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAKD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACzC,oHAAoH;IACpH,QAAQ,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;IACpD,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,wBAAwB,CAAC;CACpD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,8FAA8F;IAC9F,MAAM,IAAI,kBAAkB,CAAC;IAC7B;;;;;;OAMG;IACH,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACnE,mGAAmG;IACnG,QAAQ,IAAI,OAAO,CAAC;IACpB,qGAAqG;IACrG,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC;IAC/D;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,kBAAkB,EAAE,CAAC;IAC5D;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,UAAU,GAAG,cAAc,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACjE;;;OAGG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACnE;;;;;OAKG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC9D;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,oGAAoG;IACpG,UAAU,IAAI,UAAU,CAAC;IACzB,yGAAyG;IACzG,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAC1C;;;;;OAKG;IACH,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IAC7C;;;;OAIG;IACH,sBAAsB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;IAChE;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,gHAAgH;IAChH,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;IACzC,wGAAwG;IACxG,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnE,uGAAuG;IACvG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACjE,mDAAmD;IACnD,KAAK,IAAI,IAAI,CAAC;CACd;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,GAAG,WAAW,CAAC;IACxF,uGAAuG;IACvG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IACpF;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IACvD;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5E,wCAAwC;IACxC,GAAG,IAAI,SAAS,WAAW,EAAE,CAAC;IAC9B,gDAAgD;IAChD,KAAK,IAAI,IAAI,CAAC;CACd;AAED,iHAAiH;AACjH,MAAM,WAAW,eAAe;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,yBAAyB,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,sEAAsE;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAqED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,eAAe,CAAC,CAyV3I;AAyqBD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAQ/F;AAID,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IACnC,8GAA8G;IAC9G,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IAC5C,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;IAC7D,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,UAAU,CAAC;IACxD;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,KAAK,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACvG;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC1H;;;;OAIG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2FpI;AAID,wEAAwE;AACxE,MAAM,MAAM,aAAa,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEpE,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,CAAC;AAE3F;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,GAAG,WAAW,CAE5F;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;IAChC,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnE,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACjE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAWnG;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,QAAQ,EAAE,kBAAkB,EAC5B,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,aAAa,CAAC,CA6BxB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,EACvB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC,CAqC9B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,gBAAgB,EAAE,WAAW,EAAE,SAAS,GAAG,SAAS,EAAE,CAKvH"}