@optimystic/db-p2p 0.24.2 → 0.25.0

package/dist/src/cluster/certified-claims.js

@@ -0,0 +1,200 @@
+import { verifyBlockCommitProofClaim, verifyBlockCommitProofContent } from "./commit-proof.js";
+import { createLogger } from "../logger.js";
+const log = createLogger('certified-claims');
+/**
+ * Hard bound on `proof.peerIds.length`, enforced BEFORE any hashing or signature work. Nothing on
+ * the repair wire bounds a proof's cohort count — only byte caps apply (1 MiB control / 8 MiB sync
+ * response), which would still admit ~80k signature verifications — so this module enforces the
+ * bound `commit-proof.ts` declares as its caller obligation #2. 256 is far above any plausible
+ * cohort (deployments run ~10) while keeping the worst-case verification cost trivial.
+ *
+ * NOTE: this cap bounds the SIGNATURE count (at most `MAX_PROOF_SIGNERS` Ed25519 verifies per
+ * round, since `countApprovals` skips signers outside `peerIds` before any crypto). It does NOT
+ * bound the proof's serialized SIZE: `computeClusterMessageHash` / `...PromiseHash` /
+ * `...CommitHash` canonically serialize `message`, `promises` and `commits`, whose entry counts a
+ * peer chooses freely inside the transport byte cap. That cost is linear and today bounded by the
+ * 1 MiB control-message cap; if repair verification ever shows up in a profile, or a deployment
+ * raises those transport caps, add a serialized-size bound here alongside the signer count.
+ */
+export const MAX_PROOF_SIGNERS = 256;
+/**
+ * Every {@link CertifyFailure}, classified: may it be held against the peer that SERVED the proof?
+ *
+ * Exhaustive by type — `Record<CertifyFailure, boolean>` means adding a {@link ProofFailure}
+ * variant in `commit-proof.ts` fails the build here until it is classified, rather than silently
+ * defaulting to `true` (penalize), which is the wrong direction for an unknown reason.
+ *
+ * `false` — never a penalty, because the identity behind the artifact was not proven (mirrors
+ * `ClusterMember.verifySignature`'s outcome discipline, restated in `commit-proof.ts`) or because
+ * the outcome is not misbehavior at all.
+ *
+ * `true` — the peer's own artifact provably lies, or provably does not cover what it was served
+ * for.
+ */
+const ATTRIBUTABLE_PROOF_FAILURES = {
+    // Identity not proven — an unparseable or unbound signer, or structural garbage that could have
+    // been authored by anyone in the chain.
+    'unknown-signer': false,
+    'non-ed25519-signer': false,
+    'malformed-signature': false,
+    'malformed-proof': false,
+    // A v1 / unversioned record is history, not misbehavior: it binds no peer set and never could.
+    'legacy-record': false,
+    // A genuine mega-cohort is conceivable and the cap declines it unexamined — no evidence either way.
+    'oversized-cohort': false,
+    // Not a failure of the proof at all: the cohort declared no digest for this block, so there was
+    // nothing to compare the served bytes against. A verdict ("content uncertified, rev certified"),
+    // never misbehavior.
+    'no-digest-declared': false,
+    // The artifact contradicts itself or the claim it was served for. `buildBlockCommitProof` derives
+    // `peerIds` from `Object.keys(record.peers)`, so honest construction cannot produce a duplicate —
+    // serving one implies authorship, as does a digest or hash that does not recompute.
+    'membership-mismatch': true,
+    'message-hash-mismatch': true,
+    'duplicate-signer': true,
+    'promise-threshold': true,
+    'commit-threshold': true,
+    // The replay case: a genuine proof presented for a claim it does not cover.
+    'claim-not-in-message': true,
+    // The peer served bytes that provably are not the committed content.
+    'digest-mismatch': true
+};
+/**
+ * Failure reasons that must NEVER become a reputation penalty for the serving peer — the `false`
+ * half of {@link ATTRIBUTABLE_PROOF_FAILURES}, derived so the set and
+ * {@link isAttributableProofFailure} cannot drift apart. Prefer the predicate; this set is exported
+ * for callers that want to name the whole population (logs, tests).
+ */
+export const NON_ATTRIBUTABLE_PROOF_FAILURES = new Set(Object.keys(ATTRIBUTABLE_PROOF_FAILURES)
+    .filter(failure => !ATTRIBUTABLE_PROOF_FAILURES[failure]));
+/**
+ * May this failure be held against the peer that served the proof? One predicate so the two repair
+ * paths cannot drift on the classification — see {@link ATTRIBUTABLE_PROOF_FAILURES} for the
+ * per-reason rationale.
+ */
+export function isAttributableProofFailure(failure) {
+    return ATTRIBUTABLE_PROOF_FAILURES[failure] === true;
+}
+/**
+ * The {@link ProofThresholds} both repair paths verify against, from the cohort's configured
+ * `superMajorityThreshold`.
+ *
+ * `simpleMajorityThreshold` is hardcoded 0.5 — NOT the deployment's configured value (0.51 by
+ * default): cohort members enforce `count > total / 2` (`ClusterMember.hasMajority`), and
+ * `ProofThresholds` requires a verifier to mirror what the members actually enforced. Verifying
+ * against the configured value would reject proofs real cohorts produce.
+ *
+ * One function so the read path (`CoordinatorRepo.queryClusterForLatest`) and the commit-path
+ * reconcile (`cluster/reconcile-block.ts`) cannot drift on the one number that has to match
+ * `hasMajority`.
+ */
+export function proofThresholds(superMajorityThreshold) {
+    return { superMajorityThreshold, simpleMajorityThreshold: 0.5 };
+}
+/**
+ * Certify a repair claim by its attached cohort commit proof: cap the cohort, verify offline
+ * ({@link verifyBlockCommitProofClaim}), then run the anchoring layer on success. Total on hostile
+ * input like the verifier it wraps — never throws.
+ */
+export async function certifyClaim(proof, claim, thresholds, anchoring = {}) {
+    if (exceedsSignerCap(proof)) {
+        return { certified: false, failure: 'oversized-cohort' };
+    }
+    const verdict = await verifyBlockCommitProofClaim(proof, claim, thresholds);
+    if (!verdict.ok) {
+        return { certified: false, failure: verdict.reason };
+    }
+    await anchorAcceptedProof(proof, claim, anchoring);
+    return { certified: true };
+}
+/**
+ * Certify a claim AND the served block bytes ({@link verifyBlockCommitProofContent}). The two
+ * halves are reported separately because the content checks (`digest-mismatch` /
+ * `no-digest-declared`) only run after the claim half has already PASSED — a proof that certifies
+ * the revision while the bytes disagree still certifies the revision; the caller drops (and, for
+ * `digest-mismatch`, penalizes) the bytes. Anchoring runs whenever the claim half passed: that is
+ * the moment a proof was accepted as evidence.
+ */
+export async function certifyContent(proof, claim, block, thresholds, anchoring = {}) {
+    if (exceedsSignerCap(proof)) {
+        return { revCertified: false, contentCertified: false, failure: 'oversized-cohort' };
+    }
+    const verdict = await verifyBlockCommitProofContent(proof, claim, block, thresholds);
+    if (verdict.ok) {
+        await anchorAcceptedProof(proof, claim, anchoring);
+        return { revCertified: true, contentCertified: true };
+    }
+    if (verdict.reason === 'digest-mismatch' || verdict.reason === 'no-digest-declared') {
+        await anchorAcceptedProof(proof, claim, anchoring);
+        return { revCertified: true, contentCertified: false, failure: verdict.reason };
+    }
+    return { revCertified: false, contentCertified: false, failure: verdict.reason };
+}
+/**
+ * The cap check, structurally safe on hostile shapes: a `peerIds` that is not an array — or a
+ * property access that throws, which is why the whole read is guarded — falls through to the
+ * verifier, which reports `malformed-proof` without doing signature work either. This runs before
+ * {@link certifyClaim}'s and {@link certifyContent}'s only other call, so it is the one place their
+ * "never throws" contract could be broken.
+ */
+function exceedsSignerCap(proof) {
+    try {
+        return proof !== null && typeof proof === 'object'
+            && Array.isArray(proof.peerIds) && proof.peerIds.length > MAX_PROOF_SIGNERS;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Layer 2 + degradation for a proof the offline layer accepted. Purely observational — nothing
+ * here can revoke the certification: overlap is logged (never gated — historic cohort rotation
+ * makes zero overlap legitimate for old data, and gating would re-create the lone-holder-unreadable
+ * defect), infeasibility degrades to accept-and-surface, and a throwing capability is logged and
+ * treated as infeasible.
+ */
+async function anchorAcceptedProof(proof, claim, anchoring) {
+    const signerCount = proof.peerIds.length;
+    if (!anchoring.recomputeBlockCohort) {
+        acceptUnanchored(claim, signerCount, 'no-recompute-capability', anchoring);
+        return;
+    }
+    let verdict;
+    try {
+        verdict = await anchoring.recomputeBlockCohort(claim.blockId);
+    }
+    catch (err) {
+        log('anchor-recompute-error block=%s error=%o', claim.blockId, err);
+        acceptUnanchored(claim, signerCount, 'recompute-infeasible', anchoring);
+        return;
+    }
+    // A verdict that is null or otherwise off-contract reads as infeasible rather than throwing —
+    // `recomputeBlockCohort` is caller-supplied, so its return shape is as untrusted as its behavior.
+    if (!verdict?.feasible) {
+        acceptUnanchored(claim, signerCount, 'recompute-infeasible', anchoring);
+        return;
+    }
+    try {
+        const cohort = new Set(verdict.cohortPeerIds);
+        const overlap = proof.peerIds.filter(id => cohort.has(id)).length;
+        log('anchor-overlap block=%s rev=%d action=%s overlap=%d signers=%d cohort=%d', claim.blockId, claim.rev, claim.actionId, overlap, signerCount, cohort.size);
+    }
+    catch (err) {
+        // A non-iterable `cohortPeerIds`. The comparison is observational, so losing it costs a log
+        // line, never the certification.
+        log('anchor-overlap-error block=%s error=%o', claim.blockId, err);
+    }
+}
+/** Accept-and-surface a proof certified on layer 1 alone — never silent, never throwing. */
+function acceptUnanchored(claim, signerCount, reason, anchoring) {
+    log('accept-unanchored block=%s rev=%d action=%s signers=%d reason=%s', claim.blockId, claim.rev, claim.actionId, signerCount, reason);
+    try {
+        anchoring.onUnanchored?.({
+            blockId: claim.blockId, rev: claim.rev, actionId: claim.actionId, signerCount, reason
+        });
+    }
+    catch (err) {
+        log('accept-unanchored-callback-error block=%s error=%o', claim.blockId, err);
+    }
+}
+//# sourceMappingURL=certified-claims.js.map

package/dist/src/cluster/certified-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certified-claims.js","sourceRoot":"","sources":["../../../src/cluster/certified-claims.ts"],"names":[],"mappings":"AACA,OAAO,EACN,2BAA2B,EAAE,6BAA6B,EAE1D,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAwE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,2BAA2B,GAA8C;IAC9E,gGAAgG;IAChG,wCAAwC;IACxC,gBAAgB,EAAE,KAAK;IACvB,oBAAoB,EAAE,KAAK;IAC3B,qBAAqB,EAAE,KAAK;IAC5B,iBAAiB,EAAE,KAAK;IACxB,+FAA+F;IAC/F,eAAe,EAAE,KAAK;IACtB,oGAAoG;IACpG,kBAAkB,EAAE,KAAK;IACzB,gGAAgG;IAChG,iGAAiG;IACjG,qBAAqB;IACrB,oBAAoB,EAAE,KAAK;IAC3B,kGAAkG;IAClG,kGAAkG;IAClG,oFAAoF;IACpF,qBAAqB,EAAE,IAAI;IAC3B,uBAAuB,EAAE,IAAI;IAC7B,kBAAkB,EAAE,IAAI;IACxB,mBAAmB,EAAE,IAAI;IACzB,kBAAkB,EAAE,IAAI;IACxB,4EAA4E;IAC5E,sBAAsB,EAAE,IAAI;IAC5B,qEAAqE;IACrE,iBAAiB,EAAE,IAAI;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAgC,IAAI,GAAG,CACjF,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAsB;KAC5D,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAC1D,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAuB;IACjE,OAAO,2BAA2B,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,sBAA8B;IAC7D,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC;AACjE,CAAC;AA8BD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,KAAuB,EAAE,KAAiB,EAAE,UAA2B,EAAE,YAA4B,EAAE;IAEvG,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAAuB,EAAE,KAAiB,EAAE,KAAa,EAAE,UAA2B,EACtF,YAA4B,EAAE;IAE9B,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACrF,MAAM,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACnD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAuB;IAChD,IAAI,CAAC;QACJ,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;eAC9C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,KAAuB,EAAE,KAAiB,EAAE,SAAyB;IACvG,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACrC,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO;IACR,CAAC;IACD,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,0CAA0C,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpE,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO;IACR,CAAC;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACxB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO;IACR,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,GAAG,CAAC,0EAA0E,EAC7E,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,4FAA4F;QAC5F,iCAAiC;QACjC,GAAG,CAAC,wCAAwC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,SAAS,gBAAgB,CACxB,KAAiB,EAAE,WAAmB,EAAE,MAA2C,EAAE,SAAyB;IAE9G,GAAG,CAAC,kEAAkE,EACrE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACJ,SAAS,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM;SACrF,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,oDAAoD,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;AACF,CAAC"}

package/dist/src/cluster/client-signature-verifier.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The p2p-backed {@link ClientSignatureVerifier}: the closure a cluster member's
+ * {@link TransactionValidator} uses to decide whether a client transaction was really signed by the
+ * identity its stamp claims.
+ *
+ * Lives here — one exported factory rather than a closure inlined at each wiring site — because two
+ * consumers must agree byte-for-byte or the tests stop proving anything about production: the
+ * Quereus plugin's `createQuereusValidator` (the real deployment path once a composition root
+ * supplies `NodeOptions.validator`) and `db-p2p`'s own signature specs, whose whole claim is that
+ * they drive "the exact closure production binds".
+ */
+import type { ClientSignatureVerifier } from '@optimystic/db-core';
+/**
+ * Derive the signer's Ed25519 public key from the peer-id string embedded in `stamp.peerId` and
+ * verify the base64url signature over the canonical payload.
+ *
+ * TOTAL on adversarial input, which the {@link ClientSignatureVerifier} port requires: a throw here
+ * escapes `ClusterMember.validatePendOperations` instead of becoming a signed reject vote.
+ * `verifyPeerSig` already returns `false` rather than throwing on a non-Ed25519 or malformed
+ * peer-id; the try/catch adds the same guarantee for the base64url decode.
+ */
+export declare function createPeerClientSignatureVerifier(): ClientSignatureVerifier;
+//# sourceMappingURL=client-signature-verifier.d.ts.map

package/dist/src/cluster/client-signature-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-signature-verifier.d.ts","sourceRoot":"","sources":["../../../src/cluster/client-signature-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAInE;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,IAAI,uBAAuB,CAQ3E"}

package/dist/src/cluster/client-signature-verifier.js

@@ -0,0 +1,33 @@
+/**
+ * The p2p-backed {@link ClientSignatureVerifier}: the closure a cluster member's
+ * {@link TransactionValidator} uses to decide whether a client transaction was really signed by the
+ * identity its stamp claims.
+ *
+ * Lives here — one exported factory rather than a closure inlined at each wiring site — because two
+ * consumers must agree byte-for-byte or the tests stop proving anything about production: the
+ * Quereus plugin's `createQuereusValidator` (the real deployment path once a composition root
+ * supplies `NodeOptions.validator`) and `db-p2p`'s own signature specs, whose whole claim is that
+ * they drive "the exact closure production binds".
+ */
+import { b64urlToBytes } from '@optimystic/db-core';
+import { verifyPeerSig } from '../cohort-topic/peer-sig.js';
+/**
+ * Derive the signer's Ed25519 public key from the peer-id string embedded in `stamp.peerId` and
+ * verify the base64url signature over the canonical payload.
+ *
+ * TOTAL on adversarial input, which the {@link ClientSignatureVerifier} port requires: a throw here
+ * escapes `ClusterMember.validatePendOperations` instead of becoming a signed reject vote.
+ * `verifyPeerSig` already returns `false` rather than throwing on a non-Ed25519 or malformed
+ * peer-id; the try/catch adds the same guarantee for the base64url decode.
+ */
+export function createPeerClientSignatureVerifier() {
+    return (peerId, payload, signature) => {
+        try {
+            return verifyPeerSig(peerId, payload, b64urlToBytes(signature));
+        }
+        catch {
+            return false;
+        }
+    };
+}
+//# sourceMappingURL=client-signature-verifier.js.map

package/dist/src/cluster/client-signature-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-signature-verifier.js","sourceRoot":"","sources":["../../../src/cluster/client-signature-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC;IAChD,OAAO,CAAC,MAAc,EAAE,OAAmB,EAAE,SAAiB,EAAW,EAAE;QAC1E,IAAI,CAAC;YACJ,OAAO,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/src/cluster/cluster-policy.d.ts

@@ -1,4 +1,4 @@
-import { type ClusterConsensusConfig } from "@optimystic/db-core";
+import { type ClusterConsensusConfig, type UnvalidatablePendPolicy } from "@optimystic/db-core";
 /**
  * Resolves the operator-facing cluster knobs (`clusterSize`, `clusterPolicy.*`) into the concrete
  * numbers the consensus and block-restoration paths run on.
@@ -97,6 +97,12 @@ export interface ClusterPolicyOptions {
          * `clusterSize: 2`) to self-repair.
          */
         assumedClusterSize?: number;
+        /**
+         * What a validator-configured member does with a pend that carries no `validation` payload
+         * (nothing to re-execute — the single-collection `Collection.sync` shape). Default 'accept';
+         * see {@link UnvalidatablePendPolicy}.
+         */
+        unvalidatablePendPolicy?: UnvalidatablePendPolicy;
     };
 }
 /** Everything a node's consensus + restoration paths need, with every default already applied. */
@@ -116,8 +122,8 @@ export type ResolvedClusterPolicy = ClusterConsensusConfig & {
 /**
  * Apply every cluster-policy default a node needs. Same options in, same numbers out, so the
  * composition root's behavior is unit-testable (`test/cluster-policy.spec.ts`). Its one side effect
- * is the `assumed-cluster-size-unset` advisory below, which lives here because this is the only place
- * that knows the resolution produced a self-defeating combination.
+ * is the `repair-fault-tolerance` advisory below, which lives here because this is the only place
+ * that knows the resolution produced a combination with no repair margin — or none at all.
  */
 export declare function resolveClusterPolicy(options: ClusterPolicyOptions): ResolvedClusterPolicy;
 //# sourceMappingURL=cluster-policy.d.ts.map

package/dist/src/cluster/cluster-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-policy.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAMpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0DAA0D;QAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sGAAsG;QACtG,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC;;;;;WAKG;QACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC;;;;;;;;;;;WAWG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC5D,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,8BAA8B,EAAE,MAAM,CAAC;CACvC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CAuEzF"}
+{"version":3,"file":"cluster-policy.d.ts","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAMlI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,0DAA0D;QAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,sGAAsG;QACtG,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC;;;;;WAKG;QACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;QACvC;;;;;;;;;;;WAWG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;KAClD,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG;IAC5D,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,8BAA8B,EAAE,MAAM,CAAC;CACvC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CA4JzF"}

package/dist/src/cluster/cluster-policy.js

@@ -60,8 +60,8 @@ export const DEFAULT_CLUSTER_SIZE = 10;
 /**
  * Apply every cluster-policy default a node needs. Same options in, same numbers out, so the
  * composition root's behavior is unit-testable (`test/cluster-policy.spec.ts`). Its one side effect
- * is the `assumed-cluster-size-unset` advisory below, which lives here because this is the only place
- * that knows the resolution produced a self-defeating combination.
+ * is the `repair-fault-tolerance` advisory below, which lives here because this is the only place
+ * that knows the resolution produced a combination with no repair margin — or none at all.
  */
 export function resolveClusterPolicy(options) {
     // undefined here means "the operator said nothing", which is the only case where the two
@@ -76,36 +76,117 @@ export function resolveClusterPolicy(options) {
     const declaredCohortSize = options.clusterPolicy?.assumedClusterSize;
     const clusterSize = options.clusterSize ?? DEFAULT_CLUSTER_SIZE;
     const repairCorroborationClusterSize = declaredCohortSize ?? clusterSize;
-    // Called once per node (resolveClusterPolicy runs once at construction), so this fires once per
-    // node startup, not per repair — a per-attempt warn on a busy node would be noise that gets
-    // filtered, defeating the point. Fires purely off configuration (not an observed cohort), so a
-    // deployment that genuinely runs `clusterSize` machines sees it too; worded as a conditional
-    // ("if you run fewer than N machines") rather than a fault for exactly that reason.
+    // ## What the advisory actually claims, and why the trigger is what it is
     //
-    // The machine count in the message is CORROBORATION_FLOOR + 1, NOT repairCorroborationClusterSize:
-    // `corroboratorCapacity` caps only the FLOOR of two (`quorum-restore.ts`), so a cohort with two
-    // peers besides the reader meets it whatever the declared size. What an undeclared size costs is
-    // the relaxation below two, which is only reachable when repairCorroborationClusterSize <= 2.
-    // NOTE: only the UNDECLARED case warns. An operator who declares an assumedClusterSize larger than
-    // the cohort they actually run is equally unable to repair and gets no warning — deliberate, since
-    // a declaration is an explicit assertion and this function has no observed cohort to contradict it
-    // with. If `feat-admission-floor-from-observed-cohort-high-water-mark` ever lands (deriving the
-    // yardstick from observation), that warning becomes cheap and worth adding here.
-    if (declaredCohortSize === undefined && clusterSize > minAbsoluteClusterSize) {
-        const minimumSelfHealingDeployment = CORROBORATION_FLOOR + 1;
-        log('assumed-cluster-size-unset', {
+    // The rule it states is measurable, not rhetorical: sweep `corroboratorCapacity` and `quorumSize`
+    // over real cohort sizes and every configuration lands on the same requirement — **2 cohort peers
+    // BESIDES the reader must answer that reader and agree on the same (rev, actionId)**, relaxed to 1
+    // only for a cohort DECLARED smaller than three. Two consequences follow, and both are worth
+    // saying out loud because both surprised people in the field:
+    //
+    //  - Fewer than three machines, undeclared, can never repair at all: the floor of two never
+    //    relaxes, because `repairCorroborationClusterSize` falls back to `clusterSize` (default 10).
+    //  - Exactly three machines is the MINIMUM that can ever repair, not a size at which repair is
+    //    safe. The reader has exactly two peers and needs both, so a single peer unreachable FROM THAT
+    //    READER — perfectly healthy and reachable from everybody else — leaves that reader's copy
+    //    permanently unrepairable. Four machines is the first size with any margin.
+    //
+    // Both of those are claims about MACHINES, and the advisory used to stop there — which made it
+    // wrong in the operator's favour, because a machine count is only half the requirement. The peers
+    // that answer must also HOLD the block, and two of them must. A block only ONE cohort peer holds
+    // cannot be repaired at any deployment size whatsoever: the sole holder cannot second itself, and
+    // the two mechanisms that would give a second peer a copy (read-repair and reconcile) both consume
+    // this same decision. So an operator at four-plus machines reading "the first size with any margin"
+    // could believe they were covered while a block written when the deployment was smaller stayed
+    // stranded at one copy forever. The advisory now says so; the per-block half is
+    // `cluster-fetch:repair-deadlock` with `reason: 'sole-holder'` (`CoordinatorRepo`), and the
+    // behavioural fix — replicating owned blocks once the cohort grows — is separate work.
+    //
+    // So the trigger is a union of two conditions, not one:
+    //
+    //  - **undeclared** (the original case): the operator has asserted nothing, so a deployment
+    //    smaller than three would be silently unrepairable. Conditional wording ("if you run fewer
+    //    than N machines"), never a fault — this fires off configuration, not an observed cohort, so a
+    //    correctly-provisioned large deployment sees it too.
+    //  - **resolved cohort <= CORROBORATION_FLOOR + 1**, whether declared or not. Declaring
+    //    `assumedClusterSize: 3` does not conjure a third peer; it has exactly the same zero tolerance
+    //    as an undeclared three. The earlier "a declaration is an explicit assertion we cannot
+    //    contradict" reasoning holds for whether the NUMBER is honest — it does not hold for the
+    //    fragility implied by the number itself, which is arithmetic.
+    //
+    // Still one line per node construction (`resolveClusterPolicy` runs once), never per repair: a
+    // per-attempt warn on a busy node is noise that gets filtered, which defeats the point. The
+    // per-repair half of this — naming a decline that is provably permanent — lives at the repair site
+    // instead (`CoordinatorRepo.reportRepairDeadlock`, `cluster-fetch:repair-deadlock`), where the
+    // actual cohort is known.
+    //
+    // NOTE: an operator who declares an assumedClusterSize LARGER than the cohort they actually run is
+    // equally unable to repair and still gets no fault — this function has no observed cohort to
+    // contradict the declaration with, and the undeclared arm's conditional wording is the closest it
+    // can honestly get. If `feat-admission-floor-from-observed-cohort-high-water-mark` ever lands
+    // (deriving the yardstick from observation), that check becomes cheap and belongs here.
+    const minimumSelfHealingDeployment = CORROBORATION_FLOOR + 1;
+    const cohortUndeclared = declaredCohortSize === undefined && clusterSize > minAbsoluteClusterSize;
+    const noRepairMargin = repairCorroborationClusterSize <= minimumSelfHealingDeployment;
+    if (cohortUndeclared || noRepairMargin) {
+        // How many peers besides the reader must answer and agree, at the resolved size. Two once the
+        // cohort is three or larger; one for a cohort declared at two, which is the only size whose
+        // floor relaxes. Never below one — a claim nobody made is never accepted.
+        const requiredAnsweringPeers = Math.max(1, Math.min(CORROBORATION_FLOOR, repairCorroborationClusterSize - 1));
+        const availablePeers = Math.max(0, repairCorroborationClusterSize - 1);
+        const rule = `Block repair (read-repair and reconcile) converges only when ${CORROBORATION_FLOOR} cohort peers ` +
+            `BESIDES the reader answer that reader and agree on the same (rev, actionId); that requirement drops ` +
+            `to 1 only for a cohort that DECLARES it is smaller than ${minimumSelfHealingDeployment}. ` +
+            `${minimumSelfHealingDeployment} machines is therefore the MINIMUM that can repair at all, not a safe ` +
+            `size — at exactly ${minimumSelfHealingDeployment} the reader has two peers and needs both, so one ` +
+            `peer unreachable from that reader (healthy and reachable from everyone else) leaves that reader's ` +
+            `copy permanently unrepairable. ${minimumSelfHealingDeployment + 1} machines is the first size with ` +
+            `any margin.`;
+        // Every number above counts MACHINES. Saying only that overstates the guarantee, because repair
+        // also needs the answering peers to actually HOLD the block — which is a property of the block,
+        // not of the deployment, and which no machine count can supply.
+        //
+        // NOTE: accepted tradeoff — the caveat rides the EXISTING trigger (cohort size undeclared, or
+        // repairCorroborationClusterSize <= 3) rather than firing for every deployment. A correctly-
+        // declared large deployment is arguably the operator most likely to believe a machine count
+        // covers them, and never sees this paragraph at startup; they learn it from the per-block
+        // `cluster-fetch:repair-deadlock` line with reason=sole-holder instead. Weighed and kept: a
+        // startup advisory that fires on every correctly-configured node forever is one operators
+        // filter, which costs more than it buys. Revisit if the per-block line proves too late to be
+        // useful — i.e. if field reports show operators hitting stranded founding data without ever
+        // having read a repair-deadlock line.
+        const holdersCaveat = ` All of that counts MACHINES, and machines are only half the requirement: the peers that answer ` +
+            `must also HOLD the block, and ${CORROBORATION_FLOOR} of them must. A block that only ONE cohort ` +
+            `peer holds can never be repaired at ANY deployment size — the sole holder cannot second itself — ` +
+            `so every size claim above is about a block at least ${CORROBORATION_FLOOR} peers already hold. ` +
+            `The usual way to fall outside that: data written while the deployment (or that block's cohort) ` +
+            `was smaller keeps the number of copies it was written with, and GROWING THE DEPLOYMENT DOES NOT ` +
+            `COPY IT — so founding data can stay stranded however many machines you later run. That case is ` +
+            `reported once per affected block as cluster-fetch:repair-deadlock with reason=sole-holder, and its ` +
+            `remedy is another cohort peer holding it (commit a new revision of the block), never more machines.`;
+        const undeclaredAdvice = cohortUndeclared
+            ? ` No clusterPolicy.assumedClusterSize declared, so the floor is measured against ` +
+                `repairCorroborationClusterSize=${repairCorroborationClusterSize} and never relaxes: if you actually ` +
+                `run fewer than ${minimumSelfHealingDeployment} machines, every repair declines, permanently. Set ` +
+                `clusterPolicy.assumedClusterSize to your real cohort size; it does not lower ` +
+                `clusterSize=${clusterSize} (the replication factor). Larger deployments can ignore this.`
+            : '';
+        const noMarginAdvice = noRepairMargin
+            ? ` This node resolved repairCorroborationClusterSize=${repairCorroborationClusterSize}, which leaves ` +
+                `repair with NO fault tolerance: the reader has ${availablePeers} cohort peer(s) and needs ` +
+                `${requiredAnsweringPeers} of them to answer, so losing one is not survivable. Run at least ` +
+                `${minimumSelfHealingDeployment + 1} machines if repair must survive an unreachable peer.`
+            : '';
+        log('repair-fault-tolerance', {
             clusterSize,
             repairCorroborationClusterSize,
             corroborationFloor: CORROBORATION_FLOOR,
+            declaredCohortSize,
+            cohortUndeclared,
+            noRepairMargin,
+            requiredAnsweringPeers,
             minimumSelfHealingDeployment,
-            message: `No clusterPolicy.assumedClusterSize declared: block repair (read-repair and reconcile) requires ` +
-                `${CORROBORATION_FLOOR} distinct corroborating peers other than the reader, and that floor is ` +
-                `relaxed only for a cohort that DECLARES it is smaller — with ` +
-                `repairCorroborationClusterSize=${repairCorroborationClusterSize} it never relaxes. So a deployment ` +
-                `that actually runs fewer than ${minimumSelfHealingDeployment} machines can never supply the floor ` +
-                `and every repair declines, permanently. If you run fewer than ${minimumSelfHealingDeployment} ` +
-                `machines, set clusterPolicy.assumedClusterSize to your real cohort size; it does not lower ` +
-                `clusterSize=${clusterSize} (the replication factor). Larger deployments can ignore this.`
+            message: rule + undeclaredAdvice + noMarginAdvice + holdersCaveat
         });
     }
     return {
@@ -117,6 +198,9 @@ export function resolveClusterPolicy(options) {
         // Fail closed by default (an undersized cluster with no confident network-size estimate is
         // rejected); embedders running knowingly-small meshes opt in through clusterPolicy.
         allowUnvalidatedSmallCluster: options.clusterPolicy?.allowUnvalidatedSmallCluster ?? false,
+        // Pass through undefined (ClusterMember defaults it to 'accept') so an operator who said
+        // nothing gets the historical behaviour.
+        unvalidatablePendPolicy: options.clusterPolicy?.unvalidatablePendPolicy,
         partitionDetectionWindow: 60000,
         // Replication factor / target cohort breadth — what the coordinator aims for when selecting a
         // cohort. Deliberately NOT the membership admission gate's yardstick: it says nothing about how

package/dist/src/cluster/cluster-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"cluster-policy.js","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAA+B,MAAM,qBAAqB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AA+DvC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IACjE,yFAAyF;IACzF,4BAA4B;IAC5B,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,4FAA4F;IAC5F,8FAA8F;IAC9F,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,8BAA8B,GAAG,kBAAkB,IAAI,WAAW,CAAC;IAEzE,gGAAgG;IAChG,4FAA4F;IAC5F,+FAA+F;IAC/F,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,mGAAmG;IACnG,gGAAgG;IAChG,iGAAiG;IACjG,8FAA8F;IAC9F,mGAAmG;IACnG,mGAAmG;IACnG,mGAAmG;IACnG,gGAAgG;IAChG,iFAAiF;IACjF,IAAI,kBAAkB,KAAK,SAAS,IAAI,WAAW,GAAG,sBAAsB,EAAE,CAAC;QAC9E,MAAM,4BAA4B,GAAG,mBAAmB,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,4BAA4B,EAAE;YACjC,WAAW;YACX,8BAA8B;YAC9B,kBAAkB,EAAE,mBAAmB;YACvC,4BAA4B;YAC5B,OAAO,EACN,kGAAkG;gBAClG,GAAG,mBAAmB,yEAAyE;gBAC/F,+DAA+D;gBAC/D,kCAAkC,8BAA8B,qCAAqC;gBACrG,iCAAiC,4BAA4B,uCAAuC;gBACpG,iEAAiE,4BAA4B,GAAG;gBAChG,6FAA6F;gBAC7F,eAAe,WAAW,gEAAgE;SAC3F,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE,sBAAsB,IAAI,gCAAgC;QACzG,uBAAuB,EAAE,IAAI;QAC7B,sBAAsB;QACtB,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,IAAI;QAClE,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,GAAG;QACjE,2FAA2F;QAC3F,oFAAoF;QACpF,4BAA4B,EAAE,OAAO,CAAC,aAAa,EAAE,4BAA4B,IAAI,KAAK;QAC1F,wBAAwB,EAAE,KAAK;QAC/B,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,WAAW;QACX,+FAA+F;QAC/F,8FAA8F;QAC9F,0EAA0E;QAC1E,kBAAkB,EAAE,kBAAkB,IAAI,sBAAsB;QAChE,gGAAgG;QAChG,6FAA6F;QAC7F,uFAAuF;QACvF,8BAA8B;KAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"cluster-policy.js","sourceRoot":"","sources":["../../../src/cluster/cluster-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAA6D,MAAM,qBAAqB,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAqEvC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA6B;IACjE,yFAAyF;IACzF,4BAA4B;IAC5B,EAAE;IACF,mGAAmG;IACnG,8FAA8F;IAC9F,4FAA4F;IAC5F,8FAA8F;IAC9F,mGAAmG;IACnG,2CAA2C;IAC3C,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,8BAA8B,GAAG,kBAAkB,IAAI,WAAW,CAAC;IAEzE,0EAA0E;IAC1E,EAAE;IACF,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,6FAA6F;IAC7F,8DAA8D;IAC9D,EAAE;IACF,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,mGAAmG;IACnG,8FAA8F;IAC9F,gFAAgF;IAChF,EAAE;IACF,+FAA+F;IAC/F,kGAAkG;IAClG,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,oGAAoG;IACpG,+FAA+F;IAC/F,gFAAgF;IAChF,4FAA4F;IAC5F,uFAAuF;IACvF,EAAE;IACF,wDAAwD;IACxD,EAAE;IACF,4FAA4F;IAC5F,+FAA+F;IAC/F,mGAAmG;IACnG,yDAAyD;IACzD,wFAAwF;IACxF,mGAAmG;IACnG,2FAA2F;IAC3F,6FAA6F;IAC7F,kEAAkE;IAClE,EAAE;IACF,+FAA+F;IAC/F,4FAA4F;IAC5F,mGAAmG;IACnG,+FAA+F;IAC/F,0BAA0B;IAC1B,EAAE;IACF,mGAAmG;IACnG,6FAA6F;IAC7F,kGAAkG;IAClG,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,4BAA4B,GAAG,mBAAmB,GAAG,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,kBAAkB,KAAK,SAAS,IAAI,WAAW,GAAG,sBAAsB,CAAC;IAClG,MAAM,cAAc,GAAG,8BAA8B,IAAI,4BAA4B,CAAC;IACtF,IAAI,gBAAgB,IAAI,cAAc,EAAE,CAAC;QACxC,8FAA8F;QAC9F,4FAA4F;QAC5F,0EAA0E;QAC1E,MAAM,sBAAsB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9G,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GACT,gEAAgE,mBAAmB,gBAAgB;YACnG,sGAAsG;YACtG,2DAA2D,4BAA4B,IAAI;YAC3F,GAAG,4BAA4B,wEAAwE;YACvG,qBAAqB,4BAA4B,mDAAmD;YACpG,oGAAoG;YACpG,kCAAkC,4BAA4B,GAAG,CAAC,mCAAmC;YACrG,aAAa,CAAC;QACf,gGAAgG;QAChG,gGAAgG;QAChG,gEAAgE;QAChE,EAAE;QACF,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,0FAA0F;QAC1F,6FAA6F;QAC7F,4FAA4F;QAC5F,sCAAsC;QACtC,MAAM,aAAa,GAClB,kGAAkG;YAClG,iCAAiC,mBAAmB,8CAA8C;YAClG,mGAAmG;YACnG,uDAAuD,mBAAmB,uBAAuB;YACjG,iGAAiG;YACjG,kGAAkG;YAClG,iGAAiG;YACjG,qGAAqG;YACrG,qGAAqG,CAAC;QACvG,MAAM,gBAAgB,GAAG,gBAAgB;YACxC,CAAC,CAAC,kFAAkF;gBACpF,kCAAkC,8BAA8B,sCAAsC;gBACtG,kBAAkB,4BAA4B,qDAAqD;gBACnG,+EAA+E;gBAC/E,eAAe,WAAW,gEAAgE;YAC1F,CAAC,CAAC,EAAE,CAAC;QACN,MAAM,cAAc,GAAG,cAAc;YACpC,CAAC,CAAC,sDAAsD,8BAA8B,iBAAiB;gBACvG,kDAAkD,cAAc,4BAA4B;gBAC5F,GAAG,sBAAsB,oEAAoE;gBAC7F,GAAG,4BAA4B,GAAG,CAAC,uDAAuD;YAC1F,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,wBAAwB,EAAE;YAC7B,WAAW;YACX,8BAA8B;YAC9B,kBAAkB,EAAE,mBAAmB;YACvC,kBAAkB;YAClB,gBAAgB;YAChB,cAAc;YACd,sBAAsB;YACtB,4BAA4B;YAC5B,OAAO,EAAE,IAAI,GAAG,gBAAgB,GAAG,cAAc,GAAG,aAAa;SACjE,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,sBAAsB,EAAE,OAAO,CAAC,aAAa,EAAE,sBAAsB,IAAI,gCAAgC;QACzG,uBAAuB,EAAE,IAAI;QAC7B,sBAAsB;QACtB,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,IAAI;QAClE,oBAAoB,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,IAAI,GAAG;QACjE,2FAA2F;QAC3F,oFAAoF;QACpF,4BAA4B,EAAE,OAAO,CAAC,aAAa,EAAE,4BAA4B,IAAI,KAAK;QAC1F,yFAAyF;QACzF,yCAAyC;QACzC,uBAAuB,EAAE,OAAO,CAAC,aAAa,EAAE,uBAAuB;QACvE,wBAAwB,EAAE,KAAK;QAC/B,8FAA8F;QAC9F,gGAAgG;QAChG,qFAAqF;QACrF,WAAW;QACX,+FAA+F;QAC/F,8FAA8F;QAC9F,0EAA0E;QAC1E,kBAAkB,EAAE,kBAAkB,IAAI,sBAAsB;QAChE,gGAAgG;QAChG,6FAA6F;QAC7F,uFAAuF;QACvF,8BAA8B;KAC9B,CAAC;AACH,CAAC"}