npm - @serfab/cadre-core - Versions diffs - 0.10.0 → 0.11.0 - Mend

@serfab/cadre-core 0.10.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (105) hide show

package/README.md +255 -255
package/dist/cadre-node.d.ts +203 -28
package/dist/cadre-node.js +445 -84
package/dist/cadre-node.js.map +1 -1
package/dist/control-cohort.d.ts +26 -0
package/dist/control-cohort.js +26 -0
package/dist/control-cohort.js.map +1 -1
package/dist/control-database.d.ts +82 -117
package/dist/control-database.js +217 -295
package/dist/control-database.js.map +1 -1
package/dist/control-formation-recorder.d.ts +8 -7
package/dist/control-formation-recorder.js +8 -7
package/dist/control-formation-recorder.js.map +1 -1
package/dist/control-schema.d.ts +1 -1
package/dist/control-schema.js +789 -774
package/dist/control-schema.js.map +1 -1
package/dist/control-write-retry.d.ts +15 -5
package/dist/control-write-retry.js +19 -18
package/dist/control-write-retry.js.map +1 -1
package/dist/index.d.ts +1 -1
package/dist/index.js +1 -1
package/dist/index.js.map +1 -1
package/dist/peer-addr-book.d.ts +92 -0
package/dist/peer-addr-book.js +220 -0
package/dist/peer-addr-book.js.map +1 -0
package/dist/seed-bootstrap.d.ts +7 -0
package/dist/seed-bootstrap.js +15 -13
package/dist/seed-bootstrap.js.map +1 -1
package/dist/strand-cohort.d.ts +4 -37
package/dist/strand-cohort.js +4 -15
package/dist/strand-cohort.js.map +1 -1
package/dist/strand-database.d.ts +11 -16
package/dist/strand-database.js +19 -7
package/dist/strand-database.js.map +1 -1
package/dist/strand-formation-manager.d.ts +8 -8
package/dist/strand-formation-manager.js +15 -18
package/dist/strand-formation-manager.js.map +1 -1
package/dist/strand-instance-manager.d.ts +52 -21
package/dist/strand-instance-manager.js +100 -34
package/dist/strand-instance-manager.js.map +1 -1
package/dist/strand-membership-writer.d.ts +6 -4
package/dist/strand-membership-writer.js +38 -36
package/dist/strand-membership-writer.js.map +1 -1
package/dist/types.d.ts +39 -31
package/dist/types.js.map +1 -1
package/package.json +8 -7
package/src/arachnode-stub.ts +159 -159
package/src/bootstrap-peer-store-file.ts +44 -44
package/src/bootstrap-peer-store.ts +172 -172
package/src/cadre-node.ts +5158 -4771
package/src/canonical-json.ts +30 -30
package/src/control-authorization.ts +114 -114
package/src/control-cohort.ts +130 -103
package/src/control-database.ts +2406 -2506
package/src/control-formation-recorder.ts +305 -304
package/src/control-schema.ts +801 -786
package/src/control-stream.ts +205 -205
package/src/control-write-retry.ts +483 -473
package/src/delegate-admission.ts +302 -302
package/src/device-token.ts +94 -94
package/src/diagnostics/connection-path.ts +277 -277
package/src/diagnostics/webrtc-turn-tracker.ts +222 -222
package/src/ed25519-key.ts +134 -134
package/src/enrollment.ts +199 -199
package/src/file-durable-slot.ts +61 -61
package/src/formation-approval.ts +604 -604
package/src/fs-atomic.ts +107 -107
package/src/hibernation-manager.ts +437 -437
package/src/identity-key.ts +109 -109
package/src/index.ts +1 -0
package/src/key-store-file.ts +132 -132
package/src/key-store.ts +99 -99
package/src/membership-connection-gater.ts +204 -204
package/src/node-local-snapshot.ts +260 -260
package/src/peer-addr-book.ts +250 -0
package/src/peer-authorization.ts +259 -259
package/src/peer-record.ts +164 -164
package/src/push-credentials.ts +84 -84
package/src/push-node.ts +64 -64
package/src/push-notifier-apns.ts +247 -247
package/src/push-notifier-fcm.ts +220 -220
package/src/push-notifier-shared.ts +28 -28
package/src/push-notifier.ts +52 -52
package/src/relay-addrs.ts +111 -111
package/src/relay-reservation.ts +823 -823
package/src/seed-bootstrap.ts +15 -15
package/src/seed-trust-policy.ts +140 -140
package/src/strand-addr-protocol.ts +441 -441
package/src/strand-backfill.ts +366 -366
package/src/strand-cohort.ts +38 -77
package/src/strand-database.ts +202 -204
package/src/strand-formation-manager.ts +491 -494
package/src/strand-formation-protocol.ts +692 -692
package/src/strand-instance-manager.ts +108 -50
package/src/strand-member-key.ts +39 -39
package/src/strand-member-registry.ts +182 -182
package/src/strand-membership-writer.ts +1432 -1430
package/src/strand-solicitation.ts +472 -472
package/src/strand-transport-key.ts +58 -58
package/src/strand-wake-payload.ts +32 -32
package/src/strand-wake-protocol.ts +314 -314
package/src/strand-watcher.ts +314 -314
package/src/trusted-owner-store-file.ts +41 -41
package/src/trusted-owner-store.ts +171 -171
package/src/types.ts +1309 -1303

package/dist/control-database.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"control-database.js","sourceRoot":"","sources":["../src/control-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,YAAY,MAAM,0CAA0C,CAAC;AACpE,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAIxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAKvF,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/C,2BAA2B;IAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAe,CAAC;IAE3D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE7B,uBAAuB;IACvB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAqB,QAAgB,EAAW,KAAa;QAC3D,KAAK,CAAC,2CAA2C,KAAK,iBAAiB,QAAQ,iBAAiB,CAAC,CAAC;QAD/E,aAAQ,GAAR,QAAQ,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAE3D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YACW,KAAa,EACtB,SAAiB,EACjB,OAA6B;QAE7B,KAAK,CAAC,aAAa,SAAS,cAAc,KAAK,0CAA0C,EAAE,OAAO,CAAC,CAAC;QAJ3F,UAAK,GAAL,KAAK,CAAQ;QAKtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YACW,KAAa,EACb,SAAiB,EACjB,SAAiB;QAE1B,KAAK,CACH,cAAc,KAAK,uBAAuB,SAAS,yBAAyB,SAAS,SAAS,CAC/F,CAAC;QANO,UAAK,GAAL,KAAK,CAAQ;QACb,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QAK1B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,wBAAwB,GAAG;IAC/B,6EAA6E;IAC7E,sCAAsC;CACvC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrE,CAAC;AAgBD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,KAAyC;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,MAAqB,EACrB,SAAmB;IAEnB,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAMrC;IACC,OAAO,yBAAyB,CAAC,6BAA6B,EAAE,OAAO,EAAE;QACvE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,OAAO,yBAAyB,CAAC,6BAA6B,EAAE,SAAS,EAAE;QACzE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU;KACrE,CAAC,CAAC;AACL,CAAC;AA4BD,2EAA2E;AAC3E,MAAM,iBAAiB,GAA8B,IAAI,GAAG,CAAe,cAAc,CAAC,CAAC;AAK3F;;;;;GAKG;AACH,MAAM,kBAAkB,GAAuD;IAC7E,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,KAAK;IACpB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,QAAQ;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,CAA8C,CAAC;AAG1H;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAgC,IAAI,GAAG,CAAiB,eAAe,CAAC,CAAC;AACjG,MAAM,eAAe,GAAG,CAAC,KAAqB,EAA0B,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAgDzG;;;GAGG;AACH,MAAM,OAAO,eAAe;IAiB1B,YAAY,MAA6B;QAhBjC,OAAE,GAAoB,IAAI,CAAC;QAC3B,sBAAiB,GAA6B,IAAI,CAAC;QAEnD,gBAAW,GAAG,KAAK,CAAC;QACpB,uBAAkB,GAAoC,IAAI,CAAC;QAC3D,0BAAqB,GAAiC,IAAI,CAAC;QACnE,iEAAiE;QACzD,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD;;;;;WAKG;QACK,4BAAuB,GAA6B,EAAE,CAAC;QAG7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvE,2BAA2B;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,mEAAmE;QACnE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,gCAAgC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEhC,gEAAgE;QAChE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7C,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,QAAQ;YAC7B,oBAAoB,EAAE,WAAW;YACjC,YAAY,EAAE,IAAI;SACnB,CAAsC,CAAC;QAExC,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAEjF,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QAExD,qDAAqD;QACrD,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CACvC,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;QACF,MAAM,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAEtD,iFAAiF;QACjF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,8EAA8E;QAC9E,8EAA8E;QAC9E,gEAAgE;QAChE,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;YACzB,WAAW;YACX,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,qEAAqE,EAAE,WAAW,CAAC,CAAC;QAExF,8EAA8E;QAC9E,+EAA+E;QAC/E,iFAAiF;QACjF,+EAA+E;QAC/E,mEAAmE;QACnE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,mDAAmD,EACxD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzE,GAAG,CAAC,kDAAkD,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3F,8BAA8B;QAC9B,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0CAA0C;YAC1C,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5D,0CAA0C;YAC1C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,wDAAwD;oBACxD,oEAAoE;oBACpE,iEAAiE;oBACjE,mEAAmE;oBACnE,iEAAiE;oBACjE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;oBAClC,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC7D,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACrC,aAAa,GAAG,cAAc,CAAC;QACjC,CAAC;QAED,oFAAoF;QACpF,qFAAqF;QACrF,qFAAqF;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,oBAAoB;QACpB,EAAE;QACF,sFAAsF;QACtF,uFAAuF;QACvF,yFAAyF;QACzF,2EAA2E;QAC3E,yFAAyF;QACzF,uFAAuF;QACvF,2EAA2E;QAC3E,EAAE;QACF,+EAA+E;QAC/E,uEAAuE;QACvE,EAAE;QACF,uFAAuF;QACvF,sFAAsF;QACtF,wFAAwF;QACxF,EAAE;QACF,uFAAuF;QACvF,wFAAwF;QACxF,mDAAmD;QACnD,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACzF,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,EAAE,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,yEAAyE,EACzE,CAAC,QAAQ,CAAC,CACX,EAAE,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CAAC,KAAmB;QACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,8CAA8C,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,EAAE,CAAC;YAC7H,MAAM,OAAO,GAAI,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,OAAO;gBACP,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;gBACrD,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,YAAY,CACxB,KAAqB,EACrB,QAAgB;QAEhB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,oCAAoC,KAAK,UAAU,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvD,OAAQ,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,uBAAuB,CAAC,MAAc;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAC5F,yBAAyB,CAAC,GAAW;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAyB;QAChD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,EAAE,CAAC;YACpH,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,GAAG,CAAC,SAA2B;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,OAAO,EAAE,GAAG,CAAC,OAAiB;gBAC9B,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,2GAA2G,EAC3G,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,MAAM,OAAO,GAAI,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,SAA2B,IAAI,EAAE,CAAC;YACzD,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,EAAE;gBACjD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;aACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAyB;QAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC;;;;;KAKpB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,wGAAwG,EACxG,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAkB,IAAI,EAAE,CAAiB;gBACxD,KAAK,EAAG,GAAG,CAAC,KAAuB,IAAI,EAAE;gBACzC,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;gBACrC,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,EAAE;aAC9C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAyB;QACnD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC;;;;;KAKpB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,GAAG,CAAC,2DAA2D,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAEpC,kFAAkF;QAClF,wFAAwF;QACxF,wFAAwF;QACxF,yFAAyF;QACzF,gFAAgF;QAChF,uFAAuF;QACvF,0FAA0F;QAC1F,mFAAmF;QACnF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAAe,EACf,QAAgB,EAChB,WAA4C,EAC5C,gBAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,iCAAiC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEvD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,OAAO,GAAG,yBAAyB,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3H,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,wFAAwF;QACxF,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAE7E,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CACV,QAAgB,EAChB,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,6FAA6F;QAC7F,MAAM,OAAO,GAAG,yBAAyB,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAExC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,GAAW,EACX,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACxG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,KAAK,CAAC,eAAe,CACnB,GAMC,EACD,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,qFAAqF;QACrF,kBAAkB;QAClB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,WAAW,CAC3B,yBAAyB,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACpF,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9D,GAAG,CAAC,yEAAyE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,oFAAoF;YACpF,6EAA6E;YAC7E,EAAE;YACF,+EAA+E;YAC/E,oFAAoF;YACpF,qFAAqF;YACrF,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;OAInB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1H,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,qEAAqE,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAC3B,yBAAyB,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAChF,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YACxD,4EAA4E;YAC5E,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;OAKnB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,CACb,MAAc,EACd,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,CAC9C,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,iBAAiB,CACf,MAAc,EACd,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,gBAAgB,CAC5B,KAA0C,EAC1C,QAAgB,EAChB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,yBAAyB,CAAC,gBAAgB,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,sFAAsF;QACtF,qFAAqF;QACrF,gFAAgF;QAChF,MAAM,mBAAmB,GAAG,WAAW,CACrC,yBAAyB,CAAC,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC3F,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;mCACS,KAAK;;kBAEtB,kBAAkB,CAAC,KAAK,CAAC;OACpC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpC,kFAAkF;YAClF,iFAAiF;YACjF,qEAAqE;YACrE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;OAInB,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,KAAK,CAAC,cAAc,CAAC,KAAoB,EAAE,MAAc,EAAE,OAAe;QACxE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,gGAAgG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG;iCACiB,KAAK;;gBAEtB,kBAAkB,CAAC,KAAK,CAAC;KACpC,CAAC;QACF,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,2EAA2E;YAC3E,iFAAiF;YACjF,4EAA4E;YAC5E,sEAAsE;YACtE,EAAE;YACF,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,iFAAiF;YACjF,wEAAwE;YACxE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,+EAA+E;QAC/E,8BAA8B;QAC9B,GAAG,CAAC,+FAA+F,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU;mBAC9B,CAAC,SAAS,CAAC,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,EAAE,CAAC;gBACpF,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxF,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,0DAA0D,EAC5D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,kBAAkB,CAChB,IAA8B,EAC9B,UAAkB,EAClB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,GAAG;YACH,SAAS,EAAE,WAAW,CAAC,yBAAyB,CAC9C,yBAAyB,EAAE,SAAS,EACpC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;SACH,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACrC,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;gBACzD,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;oBACxC,wEAAwE;oBACxE,6EAA6E;oBAC7E,yEAAyE;oBACzE,wEAAwE;oBACxE,gFAAgF;oBAChF,oEAAoE;oBACpE,4EAA4E;oBAC5E,0EAA0E;oBAC1E,yEAAyE;oBACzE,4EAA4E;oBAC5E,4EAA4E;oBAC5E,oBAAoB;oBACpB,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;WAKnB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnD,QAAQ,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,2CAA2C,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,IAAyB;QAClE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,EAAG,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,EAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,2BAA2B,CAAC,QAAyC;QACnE,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CAAC,QAAsC;QAC7D,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,KAAK,CAAC,eAAe,CAAI,MAAc,EAAE,IAAsB;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,KAAK,CAAC,aAAa,CAAI,EAAoB;QACzC,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,eAAe,CAAI,EAAoB,EAAE,SAAmC,EAAE;QACpF,OAAO,iBAAiB,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAC5B,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAC/C,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,CAAC,GAAW,EAAE,MAAsB;QAC3C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,oBAAoB,CAAC,MAAc,EAAE,KAAa;QACxD,IAAI,IAAI,CAAC,EAAG,CAAC,aAAa,EAAE,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,4BAA4B,KAAK,yBAAyB;YACnF,4EAA4E;YAC5E,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAClD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,4CAA4C,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,KAAK,CAAC,qBAAqB,CACzB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,WAA4C,EAC5C,UAAmG,EAAE;QAErG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE1E,8EAA8E;QAC9E,oFAAoF;QACpF,sEAAsE;QACtE,iGAAiG;QACjG,gDAAgD;QAChD,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI;YACpD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,kBAAkB,IAAI,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE7C,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,OAAO,GAAG,yBAAyB,CAAC,8BAA8B,EAAE,KAAK,EAAE;YAC/E,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO;SAC1F,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,qFAAqF;QACrF,oFAAoF;QACpF,qEAAqE;QACrE,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE;YACD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,kBAAkB;YAClB,OAAO,CAAC,SAAS,IAAI,IAAI;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI;YAC7B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,OAAO;SACR,CAAC,CAAC;QAEH,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,KAAK,CAAC,gBAAgB,CAAC,MA0BtB;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EACpC,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,GAC7D,GAAG,MAAM,CAAC;QACX,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7D,uFAAuF;QACvF,sFAAsF;QACtF,qEAAqE;QACrE,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,CACzG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YAC1C,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;SAInB,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;YAE9B,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,CAAC,wBAAwB,CAAC;gBAClC,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;gBACrF,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;gBAClD,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;aACvF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,CAAC;QAEN,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,oBAAoB,CAAC,MA2B1B;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EACvF,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,uFAAuF;QACvF,0EAA0E;QAC1E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAAE,CAC9G,IAAI,CAAC,wBAAwB,CAAC;YAC5B,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;YACrF,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;YAClD,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;SACvF,CAAC,CAAC,CAAC;QAEN,GAAG,CAAC,wDAAwD,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1F,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACK,KAAK,CAAC,kBAAkB,CAC9B,KAAa,EACb,SAAiB,EACjB,MAA+B,EAC/B,cAAyC,EACzC,KAA2C;QAE3C,IAAI,SAAkB,CAAC;QACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;YAChE,IAAI,CAAC;gBACH,6EAA6E;gBAC7E,+EAA+E;gBAC/E,gFAAgF;gBAChF,gFAAgF;gBAChF,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;oBAC3C,gFAAgF;oBAChF,oDAAoD;oBACpD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;wBACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBACpD,CAAC;oBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;oBAClD,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;oBAC/D,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;oBACvB,OAAO,SAAS,CAAC;gBACnB,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,SAAS,GAAG,KAAK,CAAC;gBAClB,GAAG,CAAC,yEAAyE,EAC3E,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,sFAAsF;QACtF,0FAA0F;QAC1F,6EAA6E;QAC7E,MAAM,SAAS,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,SAAiB,EACjB,cAAyC;QAEzC,sFAAsF;QACtF,0FAA0F;QAC1F,6EAA6E;QAC7E,yFAAyF;QACzF,sFAAsF;QACtF,2FAA2F;QAC3F,gFAAgF;QAChF,MAAM,SAAS,GAAG,cAAc,KAAK,SAAS;YAC5C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;QAChE,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,wBAAwB,CAAC,IActC;QACC,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,8EAA8E;QAC9E,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE;YACD,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,mBAAmB;YAC1D,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO;YAC3D,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa;SACvE,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAQtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,uHAAuH,EACvH,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,KAAe;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,WAAW,EAAE,6BAA6B,CAAC,GAAG,CAAC,SAAmC,CAAC;gBACnF,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,aAAa,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;gBAC3D,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,2EAA2E,EAC3E,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,6BAA6B,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;QAC5D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,OAAO,GAAgD,EAAE,CAAC;QAChE,IAAI,oBAAoB,GAAG,KAAK,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,sEAAsE,CACvE,EAAE,CAAC;YACF,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,CAAC,SAAmC,CAAC,CAAC;YAC3F,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,SAA2B,IAAI,IAAI,CAAC;YAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,oBAAoB,GAAG,IAAI,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,+FAA+F,EAC/F,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAQ,GAAG,CAAC,MAAiB,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC;QACtB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}
1	+ {"version":3,"file":"control-database.js","sourceRoot":"","sources":["../src/control-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,YAAY,MAAM,0CAA0C,CAAC;AACpE,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAIxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAKvF,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/C,2BAA2B;IAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAe,CAAC;IAE3D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE7B,uBAAuB;IACvB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAqB,QAAgB,EAAW,KAAa;QAC3D,KAAK,CAAC,2CAA2C,KAAK,iBAAiB,QAAQ,iBAAiB,CAAC,CAAC;QAD/E,aAAQ,GAAR,QAAQ,CAAQ;QAAW,UAAK,GAAL,KAAK,CAAQ;QAE3D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YACW,KAAa,EACtB,SAAiB,EACjB,OAA6B;QAE7B,KAAK,CAAC,aAAa,SAAS,cAAc,KAAK,0CAA0C,EAAE,OAAO,CAAC,CAAC;QAJ3F,UAAK,GAAL,KAAK,CAAQ;QAKtB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YACW,KAAa,EACb,YAAoB,EACpB,SAAiB;QAE1B,KAAK,CACH,cAAc,KAAK,kBAAkB,YAAY,OAAO,SAAS,0BAA0B,CAC5F,CAAC;QANO,UAAK,GAAL,KAAK,CAAQ;QACb,iBAAY,GAAZ,YAAY,CAAQ;QACpB,cAAS,GAAT,SAAS,CAAQ;QAK1B,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAcD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,KAAyC;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,MAAqB,EACrB,SAAmB;IAEnB,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAMrC;IACC,OAAO,yBAAyB,CAAC,6BAA6B,EAAE,OAAO,EAAE;QACvE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU;KACtF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,OAAO,yBAAyB,CAAC,6BAA6B,EAAE,SAAS,EAAE;QACzE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU;KACrE,CAAC,CAAC;AACL,CAAC;AA4BD,2EAA2E;AAC3E,MAAM,iBAAiB,GAA8B,IAAI,GAAG,CAAe,cAAc,CAAC,CAAC;AAK3F;;;;;GAKG;AACH,MAAM,kBAAkB,GAAuD;IAC7E,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,QAAQ;IACnB,aAAa,EAAE,KAAK;IACpB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,QAAQ;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,CAA8C,CAAC;AAG1H;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAgC,IAAI,GAAG,CAAiB,eAAe,CAAC,CAAC;AACjG,MAAM,eAAe,GAAG,CAAC,KAAqB,EAA0B,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAgDzG;;;GAGG;AACH,MAAM,OAAO,eAAe;IAiB1B,YAAY,MAA6B;QAhBjC,OAAE,GAAoB,IAAI,CAAC;QAC3B,sBAAiB,GAA6B,IAAI,CAAC;QAEnD,gBAAW,GAAG,KAAK,CAAC;QACpB,uBAAkB,GAAoC,IAAI,CAAC;QAC3D,0BAAqB,GAAiC,IAAI,CAAC;QACnE,iEAAiE;QACzD,eAAU,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;QACzD;;;;;WAKG;QACK,4BAAuB,GAA6B,EAAE,CAAC;QAG7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvE,2BAA2B;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,mEAAmE;QACnE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,gCAAgC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEhC,gEAAgE;QAChE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7C,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,QAAQ;YAC7B,oBAAoB,EAAE,WAAW;YACjC,YAAY,EAAE,IAAI;SACnB,CAAsC,CAAC;QAExC,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAEjF,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QAExD,qDAAqD;QACrD,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CACvC,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;QACF,MAAM,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAEtD,iFAAiF;QACjF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,8EAA8E;QAC9E,8EAA8E;QAC9E,gEAAgE;QAChE,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;YACzB,WAAW;YACX,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,qEAAqE,EAAE,WAAW,CAAC,CAAC;QAExF,8EAA8E;QAC9E,+EAA+E;QAC/E,iFAAiF;QACjF,+EAA+E;QAC/E,mEAAmE;QACnE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,mDAAmD,EACxD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzE,GAAG,CAAC,kDAAkD,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3F,8BAA8B;QAC9B,iFAAiF;QACjF,2EAA2E;QAC3E,iFAAiF;QACjF,kFAAkF;QAClF,gFAAgF;QAChF,6EAA6E;QAC7E,6GAA6G;QAC7G,6CAA6C;QAC7C,gFAAgF;QAChF,+EAA+E;QAC/E,8EAA8E;QAC9E,iFAAiF;QACjF,8EAA8E;QAC9E,yBAAyB;QACzB,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0CAA0C;YAC1C,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5D,0CAA0C;YAC1C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,wDAAwD;oBACxD,oEAAoE;oBACpE,iEAAiE;oBACjE,mEAAmE;oBACnE,iEAAiE;oBACjE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;oBAClC,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC7D,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACrC,aAAa,GAAG,cAAc,CAAC;QACjC,CAAC;QAED,oFAAoF;QACpF,qFAAqF;QACrF,qFAAqF;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,oBAAoB;QACpB,EAAE;QACF,sFAAsF;QACtF,uFAAuF;QACvF,yFAAyF;QACzF,2EAA2E;QAC3E,yFAAyF;QACzF,uFAAuF;QACvF,2EAA2E;QAC3E,EAAE;QACF,+EAA+E;QAC/E,uEAAuE;QACvE,EAAE;QACF,uFAAuF;QACvF,sFAAsF;QACtF,wFAAwF;QACxF,EAAE;QACF,uFAAuF;QACvF,wFAAwF;QACxF,mDAAmD;QACnD,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,wBAAwB,EAAE,aAAa,CAAC,CAAC;QACxG,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,EAAE,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,yEAAyE,EACzE,CAAC,QAAQ,CAAC,CACX,EAAE,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CAAC,KAAmB;QACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,8CAA8C,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,EAAE,CAAC;YAC7H,MAAM,OAAO,GAAI,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,OAAO;gBACP,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;gBACrD,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,EAAE,CAAC;YACpF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,YAAY,CACxB,KAAqB,EACrB,QAAgB;QAEhB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,oCAAoC,KAAK,UAAU,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/F,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACvD,OAAQ,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,uBAAuB,CAAC,MAAc;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAC5F,yBAAyB,CAAC,GAAW;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAAyB;QAChD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtH,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,EAAE,CAAC;YACpH,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS,EAAE,GAAG,CAAC,SAA2B;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,OAAO,EAAE,GAAG,CAAC,OAAiB;gBAC9B,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,2GAA2G,EAC3G,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,MAAM,OAAO,GAAI,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,SAA2B,IAAI,EAAE,CAAC;YACzD,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,EAAE;gBACjD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;aACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAyB;QAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,SAAS,CAAC;;;;;KAKpB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC/F,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,wGAAwG,EACxG,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAkB,IAAI,EAAE,CAAiB;gBACxD,KAAK,EAAG,GAAG,CAAC,KAAuB,IAAI,EAAE;gBACzC,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;gBACrC,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,EAAE;aAC9C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAyB;QACnD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC;;;;;KAKpB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,CAAC;QACpH,GAAG,CAAC,2DAA2D,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAEpC,kFAAkF;QAClF,wFAAwF;QACxF,wFAAwF;QACxF,yFAAyF;QACzF,gFAAgF;QAChF,uFAAuF;QACvF,0FAA0F;QAC1F,mFAAmF;QACnF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAAe,EACf,QAAgB,EAChB,WAA4C,EAC5C,gBAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,iCAAiC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEvD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,wEAAwE;QACxE,sDAAsD;QACtD,MAAM,OAAO,GAAG,yBAAyB,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3H,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,wFAAwF;QACxF,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,OAAO,CAAC,EAAE,eAAe,CAAC,CAAC;QAE9F,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CACV,QAAgB,EAChB,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3H,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,6FAA6F;QAC7F,MAAM,OAAO,GAAG,yBAAyB,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,uBAAuB,CAAC,CAAC;QAEjE,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,GAAW,EACX,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACrI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,KAAK,CAAC,eAAe,CACnB,GAMC,EACD,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,qFAAqF;QACrF,kBAAkB;QAClB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,WAAW,CAC3B,yBAAyB,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACpF,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9D,GAAG,CAAC,yEAAyE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,oFAAoF;YACpF,6EAA6E;YAC7E,EAAE;YACF,+EAA+E;YAC/E,oFAAoF;YACpF,qFAAqF;YACrF,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;OAInB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAC1H,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,qEAAqE,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAC3B,yBAAyB,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAChF,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YACxD,4EAA4E;YAC5E,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;OAKnB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,CACb,MAAc,EACd,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,CAC9C,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,iBAAiB,CACf,MAAc,EACd,QAAgB,EAChB,WAA4C;QAE5C,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACpI,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,gBAAgB,CAC5B,KAA0C,EAC1C,QAAgB,EAChB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,yBAAyB,CAAC,gBAAgB,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,sFAAsF;QACtF,qFAAqF;QACrF,gFAAgF;QAChF,MAAM,mBAAmB,GAAG,WAAW,CACrC,yBAAyB,CAAC,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAC3F,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;YACrD,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;mCACS,KAAK;;kBAEtB,kBAAkB,CAAC,KAAK,CAAC;OACpC,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACpC,kFAAkF;YAClF,iFAAiF;YACjF,qEAAqE;YACrE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;OAInB,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,iEAAiE,EAAE,KAAK,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACH,KAAK,CAAC,cAAc,CAAC,KAAoB,EAAE,MAAc,EAAE,OAAe;QACxE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,gGAAgG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACrH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG;iCACiB,KAAK;;gBAEtB,kBAAkB,CAAC,KAAK,CAAC;KACpC,CAAC;QACF,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,2EAA2E;YAC3E,iFAAiF;YACjF,4EAA4E;YAC5E,sEAAsE;YACtE,EAAE;YACF,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,iFAAiF;YACjF,wEAAwE;YACxE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,+EAA+E;QAC/E,8BAA8B;QAC9B,GAAG,CAAC,+FAA+F,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7B,+EAA+E;YAC/E,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU;mBAC9B,CAAC,SAAS,CAAC,SAAS,KAAK,WAAW,IAAI,SAAS,CAAC,SAAS,KAAK,aAAa,CAAC,EAAE,CAAC;gBACpF,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxF,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,0DAA0D,EAC5D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,kBAAkB,CAChB,IAA8B,EAC9B,UAAkB,EAClB,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,mFAAmF;QACnF,kFAAkF;QAClF,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAChC,GAAG;YACH,SAAS,EAAE,WAAW,CAAC,yBAAyB,CAC9C,yBAAyB,EAAE,SAAS,EACpC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;SACH,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACrC,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;gBACzD,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;oBACxC,wEAAwE;oBACxE,6EAA6E;oBAC7E,yEAAyE;oBACzE,wEAAwE;oBACxE,gFAAgF;oBAChF,oEAAoE;oBACpE,4EAA4E;oBAC5E,0EAA0E;oBAC1E,yEAAyE;oBACzE,4EAA4E;oBAC5E,4EAA4E;oBAC5E,oBAAoB;oBACpB,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;WAKnB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnD,QAAQ,EAAE,CAAC;gBACb,CAAC;YACH,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,2CAA2C,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;YACvE,OAAO,QAAQ,CAAC;QAClB,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,IAAyB;QAClE,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,EAAG,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,EAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,2CAA2C,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,2BAA2B,CAAC,QAAyC;QACnE,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,wBAAwB,CAAC,QAAsC;QAC7D,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,KAAK,CAAC,eAAe,CAAI,MAAc,EAAE,IAAsB;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC;QAChB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,KAAK,CAAC,aAAa,CAAI,EAAoB;QACzC,0EAA0E;QAC1E,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,eAAe,CAAI,EAAoB,EAAE,SAAmC,EAAE,EAAE,KAAc;QACpG,kFAAkF;QAClF,0EAA0E;QAC1E,OAAO,iBAAiB,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,EAC5B,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,GAAW,EAAE,MAAsB,EAAE,KAAc;QAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,oBAAoB,CAAC,MAAc,EAAE,KAAa;QACxD,IAAI,IAAI,CAAC,EAAG,CAAC,aAAa,EAAE,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,4BAA4B,KAAK,yBAAyB;YACnF,4EAA4E;YAC5E,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAClD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,4CAA4C,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,KAAK,CAAC,qBAAqB,CACzB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,WAA4C,EAC5C,UAAmG,EAAE;QAErG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE1E,8EAA8E;QAC9E,oFAAoF;QACpF,sEAAsE;QACtE,iGAAiG;QACjG,gDAAgD;QAChD,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI;YACpD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,kBAAkB,IAAI,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE7C,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,OAAO,GAAG,yBAAyB,CAAC,8BAA8B,EAAE,KAAK,EAAE;YAC/E,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO;SAC1F,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,qFAAqF;QACrF,oFAAoF;QACpF,qEAAqE;QACrE,MAAM,IAAI,CAAC,SAAS,CAAC;;;;KAIpB,EAAE;YACD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,kBAAkB;YAClB,OAAO,CAAC,SAAS,IAAI,IAAI;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI;YAC7B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,OAAO;SACR,EAAE,yBAAyB,CAAC,CAAC;QAE9B,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,KAAK,CAAC,gBAAgB,CAAC,MA0BtB;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EACpC,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EAAE,SAAS,GAC7D,GAAG,MAAM,CAAC;QACX,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7D,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAEnD,wFAAwF;QACxF,qFAAqF;QACrF,sFAAsF;QACtF,gDAAgD;QAChD,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACpC,gFAAgF;YAChF,oDAAoD;YACpD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;gBAChD,0EAA0E;gBAC1E,uEAAuE;gBACvE,0EAA0E;gBAC1E,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;SAInB,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;gBAE9B,0EAA0E;gBAC1E,yEAAyE;gBACzE,MAAM,IAAI,CAAC,wBAAwB,CAAC;oBAClC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;oBACxD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;oBAClD,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;iBACvF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAE1B,GAAG,CAAC,gDAAgD,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACrF,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,oBAAoB,CAAC,MA0B1B;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAChC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,EACvF,SAAS,GACV,GAAG,MAAM,CAAC;QAEX,uFAAuF;QACvF,6BAA6B;QAC7B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QAED,wFAAwF;QACxF,yCAAyC;QACzC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE;YACpC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,wBAAwB,CAAC;gBAClC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;gBACxD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;gBAClD,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;aACvF,CAAC,CAAC;QACL,CAAC,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAE1B,GAAG,CAAC,yDAAyD,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9F,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,cAAyC;QAEzC,sFAAsF;QACtF,0FAA0F;QAC1F,6EAA6E;QAC7E,yFAAyF;QACzF,sFAAsF;QACtF,2FAA2F;QAC3F,gFAAgF;QAChF,MAAM,SAAS,GAAG,cAAc,KAAK,SAAS;YAC5C,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,IAAI,IAAI,CAAC;QAChE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,wBAAwB,CAAC,IAatC;QACC,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,8EAA8E;QAC9E,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE;YACD,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,mBAAmB;YAC1D,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO;YAC3C,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa;SACvE,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAQtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,uHAAuH,EACvH,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,KAAe;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,WAAW,EAAE,6BAA6B,CAAC,GAAG,CAAC,SAAmC,CAAC;gBACnF,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,aAAa,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;gBAC3D,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,2EAA2E,EAC3E,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,6BAA6B,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;QAC5D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,+BAA+B;QAC/B,MAAM,OAAO,GAAgD,EAAE,CAAC;QAChE,IAAI,oBAAoB,GAAG,KAAK,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,sEAAsE,CACvE,EAAE,CAAC;YACF,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,CAAC,SAAmC,CAAC,CAAC;YAC3F,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,MAAM,SAAS,GAAI,GAAG,CAAC,SAA2B,IAAI,IAAI,CAAC;YAC3D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,oBAAoB,GAAG,IAAI,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAe,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC;QACtB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/control-formation-recorder.d.ts CHANGED Viewed

@@ -145,13 +145,14 @@ export declare class ControlFormationUsageRecorder implements FormationUsageReco
      *
      * A concurrent redemption of the same single-use invite still THROWS for the loser — the
      * manager maps that to a clean protocol rejection (it never lets the dropped insert close
-     * the stream silently) — but no longer via a `(Token, UseNumber)` primary-key collision on
-     * this node: `redeemInvitation` reads the use number INSIDE the write lock, so two local
-     * redemptions serialize and the second one reads the number the first already committed.
-     * It is then refused because that number is past the invite's seat budget, reported as a
-     * named `InvitationExhaustedError` on every attempt (including the first, which is what a
-     * same-node race hits). A PK collision is still what a cross-node race surfaces as, and that
-     * one IS retried under a fresh use number rather than thrown.
+     * the stream silently): the local write queue serializes the two writes, so the loser's
+     * seat check reads the winner's committed row against the cap and is refused as a named
+     * `InvitationExhaustedError`. A CROSS-node race is not a collision to retry at all — each
+     * redemption writes under its own `UsageStampId`, both rows land and survive convergence,
+     * and the cap can over-admit by the number of concurrent redeemers. That over-admission is
+     * the accepted trade (visible in the append-only record, reversible by owner-gated
+     * removal), chosen over a fought-over shared key whose failure mode was the silent loss of
+     * a consented join.
      */
     provisionAndRecord(params: {
         token: string;

package/dist/control-formation-recorder.js CHANGED Viewed

@@ -224,13 +224,14 @@ export class ControlFormationUsageRecorder {
      *
      * A concurrent redemption of the same single-use invite still THROWS for the loser — the
      * manager maps that to a clean protocol rejection (it never lets the dropped insert close
-     * the stream silently) — but no longer via a `(Token, UseNumber)` primary-key collision on
-     * this node: `redeemInvitation` reads the use number INSIDE the write lock, so two local
-     * redemptions serialize and the second one reads the number the first already committed.
-     * It is then refused because that number is past the invite's seat budget, reported as a
-     * named `InvitationExhaustedError` on every attempt (including the first, which is what a
-     * same-node race hits). A PK collision is still what a cross-node race surfaces as, and that
-     * one IS retried under a fresh use number rather than thrown.
+     * the stream silently): the local write queue serializes the two writes, so the loser's
+     * seat check reads the winner's committed row against the cap and is refused as a named
+     * `InvitationExhaustedError`. A CROSS-node race is not a collision to retry at all — each
+     * redemption writes under its own `UsageStampId`, both rows land and survive convergence,
+     * and the cap can over-admit by the number of concurrent redeemers. That over-admission is
+     * the accepted trade (visible in the append-only record, reversible by owner-gated
+     * removal), chosen over a fought-over shared key whose failure mode was the silent loss of
+     * a consented join.
      */
     async provisionAndRecord(params) {
         const { token, peerKey, peerSignature, usageStampId, disclosure, signal } = params;

package/dist/control-formation-recorder.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"control-formation-recorder.js","sourceRoot":"","sources":["../src/control-formation-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,6BAA6B;IAGxC;;;;;OAKG;IACH,YACmB,eAAgC,EACjD,OAA0C;QADzB,oBAAe,GAAf,eAAe,CAAiB;QAGjD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpE,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa;gBACtF,SAAS,EAAE,EAAE;aACd;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB;QAC5B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,cAAc,CAC1B,OAA2F,EAC3F,MAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAC7C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAA6B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAsB,CAC9B,WAAW,EACX,kEAAkE,MAAM,CAAC,KAAK,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1F,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,WAAW,CACvB,OAAiC,EACjC,MAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,MAQjB;QACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC7F,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,yEAAyE;QACzE,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAED~~;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG~~;IACH,KAAK,CAAC,kBAAkB,CAAC,MAQxB;QACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACnF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,WAAW,CAAC,GAAG,EAAE,KAAK,CAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YAC1C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,2DAA2D,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}
1	+ {"version":3,"file":"control-formation-recorder.js","sourceRoot":"","sources":["../src/control-formation-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAwB,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AAIjC,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,OAAO,6BAA6B;IAGxC;;;;;OAKG;IACH,YACmB,eAAgC,EACjD,OAA0C;QADzB,oBAAe,GAAf,eAAe,CAAiB;QAGjD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,2BAA2B,EAAE,CAAC;IACrE,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpE,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa;gBACtF,SAAS,EAAE,EAAE;aACd;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB;QAC5B,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,6BAA6B,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,cAAc,CAC1B,OAA2F,EAC3F,MAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QAC7C,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAA6B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,sBAAsB,CAC9B,WAAW,EACX,kEAAkE,MAAM,CAAC,KAAK,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1F,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,WAAW,CACvB,OAAiC,EACjC,MAAoB;QAEpB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,MAQjB;QACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC7F,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,yEAAyE;QACzE,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC9C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAQxB;QACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QACnF,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,WAAW,CAAC,GAAG,EAAE,KAAK,CAAW,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;YACzC,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU;YAClD,aAAa,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI;SAC7C,EAAE,MAAM,CAAC,CAAC;QACX,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YAC1C,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM;YACzE,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,QAAQ;SAClD,CAAC,CAAC;QACH,GAAG,CAAC,2DAA2D,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/control-schema.d.ts CHANGED Viewed

@@ -9,4 +9,4 @@
  * build if they drift. Any edit here must be mirrored in `schemas/control.qsql`
  * and vice versa.
  */
-export declare const CONTROL_SCHEMA = "-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)\ndeclare schema CadreControl {\n    -- A key that can authorize various control changes\n    table OwnerKey (\n        Key text primary key,\n        StampId text not null unique,   -- per-row authorization nonce, bound into the signed digests below.\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below), so the never-expiring\n                                        -- enrollment signature cannot resurrect a removed owner.\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- removal. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A\n        -- legitimate re-add mints a FRESH StampId and a fresh signature, so it is unaffected.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- A party must never lose its last owner key: every other CadreControl table's\n        -- CHECK requires an OwnerKey row, so an owner-less control database can never\n        -- authorize anything again \u2014 emptying this table is a permanent denial of the\n        -- party's control plane. Deferred (subquery), so the count is the POST-delete count.\n        -- NOTE: this is a per-transaction check against locally visible rows. Two\n        -- partitioned nodes that concurrently remove different owners can each see a\n        -- survivor and still converge to zero; if partitioned rotation ever becomes a real\n        -- workflow, the floor needs a cross-node guard, not a local count.\n        constraint MinOneOwner check on delete (\n            (select count(1) from OwnerKey) >= 1\n        ),\n        -- Enrollment is insert + delete only; rotation is add-then-remove. No writer\n        -- updates an OwnerKey row, and a self-rotation branch would double as a sole-owner\n        -- takeover: a deferred post-image count is also true of an update that re-points\n        -- the only row at an attacker key. Mirrors Strand.Manager.NoUpdate.\n        constraint NoUpdate check on update (false),\n        -- NOTE: the domain tag scopes an approval to a table and an action, not to a PARTY. Two\n        -- parties that share an owner key would accept each other's approvals. Fine today (each\n        -- party has its own owner key); if shared-owner multi-party ever ships, bind a party\n        -- identity row into these digests.\n        constraint Authorized check on insert, delete (\n            -- Every authorizer is read from the PRE-transaction snapshot (committed.*):\n            -- this CHECK auto-defers to commit (it has a subquery), by which point the row\n            -- being inserted \u2014 and any sibling inserted alongside it \u2014 is live, so a plain\n            -- from-OwnerKey would let a row authorize itself, or two strangers seat each\n            -- other. committed.* excludes both, stating the rule directly: the authorizer\n            -- must have existed BEFORE this transaction.\n\n            -- Every signed digest below (and in every other CadreControl table) leads with two\n            -- fixed literals \u2014 a 'CadreControl.<Table>' domain tag and an 'add'/'remove'/\n            -- 'vouch'/'publish' action tag (cadre-core control-authorization.ts) \u2014 so an\n            -- approval verifies ONLY against the one rule it was minted for. Without them,\n            -- e.g. a ValidationKey enrollment approval covered the identical bytes as an\n            -- OwnerKey enrollment: a narrow grant that doubled as full ownership.\n\n            -- Bootstrap: the FOUNDING transaction \u2014 one whose pre-transaction owner set is\n            -- empty \u2014 needs no authorization, and every row it inserts rides this branch\n            -- (whoever writes it already owns the party outright, so a co-founder row grants\n            -- nothing a single row would not). Gated on the PRE-transaction count, so a\n            -- same-transaction swap of the sole owner (delete the founder, insert the\n            -- attacker \u2014 post-image count still 1) cannot ride it.\n            (old.Key is null and (select count(1) from committed.OwnerKey) = 0)\n\n                -- or a pre-existing owner authorizes by signing over THIS row (Key, StampId)\n                or (old.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.OwnerKey', 'add', new.Key, new.StampId), context.Signature, A.Key, 'ed25519')))\n\n                -- or a removal authorized by ANOTHER pre-existing owner over the DISTINCT\n                -- 'remove'-tagged digest bound to the stored row's StampId, so an enrollment\n                -- signature can never be replayed as a removal (cf. CadrePeer.AuthorizedDelete).\n                -- A.Key <> old.Key: an owner cannot sign its own removal (no self-resignation).\n                or (new.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and A.Key <> old.Key and verify(digest('CadreControl.OwnerKey', 'remove', old.Key, old.StampId), context.Signature, A.Key, 'ed25519')))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure\n    table ValidationKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay).\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below), so the never-expiring\n                                        -- enrollment signature cannot resurrect a removed key.\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert naming\n        -- a retired stamp: the approval that seated this row can never re-seat it after removal.\n        -- Same rationale as OwnerKey.NotRevoked, stated in full there.\n        -- NOTE: this table gained a consumer \u2014 FormationUsage.Authorized reads it to gate redemption of\n        -- a ValidationUrl invite \u2014 so the convergence gap noted on Strand.StampId now has teeth here: on\n        -- a node that has not yet seen the tombstone, a replayed enrollment re-seats the key and it can\n        -- approve redemptions there until the Revocation row arrives. Still no per-request READ surface to\n        -- filter (the gate is a write-time CHECK), so there is nothing to add today; if one appears, filter\n        -- retired stamps there.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- Enrollment is insert + delete only; rotation is add-then-remove. No writer in the repo\n        -- updates a ValidationKey row. Required because the AuthorizedInsert / AuthorizedDelete\n        -- pair below covers neither update \u2014 and a bare `check`, which is what this rule used to\n        -- be, covers insert+update but NOT delete. Mirrors OwnerKey.NoUpdate.\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.ValidationKey', 'add', new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound to\n            -- the STORED row (Key, StampId), so an enrollment approval \u2014 which never expires \u2014 can\n            -- never be replayed as a removal. Same shape as CadrePeer.AuthorizedDelete.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.ValidationKey', 'remove', old.Key, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: a COMMITTED tombstone already retires this exact row incarnation, so a node\n                -- that was offline at removal time may delete the stale row locally with no owner key.\n                -- Why committed.* and why the stamp must be bound: stated in full on\n                -- CadrePeer.AuthorizedDelete.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'ValidationKey' and R.RowKey = old.Key and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort\n    -- Cadre peers should participate in each of these strands\n    table Strand (\n        Id text primary key,    -- UUID\n        MemberPrivateKey text null unique,   -- Our private key as a member of this strand\n        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay).\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below).\n        -- NOTE: NotRevoked is a per-transaction check against LOCALLY VISIBLE rows, so a node that\n        -- has not yet converged on the Revocation row can still accept a replayed add and end up\n        -- holding the resurrected strand alongside its tombstone. CadrePeer has a read-side\n        -- mitigation for this class (CadreNode.listAuthorizedMembers drops rows whose stamp is\n        -- retired); Strand and ValidationKey deliberately do NOT, because neither has a\n        -- per-request authorization surface today. If one ever gains one, filter it there.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey. That is what makes\n        -- the consent branch of AuthorizedInsert below trustworthy: a removal cannot file a\n        -- tombstone that omits or misnames the id it retires.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        -- Strand rows are insert + delete only. Required: the consent branch of AuthorizedInsert\n        -- below authorizes by the EXISTENCE of a FormationUsage row naming (new.Id, new.StampId)\n        -- and carries no signature, so while this rule was a bare `check` (insert+update) it also\n        -- said \"anyone may REWRITE any consent-formed strand, unsigned\" \u2014 flipping Type to 'o' and\n        -- nulling MemberPrivateKey destroys the party's own membership key for that network in place.\n        -- Mirrors OwnerKey.NoUpdate / FormationInvite.Immutable.\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Strand', 'add', new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or authorized WITHOUT a signature by a redemption record naming THIS EXACT ROW: a\n                -- FormationUsage row carrying both this strand's Id and its one-off StampId\n                -- (control-database.ts:redeemInvitation writes the pair in one transaction; both\n                -- CHECKs defer, so each sees the other's row at commit).\n                --\n                -- Matching the STAMP, not the id alone, is what makes a removal stick. FormationUsage\n                -- is append-only, so a redemption record outlives the strand it formed forever; keyed\n                -- on the id alone it re-authorized ANY later insert of that id, so after a legitimate\n                -- owner-signed, tombstoned removal any writer could re-seat the strand unsigned with a\n                -- fresh StampId (sidestepping NotRevoked, which retires only the removed row's stamp)\n                -- and an ATTACKER-CHOSEN MemberPrivateKey \u2014 the party's own secret for that network.\n                -- Bound to the stamp, the removal retires that stamp into Revocation and NotRevoked\n                -- closes this consent record's branch permanently.\n                --\n                -- Beyond the stamp match, the branch is deliberately NARROW \u2014 each clause closes one door:\n                --   * Type = 'o' / MemberPrivateKey null \u2014 a consent-seated strand looks exactly like\n                --     what the unbound redemption path writes (open, keyless). A closed strand carrying\n                --     a caller-chosen member key (the party's own read-gating secret for that network)\n                --     has no legitimate producer. MemberKeyClosedOnly already implies the second clause\n                --     from the first today; both are stated so this rule does not silently depend on\n                --     another constraint staying as it is.\n                --   * the inner FI.StrandId is null \u2014 only an UNBOUND invite may seat a strand at all.\n                --     A bound invite's host strand is owner-provisioned up front; letting the invite\n                --     consent-seat that id would allow an open, keyless downgrade of the real (possibly\n                --     closed, key-bearing) host row on a node where it has not converged yet. The bound\n                --     path records usage only (resolveStrand reports an absent host as missing and the\n                --     formation manager rejects cleanly).\n                --   * the not-exists over OTHER stamps \u2014 a strand id may be consent-seated once, EVER.\n                --     FormationUsage is append-only, so the first redemption's record survives a later\n                --     owner-signed removal and permanently forecloses a second consent-seating of the\n                --     id (a spare use of the same token minted a new stamp and rode this branch to\n                --     re-seat the id with an attacker-chosen row). Re-joining a removed id is\n                --     owner-gated: the owner re-seats it signed (fresh stamp, fresh signature) and\n                --     issues a BOUND invite the returning party records consent against \u2014 the id is\n                --     not blacklisted, only its unsigned re-seat is. This cannot be weaponised to\n                --     pre-block a legitimate id: StrandExists refuses a usage row naming a strand that\n                --     does not exist, so no usage row can be pre-planted for an unseated id \u2014 and ids\n                --     are 128 random bytes anyway.\n                --   * the not-exists over Revocation \u2014 a strand id may be consent-seated once EVER\n                --     and never after ANY removal of that id, however it was seated. The usage-row\n                --     rule above binds only ids that ever carried a consent record; an id seated\n                --     purely owner-signed (insertStrand, no usage row) leaves nothing behind on\n                --     removal, so its removal needs its own trace. Every removal files a Revocation\n                --     row naming the removed row's key (RowKey), and this clause refuses any id\n                --     that has ever been tombstoned. RevocationRecorded above makes that trace\n                --     mandatory AND correctly named, so no removal can slip past this clause. The\n                --     usage-row clause is arguably subsumed by this one (a usage row implies the\n                --     strand row existed, and its removal must file a tombstone), but it reaches\n                --     the same conclusion without depending on Revocation at all; both are stated,\n                --     per the style note above. The owner-signed branch is deliberately unaffected,\n                --     so re-join stays owner-gated exactly as described.\n                --     What is NOT schema-verified is a STANDALONE tombstone (one with no\n                --     accompanying delete \u2014 see Revocation.Authorized): an owner can file one\n                --     naming an id that never existed and thereby permanently foreclose\n                --     consent-seating of that id \u2014 owner-only, the owner already controls invite\n                --     issuance, and unbound ids are 128 random bytes minted at redemption, so no\n                --     escalation (same reasoning as the pre-plant note above).\n                --     NOTE: like NotRevoked above, this is a write-time check against LOCALLY\n                --     VISIBLE rows \u2014 a node that has not yet converged on the Revocation row still\n                --     accepts the re-seat. Fails in the safe direction: the tombstone wins after\n                --     merge for the STAMP, and the resurrected row coexists with it (same class as\n                --     the StampId note above).\n                or (\n                    new.Type = 'o'\n                    and new.MemberPrivateKey is null\n                    and exists (\n                        select 1 from FormationUsage FU\n                            where FU.StrandId = new.Id\n                                and FU.StrandStampId = new.StampId\n                                and exists (select 1 from FormationInvite FI where FI.Token = FU.Token and FI.StrandId is null)\n                    )\n                    and not exists (\n                        select 1 from FormationUsage FU2\n                            where FU2.StrandId = new.Id and FU2.StrandStampId <> new.StampId\n                    )\n                    and not exists (\n                        select 1 from Revocation R\n                            where R.TableName = 'Strand' and R.RowKey = new.Id\n                    )\n                )\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound to\n            -- the STORED row (Id, StampId), so the add approval \u2014 which never expires \u2014 can never be\n            -- replayed as a removal. Note the consent branch above is deliberately NOT mirrored\n            -- here: an invitation authorizes forming a strand, never destroying one.\n            --\n            -- DELIBERATELY no REAP branch (cf. CadrePeer.AuthorizedDelete): this row carries\n            -- MemberPrivateKey \u2014 the party's own membership secret for that network, stored nowhere\n            -- else \u2014 so this is the one guarded delete whose effect is unrecoverable, and a stale\n            -- row is already inert for the purpose a tombstone serves (the consent branch of\n            -- AuthorizedInsert above refuses any id ever tombstoned). Do not \"fix\" the asymmetry;\n            -- tickets/backlog/debt-strand-tombstone-reap.md owns any future change.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Strand', 'remove', old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint MemberKeyClosedOnly check (\n            -- An open strand ('o') has no membership gate, so it must not carry a\n            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A peer (node) that is part of the cadre, carrying a self-published,\n    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).\n    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against\n    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)\n        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published\n        StampId text not null unique,    -- per-row authorization nonce, bound into the voucher/remove digests; rotates on\n                                         -- (re)insert. A removed row's stamp is retired permanently into Revocation\n                                         -- (NotRevoked below), so a captured admission approval cannot re-seat a removed peer.\n        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)\n        VouchSig text null,              -- that owner's signature over the 'vouch'-tagged digest below (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership. The domain/action tags keep this STORED, REPLICATED signature useless against every other rule (pre-tag it satisfied OwnerKey/ValidationKey inserts for Key = PeerId).\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- removal. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A\n        -- legitimate re-add mints a FRESH StampId and a fresh signature, so it is unaffected.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key, which vouches both membership and the\n            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).\n            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),\n            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest. The same\n            -- 'vouch'-tagged digest is DELIBERATELY shared with the owner branch of\n            -- AuthorizedUpdate below: both mean \"this owner vouches this membership row\".\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'vouch', new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n            -- Persist the vouching (owner, signature) onto the row so a reader can later\n            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal\n            -- the pair the verify above validated, so a writer cannot store a voucher it did\n            -- not actually receive a signature for.\n            and new.VouchOwner = context.OwnerKey\n            and new.VouchSig = context.Signature\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound\n            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so\n            -- the stored voucher (a signature over the 'vouch'-tagged digest) can NEVER be\n            -- replayed to authorize a delete. The remove signature rides in context and is never stored.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'remove', old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: this node already holds a COMMITTED tombstone retiring THIS EXACT row\n                -- incarnation, so the party owner has already authorized this row's removal and this\n                -- node is merely catching up. That is what lets a node which was offline at\n                -- revocation time delete the stale row locally, with no owner private key\n                -- (control-database.ts:reapRevokedRow). Same shape as the consent branch of\n                -- Strand.AuthorizedInsert: authorization by the EXISTENCE of a row rather than by a\n                -- signature \u2014 and that row is itself owner-signed (Revocation.Authorized), so this\n                -- widens WHO may execute a removal, never WHO may decide one. RevocationRecorded is\n                -- satisfied by the same committed tombstone, so a reap files no second one.\n                --\n                -- committed.Revocation, NOT Revocation \u2014 and the stamp clause \u2014 are both load-bearing:\n                --   * committed.* : this CHECK defers to commit (it has a subquery), by which point a\n                --     tombstone written in the SAME transaction is live. Reading plain Revocation\n                --     would therefore let deleteGuardedRow's own sibling tombstone satisfy this\n                --     branch, making the 'remove'-tagged delete signature above dead weight and\n                --     collapsing two domain-separated approvals into one. committed.* states the rule\n                --     exactly: the tombstone must have existed BEFORE this transaction.\n                --   * R.StampId = old.StampId : binds the ROW INCARNATION, not the name. One name may\n                --     legitimately carry several tombstones over its life (seat -> delete -> owner\n                --     re-seat -> delete). Without this clause a tombstone from a PREVIOUS incarnation\n                --     would authorize deleting the CURRENT row, which the owner never removed.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key\n            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on\n            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified\n            -- against the stored PublicKey over the same payload the publish path signs\n            -- (cadre-core peer-record.ts:peerRecordSignedPayload).\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and new.VouchSig = old.VouchSig\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest('CadreControl.CadrePeer', 'publish', new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                -- or an owner re-authorizes (rotation / correction): re-vouches the row over\n                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.\n                -- StampId is immutable here too: an update that rotated it would leave the OLD\n                -- stamp live-free and untombstoned (RevocationRecorded only retires the stamp a\n                -- delete carries), so the original admission approval \u2014 which is stored on the\n                -- replicated row as VouchSig \u2014 would resurrect the peer after a later removal.\n                -- Retiring a stamp is delete + Revocation row, never an update.\n                or (\n                    new.StampId = old.StampId\n                    and exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'vouch', new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and new.VouchOwner = context.OwnerKey\n                    and new.VouchSig = context.Signature\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a\n    -- server peer can deliver a push-wake to a suspended app over the platform push\n    -- channel (a control-network dial cannot reach an OS-suspended process). The row\n    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for\n    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then\n    -- hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,        -- the CadrePeer this token belongs to\n        Platform text not null,         -- 'fcm' | 'apns'\n        Token text not null,            -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)\n        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)\n        StampId text not null unique,    -- single-use authorization nonce, bound into the add/remove digests;\n                                         -- rotates on (re)insert. A cleared token's stamp is retired permanently\n                                         -- into Revocation (NotRevoked below), so the approval that published a\n                                         -- token cannot re-seat it after the owner cleared it (logout).\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- the clear. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A legitimate\n        -- re-register mints a FRESH StampId and a fresh signature, so it is unaffected. This\n        -- matters more here than the stored-approval case (CadrePeer.VouchSig): a resurrected\n        -- push token has NO freshness ceiling to retire it \u2014 cadre-node.ts:resolveDeviceToken\n        -- defaults maxAgeMs to infinity by design \u2014 so retirement is the only thing that sticks.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.\n            -- The digest binds the WHOLE row behind the domain/action tags \u2014 every column,\n            -- with the nullable UpdatedAt/Sig signing as '' when absent (the shape\n            -- FormationInvite and Strand already use) \u2014 so a replayed approval can only ever\n            -- reproduce the row it approved, never one carrying attacker-chosen\n            -- Platform/Token/UpdatedAt; NotRevoked above then refuses even that exact row\n            -- once it has been cleared. The DISTINCT 'remove'-tagged digest below keeps a\n            -- captured insert approval from doubling as a delete (and vice versa).\n            -- Mirrors cadre-core peer-authorization.ts:deviceTokenAddDigest.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.DeviceToken', 'add',\n                    new.PeerId,\n                    new.Platform,\n                    new.Token,\n                    coalesce(cast(new.UpdatedAt as text), ''),\n                    coalesce(new.Sig, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Bound to the STORED row's (PeerId, StampId) \u2014 cadre-core\n            -- peer-authorization.ts:deviceTokenRemoveDigest \u2014 so the never-expiring insert\n            -- approval can never be replayed as a clear, and a captured clear approval is\n            -- dead once the stamp it names is retired.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.DeviceToken', 'remove', old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: a COMMITTED tombstone already retires this exact row incarnation, so a node\n                -- that was offline at removal time may delete the stale row locally with no owner key.\n                -- Why committed.* and why the stamp must be bound: stated in full on\n                -- CadrePeer.AuthorizedDelete.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'DeviceToken' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key\n            -- behind PeerId). PeerId and StampId are immutable, UpdatedAt must strictly\n            -- increase (replay guard), and Sig is verified against the stored\n            -- CadrePeer.PublicKey over the signed payload (cadre-core\n            -- device-token.ts:deviceTokenSignedPayload). Platform and Token may change on\n            -- self-update (platform switch / reinstall / rotation).\n            -- StampId is immutable for the reason CadrePeer spells out: an update that\n            -- rotated it would leave the OLD stamp live-free and untombstoned, so retiring a\n            -- stamp stays delete + Revocation row, never an update.\n            -- This is the ONLY branch: there is deliberately NO owner re-touch. The branch\n            -- that used to sit beside it verified an owner signature over the peer id alone\n            -- and sat OUTSIDE the monotonicity requirement, so one captured owner approval\n            -- rewrote Platform/Token and rolled UpdatedAt BACKWARDS \u2014 and seating a\n            -- far-future UpdatedAt wedged the peer's own self-updates permanently. No writer\n            -- used it. An owner that must correct a row deletes it (retiring the stamp) and\n            -- inserts a fresh one, the same path it already takes for CadrePeer.\n            new.PeerId = old.PeerId\n            and new.StampId = old.StampId\n            and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n            and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                    digest('CadreControl.DeviceToken', 'publish', new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text)),\n                    new.Sig, P.PublicKey, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party\n    table FormationInvite (\n        Token text primary key, -- Just a random string\n        sAppId text, -- The app for the strand that will be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,   -- Web hook - send disclosure, IP address...\n        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner signing over THIS row\n            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.\n            -- Nullable bound fields (ExpiresAt/TotalUses/ValidationUrl/StrandId) sign as '' when absent.\n            -- The 'remove'-tagged AuthorizedDelete digest below is DISTINCT, so a captured\n            -- insert approval can never be replayed to revoke-then-reissue an invite (or vice versa).\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'add',\n                    new.Token,\n                    new.sAppId,\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    coalesce(new.ValidationUrl, ''),\n                    coalesce(new.StrandId, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'remove',\n                    old.Token,\n                    old.sAppId,\n                    coalesce(cast(old.ExpiresAt as text), ''),\n                    coalesce(cast(old.TotalUses as text), ''),\n                    coalesce(old.ValidationUrl, ''),\n                    coalesce(old.StrandId, ''),\n                    old.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Invites are insert/delete only: forbid in-place mutation so the row-bound\n        -- AuthorizedInsert signature cannot be sidestepped by updating consent\n        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check\n        -- defaults to insert+update; the checks on insert / on delete above exclude update,\n        -- so this guard is required. Mirrors FormationUsage.InsertOnly.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    table FormationUsage (\n        Token text,\n        UseNumber int,\n        UsageStampId text not null unique,  -- single-use nonce for THIS redemption. The JOINING peer mints it and\n                                        -- sends it in its contact message, having signed it into its own 'consent'\n                                        -- digest (PeerConsented below); the responder inserts that same value and\n                                        -- asks the approver about it, so it is bound into the 'vouch' digest below\n                                        -- too and one sign-off is spendable exactly once. Neither side can swap it:\n                                        -- a substituted nonce fails the joiner's consent signature.\n                                        -- Unlike every other StampId in this schema, this table is append-only\n                                        -- (InsertOnly below), so the nonce is never freed by a delete: `unique`\n                                        -- alone makes it permanent and there is deliberately NO NotRevoked /\n                                        -- RevocationRecorded pair here \u2014 do not go looking for the missing one.\n                                        -- NOTE: `unique` is evaluated against LOCALLY VISIBLE rows, so two nodes\n                                        -- that have not yet converged could each admit the same nonce and both\n                                        -- rows survive the merge. Same class as the NotRevoked convergence notes\n                                        -- on OwnerKey / Strand / ValidationKey; the digest binding still holds on\n                                        -- both nodes, so the outcome is a duplicated audit row, never a join\n                                        -- nobody approved.\n        PeerKey text not null,          -- the joining peer's own ed25519 public key (base64url, 32 bytes), bound\n                                        -- into BOTH the approver's 'vouch' digest and the joiner's 'consent'\n                                        -- digest below, so an approval cannot be re-filed under a different\n                                        -- joiner's name and the named joiner provably agreed (PeerConsented).\n                                        -- The key IS the joiner's identity \u2014 its libp2p peer id is derivable\n                                        -- (identity multihash of these bytes), never stored here.\n        PeerSig text not null,          -- the joining peer's signature over the 'consent' digest \u2014 see\n                                        -- PeerConsented below for what it proves and why it is stored on the row.\n        Disclosure text,\n        StrandId text,\n        StrandStampId text not null,   -- the Strand.StampId this consent record authorizes. Consent is\n                                       -- bound to ONE strand ROW, not to a strand id forever \u2014 see\n                                       -- Strand.AuthorizedInsert's consent branch for why. NOT unique:\n                                       -- in the bound (provision-then-record) path several invitees\n                                       -- each write a usage row against the SAME host strand, so many\n                                       -- usage rows legitimately share one stamp.\n        primary key (Token, UseNumber),\n        constraint InsertOnly check on update, delete (false),\n        constraint Monotonic check (\n            -- Read the PRE-transaction snapshot (committed.*): this CHECK auto-defers\n            -- to commit (it has a subquery), by which point the row being inserted is\n            -- live, so a plain from-FormationUsage would count this row itself and make\n            -- UseNumber = max+1 unsatisfiable. committed.* excludes the in-flight row,\n            -- giving sequential 1,2,3... per token (cross-transaction; concurrent\n            -- redemptions of the same token collide on the (Token, UseNumber) PK).\n            -- ControlDatabase's use-number retry (withUseNumberRetry) is what resolves\n            -- that collision, by re-presenting the same approval under a fresh use\n            -- number. The deferred check above is the other surface the same race can\n            -- take: a concurrent row the inserting transaction's key probe did not yet\n            -- see trips this Monotonic CHECK at commit instead of the PK.\n            new.UseNumber = coalesce((select max(UseNumber) from committed.FormationUsage U where U.Token = new.Token), 0) + 1\n        ),\n        constraint Authorized check on insert (\n            -- Satisfies an invitation\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses >= new.UseNumber)\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        -- An invite carrying a ValidationUrl demands a sign-off from a key the party\n                        -- ENROLLED in ValidationKey. The signature is verified against the STORED VK.Key,\n                        -- NOT against context.ValidationKey \u2014 that distinction is the whole point:\n                        -- context.ValidationKey is a plain insert parameter, so verifying against it asked\n                        -- only \"did the redeemer sign its own disclosure with SOME key it holds?\", which any\n                        -- redeemer answers by minting a throwaway keypair. context.ValidationKey survives\n                        -- purely to SELECT which enrolled row is being claimed; naming an enrolled key while\n                        -- signing with a different one fails the verify against VK.Key.\n                        --\n                        -- Deliberate: CHECKs run on write only, so removing a validation key later does NOT\n                        -- re-examine the FormationUsage rows it already approved. The sign-off was valid when\n                        -- given and the strand it authorized stays formed; removal narrows who may approve\n                        -- FUTURE redemptions, it is not a retroactive revocation of past ones.\n                        --\n                        -- What ONE sign-off buys: exactly ONE row. The digest covers\n                        -- (Token, UsageStampId, StrandId, PeerKey, Disclosure), so an approval is NOT\n                        -- transferable across invitations, redemptions, networks, joiners, or disclosure\n                        -- text. Replay is closed twice over, by two independent mechanisms: presenting an\n                        -- approval VERBATIM repeats its UsageStampId and is refused by that column's\n                        -- `unique`; presenting it under any OTHER redemption changes a signed field and\n                        -- fails this verify.\n                        -- Why a fresh nonce rather than binding UseNumber: UseNumber is derived from the\n                        -- table's current state (max+1, see Monotonic), so binding it would make the\n                        -- approver sign a value a concurrent redemption can invalidate \u2014 the loser of the\n                        -- race would need a SECOND approval for the same joiner (for a manual review\n                        -- queue, a second human review). A nonce chosen freely by the redeeming node is\n                        -- just as single-use and lets the loser retry the same approval under a new use\n                        -- number.\n                        -- Why StrandStampId is deliberately NOT bound: it names the strand ROW\n                        -- incarnation, which the unbound path (redeemInvitation) mints inside its own\n                        -- transaction, and it adds nothing on top of a strictly single-use approval \u2014\n                        -- StrandId already pins WHICH network the approver approved joining.\n                        and (FI.ValidationUrl is null or exists (\n                            select 1 from ValidationKey VK\n                                where VK.Key = context.ValidationKey\n                                    and verify(digest('CadreControl.FormationUsage', 'vouch', new.Token, new.UsageStampId, new.StrandId, new.PeerKey, new.Disclosure), context.ValidationSignature, VK.Key, 'ed25519')))\n                        -- A bound invite (non-null StrandId) may only ever name its own host strand:\n                        -- without this, any holder of a bound token could record consent against an\n                        -- arbitrary strand id \u2014 annotating an unrelated strand, or (before\n                        -- Strand.AuthorizedInsert's consent branch was narrowed to unbound invites)\n                        -- consent-seating that id outright.\n                        -- NOTE: an UNBOUND invite is deliberately left free to name any strand, so a\n                        -- holder can spend a use appending a consent row to an unrelated existing\n                        -- strand. Harmless today (the row grants nothing, it only burns a use and\n                        -- forecloses that id's consent-seating, which is the safe direction); if\n                        -- unlimited-TotalUses invites ever become common, this is an append-only\n                        -- growth surface worth bounding.\n                        and (FI.StrandId is null or FI.StrandId = new.StrandId)\n            )\n        ),\n        -- Matched on the (id, stamp) PAIR, the same key Strand.AuthorizedInsert's consent branch\n        -- reads back: a usage row may only ever name a strand ROW that exists, so a consent record\n        -- can never be filed against a stamp of the writer's choosing and held in reserve to\n        -- re-seat the id after a removal.\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId and S.StampId = new.StrandStampId)),\n        -- The JOINING peer proves it consented to this redemption: PeerKey is its own ed25519\n        -- public key and PeerSig is its signature over the 'consent'-tagged digest below.\n        -- Unlike the approver's sign-off (context.ValidationSignature, checked against a STORED\n        -- ValidationKey row), the identity here IS the key, so there is no enrolled row to look\n        -- up and nothing for a writer to substitute: a forged joiner would need that joiner's\n        -- private key. Stored rather than passed in context so any later reader can re-check it\n        -- (verifyFormationConsent); the 'consent' action tag keeps this replicated signature\n        -- useless against every other rule in this schema (notably the approver's 'vouch'\n        -- digest over the same table).\n        -- NOTE: StrandId is deliberately NOT in this digest \u2014 the joiner cannot know it when it\n        -- signs (a bound invite's host strand arrives only in the result frame; an unbound\n        -- strand is responder-minted). The responder cannot substitute a strand anyway: bound\n        -- invites are pinned by Authorized's FI.StrandId check, unbound invites mint fresh.\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.FormationUsage', 'consent',\n                          new.Token, new.UsageStampId, new.PeerKey, new.Disclosure),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        ),\n    -- Context here is only what the approver-side rules read: Now for expiry, and the\n    -- ValidationKey/ValidationSignature pair for the 'vouch' check in Authorized. The joiner's\n    -- signature is NOT context \u2014 it lives on the row (PeerSig, verified by PeerConsented above).\n    ) with context (Now datetime, ValidationKey text null, ValidationSignature text null);\n\n    -- Append-only retirement record for the one-off StampId nonces of removed OwnerKey /\n    -- CadrePeer / ValidationKey / Strand rows. Without it a removal was undoable: the add\n    -- approval is a signature over\n    -- (row key, stamp) that never expires, and deleting the row freed the stamp, so anyone who\n    -- kept a copy of the approval could resurrect the row.\n    -- Each tombstone also records WHICH row was retired (RowKey below): the consent branch of\n    -- Strand.AuthorizedInsert reads it to refuse consent-seating any strand id that has ever\n    -- been removed, whichever way it was seated.\n    -- NOTE: the guarded tables' NotRevoked CHECK runs against locally visible rows, so a node\n    -- that has not yet converged on a Revocation row can still accept the replayed add, and the\n    -- resurrected row coexists with the tombstone after merge \u2014 same class as the MinOneOwner\n    -- note on OwnerKey. The read-side mitigation is ControlDatabase.queryCadrePeers, which\n    -- drops any CadrePeer row whose StampId appears here; every membership reader inherits it.\n    -- NOTE: append-only, so this table only ever grows. Every append is owner-signed\n    -- (Authorized below), so the growth surface is the owner keys, not every writer that can\n    -- reach the control database. Cadres are a handful of peers and owner rotation is rare, so\n    -- unbounded growth is fine today; revisit if either changes.\n    -- A tombstone committed while the node was alone is local-only (never broadcast); the\n    -- ReissuedAt counter below exists so an owner can re-write \u2014 and therefore re-broadcast \u2014\n    -- such a tombstone once peers are reachable, without changing what it means.\n    table Revocation (\n        TableName text,             -- 'OwnerKey' | 'CadrePeer' | 'ValidationKey' | 'Strand' | 'DeviceToken' (confined by RowIsGone below)\n        RowKey text not null,       -- primary key of the removed row: OwnerKey.Key / ValidationKey.Key /\n                                    -- CadrePeer.PeerId / DeviceToken.PeerId / Strand.Id\n                                    -- Every guarded table's RevocationRecorded CHECK requires the\n                                    -- accompanying tombstone to carry the removed row's key here, so\n                                    -- a REMOVAL cannot file a misnamed tombstone. A tombstone with no\n                                    -- accompanying delete is not covered by that (see Authorized).\n        StampId text,               -- the retired nonce\n        -- Bumped by an owner-signed re-issue so a tombstone written while the node was alone\n        -- (committed local-only, never broadcast) can be re-written and therefore re-broadcast\n        -- on cohort growth. Carries NO semantics: nothing reads it, and retirement is decided\n        -- by the row's existence, not by this value.\n        ReissuedAt integer not null default 0,\n        -- Keyed on the stamp, not the RowKey: stamps are unique per row incarnation, and one\n        -- name may legitimately carry several tombstones over its life (seat -> delete ->\n        -- owner re-seat -> delete).\n        primary key (TableName, StampId),\n        -- Retirement is permanent: a tombstone may never be withdrawn.\n        constraint NoDelete check on delete (false),\n        -- Pinned at 0 on insert so an owner cannot seat a tombstone at a saturated counter and\n        -- thereby freeze its own later re-issues (ReissueOnly below). Deliberately NOT folded\n        -- into the Authorized digest: the value is fixed by this rule, so signing over it would\n        -- only widen the signed surface for no gain, and would invalidate every existing\n        -- insert-side digest.\n        constraint FreshTombstone check on insert (new.ReissuedAt = 0),\n        -- A re-issue may move NOTHING but the counter, and only upward. Without the identity\n        -- clause an \"update\" would be a way to re-point a tombstone at a different row,\n        -- restoring exactly the replay this table exists to stop.\n        constraint ReissueOnly check on update (\n            new.TableName = old.TableName and new.RowKey = old.RowKey\n                and new.StampId = old.StampId and new.ReissuedAt > old.ReissuedAt\n        ),\n        -- A stamp may only be retired once its row is actually gone. Deferred (subquery), so a\n        -- delete in the same transaction has already landed. Retiring a stamp that never\n        -- existed is permitted and harmless: a stamp carries 128 bits of CSPRNG output\n        -- (control-database.ts:generateStampId \u2014 16 bytes of sha256(PeerId) followed by 16\n        -- random bytes), so a future legitimate one cannot be guessed and pre-planted.\n        -- Deliberately keyed on the STAMP only, not RowKey: checking \"no live row named\n        -- new.RowKey\" breaks under out-of-order convergence \u2014 a peer removed (tombstone names\n        -- it, stamp1) then re-admitted (stamp2) would leave a node that converges on the\n        -- re-add FIRST rejecting the stamp1 tombstone forever, never learning that stamp is\n        -- retired. The stamp-only form passes there (stamp1 is not live).\n        constraint RowIsGone check on insert (\n            (new.TableName = 'OwnerKey' and not exists (select 1 from OwnerKey K where K.StampId = new.StampId))\n                or (new.TableName = 'CadrePeer' and not exists (select 1 from CadrePeer P where P.StampId = new.StampId))\n                or (new.TableName = 'ValidationKey' and not exists (select 1 from ValidationKey V where V.StampId = new.StampId))\n                or (new.TableName = 'Strand' and not exists (select 1 from Strand S where S.StampId = new.StampId))\n                or (new.TableName = 'DeviceToken' and not exists (select 1 from DeviceToken D where D.StampId = new.StampId))\n        ),\n        -- Appending a tombstone is an OWNER action, like every other write in this schema.\n        -- Ungated, any writer that could reach the control database could retire a stamp:\n        -- filing one against a CadrePeer row not visible locally (RowIsGone reads LOCALLY\n        -- VISIBLE rows \u2014 see the convergence note above) evicted that peer party-wide AND\n        -- permanently blocked the owner's own later re-admission of it (NotRevoked), and\n        -- filing arbitrary stamps flooded a table whose rows never go away.\n        -- The digest binds the WHOLE row (TableName, RowKey, StampId); the 'CadreControl.Revocation'\n        -- domain tag keeps it disjoint from every other rule \u2014 including the\n        -- 'CadreControl.CadrePeer' 'remove' digest the same owner signs in the SAME\n        -- transaction for the delete this tombstone accompanies.\n        -- RowKey is not cross-checked HERE against the retired row: positively binding it (e.g.\n        -- requiring a committed.Strand row carrying the pair) would reject a tombstone re-issued\n        -- in a LATER transaction \u2014 which the delete-while-alone durability path\n        -- (docs/architecture.md) plans to do \u2014 and reject it outright on a node that never\n        -- converged on the removed row. The binding lives on the other side instead: each\n        -- guarded table's RevocationRecorded requires the tombstone accompanying a DELETE to\n        -- name that row's key, which the re-issue path never trips (it files no delete).\n        -- Residual: a STANDALONE tombstone \u2014 owner-signed, naming a stamp no live row holds \u2014\n        -- is still accepted, so an owner can name an id that never existed and thereby\n        -- permanently foreclose CONSENT-seating of that id (Strand.AuthorizedInsert).\n        -- Owner-only, the owner already controls invite issuance, and unbound ids are 128\n        -- random bytes minted at redemption \u2014 no escalation (same reasoning as the pre-plant\n        -- note on RowIsGone).\n        -- Reads LIVE OwnerKey (like ValidationKey / Strand / CadrePeer / DeviceToken), not\n        -- committed.OwnerKey. The one difference that makes: a founding transaction on an\n        -- owner-less database could seat an owner key and file a tombstone in one go. An\n        -- owner-less control database is already a total loss, and a second transaction\n        -- achieves the same thing under committed.*, so consistency with the siblings is\n        -- worth more than the distinction \u2014 do not \"tighten\" this without a reason other\n        -- than that one.\n        -- RowIsGone and NoDelete are unchanged: they guard an owner retiring a stamp early\n        -- or withdrawing one later, which authorization does not cover.\n        constraint Authorized check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Revocation', 'remove', new.TableName, new.RowKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- A re-issue is an OWNER action, like the original append. Distinct 'reissue' action\n        -- tag, so an append approval can never be replayed as a re-issue and vice versa. The\n        -- digest adds ReissuedAt so a captured re-issue signature cannot bump the counter to\n        -- any other value. Reads LIVE OwnerKey, matching Authorized above.\n        constraint AuthorizedReissue check on update (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey\n                and verify(digest('CadreControl.Revocation', 'reissue',\n                                  new.TableName, new.RowKey, new.StampId, cast(new.ReissuedAt as text)),\n                           context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n}\n\napply schema CadreControl;";
+export declare const CONTROL_SCHEMA = "-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)\ndeclare schema CadreControl {\n    -- A key that can authorize various control changes\n    table OwnerKey (\n        Key text primary key,\n        StampId text not null unique,   -- per-row authorization nonce, bound into the signed digests below.\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below), so the never-expiring\n                                        -- enrollment signature cannot resurrect a removed owner.\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- removal. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A\n        -- legitimate re-add mints a FRESH StampId and a fresh signature, so it is unaffected.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'OwnerKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- A party must never lose its last owner key: every other CadreControl table's\n        -- CHECK requires an OwnerKey row, so an owner-less control database can never\n        -- authorize anything again \u2014 emptying this table is a permanent denial of the\n        -- party's control plane. Deferred (subquery), so the count is the POST-delete count.\n        -- NOTE: this is a per-transaction check against locally visible rows. Two\n        -- partitioned nodes that concurrently remove different owners can each see a\n        -- survivor and still converge to zero; if partitioned rotation ever becomes a real\n        -- workflow, the floor needs a cross-node guard, not a local count.\n        constraint MinOneOwner check on delete (\n            (select count(1) from OwnerKey) >= 1\n        ),\n        -- Enrollment is insert + delete only; rotation is add-then-remove. No writer\n        -- updates an OwnerKey row, and a self-rotation branch would double as a sole-owner\n        -- takeover: a deferred post-image count is also true of an update that re-points\n        -- the only row at an attacker key. Mirrors Strand.Manager.NoUpdate.\n        constraint NoUpdate check on update (false),\n        -- NOTE: the domain tag scopes an approval to a table and an action, not to a PARTY. Two\n        -- parties that share an owner key would accept each other's approvals. Fine today (each\n        -- party has its own owner key); if shared-owner multi-party ever ships, bind a party\n        -- identity row into these digests.\n        constraint Authorized check on insert, delete (\n            -- Every authorizer is read from the PRE-transaction snapshot (committed.*):\n            -- this CHECK auto-defers to commit (it has a subquery), by which point the row\n            -- being inserted \u2014 and any sibling inserted alongside it \u2014 is live, so a plain\n            -- from-OwnerKey would let a row authorize itself, or two strangers seat each\n            -- other. committed.* excludes both, stating the rule directly: the authorizer\n            -- must have existed BEFORE this transaction.\n\n            -- Every signed digest below (and in every other CadreControl table) leads with two\n            -- fixed literals \u2014 a 'CadreControl.<Table>' domain tag and an 'add'/'remove'/\n            -- 'vouch'/'publish' action tag (cadre-core control-authorization.ts) \u2014 so an\n            -- approval verifies ONLY against the one rule it was minted for. Without them,\n            -- e.g. a ValidationKey enrollment approval covered the identical bytes as an\n            -- OwnerKey enrollment: a narrow grant that doubled as full ownership.\n\n            -- Bootstrap: the FOUNDING transaction \u2014 one whose pre-transaction owner set is\n            -- empty \u2014 needs no authorization, and every row it inserts rides this branch\n            -- (whoever writes it already owns the party outright, so a co-founder row grants\n            -- nothing a single row would not). Gated on the PRE-transaction count, so a\n            -- same-transaction swap of the sole owner (delete the founder, insert the\n            -- attacker \u2014 post-image count still 1) cannot ride it.\n            (old.Key is null and (select count(1) from committed.OwnerKey) = 0)\n\n                -- or a pre-existing owner authorizes by signing over THIS row (Key, StampId)\n                or (old.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.OwnerKey', 'add', new.Key, new.StampId), context.Signature, A.Key, 'ed25519')))\n\n                -- or a removal authorized by ANOTHER pre-existing owner over the DISTINCT\n                -- 'remove'-tagged digest bound to the stored row's StampId, so an enrollment\n                -- signature can never be replayed as a removal (cf. CadrePeer.AuthorizedDelete).\n                -- A.Key <> old.Key: an owner cannot sign its own removal (no self-resignation).\n                or (new.Key is null and exists (select 1 from committed.OwnerKey A where A.Key = context.OwnerKey and A.Key <> old.Key and verify(digest('CadreControl.OwnerKey', 'remove', old.Key, old.StampId), context.Signature, A.Key, 'ed25519')))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure\n    table ValidationKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay).\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below), so the never-expiring\n                                        -- enrollment signature cannot resurrect a removed key.\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert naming\n        -- a retired stamp: the approval that seated this row can never re-seat it after removal.\n        -- Same rationale as OwnerKey.NotRevoked, stated in full there.\n        -- NOTE: this table gained a consumer \u2014 FormationUsage.Authorized reads it to gate redemption of\n        -- a ValidationUrl invite \u2014 so the convergence gap noted on Strand.StampId now has teeth here: on\n        -- a node that has not yet seen the tombstone, a replayed enrollment re-seats the key and it can\n        -- approve redemptions there until the Revocation row arrives. Still no per-request READ surface to\n        -- filter (the gate is a write-time CHECK), so there is nothing to add today; if one appears, filter\n        -- retired stamps there.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'ValidationKey' and R.StampId = old.StampId and R.RowKey = old.Key)\n        ),\n        -- Enrollment is insert + delete only; rotation is add-then-remove. No writer in the repo\n        -- updates a ValidationKey row. Required because the AuthorizedInsert / AuthorizedDelete\n        -- pair below covers neither update \u2014 and a bare `check`, which is what this rule used to\n        -- be, covers insert+update but NOT delete. Mirrors OwnerKey.NoUpdate.\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.ValidationKey', 'add', new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound to\n            -- the STORED row (Key, StampId), so an enrollment approval \u2014 which never expires \u2014 can\n            -- never be replayed as a removal. Same shape as CadrePeer.AuthorizedDelete.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.ValidationKey', 'remove', old.Key, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: a COMMITTED tombstone already retires this exact row incarnation, so a node\n                -- that was offline at removal time may delete the stale row locally with no owner key.\n                -- Why committed.* and why the stamp must be bound: stated in full on\n                -- CadrePeer.AuthorizedDelete.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'ValidationKey' and R.RowKey = old.Key and R.StampId = old.StampId)\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort\n    -- Cadre peers should participate in each of these strands\n    table Strand (\n        Id text primary key,    -- UUID\n        MemberPrivateKey text null unique,   -- Our private key as a member of this strand\n        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay).\n                                        -- `unique` holds over LIVE rows only; a removed row's stamp is retired\n                                        -- permanently into Revocation (NotRevoked below).\n        -- NOTE: NotRevoked is a per-transaction check against LOCALLY VISIBLE rows, so a node that\n        -- has not yet converged on the Revocation row can still accept a replayed add and end up\n        -- holding the resurrected strand alongside its tombstone. CadrePeer has a read-side\n        -- mitigation for this class (ControlDatabase.queryCadrePeers drops rows whose stamp is\n        -- retired, so every membership reader inherits it); Strand and ValidationKey deliberately\n        -- do NOT, because neither has a\n        -- per-request authorization surface today. If one ever gains one, filter it there.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey. That is what makes\n        -- the consent branch of AuthorizedInsert below trustworthy: a removal cannot file a\n        -- tombstone that omits or misnames the id it retires.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'Strand' and R.StampId = old.StampId and R.RowKey = old.Id)\n        ),\n        -- Strand rows are insert + delete only. Required: the consent branch of AuthorizedInsert\n        -- below authorizes by the EXISTENCE of a FormationUsage row naming (new.Id, new.StampId)\n        -- and carries no signature, so while this rule was a bare `check` (insert+update) it also\n        -- said \"anyone may REWRITE any consent-formed strand, unsigned\" \u2014 flipping Type to 'o' and\n        -- nulling MemberPrivateKey destroys the party's own membership key for that network in place.\n        -- Mirrors OwnerKey.NoUpdate / FormationInvite.Immutable.\n        constraint NoUpdate check on update (false),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Strand', 'add', new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or authorized WITHOUT a signature by a redemption record naming THIS EXACT ROW: a\n                -- FormationUsage row carrying both this strand's Id and its one-off StampId\n                -- (control-database.ts:redeemInvitation writes the pair in one transaction; both\n                -- CHECKs defer, so each sees the other's row at commit).\n                --\n                -- Matching the STAMP, not the id alone, is what makes a removal stick. FormationUsage\n                -- is append-only, so a redemption record outlives the strand it formed forever; keyed\n                -- on the id alone it re-authorized ANY later insert of that id, so after a legitimate\n                -- owner-signed, tombstoned removal any writer could re-seat the strand unsigned with a\n                -- fresh StampId (sidestepping NotRevoked, which retires only the removed row's stamp)\n                -- and an ATTACKER-CHOSEN MemberPrivateKey \u2014 the party's own secret for that network.\n                -- Bound to the stamp, the removal retires that stamp into Revocation and NotRevoked\n                -- closes this consent record's branch permanently.\n                --\n                -- Beyond the stamp match, the branch is deliberately NARROW \u2014 each clause closes one door:\n                --   * Type = 'o' / MemberPrivateKey null \u2014 a consent-seated strand looks exactly like\n                --     what the unbound redemption path writes (open, keyless). A closed strand carrying\n                --     a caller-chosen member key (the party's own read-gating secret for that network)\n                --     has no legitimate producer. MemberKeyClosedOnly already implies the second clause\n                --     from the first today; both are stated so this rule does not silently depend on\n                --     another constraint staying as it is.\n                --   * the inner FI.StrandId is null \u2014 only an UNBOUND invite may seat a strand at all.\n                --     A bound invite's host strand is owner-provisioned up front; letting the invite\n                --     consent-seat that id would allow an open, keyless downgrade of the real (possibly\n                --     closed, key-bearing) host row on a node where it has not converged yet. The bound\n                --     path records usage only (resolveStrand reports an absent host as missing and the\n                --     formation manager rejects cleanly).\n                --   * the not-exists over OTHER stamps \u2014 a strand id may be consent-seated once, EVER.\n                --     FormationUsage is append-only, so the first redemption's record survives a later\n                --     owner-signed removal and permanently forecloses a second consent-seating of the\n                --     id (a spare use of the same token minted a new stamp and rode this branch to\n                --     re-seat the id with an attacker-chosen row). Re-joining a removed id is\n                --     owner-gated: the owner re-seats it signed (fresh stamp, fresh signature) and\n                --     issues a BOUND invite the returning party records consent against \u2014 the id is\n                --     not blacklisted, only its unsigned re-seat is. This cannot be weaponised to\n                --     pre-block a legitimate id: StrandExists refuses a usage row naming a strand that\n                --     does not exist, so no usage row can be pre-planted for an unseated id \u2014 and ids\n                --     are 128 random bytes anyway.\n                --   * the not-exists over Revocation \u2014 a strand id may be consent-seated once EVER\n                --     and never after ANY removal of that id, however it was seated. The usage-row\n                --     rule above binds only ids that ever carried a consent record; an id seated\n                --     purely owner-signed (insertStrand, no usage row) leaves nothing behind on\n                --     removal, so its removal needs its own trace. Every removal files a Revocation\n                --     row naming the removed row's key (RowKey), and this clause refuses any id\n                --     that has ever been tombstoned. RevocationRecorded above makes that trace\n                --     mandatory AND correctly named, so no removal can slip past this clause. The\n                --     usage-row clause is arguably subsumed by this one (a usage row implies the\n                --     strand row existed, and its removal must file a tombstone), but it reaches\n                --     the same conclusion without depending on Revocation at all; both are stated,\n                --     per the style note above. The owner-signed branch is deliberately unaffected,\n                --     so re-join stays owner-gated exactly as described.\n                --     What is NOT schema-verified is a STANDALONE tombstone (one with no\n                --     accompanying delete \u2014 see Revocation.Authorized): an owner can file one\n                --     naming an id that never existed and thereby permanently foreclose\n                --     consent-seating of that id \u2014 owner-only, the owner already controls invite\n                --     issuance, and unbound ids are 128 random bytes minted at redemption, so no\n                --     escalation (same reasoning as the pre-plant note above).\n                --     NOTE: like NotRevoked above, this is a write-time check against LOCALLY\n                --     VISIBLE rows \u2014 a node that has not yet converged on the Revocation row still\n                --     accepts the re-seat. Fails in the safe direction: the tombstone wins after\n                --     merge for the STAMP, and the resurrected row coexists with it (same class as\n                --     the StampId note above).\n                or (\n                    new.Type = 'o'\n                    and new.MemberPrivateKey is null\n                    and exists (\n                        select 1 from FormationUsage FU\n                            where FU.StrandId = new.Id\n                                and FU.StrandStampId = new.StampId\n                                and exists (select 1 from FormationInvite FI where FI.Token = FU.Token and FI.StrandId is null)\n                    )\n                    and not exists (\n                        select 1 from FormationUsage FU2\n                            where FU2.StrandId = new.Id and FU2.StrandStampId <> new.StampId\n                    )\n                    and not exists (\n                        select 1 from Revocation R\n                            where R.TableName = 'Strand' and R.RowKey = new.Id\n                    )\n                )\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound to\n            -- the STORED row (Id, StampId), so the add approval \u2014 which never expires \u2014 can never be\n            -- replayed as a removal. Note the consent branch above is deliberately NOT mirrored\n            -- here: an invitation authorizes forming a strand, never destroying one.\n            --\n            -- DELIBERATELY no REAP branch (cf. CadrePeer.AuthorizedDelete): this row carries\n            -- MemberPrivateKey \u2014 the party's own membership secret for that network, stored nowhere\n            -- else \u2014 so this is the one guarded delete whose effect is unrecoverable, and a stale\n            -- row is already inert for the purpose a tombstone serves (the consent branch of\n            -- AuthorizedInsert above refuses any id ever tombstoned). Do not \"fix\" the asymmetry;\n            -- tickets/backlog/debt-strand-tombstone-reap.md owns any future change.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Strand', 'remove', old.Id, old.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint MemberKeyClosedOnly check (\n            -- An open strand ('o') has no membership gate, so it must not carry a\n            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A peer (node) that is part of the cadre, carrying a self-published,\n    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).\n    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against\n    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)\n        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published\n        StampId text not null unique,    -- per-row authorization nonce, bound into the voucher/remove digests; rotates on\n                                         -- (re)insert. A removed row's stamp is retired permanently into Revocation\n                                         -- (NotRevoked below), so a captured admission approval cannot re-seat a removed peer.\n        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)\n        VouchSig text null,              -- that owner's signature over the 'vouch'-tagged digest below (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership. The domain/action tags keep this STORED, REPLICATED signature useless against every other rule (pre-tag it satisfied OwnerKey/ValidationKey inserts for Key = PeerId).\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- removal. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A\n        -- legitimate re-add mints a FRESH StampId and a fresh signature, so it is unaffected.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'CadrePeer' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key, which vouches both membership and the\n            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).\n            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),\n            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest. The same\n            -- 'vouch'-tagged digest is DELIBERATELY shared with the owner branch of\n            -- AuthorizedUpdate below: both mean \"this owner vouches this membership row\".\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'vouch', new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n            -- Persist the vouching (owner, signature) onto the row so a reader can later\n            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal\n            -- the pair the verify above validated, so a writer cannot store a voucher it did\n            -- not actually receive a signature for.\n            and new.VouchOwner = context.OwnerKey\n            and new.VouchSig = context.Signature\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over the DISTINCT 'remove'-tagged digest bound\n            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so\n            -- the stored voucher (a signature over the 'vouch'-tagged digest) can NEVER be\n            -- replayed to authorize a delete. The remove signature rides in context and is never stored.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'remove', old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: this node already holds a COMMITTED tombstone retiring THIS EXACT row\n                -- incarnation, so the party owner has already authorized this row's removal and this\n                -- node is merely catching up. That is what lets a node which was offline at\n                -- revocation time delete the stale row locally, with no owner private key\n                -- (control-database.ts:reapRevokedRow). Same shape as the consent branch of\n                -- Strand.AuthorizedInsert: authorization by the EXISTENCE of a row rather than by a\n                -- signature \u2014 and that row is itself owner-signed (Revocation.Authorized), so this\n                -- widens WHO may execute a removal, never WHO may decide one. RevocationRecorded is\n                -- satisfied by the same committed tombstone, so a reap files no second one.\n                --\n                -- committed.Revocation, NOT Revocation \u2014 and the stamp clause \u2014 are both load-bearing:\n                --   * committed.* : this CHECK defers to commit (it has a subquery), by which point a\n                --     tombstone written in the SAME transaction is live. Reading plain Revocation\n                --     would therefore let deleteGuardedRow's own sibling tombstone satisfy this\n                --     branch, making the 'remove'-tagged delete signature above dead weight and\n                --     collapsing two domain-separated approvals into one. committed.* states the rule\n                --     exactly: the tombstone must have existed BEFORE this transaction.\n                --   * R.StampId = old.StampId : binds the ROW INCARNATION, not the name. One name may\n                --     legitimately carry several tombstones over its life (seat -> delete -> owner\n                --     re-seat -> delete). Without this clause a tombstone from a PREVIOUS incarnation\n                --     would authorize deleting the CURRENT row, which the owner never removed.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'CadrePeer' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key\n            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on\n            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified\n            -- against the stored PublicKey over the same payload the publish path signs\n            -- (cadre-core peer-record.ts:peerRecordSignedPayload).\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and new.VouchSig = old.VouchSig\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest('CadreControl.CadrePeer', 'publish', new.PeerId, new.Multiaddr, cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                -- or an owner re-authorizes (rotation / correction): re-vouches the row over\n                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.\n                -- StampId is immutable here too: an update that rotated it would leave the OLD\n                -- stamp live-free and untombstoned (RevocationRecorded only retires the stamp a\n                -- delete carries), so the original admission approval \u2014 which is stored on the\n                -- replicated row as VouchSig \u2014 would resurrect the peer after a later removal.\n                -- Retiring a stamp is delete + Revocation row, never an update.\n                or (\n                    new.StampId = old.StampId\n                    and exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.CadrePeer', 'vouch', new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and new.VouchOwner = context.OwnerKey\n                    and new.VouchSig = context.Signature\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a\n    -- server peer can deliver a push-wake to a suspended app over the platform push\n    -- channel (a control-network dial cannot reach an OS-suspended process). The row\n    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for\n    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then\n    -- hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,        -- the CadrePeer this token belongs to\n        Platform text not null,         -- 'fcm' | 'apns'\n        Token text not null,            -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)\n        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)\n        StampId text not null unique,    -- single-use authorization nonce, bound into the add/remove digests;\n                                         -- rotates on (re)insert. A cleared token's stamp is retired permanently\n                                         -- into Revocation (NotRevoked below), so the approval that published a\n                                         -- token cannot re-seat it after the owner cleared it (logout).\n        -- A removed row's StampId is retired into Revocation, and this refuses any insert\n        -- naming a retired stamp: the approval that seated this row can never re-seat it after\n        -- the clear. `unique` alone did not do this \u2014 it only holds over LIVE rows, so a delete\n        -- freed the stamp and the original never-expiring signature verified again. A legitimate\n        -- re-register mints a FRESH StampId and a fresh signature, so it is unaffected. This\n        -- matters more here than the stored-approval case (CadrePeer.VouchSig): a resurrected\n        -- push token has NO freshness ceiling to retire it \u2014 cadre-node.ts:resolveDeviceToken\n        -- defaults maxAgeMs to infinity by design \u2014 so retirement is the only thing that sticks.\n        constraint NotRevoked check on insert (\n            not exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = new.StampId)\n        ),\n        -- Retirement is MANDATORY: a delete must carry the matching Revocation row in the same\n        -- transaction, or the stamp would free up again. Deferred (subquery), so the sibling\n        -- insert is visible at commit regardless of statement order. The tombstone must also\n        -- name the removed ROW, not just its stamp \u2014 see Revocation.RowKey.\n        constraint RevocationRecorded check on delete (\n            exists (select 1 from Revocation R where R.TableName = 'DeviceToken' and R.StampId = old.StampId and R.RowKey = old.PeerId)\n        ),\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.\n            -- The digest binds the WHOLE row behind the domain/action tags \u2014 every column,\n            -- with the nullable UpdatedAt/Sig signing as '' when absent (the shape\n            -- FormationInvite and Strand already use) \u2014 so a replayed approval can only ever\n            -- reproduce the row it approved, never one carrying attacker-chosen\n            -- Platform/Token/UpdatedAt; NotRevoked above then refuses even that exact row\n            -- once it has been cleared. The DISTINCT 'remove'-tagged digest below keeps a\n            -- captured insert approval from doubling as a delete (and vice versa).\n            -- Mirrors cadre-core peer-authorization.ts:deviceTokenAddDigest.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.DeviceToken', 'add',\n                    new.PeerId,\n                    new.Platform,\n                    new.Token,\n                    coalesce(cast(new.UpdatedAt as text), ''),\n                    coalesce(new.Sig, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Bound to the STORED row's (PeerId, StampId) \u2014 cadre-core\n            -- peer-authorization.ts:deviceTokenRemoveDigest \u2014 so the never-expiring insert\n            -- approval can never be replayed as a clear, and a captured clear approval is\n            -- dead once the stamp it names is retired.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.DeviceToken', 'remove', old.PeerId, old.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or REAP: a COMMITTED tombstone already retires this exact row incarnation, so a node\n                -- that was offline at removal time may delete the stale row locally with no owner key.\n                -- Why committed.* and why the stamp must be bound: stated in full on\n                -- CadrePeer.AuthorizedDelete.\n                or exists (select 1 from committed.Revocation R where R.TableName = 'DeviceToken' and R.RowKey = old.PeerId and R.StampId = old.StampId)\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key\n            -- behind PeerId). PeerId and StampId are immutable, UpdatedAt must strictly\n            -- increase (replay guard), and Sig is verified against the stored\n            -- CadrePeer.PublicKey over the signed payload (cadre-core\n            -- device-token.ts:deviceTokenSignedPayload). Platform and Token may change on\n            -- self-update (platform switch / reinstall / rotation).\n            -- StampId is immutable for the reason CadrePeer spells out: an update that\n            -- rotated it would leave the OLD stamp live-free and untombstoned, so retiring a\n            -- stamp stays delete + Revocation row, never an update.\n            -- This is the ONLY branch: there is deliberately NO owner re-touch. The branch\n            -- that used to sit beside it verified an owner signature over the peer id alone\n            -- and sat OUTSIDE the monotonicity requirement, so one captured owner approval\n            -- rewrote Platform/Token and rolled UpdatedAt BACKWARDS \u2014 and seating a\n            -- far-future UpdatedAt wedged the peer's own self-updates permanently. No writer\n            -- used it. An owner that must correct a row deletes it (retiring the stamp) and\n            -- inserts a fresh one, the same path it already takes for CadrePeer.\n            new.PeerId = old.PeerId\n            and new.StampId = old.StampId\n            and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n            and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                    digest('CadreControl.DeviceToken', 'publish', new.PeerId, new.Platform, new.Token, cast(new.UpdatedAt as text)),\n                    new.Sig, P.PublicKey, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party\n    table FormationInvite (\n        Token text primary key, -- Just a random string\n        sAppId text, -- The app for the strand that will be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,   -- Web hook - send disclosure, IP address...\n        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner signing over THIS row\n            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.\n            -- Nullable bound fields (ExpiresAt/TotalUses/ValidationUrl/StrandId) sign as '' when absent.\n            -- The 'remove'-tagged AuthorizedDelete digest below is DISTINCT, so a captured\n            -- insert approval can never be replayed to revoke-then-reissue an invite (or vice versa).\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'add',\n                    new.Token,\n                    new.sAppId,\n                    coalesce(cast(new.ExpiresAt as text), ''),\n                    coalesce(cast(new.TotalUses as text), ''),\n                    coalesce(new.ValidationUrl, ''),\n                    coalesce(new.StrandId, ''),\n                    new.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedDelete check on delete (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    'CadreControl.FormationInvite', 'remove',\n                    old.Token,\n                    old.sAppId,\n                    coalesce(cast(old.ExpiresAt as text), ''),\n                    coalesce(cast(old.TotalUses as text), ''),\n                    coalesce(old.ValidationUrl, ''),\n                    coalesce(old.StrandId, ''),\n                    old.StampId\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Invites are insert/delete only: forbid in-place mutation so the row-bound\n        -- AuthorizedInsert signature cannot be sidestepped by updating consent\n        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check\n        -- defaults to insert+update; the checks on insert / on delete above exclude update,\n        -- so this guard is required. Mirrors FormationUsage.InsertOnly.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    table FormationUsage (\n        Token text not null,            -- the FormationInvite this acceptance redeems. Stated explicitly because\n                                        -- Token is no longer a primary-key prefix; Authorized below would refuse a\n                                        -- null anyway (null = null is never true, so its FormationInvite\n                                        -- exists-clause cannot match), but the column carries the invariant rather\n                                        -- than leaving it to a CHECK.\n        UsageStampId text not null,     -- single-use nonce for THIS redemption, and this table's PRIMARY KEY.\n                                        -- The JOINING peer mints it and sends it in its contact message, having\n                                        -- signed it into its own 'consent' digest (PeerConsented below); the\n                                        -- responder inserts that same value and asks the approver about it, so it\n                                        -- is bound into the 'vouch' digest below too and one sign-off is spendable\n                                        -- exactly once. Neither side can swap it: a substituted nonce fails the\n                                        -- joiner's consent signature.\n                                        -- As the row key, a verbatim replay of an approval collides on the\n                                        -- primary key locally instead of on a column `unique`. Unlike every other\n                                        -- StampId in this schema, this table is append-only (InsertOnly below),\n                                        -- so the nonce is never freed by a delete: the key alone makes it\n                                        -- permanent and there is deliberately NO NotRevoked / RevocationRecorded\n                                        -- pair here \u2014 do not go looking for the missing one.\n                                        -- NOTE: the key is evaluated against LOCALLY VISIBLE rows, so two nodes\n                                        -- that have not yet converged could each admit the same nonce and both\n                                        -- rows survive the merge. Same class as the NotRevoked convergence notes\n                                        -- on OwnerKey / Strand / ValidationKey; the digest binding still holds on\n                                        -- both nodes, so the outcome is a duplicated audit row, never a join\n                                        -- nobody approved.\n        PeerKey text not null,          -- the joining peer's own ed25519 public key (base64url, 32 bytes), bound\n                                        -- into BOTH the approver's 'vouch' digest and the joiner's 'consent'\n                                        -- digest below, so an approval cannot be re-filed under a different\n                                        -- joiner's name and the named joiner provably agreed (PeerConsented).\n                                        -- The key IS the joiner's identity \u2014 its libp2p peer id is derivable\n                                        -- (identity multihash of these bytes), never stored here.\n        PeerSig text not null,          -- the joining peer's signature over the 'consent' digest \u2014 see\n                                        -- PeerConsented below for what it proves and why it is stored on the row.\n        Disclosure text,\n        StrandId text,\n        StrandStampId text not null,   -- the Strand.StampId this consent record authorizes. Consent is\n                                       -- bound to ONE strand ROW, not to a strand id forever \u2014 see\n                                       -- Strand.AuthorizedInsert's consent branch for why. NOT unique:\n                                       -- in the bound (provision-then-record) path several invitees\n                                       -- each write a usage row against the SAME host strand, so many\n                                       -- usage rows legitimately share one stamp.\n        primary key (UsageStampId),\n        constraint InsertOnly check on update, delete (false),\n        constraint Authorized check on insert (\n            -- Satisfies an invitation\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        -- The use cap is COUNTED against the pre-transaction snapshot, never\n                        -- sequenced. This CHECK auto-defers to commit (it has a subquery), by\n                        -- which point the in-flight row is live; committed.* is what excludes\n                        -- it, so a sequentially exhausted invite \u2014 every seat already committed\n                        -- on this node \u2014 is still refused here. What is deliberately NOT\n                        -- refused: concurrent redeemers on separate nodes (or nodes that have\n                        -- not yet converged) each count the same committed snapshot and both\n                        -- land, over-admitting by at most the number of concurrent redeemers.\n                        -- Both rows survive in this append-only record, so the overage is\n                        -- auditable, and removal is owner-gated (member removal + Revocation).\n                        -- Same class as the convergence note on UsageStampId above.\n                        -- One rule for FUTURE writers: two FormationUsage rows for one token\n                        -- inserted in ONE transaction each read the same committed count, so\n                        -- they can jointly exceed the cap. No writer in this repo does that; it\n                        -- is a constraint on new writers, not a case to engineer for.\n                        -- Do not \"fix\" this into a per-token sequence number to restore a\n                        -- strict cap \u2014 that trade was weighed and rejected (2026-08-04): a\n                        -- fought-over sequence key turns a concurrent redemption into a silent,\n                        -- unrecoverable loss of a consented join, which is strictly worse than\n                        -- a visible, reversible over-admission.\n                        and (FI.TotalUses is null or FI.TotalUses > (select count(1) from committed.FormationUsage U where U.Token = new.Token))\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        -- An invite carrying a ValidationUrl demands a sign-off from a key the party\n                        -- ENROLLED in ValidationKey. The signature is verified against the STORED VK.Key,\n                        -- NOT against context.ValidationKey \u2014 that distinction is the whole point:\n                        -- context.ValidationKey is a plain insert parameter, so verifying against it asked\n                        -- only \"did the redeemer sign its own disclosure with SOME key it holds?\", which any\n                        -- redeemer answers by minting a throwaway keypair. context.ValidationKey survives\n                        -- purely to SELECT which enrolled row is being claimed; naming an enrolled key while\n                        -- signing with a different one fails the verify against VK.Key.\n                        --\n                        -- Deliberate: CHECKs run on write only, so removing a validation key later does NOT\n                        -- re-examine the FormationUsage rows it already approved. The sign-off was valid when\n                        -- given and the strand it authorized stays formed; removal narrows who may approve\n                        -- FUTURE redemptions, it is not a retroactive revocation of past ones.\n                        --\n                        -- What ONE sign-off buys: exactly ONE row. The digest covers\n                        -- (Token, UsageStampId, StrandId, PeerKey, Disclosure), so an approval is NOT\n                        -- transferable across invitations, redemptions, networks, joiners, or disclosure\n                        -- text. Replay is closed twice over, by two independent mechanisms: presenting an\n                        -- approval VERBATIM repeats its UsageStampId and is refused by this table's\n                        -- primary key; presenting it under any OTHER redemption changes a signed field\n                        -- and fails this verify.\n                        -- Every signed field is supplied by the redeeming side \u2014 nothing derived from\n                        -- the table's current state is bound \u2014 so no concurrent write can invalidate an\n                        -- approval between the sign-off and the row landing.\n                        -- Why StrandStampId is deliberately NOT bound: it names the strand ROW\n                        -- incarnation, which the unbound path (redeemInvitation) mints inside its own\n                        -- transaction, and it adds nothing on top of a strictly single-use approval \u2014\n                        -- StrandId already pins WHICH network the approver approved joining.\n                        and (FI.ValidationUrl is null or exists (\n                            select 1 from ValidationKey VK\n                                where VK.Key = context.ValidationKey\n                                    and verify(digest('CadreControl.FormationUsage', 'vouch', new.Token, new.UsageStampId, new.StrandId, new.PeerKey, new.Disclosure), context.ValidationSignature, VK.Key, 'ed25519')))\n                        -- A bound invite (non-null StrandId) may only ever name its own host strand:\n                        -- without this, any holder of a bound token could record consent against an\n                        -- arbitrary strand id \u2014 annotating an unrelated strand, or (before\n                        -- Strand.AuthorizedInsert's consent branch was narrowed to unbound invites)\n                        -- consent-seating that id outright.\n                        -- NOTE: an UNBOUND invite is deliberately left free to name any strand, so a\n                        -- holder can spend a use appending a consent row to an unrelated existing\n                        -- strand. Harmless today (the row grants nothing, it only burns a use and\n                        -- forecloses that id's consent-seating, which is the safe direction); if\n                        -- unlimited-TotalUses invites ever become common, this is an append-only\n                        -- growth surface worth bounding.\n                        and (FI.StrandId is null or FI.StrandId = new.StrandId)\n            )\n        ),\n        -- Matched on the (id, stamp) PAIR, the same key Strand.AuthorizedInsert's consent branch\n        -- reads back: a usage row may only ever name a strand ROW that exists, so a consent record\n        -- can never be filed against a stamp of the writer's choosing and held in reserve to\n        -- re-seat the id after a removal.\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId and S.StampId = new.StrandStampId)),\n        -- The JOINING peer proves it consented to this redemption: PeerKey is its own ed25519\n        -- public key and PeerSig is its signature over the 'consent'-tagged digest below.\n        -- Unlike the approver's sign-off (context.ValidationSignature, checked against a STORED\n        -- ValidationKey row), the identity here IS the key, so there is no enrolled row to look\n        -- up and nothing for a writer to substitute: a forged joiner would need that joiner's\n        -- private key. Stored rather than passed in context so any later reader can re-check it\n        -- (verifyFormationConsent); the 'consent' action tag keeps this replicated signature\n        -- useless against every other rule in this schema (notably the approver's 'vouch'\n        -- digest over the same table).\n        -- NOTE: StrandId is deliberately NOT in this digest \u2014 the joiner cannot know it when it\n        -- signs (a bound invite's host strand arrives only in the result frame; an unbound\n        -- strand is responder-minted). The responder cannot substitute a strand anyway: bound\n        -- invites are pinned by Authorized's FI.StrandId check, unbound invites mint fresh.\n        constraint PeerConsented check on insert (\n            verify(digest('CadreControl.FormationUsage', 'consent',\n                          new.Token, new.UsageStampId, new.PeerKey, new.Disclosure),\n                   new.PeerSig, new.PeerKey, 'ed25519')\n        ),\n    -- Context here is only what the approver-side rules read: Now for expiry, and the\n    -- ValidationKey/ValidationSignature pair for the 'vouch' check in Authorized. The joiner's\n    -- signature is NOT context \u2014 it lives on the row (PeerSig, verified by PeerConsented above).\n    ) with context (Now datetime, ValidationKey text null, ValidationSignature text null);\n\n    -- Token is no longer a primary-key prefix (the key is the redemption nonce), so the\n    -- per-token filters \u2014 the cap count in Authorized above, and cadre-core's\n    -- countFormationUsage / isTokenUsed / hasOutstandingFormationInvite \u2014 get an index\n    -- rather than a table scan.\n    index FormationUsageByToken on FormationUsage (Token);\n\n    -- Append-only retirement record for the one-off StampId nonces of removed OwnerKey /\n    -- CadrePeer / ValidationKey / Strand rows. Without it a removal was undoable: the add\n    -- approval is a signature over\n    -- (row key, stamp) that never expires, and deleting the row freed the stamp, so anyone who\n    -- kept a copy of the approval could resurrect the row.\n    -- Each tombstone also records WHICH row was retired (RowKey below): the consent branch of\n    -- Strand.AuthorizedInsert reads it to refuse consent-seating any strand id that has ever\n    -- been removed, whichever way it was seated.\n    -- NOTE: the guarded tables' NotRevoked CHECK runs against locally visible rows, so a node\n    -- that has not yet converged on a Revocation row can still accept the replayed add, and the\n    -- resurrected row coexists with the tombstone after merge \u2014 same class as the MinOneOwner\n    -- note on OwnerKey. The read-side mitigation is ControlDatabase.queryCadrePeers, which\n    -- drops any CadrePeer row whose StampId appears here; every membership reader inherits it.\n    -- NOTE: append-only, so this table only ever grows. Every append is owner-signed\n    -- (Authorized below), so the growth surface is the owner keys, not every writer that can\n    -- reach the control database. Cadres are a handful of peers and owner rotation is rare, so\n    -- unbounded growth is fine today; revisit if either changes.\n    -- A tombstone committed while the node was alone is local-only (never broadcast); the\n    -- ReissuedAt counter below exists so an owner can re-write \u2014 and therefore re-broadcast \u2014\n    -- such a tombstone once peers are reachable, without changing what it means.\n    table Revocation (\n        TableName text,             -- 'OwnerKey' | 'CadrePeer' | 'ValidationKey' | 'Strand' | 'DeviceToken' (confined by RowIsGone below)\n        RowKey text not null,       -- primary key of the removed row: OwnerKey.Key / ValidationKey.Key /\n                                    -- CadrePeer.PeerId / DeviceToken.PeerId / Strand.Id\n                                    -- Every guarded table's RevocationRecorded CHECK requires the\n                                    -- accompanying tombstone to carry the removed row's key here, so\n                                    -- a REMOVAL cannot file a misnamed tombstone. A tombstone with no\n                                    -- accompanying delete is not covered by that (see Authorized).\n        StampId text,               -- the retired nonce\n        -- Bumped by an owner-signed re-issue so a tombstone written while the node was alone\n        -- (committed local-only, never broadcast) can be re-written and therefore re-broadcast\n        -- on cohort growth. Carries NO semantics: nothing reads it, and retirement is decided\n        -- by the row's existence, not by this value.\n        ReissuedAt integer not null default 0,\n        -- Keyed on the stamp, not the RowKey: stamps are unique per row incarnation, and one\n        -- name may legitimately carry several tombstones over its life (seat -> delete ->\n        -- owner re-seat -> delete).\n        primary key (TableName, StampId),\n        -- Retirement is permanent: a tombstone may never be withdrawn.\n        constraint NoDelete check on delete (false),\n        -- Pinned at 0 on insert so an owner cannot seat a tombstone at a saturated counter and\n        -- thereby freeze its own later re-issues (ReissueOnly below). Deliberately NOT folded\n        -- into the Authorized digest: the value is fixed by this rule, so signing over it would\n        -- only widen the signed surface for no gain, and would invalidate every existing\n        -- insert-side digest.\n        constraint FreshTombstone check on insert (new.ReissuedAt = 0),\n        -- A re-issue may move NOTHING but the counter, and only upward. Without the identity\n        -- clause an \"update\" would be a way to re-point a tombstone at a different row,\n        -- restoring exactly the replay this table exists to stop.\n        constraint ReissueOnly check on update (\n            new.TableName = old.TableName and new.RowKey = old.RowKey\n                and new.StampId = old.StampId and new.ReissuedAt > old.ReissuedAt\n        ),\n        -- A stamp may only be retired once its row is actually gone. Deferred (subquery), so a\n        -- delete in the same transaction has already landed. Retiring a stamp that never\n        -- existed is permitted and harmless: a stamp carries 128 bits of CSPRNG output\n        -- (control-database.ts:generateStampId \u2014 16 bytes of sha256(PeerId) followed by 16\n        -- random bytes), so a future legitimate one cannot be guessed and pre-planted.\n        -- Deliberately keyed on the STAMP only, not RowKey: checking \"no live row named\n        -- new.RowKey\" breaks under out-of-order convergence \u2014 a peer removed (tombstone names\n        -- it, stamp1) then re-admitted (stamp2) would leave a node that converges on the\n        -- re-add FIRST rejecting the stamp1 tombstone forever, never learning that stamp is\n        -- retired. The stamp-only form passes there (stamp1 is not live).\n        constraint RowIsGone check on insert (\n            (new.TableName = 'OwnerKey' and not exists (select 1 from OwnerKey K where K.StampId = new.StampId))\n                or (new.TableName = 'CadrePeer' and not exists (select 1 from CadrePeer P where P.StampId = new.StampId))\n                or (new.TableName = 'ValidationKey' and not exists (select 1 from ValidationKey V where V.StampId = new.StampId))\n                or (new.TableName = 'Strand' and not exists (select 1 from Strand S where S.StampId = new.StampId))\n                or (new.TableName = 'DeviceToken' and not exists (select 1 from DeviceToken D where D.StampId = new.StampId))\n        ),\n        -- Appending a tombstone is an OWNER action, like every other write in this schema.\n        -- Ungated, any writer that could reach the control database could retire a stamp:\n        -- filing one against a CadrePeer row not visible locally (RowIsGone reads LOCALLY\n        -- VISIBLE rows \u2014 see the convergence note above) evicted that peer party-wide AND\n        -- permanently blocked the owner's own later re-admission of it (NotRevoked), and\n        -- filing arbitrary stamps flooded a table whose rows never go away.\n        -- The digest binds the WHOLE row (TableName, RowKey, StampId); the 'CadreControl.Revocation'\n        -- domain tag keeps it disjoint from every other rule \u2014 including the\n        -- 'CadreControl.CadrePeer' 'remove' digest the same owner signs in the SAME\n        -- transaction for the delete this tombstone accompanies.\n        -- RowKey is not cross-checked HERE against the retired row: positively binding it (e.g.\n        -- requiring a committed.Strand row carrying the pair) would reject a tombstone re-issued\n        -- in a LATER transaction \u2014 which the delete-while-alone durability path\n        -- (docs/architecture.md) plans to do \u2014 and reject it outright on a node that never\n        -- converged on the removed row. The binding lives on the other side instead: each\n        -- guarded table's RevocationRecorded requires the tombstone accompanying a DELETE to\n        -- name that row's key, which the re-issue path never trips (it files no delete).\n        -- Residual: a STANDALONE tombstone \u2014 owner-signed, naming a stamp no live row holds \u2014\n        -- is still accepted, so an owner can name an id that never existed and thereby\n        -- permanently foreclose CONSENT-seating of that id (Strand.AuthorizedInsert).\n        -- Owner-only, the owner already controls invite issuance, and unbound ids are 128\n        -- random bytes minted at redemption \u2014 no escalation (same reasoning as the pre-plant\n        -- note on RowIsGone).\n        -- Reads LIVE OwnerKey (like ValidationKey / Strand / CadrePeer / DeviceToken), not\n        -- committed.OwnerKey. The one difference that makes: a founding transaction on an\n        -- owner-less database could seat an owner key and file a tombstone in one go. An\n        -- owner-less control database is already a total loss, and a second transaction\n        -- achieves the same thing under committed.*, so consistency with the siblings is\n        -- worth more than the distinction \u2014 do not \"tighten\" this without a reason other\n        -- than that one.\n        -- RowIsGone and NoDelete are unchanged: they guard an owner retiring a stamp early\n        -- or withdrawing one later, which authorization does not cover.\n        constraint Authorized check on insert (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest('CadreControl.Revocation', 'remove', new.TableName, new.RowKey, new.StampId), context.Signature, A.Key, 'ed25519'))\n        ),\n        -- A re-issue is an OWNER action, like the original append. Distinct 'reissue' action\n        -- tag, so an append approval can never be replayed as a re-issue and vice versa. The\n        -- digest adds ReissuedAt so a captured re-issue signature cannot bump the counter to\n        -- any other value. Reads LIVE OwnerKey, matching Authorized above.\n        constraint AuthorizedReissue check on update (\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey\n                and verify(digest('CadreControl.Revocation', 'reissue',\n                                  new.TableName, new.RowKey, new.StampId, cast(new.ReissuedAt as text)),\n                           context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n}\n\napply schema CadreControl;";