@serfab/cadre-core 0.12.0 → 1.0.0

package/dist/strand-revocation-enforcer.js

@@ -0,0 +1,533 @@
+/**
+ * Strand revoked-peer enforcement: a per-strand deny gate that refuses the
+ * network nodes of a REMOVED party, so removal means "we stop talking to you"
+ * rather than only deleting a row.
+ *
+ * ## The deny set is revocation-keyed, never membership-keyed
+ *
+ * A strand node maintains a materialized in-memory set of revoked peer ids:
+ * every `Strand.MemberPeer.PeerId` whose `MemberKey` has no live `Strand.Member`
+ * row. `MemberPeer.MemberExists` runs on insert, so an orphaned binding can only
+ * mean "this member existed and was removed" — it is exactly the durable,
+ * replicated record of a removed party's machines. Everything NOT in the set is
+ * admitted. Deliberate consequences:
+ *
+ * - **Open strands are untouched.** `Member`/`MemberPeer` carry `OnlyClosed`
+ *   checks, so an open strand has no rows and the set is empty — and
+ *   `StrandInstanceManager` additionally skips arming this enforcer entirely for
+ *   `Type !== 'c'`, so an open strand does not even poll.
+ * - **A joining party mid-admission is admitted** (it has no orphaned binding).
+ *   An allowlist ("only peers bound to live members") was considered and
+ *   rejected: a joiner's first membership writes must travel through the very
+ *   cohort an allowlist would close to it — the same mutual-denial trap the
+ *   control network's gater doc describes (`membership-connection-gater.ts`),
+ *   with no enrollment window to carve out. A deny-list on positive evidence
+ *   has no such trap.
+ * - **Stale-view failure direction: fail-open.** A remaining member that has not
+ *   yet replicated the revocation keeps serving the removed party until the
+ *   tombstoned state arrives — bounded by replication, consistent with
+ *   "revocation is forward-looking". The opposite error (denying a legitimate
+ *   member) is only reachable for a revoked-then-re-admitted party at a node
+ *   that saw the revoke but not the re-add; the re-add gives the member key a
+ *   live `Member` row again, which removes its peers from the deny set as the
+ *   row replicates — self-healing, and the re-adding manager's own node updates
+ *   first, so the heal never depends on talking to the peer being wrongly denied.
+ * - **Orphaned `MemberPeer` rows are load-bearing**: they ARE the deny record —
+ *   the `Strand.Revocation` tombstone keeps only the stamp, not the peer id — so
+ *   nothing here (or anywhere) tombstones or auto-cleans them at revocation.
+ *   The manager-cleanup path (`removeMemberPeer`'s manager branch) stays as the
+ *   only way to clear a wrongly-registered binding, and clearing an orphan
+ *   forgets the denial (the NOTE at that branch says so).
+ *
+ * ## Removal cuts LIVE sessions too — the refresh IS the teardown seam
+ *
+ * Refusing NEW connections only half-honors "no longer be answered to or
+ * communicated with": a long-lived strand connection may never re-dial, so
+ * without teardown a removed party keeps whatever session it already holds.
+ * There is no push notification to hang teardown off — a REPLICATED revocation
+ * arrives with no change event (the strand database has no reactive
+ * subscription; `StrandWatcher` polls for the same reason), and a LOCAL
+ * `revokeMember`/`leaveStrand` writes through a bare `Database` handle this
+ * runtime never sees — so teardown rides the snapshot refresh itself, with
+ * `refresh()` exposed for immediacy
+ * (`StrandInstanceManager.refreshRevocationEnforcement` →
+ * `CadreNode.refreshRevocationEnforcement`).
+ *
+ * The sweep is driven by MEMBERSHIP in the deny set, never by an
+ * entered-the-set diff: every refresh hangs up every currently-connected
+ * revoked peer, so a resume, a crashed refresh, or a connection established
+ * between two refreshes cannot leave a session standing (a diff would be a
+ * strict subset of this, so none is kept). A peer with no open connection is
+ * simply not swept, and a failed `hangUp` is logged, never thrown — the next
+ * refresh retries it. `hangUp` closes DIRECT and RELAYED connections alike, and
+ * on a strand node running the relay server it also drops any reservation the
+ * revoked peer holds there (a reservation dies with its connection — see the
+ * relay-seam doc in `membership-connection-gater.ts`).
+ *
+ * Teardown is also what stops OUTBOUND traffic. The gate is one-directional —
+ * `authorizeStream` judges streams the revoked peer opens to US — so nothing
+ * else prevents this node from pushing over an already-open connection, which
+ * `PeerJoinBackfill` does for that connection's whole life. Closing the
+ * connection stops both directions at once, which is why no separate outbound
+ * gate exists.
+ *
+ * If this node's OWN peer id is in the set, it was itself removed (or it left —
+ * a voluntary departure files the same tombstone). Nothing is torn down for
+ * that: the other side's gate already refuses us, and every other revoked peer
+ * is still swept. Instead `onSelfRevoked` fires ONCE per entry into the set
+ * (re-armed if the party is re-admitted, so a second removal signals again),
+ * which `CadreNode` surfaces as `strand:revoked` so the embedding app decides
+ * what to do — this module never stops or leaves a strand on its own.
+ * Best-effort by nature: a removed party learns only if the tombstone
+ * replicated to it before the cut.
+ *
+ * ## What transfers from the control gater (`membership-connection-gater.ts`)
+ *
+ * Transfers: the two-layer shape (fail-closed per-stream gate as PRIMARY, an
+ * opportunistic connection-level deny on top), the synchronous in-memory
+ * snapshot judged by the stream gate (a live DB read inside a gate deadlocks —
+ * the same argument as the control node's `authorizeInboundControlStream`), the
+ * fail-open-on-error/timeout posture for the connection hooks
+ * (`decideWithinDeadline`, reused as-is), and the "compose over the caller's
+ * gater, every base hook preserved" mechanics.
+ *
+ * Does NOT transfer — the relay-reservation seam (`'admit-for-relay'` + the
+ * unauthorized budget). That machinery exists because the control gate denies on
+ * ABSENCE of placement, where a member whose row is in flight is
+ * indistinguishable from an outsider and a wrong reservation deny is
+ * unrecoverable. This gate denies on POSITIVE revocation evidence, so a
+ * reservation deny is never that kind of wrong answer; the one stale-wrong case
+ * (a missed re-add) heals via replication as above. `denyInboundRelayReservation`
+ * here is therefore a plain "deny iff revoked" — no budget, no admit-for-relay
+ * verdict, no reserve deadline.
+ *
+ * Does NOT transfer — the bring-up quiet period. A strand node's DB bring-up
+ * NEEDS its cross-party cohort connections; this enforcer simply starts with an
+ * empty snapshot (admit everything) until its first successful read — the same
+ * fail-open posture as everywhere else here.
+ *
+ * Does NOT transfer — every stranger carve-out (enrollment window, formation
+ * window, delegate grants). None of those protocols exist on a strand node.
+ *
+ * Unlike the control stream gate, no empty-snapshot carve-out is needed: an
+ * empty deny set means "nothing revoked", which correctly admits everyone — the
+ * deny-list shape makes the cold-start case and the steady case the same code
+ * path.
+ */
+import debug from 'debug';
+import { ADMISSION_DECISION_TIMEOUT_MS, decideWithinDeadline } from './membership-connection-gater.js';
+const log = debug('sereus:cadre:strand-revocation');
+/**
+ * Default cadence of the deny-set refresh. Bounded staleness is the accepted
+ * failure direction (see the module doc's stale-view paragraph); 30 s keeps a
+ * revoked peer's post-replication admit window in the same order as the
+ * replication delay itself. Overridable via
+ * {@link StrandRevocationEnforcementConfig.pollIntervalMs}.
+ */
+export const DEFAULT_REVOCATION_POLL_INTERVAL_MS = 30000;
+const defaultScheduler = {
+    setInterval: (fn, ms) => {
+        const handle = setInterval(fn, ms);
+        handle.unref?.();
+        return handle;
+    },
+    clearInterval: (handle) => clearInterval(handle)
+};
+/** Every `Strand.MemberPeer` binding — live-membered and orphaned alike. */
+async function scanBindings(db) {
+    const bindings = [];
+    for await (const row of db.eval('select MemberKey, PeerId from Strand.MemberPeer')) {
+        bindings.push({ memberKey: row.MemberKey, peerId: row.PeerId });
+    }
+    return bindings;
+}
+/** Every live `Strand.Member.Key`. */
+async function scanMemberKeys(db) {
+    const memberKeys = new Set();
+    for await (const row of db.eval('select Key from Strand.Member')) {
+        memberKeys.add(row.Key);
+    }
+    return memberKeys;
+}
+/**
+ * Read the deny-set inputs from a strand database: full-scan
+ * `Strand.MemberPeer` and `Strand.Member`, to be joined in JavaScript by the
+ * enforcer. Scan-and-filter, never seek — the composite-PK point-lookup
+ * unreliability documented at `scanMemberPeers` in `strand-membership-writer.ts`
+ * applies, so correctness depends only on each scan returning a superset of the
+ * live rows.
+ *
+ * **Scan order is load-bearing, and it is BINDINGS FIRST.** The two scans are
+ * separate reads with nothing holding them to one snapshot, so a write that
+ * lands between them is seen by the second scan and not the first. A member
+ * joins as `Member` row then `MemberPeer` row (`MemberExists` forces that
+ * order), so reading `Member` first would let a join that commits mid-read
+ * produce a binding whose member key is absent from the key set — a brand-new
+ * member classified as REVOKED, the one fail-CLOSED outcome this module exists
+ * to avoid. Reading bindings first inverts the skew: the new binding is simply
+ * not in the older bindings snapshot, so the joiner is unclassified and
+ * admitted, and a revocation that lands mid-read is still seen (the key is
+ * missing from the NEWER key scan). Every skew window then resolves fail-open,
+ * matching the module doc.
+ *
+ * NOTE: two whole-table scans per refresh (default every 30 s per closed
+ * strand). Fine at strand scale (a handful of members and bindings); if
+ * membership churn ever makes these tables large, the fix is a reliable
+ * filtered read — which needs the networked point-lookup gap closed
+ * (`debt-composite-pk-point-lookup-unreliable-untracked`) — not a bigger scan.
+ */
+export async function readStrandRevocationRows(db) {
+    const bindings = await scanBindings(db);
+    const memberKeys = await scanMemberKeys(db);
+    return { memberKeys, bindings };
+}
+/**
+ * The per-strand revoked-peer deny set and the synchronous predicates over it.
+ *
+ * Lifecycle mirrors `PeerJoinBackfill`: created in
+ * `StrandInstanceManager.buildStrandRuntime` (closed strands only), started
+ * after the strand database initializes, stopped and dropped in
+ * `releaseRuntime` — so quiesce → resume rebuilds it with a fresh snapshot.
+ * The snapshot starts EMPTY (admit everything) and repopulates on the first
+ * successful read; a revoked peer therefore gets a short admit window per
+ * resume at the connection level. Accepted: fail-open posture, and resume is
+ * never blocked on a refresh.
+ */
+export class StrandRevocationEnforcer {
+    constructor(deps, config) {
+        this.deps = deps;
+        /** The materialized deny set — peer ids with an orphaned binding and no live one. */
+        this.revokedPeerIds = new Set();
+        /** Tail of the refresh chain — what serializes refreshes (no two reads in flight). */
+        this.refreshTail = Promise.resolve();
+        this.refreshing = false;
+        this.started = false;
+        this.stopped = false;
+        /** Latch for the one-shot self-revocation signal — see {@link StrandRevocationEnforcerDeps.onSelfRevoked}. */
+        this.selfRevokedSignaled = false;
+        this.scheduler = deps.scheduler ?? defaultScheduler;
+        this.pollIntervalMs = config?.pollIntervalMs ?? DEFAULT_REVOCATION_POLL_INTERVAL_MS;
+    }
+    /** Number of peers currently denied — test/diagnostic surface. */
+    get revokedCount() {
+        return this.revokedPeerIds.size;
+    }
+    /** Kick an immediate refresh (not awaited — bring-up never blocks on it) and arm the poll. */
+    start() {
+        if (this.started || this.stopped)
+            return;
+        this.started = true;
+        void this.refresh();
+        this.intervalHandle = this.scheduler.setInterval(() => {
+            // Skip a tick while a refresh is in flight rather than queueing behind it —
+            // the interval exists to bound staleness, and a stack of queued reads
+            // bounds nothing extra. Explicit refresh() calls still chain (see refresh).
+            if (!this.refreshing) {
+                void this.refresh();
+            }
+        }, this.pollIntervalMs);
+        log('[%s] revocation enforcer started (poll %dms)', this.deps.label, this.pollIntervalMs);
+    }
+    /** Disarm the poll; a read already in flight completes but its result is discarded. */
+    stop() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        if (this.intervalHandle != null) {
+            this.scheduler.clearInterval(this.intervalHandle);
+            this.intervalHandle = undefined;
+        }
+        log('[%s] revocation enforcer stopped', this.deps.label);
+    }
+    /**
+     * Refresh the deny set now. Never rejects. Serialized: concurrent calls chain,
+     * so no two reads overlap, and each explicit call gets a read that STARTS
+     * after the call (an on-demand refresh after a revocation commit observes that
+     * commit). A failed or slow read keeps the previous snapshot — never clears it.
+     */
+    refresh() {
+        const run = this.refreshTail.then(() => this.doRefresh());
+        this.refreshTail = run;
+        return run;
+    }
+    /**
+     * Is `remotePeerId` positively revoked in the current snapshot? Synchronous by
+     * design — this is judged inside libp2p gates where an await against the DB
+     * would deadlock (the control stream gate's argument).
+     */
+    isRevoked(remotePeerId) {
+        return this.revokedPeerIds.has(remotePeerId);
+    }
+    /**
+     * The fail-closed PRIMARY layer: the per-stream predicate wired as
+     * `createLibp2pNode({ authorizeInboundStream })`, gating all four
+     * `/optimystic/strand-<id>/{repo,cluster,sync,block-transfer}` protocols.
+     * Also what catches a revoked peer arriving over a RELAYED connection, or
+     * over a connection admitted before the revocation replicated here.
+     */
+    authorizeStream(remotePeerId, _protocol) {
+        return !this.isRevoked(remotePeerId);
+    }
+    /**
+     * One serialized snapshot rebuild; contains every failure (contract: never rejects).
+     *
+     * NOTE: nothing here carries a deadline — a `readRows` or a `hangUp` that never
+     * settles wedges the refresh chain, which freezes the deny set (the poll skips
+     * while `refreshing`, and every later `refresh()` chains behind the stuck one).
+     * Both are bounded in practice (Quereus reads settle; libp2p's connection close
+     * has its own timeout). If a strand is ever seen with a stale deny set and no
+     * refresh log line, wrap both awaits in a timeout rather than hunting further.
+     */
+    async doRefresh() {
+        if (this.stopped)
+            return;
+        this.refreshing = true;
+        try {
+            const rows = await this.deps.readRows();
+            if (this.stopped)
+                return;
+            this.revokedPeerIds = deriveRevokedPeerIds(rows);
+            log('[%s] deny set refreshed: %d revoked peer(s)', this.deps.label, this.revokedPeerIds.size);
+            // Awaited inside the refresh, so an on-demand refresh() resolves only once
+            // the cut has been made — that is what makes "revoke, then refresh" an
+            // immediate teardown for the caller rather than a scheduled one.
+            await this.tearDownRevoked(this.revokedPeerIds);
+        }
+        catch (error) {
+            log('[%s] deny-set refresh failed — keeping previous snapshot: %o', this.deps.label, error);
+        }
+        finally {
+            this.refreshing = false;
+        }
+    }
+    /**
+     * Close what is already OPEN to the peers of `revoked` — the teardown half of
+     * enforcement (module doc: "Removal cuts LIVE sessions too"). Never rejects:
+     * every failure is contained, so the refresh loop survives and simply retries
+     * on the next tick.
+     *
+     * `revoked` is passed IN rather than read off the field, so the sweep judges
+     * the exact snapshot its own refresh produced; likewise the connection list is
+     * enumerated once, before any await, so a peer re-admitted mid-sweep is at
+     * worst hung up once and reconnects.
+     *
+     * NOTE: dropping the revoked peer from the strand's Optimystic cohort needs no
+     * separate action — machines quiesce strands routinely and the remaining cohort
+     * keeps committing, so an unreachable cohort peer is already tolerated, and
+     * `denyDialPeer` makes the exclusion fast (a local refusal, not a dial timeout).
+     * Two residual facts, both accepted: the removed node keeps every block it had
+     * already replicated (revocation is forward-looking), and a block whose only
+     * holders were the removed party's machines can be unavailable to the rest
+     * until repair.
+     *
+     * NOTE: post-removal commit latency is real and MEASURED, not hypothetical. On
+     * the two-parties-by-two-machines fixture in
+     * `integration-tests/src/scenarios/strand-removal-cuts-network.integration.ts`
+     * the remaining cohort's FIRST write after a cut fails repeatedly with
+     * `BlockUnavailableError: … (peers-unreachable)` before it commits — three or
+     * four failures, 3.5-4.3 s, over four runs — because the cohort still listed
+     * the removed party's now unreachable machines and had to downsize to the
+     * live holders first. It
+     * recovers on its own, so this is a latency cost, not a defect, and it is
+     * stated for app authors in `docs/strands.md` → Removing Members. If it ever
+     * stops recovering — a write that never commits, or `cluster-fetch:no-quorum` —
+     * that is an upstream (Optimystic) conversation, not a workaround here.
+     */
+    async tearDownRevoked(revoked) {
+        if (this.stopped) {
+            return;
+        }
+        const network = this.resolveNetwork();
+        if (!network) {
+            return;
+        }
+        const selfPeerId = network.peerId.toString();
+        // Judged on EVERY pass, including the empty-set one: leaving the set is what
+        // re-arms the signal (see trackSelfRevoked). Being revoked ourselves tears
+        // nothing down on our own behalf — the other side's gate already refuses us —
+        // so the sweep below still runs for every OTHER revoked peer in the pass.
+        this.trackSelfRevoked(revoked.has(selfPeerId));
+        if (revoked.size === 0) {
+            return;
+        }
+        for (const peer of connectedRevokedPeers(network, revoked, selfPeerId, this.deps.label)) {
+            await this.hangUpRevoked(network, peer);
+        }
+    }
+    /** The lazily-read network handle; an accessor that throws costs this pass only. */
+    resolveNetwork() {
+        try {
+            return this.deps.getNetwork?.();
+        }
+        catch (error) {
+            log('[%s] network handle unavailable — teardown skipped this pass: %o', this.deps.label, error);
+            return undefined;
+        }
+    }
+    /** One hangUp, contained: a stopping node or an already-closed connection is not an error here. */
+    async hangUpRevoked(network, peer) {
+        try {
+            await network.hangUp(peer);
+            log('[%s] hung up revoked peer %s', this.deps.label, peer.toString());
+        }
+        catch (error) {
+            log('[%s] hangUp of revoked peer %s failed — next refresh retries: %o', this.deps.label, peer.toString(), error);
+        }
+    }
+    /**
+     * Latch {@link StrandRevocationEnforcerDeps.onSelfRevoked} to the TRANSITION
+     * into the revoked state: fired once on entry, and re-armed the moment this
+     * node is out of the set again — a manager can re-admit a party it removed
+     * (a fresh `Member` row makes the orphaned bindings live again), and a second
+     * removal has to be reported like the first.
+     */
+    trackSelfRevoked(selfRevoked) {
+        if (!selfRevoked) {
+            this.selfRevokedSignaled = false;
+            return;
+        }
+        if (this.selfRevokedSignaled) {
+            return;
+        }
+        this.selfRevokedSignaled = true;
+        log('[%s] THIS node is revoked from the strand (removed or left) — signalling', this.deps.label);
+        try {
+            this.deps.onSelfRevoked?.();
+        }
+        catch (error) {
+            log('[%s] onSelfRevoked handler threw: %o', this.deps.label, error);
+        }
+    }
+}
+/**
+ * The distinct peer ids of `network`'s open connections that are in `revoked`,
+ * as the `PeerId` objects `hangUp` takes — reusing each connection's own
+ * `remotePeer` rather than parsing the string back, so no peer-id codec is
+ * needed here. Self is excluded (a node holds no connection to itself, and
+ * hanging one up would be nonsense if it did), and a peer connected twice — say
+ * one direct and one relayed — yields ONE hangUp, which closes both. A throw
+ * mid-enumeration is logged and keeps whatever was collected before it: a
+ * partial sweep beats none, and the next refresh re-enumerates anyway.
+ */
+function connectedRevokedPeers(network, revoked, selfPeerId, label) {
+    const targets = new Map();
+    try {
+        for (const connection of network.getConnections()) {
+            const remotePeerId = connection.remotePeer.toString();
+            if (remotePeerId !== selfPeerId && revoked.has(remotePeerId)) {
+                targets.set(remotePeerId, connection.remotePeer);
+            }
+        }
+    }
+    catch (error) {
+        log('[%s] connection enumeration failed — teardown skipped this pass: %o', label, error);
+    }
+    return [...targets.values()];
+}
+/**
+ * Derive the deny set: a peer id is revoked iff it has at least one ORPHANED
+ * binding (a `MemberPeer` row whose member key has no live `Member` row) AND no
+ * live-membered binding. The second conjunct is what lets a peer id bound to
+ * TWO member keys — revoked under one, live under the other — keep serving the
+ * live member: a machine serving a live member must not be cut. Per-binding,
+ * not per-member, so every machine of a multi-device removed party lands in
+ * the set.
+ */
+function deriveRevokedPeerIds(rows) {
+    const orphaned = new Set();
+    const live = new Set();
+    for (const binding of rows.bindings) {
+        (rows.memberKeys.has(binding.memberKey) ? live : orphaned).add(binding.peerId);
+    }
+    for (const peerId of live) {
+        orphaned.delete(peerId);
+    }
+    return orphaned;
+}
+/**
+ * Build a closed strand's connection gater: the caller-supplied gater (if any)
+ * with revoked-peer denial composed onto three hooks. The opportunistic
+ * SECONDARY layer — the per-stream gate above is the fail-closed primary.
+ *
+ *  - `denyInboundEncryptedConnection`: deny iff revoked, so a removed party's
+ *    node is refused before any protocol negotiation.
+ *  - `denyDialPeer`: deny iff revoked — the owner ruling covers "communicated
+ *    with", not just "answered to", and refusing the dial locally is instant,
+ *    which keeps Optimystic from wasting a dial timeout on a peer this node
+ *    will not talk to anyway.
+ *  - `denyInboundRelayReservation`: deny iff revoked — matters when the strand
+ *    node runs the relay server (the storage-profile default), where admitting
+ *    the reservation would let a removed party keep using this node's
+ *    forwarding capacity.
+ *
+ * Composition semantics: every hook of `base` is preserved as-is; on the three
+ * composed hooks a deny from EITHER the base gater or the revocation check
+ * denies, and an error (or a decision slower than `decisionTimeoutMs`) in
+ * either is fail-open — the base error admits through to the revocation check,
+ * a revocation-check error admits outright, and the fail-closed stream gate
+ * still stands behind both. The deadline is belt-and-braces: the snapshot read
+ * is synchronous.
+ *
+ * NOTE: accepted tradeoff — swallowing a BASE hook's throw diverges from
+ * `createMembershipConnectionGater`, which lets it propagate to libp2p (a
+ * fail-closed outcome there). Uniform fail-open was chosen for this module so
+ * every hook has one failure direction, and it was the shape the plan specified;
+ * the cost is that an embedder gater which throws is silently admitted here
+ * while the same gater passed raw to an OPEN strand would refuse. Loud in the
+ * log either way. Revisit if an embedder ever ships a gater whose throw is a
+ * meaningful deny, or if the two gaters are unified.
+ *
+ * NOTE: `base` is spread, so a gater passed as a CLASS INSTANCE would lose its
+ * prototype methods — same caveat as `createMembershipConnectionGater`; every
+ * caller in this repo supplies a plain object (the RN/web permissive gaters,
+ * e.g. `{ denyDialMultiaddr: () => false }`, keep working unchanged).
+ */
+export function createRevocationConnectionGater(enforcer, base, decisionTimeoutMs = ADMISSION_DECISION_TIMEOUT_MS) {
+    /** The base gater's verdict, fail-open: an error or absence is "not denied". */
+    const baseDenies = async (decide, hook) => {
+        try {
+            return await decide() === true;
+        }
+        catch (error) {
+            log('base gater %s threw — treating as not-denied (fail-open): %o', hook, error);
+            return false;
+        }
+    };
+    /** The revocation verdict, bounded and fail-open. */
+    const revokedDenies = async (peerId, hook) => {
+        const remotePeerId = peerId.toString();
+        try {
+            const revoked = await decideWithinDeadline(() => enforcer.isRevoked(remotePeerId), false, decisionTimeoutMs, `${hook}(${remotePeerId})`);
+            if (revoked) {
+                log('%s: %s is revoked — denying', hook, remotePeerId);
+            }
+            return revoked;
+        }
+        catch (error) {
+            log('%s revocation check threw for %s — admitting (fail-open; stream gate decides): %o', hook, remotePeerId, error);
+            return false;
+        }
+    };
+    return {
+        ...base,
+        denyDialPeer: async (peerId) => {
+            if (await baseDenies(() => base?.denyDialPeer?.(peerId), 'denyDialPeer')) {
+                return true;
+            }
+            return revokedDenies(peerId, 'denyDialPeer');
+        },
+        denyInboundEncryptedConnection: async (peerId, maConn) => {
+            if (await baseDenies(() => base?.denyInboundEncryptedConnection?.(peerId, maConn), 'denyInboundEncryptedConnection')) {
+                return true;
+            }
+            return revokedDenies(peerId, 'denyInboundEncryptedConnection');
+        },
+        denyInboundRelayReservation: async (peerId) => {
+            if (await baseDenies(() => base?.denyInboundRelayReservation?.(peerId), 'denyInboundRelayReservation')) {
+                return true;
+            }
+            return revokedDenies(peerId, 'denyInboundRelayReservation');
+        }
+    };
+}
+//# sourceMappingURL=strand-revocation-enforcer.js.map

package/dist/strand-revocation-enforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-revocation-enforcer.js","sourceRoot":"","sources":["../src/strand-revocation-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmHG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,6BAA6B,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAEvG,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,KAAM,CAAC;AA0C1D,MAAM,gBAAgB,GAA+B;IACnD,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAiC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAA6C,CAAC;CACxF,CAAC;AAmDF,4EAA4E;AAC5E,KAAK,UAAU,YAAY,CAAC,EAAY;IACtC,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,iDAAiD,CAAC,EAAE,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAmB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAgB,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sCAAsC;AACtC,KAAK,UAAU,cAAc,CAAC,EAAY;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACjE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAY;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IAcnC,YACmB,IAAkC,EACnD,MAA0C;QADzB,SAAI,GAAJ,IAAI,CAA8B;QAdrD,qFAAqF;QAC7E,mBAAc,GAAwB,IAAI,GAAG,EAAE,CAAC;QAGxD,sFAAsF;QAC9E,gBAAW,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/C,eAAU,GAAG,KAAK,CAAC;QAEnB,YAAO,GAAG,KAAK,CAAC;QAChB,YAAO,GAAG,KAAK,CAAC;QACxB,8GAA8G;QACtG,wBAAmB,GAAG,KAAK,CAAC;QAMlC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,mCAAmC,CAAC;IACtF,CAAC;IAED,kEAAkE;IAClE,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,8FAA8F;IAC9F,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE;YACpD,4EAA4E;YAC5E,sEAAsE;YACtE,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,GAAG,CAAC,8CAA8C,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5F,CAAC;IAED,uFAAuF;IACvF,IAAI;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,YAAoB;QAC5B,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,YAAoB,EAAE,SAAiB;QACrD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACjD,GAAG,CAAC,6CAA6C,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAC9F,2EAA2E;YAC3E,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,8DAA8D,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9F,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACK,KAAK,CAAC,eAAe,CAAC,OAA4B;QACxD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7C,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,0EAA0E;QAC1E,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,oFAAoF;IAC5E,cAAc;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,kEAAkE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAChG,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,aAAa,CAAC,OAAgC,EAAE,IAAY;QACxE,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,kEAAkE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,WAAoB;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,GAAG,CAAC,0EAA0E,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjG,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,sCAAsC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,OAAgC,EAChC,OAA4B,EAC5B,UAAkB,EAClB,KAAa;IAEb,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,CAAC;QACH,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtD,IAAI,YAAY,KAAK,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,qEAAqE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,IAA0B;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAA+B,EAC/B,IAAsB,EACtB,oBAA4B,6BAA6B;IAEzD,gFAAgF;IAChF,MAAM,UAAU,GAAG,KAAK,EAAE,MAAoD,EAAE,IAAY,EAAoB,EAAE;QAChH,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,EAAE,KAAK,IAAI,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,8DAA8D,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,qDAAqD;IACrD,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAAoB,EAAE;QAC7E,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,IAAI,YAAY,GAAG,CAC7F,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,mFAAmF,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACpH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACvD,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC/C,CAAC;QACD,8BAA8B,EAAE,KAAK,EAAE,MAAc,EAAE,MAA2B,EAAoB,EAAE;YACtG,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,8BAA8B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,gCAAgC,CAAC,EAAE,CAAC;gBACrH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;QACjE,CAAC;QACD,2BAA2B,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACtE,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,2BAA2B,EAAE,CAAC,MAAM,CAAC,EAAE,6BAA6B,CAAC,EAAE,CAAC;gBACvG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/strand-solicitation.d.ts

@@ -1,5 +1,5 @@
 import type { Libp2p } from '@libp2p/interface';
-import type { OpenInvitation, FormStrandResult, StrandFormationDisclosure } from './types.js';
+import type { OpenInvitation, FormStrandResult, StrandFormationDisclosure, StrandMembershipInvite } from './types.js';
 import { type StrandFormationManagerConfig } from './strand-formation-manager.js';
 import { type FormationResultMessage } from './strand-formation-protocol.js';
 /**
@@ -164,6 +164,20 @@ export interface StrandSolicitationServiceOptions {
     partyId?: string;
     /** Cadre peer addresses for this node */
     cadrePeerAddrs?: string[];
+    /**
+     * This node's live STRAND-network multiaddrs for a strand it is running (responder
+     * side), carried back to a validated joiner as its cross-party discovery seed. Wired
+     * by `CadreNode`; unwired, the responder discloses no strand addresses.
+     */
+    resolveStrandAddrs?: (strandId: string) => string[];
+    /**
+     * Issue a single-use strand membership invitation against the live host strand a
+     * bound closed-strand redemption resolved to (responder side). Wired by `CadreNode`;
+     * see `StrandFormationManagerOptions.issueMembershipInvite` for the full contract
+     * (null = open strand, throw = reject the redemption retryably, unwired = mock/test
+     * posture: approve with no invitation).
+     */
+    issueMembershipInvite?: (strandId: string) => Promise<StrandMembershipInvite | null>;
     /** Configuration for the formation manager */
     formationConfig?: StrandFormationManagerConfig;
 }
@@ -187,6 +201,8 @@ export declare class StrandSolicitationService {
     private readonly formationResponseValidator?;
     private readonly partyId;
     private readonly cadrePeerAddrs;
+    private readonly resolveStrandAddrs?;
+    private readonly issueMembershipInvite?;
     private formationManager?;
     private readonly formationConfig?;
     /**

package/dist/strand-solicitation.js

@@ -58,6 +58,8 @@ export class StrandSolicitationService {
         this.formationResponseValidator = options?.formationResponseValidator;
         this.partyId = options?.partyId ?? `party-${Date.now()}`;
         this.cadrePeerAddrs = options?.cadrePeerAddrs ?? [];
+        this.resolveStrandAddrs = options?.resolveStrandAddrs;
+        this.issueMembershipInvite = options?.issueMembershipInvite;
         this.formationConfig = options?.formationConfig;
         log('StrandSolicitationService created for party: %s', this.partyId);
     }
@@ -74,6 +76,8 @@ export class StrandSolicitationService {
                 formationResponseValidator: this.formationResponseValidator,
                 partyId: this.partyId,
                 cadrePeerAddrs: this.cadrePeerAddrs,
+                resolveStrandAddrs: this.resolveStrandAddrs,
+                issueMembershipInvite: this.issueMembershipInvite,
                 config: this.formationConfig
             });
         }
@@ -138,7 +142,12 @@ export class StrandSolicitationService {
                 strandId: result.strandId,
                 // Carry the host strand's membership key delivered over the protocol (closed-strand
                 // provision-then-record). invitePrivateKey stays the initiator's generated signing key.
-                memberPrivateKey: result.memberPrivateKey
+                memberPrivateKey: result.memberPrivateKey,
+                // The joiner's own single-use membership invitation into a closed host strand
+                // (already shape-checked by the manager); absent for open/unbound.
+                membershipInvite: result.membershipInvite,
+                // The responder's live strand-network addresses, or `[]` when it had none to give.
+                strandAddrs: result.strandAddrs
             };
         }
         // Fallback: placeholder strandId (for testing without network)
@@ -147,7 +156,9 @@ export class StrandSolicitationService {
         return {
             memberKey,
             invitePrivateKey,
-            strandId
+            strandId,
+            // No wire, so nothing was disclosed — an empty seed, never absent.
+            strandAddrs: []
         };
     }
     /**

package/dist/strand-solicitation.js.map

@@ -1 +1 @@
-{"version":3,"file":"strand-solicitation.js","sourceRoot":"","sources":["../src/strand-solicitation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AAMzD,sFAAsF;AACtF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAiJ/C;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC;IACrD,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;YACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAAyB;IAsBpC,YAAY,OAA0C;QAbtD;;;;;;;;;;WAUG;QACc,sBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAG7D,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,CAAC;QACxD,IAAI,CAAC,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,0BAA0B,GAAG,OAAO,EAAE,0BAA0B,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAChD,GAAG,CAAC,iDAAiD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,sBAAsB,CAAC;gBACjD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;gBAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY;QAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACnD,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,IAAI,CAAC,mBAAmB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,IAAa;QAEb,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAE5C,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEvE,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;QAE3C,2CAA2C;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,6CAA6C,CAAC,CAAC;YACnD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,2EAA2E;YAC3E,gFAAgF;YAChF,4EAA4E;YAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CACxB,uBAAuB,CAAC;gBACtB,KAAK;gBACL,YAAY;gBACZ,OAAO,EAAE,YAAY;gBACrB,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC;aAC1C,CAAC,EACF,aAAa,EACb,SAAS,EACT,OAAO,EACP,WAAW,EACX,WAAW,CACF,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,UAAU,CACxD,UAAU,EACV,cAAc,EACd,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,EACtD,IAAI,CACL,CAAC;YACF,OAAO;gBACL,SAAS;gBACT,gBAAgB;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,oFAAoF;gBACpF,wFAAwF;gBACxF,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAElF,OAAO;YACL,SAAS;YACT,gBAAgB;YAChB,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,YAAoB,EACpB,SAAmB;QAEnB,0BAA0B;QAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3D,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjF,OAAO;YACL,KAAK;YACL,MAAM;YACN,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAa,EAAE,WAAmB;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1D,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACpF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,OAAe,EACf,QAAgB,EAChB,OAAwD,EACxD,UAAU,GAAG,EAAE;QAEf,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC5C,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ;gBACR,UAAU;aACX,CAAC,CAAC;YACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"strand-solicitation.js","sourceRoot":"","sources":["../src/strand-solicitation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AAOzD,sFAAsF;AACtF,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EAEvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAE9B,MAAM,gCAAgC,CAAC;AAExC,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAiJ/C;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC;IACrD,OAAO;QACL,KAAK,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;YACjC,OAAO,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AA8BD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAAyB;IAwBpC,YAAY,OAA0C;QAbtD;;;;;;;;;;WAUG;QACc,sBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAG7D,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,CAAC;QACxD,IAAI,CAAC,sBAAsB,GAAG,OAAO,EAAE,sBAAsB,CAAC;QAC9D,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;QACpD,IAAI,CAAC,0BAA0B,GAAG,OAAO,EAAE,0BAA0B,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,SAAS,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,kBAAkB,GAAG,OAAO,EAAE,kBAAkB,CAAC;QACtD,IAAI,CAAC,qBAAqB,GAAG,OAAO,EAAE,qBAAqB,CAAC;QAC5D,IAAI,CAAC,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAChD,GAAG,CAAC,iDAAiD,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,mBAAmB;QACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,sBAAsB,CAAC;gBACjD,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,sBAAsB,EAAE,IAAI,CAAC,sBAAsB;gBACnD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;gBAC3D,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,MAAM,EAAE,IAAI,CAAC,eAAe;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,IAAY;QAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACnD,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,IAAY;QAC9B,IAAI,CAAC,mBAAmB,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CACd,UAA0B,EAC1B,UAAqC,EACrC,IAAa;QAEb,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAC/B,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAE5C,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAEvE,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAC;QAE3C,2CAA2C;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,6CAA6C,CAAC,CAAC;YACnD,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;YAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,2EAA2E;YAC3E,gFAAgF;YAChF,4EAA4E;YAC5E,MAAM,cAAc,GAAG,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7D,MAAM,aAAa,GAAG,IAAI,CACxB,uBAAuB,CAAC;gBACtB,KAAK;gBACL,YAAY;gBACZ,OAAO,EAAE,YAAY;gBACrB,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC;aAC1C,CAAC,EACF,aAAa,EACb,SAAS,EACT,OAAO,EACP,WAAW,EACX,WAAW,CACF,CAAC;YACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC,UAAU,CACxD,UAAU,EACV,cAAc,EACd,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,EACtD,IAAI,CACL,CAAC;YACF,OAAO;gBACL,SAAS;gBACT,gBAAgB;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,oFAAoF;gBACpF,wFAAwF;gBACxF,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,8EAA8E;gBAC9E,mEAAmE;gBACnE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,mFAAmF;gBACnF,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAElF,OAAO;YACL,SAAS;YACT,gBAAgB;YAChB,QAAQ;YACR,mEAAmE;YACnE,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,YAAoB,EACpB,SAAmB;QAEnB,0BAA0B;QAC1B,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3D,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAEjF,OAAO;YACL,KAAK;YACL,MAAM;YACN,UAAU;YACV,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB,CAAC,KAAa,EAAE,WAAmB;QACzD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC/C,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,wBAAwB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1D,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;gBACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,wBAAwB,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IACpF,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,OAAe,EACf,QAAgB,EAChB,OAAwD,EACxD,UAAU,GAAG,EAAE;QAEf,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC5C,KAAK;gBACL,OAAO;gBACP,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ;gBACR,UAAU;aACX,CAAC,CAAC;YACH,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}