@serfab/cadre-core 0.7.1 → 0.9.0

package/dist/control-database.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-database.js","sourceRoot":"","sources":["../src/control-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,YAAY,MAAM,0CAA0C,CAAC;AACpE,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAKxE,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAE5C;;;;GAIG;AACH,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAgGI,CAAC;AAE5B;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,qDAAqD;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAe,CAAC;IAC3E,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/C,2BAA2B;IAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAe,CAAC;IAE3D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE7B,uBAAuB;IACvB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAkCD;;;GAGG;AACH,MAAM,OAAO,eAAe;IAM1B,YAAY,MAA6B;QALjC,OAAE,GAAoB,IAAI,CAAC;QAC3B,sBAAiB,GAA6B,IAAI,CAAC;QAEnD,gBAAW,GAAG,KAAK,CAAC;QAG1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvE,2BAA2B;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,mEAAmE;QACnE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,gCAAgC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEhC,gEAAgE;QAChE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7C,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,QAAQ;YAC7B,oBAAoB,EAAE,WAAW;YACjC,YAAY,EAAE,IAAI;SACnB,CAA2B,CAAC;QAE7B,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAqE,EAAE,CAAC;YACxG,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAuC,EAAE,CAAC;YACxE,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAa,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAEjF,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QAExD,qDAAqD;QACrD,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CACvC,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;QACF,MAAM,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAEtD,8BAA8B;QAC9B,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0CAA0C;YAC1C,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5D,0CAA0C;YAC1C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,uDAAuD;oBACvD,wDAAwD;oBACxD,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;oBAClC,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClH,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC7D,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACrC,aAAa,GAAG,cAAc,CAAC;QACjC,CAAC;QAED,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,EAAE,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAAW;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAExC,+EAA+E;QAC/E,8DAA8D;QAC9D,oFAAoF;QACpF,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACV,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAAe,EACf,YAAoB,EACpB,WAAwC,EACxC,gBAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,iCAAiC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEvD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,2CAA2C;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,kCAAkC;QAClC,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC;QAEjF,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"control-database.js","sourceRoot":"","sources":["../src/control-database.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,YAAY,MAAM,0CAA0C,CAAC;AACpE,OAAO,gBAAgB,MAAM,8CAA8C,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAIxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE/C,2BAA2B;IAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAe,CAAC;IAE3D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE7B,uBAAuB;IACvB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAsB;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAgB;IACxD,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;AAC9D,CAAC;AA2CD,iFAAiF;AACjF,MAAM,cAAc,GAA8B,IAAI,GAAG,CAAe;IACtE,UAAU;IACV,eAAe;IACf,QAAQ;IACR,WAAW;IACX,aAAa;IACb,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAiBH;;;GAGG;AACH,MAAM,OAAO,eAAe;IAM1B,YAAY,MAA6B;QALjC,OAAE,GAAoB,IAAI,CAAC;QAC3B,sBAAiB,GAA6B,IAAI,CAAC;QAEnD,gBAAW,GAAG,KAAK,CAAC;QAG1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvE,2BAA2B;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;QAEzB,mEAAmE;QACnE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,CAAC,gCAAgC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7E,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEhC,gEAAgE;QAChE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,WAAW,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE;YAC7C,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,QAAQ;YAC7B,oBAAoB,EAAE,WAAW;YACjC,YAAY,EAAE,IAAI;SACnB,CAAsC,CAAC;QAExC,oFAAoF;QACpF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAEjF,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC;QAExD,qDAAqD;QACrD,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CACvC,WAAW,EACX,IAAI,CAAC,MAAM,CAAC,UAAU,EACtB,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;QACF,MAAM,CAAC,sCAAsC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAEtD,iFAAiF;QACjF,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,8EAA8E;QAC9E,8EAA8E;QAC9E,gEAAgE;QAChE,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC;YACzB,WAAW;YACX,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,qEAAqE,EAAE,WAAW,CAAC,CAAC;QAExF,8EAA8E;QAC9E,+EAA+E;QAC/E,iFAAiF;QACjF,+EAA+E;QAC/E,mEAAmE;QACnE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,mDAAmD,EACxD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzE,GAAG,CAAC,kDAAkD,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3F,8BAA8B;QAC9B,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,aAAqB,CAAC;QAE1B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,wEAAwE;YACxE,0CAA0C;YAC1C,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAE5D,0CAA0C;YAC1C,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,wDAAwD;oBACxD,oEAAoE;oBACpE,iEAAiE;oBACjE,mEAAmE;oBACnE,iEAAiE;oBACjE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;oBAClC,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,KAAK,CACb,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CACb,6DAA6D;oBAC7D,kEAAkE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACrC,aAAa,GAAG,cAAc,CAAC;QACjC,CAAC;QAED,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,EAAE,CAAC;YACpG,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB;QAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,yEAAyE,EACzE,CAAC,QAAQ,CAAC,CACX,EAAE,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAY;gBACpB,gBAAgB,EAAE,GAAG,CAAC,gBAAiC;gBACvD,IAAI,EAAE,GAAG,CAAC,IAAiB;aAC5B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CAAC,KAAmB;QACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,8CAA8C,KAAK,EAAE,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;OAEG;IACH,WAAW;QACT,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,EAAG,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,EAAE,CAAC;YAC7F,OAAQ,GAAG,CAAC,KAAgB,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,oDAAoD,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAa,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAoI,EAAE,CAAC;QACjJ,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,qFAAqF,CAAC,EAAE,CAAC;YAC7H,IAAI,CAAC,IAAI,CAAC;gBACR,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,OAAO,EAAG,GAAG,CAAC,OAAyB,IAAI,IAAI;gBAC/C,UAAU,EAAG,GAAG,CAAC,UAA4B,IAAI,IAAI;gBACrD,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC,6DAA6D,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC/G,OAAQ,GAAG,CAAC,OAAyB,IAAI,IAAI,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,kGAAkG,EAClG,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,MAAM,SAAS,GAAI,GAAG,CAAC,SAA2B,IAAI,EAAE,CAAC;YACzD,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,EAAE;gBACjD,KAAK,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvD,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;aACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAyB;QAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;KAKnB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,GAAG,CAAC,6CAA6C,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,+FAA+F,EAC/F,CAAC,MAAM,CAAC,CACT,EAAE,CAAC;YACF,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAkB,IAAI,EAAE,CAAiB;gBACxD,KAAK,EAAG,GAAG,CAAC,KAAuB,IAAI,EAAE;gBACzC,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,CAAC;gBAChD,GAAG,EAAG,GAAG,CAAC,GAAqB,IAAI,EAAE;aACtC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAyB;QACnD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;;KAKnB,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,GAAG,CAAC,2DAA2D,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAEpC,iFAAiF;QACjF,qFAAqF;QACrF,uFAAuF;QACvF,2EAA2E;QAC3E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAAe,EACf,QAAgB,EAChB,WAA4C,EAC5C,gBAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,iCAAiC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEvD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,kEAAkE;QAClE,sDAAsD;QACtD,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,wFAAwF;QACxF,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAE7E,GAAG,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,mBAAmB,CACvB,GAAW,EACX,QAAgB,EAChB,WAA4C;QAE5C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAExC,uFAAuF;QACvF,MAAM,OAAO,GAAG,yBAAyB,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAExC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,KAAK,CAAC,qBAAqB,CACzB,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,WAA4C,EAC5C,UAAmG,EAAE;QAErG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE1E,8EAA8E;QAC9E,oFAAoF;QACpF,sEAAsE;QACtE,iGAAiG;QACjG,gDAAgD;QAChD,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI;YACpD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,kBAAkB,IAAI,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;QAE7C,sFAAsF;QACtF,yEAAyE;QACzE,MAAM,OAAO,GAAG,yBAAyB,CAAC;YACxC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,OAAO;SAC1F,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,qFAAqF;QACrF,oFAAoF;QACpF,qEAAqE;QACrE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE;YACD,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,MAAM;YACb,kBAAkB;YAClB,OAAO,CAAC,SAAS,IAAI,IAAI;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI;YAC7B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,OAAO;SACR,CAAC,CAAC;QAEH,GAAG,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAWtB;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,GAAG,EAC3B,gBAAgB,EAAE,UAAU,GAAG,EAAE,EACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,EAAE,mBAAmB,GAC1C,GAAG,MAAM,CAAC;QACX,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,aAAa,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,EAAG,CAAC,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;OAInB,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAI,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;YAE9D,sEAAsE;YACtE,MAAM,IAAI,CAAC,wBAAwB,CAAC;gBAClC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ;gBACtC,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC/F,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;aACvF,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,EAAG,CAAC,MAAM,EAAE,CAAC;YACxB,GAAG,CAAC,+CAA+C,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4EAA4E;YAC5E,6EAA6E;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,mDAAmD,EAAE,aAAa,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAS1B;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,EACJ,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,EAAE,EAChC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,GACjE,GAAG,MAAM,CAAC;QAEX,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,wBAAwB,CAAC;YAClC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ;YACtC,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/F,aAAa,EAAE,aAAa,IAAI,IAAI,EAAE,mBAAmB,EAAE,mBAAmB,IAAI,IAAI;SACvF,CAAC,CAAC;QAEH,GAAG,CAAC,wDAAwD,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,wBAAwB,CAAC,IAUtC;QACC,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,+EAA+E;QAC/E,8EAA8E;QAC9E,8EAA8E;QAC9E,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,EAAG,CAAC,IAAI,CAAC;;;;KAInB,EAAE;YACD,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY;YAC7C,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,mBAAmB;YAC5C,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAQtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,uHAAuH,EACvH,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,MAAM,SAAS,GAAG,GAAG,CAAC,SAAmC,CAAC;YAC1D,MAAM,WAAW,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS;gBAC/D,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,KAAe;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAgB;gBAC5B,WAAW,EAAE,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW;gBACnF,SAAS,EAAG,GAAG,CAAC,SAA2B,IAAI,IAAI;gBACnD,aAAa,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;gBAC3D,QAAQ,EAAG,GAAG,CAAC,QAA0B,IAAI,IAAI;aAClD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,2EAA2E,EAC3E,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,IAAI,CAAC,EAAG,CAAC,IAAI,CACnC,+FAA+F,EAC/F,CAAC,KAAK,CAAC,CACR,EAAE,CAAC;YACF,OAAQ,GAAG,CAAC,MAAiB,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}

package/dist/control-formation-recorder.d.ts

@@ -0,0 +1,89 @@
+import type { ControlDatabase } from './control-database.js';
+import type { FormationUsageRecorder, ResolvedHostStrand } from './strand-solicitation.js';
+import type { OpenInvitation } from './types.js';
+/**
+ * {@link FormationUsageRecorder} backed by the real `CadreControl` tables.
+ *
+ * It reads `FormationInvite` / `FormationUsage` to answer token-validity and
+ * usage questions, and writes the consent row that records a redemption. Two
+ * provisioning shapes are supported, keyed on whether the invite binds a host strand:
+ *
+ * - **Bound (provision-then-record):** the host strand already exists (owner-signed
+ *   up front and named by the invite's `StrandId`), so {@link resolveStrand} reports it
+ *   and {@link recordUsage} writes the consent row against that pre-existing strand
+ *   (record-only) rather than inserting a new `Strand`.
+ * - **Unbound (responder-provisions):** the invite carries no `StrandId`, so
+ *   {@link provisionAndRecord} mints a fresh strand and records consent against it
+ *   ATOMICALLY (one `FormationUsage` row), closing the single-use hole the older
+ *   never-record fallback left open.
+ *
+ * This replaces the in-memory stubs used by the formation tests so the consent path
+ * is exercised against the persisted control network.
+ *
+ * Usage accounting follows the schema's `FormationUsage.Authorized` semantics:
+ * a null `TotalUses` means unlimited uses; otherwise the invite is "used up"
+ * once the recorded usage count reaches `TotalUses`.
+ */
+export declare class ControlFormationUsageRecorder implements FormationUsageRecorder {
+    private readonly controlDatabase;
+    constructor(controlDatabase: ControlDatabase);
+    /** A token is valid when a matching, unexpired `FormationInvite` exists. */
+    isTokenValid(token: string): Promise<{
+        valid: boolean;
+        invitation?: OpenInvitation;
+    }>;
+    /**
+     * A token is "used" when its recorded usage count has reached the invite's
+     * `TotalUses`. A null `TotalUses` (unlimited) is never used up; an unknown
+     * token is reported not-used (validity is handled by {@link isTokenValid}).
+     */
+    isTokenUsed(token: string): Promise<boolean>;
+    /**
+     * Record consent against an **already-existing** host strand (record-only): the
+     * single `FormationUsage` insert auto-commits and the deferred `StrandExists`
+     * CHECK is satisfied by the pre-existing strand. This is the provision-then-record
+     * commitment — the strand was minted owner-signed up front, so we do NOT
+     * re-insert it (which would double-insert the same PK). `initiatorKey` is carried
+     * as the usage `PeerId` (advisory). Use {@link ControlDatabase.redeemInvitation}
+     * for the consent-creates-strand path instead.
+     */
+    recordUsage(token: string, initiatorKey: string, strandId: string): Promise<void>;
+    /**
+     * Classify the host strand this invite binds to (see {@link ResolvedHostStrand}):
+     *
+     * - no invite / no `StrandId` → `unbound` (responder-provisions path).
+     * - `StrandId` set AND the strand row is present → `bound`, carrying its
+     *   `MemberPrivateKey` (the closed-strand read-gating secret) for delivery to a
+     *   validated invitee.
+     * - `StrandId` set but the strand row is absent → `missing` (the host strand has not
+     *   converged on this responder yet); the manager rejects cleanly instead of recording
+     *   usage against a non-existent strand, which would fail the deferred `StrandExists`
+     *   CHECK at commit and drop the result frame.
+     */
+    resolveStrand(token: string): Promise<ResolvedHostStrand>;
+    /**
+     * Provision a NEW strand for an UNBOUND invite and record consent against it in ONE
+     * transaction (the responder-provisions fallback, now single-use-enforced).
+     *
+     * Mints a fresh, globally-unique strand id from {@link randomBytes} — the same
+     * cross-platform CSPRNG `control-database`'s `generateStampId` uses, NOT
+     * `crypto.randomUUID` / `Date.now` / `Math.random` (not uniformly available across
+     * node/browser/RN) — then delegates to {@link ControlDatabase.redeemInvitation}, whose
+     * single `begin … commit` inserts the consent-authorized `Strand` row AND the matching
+     * `FormationUsage` row together (both deferred CHECKs see both rows at commit). That one
+     * `FormationUsage` row makes the unbound redemption single-use exactly like the bound
+     * path: the next redemption of a `TotalUses:1` invite sees `count 1 >= 1` and is rejected.
+     *
+     * The strand is open (`'o'`) — an unbound responder-provisioned strand has no membership
+     * key — so the returned `memberPrivateKey` is null. `sAppId` is accepted for parity/future
+     * use; `redeemInvitation` does not currently thread it into the `Strand` row.
+     *
+     * A concurrent redemption of the same single-use invite collides on the
+     * `(Token, UseNumber)` PK and this call THROWS for the loser — the manager maps that to a
+     * clean protocol rejection (it never lets the dropped insert close the stream silently).
+     */
+    provisionAndRecord(token: string, initiatorKey: string, _sAppId: string): Promise<{
+        strandId: string;
+        memberPrivateKey: string | null;
+    }>;
+}

package/dist/control-formation-recorder.js

@@ -0,0 +1,139 @@
+import debug from 'debug';
+import { randomBytes } from '@optimystic/quereus-plugin-crypto';
+const log = debug('sereus:cadre:formation-recorder');
+/** Far-future sentinel for an invitation that never expires (max valid JS Date). */
+const NEVER_EXPIRES = new Date(8640000000000000);
+/**
+ * {@link FormationUsageRecorder} backed by the real `CadreControl` tables.
+ *
+ * It reads `FormationInvite` / `FormationUsage` to answer token-validity and
+ * usage questions, and writes the consent row that records a redemption. Two
+ * provisioning shapes are supported, keyed on whether the invite binds a host strand:
+ *
+ * - **Bound (provision-then-record):** the host strand already exists (owner-signed
+ *   up front and named by the invite's `StrandId`), so {@link resolveStrand} reports it
+ *   and {@link recordUsage} writes the consent row against that pre-existing strand
+ *   (record-only) rather than inserting a new `Strand`.
+ * - **Unbound (responder-provisions):** the invite carries no `StrandId`, so
+ *   {@link provisionAndRecord} mints a fresh strand and records consent against it
+ *   ATOMICALLY (one `FormationUsage` row), closing the single-use hole the older
+ *   never-record fallback left open.
+ *
+ * This replaces the in-memory stubs used by the formation tests so the consent path
+ * is exercised against the persisted control network.
+ *
+ * Usage accounting follows the schema's `FormationUsage.Authorized` semantics:
+ * a null `TotalUses` means unlimited uses; otherwise the invite is "used up"
+ * once the recorded usage count reaches `TotalUses`.
+ */
+export class ControlFormationUsageRecorder {
+    constructor(controlDatabase) {
+        this.controlDatabase = controlDatabase;
+    }
+    /** A token is valid when a matching, unexpired `FormationInvite` exists. */
+    async isTokenValid(token) {
+        const invite = await this.controlDatabase.queryFormationInvite(token);
+        if (!invite) {
+            return { valid: false };
+        }
+        if (invite.expiresAtMs !== null && invite.expiresAtMs <= Date.now()) {
+            log('Token expired: %s', token);
+            return { valid: false };
+        }
+        return {
+            valid: true,
+            invitation: {
+                token: invite.token,
+                sAppId: invite.sAppId,
+                expiration: invite.expiresAtMs !== null ? new Date(invite.expiresAtMs) : NEVER_EXPIRES,
+                bootstrap: [],
+            },
+        };
+    }
+    /**
+     * A token is "used" when its recorded usage count has reached the invite's
+     * `TotalUses`. A null `TotalUses` (unlimited) is never used up; an unknown
+     * token is reported not-used (validity is handled by {@link isTokenValid}).
+     */
+    async isTokenUsed(token) {
+        const invite = await this.controlDatabase.queryFormationInvite(token);
+        if (!invite || invite.totalUses === null) {
+            return false;
+        }
+        const uses = await this.controlDatabase.countFormationUsage(token);
+        return uses >= invite.totalUses;
+    }
+    /**
+     * Record consent against an **already-existing** host strand (record-only): the
+     * single `FormationUsage` insert auto-commits and the deferred `StrandExists`
+     * CHECK is satisfied by the pre-existing strand. This is the provision-then-record
+     * commitment — the strand was minted owner-signed up front, so we do NOT
+     * re-insert it (which would double-insert the same PK). `initiatorKey` is carried
+     * as the usage `PeerId` (advisory). Use {@link ControlDatabase.redeemInvitation}
+     * for the consent-creates-strand path instead.
+     */
+    async recordUsage(token, initiatorKey, strandId) {
+        await this.controlDatabase.recordFormationUsage({ token, strandId, peerId: initiatorKey });
+        log('Recorded formation usage: token=%s strand=%s', token, strandId);
+    }
+    /**
+     * Classify the host strand this invite binds to (see {@link ResolvedHostStrand}):
+     *
+     * - no invite / no `StrandId` → `unbound` (responder-provisions path).
+     * - `StrandId` set AND the strand row is present → `bound`, carrying its
+     *   `MemberPrivateKey` (the closed-strand read-gating secret) for delivery to a
+     *   validated invitee.
+     * - `StrandId` set but the strand row is absent → `missing` (the host strand has not
+     *   converged on this responder yet); the manager rejects cleanly instead of recording
+     *   usage against a non-existent strand, which would fail the deferred `StrandExists`
+     *   CHECK at commit and drop the result frame.
+     */
+    async resolveStrand(token) {
+        const invite = await this.controlDatabase.queryFormationInvite(token);
+        if (!invite || !invite.strandId) {
+            return { kind: 'unbound' };
+        }
+        const strand = await this.controlDatabase.queryStrand(invite.strandId);
+        if (!strand) {
+            return { kind: 'missing', strandId: invite.strandId };
+        }
+        return {
+            kind: 'bound',
+            strandId: invite.strandId,
+            memberPrivateKey: strand.MemberPrivateKey ?? null,
+        };
+    }
+    /**
+     * Provision a NEW strand for an UNBOUND invite and record consent against it in ONE
+     * transaction (the responder-provisions fallback, now single-use-enforced).
+     *
+     * Mints a fresh, globally-unique strand id from {@link randomBytes} — the same
+     * cross-platform CSPRNG `control-database`'s `generateStampId` uses, NOT
+     * `crypto.randomUUID` / `Date.now` / `Math.random` (not uniformly available across
+     * node/browser/RN) — then delegates to {@link ControlDatabase.redeemInvitation}, whose
+     * single `begin … commit` inserts the consent-authorized `Strand` row AND the matching
+     * `FormationUsage` row together (both deferred CHECKs see both rows at commit). That one
+     * `FormationUsage` row makes the unbound redemption single-use exactly like the bound
+     * path: the next redemption of a `TotalUses:1` invite sees `count 1 >= 1` and is rejected.
+     *
+     * The strand is open (`'o'`) — an unbound responder-provisioned strand has no membership
+     * key — so the returned `memberPrivateKey` is null. `sAppId` is accepted for parity/future
+     * use; `redeemInvitation` does not currently thread it into the `Strand` row.
+     *
+     * A concurrent redemption of the same single-use invite collides on the
+     * `(Token, UseNumber)` PK and this call THROWS for the loser — the manager maps that to a
+     * clean protocol rejection (it never lets the dropped insert close the stream silently).
+     */
+    async provisionAndRecord(token, initiatorKey, _sAppId) {
+        const strandId = `strand-${randomBytes(128, 'hex')}`;
+        await this.controlDatabase.redeemInvitation({
+            token,
+            strandId,
+            type: 'o',
+            peerId: initiatorKey,
+        });
+        log('Provisioned + recorded unbound strand: token=%s strand=%s', token, strandId);
+        return { strandId, memberPrivateKey: null };
+    }
+}
+//# sourceMappingURL=control-formation-recorder.js.map

package/dist/control-formation-recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-formation-recorder.js","sourceRoot":"","sources":["../src/control-formation-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAKhE,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD,oFAAoF;AACpF,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,6BAA6B;IACxC,YAA6B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;IAAG,CAAC;IAEjE,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpE,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,UAAU,EAAE;gBACV,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,aAAa;gBACtF,SAAS,EAAE,EAAE;aACd;SACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,YAAoB,EAAE,QAAgB;QACrE,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3F,GAAG,CAAC,8CAA8C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;QACD,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,YAAoB,EACpB,OAAe;QAEf,MAAM,QAAQ,GAAG,UAAU,WAAW,CAAC,GAAG,EAAE,KAAK,CAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC;YAC1C,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QACH,GAAG,CAAC,2DAA2D,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/control-schema.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Embedded control schema for cross-platform compatibility.
+ *
+ * This is the authoritative runtime copy of the CadreControl authorization
+ * schema. It is duplicated from `schemas/control.qsql` so that React Native and
+ * other filesystem-less environments get the schema without a runtime file read.
+ *
+ * The two copies MUST stay identical — `control-schema-drift.spec.ts` fails the
+ * build if they drift. Any edit here must be mirrored in `schemas/control.qsql`
+ * and vice versa.
+ */
+export declare const CONTROL_SCHEMA = "-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)\ndeclare schema CadreControl {\n    -- A key that can authorize various control changes\n    table OwnerKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Bootstrap: first owner key needs no existing authorization\n            (select count(1) from OwnerKey) <= 1\n\n                -- Old owner authorizes by signing over THIS row (Key, StampId); single-use via unique StampId\n                or (old.Key is not null and old.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))\n\n                -- or other owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text null);\n\n    -- A key that can validate a strand formation disclosure\n    table ValidationKey (\n        Key text primary key,\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort\n    -- Cadre peers should participate in each of these strands\n    table Strand (\n        Id text primary key,    -- UUID\n        MemberPrivateKey text null unique,   -- Our private key as a member of this strand\n        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint Authorized check (\n            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))\n\n                -- or authorized by a cadre peer who has received a valid formation invitation.\n                -- That path has no signed writer yet; when one is built it must still supply a\n                -- fresh, unique StampId to satisfy the not-null/unique anti-replay column.\n                or exists (select 1 from FormationUsage FU where FU.StrandId = new.Id)\n        ),\n        constraint MemberKeyClosedOnly check (\n            -- An open strand ('o') has no membership gate, so it must not carry a\n            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').\n            new.MemberPrivateKey is null or new.Type = 'c'\n        )\n    ) with context (OwnerKey text, Signature text);\n\n    -- A peer (node) that is part of the cadre, carrying a self-published,\n    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).\n    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against\n    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.\n    table CadrePeer (\n        PeerId text primary key,\n        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)\n        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)\n        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published\n        StampId text not null unique,    -- single-use authorization nonce (anti-replay), bound into the voucher/remove digests; rotates on (re)insert\n        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)\n        VouchSig text null,              -- that owner's signature over digest(PeerId, StampId) (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership.\n        constraint AuthorizedInsert check on insert (\n            -- Authorized by an owner key, which vouches both membership and the\n            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).\n            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),\n            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n            -- Persist the vouching (owner, signature) onto the row so a reader can later\n            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal\n            -- the pair the verify above validated, so a writer cannot store a voucher it did\n            -- not actually receive a signature for.\n            and new.VouchOwner = context.OwnerKey\n            and new.VouchSig = context.Signature\n        ),\n        constraint AuthorizedDelete check on delete (\n            -- Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound\n            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so\n            -- the stored voucher (a signature over digest(PeerId, StampId)) can NEVER be replayed\n            -- to authorize a delete. The remove signature rides in context and is never stored.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(old.PeerId, old.StampId, 'remove'), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key\n            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on\n            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified\n            -- against the stored PublicKey over the same payload the publish path signs\n            -- (cadre-core peer-record.ts:peerRecordSignedPayload).\n            (\n                new.PeerId = old.PeerId\n                and new.PublicKey = old.PublicKey\n                and new.StampId = old.StampId\n                and new.VouchOwner = old.VouchOwner\n                and new.VouchSig = old.VouchSig\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and verify(\n                        digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, new.PublicKey, 'ed25519')\n            )\n                -- or an owner re-authorizes (rotation / correction): re-vouches the row over\n                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.\n                or (\n                    exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))\n                    and new.VouchOwner = context.OwnerKey\n                    and new.VouchSig = context.Signature\n                )\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a\n    -- server peer can deliver a push-wake to a suspended app over the platform push\n    -- channel (a control-network dial cannot reach an OS-suspended process). The row\n    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for\n    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then\n    -- hands the token to the push sender.\n    table DeviceToken (\n        PeerId text primary key,        -- the CadrePeer this token belongs to\n        Platform text not null,         -- 'fcm' | 'apns'\n        Token text not null,            -- opaque platform device/registration token\n        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)\n        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)\n        constraint AuthorizedInsert check on insert, delete (\n            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.\n            -- The single-field digest frames the base58btc PeerId as TEXT.\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))\n        ),\n        constraint AuthorizedUpdate check on update (\n            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key\n            -- behind PeerId). PeerId is immutable, UpdatedAt must strictly increase (replay\n            -- guard), and Sig is verified against the stored CadrePeer.PublicKey over the\n            -- signed payload (cadre-core device-token.ts:deviceTokenSignedPayload). Platform\n            -- and Token may change on self-update (platform switch / reinstall / rotation).\n            (\n                new.PeerId = old.PeerId\n                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)\n                and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(\n                        digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),\n                        new.Sig, P.PublicKey, 'ed25519'))\n            )\n                -- or an owner re-authorizes (rotation / correction)\n                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))\n        )\n    ) with context (OwnerKey text null, Signature text);\n\n    -- An open invitation to form a strand with this party\n    table FormationInvite (\n        Token text primary key, -- Just a random string\n        sAppId text, -- The app for the strand that will be formed\n        ExpiresAt datetime null,\n        TotalUses int null check (TotalUses >= 0),\n        ValidationUrl text null,   -- Web hook - send disclosure, IP address...\n        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.\n        StampId text not null unique,   -- single-use authorization nonce (anti-replay)\n        constraint AuthorizedAddOrRemove check on insert, delete (\n            -- Authorized by an owner signing over THIS row\n            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.\n            -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).\n            -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).\n            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(\n                digest(\n                    coalesce(new.Token, old.Token),\n                    coalesce(new.sAppId, old.sAppId),\n                    coalesce(cast(coalesce(new.ExpiresAt, old.ExpiresAt) as text), ''),\n                    coalesce(cast(coalesce(new.TotalUses, old.TotalUses) as text), ''),\n                    coalesce(coalesce(new.ValidationUrl, old.ValidationUrl), ''),\n                    coalesce(coalesce(new.StrandId, old.StrandId), ''),\n                    coalesce(new.StampId, old.StampId)\n                ),\n                context.Signature, A.Key, 'ed25519'))\n        ),\n        -- Invites are insert/delete only: forbid in-place mutation so the row-bound\n        -- AuthorizedAddOrRemove signature cannot be sidestepped by updating consent\n        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check\n        -- defaults to insert+update; the check on insert, delete above excludes update,\n        -- so this guard is required. Mirrors FormationUsage.InsertOnly.\n        constraint Immutable check on update (false)\n    ) with context (OwnerKey text, Signature text);\n\n    table FormationUsage (\n        Token text,\n        UseNumber int,\n        Disclosure text,\n        StrandId text,\n        primary key (Token, UseNumber),\n        constraint InsertOnly check on update, delete (false),\n        constraint Monotonic check (\n            -- Read the PRE-transaction snapshot (committed.*): this CHECK auto-defers\n            -- to commit (it has a subquery), by which point the row being inserted is\n            -- live, so a plain from-FormationUsage would count this row itself and make\n            -- UseNumber = max+1 unsatisfiable. committed.* excludes the in-flight row,\n            -- giving sequential 1,2,3... per token (cross-transaction; concurrent\n            -- redemptions of the same token collide on the (Token, UseNumber) PK).\n            new.UseNumber = coalesce((select max(UseNumber) from committed.FormationUsage U where U.Token = new.Token), 0) + 1\n        ),\n        constraint Authorized check on insert (\n            -- Satisfies an invitation\n            exists (\n                select 1 from FormationInvite FI\n                    where FI.Token = new.Token\n                        and (FI.TotalUses is null or FI.TotalUses >= new.UseNumber)\n                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)\n                        and (FI.ValidationUrl is null or verify(digest(new.Token || new.Disclosure), context.ValidationSignature, context.ValidationKey, 'ed25519'))\n            )\n        ),\n        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId)),\n    ) with context (PeerId text, PeerSignature text, Now datetime, ValidationKey text null, ValidationSignature text null);\n}\n\napply schema CadreControl;";

package/dist/control-schema.js

@@ -0,0 +1,223 @@
+/**
+ * Embedded control schema for cross-platform compatibility.
+ *
+ * This is the authoritative runtime copy of the CadreControl authorization
+ * schema. It is duplicated from `schemas/control.qsql` so that React Native and
+ * other filesystem-less environments get the schema without a runtime file read.
+ *
+ * The two copies MUST stay identical — `control-schema-drift.spec.ts` fails the
+ * build if they drift. Any edit here must be mirrored in `schemas/control.qsql`
+ * and vice versa.
+ */
+export const CONTROL_SCHEMA = `-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)
+declare schema CadreControl {
+    -- A key that can authorize various control changes
+    table OwnerKey (
+        Key text primary key,
+        StampId text not null unique,   -- single-use authorization nonce (anti-replay)
+        constraint Authorized check (
+            -- Bootstrap: first owner key needs no existing authorization
+            (select count(1) from OwnerKey) <= 1
+
+                -- Old owner authorizes by signing over THIS row (Key, StampId); single-use via unique StampId
+                or (old.Key is not null and old.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))
+
+                -- or other owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+        )
+    ) with context (OwnerKey text null, Signature text null);
+
+    -- A key that can validate a strand formation disclosure
+    table ValidationKey (
+        Key text primary key,
+        StampId text not null unique,   -- single-use authorization nonce (anti-replay)
+        constraint Authorized check (
+            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+        )
+    ) with context (OwnerKey text, Signature text);
+
+    -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort
+    -- Cadre peers should participate in each of these strands
+    table Strand (
+        Id text primary key,    -- UUID
+        MemberPrivateKey text null unique,   -- Our private key as a member of this strand
+        Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads
+        StampId text not null unique,   -- single-use authorization nonce (anti-replay)
+        constraint Authorized check (
+            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))
+
+                -- or authorized by a cadre peer who has received a valid formation invitation.
+                -- That path has no signed writer yet; when one is built it must still supply a
+                -- fresh, unique StampId to satisfy the not-null/unique anti-replay column.
+                or exists (select 1 from FormationUsage FU where FU.StrandId = new.Id)
+        ),
+        constraint MemberKeyClosedOnly check (
+            -- An open strand ('o') has no membership gate, so it must not carry a
+            -- member key. A non-null MemberPrivateKey requires a closed strand ('c').
+            new.MemberPrivateKey is null or new.Type = 'c'
+        )
+    ) with context (OwnerKey text, Signature text);
+
+    -- A peer (node) that is part of the cadre, carrying a self-published,
+    -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).
+    -- The row IS the peer-address record: a resolver reads it, re-verifies Sig against
+    -- PublicKey, checks freshness (UpdatedAt) and trust, then dials the addrs.
+    table CadrePeer (
+        PeerId text primary key,
+        PublicKey text null,            -- ed25519 (base64url) whose libp2p identity == PeerId (null if non-Ed25519)
+        Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)
+        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)
+        Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published
+        StampId text not null unique,    -- single-use authorization nonce (anti-replay), bound into the voucher/remove digests; rotates on (re)insert
+        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)
+        VouchSig text null,              -- that owner's signature over digest(PeerId, StampId) (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership.
+        constraint AuthorizedInsert check on insert (
+            -- Authorized by an owner key, which vouches both membership and the
+            -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).
+            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),
+            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Persist the vouching (owner, signature) onto the row so a reader can later
+            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal
+            -- the pair the verify above validated, so a writer cannot store a voucher it did
+            -- not actually receive a signature for.
+            and new.VouchOwner = context.OwnerKey
+            and new.VouchSig = context.Signature
+        ),
+        constraint AuthorizedDelete check on delete (
+            -- Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound
+            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so
+            -- the stored voucher (a signature over digest(PeerId, StampId)) can NEVER be replayed
+            -- to authorize a delete. The remove signature rides in context and is never stored.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(old.PeerId, old.StampId, 'remove'), context.Signature, A.Key, 'ed25519'))
+        ),
+        constraint AuthorizedUpdate check on update (
+            -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key
+            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on
+            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified
+            -- against the stored PublicKey over the same payload the publish path signs
+            -- (cadre-core peer-record.ts:peerRecordSignedPayload).
+            (
+                new.PeerId = old.PeerId
+                and new.PublicKey = old.PublicKey
+                and new.StampId = old.StampId
+                and new.VouchOwner = old.VouchOwner
+                and new.VouchSig = old.VouchSig
+                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
+                and verify(
+                        digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),
+                        new.Sig, new.PublicKey, 'ed25519')
+            )
+                -- or an owner re-authorizes (rotation / correction): re-vouches the row over
+                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.
+                or (
+                    exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+                    and new.VouchOwner = context.OwnerKey
+                    and new.VouchSig = context.Signature
+                )
+        )
+    ) with context (OwnerKey text null, Signature text);
+
+    -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a
+    -- server peer can deliver a push-wake to a suspended app over the platform push
+    -- channel (a control-network dial cannot reach an OS-suspended process). The row
+    -- mirrors CadrePeer: a resolver re-verifies Sig against the CadrePeer.PublicKey for
+    -- this PeerId (see device-token.ts:deviceTokenSignedPayload), checks freshness, then
+    -- hands the token to the push sender.
+    table DeviceToken (
+        PeerId text primary key,        -- the CadrePeer this token belongs to
+        Platform text not null,         -- 'fcm' | 'apns'
+        Token text not null,            -- opaque platform device/registration token
+        UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)
+        Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)
+        constraint AuthorizedInsert check on insert, delete (
+            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.
+            -- The single-field digest frames the base58btc PeerId as TEXT.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
+        ),
+        constraint AuthorizedUpdate check on update (
+            -- Peer self-updates its own token, signing with its OWN ed25519 key (the key
+            -- behind PeerId). PeerId is immutable, UpdatedAt must strictly increase (replay
+            -- guard), and Sig is verified against the stored CadrePeer.PublicKey over the
+            -- signed payload (cadre-core device-token.ts:deviceTokenSignedPayload). Platform
+            -- and Token may change on self-update (platform switch / reinstall / rotation).
+            (
+                new.PeerId = old.PeerId
+                and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
+                and exists (select 1 from CadrePeer P where P.PeerId = new.PeerId and verify(
+                        digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),
+                        new.Sig, P.PublicKey, 'ed25519'))
+            )
+                -- or an owner re-authorizes (rotation / correction)
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
+        )
+    ) with context (OwnerKey text null, Signature text);
+
+    -- An open invitation to form a strand with this party
+    table FormationInvite (
+        Token text primary key, -- Just a random string
+        sAppId text, -- The app for the strand that will be formed
+        ExpiresAt datetime null,
+        TotalUses int null check (TotalUses >= 0),
+        ValidationUrl text null,   -- Web hook - send disclosure, IP address...
+        StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.
+        StampId text not null unique,   -- single-use authorization nonce (anti-replay)
+        constraint AuthorizedAddOrRemove check on insert, delete (
+            -- Authorized by an owner signing over THIS row
+            -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.
+            -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).
+            -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(
+                digest(
+                    coalesce(new.Token, old.Token),
+                    coalesce(new.sAppId, old.sAppId),
+                    coalesce(cast(coalesce(new.ExpiresAt, old.ExpiresAt) as text), ''),
+                    coalesce(cast(coalesce(new.TotalUses, old.TotalUses) as text), ''),
+                    coalesce(coalesce(new.ValidationUrl, old.ValidationUrl), ''),
+                    coalesce(coalesce(new.StrandId, old.StrandId), ''),
+                    coalesce(new.StampId, old.StampId)
+                ),
+                context.Signature, A.Key, 'ed25519'))
+        ),
+        -- Invites are insert/delete only: forbid in-place mutation so the row-bound
+        -- AuthorizedAddOrRemove signature cannot be sidestepped by updating consent
+        -- parameters (TotalUses/ExpiresAt/...) after a legitimate insert. A bare check
+        -- defaults to insert+update; the check on insert, delete above excludes update,
+        -- so this guard is required. Mirrors FormationUsage.InsertOnly.
+        constraint Immutable check on update (false)
+    ) with context (OwnerKey text, Signature text);
+
+    table FormationUsage (
+        Token text,
+        UseNumber int,
+        Disclosure text,
+        StrandId text,
+        primary key (Token, UseNumber),
+        constraint InsertOnly check on update, delete (false),
+        constraint Monotonic check (
+            -- Read the PRE-transaction snapshot (committed.*): this CHECK auto-defers
+            -- to commit (it has a subquery), by which point the row being inserted is
+            -- live, so a plain from-FormationUsage would count this row itself and make
+            -- UseNumber = max+1 unsatisfiable. committed.* excludes the in-flight row,
+            -- giving sequential 1,2,3... per token (cross-transaction; concurrent
+            -- redemptions of the same token collide on the (Token, UseNumber) PK).
+            new.UseNumber = coalesce((select max(UseNumber) from committed.FormationUsage U where U.Token = new.Token), 0) + 1
+        ),
+        constraint Authorized check on insert (
+            -- Satisfies an invitation
+            exists (
+                select 1 from FormationInvite FI
+                    where FI.Token = new.Token
+                        and (FI.TotalUses is null or FI.TotalUses >= new.UseNumber)
+                        and (FI.ExpiresAt is null or FI.ExpiresAt > context.Now)
+                        and (FI.ValidationUrl is null or verify(digest(new.Token || new.Disclosure), context.ValidationSignature, context.ValidationKey, 'ed25519'))
+            )
+        ),
+        constraint StrandExists check (exists (select 1 from Strand S where S.Id = new.StrandId)),
+    ) with context (PeerId text, PeerSignature text, Now datetime, ValidationKey text null, ValidationSignature text null);
+}
+
+apply schema CadreControl;`;
+//# sourceMappingURL=control-schema.js.map

package/dist/control-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-schema.js","sourceRoot":"","sources":["../src/control-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAkNH,CAAC"}

package/dist/control-stream.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Shared control-network stream primitives.
+ *
+ * The cadre control protocols — seed delivery (`seed-bootstrap.ts`), push-wake
+ * (`strand-wake-protocol.ts`), and strand formation (`strand-formation-protocol.ts`)
+ * — all speak 4-byte big-endian length-prefixed JSON frames over a libp2p 3.x
+ * stream. This module lifts the previously-triplicated stream shape, frame
+ * writer, and `withTimeout` wrapper into one place, and adds a timeout-bounded,
+ * abort-on-timeout read-to-EOF helper so a misbehaving peer that opens a stream
+ * and never half-closes its write end cannot pin a receiver forever.
+ *
+ * Dependency-free by design: it imports nothing from the protocol modules, so
+ * the import graph stays acyclic (`control-stream` ← `seed-bootstrap` ←
+ * `strand-wake-protocol`). In particular it returns RAW bytes from
+ * {@link readStreamToEnd} rather than decoding a frame — callers own the
+ * `decodeLengthPrefixedFrame` guard.
+ */
+/**
+ * Minimal libp2p 3.x stream surface: AsyncIterable for reads, `send()` for
+ * writes, `close()` to half-close the write end (EOF), `abort()` to reset.
+ */
+export interface ControlStream extends AsyncIterable<Uint8Array> {
+    send(data: Uint8Array): boolean;
+    close(): Promise<void>;
+    abort(err: Error): void;
+}
+/** Write a JSON object as a single 4-byte big-endian length-prefixed frame. */
+export declare function writeFrame(stream: ControlStream, obj: unknown): void;
+/**
+ * Reject if `op` does not settle within `ms`. On timeout, invoke `onTimeout`
+ * (used by the sender to abort the in-flight dial/stream so it does not leak)
+ * before rejecting. A throwing `onTimeout` is swallowed so it cannot mask the
+ * timeout rejection. The rejection message is exactly `<label> timed out after
+ * <ms>ms`, so callers fold any domain prefix into `label`.
+ */
+export declare function withTimeout<T>(ms: number, label: string, op: () => Promise<T>, onTimeout?: () => void): Promise<T>;
+/**
+ * Read a stream to EOF, capped at `maxBytes`, bounded by `timeoutMs`, returning
+ * the assembled bytes (the caller decodes via `decodeLengthPrefixedFrame`).
+ *
+ * Implemented as `Promise.race([readLoop, timeout])`:
+ * - The size cap throws synchronously inside `readLoop` (a well-behaved peer may
+ *   have sent a real-but-too-large frame and could still be reading for the ack,
+ *   so this path does NOT abort the stream — it just rejects).
+ * - The timeout path is the true hang: it ALSO calls `stream.abort(err)` to
+ *   release the stuck read. The race guarantees the helper settles at the
+ *   deadline even if `abort()` does not immediately unblock the iterator (e.g. a
+ *   test double whose `abort()` is a no-op).
+ */
+export declare function readStreamToEnd(stream: ControlStream, opts: {
+    maxBytes: number;
+    timeoutMs: number;
+    label: string;
+}): Promise<Uint8Array>;