@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/membership-connection-gater.js

@@ -1,121 +1,159 @@
 /**
- * Control-network inbound admission gates (defense-in-depth): the
- * encrypted-connection checkpoint and the circuit-relay reservation checkpoint.
- *
- * Layer 2 of the membership enforcement chain: the PRIMARY gates are per-stream
- * — every sensitive sereus control protocol rejects a peer that fails the
- * voucher-anchored membership check (wake and strand-addr via
- * `CadreNode.isAuthorizedMember`; the Optimystic control-DB protocols via the
- * materialized-snapshot gate `CadreNode.authorizeInboundControlStream`), and
- * the replicated rows an outsider *can* still write are disbelieved at read
- * time. This module adds the opportunistic connection-level layer on top: a
- * peer this node can positively determine is NOT authorized is refused at the
- * encrypted-connection checkpoint, before any protocol negotiation, so a
- * known-nothing outsider is never even in the conversation — EXCEPT on a node
- * that runs the circuit-relay server, where the refusal moves to the
- * relay-reservation checkpoint instead (see "The relay-reservation seam").
- *
- * ## The stranger allowlist (the ONE place it is defined)
- *
- * A libp2p connection gater decides per CONNECTION, before protocols are
- * negotiated, so "allow seed, deny repo" cannot be expressed here — instead the
- * policy admits a connection whenever a legitimate stranger interaction could be
- * riding it, and the per-stream gates take over. The complete set of protocols a
- * NOT-yet-authorized peer may legitimately speak on a control node is:
- *
- *  - `/sereus/seed/1.0.0` ({@link SEED_PROTOCOL}) — enrollment seed delivery.
+ * Control-network inbound admission gates: the encrypted-connection checkpoint
+ * and the circuit-relay reservation checkpoint.
+ *
+ * The fail-closed layer of the membership enforcement chain is per-stream: the
+ * control node's protocol guard (`control-protocol-guard.ts`) refuses a peer that
+ * is not an authorized member on every protocol not declared open to strangers,
+ * before its handler runs, and the replicated rows an outsider *can* still write
+ * are disbelieved at read time. This module is NOT a stranger boundary on an
+ * enrolled node — outside the bring-up quiet period it admits every inbound
+ * connection. Its jobs are:
+ *
+ *  - the bring-up quiet period (below), the one state in which it denies;
+ *  - deciding which admitted peers carry a deadline: a peer the policy cannot
+ *    place is admitted PROVISIONALLY, and its connection is closed at the
+ *    deadline unless the policy admits it by then (see "Provisional admission");
+ *  - handing circuit-relay reservations to the reservation policy (see "The
+ *    relay-reservation seam").
+ *
+ * Why a stranger's connection is admitted at all: the gate sees only a peer id,
+ * after the encrypted handshake and before any protocol, so it cannot tell an
+ * outsider from a device carrying a cadre invitation this node has not received
+ * yet, or from a sibling whose membership row is still replicating. Refusing
+ * would fail those at the connection; admitting costs a mute connection for a
+ * bounded time, because the protocol guard refuses it every members-only protocol.
+ *
+ * ## Admitted outright
+ *
+ * A peer the policy CAN place gets no deadline. Besides members, configured
+ * infrastructure and an un-enrolled node's whole world (empty anchor or empty
+ * authorized set), that covers the stranger windows: states in which this node
+ * expects a stranger on one of the `stranger-open` protocols declared in
+ * `controlProtocolClasses` (`control-protocol-guard.ts`):
+ *
+ *  - `/sereus/seed/1.0.0` — enrollment seed delivery.
  *    An owner dials a brand-new node to seed it (the new node has no members
- *    yet, so its gate is inert), and an invited phone dials the owner before it
- *    is authorized (admitted via the enrollment window `CadreNode.createInvite`
- *    opens). The handler's own trust decision is the anchored seed-trust policy.
- *  - `/sereus/formation/1.0.0` ({@link FORMATION_PROTOCOL}) — cross-party
+ *    yet, so it admits everyone outright). The handler's own trust decision is the
+ *    anchored seed-trust policy — or, on a node started with a claim secret
+ *    (`CadreNodeConfig.claim`), the claim-secret policy. Such a node is the one
+ *    stranger-facing state that is NOT "admit the connection and let the
+ *    per-stream gates sort it out": while it waits to be claimed
+ *    (`CadreNode.isAwaitingClaim`) its connection is admitted, because the claim
+ *    seed has to ride one, but its control-DB streams and relay reservations are
+ *    refused ahead of every admission below, the empty-anchor one included. An
+ *    unclaimed node has no siblings to replicate from, and one on a public
+ *    address must not relay for anyone. The claim anchors the owner, after which
+ *    the ordinary rules apply.
+ *  - `/sereus/formation/1.0.0` — cross-party
  *    strand formation via open invitations. Stranger-facing BY DESIGN: the
  *    initiator is another party, and its token is only checkable inside the
- *    protocol. The exemption is therefore keyed on EXPECTATION of a stranger,
- *    not capability to serve one: stranger denial is suspended only while this
- *    node has at least one UNEXPIRED, NOT-FULLY-CONSUMED open invitation
- *    outstanding (`StrandSolicitationService.hasOutstandingInvitation` — the
- *    tokens this process minted or published, plus any still-redeemable
- *    `FormationInvite` row the usage recorder can see). Registering the
- *    responder does NOT suspend it, so every node — each registers one at
- *    `CadreNode.start` — keeps a live gate. The
+ *    protocol. The window is keyed on EXPECTATION of a stranger, not capability
+ *    to serve one: it is open only while this node has at least one UNEXPIRED,
+ *    NOT-FULLY-CONSUMED open invitation outstanding
+ *    (`StrandSolicitationService.hasOutstandingInvitation` — the tokens this
+ *    process minted or published, plus any still-redeemable `FormationInvite`
+ *    row the usage recorder can see). Registering the responder does NOT open
+ *    it, so on every node — each registers one at `CadreNode.start` — a stranger
+ *    with no invitation in play stays on the provisional deadline. The
  *    handler's own trust decision remains the per-token check, which is
  *    strictly finer than this one: a peer admitted here can still be rejected
  *    in-protocol for a bogus or spent token.
+ *  - `/sereus/cadre-invite/1.0.0` — redemption
+ *    of a cadre invitation at any member machine. Stranger-facing BY DESIGN:
+ *    the device is not a member until the redemption writes its row, and its
+ *    proof of possession (a signature with the invitation's private key) is
+ *    only checkable inside the protocol. Keyed on expectation, as formation's
+ *    is: open only while this node holds at least one LIVE `CadreInvite` row
+ *    (`ControlDatabase.hasLiveCadreInvite`: not withdrawn, unexpired, uses left,
+ *    issuer still an owner). A member that has not yet received the device's
+ *    row by replication admits the device provisionally instead, seats the row
+ *    from the invitation bundle during the redemption, and so admits it at the
+ *    deadline's re-check.
  *
  * There is one further connection-level carve-out, which is NOT a protocol
- * exemption and needs no stranger window:
+ * window:
  *
  *  - **Announced delegate peers** (`delegate-admission.ts`). A member's strand
  *    node runs as a separate libp2p identity whose peerId no sibling can
  *    recompute. Before starting a strand node, a member's control node
  *    announces that peerId over the already-authenticated strand-addr RPC, and
  *    the receiver holds a short-lived grant for it
- *    (`CadreNode.grantDelegateAdmission`). The grant admits the CONNECTION,
- *    admits the peer's RESERVATION at the seam below (without spending the
- *    unauthorized budget), and nothing else — it is deliberately invisible to
- *    the per-stream gate, so a delegate still gets refused on every
+ *    (`CadreNode.grantDelegateAdmission`). The grant admits the CONNECTION
+ *    outright, admits the peer's RESERVATION at the seam below (without
+ *    spending the unauthorized budget), and nothing else — it is deliberately
+ *    invisible to the protocol guard, so a delegate still gets refused on every
  *    members-only protocol.
  *
+ * ## Provisional admission
+ *
+ * A peer the policy cannot place (`'admit-provisionally'`) gets its connection
+ * and a deadline — {@link PROVISIONAL_ADMISSION_DEADLINE_MS} at the default
+ * declaration; `CadreNode` passes the one derived from its OWN declared link,
+ * because the member is the machine that decides. At the deadline the gate asks
+ * the policy again:
+ *
+ *  - `'admit'` — the peer has since become a member, holds a delegate grant, or
+ *    this node now holds a live invitation (a redeeming device's row was
+ *    seated): the connection stays, and nothing is re-armed;
+ *  - `'admit-provisionally'` — the connection is closed (a bounded graceful
+ *    close, with an abort only as the escalation);
+ *  - the question throws or outlasts the decision deadline — the connection
+ *    stays (see "Fail-open, deliberately").
+ *
+ * A connection that is already gone by then costs no question. One peer may hold
+ * several provisional connections; each deadline re-asks on its own.
+ *
+ * NOTE: the gate does not stop a provisionally admitted stranger from being
+ * counted into this node's FRET ring and control-database cohort by opening or
+ * advertising the party's protocols — FRET and Optimystic decide that from the
+ * protocols libp2p records the peer as serving. Ticket
+ * `stranger-joins-the-control-cohort-by-advertising-protocols` (blocked).
+ *
  * ## The relay-reservation seam
  *
  * A circuit-relay reservation is established by the reserving peer DIALING the
- * relay, so at the relay it is an inbound connection — and killing that
+ * relay, so at the relay it rides an inbound connection — and closing that
  * connection kills the reservation. For a genuine member whose `CadrePeer` row
- * has not yet replicated to this node, a connection-level deny here is NOT
- * self-healing the way a data connection's is: an outbound reconcile dial
- * re-establishes a data link, but no outbound dial can grant the REMOTE peer a
- * reservation, and a relay-only peer has no address of its own to dial back —
- * the reservation IS its address. Boot ordering makes the window ordinary (a
- * node's circuit listener runs inside `libp2p.start()`, before its own row
- * could have replicated anywhere), and a stalled replication makes it
- * unbounded. So the relay would be answering a RELAY question ("may this peer
- * use my forwarding capacity?") with a MEMBERSHIP answer, at a checkpoint where
- * a wrong answer is unrecoverable.
- *
- * On a node whose relay server is enabled the two questions are separated:
- *
- *  - The policy returns `'admit-for-relay'` instead of `'deny'`, and the
- *    connection is ADMITTED. The fail-closed per-stream gates still refuse such
- *    a peer every members-only protocol, so it gains identify/ping and the
- *    relay hop protocol, nothing else.
- *  - The reservation itself is decided at libp2p's
- *    `denyInboundRelayReservation` hook (the circuit-relay server consults it
- *    per RESERVE request): the policy admits members, delegates and configured
- *    infra outright, and admits peers it cannot place only within a bounded
- *    budget ({@link UnauthorizedReservationBudget}) — a member whose row is in
- *    flight always finds a slot under any sane cap, while outsiders cannot
- *    annex the party's relay capacity. COUNT and lifetime are the only bounds
- *    on such a peer: a party-run relay forwards without libp2p's per-connection
- *    data and duration limit by default (`relay-server.ts`), so what a granted
- *    slot carries is not capped.
- *  - An `'admit-for-relay'` connection that is NOT reserving is dropped: it has
- *    {@link RELAY_ADMISSION_RESERVE_DEADLINE_MS} to get a reservation ADMITTED
- *    at that hook, after which the gate CLOSES the underlying connection so
- *    both ends let go of the socket. The guarantee above thus weakens on
- *    relay-enabled nodes from "never in the conversation" to "in it briefly,
- *    and can speak nothing".
+ * has not yet replicated to this node that would NOT be self-healing the way a
+ * data connection's close is: an outbound reconcile dial re-establishes a data
+ * link, but no outbound dial can grant the REMOTE peer a reservation, and a
+ * relay-only peer has no address of its own to dial back — the reservation IS
+ * its address. Boot ordering makes the window ordinary (a node reserves at the
+ * end of its own `start()`, before its row could have replicated anywhere), and
+ * a stalled replication makes it unbounded. So the reservation is decided on its
+ * own terms, not by the connection's:
+ *
+ *  - It is decided at libp2p's `denyInboundRelayReservation` hook (the
+ *    circuit-relay server consults it per RESERVE request): the policy admits
+ *    members, delegates and configured infra outright, and admits peers it
+ *    cannot place only within a bounded budget
+ *    ({@link UnauthorizedReservationBudget}) — a member whose row is in flight
+ *    always finds a slot under any sane cap, while outsiders cannot annex the
+ *    party's relay capacity. COUNT and lifetime are the only bounds on such a
+ *    peer: a party-run relay forwards without libp2p's per-connection data and
+ *    duration limit by default (`relay-server.ts`), so what a granted slot
+ *    carries is not capped.
+ *  - An ADMITTED reservation disarms every provisional deadline the peer holds
+ *    here, so its connection outlives the deadline even while the peer is still
+ *    unplaced. A refused one disarms nothing.
  *
  * The deadline clears on reservation ADMISSION, not on the reservation's own
  * success: this gate cannot observe the server-side `reserve()` outcome, so a
  * peer whose admitted reservation is then refused for server capacity keeps its
  * connection until either side closes it — bounded and mute, so harmless.
  *
- * Everything else a control node handles — the Optimystic control-DB protocols
- * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`), wake
- * (`/sereus/strand-wake/1.0.0`), and strand-addr (`/sereus/strand-addr/1.0.0`)
- * — is members-only, and every one of them enforces that per-stream. Wake and
- * strand-addr check `isAuthorizedMember` inside their handlers; the four
- * control-DB protocols are gated by the fail-closed
- * `CadreNode.authorizeInboundControlStream` (wired as libp2p's
- * `authorizeInboundStream` upstream hook), which judges each inbound stream
- * against the MATERIALIZED authorized-peer snapshot — synchronous and
- * in-memory, because a live DB read from inside the gate would deadlock into
- * mutual denial. The two layers complement, not duplicate: this connection
- * gate is fail-open over a live DB read (deny only on positive proof of an
- * outsider), the stream gate is fail-closed over the snapshot and has NO
- * stranger carve-outs — an enrollment window admits a stranger's connection
- * for seed delivery, yet its repo streams are still refused.
+ * Everything else a control node serves is either libp2p plumbing open to any
+ * connection (identify, ping, hole punching, AutoNAT, the relay protocols) or
+ * members-only — wake, strand-addr, the Optimystic control-DB protocols and FRET —
+ * and the fail-closed layer for all of it is the protocol guard
+ * (`control-protocol-guard.ts`), one seam that wraps every handler at dispatch,
+ * with a protocol nobody classed treated as members-only. The two layers
+ * complement, not duplicate: this connection gate is fail-open over a live DB
+ * read and decides only how long a connection lasts, the protocol guard is
+ * fail-closed and has NO stranger carve-outs — a live invitation admits a
+ * stranger's connection outright for redemption, yet its repo and FRET streams
+ * are still refused.
  *
  * ## The bring-up quiet period
  *
@@ -151,62 +189,54 @@
  *
  * ## Fail-open, deliberately
  *
- * Outside that window this layer only ever denies on a POSITIVE determination of
- * "unauthorized outsider while no stranger path is open". Any error, missing
- * dependency, or ambiguous state admits the connection (and the reservation) and
- * defers to the fail-closed stream gates — a DB hiccup must not partition a
- * legitimate cadre.
+ * Outside that window this layer never denies, and it closes a provisional
+ * connection only on a positive answer that the peer is still unplaced. Any
+ * error, missing dependency, timeout or ambiguous state admits the connection
+ * outright (and the reservation), or keeps a provisional connection at its
+ * deadline, and defers to the fail-closed stream gates — a DB hiccup must not
+ * partition a legitimate cadre.
  */
 import debug from 'debug';
-import { SEED_PROTOCOL } from './seed-bootstrap.js';
-import { FORMATION_PROTOCOL } from './strand-formation-protocol.js';
 import { withDeadline } from './control-stream.js';
 import { PARTY_RELAY_RESERVATION_TTL_MS } from './relay-server.js';
-import { ADMISSION_DECISION_TIMEOUT_MS, relayAdmissionReserveDeadlineMs } from './link-budget.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, relayedRequestBudgetMs } from './link-budget.js';
 const log = debug('sereus:cadre:connection-gater');
 /**
- * The protocols a not-yet-authorized peer may legitimately speak on a control
- * node (see the module doc above for why each is open and where its own trust
- * decision lives). Exported as the single reference point so the allowlist
- * cannot silently drift across modules.
- */
-export const STRANGER_OPEN_PROTOCOLS = [SEED_PROTOCOL, FORMATION_PROTOCOL];
-/**
- * How long `CadreNode.createInvite` holds the inbound gate open for strangers
- * when the invite carries no explicit expiry: the invitee must dial in before
- * it is authorized, and an expiry-less invite gives the gate no bound of its
- * own. Redeeming after this window still works once the owner re-mints (or the
- * caller re-opens the window via `CadreNode.openEnrollmentWindow`).
- */
-export const DEFAULT_ENROLLMENT_WINDOW_MS = 30 * 60 * 1000;
-/**
- * How long an `'admit-for-relay'` connection may exist without a relay
- * reservation being ADMITTED at the `denyInboundRelayReservation` hook, after
- * which the gate closes the underlying connection. A reserving client asks for
- * its slot immediately after the connection upgrades (`relay-reservation.ts`
- * dials and requests in one drive; a strand node's configured circuit listener
- * does the same from inside its own `listen()`), so a connection idle past this
- * deadline is not reserving.
- *
- * Derived from the link ({@link relayAdmissionReserveDeadlineMs}): one link round trip for the
- * request to arrive plus one admission decision on it. This is the value at the default
- * declaration; `CadreNode` passes the one derived from the relay's OWN declaration, because the
- * relay is the machine that decides.
+ * How long a provisionally admitted connection lasts before the gate re-asks the
+ * policy and closes it unless the peer is admissible by then (see the module
+ * doc's "Provisional admission").
+ *
+ * {@link relayedRequestBudgetMs}: 28 500 ms at the default declaration. The
+ * longest exchange a stranger legitimately starts on a fresh connection is a
+ * cadre invitation redemption, and the device abandons each member address after
+ * that same budget of its own declared link (`redeemAtMembers`): it covers the
+ * dial, the request, the member's catch-up push, the seat and the redemption. So
+ * a member never cuts an exchange the device is still waiting on, and a
+ * reservation request lands well inside it. This is the value at the default
+ * declaration; `CadreNode` passes the one derived from its OWN declaration.
+ *
+ * NOTE: accepted tradeoff — any stranger can hold a mute connection to any
+ * enrolled member for this long, weighed against letting a device redeem an
+ * invitation at a member that has not yet received its row (maintainer,
+ * 2026-10-07, plan `cadre-invite-redeemable-before-the-row-replicates`). It can
+ * open only stranger-open and transport streams (the protocol guard), and
+ * libp2p's connection-manager limits bound how many it holds. Revisit if stranger
+ * connections show up as load on a member.
  */
-export const RELAY_ADMISSION_RESERVE_DEADLINE_MS = relayAdmissionReserveDeadlineMs();
+export const PROVISIONAL_ADMISSION_DEADLINE_MS = relayedRequestBudgetMs();
 /**
- * Bound on the graceful close of an expired relay-only connection. It exists
+ * Bound on the graceful close of an expired provisional connection. It exists
  * because `AbstractMultiaddrConnection.close()` awaits an `idle`/`drain` event
  * when the connection still has unsent bytes, and that wait has no timeout of
  * its own — an unsignalled one never ends. This gate writes nothing to a
- * stranger, so the wait is not reachable today; the bound is here so a timer
+ * stranger, so the wait is not reachable from here; the bound is here so a timer
  * callback can never hold an unending await.
  *
  * Applied through {@link withDeadline}, not `AbortSignal.timeout`: the latter is
  * not reliably present on React Native/Hermes, which loads this same module.
  */
 // eslint-disable-next-line no-restricted-syntax -- link-independent: bounds a local connection close inside a timer callback, and expiry aborts the connection instead
-export const RELAY_ADMISSION_CLOSE_TIMEOUT_MS = 2000;
+export const PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS = 2000;
 /**
  * Default cap on concurrent relay reservations held by peers the membership
  * check could not place (see {@link UnauthorizedReservationBudget}). Small on
@@ -293,27 +323,30 @@ export class UnauthorizedReservationBudget {
  * membership — this node decides for itself who to talk to.
  *
  * Composition semantics: every hook of `base` is preserved as-is; on the three
- * composed hooks a deny from EITHER the base gater or the admission policy
- * denies. A policy error — or a decision slower than `decisionTimeoutMs` —
- * takes the fail-open outcome (connection admitted / reservation admitted, see
- * module doc); the base gater's verdict is still honored first.
+ * composed hooks a deny from the base gater denies, and so does the quiet
+ * period. The admission policy never denies a connection. A policy error — or a
+ * decision slower than `decisionTimeoutMs` — takes the fail-open outcome
+ * (connection admitted outright / reservation admitted, see module doc); the
+ * base gater's verdict is still honored first.
  *
- * An `'admit-for-relay'` verdict admits the connection and arms a
- * `reserveDeadlineMs` timer against it; the timer is disarmed when a
- * reservation for that peer is ADMITTED at the reservation hook, and closes the
- * underlying `MultiaddrConnection` when it fires first.
+ * An `'admit-provisionally'` verdict admits the connection and arms a
+ * `provisionalDeadlineMs` timer against it. When the timer fires the policy is
+ * asked again, and the underlying `MultiaddrConnection` is closed unless it now
+ * answers `'admit'`; a reservation for that peer ADMITTED at the reservation
+ * hook disarms the timer first.
  *
  * NOTE: `base` is spread, so a gater passed as a CLASS INSTANCE would lose its
  * prototype methods; every caller in this repo (and libp2p's own default)
  * supplies a plain object. If a class-based gater ever shows up, delegate
  * per-hook instead of spreading.
  *
- * Deny timing, as observed by the denied dialer: noise negotiates the muxer in
- * the security handshake's early data, so the DIALER's upgrade may complete
- * (its `dial()` resolves) before this receiver-side hook runs. The deny then
- * aborts the receiver's upgrade — the receiver never registers the connection
- * and never creates its muxer, so no protocol can ever be negotiated — and the
- * dialer sees its "open" connection close moments later.
+ * Deny timing, as observed by the denied dialer (a quiet-period or base-gater
+ * deny): noise negotiates the muxer in the security handshake's early data, so
+ * the DIALER's upgrade may complete (its `dial()` resolves) before this
+ * receiver-side hook runs. The deny then aborts the receiver's upgrade — the
+ * receiver never registers the connection and never creates its muxer, so no
+ * protocol can ever be negotiated — and the dialer sees its "open" connection
+ * close moments later.
  *
  * Control node only: strand cohort nodes legitimately connect cross-party
  * peers, so cadre membership never gates them. An OPEN strand's node receives
@@ -322,8 +355,9 @@ export class UnauthorizedReservationBudget {
  * evidence, not this module's membership admission — see
  * `strand-revocation-enforcer.ts`.
  */
-export function createMembershipConnectionGater(policy, base, decisionTimeoutMs = ADMISSION_DECISION_TIMEOUT_MS, reserveDeadlineMs = RELAY_ADMISSION_RESERVE_DEADLINE_MS) {
-    const pendingReservations = new PendingReserveDeadlines(reserveDeadlineMs);
+export function createMembershipConnectionGater(policy, base, decisionTimeoutMs = ADMISSION_DECISION_TIMEOUT_MS, provisionalDeadlineMs = PROVISIONAL_ADMISSION_DEADLINE_MS) {
+    const decideInbound = (remotePeerId) => decideWithinDeadline(() => policy.admitInbound(remotePeerId), 'admit', decisionTimeoutMs, `admitInbound(${remotePeerId})`);
+    const provisional = new ProvisionalAdmissions(provisionalDeadlineMs, decideInbound);
     const quiet = () => policy.bringUpInFlight?.() ?? false;
     return {
         ...base,
@@ -348,17 +382,16 @@ export function createMembershipConnectionGater(policy, base, decisionTimeoutMs
             const remotePeerId = peerId.toString();
             let verdict;
             try {
-                verdict = await decideWithinDeadline(() => policy.admitInbound(remotePeerId), 'admit', decisionTimeoutMs, `admitInbound(${remotePeerId})`);
+                verdict = await decideInbound(remotePeerId);
             }
             catch (error) {
                 log('admitInbound threw for %s — admitting (fail-open; stream gates decide): %o', remotePeerId, error);
                 return false;
             }
-            if (verdict === 'admit-for-relay') {
-                pendingReservations.arm(remotePeerId, maConn);
-                return false;
+            if (verdict === 'admit-provisionally') {
+                provisional.arm(remotePeerId, maConn);
             }
-            return verdict === 'deny';
+            return false;
         },
         denyInboundRelayReservation: async (peerId) => {
             if (await base?.denyInboundRelayReservation?.(peerId)) {
@@ -374,7 +407,7 @@ export function createMembershipConnectionGater(policy, base, decisionTimeoutMs
                 admitted = true;
             }
             if (admitted) {
-                pendingReservations.disarm(remotePeerId);
+                provisional.disarm(remotePeerId);
             }
             return !admitted;
         }
@@ -407,13 +440,12 @@ export async function decideWithinDeadline(decide, fallback, timeoutMs, what) {
     }
 }
 /**
- * The not-reserving deadlines for `'admit-for-relay'` connections, keyed by
- * remote peerId (a Set per peer — one peer can hold several in-flight
- * connections). `arm` starts a timer that closes the connection; `disarm`
- * (called when a reservation for that peer is admitted) cancels every pending
- * timer for the peer. Timers are unref'd so an armed deadline never holds a
- * process open, and a timer that fires against an already-closed connection is
- * a no-op (`close()` returns at once on any status but `open`).
+ * The deadlines of `'admit-provisionally'` connections, keyed by remote peerId
+ * (a Set per peer — one peer can hold several in-flight connections). `arm`
+ * starts a timer that re-asks the policy and closes the connection unless it now
+ * admits; `disarm` (called when a reservation for that peer is admitted) cancels
+ * every pending deadline for the peer, one whose question is already out
+ * included. Timers are unref'd so an armed deadline never holds a process open.
  *
  * Disarming is final for the connections it cancelled: a peer that reserved
  * once and then lets its reservation lapse keeps a mute connection (the
@@ -421,15 +453,16 @@ export async function decideWithinDeadline(decide, fallback, timeoutMs, what) {
  * side closes it. Bounded — only a peer the reservation policy already admitted
  * can reach that state, so unplaceable peers are bounded by the budget cap.
  */
-class PendingReserveDeadlines {
-    constructor(deadlineMs) {
+class ProvisionalAdmissions {
+    constructor(deadlineMs, decide) {
         this.deadlineMs = deadlineMs;
+        this.decide = decide;
         this.byPeer = new Map();
     }
     arm(remotePeerId, maConn) {
         const entry = {
             maConn,
-            timer: setTimeout(() => this.expire(remotePeerId, entry), this.deadlineMs)
+            timer: setTimeout(() => void this.expire(remotePeerId, entry), this.deadlineMs)
         };
         entry.timer.unref?.();
         let entries = this.byPeer.get(remotePeerId);
@@ -438,7 +471,7 @@ class PendingReserveDeadlines {
             this.byPeer.set(remotePeerId, entries);
         }
         entries.add(entry);
-        log('Admitted %s for relay only — dropping the connection unless a reservation is admitted within %dms', remotePeerId, this.deadlineMs);
+        log('Admitted %s provisionally — closing the connection in %dms unless it is admissible by then', remotePeerId, this.deadlineMs);
     }
     disarm(remotePeerId) {
         const entries = this.byPeer.get(remotePeerId);
@@ -450,17 +483,46 @@ class PendingReserveDeadlines {
             clearTimeout(entry.timer);
         }
     }
-    expire(remotePeerId, entry) {
+    async expire(remotePeerId, entry) {
+        if (entry.maConn.status !== 'open') {
+            this.release(remotePeerId, entry);
+            return;
+        }
+        const verdict = await this.recheck(remotePeerId);
+        // False when a reservation admitted while the question was out disarmed this deadline.
+        if (!this.release(remotePeerId, entry)) {
+            return;
+        }
+        if (verdict === 'admit') {
+            log('%s is admissible at its provisional deadline — keeping the connection', remotePeerId);
+            return;
+        }
+        log('Provisional admission expired for %s — still unplaced after %dms, closing the connection', remotePeerId, this.deadlineMs);
+        await this.drop(remotePeerId, entry.maConn);
+    }
+    /** The policy's answer at the deadline; a throw keeps the connection (fail-open). */
+    async recheck(remotePeerId) {
+        try {
+            return await this.decide(remotePeerId);
+        }
+        catch (error) {
+            log('admitInbound threw for %s at its provisional deadline — keeping the connection (fail-open): %o', remotePeerId, error);
+            return 'admit';
+        }
+    }
+    /** Forget `entry`; false when a `disarm` already took it. */
+    release(remotePeerId, entry) {
         const entries = this.byPeer.get(remotePeerId);
-        entries?.delete(entry);
-        if (entries?.size === 0) {
+        if (!entries?.delete(entry)) {
+            return false;
+        }
+        if (entries.size === 0) {
             this.byPeer.delete(remotePeerId);
         }
-        log('Relay-only admission expired for %s — no reservation admitted within %dms, closing the connection', remotePeerId, this.deadlineMs);
-        void this.drop(remotePeerId, entry.maConn);
+        return true;
     }
     /**
-     * End an expired relay-only connection: a bounded graceful close, with
+     * End an expired provisional connection: a bounded graceful close, with
      * `abort()` only as the escalation. The order cannot be reversed — `abort()`
      * marks the connection `aborted`, and `close()` returns immediately on any
      * status that is not `open`, so aborting first would make the close a silent
@@ -469,11 +531,11 @@ class PendingReserveDeadlines {
      */
     async drop(remotePeerId, maConn) {
         try {
-            await withDeadline(RELAY_ADMISSION_CLOSE_TIMEOUT_MS, `relay-only close for ${remotePeerId}`, (signal) => maConn.close({ signal }));
+            await withDeadline(PROVISIONAL_ADMISSION_CLOSE_TIMEOUT_MS, `provisional close for ${remotePeerId}`, (signal) => maConn.close({ signal }));
             return;
         }
         catch (error) {
-            log('Closing the expired relay-only connection from %s failed — aborting: %o', remotePeerId, error);
+            log('Closing the expired provisional connection from %s failed — aborting: %o', remotePeerId, error);
         }
         // NOTE: this fallback cannot actually free a WebSocket. `@libp2p/websockets`'
         // `sendReset()` calls `websocket.close(1006)`, and 1006 is a reserved code
@@ -485,10 +547,10 @@ class PendingReserveDeadlines {
         // far as this layer can go. Revisit — drop the fallback, or go back to a
         // plain `abort()` — once that transport sends a legal reset code.
         try {
-            maConn.abort(new Error(`relay-only admission expired: no relay reservation admitted within ${this.deadlineMs}ms`));
+            maConn.abort(new Error(`provisional admission expired: still unplaced after ${this.deadlineMs}ms`));
         }
         catch (error) {
-            log('Aborting the expired relay-only connection from %s threw: %o', remotePeerId, error);
+            log('Aborting the expired provisional connection from %s threw: %o', remotePeerId, error);
         }
     }
 }

package/dist/membership-connection-gater.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership-connection-gater.js","sourceRoot":"","sources":["../src/membership-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8JG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AAElG,MAAM,GAAG,GAAG,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,+BAA+B,EAAE,CAAC;AAErF;;;;;;;;;;GAUG;AACH,uKAAuK;AACvK,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAK,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AAwCrD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,6BAA6B;IAGxC;IACE,yFAAyF;IAChF,MAAc,mCAAmC,EACzC,QAAgB,8BAA8B;QADtD,QAAG,GAAH,GAAG,CAA8C;QACzC,UAAK,GAAL,KAAK,CAAyC;QALhD,aAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAMnD,CAAC;IAEJ,kFAAkF;IAClF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,wFAAwF;IACxF,QAAQ,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvE,GAAG,CAAC,6DAA6D,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/G,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,YAAoB;QAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAA8B,EAC9B,IAAsB,EACtB,oBAA4B,6BAA6B,EACzD,oBAA4B,mCAAmC;IAE/D,MAAM,mBAAmB,GAAG,IAAI,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,KAAK,CAAC;IACjE,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACvD,IAAI,MAAM,IAAI,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,EAAE,EAAE,CAAC;gBACZ,GAAG,CAAC,wEAAwE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,8BAA8B,EAAE,KAAK,EAAE,MAAc,EAAE,MAA2B,EAAoB,EAAE;YACtG,IAAI,MAAM,IAAI,EAAE,8BAA8B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,EAAE,EAAE,CAAC;gBACZ,GAAG,CAAC,+EAA+E,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,oBAAoB,CAClC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,YAAY,GAAG,CACrG,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,4EAA4E,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBACvG,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBAClC,mBAAmB,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,OAAO,KAAK,MAAM,CAAC;QAC5B,CAAC;QACD,2BAA2B,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACtE,IAAI,MAAM,IAAI,EAAE,2BAA2B,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,oBAAoB,CACnC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,yBAAyB,YAAY,GAAG,CACpH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,gEAAgE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBAC3F,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA4B,EAC5B,QAAW,EACX,SAAiB,EACjB,IAAY;IAEZ,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;gBACzB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,GAAG,CAAC,uEAAuE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;oBAC9F,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB;IAG3B,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;QAF9B,WAAM,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEvB,CAAC;IAEnD,GAAG,CAAC,YAAoB,EAAE,MAA2B;QACnD,MAAM,KAAK,GAA2B;YACpC,MAAM;YACN,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;SAC3E,CAAC;QACD,KAAK,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,GAAG,CAAC,mGAAmG,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1I,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAoB,EAAE,KAA6B;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,OAAO,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,mGAAmG,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxI,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,IAAI,CAAC,YAAoB,EAAE,MAA2B;QAClE,IAAI,CAAC;YACH,MAAM,YAAY,CAChB,gCAAgC,EAChC,wBAAwB,YAAY,EAAE,EACtC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CACrC,CAAC;YACF,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,yEAAyE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QACtG,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,gEAAgE;QAChE,uEAAuE;QACvE,wDAAwD;QACxD,gGAAgG;QAChG,6EAA6E;QAC7E,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,sEAAsE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QACrH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,8DAA8D,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"membership-connection-gater.js","sourceRoot":"","sources":["../src/membership-connection-gater.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqMG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAEzF,MAAM,GAAG,GAAG,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,sBAAsB,EAAE,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,uKAAuK;AACvK,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAK,CAAC;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC;AA4CrD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,6BAA6B;IAGxC;IACE,yFAAyF;IAChF,MAAc,mCAAmC,EACzC,QAAgB,8BAA8B;QADtD,QAAG,GAAH,GAAG,CAA8C;QACzC,UAAK,GAAL,KAAK,CAAyC;QALhD,aAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAMnD,CAAC;IAEJ,kFAAkF;IAClF,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,wFAAwF;IACxF,QAAQ,CAAC,YAAoB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACvE,GAAG,CAAC,6DAA6D,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/G,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,YAAoB;QAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChD,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,+BAA+B,CAC7C,MAA8B,EAC9B,IAAsB,EACtB,oBAA4B,6BAA6B,EACzD,wBAAgC,iCAAiC;IAEjE,MAAM,aAAa,GAAG,CAAC,YAAoB,EAAqC,EAAE,CAAC,oBAAoB,CACrG,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,YAAY,GAAG,CACrG,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,GAAY,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,EAAE,IAAI,KAAK,CAAC;IACjE,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACvD,IAAI,MAAM,IAAI,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,EAAE,EAAE,CAAC;gBACZ,GAAG,CAAC,wEAAwE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACjG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,8BAA8B,EAAE,KAAK,EAAE,MAAc,EAAE,MAA2B,EAAoB,EAAE;YACtG,IAAI,MAAM,IAAI,EAAE,8BAA8B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,EAAE,EAAE,CAAC;gBACZ,GAAG,CAAC,+EAA+E,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,4EAA4E,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBACvG,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;gBACtC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2BAA2B,EAAE,KAAK,EAAE,MAAc,EAAoB,EAAE;YACtE,IAAI,MAAM,IAAI,EAAE,2BAA2B,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,QAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,oBAAoB,CACnC,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,yBAAyB,YAAY,GAAG,CACpH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,gEAAgE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;gBAC3F,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAA4B,EAC5B,QAAW,EACX,SAAiB,EACjB,IAAY;IAEZ,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,EAAE;gBACzB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,GAAG,CAAC,uEAAuE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;oBAC9F,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB;IAGzB,YACmB,UAAkB,EAClB,MAAmE;QADnE,eAAU,GAAV,UAAU,CAAQ;QAClB,WAAM,GAAN,MAAM,CAA6D;QAJrE,WAAM,GAAG,IAAI,GAAG,EAAqC,CAAC;IAKpE,CAAC;IAEJ,GAAG,CAAC,YAAoB,EAAE,MAA2B;QACnD,MAAM,KAAK,GAAyB;YAClC,MAAM;YACN,KAAK,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC;SAChF,CAAC;QACD,KAAK,CAAC,KAAgC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,GAAG,CAAC,4FAA4F,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnI,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,YAAoB,EAAE,KAA2B;QACpE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjD,uFAAuF;QACvF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,GAAG,CAAC,uEAAuE,EAAE,YAAY,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,GAAG,CAAC,0FAA0F,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/H,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,OAAO,CAAC,YAAoB;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,gGAAgG,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC3H,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,6DAA6D;IACrD,OAAO,CAAC,YAAoB,EAAE,KAA2B;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,IAAI,CAAC,YAAoB,EAAE,MAA2B;QAClE,IAAI,CAAC;YACH,MAAM,YAAY,CAChB,sCAAsC,EACtC,yBAAyB,YAAY,EAAE,EACvC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CACrC,CAAC;YACF,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,0EAA0E,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QACvG,CAAC;QACD,8EAA8E;QAC9E,2EAA2E;QAC3E,gEAAgE;QAChE,uEAAuE;QACvE,wDAAwD;QACxD,gGAAgG;QAChG,6EAA6E;QAC7E,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,+DAA+D,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;CACF"}