@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/cadre-invite-protocol.js

@@ -0,0 +1,605 @@
+/**
+ * Cadre invitation redemption transport: `/sereus/cadre-invite/1.0.0`.
+ *
+ * A device holding a cadre invitation (an owner-signed `CadreInvite` row plus the private
+ * half of the invitation keypair, see {@link CadreInvitation}) dials ANY member machine the
+ * invitation names and proves possession; the member seats the row if it does not hold it
+ * yet, writes the device's `CadrePeer` row (and `OwnerKey` row, when the invitation grants
+ * ownership) through `ControlDatabase.redeemCadreInvite`, and answers with the party id,
+ * the row and dial hints. The owner that minted the invitation need not be online.
+ *
+ * Same shape as the seed and wake protocols: one length-prefixed JSON frame each way over
+ * the shared primitives in `control-stream.ts`. Stranger-facing by design — the device is
+ * not a member when it dials — so the connection gate admits a stranger while a live
+ * invitation exists (`membership-connection-gater.ts`), and the handler's own trust
+ * decision is the proof of possession: nothing touches the database for a caller that
+ * cannot prove it holds the invitation and is the identity it names.
+ *
+ * The seed protocol is left untouched so `SeedMessage` can grow independently.
+ */
+import debug from 'debug';
+import { multiaddr } from '@multiformats/multiaddr';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { sign } from '@optimystic/quereus-plugin-crypto';
+import { withDeadline, exchangeFrame, readStreamToEnd, replyAndClose } from './control-stream.js';
+import { decodeLengthPrefixedFrame } from './seed-bootstrap.js';
+import { relayedRequestBudgetMs } from './link-budget.js';
+import { cadreInviteRedeemMessage, cadreInviteConsentMessage, CadreInviteIssuerUnknownError, InvitationExhaustedError } from './control-database.js';
+import { verifyCadreInviteRow, verifyCadreInviteRedemption } from './peer-authorization.js';
+import { ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { trailingPeerId } from './peer-record.js';
+import { nextMacrotask } from './peer-dial.js';
+import { chainMessages } from './control-retry.js';
+import { isRetriableControlWriteFailure } from './control-write-retry.js';
+const log = debug('sereus:cadre:invite-proto');
+/** Protocol id for cadre invitation redemption (parallel to `/sereus/seed/1.0.0`). */
+export const CADRE_INVITE_PROTOCOL = '/sereus/cadre-invite/1.0.0';
+/**
+ * Cap on either frame. A request is one signed row, two signatures and a few addresses;
+ * a reply adds a peer list of a cadre's size. Both fit in a few KB; 64 KiB is the
+ * defensive bound a stranger can make the handler buffer.
+ */
+const MAX_CADRE_INVITE_MSG_SIZE = 64 * 1024;
+/**
+ * Default time the member waits for the request frame before aborting the read (ms). The
+ * read only: a stranger opens the stream, so the bound is on a caller that opens one and
+ * never sends. Same figure as the seed handler's.
+ */
+// eslint-disable-next-line no-restricted-syntax -- link-independent: a receiver cap on one frame on a stream the peer already opened; it bounds a peer that opens a stream and never sends, not the dial
+const DEFAULT_REDEEM_READ_TIMEOUT_MS = 10000;
+/** Default cap on concurrent inbound redemptions; over it the handler answers `busy`. */
+const DEFAULT_MAX_CONCURRENT_REDEMPTIONS = 100;
+/** Longest string field accepted off the wire; a stamp is 342 base64url chars, a signature 86. */
+const MAX_WIRE_FIELD_LENGTH = 1024;
+/** Most addresses a request may carry for the device, and a reply per peer (`sanitizeAddrs`). */
+const MAX_ADDRS = 16;
+/** Most machines an invitation bundle may name; the issuer caps its own list far below this. */
+const MAX_BUNDLE_MEMBERS = 64;
+/** Most peers a reply may carry as dial hints. */
+const MAX_REPLY_PEERS = 256;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** Encode a bundle for out-of-band delivery: base64url over JSON, as seeds and open invitations are. */
+export function encodeCadreInvitation(invitation) {
+    return uint8ArrayToString(new TextEncoder().encode(JSON.stringify(invitation)), 'base64url');
+}
+/**
+ * Decode a bundle, refusing anything that is not a well-formed version-1
+ * {@link CadreInvitation}. Standalone so a client without a node (a settings screen that
+ * wants to show which cadre an invitation joins) can decode one.
+ *
+ * @throws on a string that is not base64url JSON, or decodes to another shape or version.
+ */
+export function decodeCadreInvitation(encoded) {
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder().decode(uint8ArrayFromString(encoded.trim(), 'base64url')));
+    }
+    catch (error) {
+        throw new Error('Cadre invitation does not decode as base64url JSON', { cause: error });
+    }
+    if (!isWellFormedCadreInvitation(parsed)) {
+        throw new Error('Cadre invitation is malformed or of an unsupported version');
+    }
+    return parsed;
+}
+function isWellFormedCadreInvitation(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const { v, partyId, invitePrivateKey, invite, ownerKeys, members } = value;
+    return v === 1
+        && isBoundedString(partyId)
+        && isEd25519KeyB64(invitePrivateKey)
+        && isWellFormedCadreInviteRow(invite)
+        && Array.isArray(ownerKeys) && ownerKeys.length > 0 && ownerKeys.every((key) => isEd25519KeyB64(key))
+        && Array.isArray(members) && members.length <= MAX_BUNDLE_MEMBERS && members.every((addr) => isBoundedString(addr));
+}
+/** Which refusals are worth repeating at the next address — the one place that says so. */
+export const CADRE_INVITE_REJECTION_RETRYABLE = {
+    'issuer-unknown': true,
+    'invite-invalid': false,
+    'invite-spent': false,
+    'party-mismatch': false,
+    'busy': true,
+    'conflict': true,
+    'internal': true
+};
+/** Is `value` a code this build knows? Own keys only, so a peer's `'constructor'` does not pass. */
+export function isCadreInviteRejectionCode(value) {
+    return typeof value === 'string' && Object.prototype.hasOwnProperty.call(CADRE_INVITE_REJECTION_RETRYABLE, value);
+}
+function rejection(code, reason) {
+    return { accepted: false, code, reason };
+}
+// ── Errors the device sees ───────────────────────────────────────────────────
+/**
+ * A member answered and refused. `code` is `'unrecognized'` when the frame carried none this
+ * build knows (the two machines may run different versions), and such a refusal counts as
+ * retryable: trying the next address on an unknown answer is safe, giving up is not.
+ */
+export class CadreInviteRejectedError extends Error {
+    /** Both arguments come straight off the wire, so neither is trusted to have its declared type. */
+    constructor(code, reason) {
+        const text = typeof reason === 'string' ? reason : 'no reason provided';
+        super(`Cadre invitation refused: ${text}`);
+        this.name = 'CadreInviteRejectedError';
+        this.code = isCadreInviteRejectionCode(code) ? code : 'unrecognized';
+        this.reason = text;
+        this.retryable = this.code === 'unrecognized' || CADRE_INVITE_REJECTION_RETRYABLE[this.code];
+    }
+}
+/**
+ * Every address the bundle names was tried and none accepted: each failed to dial, answered
+ * malformed, or refused retryably. Always retryable; `outcomes` says what each address did.
+ */
+export class CadreInviteUnreachableError extends Error {
+    constructor(outcomes) {
+        super(outcomes.length === 0
+            ? 'Cadre invitation names no dialable member'
+            : `Cadre invitation could not be redeemed at any of its ${outcomes.length} address(es): `
+                + outcomes.map((outcome) => `${outcome.addr}: ${outcome.error.message}`).join('; '));
+        this.outcomes = outcomes;
+        this.retryable = true;
+        this.name = 'CadreInviteUnreachableError';
+    }
+}
+/**
+ * A member accepted but its reply does not check out: another party id, another invitation
+ * key, or a row not signed by one of the pinned owner keys. Final: a machine that answers
+ * like this is not a member of the cadre the invitation names, and the row it wrote (if any)
+ * is in a database the device will never trust.
+ */
+export class CadreInviteReplyInvalidError extends Error {
+    constructor(message) {
+        super(`Cadre invitation reply refused: ${message}`);
+        this.retryable = false;
+        this.name = 'CadreInviteReplyInvalidError';
+    }
+}
+// ── Shape checks (both directions) ───────────────────────────────────────────
+function isBoundedString(value, max = MAX_WIRE_FIELD_LENGTH) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+function isEd25519KeyB64(value) {
+    if (!isBoundedString(value) || !BASE64URL.test(value))
+        return false;
+    try {
+        requireEd25519PublicKeyB64(value, 'key');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Is `value` a {@link CadreInviteRow} with every column in its stored form and bounded? */
+export function isWellFormedCadreInviteRow(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const row = value;
+    return isEd25519KeyB64(row.key)
+        && (row.peerId === null || isBoundedString(row.peerId))
+        && typeof row.grantsOwner === 'boolean'
+        && (row.expiresAt === null || isBoundedString(row.expiresAt))
+        && (row.totalUses === null || (Number.isInteger(row.totalUses) && row.totalUses >= 1))
+        && isBoundedString(row.stampId)
+        && isEd25519KeyB64(row.issuerKey)
+        && isBoundedString(row.issuerSig);
+}
+function isWellFormedRedeemRequest(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const { v, partyId, invite, peerKey, multiaddrs, usageStampId, inviteSig, peerSig } = value;
+    return v === 1
+        && isBoundedString(partyId)
+        && isWellFormedCadreInviteRow(invite)
+        && isEd25519KeyB64(peerKey)
+        && Array.isArray(multiaddrs)
+        && isBoundedString(usageStampId)
+        && isBoundedString(inviteSig)
+        && isBoundedString(peerSig);
+}
+/**
+ * Keep only parsable, distinct multiaddr strings, capped at {@link MAX_ADDRS}, order kept.
+ * Applied on both sides: the member bounds what it stores on the device's row, the device
+ * bounds what it merges into its peer store. A malformed entry is skipped, not fatal.
+ */
+export function sanitizeAddrs(addrs) {
+    if (!Array.isArray(addrs))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const entry of addrs) {
+        if (out.length >= MAX_ADDRS)
+            break;
+        if (!isBoundedString(entry) || seen.has(entry))
+            continue;
+        try {
+            multiaddr(entry);
+        }
+        catch (error) {
+            log('addrs: skipping unparsable entry: %o', error);
+            continue;
+        }
+        seen.add(entry);
+        out.push(entry);
+    }
+    return out;
+}
+/** The reply's peer list, bounded and each entry's addresses sanitized; anything else dropped. */
+function sanitizePeers(peers) {
+    if (!Array.isArray(peers))
+        return [];
+    const out = [];
+    for (const entry of peers) {
+        if (out.length >= MAX_REPLY_PEERS)
+            break;
+        if (typeof entry !== 'object' || entry === null)
+            continue;
+        const { peerId, multiaddrs, isOwner, publicKey } = entry;
+        if (!isBoundedString(peerId))
+            continue;
+        out.push({
+            peerId,
+            multiaddrs: sanitizeAddrs(multiaddrs),
+            isOwner: isOwner === true,
+            ...(isEd25519KeyB64(publicKey) ? { publicKey } : {})
+        });
+    }
+    return out;
+}
+/**
+ * Read a reply frame into a typed reply, sanitizing the attacker-influenced fields of an
+ * acceptance. A refusal keeps only its code and reason, as sent. Throws on a frame that is
+ * neither.
+ */
+function decodeReply(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('Cadre invitation reply is not an object');
+    }
+    const reply = value;
+    if (reply.accepted !== true) {
+        return { accepted: false, code: reply.code, reason: reply.reason };
+    }
+    if (!isBoundedString(reply.partyId) || !isWellFormedCadreInviteRow(reply.invite)) {
+        throw new Error('Cadre invitation acceptance is missing its party id or a well-formed row');
+    }
+    return { accepted: true, partyId: reply.partyId, invite: reply.invite, peers: sanitizePeers(reply.peers) };
+}
+/**
+ * Build and sign the request for `invitation`: the holder's `'redeem'` signature with the
+ * invitation's private key and the device's `'consent'` signature with its own, both over
+ * (invitation key, `usageStampId`, device key) for the invitation's party. The same bytes
+ * the schema verifies at the member (`cadreInviteRedeemMessage` / `cadreInviteConsentMessage`),
+ * whose own `party_id()` must therefore be the party the bundle names.
+ */
+export function signRedeemRequest(invitation, signer, usageStampId, multiaddrs) {
+    const fields = { inviteKey: invitation.invite.key, usageStampId, peerKey: signer.peerKey };
+    const signB64 = (message, privateKey) => sign(message, privateKey, 'ed25519', 'bytes', 'base64url', 'base64url');
+    return {
+        v: 1,
+        partyId: invitation.partyId,
+        invite: invitation.invite,
+        peerKey: signer.peerKey,
+        multiaddrs: sanitizeAddrs(multiaddrs),
+        usageStampId,
+        inviteSig: signB64(cadreInviteRedeemMessage(invitation.partyId, fields), invitation.invitePrivateKey),
+        peerSig: signB64(cadreInviteConsentMessage(invitation.partyId, fields), signer.peerPrivateKey)
+    };
+}
+/**
+ * The device's check on an acceptance: the same party, the same invitation key, and a row
+ * signed by an issuer the device pinned from the bundle. Throws
+ * {@link CadreInviteReplyInvalidError} naming the first failure.
+ *
+ * What it proves is bounded: the request already carried the owner-signed row, so a machine
+ * that is not a member can echo it. The check catches a reply for another party or
+ * invitation and a row the pinned owners never signed; whether the answering machine is a
+ * member is settled afterwards, when the device syncs the control database and judges every
+ * row against its anchor (`CadreNode.listAuthorizedMembers`).
+ */
+export function verifyRedeemReply(reply, invitation, isTrustedIssuer) {
+    if (reply.partyId !== invitation.partyId) {
+        throw new CadreInviteReplyInvalidError(`the member serves party ${reply.partyId}, the invitation names ${invitation.partyId}`);
+    }
+    if (reply.invite.key !== invitation.invite.key) {
+        throw new CadreInviteReplyInvalidError('the member answered for a different invitation');
+    }
+    if (!isTrustedIssuer(reply.invite.issuerKey)) {
+        throw new CadreInviteReplyInvalidError('the row the member holds is not issued by one of the invitation\'s owner keys');
+    }
+    if (!verifyCadreInviteRow(invitation.partyId, reply.invite)) {
+        throw new CadreInviteReplyInvalidError('the row the member holds is not signed by its issuer');
+    }
+}
+/** Constraint names the schema refuses a redemption with, and the code each maps to. */
+const REDEEM_CONSTRAINT_CODES = [
+    [/CHECK constraint failed: Authorized\b/, 'invite-spent', 'The invitation is expired, withdrawn, exhausted, or its issuer is no longer an owner'],
+    [/CHECK constraint failed: (InvitePossessed|PeerConsented|PeerExists|OwnerExists)\b/, 'invite-invalid', 'The redemption does not satisfy the invitation'],
+    [/CHECK constraint failed: NotRevoked\b/, 'invite-spent', 'The invitation was withdrawn'],
+];
+/** Which named constraint, if any, refused the write — read off the error's cause chain. */
+function constraintRejection(error) {
+    if (!(error instanceof Error))
+        return null;
+    const messages = chainMessages(error);
+    for (const [pattern, code, reason] of REDEEM_CONSTRAINT_CODES) {
+        if (messages.some((message) => pattern.test(message)))
+            return rejection(code, reason);
+    }
+    return null;
+}
+/** A write failure that is not a refusal: the retry gave up (`conflict`), or something else (`internal`). */
+function writeFailureRejection(error) {
+    // NOTE: a seat torn on a member alone with an uncaught-up device was measured answering
+    // `internal`, not `conflict` (cadre-invite-redeemed-at-a-member-without-the-row). Both are
+    // retryable, so the device is unaffected; if the two codes ever diverge in retryability,
+    // find which tear `isRetriableControlWriteFailure` does not recognise.
+    return isRetriableControlWriteFailure(error)
+        ? rejection('conflict', 'The redemption write failed transiently; nothing was recorded')
+        : rejection('internal', 'Internal redemption error');
+}
+/**
+ * Member side: registers the handler and drives each inbound stream through the checks in
+ * cost order — shape, connecting identity, both signatures, target device — so no database
+ * work happens for a stranger that cannot prove anything, then hands the device the control
+ * store (`catchUpDevice`), seats the row and redeems.
+ * Hardened as the seed handler is: a concurrency cap (over it, `busy`) and a read timeout.
+ *
+ * Registered only by a started `CadreNode`, after its control database is up, like the
+ * formation responder; nothing here is reachable on a node without one.
+ */
+export class CadreInviteHandler {
+    constructor(options) {
+        this.registered = new Set();
+        this.active = 0;
+        this.options = options;
+        this.readTimeoutMs = options.redeemReadTimeoutMs ?? DEFAULT_REDEEM_READ_TIMEOUT_MS;
+        this.maxConcurrent = options.maxConcurrentRedemptions ?? DEFAULT_MAX_CONCURRENT_REDEMPTIONS;
+    }
+    /** In-flight inbound redemptions. */
+    get activeCount() {
+        return this.active;
+    }
+    /**
+     * Register on `node`; rejects when libp2p refuses the registration. `runOnLimitedConnection`
+     * because a phone redeems through a relay, whose connection libp2p marks limited; the
+     * exchange is two small frames, well inside any relay's cap.
+     */
+    async register(node, protocolId = CADRE_INVITE_PROTOCOL) {
+        if (this.registered.has(node))
+            return;
+        await node.handle(protocolId, async (rawStream, rawConnection) => {
+            await this.handleStream(rawStream, rawConnection.remotePeer.toString());
+        }, { runOnLimitedConnection: true });
+        this.registered.add(node);
+        log('cadre invitation handler registered (%s)', protocolId);
+    }
+    async unregister(node, protocolId = CADRE_INVITE_PROTOCOL) {
+        if (!this.registered.has(node))
+            return;
+        await node.unhandle(protocolId);
+        this.registered.delete(node);
+        log('cadre invitation handler unregistered (%s)', protocolId);
+    }
+    /**
+     * One inbound redemption: read the frame, decide, reply, close. Public as the seam the
+     * protocol spec drives directly; `remotePeerId` is the connection's authenticated peer.
+     */
+    async handleStream(stream, remotePeerId) {
+        if (this.active >= this.maxConcurrent) {
+            log('refusing redemption from %s: %d in flight at cap %d', remotePeerId, this.active, this.maxConcurrent);
+            await replyAndClose(stream, rejection('busy', 'Too many concurrent redemptions'), 'Cadre invite');
+            return;
+        }
+        this.active++;
+        try {
+            const reply = await this.decide(stream, remotePeerId);
+            log('redemption from %s: %s', remotePeerId, reply.accepted ? 'accepted' : `refused (${reply.code})`);
+            await replyAndClose(stream, reply, 'Cadre invite');
+        }
+        catch (error) {
+            log('redemption from %s failed: %o', remotePeerId, error);
+            await replyAndClose(stream, rejection('internal', 'Internal redemption error'), 'Cadre invite');
+        }
+        finally {
+            this.active--;
+        }
+    }
+    /**
+     * Read the request frame to EOF, bounded and size-capped; JSON only, shape is `decide`'s.
+     * Throws on a frame that cannot be read, which {@link handleStream} answers `internal`:
+     * a read timeout or a cut frame proves nothing about the invitation, so the device must
+     * stay free to try the next address.
+     */
+    async readRequest(stream) {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_CADRE_INVITE_MSG_SIZE, timeoutMs: this.readTimeoutMs, label: 'Cadre invite' });
+        return JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_CADRE_INVITE_MSG_SIZE)));
+    }
+    async decide(stream, remotePeerId) {
+        const request = await this.readRequest(stream);
+        const refused = this.checkRequest(request, remotePeerId);
+        if (refused)
+            return refused;
+        return await this.seatAndRedeem(request, remotePeerId);
+    }
+    /**
+     * The checks that cost no database work, in order: shape, party, connecting identity (an
+     * ed25519 peer id is an identity multihash of the very key, and this is the only layer that
+     * can check the pair), both signatures, and a targeted invitation's device.
+     */
+    checkRequest(request, remotePeerId) {
+        if (!isWellFormedRedeemRequest(request)) {
+            return rejection('invite-invalid', 'Malformed redemption request');
+        }
+        if (request.partyId !== this.options.partyId) {
+            return rejection('party-mismatch', 'This machine serves another cadre');
+        }
+        if (ed25519PublicKeyB64FromPeerId(remotePeerId) !== request.peerKey) {
+            return rejection('invite-invalid', 'The peer key is not the connecting identity');
+        }
+        const fields = { inviteKey: request.invite.key, usageStampId: request.usageStampId, peerKey: request.peerKey };
+        if (!verifyCadreInviteRedemption(this.options.partyId, fields, request.inviteSig, request.peerSig)) {
+            return rejection('invite-invalid', 'The redemption signatures do not verify');
+        }
+        if (request.invite.peerId !== null && request.invite.peerId !== remotePeerId) {
+            return rejection('invite-invalid', 'The invitation names another device');
+        }
+        return null;
+    }
+    /**
+     * Hand the device this member's control store, seat the row from the bundle (its own
+     * transaction; a no-op when held), then redeem. The push comes first because the seat is
+     * already a write the device takes part in (see {@link catchUpDeviceIfLive}). An issuer this
+     * member does not know as an owner is the one retryable refusal left: the device tries the
+     * next address, which may hold the issuer's row.
+     */
+    async seatAndRedeem(request, remotePeerId) {
+        const { store } = this.options;
+        await this.catchUpDeviceIfLive(request.invite, remotePeerId);
+        try {
+            await store.seatCadreInvite(request.invite);
+        }
+        catch (error) {
+            if (error instanceof CadreInviteIssuerUnknownError) {
+                return rejection('issuer-unknown', 'The invitation\'s issuer is not known as an owner here');
+            }
+            log('seating invitation %s from %s failed: %o', request.invite.key, remotePeerId, error);
+            return constraintRejection(error) ?? writeFailureRejection(error);
+        }
+        try {
+            const result = await store.redeemCadreInvite({
+                inviteKey: request.invite.key,
+                peerId: remotePeerId,
+                peerKey: request.peerKey,
+                multiaddrs: sanitizeAddrs(request.multiaddrs),
+                usageStampId: request.usageStampId,
+                inviteSig: request.inviteSig,
+                peerSig: request.peerSig
+            });
+            log('invitation %s redeemed by %s (alreadyMember=%s)', request.invite.key, remotePeerId, result.alreadyMember);
+        }
+        catch (error) {
+            if (error instanceof InvitationExhaustedError) {
+                return rejection('invite-spent', 'The invitation has no uses left');
+            }
+            log('redeeming invitation %s for %s failed: %o', request.invite.key, remotePeerId, error);
+            return constraintRejection(error) ?? writeFailureRejection(error);
+        }
+        // The row as held: the seat inserted this copy verbatim, or found the same row (its key
+        // is the primary key and every column is under the issuer's signature).
+        return { accepted: true, partyId: this.options.partyId, invite: request.invite, peers: await this.peersBestEffort() };
+    }
+    /**
+     * Push this member's control store to the device before the first write of the exchange
+     * (the seat, when this member does not hold the row; otherwise the admission). The device
+     * joined this member's control write cohort when it connected, and a cohort node with no
+     * base revision of a block refuses a commit to it; a member alone with the device then has
+     * half its cohort refusing, and the write tears instead of committing. With the store in
+     * hand the device holds the write too.
+     *
+     * Only for an invitation still live here, judged on the row this member holds or, before
+     * the seat, on the bundle's copy once its issuer signature verifies
+     * (`ControlDatabase.isCadreInviteLive`): the holder of a withdrawn, expired or spent one,
+     * or of a forged copy naming a real owner, is refused without being sent anything. The
+     * retry of an admission already written can read as spent too and is sent nothing; it
+     * needs nothing, since the device is a member and the ordinary catch-up reaches it.
+     * Best-effort: a failed check or push is logged and the writes go ahead, then commit or are
+     * answered retryably.
+     */
+    async catchUpDeviceIfLive(invite, remotePeerId) {
+        const { catchUpDevice, store } = this.options;
+        if (!catchUpDevice)
+            return;
+        try {
+            if (!await store.isCadreInviteLive(invite)) {
+                log('invitation %s is not live here; %s is not caught up before the write', invite.key, remotePeerId);
+                return;
+            }
+            // NOTE: accepted tradeoff — when a write then fails (the seat refused, the last use
+            // taken by a race, the row expiring between this check and the write), the device keeps
+            // a copy of a control store it was not admitted to. It holds a live owner-signed
+            // invitation and proved possession and consent, and a seed hands an un-enrolled machine
+            // the same information. Revisit if a control table ever carries data a non-member must not see.
+            await catchUpDevice(remotePeerId);
+        }
+        catch (error) {
+            log('catching up %s before its admission failed (writing anyway): %o', remotePeerId, error);
+        }
+    }
+    /** Dial hints are an optimization; a failed read costs the device its hints, not its membership. */
+    async peersBestEffort() {
+        try {
+            return await this.options.store.querySeedPeers();
+        }
+        catch (error) {
+            log('peer projection for the reply failed (continuing without hints): %o', error);
+            return [];
+        }
+    }
+}
+/**
+ * Open one stream to `addr`, send the request, half-close, read the one reply frame.
+ * `signal` is the per-address deadline: it cancels the dial and resets a live stream.
+ */
+async function exchangeRedemption(node, addr, request, signal, budgetMs, protocolId) {
+    // `runOnLimitedConnection`: a member may be reachable only through a relay (see `register`).
+    const rawStream = await node.dialProtocol(addr, protocolId, { runOnLimitedConnection: true, signal });
+    return await exchangeFrame(rawStream, signal, request, async (stream) => {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_CADRE_INVITE_MSG_SIZE, timeoutMs: budgetMs, label: 'Cadre invite reply' });
+        return decodeReply(JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_CADRE_INVITE_MSG_SIZE))));
+    }, 'Cadre invitation redemption aborted by its deadline');
+}
+function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+/**
+ * Device side: try the bundle's addresses one at a time, each under its own deadline, and
+ * stop at the first acceptance or the first final refusal. A dial failure, a malformed
+ * reply or a retryable refusal moves to the next address.
+ *
+ * Every address gets the SAME request, with one `usageStampId`: `CadreInviteUsage` is keyed
+ * by it, so a member the device gave up on that was still committing cannot admit it twice,
+ * and a retry at the next member after a dropped reply is answered as already a member.
+ *
+ * @throws {CadreInviteRejectedError} on a final refusal (its `retryable` is false).
+ * @throws {CadreInviteReplyInvalidError} on an acceptance that fails {@link verifyRedeemReply}.
+ * @throws {CadreInviteUnreachableError} when every address was tried and none accepted.
+ */
+export async function redeemAtMembers(node, options) {
+    const protocolId = options.protocolId ?? CADRE_INVITE_PROTOCOL;
+    const budgetMs = options.addressBudgetMs ?? relayedRequestBudgetMs(options.linkRoundTripMs);
+    const outcomes = [];
+    for (const addr of options.invitation.members) {
+        // Between attempts: libp2p's dial queue needs a macrotask to drop an aborted job.
+        if (outcomes.length > 0)
+            await nextMacrotask();
+        let parsed;
+        try {
+            parsed = multiaddr(addr);
+        }
+        catch (error) {
+            outcomes.push({ addr, error: new Error('not a multiaddr', { cause: error }) });
+            continue;
+        }
+        try {
+            const reply = await withDeadline(budgetMs, `Cadre invitation redemption via ${addr}`, (signal) => exchangeRedemption(node, parsed, options.request, signal, budgetMs, protocolId));
+            if (!reply.accepted) {
+                const refusal = new CadreInviteRejectedError(reply.code, reply.reason);
+                if (!refusal.retryable)
+                    throw refusal;
+                log('redemption via %s refused retryably (%s); trying the next address', addr, refusal.code);
+                outcomes.push({ addr, error: refusal });
+                continue;
+            }
+            verifyRedeemReply(reply, options.invitation, options.isTrustedIssuer);
+            return { reply, memberPeerId: trailingPeerId(parsed), memberAddr: addr };
+        }
+        catch (error) {
+            if (error instanceof CadreInviteRejectedError || error instanceof CadreInviteReplyInvalidError)
+                throw error;
+            log('redemption via %s failed before an answer (%s); trying the next address', addr, asError(error).message);
+            outcomes.push({ addr, error: asError(error) });
+        }
+    }
+    throw new CadreInviteUnreachableError(outcomes);
+}
+//# sourceMappingURL=cadre-invite-protocol.js.map

package/dist/cadre-invite-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cadre-invite-protocol.js","sourceRoot":"","sources":["../src/cadre-invite-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACzD,OAAO,EAAsB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,GAAG,GAAG,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAE/C,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C;;;;GAIG;AACH,yMAAyM;AACzM,MAAM,8BAA8B,GAAG,KAAM,CAAC;AAE9C,yFAAyF;AACzF,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAE/C,kGAAkG;AAClG,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,iGAAiG;AACjG,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,kDAAkD;AAClD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAuCrC,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,UAA2B;IAC/D,OAAO,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAgC,CAAC;IACtG,OAAO,CAAC,KAAK,CAAC;WACT,eAAe,CAAC,OAAO,CAAC;WACxB,eAAe,CAAC,gBAAgB,CAAC;WACjC,0BAA0B,CAAC,MAAM,CAAC;WAClC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;WAClG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AACxH,CAAC;AAqDD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAwD;IACnG,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,KAAK;IACvB,cAAc,EAAE,KAAK;IACrB,gBAAgB,EAAE,KAAK;IACvB,MAAM,EAAE,IAAI;IACZ,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,IAAI;CACjB,CAAC;AAEF,oGAAoG;AACpG,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;AACpH,CAAC;AAgDD,SAAS,SAAS,CAAC,IAA8B,EAAE,MAAc;IAC/D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAKjD,kGAAkG;IAClG,YAAY,IAAa,EAAE,MAAe;QACxC,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACxE,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;CACF;AASD;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAGpD,YAAqB,QAA8C;QACjE,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,wDAAwD,QAAQ,CAAC,MAAM,gBAAgB;kBACrF,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAJtE,aAAQ,GAAR,QAAQ,CAAsC;QAF1D,cAAS,GAAG,IAAI,CAAC;QAOxB,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAGrD,YAAY,OAAe;QACzB,KAAK,CAAC,mCAAmC,OAAO,EAAE,CAAC,CAAC;QAH7C,cAAS,GAAG,KAAK,CAAC;QAIzB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,gFAAgF;AAEhF,SAAS,eAAe,CAAC,KAAc,EAAE,GAAG,GAAG,qBAAqB;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;WAC1B,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;WACpD,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS;WACpC,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;WAC1D,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAK,GAAG,CAAC,SAAoB,IAAI,CAAC,CAAC,CAAC;WAC/F,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;WAC5B,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;WAC9B,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAgC,CAAC;IACvH,OAAO,CAAC,KAAK,CAAC;WACT,eAAe,CAAC,OAAO,CAAC;WACxB,0BAA0B,CAAC,MAAM,CAAC;WAClC,eAAe,CAAC,OAAO,CAAC;WACxB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;WACzB,eAAe,CAAC,YAAY,CAAC;WAC7B,eAAe,CAAC,SAAS,CAAC;WAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;QACnC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACzD,IAAI,CAAC;YACH,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,MAAM,IAAI,eAAe;YAAE,MAAM;QACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAgC,CAAC;QACpF,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;YACrC,OAAO,EAAE,OAAO,KAAK,IAAI;YACzB,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7G,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA2B,EAC3B,MAAoB,EACpB,YAAoB,EACpB,UAAoB;IAEpB,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,CAAC,OAAmB,EAAE,UAAkB,EAAU,EAAE,CAClE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;IACpF,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC;QACrC,YAAY;QACZ,SAAS,EAAE,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC;QACrG,OAAO,EAAE,OAAO,CAAC,yBAAyB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;KAC/F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAA0B,EAC1B,UAA2B,EAC3B,eAA8C;IAE9C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,4BAA4B,CAAC,2BAA2B,KAAK,CAAC,OAAO,0BAA0B,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,IAAI,4BAA4B,CAAC,gDAAgD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,4BAA4B,CAAC,+EAA+E,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,4BAA4B,CAAC,sDAAsD,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAwBD,wFAAwF;AACxF,MAAM,uBAAuB,GAA8D;IACzF,CAAC,uCAAuC,EAAE,cAAc,EAAE,sFAAsF,CAAC;IACjJ,CAAC,mFAAmF,EAAE,gBAAgB,EAAE,gDAAgD,CAAC;IACzJ,CAAC,uCAAuC,EAAE,cAAc,EAAE,8BAA8B,CAAC;CAC1F,CAAC;AAEF,4FAA4F;AAC5F,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6GAA6G;AAC7G,SAAS,qBAAqB,CAAC,KAAc;IAC3C,wFAAwF;IACxF,2FAA2F;IAC3F,yFAAyF;IACzF,uEAAuE;IACvE,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,+DAA+D,CAAC;QACxF,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,kBAAkB;IAO7B,YAAY,OAAkC;QAH7B,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,WAAM,GAAG,CAAC,CAAC;QAGjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;QACnF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IAC9F,CAAC;IAED,qCAAqC;IACrC,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,aAAqB,qBAAqB;QACrE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAkB,EAAE,aAAsB,EAAE,EAAE;YACjF,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,EAAG,aAA4B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,0CAA0C,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,aAAqB,qBAAqB;QACvE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,4CAA4C,EAAE,UAAU,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,GAAG,CAAC,qDAAqD,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1G,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,iCAAiC,CAAC,EAAE,cAAc,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtD,GAAG,CAAC,wBAAwB,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACrG,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,+BAA+B,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,EAAE,cAAc,CAAC,CAAC;QAClG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,MAAqB;QAC7C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,YAAoB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,OAAmC,EAAE,YAAY,CAAC,CAAC;IACrF,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,OAAgB,EAAE,YAAoB;QACzD,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,OAAO,SAAS,CAAC,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,6BAA6B,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/G,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnG,OAAO,SAAS,CAAC,gBAAgB,EAAE,yCAAyC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7E,OAAO,SAAS,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,OAAiC,EAAE,YAAoB;QACjF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC,gBAAgB,EAAE,wDAAwD,CAAC,CAAC;YAC/F,CAAC;YACD,GAAG,CAAC,0CAA0C,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACzF,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC;gBAC3C,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;gBAC7B,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,GAAG,CAAC,iDAAiD,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACjH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;gBAC9C,OAAO,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,2CAA2C,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC1F,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,wFAAwF;QACxF,wEAAwE;QACxE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;IACxH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAsB,EAAE,YAAoB;QAC5E,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC9C,IAAI,CAAC,aAAa;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,sEAAsE,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACtG,OAAO;YACT,CAAC;YACD,oFAAoF;YACpF,wFAAwF;YACxF,iFAAiF;YACjF,wFAAwF;YACxF,gGAAgG;YAChG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,iEAAiE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,oGAAoG;IAC5F,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,qEAAqE,EAAE,KAAK,CAAC,CAAC;YAClF,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA+BD;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,IAAe,EACf,OAAiC,EACjC,MAAmB,EACnB,QAAgB,EAChB,UAAkB;IAElB,6FAA6F;IAC7F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACtG,OAAO,MAAM,aAAa,CACxB,SAAqC,EACrC,MAAM,EACN,OAAO,EACP,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACtI,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvH,CAAC,EACD,qDAAqD,CACtD,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,OAA+B;IACjF,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9C,kFAAkF;QAClF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/C,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,mCAAmC,IAAI,EAAE,EAClF,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvE,IAAI,CAAC,OAAO,CAAC,SAAS;oBAAE,MAAM,OAAO,CAAC;gBACtC,GAAG,CAAC,mEAAmE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;YACtE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,4BAA4B;gBAAE,MAAM,KAAK,CAAC;YAC5G,GAAG,CAAC,yEAAyE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAC7G,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC"}