@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/member-redemption.js

@@ -0,0 +1,490 @@
+/**
+ * The member-dialed redemption exchange shared by cadre invitations
+ * (`cadre-invite-protocol.ts`) and owner grants (`owner-grant-protocol.ts`): a holder dials ANY
+ * member machine its bundle names, proves possession in one signed frame, and the member writes
+ * rows on the issuer's behalf and answers in one frame. The issuer need not be online.
+ *
+ * What is the same for both credentials lives here, generic over the request and reply types:
+ *
+ * - the member side's hardening and sequencing ({@link MemberRedemptionHandler}): a concurrency
+ *   cap, a read timeout, the checks before any database work, the push of this member's control
+ *   store to the holder for a credential still live here, and the writes under that admission;
+ * - the holder side's dialing ({@link dialRedemption}, {@link dialRedemptionInPasses}): the
+ *   bundle's addresses one at a time under a per-address deadline, one signed request for every
+ *   address and every pass, and the pacing between passes;
+ * - the shape checks both directions apply off the wire, and the frame cap.
+ *
+ * What differs — the bundle, the request's fields and signatures, the refusal codes, the rows
+ * written and the reply's contents — stays in each protocol module, which passes it in. Same
+ * shape as the seed and wake protocols underneath: one length-prefixed JSON frame each way over
+ * the primitives in `control-stream.ts`.
+ */
+import debug from 'debug';
+import { multiaddr } from '@multiformats/multiaddr';
+import { withDeadline, exchangeFrame, readStreamToEnd, replyAndClose } from './control-stream.js';
+import { decodeLengthPrefixedFrame } from './seed-bootstrap.js';
+import { relayedRequestBudgetMs } from './link-budget.js';
+import { IssuedRowNotHereYetError, parseNullableStoredDatetimeMs } from './control-database.js';
+import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { dialAddr, nextMacrotask, trailingPeerId } from './peer-dial.js';
+import { chainMessages } from './control-retry.js';
+import { isRetriableControlWriteFailure } from './control-write-retry.js';
+const log = debug('sereus:cadre:member-redemption');
+/**
+ * Cap on either frame of either protocol. A request is one signed row, two signatures and a few
+ * addresses; a reply adds at most a peer list of a cadre's size. Both fit in a few KB; 64 KiB is
+ * the defensive bound a stranger can make the handler buffer.
+ */
+export const MAX_REDEMPTION_FRAME_BYTES = 64 * 1024;
+/**
+ * Default time the member waits for the request frame before aborting the read (ms). The read
+ * only: a stranger opens the stream, so the bound is on a caller that opens one and never sends.
+ * Same figure as the seed handler's.
+ */
+// eslint-disable-next-line no-restricted-syntax -- link-independent: a receiver cap on one frame on a stream the peer already opened; it bounds a peer that opens a stream and never sends, not the dial
+const DEFAULT_REDEEM_READ_TIMEOUT_MS = 10000;
+/** Default cap on concurrent inbound redemptions; over it the handler answers `busy`. */
+const DEFAULT_MAX_CONCURRENT_REDEMPTIONS = 100;
+/** Longest string field accepted off the wire; a stamp is 342 base64url chars, a signature 86. */
+export const MAX_WIRE_FIELD_LENGTH = 1024;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+// ── Shape checks (both directions, both protocols) ───────────────────────────
+export function isBoundedString(value, max = MAX_WIRE_FIELD_LENGTH) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+export function isEd25519KeyB64(value) {
+    if (!isBoundedString(value) || !BASE64URL.test(value))
+        return false;
+    try {
+        requireEd25519PublicKeyB64(value, 'key');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Is `value` a null-or-bounded-string column, as the nullable text columns of a travelling row are? */
+export function isNullableBoundedString(value, max = MAX_WIRE_FIELD_LENGTH) {
+    return value === null || isBoundedString(value, max);
+}
+/** Is `value` a null-or-positive-integer use cap? */
+export function isNullableUseCap(value) {
+    return value === null || (Number.isInteger(value) && value >= 1);
+}
+export function rejection(code, reason) {
+    return { accepted: false, code, reason };
+}
+/** Which named constraint, if any, refused the write — read off the error's cause chain. */
+export function constraintRefusal(error, table) {
+    if (!(error instanceof Error))
+        return null;
+    const messages = chainMessages(error);
+    for (const [pattern, code, reason] of table) {
+        if (messages.some((message) => pattern.test(message)))
+            return rejection(code, reason);
+    }
+    return null;
+}
+/**
+ * A write failure that is not a refusal: this member cannot read the credential row the cadre
+ * holds yet, or the retry gave up (`conflict`), or something else (`internal`).
+ */
+export function writeFailureRefusal(error) {
+    if (error instanceof IssuedRowNotHereYetError) {
+        return rejection('conflict', 'This member has not synced the credential yet; nothing was recorded');
+    }
+    // NOTE: a seat torn on a member alone with an uncaught-up device was measured answering
+    // `internal`, not `conflict` (cadre-invite-redeemed-at-a-member-without-the-row). Both are
+    // retryable, so the holder is unaffected; if the two codes ever diverge in retryability,
+    // find which tear `isRetriableControlWriteFailure` does not recognise.
+    return isRetriableControlWriteFailure(error)
+        ? rejection('conflict', 'The redemption write failed transiently; nothing was recorded')
+        : rejection('internal', 'Internal redemption error');
+}
+/**
+ * Member side of one redemption protocol: registers the handler and drives each inbound stream
+ * through the checks in cost order — shape, then whatever the protocol checks without database
+ * work (party, signatures, and for an invitation the connecting identity and target device) —
+ * so no database work happens for a stranger that cannot prove anything; then admits the holder
+ * to this member's control replication (`admitDevice`) when the credential is live here, and
+ * runs the protocol's writes. Hardened as the seed handler is: a concurrency cap (over it,
+ * `busy`) and a read timeout.
+ *
+ * Registered only by a started `CadreNode`, after its control database is up, like the
+ * formation responder; nothing here is reachable on a node without one.
+ *
+ * A subclass supplies the six credential-specific pieces: the request's shape, the checks after
+ * it, the read of the credential row this member holds, the liveness judgement behind the push,
+ * the writes, and the two fixed refusals the base sends on its own (`busy`, and `internal` for a
+ * frame it could not read or a failure it did not expect).
+ *
+ * The held row is read once, after the checks, and carried to the liveness judgement and the
+ * writes: the schema refuses every update and delete of an issued credential row, so the row
+ * read before the write lock is the row a read inside it would return.
+ */
+export class MemberRedemptionHandler {
+    /**
+     * @param label - Names the credential in log lines and stream labels ("Cadre invite", "Owner grant").
+     * @param protocolId - The protocol id {@link register} handles by default.
+     */
+    constructor(label, protocolId, options) {
+        this.label = label;
+        this.protocolId = protocolId;
+        this.registered = new Set();
+        this.active = 0;
+        this.partyId = options.partyId;
+        this.admitDevice = options.admitDevice;
+        this.readTimeoutMs = options.redeemReadTimeoutMs ?? DEFAULT_REDEEM_READ_TIMEOUT_MS;
+        this.maxConcurrent = options.maxConcurrentRedemptions ?? DEFAULT_MAX_CONCURRENT_REDEMPTIONS;
+    }
+    /** In-flight inbound redemptions. */
+    get activeCount() {
+        return this.active;
+    }
+    /**
+     * Register on `node`; rejects when libp2p refuses the registration. `runOnLimitedConnection`
+     * because a phone redeems through a relay, whose connection libp2p marks limited; the
+     * exchange is two small frames, well inside any relay's cap.
+     */
+    async register(node, protocolId = this.protocolId) {
+        if (this.registered.has(node))
+            return;
+        await node.handle(protocolId, async (rawStream, rawConnection) => {
+            await this.handleStream(rawStream, rawConnection.remotePeer.toString());
+        }, { runOnLimitedConnection: true });
+        this.registered.add(node);
+        log('%s handler registered (%s)', this.label, protocolId);
+    }
+    async unregister(node, protocolId = this.protocolId) {
+        if (!this.registered.has(node))
+            return;
+        await node.unhandle(protocolId);
+        this.registered.delete(node);
+        log('%s handler unregistered (%s)', this.label, protocolId);
+    }
+    /**
+     * One inbound redemption: read the frame, decide, reply, close. Public as the seam a protocol
+     * spec drives directly; `remotePeerId` is the connection's authenticated peer.
+     */
+    async handleStream(stream, remotePeerId) {
+        if (this.active >= this.maxConcurrent) {
+            log('%s: refusing redemption from %s: %d in flight at cap %d', this.label, remotePeerId, this.active, this.maxConcurrent);
+            await replyAndClose(stream, this.busyRefusal, this.label);
+            return;
+        }
+        this.active++;
+        try {
+            const reply = await this.decide(stream, remotePeerId);
+            log('%s: redemption from %s: %s', this.label, remotePeerId, reply.accepted ? 'accepted' : `refused (${reply.code})`);
+            await replyAndClose(stream, reply, this.label);
+        }
+        catch (error) {
+            log('%s: redemption from %s failed: %o', this.label, remotePeerId, error);
+            await replyAndClose(stream, this.internalRefusal, this.label);
+        }
+        finally {
+            this.active--;
+        }
+    }
+    /**
+     * Read the request frame to EOF, bounded and size-capped; JSON only, shape is the subclass's.
+     * Throws on a frame that cannot be read, which {@link handleStream} answers `internal`: a read
+     * timeout or a cut frame proves nothing about the credential, so the holder must stay free to
+     * try the next address.
+     */
+    async readRequest(stream) {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_REDEMPTION_FRAME_BYTES, timeoutMs: this.readTimeoutMs, label: this.label });
+        return JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_REDEMPTION_FRAME_BYTES)));
+    }
+    async decide(stream, remotePeerId) {
+        const request = await this.readRequest(stream);
+        if (!this.isWellFormedRequest(request))
+            return this.malformedRefusal;
+        const refused = this.checkRequest(request, remotePeerId);
+        if (refused)
+            return refused;
+        const held = await this.readHeld(request);
+        const release = await this.admitIfLive(request, remotePeerId, held);
+        try {
+            return await this.redeemAdmitted(request, remotePeerId, held);
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Admit the holder to this member's control replication before the first write of the
+     * exchange (the seat, when this member does not hold the row; otherwise the redemption), and
+     * resolve to the release that ends the admission. The holder is not a member, so only this
+     * puts it in this member's control write cohort, and it must be there to hold the rows the
+     * exchange writes. It is pushed the control store first, because a cohort node with no base
+     * revision of a block refuses a commit to it; a member alone with the holder would then have
+     * half its cohort refusing, and the write would tear instead of committing.
+     *
+     * Only for a credential still live here ({@link isLive}, judged on the row this member holds
+     * or, before the seat, on the bundle's copy once its issuer signature verifies): the holder
+     * of a withdrawn, expired or spent one, or of a forged copy naming a real owner, is refused
+     * without being sent anything. The retry of a redemption already written can read as spent
+     * too and is sent nothing; it needs nothing, since the rows it would hold are written and
+     * the ordinary catch-up reaches a member. Best-effort: a failed check or push is logged and
+     * the writes go ahead without the holder admitted, then commit or are answered retryably.
+     */
+    async admitIfLive(request, remotePeerId, held) {
+        const notAdmitted = () => undefined;
+        if (!this.admitDevice)
+            return notAdmitted;
+        try {
+            if (!await this.isLive(request, held)) {
+                log('%s: the credential is not live here; %s is not admitted before the write', this.label, remotePeerId);
+                return notAdmitted;
+            }
+            // NOTE: accepted tradeoff — when a write then fails (the seat refused, the last use
+            // taken by a race, the row expiring between this check and the write), the holder keeps
+            // a copy of a control store it was not admitted to. It holds a live owner-signed
+            // credential and proved possession and consent, and a seed hands an un-enrolled machine
+            // the same information. Revisit if a control table ever carries data a non-member must not see.
+            return await this.admitDevice(remotePeerId);
+        }
+        catch (error) {
+            log('%s: admitting %s before its write failed (writing anyway): %o', this.label, remotePeerId, error);
+            return notAdmitted;
+        }
+    }
+}
+/**
+ * Dial `addr`, open one stream to it, send the request, half-close, read the one reply frame.
+ * `signal` is the per-address deadline: it cancels the dial and resets a live stream.
+ *
+ * The address is dialed outside libp2p's dial queue (`dialAddr`), so another dial of the
+ * member in flight cannot capture this attempt; an open connection is still reused.
+ */
+async function exchangeRedemption(node, addr, options, signal, budgetMs) {
+    const connection = await dialAddr(node, addr, signal, `${options.label} redemption`);
+    // `runOnLimitedConnection`: a member may be reachable only through a relay (see `register`).
+    const rawStream = await connection.newStream(options.protocolId, { runOnLimitedConnection: true, signal });
+    return await exchangeFrame(rawStream, signal, options.request, async (stream) => {
+        const data = await readStreamToEnd(stream, { maxBytes: MAX_REDEMPTION_FRAME_BYTES, timeoutMs: budgetMs, label: `${options.label} reply` });
+        return decodeReply(JSON.parse(new TextDecoder().decode(decodeLengthPrefixedFrame(data, MAX_REDEMPTION_FRAME_BYTES))), options);
+    }, `${options.label} redemption aborted by its deadline`);
+}
+/**
+ * Read a reply frame into a typed reply. A refusal keeps only its code and reason, as sent;
+ * an acceptance is the protocol's to read. Throws on a frame that is neither.
+ */
+function decodeReply(value, options) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error(`${options.label} reply is not an object`);
+    }
+    const reply = value;
+    if (reply.accepted !== true) {
+        return { accepted: false, code: reply.code, reason: reply.reason };
+    }
+    return options.decodeAccepted(reply);
+}
+function isRefusal(reply) {
+    return reply.accepted === false;
+}
+function asError(error) {
+    if (error instanceof Error)
+        return error;
+    // A WebSocket transport rejects a refused dial with an `ErrorEvent`, whose text is its `message`.
+    const message = error?.message;
+    return new Error(typeof message === 'string' && message.length > 0 ? message : String(error), { cause: error });
+}
+/**
+ * Run `op` with a signal that aborts when either `deadline` or the caller's `signal` does.
+ * Relayed by hand rather than with `AbortSignal.any`, which the phone runtimes lack.
+ */
+async function underDeadlineAndCaller(deadline, caller, op) {
+    if (!caller)
+        return await op(deadline);
+    const either = new AbortController();
+    const abort = () => either.abort();
+    deadline.addEventListener('abort', abort, { once: true });
+    caller.addEventListener('abort', abort, { once: true });
+    // An abort between the caller's last check and the listener above fired no event.
+    if (caller.aborted)
+        abort();
+    try {
+        return await op(either.signal);
+    }
+    finally {
+        deadline.removeEventListener('abort', abort);
+        caller.removeEventListener('abort', abort);
+    }
+}
+/**
+ * One pass over the bundle's addresses, one at a time, each under its own deadline, stopping at
+ * the first acceptance or the first final refusal. A dial failure, a malformed reply or a
+ * retryable refusal moves to the next address. A final refusal and an acceptance that fails
+ * the holder's check are thrown from outside the per-address catch, so neither is ever
+ * mistaken for an address that could not be reached.
+ */
+async function dialOnce(node, options) {
+    const budgetMs = options.addressBudgetMs ?? relayedRequestBudgetMs(options.linkRoundTripMs);
+    const outcomes = [];
+    let memberAnswered = false;
+    for (const addr of options.members) {
+        options.signal?.throwIfAborted();
+        // Between attempts: a relayed address's relay leg goes through libp2p's dial queue, which
+        // needs a macrotask to drop an aborted job (see `tryAddrsInTurn`).
+        if (outcomes.length > 0)
+            await nextMacrotask();
+        let parsed;
+        try {
+            parsed = multiaddr(addr);
+        }
+        catch (error) {
+            outcomes.push({ addr, error: new Error('not a multiaddr', { cause: error }) });
+            continue;
+        }
+        let reply;
+        try {
+            reply = await withDeadline(budgetMs, `${options.label} redemption via ${addr}`, (deadline) => underDeadlineAndCaller(deadline, options.signal, (signal) => exchangeRedemption(node, parsed, options, signal, budgetMs)));
+        }
+        catch (error) {
+            // The caller's abort cut this attempt short; its reason, not the cut, is the answer.
+            options.signal?.throwIfAborted();
+            log('%s redemption via %s failed before an answer (%s); trying the next address', options.label, addr, asError(error).message);
+            outcomes.push({ addr, error: asError(error) });
+            continue;
+        }
+        if (isRefusal(reply)) {
+            const refusal = options.refusal(reply.code, reply.reason);
+            if (!refusal.retryable)
+                throw refusal;
+            log('%s redemption via %s refused retryably (%s); trying the next address', options.label, addr, refusal.message);
+            outcomes.push({ addr, error: refusal });
+            memberAnswered = true;
+            continue;
+        }
+        options.verifyAccepted(reply);
+        return { redeemed: { reply, memberPeerId: trailingPeerId(parsed), memberAddr: addr } };
+    }
+    return { outcomes, memberAnswered };
+}
+/**
+ * Holder side: try the bundle's addresses one at a time ({@link dialOnce}) and throw the
+ * protocol's unreachable error when none accepts.
+ *
+ * Every address gets the SAME request, with one usage nonce: the usage table is keyed by it,
+ * so a member the holder gave up on that was still committing cannot redeem it twice, and a
+ * retry at the next member after a dropped reply is answered as already done.
+ *
+ * @throws the protocol's rejected error on a final refusal, its reply-invalid error on an
+ *   acceptance that fails `verifyAccepted`, its unreachable error when every address was tried
+ *   and none accepted, and the reason of `options.signal` once it aborts.
+ */
+export async function dialRedemption(node, options) {
+    const outcome = await dialOnce(node, options);
+    if ('redeemed' in outcome)
+        return outcome.redeemed;
+    throw options.unreachable(outcome.outcomes);
+}
+/** Pause after the first pass in which no member accepted; doubled after each further one. */
+const REDEEM_PASS_FIRST_PAUSE_MS = 5000;
+/** Longest pause between passes. */
+const REDEEM_PASS_MAX_PAUSE_MS = 60000;
+/**
+ * Holder side, in passes: one {@link dialOnce} pass over the bundle's addresses, or, with
+ * `waitForMember`, as many as it takes, pausing between them (5 s after the first, doubling to
+ * 60 s, never past the credential's expiry). Every pass sends the same signed request, so a
+ * member that wrote the redemption on a pass whose reply was lost answers a later pass as
+ * already done, with no second usage row.
+ *
+ * A wait ends at the first acceptance, at a final refusal or an invalid reply (thrown as
+ * {@link dialRedemption} throws them), when the credential expires by this holder's clock
+ * (thrown as `expired()`), when `signal` aborts (its reason thrown), and when `node` stops. A
+ * bundle that names no address has nothing to wait for and throws at once.
+ */
+export async function dialRedemptionInPasses(node, options) {
+    for (let pass = 1;; pass++) {
+        if (options.waitForMember) {
+            // One pass leaves expiry to the member, whose clock decides; a wait has nothing else to end it.
+            refuseIfExpired(options);
+            refuseIfStopped(node, options.label);
+        }
+        reportProgress(options.onProgress, { state: 'redeeming', pass });
+        const outcome = await dialOnce(node, options);
+        if ('redeemed' in outcome)
+            return outcome.redeemed;
+        if (!options.waitForMember || outcome.outcomes.length === 0)
+            throw options.unreachable(outcome.outcomes);
+        const pauseMs = pauseAfterPass(pass, options.expiresAt);
+        reportProgress(options.onProgress, {
+            state: 'waiting',
+            pass,
+            retryAtMs: Date.now() + pauseMs,
+            // Any refusal means a member answered and is not ready yet; otherwise none answered at all.
+            reason: outcome.memberAnswered ? 'member-not-ready' : 'no-member-answered',
+            outcomes: outcome.outcomes
+        });
+        log('%s redemption pass %d found no member ready; the next pass in %d ms', options.label, pass, pauseMs);
+        await pause(pauseMs, options.signal, node);
+    }
+}
+// NOTE: judged by this holder's clock, so one running ahead ends a wait before the members
+// would refuse it. If waits are seen ending early on skewed phones, allow a grace margin here.
+function refuseIfExpired(options) {
+    const expiresAtMs = parseNullableStoredDatetimeMs(options.expiresAt);
+    if (expiresAtMs !== null && expiresAtMs <= Date.now()) {
+        throw options.expired();
+    }
+}
+/** A stopped node's every dial fails at once, which would otherwise read as "no member answered" until expiry. */
+function refuseIfStopped(node, label) {
+    if (node.status !== 'started') {
+        throw new Error(`${label} redemption stopped waiting: the node is ${node.status}`);
+    }
+}
+/** The pause after pass `pass`, cut short at the credential's expiry so the next check ends the wait then. */
+function pauseAfterPass(pass, expiresAt) {
+    const backoffMs = Math.min(REDEEM_PASS_FIRST_PAUSE_MS * 2 ** (pass - 1), REDEEM_PASS_MAX_PAUSE_MS);
+    const expiresAtMs = parseNullableStoredDatetimeMs(expiresAt);
+    return expiresAtMs === null ? backoffMs : Math.max(0, Math.min(backoffMs, expiresAtMs - Date.now()));
+}
+/** A UI callback must not break the join. */
+function reportProgress(onProgress, progress) {
+    if (!onProgress)
+        return;
+    try {
+        onProgress(progress);
+    }
+    catch (error) {
+        log('redemption progress callback threw (ignored): %o', error);
+    }
+}
+/**
+ * Wait `ms`, or reject with `signal`'s reason as soon as it aborts. Ends early, resolving, when
+ * `node` stops (or is already stopped), so the next pass's stop check ends the wait without a
+ * timer holding the process open. Listeners and timer are cleared however it ends.
+ */
+function pause(ms, signal, node) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        if (node.status !== 'started') {
+            resolve();
+            return;
+        }
+        const settle = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', onAbort);
+            node.removeEventListener('stop', onStop);
+        };
+        const onAbort = () => {
+            settle();
+            reject(signal.reason);
+        };
+        const onStop = () => {
+            settle();
+            resolve();
+        };
+        const timer = setTimeout(onStop, ms);
+        signal?.addEventListener('abort', onAbort, { once: true });
+        node.addEventListener('stop', onStop, { once: true });
+    });
+}
+//# sourceMappingURL=member-redemption.js.map

package/dist/member-redemption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-redemption.js","sourceRoot":"","sources":["../src/member-redemption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAkB,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAsB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtH,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAChG,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG1E,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD;;;;GAIG;AACH,yMAAyM;AACzM,MAAM,8BAA8B,GAAG,KAAM,CAAC;AAE9C,yFAAyF;AACzF,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAE/C,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,gFAAgF;AAEhF,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,GAAG,GAAG,qBAAqB;IACzE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,CAAC;QACH,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,GAAG,GAAG,qBAAqB;IACjF,OAAO,KAAK,KAAK,IAAI,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC;AAsBD,MAAM,UAAU,SAAS,CAAsB,IAAU,EAAE,MAAc;IACvE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAKD,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAsB,KAAc,EAAE,KAAgD;IACrH,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,UAAU,EAAE,qEAAqE,CAAC,CAAC;IACtG,CAAC;IACD,wFAAwF;IACxF,2FAA2F;IAC3F,yFAAyF;IACzF,uEAAuE;IACvE,OAAO,8BAA8B,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,+DAA+D,CAAC;QACxF,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAgB,uBAAuB;IAQ3C;;;OAGG;IACH,YAAyC,KAAa,EAAqB,UAAkB,EAAE,OAAuC;QAA7F,UAAK,GAAL,KAAK,CAAQ;QAAqB,eAAU,GAAV,UAAU,CAAQ;QAP5E,eAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,WAAM,GAAG,CAAC,CAAC;QAOjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;QACnF,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,wBAAwB,IAAI,kCAAkC,CAAC;IAC9F,CAAC;IAmBD,qCAAqC;IACrC,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,aAAqB,IAAI,CAAC,UAAU;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAkB,EAAE,aAAsB,EAAE,EAAE;YACjF,MAAM,IAAI,CAAC,YAAY,CAAC,SAA0B,EAAG,aAA4B,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,CAAC,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,aAAqB,IAAI,CAAC,UAAU;QACjE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAqB,EAAE,YAAoB;QAC5D,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,GAAG,CAAC,yDAAyD,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1H,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACtD,GAAG,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAa,KAA4B,CAAC,IAAI,GAAG,CAAC,CAAC;YAC7I,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC1E,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CAAC,MAAqB;QAC7C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACvI,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAqB,EAAE,YAAoB;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,WAAW,CAAC,OAAgB,EAAE,YAAoB,EAAE,IAAiB;QACjF,MAAM,WAAW,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,WAAW,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,0EAA0E,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBAC1G,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,oFAAoF;YACpF,wFAAwF;YACxF,iFAAiF;YACjF,wFAAwF;YACxF,gGAAgG;YAChG,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,+DAA+D,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YACtG,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAmDD;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,IAAe,EACf,OAA0C,EAC1C,MAAmB,EACnB,QAAgB;IAEhB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,aAAa,CAAC,CAAC;IACrF,6FAA6F;IAC7F,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,OAAO,MAAM,aAAa,CACxB,SAAqC,EACrC,MAAM,EACN,OAAO,CAAC,OAAO,EACf,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC3I,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,IAAI,EAAE,0BAA0B,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjI,CAAC,EACD,GAAG,OAAO,CAAC,KAAK,qCAAqC,CACtD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAW,KAAc,EAAE,OAA0C;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAW,KAAwC;IACnE,OAAQ,KAAgC,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC9D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,kGAAkG;IAClG,MAAM,OAAO,GAAI,KAAsC,EAAE,OAAO,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,QAAqB,EACrB,MAA+B,EAC/B,EAAuC;IAEvC,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,kFAAkF;IAClF,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAOD;;;;;;GAMG;AACH,KAAK,UAAU,QAAQ,CAAW,IAAY,EAAE,OAA0C;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5F,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,0FAA0F;QAC1F,mEAAmE;QACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,aAAa,EAAE,CAAC;QAC/C,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,mBAAmB,IAAI,EAAE,EAC5E,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qFAAqF;YACrF,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,4EAA4E,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/H,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,SAAS;gBAAE,MAAM,OAAO,CAAC;YACtC,GAAG,CAAC,sEAAsE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAClH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACxC,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAW,IAAY,EAAE,OAA0C;IACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,UAAU,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,8FAA8F;AAC9F,MAAM,0BAA0B,GAAG,IAAK,CAAC;AAEzC,oCAAoC;AACpC,MAAM,wBAAwB,GAAG,KAAM,CAAC;AAaxC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAW,IAAY,EAAE,OAA8C;IACjH,KAAK,IAAI,IAAI,GAAG,CAAC,GAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,gGAAgG;YAChG,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,UAAU,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE;YACjC,KAAK,EAAE,SAAS;YAChB,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAC/B,4FAA4F;YAC5F,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB;YAC1E,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,GAAG,CAAC,qEAAqE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzG,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,+FAA+F;AAC/F,SAAS,eAAe,CAAW,OAA8C;IAC/E,MAAM,WAAW,GAAG,6BAA6B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACtD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4CAA4C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,SAAS,cAAc,CAAC,IAAY,EAAE,SAAwB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACnG,MAAM,WAAW,GAAG,6BAA6B,CAAC,SAAS,CAAC,CAAC;IAC7D,OAAO,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,6CAA6C;AAC7C,SAAS,cAAc,CAAC,UAA+D,EAAE,QAA2B;IAClH,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CAAC,EAAU,EAAE,MAA+B,EAAE,IAAY;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/membership-view.d.ts

@@ -0,0 +1,91 @@
+/**
+ * An in-memory copy of one small control table's rows, kept until the table changes, so the
+ * membership, owner, peer-record and admission-chain reads that every flow repeats cost nothing
+ * after the first.
+ * `ControlDatabase` keeps one per cached table and drops it from its table-change subscription
+ * (`docs/architecture.md` → "Membership rows view"); this class holds only the caching rules, so
+ * they are testable without a database.
+ */
+/**
+ * How long installed rows are served before the next read reloads them, change or no change.
+ * The reload is the only path for a change that reaches this node with no storage event: a
+ * machine outside the block's cohort (a cadre larger than its replication breadth), or one in
+ * the cohort that the writer could not reach when it committed (one side of a NAT pair; the
+ * cohort auto-connect scenarios). Longer than Optimystic's read-repair window
+ * ({@link OPTIMYSTIC_READ_REPAIR_WINDOW_MS}), so the reload's storage read starts the cohort
+ * consult that brings such a change in instead of being served from the local copy, and
+ * shorter than any reconcile backstop (`DEFAULT_CONTROL_COHORT_RECONCILE_MS`, 2 minutes), so
+ * the backstop pass, the only reader on an idle party, reloads rather than serving kept rows.
+ * The reload rate on an idle party is therefore the pass rate, and the staleness bound for
+ * such a change is the backstop, not this value.
+ *
+ * A machine that was offline when a sibling committed is covered sooner than either:
+ * `CadreNode` drops every view when a sibling becomes reachable (its identify on a new
+ * connection; `ControlDatabase.invalidateMembershipViews`), so the pass that starts then reads
+ * storage.
+ */
+export declare const MEMBERSHIP_VIEW_MAX_AGE_MS = 15000;
+/**
+ * How long after a sibling becomes reachable (its identify on a new connection) `CadreNode`
+ * drops the views a second time: one read-repair window, plus a second for timer slop. The
+ * drop at the identify is not enough by itself. A node's reads before the sibling arrived
+ * (its start pass, with no cohort to ask) stamp the window, so the reload the identify
+ * starts is served from the local copy without a consult and the view would keep the
+ * pre-connection rows until {@link MEMBERSHIP_VIEW_MAX_AGE_MS}. The reload past the window
+ * starts the consults that bring in what the sibling committed while this node was away.
+ */
+export declare const MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS: number;
+/** One load's rows, and whether the view may keep them. */
+export interface MembershipViewLoad<Row> {
+    rows: readonly Row[];
+    /**
+     * False when no later change event is guaranteed to reach the view for these rows (the
+     * read that produced them did not arm the table's change bridge), so they serve only the
+     * callers of this load.
+     */
+    installable: boolean;
+}
+/**
+ * Reads the whole table. `retry` is the caller's: false from a caller holding the control
+ * write lock, whose read must not sleep a retry backoff.
+ */
+export type MembershipViewLoader<Row> = (retry: boolean) => Promise<MembershipViewLoad<Row>>;
+export interface MembershipViewOptions {
+    /** Default {@link MEMBERSHIP_VIEW_MAX_AGE_MS}. */
+    maxAgeMs?: number;
+    /** Monotonic clock in milliseconds; default `performance.now`. */
+    now?: () => number;
+}
+export declare class MembershipView<Row> {
+    private readonly loader;
+    private rows;
+    /** When the load that produced {@link rows} started: the rows are no older than this. */
+    private loadedAt;
+    /** Bumped by every {@link invalidate}; a load installs only if it is unchanged since the load began. */
+    private generation;
+    /**
+     * The load each `retry` flag's callers share, current generation only. Separate per flag
+     * so a caller under the write lock never awaits a retrying load's backoff sleep.
+     */
+    private readonly inFlight;
+    private readonly maxAgeMs;
+    private readonly now;
+    constructor(loader: MembershipViewLoader<Row>, options?: MembershipViewOptions);
+    /**
+     * The table's rows: the installed copy while it is younger than the maximum age, otherwise a
+     * load, shared with every caller of the same `retry` flag that arrives while it runs. A load
+     * that raced an {@link invalidate} answers its own callers with what it read, as an uncached
+     * read would have, and keeps nothing. A failed load keeps nothing and rejects.
+     */
+    read(retry: boolean): Promise<readonly Row[]>;
+    /** Read the table without serving, joining or keeping anything. */
+    readThrough(retry: boolean): Promise<readonly Row[]>;
+    /**
+     * Drop the installed rows and every load in flight, so the next read loads afresh and no
+     * earlier load installs. Synchronous and flag-setting only: the table-change handler calls
+     * it inside the committing call.
+     */
+    invalidate(): void;
+    private startLoad;
+    private load;
+}