@cello-protocol/daemon 0.0.122 → 0.0.123

package/dist/document-rejection.d.ts

@@ -1,224 +0,0 @@
-/**
- * DOD-DOC-REJECT-1 — rejection and supersession (§3.2, §16.7-2).
- *
- * ── WHY SUPERSESSION, AND NOT "BOTH SIDES ROLL BACK" ──────────────────────────────────────────
- *
- * The naive protocol is: the receiver discards, the sender undoes locally, and both return to the
- * pre-update state. It does not work, and the reason is a property of CRDTs rather than a bug.
- *
- * **Yjs undo adds INVERSES; it does not erase.** The rejected operations stay in the sender's
- * document. So every later update the sender computes against the receiver's state vector
- * re-transmits them, and the receiver — which refuses to hold them — can never integrate the
- * legitimate work stacked causally on top, because Yjs will not apply operations whose
- * predecessors are missing. A permanent causal gap, from a protocol that looked symmetric.
- *
- * The protocol that works (§3.2):
- *   1. The receiver rejects with a REASON — a protocol message and its own `0x05` leaf, never a
- *      silent drop. The update goes to quarantine, held rather than discarded.
- *   2. The sender rolls back locally, which emits inverses into its own log and leaves an
- *      auditable "wrote X, was rejected, undid X" trail.
- *   3. The sender publishes a SUPERSEDING update against the receiver's state vector, which
- *      necessarily carries the rejected operations PLUS their inverses plus any new work.
- *   4. The receiver validates the now-clean projected diff — the rejected content nets to zero —
- *      admits it, and clears the quarantine. Causality intact, both parties converge, and the
- *      rejected content survives only as inert tombstones.
- *
- * ── SCOPE ─────────────────────────────────────────────────────────────────────────────────────
- *
- * This proves the protocol against STORE-1's local envelope log. The CBOR wire encoding is
- * DOD-DOC-ENVELOPE-1's job and the cross-daemon proof is DOD-DOC-E2E-REJECT-1's.
- */
-import * as Y from "yjs";
-import type { DocumentStore } from "./document-store.js";
-import type { Logger } from "./types.js";
-/**
- * The document stalls on the THIRD rejected round: the original refusal, one superseding attempt,
- * and no more (§16.7-2 "one retry, then freeze").
- *
- * Counted in rounds rather than retries because the previous spelling — a `REJECTION_RETRY_LIMIT`
- * of 1 compared as `round > LIMIT + 1` — permitted two retries under a name that said one, which
- * is the kind of thing the next edit gets wrong.
- *
- * Bounded at all because an unbounded retry loop between two daemons that disagree is not
- * convergence, it is a hot loop neither operator can see. Stalling is the visible failure.
- */
-export declare const MAX_REJECTED_ROUNDS = 3;
-export interface RejectionInput {
-    /** The envelope being rejected — the `0x05` leaf references this hash (§9). */
-    rejectedEnvelopeHash: string;
-    /** The bytes, held rather than discarded (§3.2). Supplied by the gate's quarantine verdict. */
-    quarantined: Uint8Array;
-    /**
-     * The refused envelope's OWN chain link — `null` only when the refused envelope was genuinely
-     * that sender's first. REQUIRED rather than optional: the refused envelope is deliberately never
-     * written to the log, so this is the only thing keeping the peer's next link resolvable, and an
-     * omitted value would default every refused envelope to a genesis stub — manufacturing exactly
-     * the fork the bridge exists to prevent. The caller decoded the envelope; it knows.
-     */
-    rejectedDocPrevHash: string | null;
-    reason: string;
-    detail?: string;
-    senderAgentId: string;
-    /** Which pluggable rule refused, when one did (from the gate's verdict). */
-    rule?: string;
-    /** The limit breached, when one was (from the gate's verdict). */
-    limit?: {
-        name: string;
-        limit: number;
-        actual: number;
-    };
-    /**
-     * The rejection's own signature and state vector.
-     *
-     * REQUIRED rather than fabricated. An all-zero placeholder written into an immutable log is
-     * indistinguishable from a real signature that fails to verify, so a later verifier would send
-     * an operator to the crypto layer for a value nobody ever signed. Producing these is
-     * DOD-DOC-ENVELOPE-1's job; this unit refuses to invent them.
-     */
-    signature: Uint8Array;
-    stateVector: Uint8Array;
-    /** Distinguishes repeat rejections of the same envelope for the same reason. */
-    nonce: string;
-}
-export interface RejectionOutcome {
-    /** The document has exhausted its retries and stopped accepting updates. */
-    stalled: boolean;
-    /** How many rejections this document has seen, including this one. */
-    round: number;
-}
-export interface QuarantineEntry {
-    rejectedEnvelopeHash: string;
-    quarantined: Uint8Array;
-    reason: string;
-    detail?: string;
-    /** Which rule refused, and the number it refused on. Surfaced, not just stored. */
-    rule?: string;
-    limitName?: string;
-    limitValue?: number;
-    limitActual?: number;
-}
-/** A handle over the sender's local edits, so a rejection can be rolled back as inverses. */
-export interface TrackedEdits {
-    readonly doc: Y.Doc;
-    readonly undoManager: Y.UndoManager;
-    /**
-     * Release the tracker. Required, not optional hygiene: the depth guard in `rollback` admits
-     * exactly one stacked edit, so the only workable pattern is a FRESH tracker per publish — which
-     * means one live UndoManager per publish on a long-lived Y.Doc, each holding `afterTransaction`
-     * observers and accumulating undo items that retain deleted structs. Call it once the rejection
-     * is resolved, either way.
-     */
-    dispose(): void;
-    /** Stack depth when tracking began, so `rollback` can prove it is undoing the right item. */
-    readonly depthAtTracking: number;
-}
-export declare class DocumentRejections {
-    #private;
-    constructor(store: DocumentStore, logger: Logger);
-    /**
-     * Record a rejection: a `0x05` row referencing the rejected envelope, the quarantined bytes
-     * held, and a policy record carrying the reason.
-     *
-     * The envelope log is append-only, so this is a NEW ROW — nothing is edited or removed.
-     *
-     * ── HOW A REFUSAL IS ACTUALLY REALIZED, AND WHY NOT THE WAY §9 SAYS ─────────────────────────
-     *
-     * §9 phrases effectiveness as a replay-time set property: "an update leaf is effective iff no
-     * rejection leaf references it". Implemented literally that is unsound, and it was measured
-     * rather than argued. Sender publishes a base, then a refused update, then rolls back and
-     * supersedes. Replaying the log while SKIPPING the refused leaf gives:
-     *
-     *     text "agreed base. "   pendingStructs PRESENT   pendingDs PRESENT
-     *
-     * The supersession is causally stacked on the refused operations — the rollback is a DELETION of
-     * those structs and the new work is positioned after them — so dropping them leaves everything
-     * later permanently pending. The document reads as complete and is silently missing the
-     * legitimate work. §16.7-5 already retired §9's "document-log order" phrasing; this retires its
-     * effectiveness phrasing on the same grounds.
-     *
-     * What is sound: the receiver NEVER WRITES the refused payload to its log. There is nothing to
-     * subtract at replay because it was never added, and the peer's supersession — computed against
-     * the RECEIVER's state vector per §3.2 step 3 — is self-contained. Measured on the same fixture:
-     *
-     *     text "agreed base. clean text. "   pendingStructs null   pendingDs null   converged true
-     *
-     * The refused bytes do travel again inside that supersession, carrying their own inverses, which
-     * is precisely "inverses, not erasure" (§3.2) — the content nets to zero and survives only as
-     * tombstones. The bytes we refused live in `document_quarantine`, and the chain bridges across
-     * the refused envelope so the peer's next link still resolves (see `verifyChainLinkage`).
-     */
-    reject(agentId: string, documentId: string, input: RejectionInput): RejectionOutcome;
-    /**
-     * Record a rejection ARRIVING from the peer — the receiving half of §3.2's "both sides".
-     *
-     * ── THE ROUTING DECISION (the DoD requires it resolved in-unit) ─────────────────────────────
-     *
-     * A document rejection is written **daemon-side**, into this document's own log and quarantine,
-     * NOT through the gateway record store's `source` discriminator.
-     *
-     * The gateway's record store exists for SCREENING verdicts, and most V1 rejection reasons are
-     * not screening at all — `append_only`, the receiver-local limits, malformed updates, unresolved
-     * dependencies. Routing every document rejection through a screening store would file structural
-     * protocol events as policy verdicts, and it would couple this unit to a schema owned by a
-     * component that is not involved. DOD-DOC-SCREEN-1 is parked, so that coupling would also have
-     * to be built speculatively and unwound if screening lands differently.
-     *
-     * When SCREEN-1 does land, a rejection whose reason came from the screening rule can ADDITIONALLY
-     * write a gateway record — the discriminator exists for exactly that, and adding it later costs
-     * nothing, whereas removing a premature coupling costs a migration.
-     */
-    recordIncomingRejection(agentId: string, documentId: string, input: {
-        /** The peer's 0x05 leaf hash — the row's identity, so a redelivery does not advance a round. */
-        rejectionEnvelopeHash: string;
-        rejectedEnvelopeHash: string;
-        reason: string;
-        detail?: string;
-        fromAgentId: string;
-    }): {
-        stalled: boolean;
-        round: number;
-    };
-    /** Entries held for this document — never admitted, never discarded (§3.2). From the store. */
-    quarantined(agentId: string, documentId: string): QuarantineEntry[];
-    /** Clear one entry once its superseding update has been admitted (§3.2 step 4). */
-    clearQuarantine(agentId: string, documentId: string, rejectedEnvelopeHash: string): void;
-    /**
-     * Whether this document still accepts updates.
-     *
-     * A stalled document REFUSES, naming the reason it stalled — both operators need to see why,
-     * because a document that silently stops converging is the failure this exists to prevent.
-     */
-    acceptsUpdates(agentId: string, documentId: string): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-        detail: string;
-    };
-    /**
-     * Start tracking local edits so a rejection can be rolled back.
-     *
-     * Yjs's own UndoManager, deliberately: rolling back by hand would mean computing inverses, and
-     * the inverse of a CRDT operation is not something to hand-roll — the whole reason supersession
-     * works is that Yjs's undo produces operations that compose correctly with everything stacked
-     * on top of them.
-     */
-    trackLocalEdits(doc: Y.Doc): TrackedEdits;
-    /**
-     * Roll back the last tracked edit, as INVERSES.
-     *
-     * The sender's history grows rather than shrinking. That is not a limitation to work around: it
-     * is what leaves an auditable "wrote X, was rejected, undid X" trail, and what lets the
-     * superseding update carry the rejected operations plus their inverses so causality survives.
-     *
-     * **PRECONDITION: roll back before making further local edits.** Yjs's UndoManager undoes the
-     * most recent stack item, and it cannot undo one out of order — so a sender that keeps editing
-     * after a rejection arrives and then rolls back would undo the WRONG transaction. §3.2's
-     * ordering is steps 2 then 3 for exactly this reason: roll back, THEN do new work, THEN
-     * publish the supersession that carries all three. A caller that needs to interleave has a
-     * genuine design question, not a call-order detail, and it belongs in the unit that wires
-     * publish to the receive path.
-     */
-    rollback(tracked: TrackedEdits): void;
-}
-//# sourceMappingURL=document-rejection.d.ts.map

package/dist/document-rejection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-rejection.d.ts","sourceRoot":"","sources":["../src/document-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;OAOG;IACH,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,UAAU,CAAC;IACxB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAAC;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,kBAAkB;;gBAIjB,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM;IAKhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,gBAAgB;IAsGpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,gGAAgG;QAChG,qBAAqB,EAAE,MAAM,CAAC;QAC9B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GACA;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAoDtC,+FAA+F;IAC/F,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE;IAanE,mFAAmF;IACnF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,IAAI;IAQxF;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAkB/D;;;;;;;OAOG;IACH,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,YAAY;IAuBzC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;CAkCtC"}

package/dist/document-rejection.js

@@ -1,374 +0,0 @@
-/**
- * DOD-DOC-REJECT-1 — rejection and supersession (§3.2, §16.7-2).
- *
- * ── WHY SUPERSESSION, AND NOT "BOTH SIDES ROLL BACK" ──────────────────────────────────────────
- *
- * The naive protocol is: the receiver discards, the sender undoes locally, and both return to the
- * pre-update state. It does not work, and the reason is a property of CRDTs rather than a bug.
- *
- * **Yjs undo adds INVERSES; it does not erase.** The rejected operations stay in the sender's
- * document. So every later update the sender computes against the receiver's state vector
- * re-transmits them, and the receiver — which refuses to hold them — can never integrate the
- * legitimate work stacked causally on top, because Yjs will not apply operations whose
- * predecessors are missing. A permanent causal gap, from a protocol that looked symmetric.
- *
- * The protocol that works (§3.2):
- *   1. The receiver rejects with a REASON — a protocol message and its own `0x05` leaf, never a
- *      silent drop. The update goes to quarantine, held rather than discarded.
- *   2. The sender rolls back locally, which emits inverses into its own log and leaves an
- *      auditable "wrote X, was rejected, undid X" trail.
- *   3. The sender publishes a SUPERSEDING update against the receiver's state vector, which
- *      necessarily carries the rejected operations PLUS their inverses plus any new work.
- *   4. The receiver validates the now-clean projected diff — the rejected content nets to zero —
- *      admits it, and clears the quarantine. Causality intact, both parties converge, and the
- *      rejected content survives only as inert tombstones.
- *
- * ── SCOPE ─────────────────────────────────────────────────────────────────────────────────────
- *
- * This proves the protocol against STORE-1's local envelope log. The CBOR wire encoding is
- * DOD-DOC-ENVELOPE-1's job and the cross-daemon proof is DOD-DOC-E2E-REJECT-1's.
- */
-import { createHash } from "node:crypto";
-import * as Y from "yjs";
-/**
- * The document stalls on the THIRD rejected round: the original refusal, one superseding attempt,
- * and no more (§16.7-2 "one retry, then freeze").
- *
- * Counted in rounds rather than retries because the previous spelling — a `REJECTION_RETRY_LIMIT`
- * of 1 compared as `round > LIMIT + 1` — permitted two retries under a name that said one, which
- * is the kind of thing the next edit gets wrong.
- *
- * Bounded at all because an unbounded retry loop between two daemons that disagree is not
- * convergence, it is a hot loop neither operator can see. Stalling is the visible failure.
- */
-export const MAX_REJECTED_ROUNDS = 3;
-export class DocumentRejections {
-    #store;
-    #logger;
-    constructor(store, logger) {
-        this.#store = store;
-        this.#logger = logger;
-    }
-    /**
-     * Record a rejection: a `0x05` row referencing the rejected envelope, the quarantined bytes
-     * held, and a policy record carrying the reason.
-     *
-     * The envelope log is append-only, so this is a NEW ROW — nothing is edited or removed.
-     *
-     * ── HOW A REFUSAL IS ACTUALLY REALIZED, AND WHY NOT THE WAY §9 SAYS ─────────────────────────
-     *
-     * §9 phrases effectiveness as a replay-time set property: "an update leaf is effective iff no
-     * rejection leaf references it". Implemented literally that is unsound, and it was measured
-     * rather than argued. Sender publishes a base, then a refused update, then rolls back and
-     * supersedes. Replaying the log while SKIPPING the refused leaf gives:
-     *
-     *     text "agreed base. "   pendingStructs PRESENT   pendingDs PRESENT
-     *
-     * The supersession is causally stacked on the refused operations — the rollback is a DELETION of
-     * those structs and the new work is positioned after them — so dropping them leaves everything
-     * later permanently pending. The document reads as complete and is silently missing the
-     * legitimate work. §16.7-5 already retired §9's "document-log order" phrasing; this retires its
-     * effectiveness phrasing on the same grounds.
-     *
-     * What is sound: the receiver NEVER WRITES the refused payload to its log. There is nothing to
-     * subtract at replay because it was never added, and the peer's supersession — computed against
-     * the RECEIVER's state vector per §3.2 step 3 — is self-contained. Measured on the same fixture:
-     *
-     *     text "agreed base. clean text. "   pendingStructs null   pendingDs null   converged true
-     *
-     * The refused bytes do travel again inside that supersession, carrying their own inverses, which
-     * is precisely "inverses, not erasure" (§3.2) — the content nets to zero and survives only as
-     * tombstones. The bytes we refused live in `document_quarantine`, and the chain bridges across
-     * the refused envelope so the peer's next link still resolves (see `verifyChainLinkage`).
-     */
-    reject(agentId, documentId, input) {
-        // CHAIN IT. Writing `docPrevHash: null` made every rejection a second GENESIS row for this
-        // agent, so two rejections forked the chain — and the retry protocol guarantees at least two
-        // before a stall. `verifyChainLinkage` then refuses, and since `rebuildSnapshot` is how a
-        // document survives a restart, the document rebuilt until the next daemon start and was
-        // permanently unopenable after it. Measured. A rejection is this agent's own authored act, so
-        // it belongs in this agent's own chain.
-        const rejectionEnvelopeHash = rejectionHash(input.rejectedEnvelopeHash, input.reason, input.nonce);
-        const appended = this.#store.appendEnvelope(agentId, {
-            envelopeHash: rejectionEnvelopeHash,
-            documentId,
-            senderAgentId: agentId, // WE authored the rejection, whoever authored the update
-            docPrevHash: this.#store.lastEnvelopeHashBySender(agentId, documentId, agentId),
-            epochId: 0,
-            signature: input.signature,
-            stateVector: input.stateVector,
-            payload: null, // an audit record carries no content
-            kind: "rejection",
-            referencesEnvelopeHash: input.rejectedEnvelopeHash,
-            createdAtMs: Date.now(),
-        });
-        if (!appended) {
-            // The store tells callers whether a row was written precisely so this is not inferred. A
-            // duplicate must not advance the retry round, or a document reaches `stalled` with fewer
-            // rejection leaves than rounds and an auditor replaying the log cannot see why.
-            this.#logger.warn("document.rejection.duplicate", {
-                documentId,
-                rejectedEnvelopeHash: input.rejectedEnvelopeHash,
-                reason: input.reason,
-            });
-            return { stalled: this.#isStalled(agentId, documentId), round: this.#round(agentId, documentId) };
-        }
-        // PERSISTED, not remembered. The 0x05 leaf references these bytes; holding them in a Map
-        // meant the reference outlived the thing it referenced across a restart.
-        const held = this.#store.holdQuarantined(agentId, {
-            documentId,
-            rejectionEnvelopeHash,
-            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
-            // The refused envelope's own author and chain link, so `verifyChainLinkage` can bridge it —
-            // the peer chains its supersession onto an envelope our log deliberately never holds.
-            rejectedSenderAgentId: input.senderAgentId,
-            rejectedDocPrevHash: input.rejectedDocPrevHash,
-            // COPY: the caller's buffer may be a pooled network read, and a 0x05 leaf must reference
-            // the bytes that were actually refused.
-            payload: new Uint8Array(input.quarantined),
-            reason: input.reason,
-            detail: input.detail,
-            // The gate produces these deliberately; dropping them leaves an operator unable to see
-            // WHICH rule refused or WHAT number was exceeded.
-            rule: input.rule,
-            limitName: input.limit?.name,
-            limitValue: input.limit?.limit,
-            limitActual: input.limit?.actual,
-            createdAtMs: Date.now(),
-        });
-        if (!held) {
-            // Cannot happen while the leaf hash is unique per rejection, which the append above already
-            // established. Logged rather than assumed: the previous key silently dropped every round
-            // after the first, and the way that stayed invisible was precisely that nothing said so.
-            this.#logger.error("document.rejection.quarantine_not_written", {
-                documentId,
-                rejectionEnvelopeHash,
-                rejectedEnvelopeHash: input.rejectedEnvelopeHash,
-            });
-        }
-        const round = this.#round(agentId, documentId);
-        // The policy record — on BOTH sides, per §3.2. This is the sending half; the receiving half
-        // is written when a rejection arrives.
-        this.#logger.warn("document.rejection.sent", {
-            documentId,
-            senderAgentId: input.senderAgentId,
-            reason: input.reason,
-            detail: input.detail,
-            // Carried, not merely stored: an operator asking "why was this refused" needs the rule and
-            // the number, and a column no surface reads is a column that is not there.
-            rule: input.rule,
-            limitName: input.limit?.name,
-            limitValue: input.limit?.limit,
-            limitActual: input.limit?.actual,
-            round,
-        });
-        const stalled = round >= MAX_REJECTED_ROUNDS;
-        const alreadyStalled = this.#store.getDocument(agentId, documentId)?.status === "stalled";
-        if (stalled && !alreadyStalled) {
-            this.#store.setDocumentStatus(agentId, documentId, "stalled");
-            // Once, not on every subsequent refusal — a stalled document that keeps shouting is noise
-            // an operator learns to filter.
-            this.#logger.error("document.stalled", {
-                documentId,
-                reason: input.reason,
-                detail: input.detail,
-                rounds: round,
-            });
-        }
-        return { stalled, round };
-    }
-    /**
-     * Record a rejection ARRIVING from the peer — the receiving half of §3.2's "both sides".
-     *
-     * ── THE ROUTING DECISION (the DoD requires it resolved in-unit) ─────────────────────────────
-     *
-     * A document rejection is written **daemon-side**, into this document's own log and quarantine,
-     * NOT through the gateway record store's `source` discriminator.
-     *
-     * The gateway's record store exists for SCREENING verdicts, and most V1 rejection reasons are
-     * not screening at all — `append_only`, the receiver-local limits, malformed updates, unresolved
-     * dependencies. Routing every document rejection through a screening store would file structural
-     * protocol events as policy verdicts, and it would couple this unit to a schema owned by a
-     * component that is not involved. DOD-DOC-SCREEN-1 is parked, so that coupling would also have
-     * to be built speculatively and unwound if screening lands differently.
-     *
-     * When SCREEN-1 does land, a rejection whose reason came from the screening rule can ADDITIONALLY
-     * write a gateway record — the discriminator exists for exactly that, and adding it later costs
-     * nothing, whereas removing a premature coupling costs a migration.
-     */
-    recordIncomingRejection(agentId, documentId, input) {
-        // DURABLE, not a log line. Everything the PUBLISHING operator needs depends on this surviving
-        // a restart: why their work was refused, and how many rounds remain before the document
-        // stalls. It also has to exist for the retry bound to bind at all — the round was counted from
-        // rejections this agent AUTHORED, which on a pure publisher is zero forever, so the loop the
-        // limit exists to stop was the one side that had no limit.
-        const written = this.#store.recordRejectionReceived(agentId, {
-            documentId,
-            rejectionEnvelopeHash: input.rejectionEnvelopeHash,
-            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
-            fromAgentId: input.fromAgentId,
-            reason: input.reason,
-            detail: input.detail,
-            createdAtMs: Date.now(),
-        });
-        const round = this.#store.countRejectionsReceived(agentId, documentId);
-        if (!written) {
-            this.#logger.warn("document.rejection.received_duplicate", {
-                documentId,
-                rejectionEnvelopeHash: input.rejectionEnvelopeHash,
-                round,
-            });
-            return { stalled: this.#isStalled(agentId, documentId), round };
-        }
-        this.#logger.warn("document.rejection.received", {
-            documentId,
-            fromAgentId: input.fromAgentId,
-            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
-            reason: input.reason,
-            detail: input.detail,
-            round,
-        });
-        // The publisher stops superseding on the same threshold the receiver stops accepting on. Two
-        // sides of one bound: without this, the receiver freezes and the sender keeps retrying into a
-        // document that will never take it.
-        const stalled = round >= MAX_REJECTED_ROUNDS;
-        if (stalled && !this.#isStalled(agentId, documentId)) {
-            this.#store.setDocumentStatus(agentId, documentId, "stalled");
-            this.#logger.error("document.stalled", {
-                documentId,
-                reason: input.reason,
-                detail: input.detail,
-                rounds: round,
-                side: "publisher",
-            });
-        }
-        return { stalled, round };
-    }
-    /** Entries held for this document — never admitted, never discarded (§3.2). From the store. */
-    quarantined(agentId, documentId) {
-        return this.#store.listQuarantined(agentId, documentId).map((r) => ({
-            rejectedEnvelopeHash: r.rejectedEnvelopeHash,
-            quarantined: r.payload,
-            reason: r.reason,
-            detail: r.detail,
-            rule: r.rule,
-            limitName: r.limitName,
-            limitValue: r.limitValue,
-            limitActual: r.limitActual,
-        }));
-    }
-    /** Clear one entry once its superseding update has been admitted (§3.2 step 4). */
-    clearQuarantine(agentId, documentId, rejectedEnvelopeHash) {
-        // Only announce an admission that actually happened — an event that fires on a no-op is a
-        // signal on the wrong case.
-        if (this.#store.releaseQuarantined(agentId, documentId, rejectedEnvelopeHash)) {
-            this.#logger.info("document.supersession.admitted", { documentId, rejectedEnvelopeHash });
-        }
-    }
-    /**
-     * Whether this document still accepts updates.
-     *
-     * A stalled document REFUSES, naming the reason it stalled — both operators need to see why,
-     * because a document that silently stops converging is the failure this exists to prevent.
-     */
-    acceptsUpdates(agentId, documentId) {
-        // Read the STORE, not memory. The status was persisted while the flag that gated this check
-        // was not, so after a restart the document row said `stalled` while the daemon happily
-        // accepted updates on it — the system reporting two contradictory states at once.
-        if (this.#isStalled(agentId, documentId)) {
-            const held = this.#store.listQuarantined(agentId, documentId);
-            const last = held[held.length - 1];
-            return {
-                ok: false,
-                reason: "document_stalled",
-                detail: `this document stopped accepting updates after ` +
-                    `${this.#round(agentId, documentId)} rejected rounds` +
-                    (last ? `; the most recent reason was ${last.reason}` : ""),
-            };
-        }
-        return { ok: true };
-    }
-    /**
-     * Start tracking local edits so a rejection can be rolled back.
-     *
-     * Yjs's own UndoManager, deliberately: rolling back by hand would mean computing inverses, and
-     * the inverse of a CRDT operation is not something to hand-roll — the whole reason supersession
-     * works is that Yjs's undo produces operations that compose correctly with everything stacked
-     * on top of them.
-     */
-    trackLocalEdits(doc) {
-        // The two roots this codebase's write path projects from, taken through their TYPED getters.
-        //
-        // Not the `doc.share` placeholders: `doc.get(name)` hands back the untyped AbstractType, and
-        // the typed getter later instantiates a DIFFERENT object — so the UndoManager would watch a
-        // root nobody edits and `undo()` would silently do nothing. Caught by the out-of-order guard
-        // below, which is the guard earning its keep on its first outing.
-        //
-        // Instantiating these two as Text and Map is not the guessed-type hazard GATE-1 measured:
-        // the write path DEFINES them as Text and Map. A document that puts content under any other
-        // root is not tracked here, and that is a real gap — recorded rather than papered over,
-        // because it belongs with whichever unit lets a document declare its own roots.
-        const undoManager = new Y.UndoManager([doc.getText("content"), doc.getMap("data")], {
-            captureTimeout: 0,
-        });
-        return {
-            doc,
-            undoManager,
-            depthAtTracking: undoManager.undoStack.length,
-            dispose: () => undoManager.destroy(),
-        };
-    }
-    /**
-     * Roll back the last tracked edit, as INVERSES.
-     *
-     * The sender's history grows rather than shrinking. That is not a limitation to work around: it
-     * is what leaves an auditable "wrote X, was rejected, undid X" trail, and what lets the
-     * superseding update carry the rejected operations plus their inverses so causality survives.
-     *
-     * **PRECONDITION: roll back before making further local edits.** Yjs's UndoManager undoes the
-     * most recent stack item, and it cannot undo one out of order — so a sender that keeps editing
-     * after a rejection arrives and then rolls back would undo the WRONG transaction. §3.2's
-     * ordering is steps 2 then 3 for exactly this reason: roll back, THEN do new work, THEN
-     * publish the supersession that carries all three. A caller that needs to interleave has a
-     * genuine design question, not a call-order detail, and it belongs in the unit that wires
-     * publish to the receive path.
-     */
-    rollback(tracked) {
-        // REFUSE rather than undo the wrong thing. Measured, the unguarded version had three failure
-        // modes that all reported success: nothing tracked (silent no-op), an untracked root (silent
-        // no-op), and — the damaging one — a sender that kept editing after the rejection arrived,
-        // where undo removed the agent's LEGITIMATE later work and KEPT the refused content. The
-        // supersession then re-ships the refused bytes, is rejected again, and the document stalls
-        // with a reason pointing at the peer while the operator's writing is gone.
-        const depth = tracked.undoManager.undoStack.length;
-        if (depth !== tracked.depthAtTracking + 1) {
-            throw new Error(`document_rollback_out_of_order: ${depth - tracked.depthAtTracking} local edit(s) are ` +
-                `stacked since tracking began, and Yjs can only undo the most recent — rolling back now ` +
-                `would discard the wrong work. Roll back before making further local edits (§3.2 step 2).`);
-        }
-        if (tracked.undoManager.undo() === null) {
-            throw new Error("document_rollback_nothing_tracked: no tracked edit to roll back — the rejected update " +
-                "was not produced through this tracker");
-        }
-    }
-    /** Derived from the log, not remembered — so it survives a restart. */
-    #round(agentId, documentId) {
-        // Scoped to the rejections THIS agent authored. A mutual exchange puts both directions' 0x05
-        // leaves in one document log, so an unscoped count conflated them and a document stalled at
-        // half the intended rounds the moment the peer also rejected something.
-        return this.#store.countRejections(agentId, documentId, agentId);
-    }
-    #isStalled(agentId, documentId) {
-        return this.#store.getDocument(agentId, documentId)?.status === "stalled";
-    }
-}
-/** A rejection's own envelope hash — distinct per rejected envelope and reason. */
-function rejectionHash(rejectedEnvelopeHash, reason, nonce) {
-    // The nonce is what stops two rejections of the same envelope for the same reason collapsing
-    // into one row — which would let a document reach `stalled` with fewer leaves than rounds.
-    // DELIBERATELY a different construction from ENVELOPE-1's update hash (a CBOR-array digest), though both land in the envelope_hash column and the same per-sender chain. The preimage shapes cannot collide, and unifying them would mean signing a rejection as a document update.
-    return createHash("sha256")
-        .update(`rejection:${rejectedEnvelopeHash}:${reason}:${nonce}`, "utf8")
-        .digest("hex");
-}
-//# sourceMappingURL=document-rejection.js.map

package/dist/document-rejection.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-rejection.js","sourceRoot":"","sources":["../src/document-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAIzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAuErC,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAgB;IACtB,OAAO,CAAS;IAEzB,YAAY,KAAoB,EAAE,MAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,MAAM,CAAC,OAAe,EAAE,UAAkB,EAAE,KAAqB;QAE/D,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,wCAAwC;QACxC,MAAM,qBAAqB,GAAG,aAAa,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;YACnD,YAAY,EAAE,qBAAqB;YACnC,UAAU;YACV,aAAa,EAAE,OAAO,EAAE,yDAAyD;YACjF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;YAC/E,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,IAAI,EAAE,qCAAqC;YACpD,IAAI,EAAE,WAAW;YACjB,sBAAsB,EAAE,KAAK,CAAC,oBAAoB;YAClD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yFAAyF;YACzF,yFAAyF;YACzF,gFAAgF;YAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAChD,UAAU;gBACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,yFAAyF;QACzF,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE;YAChD,UAAU;YACV,qBAAqB;YACrB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,4FAA4F;YAC5F,sFAAsF;YACtF,qBAAqB,EAAE,KAAK,CAAC,aAAa;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,yFAAyF;YACzF,wCAAwC;YACxC,OAAO,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,uFAAuF;YACvF,kDAAkD;YAClD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM;YAChC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,4FAA4F;YAC5F,yFAAyF;YACzF,yFAAyF;YACzF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBAC9D,UAAU;gBACV,qBAAqB;gBACrB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAE/C,4FAA4F;QAC5F,uCAAuC;QACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC3C,UAAU;YACV,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,2FAA2F;YAC3F,2EAA2E;YAC3E,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM;YAChC,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;QAC1F,IAAI,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,0FAA0F;YAC1F,gCAAgC;YAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBACrC,UAAU;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CACrB,OAAe,EACf,UAAkB,EAClB,KAOC;QAED,8FAA8F;QAC9F,wFAAwF;QACxF,+FAA+F;QAC/F,6FAA6F;QAC7F,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE;YAC3D,UAAU;YACV,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU;gBACV,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC/C,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;SACN,CAAC,CAAC;QAEH,6FAA6F;QAC7F,8FAA8F;QAC9F,oCAAoC;QACpC,MAAM,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBACrC,UAAU;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,+FAA+F;IAC/F,WAAW,CAAC,OAAe,EAAE,UAAkB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,WAAW,EAAE,CAAC,CAAC,OAAO;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,mFAAmF;IACnF,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,oBAA4B;QAC/E,0FAA0F;QAC1F,4BAA4B;QAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,OAAe,EACf,UAAkB;QAElB,4FAA4F;QAC5F,uFAAuF;QACvF,kFAAkF;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gDAAgD;oBACtD,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,kBAAkB;oBACrD,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,GAAU;QACxB,6FAA6F;QAC7F,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,kEAAkE;QAClE,EAAE;QACF,0FAA0F;QAC1F,4FAA4F;QAC5F,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;YAClF,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,WAAW;YACX,eAAe,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM;YAC7C,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAqB;QAC5B,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,yFAAyF;QACzF,2FAA2F;QAC3F,2EAA2E;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;QACnD,IAAI,KAAK,KAAK,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,GAAG,OAAO,CAAC,eAAe,qBAAqB;gBACrF,yFAAyF;gBACzF,0FAA0F,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,uCAAuC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,OAAe,EAAE,UAAkB;QACxC,6FAA6F;QAC7F,4FAA4F;QAC5F,wEAAwE;QACxE,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,UAAkB;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;IAC5E,CAAC;CACF;AAED,mFAAmF;AACnF,SAAS,aAAa,CAAC,oBAA4B,EAAE,MAAc,EAAE,KAAa;IAChF,6FAA6F;IAC7F,2FAA2F;IAC3F,oRAAoR;IACpR,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,aAAa,oBAAoB,IAAI,MAAM,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC;SACtE,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}