@cello-protocol/daemon 0.0.131 → 0.0.133

package/dist/document-publish.d.ts

@@ -0,0 +1,67 @@
+/**
+ * DOD-DOC-DELIVERY-1 (outbound half) — turning a local edit into a signed envelope in the log.
+ *
+ * Publish is fire-and-forget by design (§16.4): it writes the envelope and returns. Delivery is the
+ * worker's job, and pending is derived from the log, so the only thing publish has to get right is
+ * that what it writes is complete, signed, and correctly chained.
+ *
+ * ── WHAT IS PUBLISHED IS A DIFF AGAINST THE PEER'S STATE VECTOR ───────────────────────────────
+ *
+ * Not the whole document. §3.2 step 3 and §7: an update computed against what the peer has already
+ * seen carries exactly the operations they lack — including, after a rejection, the refused
+ * operations PLUS their inverses, which is what lets supersession converge. Publishing the full
+ * state instead would work but would re-send the entire document on every edit, and would lose the
+ * property that makes the rejection protocol terminate.
+ *
+ * The peer's state vector is the one they last told us about. Absent — before they have ever
+ * published — the diff is against an empty document, which is the whole state and correct.
+ *
+ * ── THE CHAIN LINK IS READ, NEVER GUESSED ─────────────────────────────────────────────────────
+ *
+ * `doc_prev_hash` is our own last envelope for this document, read from the log at publish time. A
+ * cached value would go stale the moment anything else appended — a rejection, a withdrawal — and a
+ * wrong link is not a soft failure: the peer refuses it and, if it is ever replayed locally, the
+ * document stops rebuilding.
+ */
+import type * as Y from "yjs";
+import type { DocumentStore } from "./document-store.js";
+import type { DocumentEngine } from "./document-engine.js";
+import type { Logger } from "./types.js";
+export type PublishResult = {
+    ok: true;
+    envelopeHash: string;
+    bytes: number;
+} | {
+    ok: false;
+    reason: string;
+    detail: string;
+};
+export interface DocumentPublishDeps {
+    store: DocumentStore;
+    engine: DocumentEngine;
+    logger: Logger;
+    /** Sign as the owning agent, over the update envelope's TBS. */
+    sign(ownerAgentId: string, tbs: Uint8Array): Promise<Uint8Array>;
+    /** The owning agent's own id — which is its pubkey hex (M14-D5) — for the envelope's sender. */
+    senderIdFor(ownerAgentId: string): string | null;
+    /** May this agent publish into this document right now? LIFECYCLE-1 owns the answer. */
+    canPublish(ownerAgentId: string, documentId: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+        detail: string;
+    };
+}
+export declare class DocumentPublish {
+    #private;
+    constructor(deps: DocumentPublishDeps);
+    /**
+     * Publish the live document's state as an update the peer does not yet have.
+     *
+     * Returns the envelope hash so a caller can follow it — a publish that says only "ok" gives an
+     * operator nothing to correlate with what later lands or stalls.
+     */
+    publish(ownerAgentId: string, documentId: string, doc: Y.Doc, nowMs: number): Promise<PublishResult>;
+}
+//# sourceMappingURL=document-publish.d.ts.map

package/dist/document-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-publish.d.ts","sourceRoot":"","sources":["../src/document-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,KAAK,CAAC,MAAM,KAAK,CAAC;AAQ9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE,gGAAgG;IAChG,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACjD,wFAAwF;IACxF,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACpH;AAQD,qBAAa,eAAe;;gBAGd,IAAI,EAAE,mBAAmB;IAIrC;;;;;OAKG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,CAAC,CAAC,GAAG,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,CAAC;CA6G1B"}

package/dist/document-publish.js

@@ -0,0 +1,149 @@
+/**
+ * DOD-DOC-DELIVERY-1 (outbound half) — turning a local edit into a signed envelope in the log.
+ *
+ * Publish is fire-and-forget by design (§16.4): it writes the envelope and returns. Delivery is the
+ * worker's job, and pending is derived from the log, so the only thing publish has to get right is
+ * that what it writes is complete, signed, and correctly chained.
+ *
+ * ── WHAT IS PUBLISHED IS A DIFF AGAINST THE PEER'S STATE VECTOR ───────────────────────────────
+ *
+ * Not the whole document. §3.2 step 3 and §7: an update computed against what the peer has already
+ * seen carries exactly the operations they lack — including, after a rejection, the refused
+ * operations PLUS their inverses, which is what lets supersession converge. Publishing the full
+ * state instead would work but would re-send the entire document on every edit, and would lose the
+ * property that makes the rejection protocol terminate.
+ *
+ * The peer's state vector is the one they last told us about. Absent — before they have ever
+ * published — the diff is against an empty document, which is the whole state and correct.
+ *
+ * ── THE CHAIN LINK IS READ, NEVER GUESSED ─────────────────────────────────────────────────────
+ *
+ * `doc_prev_hash` is our own last envelope for this document, read from the log at publish time. A
+ * cached value would go stale the moment anything else appended — a rejection, a withdrawal — and a
+ * wrong link is not a soft failure: the peer refuses it and, if it is ever replayed locally, the
+ * document stops rebuilding.
+ */
+import { buildDocumentUpdateTbs, documentEnvelopeHash, DOCUMENT_EPOCH_V1, DOCUMENT_UPDATE_ENCODING_V1, } from "@cello-protocol/protocol-types";
+function equalBytes(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+export class DocumentPublish {
+    #d;
+    constructor(deps) {
+        this.#d = deps;
+    }
+    /**
+     * Publish the live document's state as an update the peer does not yet have.
+     *
+     * Returns the envelope hash so a caller can follow it — a publish that says only "ok" gives an
+     * operator nothing to correlate with what later lands or stalls.
+     */
+    async publish(ownerAgentId, documentId, doc, nowMs) {
+        const document = this.#d.store.getDocument(ownerAgentId, documentId);
+        if (!document) {
+            return {
+                ok: false,
+                reason: "document_unknown",
+                detail: `no document ${documentId.slice(0, 16)}… for this agent`,
+            };
+        }
+        // LIFECYCLE-1 decides. A closed, killed, stalled or platform-paused agent must not publish, and
+        // the reason it gives is the one the operator needs — not a generic refusal from here.
+        const allowed = this.#d.canPublish(ownerAgentId, documentId);
+        if (!allowed.ok)
+            return { ok: false, reason: allowed.reason, detail: allowed.detail };
+        const senderId = this.#d.senderIdFor(ownerAgentId);
+        if (senderId === null) {
+            return {
+                ok: false,
+                reason: "document_publish_no_identity",
+                detail: `no signing identity for ${ownerAgentId}, so an envelope cannot be authored`,
+            };
+        }
+        // THE PEER's state vector, from their most recent envelope — not our own snapshot. Our
+        // snapshot answers "what have we not yet materialized", which is a different question whose
+        // answer looks plausible: it produced an update every time, so a republish with no new edits
+        // appended a second envelope instead of reporting that there was nothing to say.
+        const peerStateVector = this.#d.store.peerStateVector(ownerAgentId, documentId, document.peerAgentId) ?? undefined;
+        const update = this.#d.engine.encodeState(doc, peerStateVector);
+        // NOTHING NEW is a different question from what to SEND, and conflating them was a bug. The
+        // update is a diff against the PEER's state vector, so before they have ever published it is
+        // the whole document — non-empty however long we have gone without editing. Whether there is
+        // anything new is a fact about US: compare our current state vector against the one our own
+        // last envelope carried.
+        const ourLast = this.#d.store.lastPublishedStateVector(ownerAgentId, documentId, senderId);
+        const ourNow = this.#d.engine.encodeStateVector(doc);
+        if (ourLast !== null && equalBytes(ourLast, ourNow)) {
+            // Publishing anyway would append a leaf, cost a delivery, and converge nothing.
+            return {
+                ok: false,
+                reason: "document_nothing_to_publish",
+                detail: "nothing has changed in this document since your last publish",
+            };
+        }
+        if (update.length === 0) {
+            return {
+                ok: false,
+                reason: "document_nothing_to_publish",
+                detail: "the peer already has everything in this document",
+            };
+        }
+        const envelope = {
+            type: "document_update",
+            document_id: documentId,
+            epoch_id: DOCUMENT_EPOCH_V1,
+            // READ, never cached. Anything else appended since — a rejection, a withdrawal — moves this,
+            // and a wrong link is refused by the peer and stops the document rebuilding locally.
+            doc_prev_hash: this.#d.store.lastEnvelopeHashBySender(ownerAgentId, documentId, senderId),
+            sender_agent_id: senderId,
+            sender_client_id: doc.clientID,
+            update_encoding: DOCUMENT_UPDATE_ENCODING_V1,
+            state_vector: ourNow,
+            update,
+            signature: new Uint8Array(0),
+        };
+        envelope.signature = await this.#d.sign(ownerAgentId, buildDocumentUpdateTbs(envelope));
+        const envelopeHash = documentEnvelopeHash(envelope);
+        const appended = this.#d.store.appendEnvelope(ownerAgentId, {
+            envelopeHash,
+            documentId,
+            senderAgentId: senderId,
+            docPrevHash: envelope.doc_prev_hash,
+            epochId: envelope.epoch_id,
+            signature: envelope.signature,
+            stateVector: envelope.state_vector,
+            payload: update,
+            kind: "update",
+            referencesEnvelopeHash: null,
+            // Recorded so the peer's authorship binding is derived from what we SIGNED, matching what the
+            // inbound path stores for their envelopes.
+            senderClientId: doc.clientID,
+            createdAtMs: nowMs,
+        });
+        if (!appended) {
+            // The same content published twice hashes the same, so this is a genuine no-op rather than a
+            // fault — but it is reported, because a caller that believes it published something new and
+            // waits for it to deliver would wait forever.
+            return {
+                ok: false,
+                reason: "document_already_published",
+                detail: `this exact update is already in the log as ${envelopeHash.slice(0, 16)}…`,
+            };
+        }
+        this.#d.logger.info("document.published", {
+            documentId,
+            envelopeHash,
+            bytes: update.length,
+            senderClientId: doc.clientID,
+        });
+        // Fire and forget: the delivery worker derives pending FROM THE LOG, so writing the envelope is
+        // the whole of publishing. Nothing here waits for a peer.
+        return { ok: true, envelopeHash, bytes: update.length };
+    }
+}
+//# sourceMappingURL=document-publish.js.map

package/dist/document-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-publish.js","sourceRoot":"","sources":["../src/document-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,GAE5B,MAAM,gCAAgC,CAAC;AAqBxC,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,EAAE,CAAsB;IAEjC,YAAY,IAAyB;QACnC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,UAAkB,EAClB,GAAU,EACV,KAAa;QAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACjE,CAAC;QACJ,CAAC;QAED,gGAAgG;QAChG,uFAAuF;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,8BAA8B;gBACtC,MAAM,EAAE,2BAA2B,YAAY,qCAAqC;aACrF,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,4FAA4F;QAC5F,6FAA6F;QAC7F,iFAAiF;QACjF,MAAM,eAAe,GACnB,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAEhE,4FAA4F;QAC5F,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,yBAAyB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpD,gFAAgF;YAChF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6BAA6B;gBACrC,MAAM,EAAE,8DAA8D;aACvE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6BAA6B;gBACrC,MAAM,EAAE,kDAAkD;aAC3D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAA2B;YACvC,IAAI,EAAE,iBAAiB;YACvB,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,iBAAiB;YAC3B,6FAA6F;YAC7F,qFAAqF;YACrF,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC;YACzF,eAAe,EAAE,QAAQ;YACzB,gBAAgB,EAAE,GAAG,CAAC,QAAQ;YAC9B,eAAe,EAAE,2BAA2B;YAC5C,YAAY,EAAE,MAAM;YACpB,MAAM;YACN,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;SAC7B,CAAC;QACF,QAAQ,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxF,MAAM,YAAY,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YAC1D,YAAY;YACZ,UAAU;YACV,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,QAAQ,CAAC,aAAa;YACnC,OAAO,EAAE,QAAQ,CAAC,QAAQ;YAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,QAAQ;YACd,sBAAsB,EAAE,IAAI;YAC5B,8FAA8F;YAC9F,2CAA2C;YAC3C,cAAc,EAAE,GAAG,CAAC,QAAQ;YAC5B,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,6FAA6F;YAC7F,4FAA4F;YAC5F,8CAA8C;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,8CAA8C,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;aACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;YACxC,UAAU;YACV,YAAY;YACZ,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,cAAc,EAAE,GAAG,CAAC,QAAQ;SAC7B,CAAC,CAAC;QACH,gGAAgG;QAChG,0DAA0D;QAC1D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,CAAC;CACF"}

package/dist/document-reachability.d.ts

@@ -0,0 +1,42 @@
+/**
+ * DOD-DOC-DELIVERY-2 — binding the delivery worker's reachability check to `discovery_lookup`.
+ *
+ * The worker asks one question — "is this peer reachable right now?" — and its whole retry
+ * behaviour turns on the answer being about the PEER. `runDiscoveryLookup` deliberately returns
+ * five outcomes, only one of which is an answer about the peer at all, and this maps them:
+ *
+ *   result / offline | unknown_agent  ->  false   the peer is not reachable. A fact about them.
+ *   result / online                   ->  true
+ *   error | malformed | timeout | send_failed
+ *                                     ->  THROW   the lookup did not happen. A fact about US.
+ *
+ * The throw is the point. `isPeerReachable` returning false for a directory fault would record a
+ * directory outage — or our own signaling stream being down — as the operator's collaborator being
+ * absent, and send them to ask the wrong person why nothing is syncing. The worker already treats
+ * a throw as `lookup_failed` and keeps that distinction in the log; this is what feeds it.
+ *
+ * `unknown_agent` maps to false rather than throwing on purpose. It IS an answer from the
+ * directory about the peer — the address does not resolve — and the honest consequence is the same
+ * as offline: do not dial, retry later. It is a bad address rather than a transient absence, so it
+ * is surfaced distinctly by the caller rather than being collapsed into the same log line.
+ */
+import type { DiscoveryOutcome } from "./cross-node-negotiation.js";
+/** Why a lookup could not be performed. Carries the upstream reason verbatim. */
+export declare class DiscoveryUnavailableError extends Error {
+    readonly kind: string;
+    constructor(kind: string, reason: string);
+}
+export interface Reachability {
+    reachable: boolean;
+    /** Present when the directory answered but the address does not resolve to a known agent. */
+    unknownAgent: boolean;
+}
+/**
+ * Map a discovery outcome onto the worker's reachability question.
+ *
+ * Pure, so the mapping is testable without a directory — which matters, because the expensive way
+ * to discover this mapping is wrong is in production, where the symptom is an operator chasing a
+ * collaborator who was never offline.
+ */
+export declare function reachabilityFromDiscovery(outcome: DiscoveryOutcome): Reachability;
+//# sourceMappingURL=document-reachability.d.ts.map

package/dist/document-reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-reachability.d.ts","sourceRoot":"","sources":["../src/document-reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,iFAAiF;AACjF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAKzC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,6FAA6F;IAC7F,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,YAAY,CA+CjF"}

package/dist/document-reachability.js

@@ -0,0 +1,80 @@
+/**
+ * DOD-DOC-DELIVERY-2 — binding the delivery worker's reachability check to `discovery_lookup`.
+ *
+ * The worker asks one question — "is this peer reachable right now?" — and its whole retry
+ * behaviour turns on the answer being about the PEER. `runDiscoveryLookup` deliberately returns
+ * five outcomes, only one of which is an answer about the peer at all, and this maps them:
+ *
+ *   result / offline | unknown_agent  ->  false   the peer is not reachable. A fact about them.
+ *   result / online                   ->  true
+ *   error | malformed | timeout | send_failed
+ *                                     ->  THROW   the lookup did not happen. A fact about US.
+ *
+ * The throw is the point. `isPeerReachable` returning false for a directory fault would record a
+ * directory outage — or our own signaling stream being down — as the operator's collaborator being
+ * absent, and send them to ask the wrong person why nothing is syncing. The worker already treats
+ * a throw as `lookup_failed` and keeps that distinction in the log; this is what feeds it.
+ *
+ * `unknown_agent` maps to false rather than throwing on purpose. It IS an answer from the
+ * directory about the peer — the address does not resolve — and the honest consequence is the same
+ * as offline: do not dial, retry later. It is a bad address rather than a transient absence, so it
+ * is surfaced distinctly by the caller rather than being collapsed into the same log line.
+ */
+/** Why a lookup could not be performed. Carries the upstream reason verbatim. */
+export class DiscoveryUnavailableError extends Error {
+    kind;
+    constructor(kind, reason) {
+        super(`document_discovery_unavailable: ${kind}${reason ? ` (${reason})` : ""}`);
+        this.name = "DiscoveryUnavailableError";
+        this.kind = kind;
+    }
+}
+/**
+ * Map a discovery outcome onto the worker's reachability question.
+ *
+ * Pure, so the mapping is testable without a directory — which matters, because the expensive way
+ * to discover this mapping is wrong is in production, where the symptom is an operator chasing a
+ * collaborator who was never offline.
+ */
+export function reachabilityFromDiscovery(outcome) {
+    switch (outcome.kind) {
+        case "result":
+            if (outcome.state === "online") {
+                if (outcome.owningNodeIds.length === 0) {
+                    // `classifyOnlineResult` calls exactly this shape malformed — "online but no owner named
+                    // … never dial a fabricated node" — and treats it as retry, not as availability. This
+                    // module's whole thesis is that only a RESULT is an answer about the peer; a result that
+                    // names no home answers nothing.
+                    throw new DiscoveryUnavailableError("online_without_owner", "no owning node named");
+                }
+                return { reachable: true, unknownAgent: false };
+            }
+            if (outcome.state === "unknown_agent")
+                return { reachable: false, unknownAgent: true };
+            return { reachable: false, unknownAgent: false };
+        case "error":
+            // A directory DB fault. Retryable, and emphatically not the counterparty being offline —
+            // the outcome type's own comment says so, and collapsing it here would undo that care.
+            throw new DiscoveryUnavailableError("directory_error", outcome.reason);
+        case "malformed":
+            // A reply that did not parse: a protocol or version anomaly on a directory that DID respond.
+            // Distinct from a clean directory error, and never availability.
+            throw new DiscoveryUnavailableError("malformed_reply", "");
+        case "timeout":
+            // No reply in the window — an old directory, or a slow or dropped reply on a new one. Either
+            // way we learned nothing about the peer.
+            throw new DiscoveryUnavailableError("timeout", "");
+        case "send_failed":
+            // Our OWN signaling stream is down. The most important one to keep separate: reporting our
+            // transport fault as the peer's absence points the operator at the wrong machine entirely.
+            throw new DiscoveryUnavailableError("signaling_unavailable", outcome.reason);
+        default: {
+            // Exhaustiveness, enforced by the compiler. A new outcome kind must be classified
+            // deliberately rather than defaulting into "reachable" or "offline", which are the two
+            // answers a silent default would have to invent.
+            const never = outcome;
+            throw new DiscoveryUnavailableError("unrecognized_outcome", `unhandled discovery outcome ${JSON.stringify(never)}`);
+        }
+    }
+}
+//# sourceMappingURL=document-reachability.js.map

package/dist/document-reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-reachability.js","sourceRoot":"","sources":["../src/document-reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,iFAAiF;AACjF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,mCAAmC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAyB;IACjE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/B,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvC,yFAAyF;oBACzF,sFAAsF;oBACtF,yFAAyF;oBACzF,iCAAiC;oBACjC,MAAM,IAAI,yBAAyB,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,CAAC;gBACtF,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACvF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAEnD,KAAK,OAAO;YACV,yFAAyF;YACzF,uFAAuF;YACvF,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAEzE,KAAK,WAAW;YACd,6FAA6F;YAC7F,iEAAiE;YACjE,MAAM,IAAI,yBAAyB,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAE7D,KAAK,SAAS;YACZ,6FAA6F;YAC7F,yCAAyC;YACzC,MAAM,IAAI,yBAAyB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAErD,KAAK,aAAa;YAChB,2FAA2F;YAC3F,2FAA2F;YAC3F,MAAM,IAAI,yBAAyB,CAAC,uBAAuB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE/E,OAAO,CAAC,CAAC,CAAC;YACR,kFAAkF;YAClF,uFAAuF;YACvF,iDAAiD;YACjD,MAAM,KAAK,GAAU,OAAO,CAAC;YAC7B,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,EACtB,+BAA+B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/document-rejection.d.ts

@@ -0,0 +1,240 @@
+/**
+ * DOD-DOC-REJECT-1 — rejection and supersession (§3.2, §16.7-2).
+ *
+ * ── WHY SUPERSESSION, AND NOT "BOTH SIDES ROLL BACK" ──────────────────────────────────────────
+ *
+ * The naive protocol is: the receiver discards, the sender undoes locally, and both return to the
+ * pre-update state. It does not work, and the reason is a property of CRDTs rather than a bug.
+ *
+ * **Yjs undo adds INVERSES; it does not erase.** The rejected operations stay in the sender's
+ * document. So every later update the sender computes against the receiver's state vector
+ * re-transmits them, and the receiver — which refuses to hold them — can never integrate the
+ * legitimate work stacked causally on top, because Yjs will not apply operations whose
+ * predecessors are missing. A permanent causal gap, from a protocol that looked symmetric.
+ *
+ * The protocol that works (§3.2):
+ *   1. The receiver rejects with a REASON — a protocol message and its own `0x05` leaf, never a
+ *      silent drop. The update goes to quarantine, held rather than discarded.
+ *   2. The sender rolls back locally, which emits inverses into its own log and leaves an
+ *      auditable "wrote X, was rejected, undid X" trail.
+ *   3. The sender publishes a SUPERSEDING update against the receiver's state vector, which
+ *      necessarily carries the rejected operations PLUS their inverses plus any new work.
+ *   4. The receiver validates the now-clean projected diff — the rejected content nets to zero —
+ *      admits it, and clears the quarantine. Causality intact, both parties converge, and the
+ *      rejected content survives only as inert tombstones.
+ *
+ * ── SCOPE ─────────────────────────────────────────────────────────────────────────────────────
+ *
+ * This proves the protocol against STORE-1's local envelope log. The CBOR wire encoding is
+ * DOD-DOC-ENVELOPE-1's job and the cross-daemon proof is DOD-DOC-E2E-REJECT-1's.
+ */
+import * as Y from "yjs";
+import type { DocumentStore } from "./document-store.js";
+import type { Logger } from "./types.js";
+/**
+ * The document stalls on the THIRD rejected round: the original refusal, one superseding attempt,
+ * and no more (§16.7-2 "one retry, then freeze").
+ *
+ * Counted in rounds rather than retries because the previous spelling — a `REJECTION_RETRY_LIMIT`
+ * of 1 compared as `round > LIMIT + 1` — permitted two retries under a name that said one, which
+ * is the kind of thing the next edit gets wrong.
+ *
+ * Bounded at all because an unbounded retry loop between two daemons that disagree is not
+ * convergence, it is a hot loop neither operator can see. Stalling is the visible failure.
+ */
+export declare const MAX_REJECTED_ROUNDS = 3;
+export interface RejectionInput {
+    /** The envelope being rejected — the `0x05` leaf references this hash (§9). */
+    rejectedEnvelopeHash: string;
+    /** The bytes, held rather than discarded (§3.2). Supplied by the gate's quarantine verdict. */
+    quarantined: Uint8Array;
+    /**
+     * The refused envelope's OWN chain link — `null` only when the refused envelope was genuinely
+     * that sender's first. REQUIRED rather than optional: the refused envelope is deliberately never
+     * written to the log, so this is the only thing keeping the peer's next link resolvable, and an
+     * omitted value would default every refused envelope to a genesis stub — manufacturing exactly
+     * the fork the bridge exists to prevent. The caller decoded the envelope; it knows.
+     */
+    rejectedDocPrevHash: string | null;
+    reason: string;
+    detail?: string;
+    senderAgentId: string;
+    /** Which pluggable rule refused, when one did (from the gate's verdict). */
+    rule?: string;
+    /** The limit breached, when one was (from the gate's verdict). */
+    limit?: {
+        name: string;
+        limit: number;
+        actual: number;
+    };
+    /**
+     * Sign the rejection's canonical preimage (DOD-DOC-REJECT-2).
+     *
+     * The caller supplies the SIGNER, not the signature: a signature with no defined preimage is a
+     * field that can only be filled dishonestly, which is exactly what this used to be. An all-zero
+     * placeholder written into an immutable log is indistinguishable from a real signature that
+     * fails to verify, so a later verifier would send an operator to the crypto layer for a value
+     * nobody ever signed.
+     */
+    sign(tbs: Uint8Array): Promise<Uint8Array>;
+    /**
+     * The clock, passed in rather than read here. The rejection's timestamp is SIGNED, so it must be
+     * the same value in the preimage and in the row — reading `Date.now()` twice would sign one
+     * moment and store another.
+     */
+    nowMs: number;
+}
+export interface RejectionOutcome {
+    /** The document has exhausted its retries and stopped accepting updates. */
+    stalled: boolean;
+    /** How many rejections this document has seen, including this one. */
+    round: number;
+    /**
+     * The signed rejection, encoded, for the caller to put on the wire — or absent when this was a
+     * duplicate and nothing new was authored.
+     *
+     * RETURNED, because it was not, and the consequence was that the entire retry protocol was
+     * unreachable. The envelope was built here, signed here, leafed here, and then discarded: nothing
+     * in production ever called `encodeDocumentRejection`. So the refusing side kept a perfect local
+     * record of a decision it never communicated, and the sender — whose round counter is advanced by
+     * RECEIVING this frame — never advanced past round zero. A peer whose every update is refused
+     * republished forever, and its own surface said `active` the whole time. Measured live.
+     */
+    wire?: Uint8Array;
+}
+export interface QuarantineEntry {
+    rejectedEnvelopeHash: string;
+    quarantined: Uint8Array;
+    reason: string;
+    detail?: string;
+    /** Which rule refused, and the number it refused on. Surfaced, not just stored. */
+    rule?: string;
+    limitName?: string;
+    limitValue?: number;
+    limitActual?: number;
+}
+/** A handle over the sender's local edits, so a rejection can be rolled back as inverses. */
+export interface TrackedEdits {
+    readonly doc: Y.Doc;
+    readonly undoManager: Y.UndoManager;
+    /**
+     * Release the tracker. Required, not optional hygiene: the depth guard in `rollback` admits
+     * exactly one stacked edit, so the only workable pattern is a FRESH tracker per publish — which
+     * means one live UndoManager per publish on a long-lived Y.Doc, each holding `afterTransaction`
+     * observers and accumulating undo items that retain deleted structs. Call it once the rejection
+     * is resolved, either way.
+     */
+    dispose(): void;
+    /** Stack depth when tracking began, so `rollback` can prove it is undoing the right item. */
+    readonly depthAtTracking: number;
+}
+export declare class DocumentRejections {
+    #private;
+    constructor(store: DocumentStore, logger: Logger);
+    /**
+     * Record a rejection: a `0x05` row referencing the rejected envelope, the quarantined bytes
+     * held, and a policy record carrying the reason.
+     *
+     * The envelope log is append-only, so this is a NEW ROW — nothing is edited or removed.
+     *
+     * ── HOW A REFUSAL IS ACTUALLY REALIZED, AND WHY NOT THE WAY §9 SAYS ─────────────────────────
+     *
+     * §9 phrases effectiveness as a replay-time set property: "an update leaf is effective iff no
+     * rejection leaf references it". Implemented literally that is unsound, and it was measured
+     * rather than argued. Sender publishes a base, then a refused update, then rolls back and
+     * supersedes. Replaying the log while SKIPPING the refused leaf gives:
+     *
+     *     text "agreed base. "   pendingStructs PRESENT   pendingDs PRESENT
+     *
+     * The supersession is causally stacked on the refused operations — the rollback is a DELETION of
+     * those structs and the new work is positioned after them — so dropping them leaves everything
+     * later permanently pending. The document reads as complete and is silently missing the
+     * legitimate work. §16.7-5 already retired §9's "document-log order" phrasing; this retires its
+     * effectiveness phrasing on the same grounds.
+     *
+     * What is sound: the receiver NEVER WRITES the refused payload to its log. There is nothing to
+     * subtract at replay because it was never added, and the peer's supersession — computed against
+     * the RECEIVER's state vector per §3.2 step 3 — is self-contained. Measured on the same fixture:
+     *
+     *     text "agreed base. clean text. "   pendingStructs null   pendingDs null   converged true
+     *
+     * The refused bytes do travel again inside that supersession, carrying their own inverses, which
+     * is precisely "inverses, not erasure" (§3.2) — the content nets to zero and survives only as
+     * tombstones. The bytes we refused live in `document_quarantine`, and the chain bridges across
+     * the refused envelope so the peer's next link still resolves (see `verifyChainLinkage`).
+     */
+    reject(agentId: string, documentId: string, input: RejectionInput): Promise<RejectionOutcome>;
+    /**
+     * Record a rejection ARRIVING from the peer — the receiving half of §3.2's "both sides".
+     *
+     * ── THE ROUTING DECISION (the DoD requires it resolved in-unit) ─────────────────────────────
+     *
+     * A document rejection is written **daemon-side**, into this document's own log and quarantine,
+     * NOT through the gateway record store's `source` discriminator.
+     *
+     * The gateway's record store exists for SCREENING verdicts, and most V1 rejection reasons are
+     * not screening at all — `append_only`, the receiver-local limits, malformed updates, unresolved
+     * dependencies. Routing every document rejection through a screening store would file structural
+     * protocol events as policy verdicts, and it would couple this unit to a schema owned by a
+     * component that is not involved. DOD-DOC-SCREEN-1 is parked, so that coupling would also have
+     * to be built speculatively and unwound if screening lands differently.
+     *
+     * When SCREEN-1 does land, a rejection whose reason came from the screening rule can ADDITIONALLY
+     * write a gateway record — the discriminator exists for exactly that, and adding it later costs
+     * nothing, whereas removing a premature coupling costs a migration.
+     */
+    recordIncomingRejection(agentId: string, documentId: string, input: {
+        /** The peer's 0x05 leaf hash — the row's identity, so a redelivery does not advance a round. */
+        rejectionEnvelopeHash: string;
+        rejectedEnvelopeHash: string;
+        reason: string;
+        detail?: string;
+        fromAgentId: string;
+    }): {
+        stalled: boolean;
+        round: number;
+    };
+    /** Entries held for this document — never admitted, never discarded (§3.2). From the store. */
+    quarantined(agentId: string, documentId: string): QuarantineEntry[];
+    /** Clear one entry once its superseding update has been admitted (§3.2 step 4). */
+    clearQuarantine(agentId: string, documentId: string, rejectedEnvelopeHash: string): void;
+    /**
+     * Whether this document still accepts updates.
+     *
+     * A stalled document REFUSES, naming the reason it stalled — both operators need to see why,
+     * because a document that silently stops converging is the failure this exists to prevent.
+     */
+    acceptsUpdates(agentId: string, documentId: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+        detail: string;
+    };
+    /**
+     * Start tracking local edits so a rejection can be rolled back.
+     *
+     * Yjs's own UndoManager, deliberately: rolling back by hand would mean computing inverses, and
+     * the inverse of a CRDT operation is not something to hand-roll — the whole reason supersession
+     * works is that Yjs's undo produces operations that compose correctly with everything stacked
+     * on top of them.
+     */
+    trackLocalEdits(doc: Y.Doc): TrackedEdits;
+    /**
+     * Roll back the last tracked edit, as INVERSES.
+     *
+     * The sender's history grows rather than shrinking. That is not a limitation to work around: it
+     * is what leaves an auditable "wrote X, was rejected, undid X" trail, and what lets the
+     * superseding update carry the rejected operations plus their inverses so causality survives.
+     *
+     * **PRECONDITION: roll back before making further local edits.** Yjs's UndoManager undoes the
+     * most recent stack item, and it cannot undo one out of order — so a sender that keeps editing
+     * after a rejection arrives and then rolls back would undo the WRONG transaction. §3.2's
+     * ordering is steps 2 then 3 for exactly this reason: roll back, THEN do new work, THEN
+     * publish the supersession that carries all three. A caller that needs to interleave has a
+     * genuine design question, not a call-order detail, and it belongs in the unit that wires
+     * publish to the receive path.
+     */
+    rollback(tracked: TrackedEdits): void;
+}
+//# sourceMappingURL=document-rejection.d.ts.map

package/dist/document-rejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-rejection.d.ts","sourceRoot":"","sources":["../src/document-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAQzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;;OAQG;IACH,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAAC;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,qBAAa,kBAAkB;;gBAIjB,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM;IAKhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgJnG;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,gGAAgG;QAChG,qBAAqB,EAAE,MAAM,CAAC;QAC9B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GACA;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAoDtC,+FAA+F;IAC/F,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE;IAanE,mFAAmF;IACnF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,IAAI;IAQxF;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAkB/D;;;;;;;OAOG;IACH,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,YAAY;IAuBzC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;CAkCtC"}