@cello-protocol/daemon 0.0.132 → 0.0.133

package/dist/document-inbound.d.ts

@@ -0,0 +1,91 @@
+/**
+ * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
+ *
+ * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
+ * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
+ * assembling them, and assembling them is not clerical work — **the order is the security
+ * property**. A check performed after admission is a check that did not protect anything.
+ *
+ * The order, and what each step is protecting:
+ *
+ *   1. DECODE          — refuse malformed input before any of it is interpreted.
+ *   2. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
+ *   3. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
+ *                          belong here at all, and is not a rejection case (there is no
+ *                          collaboration to supersede).
+ *   4. VERIFY the signature — BEFORE the gate. The gate runs pluggable rules, and eventually
+ *                          screening, over peer-controlled bytes; running them first means those
+ *                          rules process input from a party we have not authenticated. An
+ *                          unverified envelope is also not REJECTED — a rejection is a protocol act
+ *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
+ *                          naming an unauthenticated sender puts their claim in our permanent log.
+ *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
+ *                          a redelivery that goes unacked never lets the sender settle it); a gap
+ *                          or a fork refuses.
+ *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
+ *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
+ *                          peer has decided, so the sender must stop retrying and supersede.
+ */
+import * as Y from "yjs";
+import type { DocumentStore } from "./document-store.js";
+import type { DocumentEngine } from "./document-engine.js";
+import type { DocumentGate } from "./document-gate.js";
+import type { DocumentRejections } from "./document-rejection.js";
+import type { Logger } from "./types.js";
+export type InboundResult = {
+    ok: true;
+    admitted: true;
+    envelopeHash: string;
+    duplicate: boolean;
+} | {
+    ok: true;
+    admitted: false;
+    envelopeHash: string;
+    rejectionReason: string;
+    duplicate: false;
+    /** The signed `document_rejection` to put on the wire. Absent when this refusal is a repeat. */
+    rejectionWire?: Uint8Array;
+} | {
+    ok: false;
+    reason: string;
+    detail: string;
+};
+export interface DocumentInboundDeps {
+    store: DocumentStore;
+    engine: DocumentEngine;
+    gate: DocumentGate;
+    rejections: DocumentRejections;
+    logger: Logger;
+    /**
+     * Verify the envelope signature against `sender_agent_id`. INJECTED and REQUIRED — this module
+     * cannot resolve an agent id to a public key, and a default would be a default answer to "is this
+     * authentic", which is the one question that must never have one.
+     */
+    verifySignature(senderAgentId: string, tbs: Uint8Array, signature: Uint8Array): boolean;
+    /** The live document to apply admitted updates to. */
+    liveDocFor(ownerAgentId: string, documentId: string): Y.Doc;
+    /**
+     * Sign as the OWNING agent, over the rejection's canonical preimage (DOD-DOC-REJECT-2).
+     *
+     * Takes the agent so it cannot sign with the wrong key. ASYNC, and that is what makes `receive`
+     * async: signing goes through a key provider, and REJECT-1 requires a real signature rather than
+     * a placeholder.
+     */
+    sign(ownerAgentId: string, tbs: Uint8Array): Promise<Uint8Array>;
+}
+export declare class DocumentInbound {
+    #private;
+    constructor(deps: DocumentInboundDeps);
+    /**
+     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
+     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
+     * log is indistinguishable from a real one that fails to verify — so the async is real, not
+     * incidental.
+     *
+     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
+     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
+     * stored before its successor is checked.
+     */
+    receive(ownerAgentId: string, wire: Uint8Array, nowMs: number, correlationId?: string): Promise<InboundResult>;
+}
+//# sourceMappingURL=document-inbound.d.ts.map

package/dist/document-inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-inbound.d.ts","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAQzB,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACtE;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,KAAK,CAAC;IACjB,gGAAgG;IAChG,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IACxF,sDAAsD;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IAC5D;;;;;;OAMG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClE;AAOD,qBAAa,eAAe;;gBAGd,IAAI,EAAE,mBAAmB;IAkBrC;;;;;;;;;OASG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,SAAY,GACxB,OAAO,CAAC,aAAa,CAAC;CA0P1B"}

package/dist/document-inbound.js

@@ -0,0 +1,290 @@
+/**
+ * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
+ *
+ * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
+ * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
+ * assembling them, and assembling them is not clerical work — **the order is the security
+ * property**. A check performed after admission is a check that did not protect anything.
+ *
+ * The order, and what each step is protecting:
+ *
+ *   1. DECODE          — refuse malformed input before any of it is interpreted.
+ *   2. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
+ *   3. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
+ *                          belong here at all, and is not a rejection case (there is no
+ *                          collaboration to supersede).
+ *   4. VERIFY the signature — BEFORE the gate. The gate runs pluggable rules, and eventually
+ *                          screening, over peer-controlled bytes; running them first means those
+ *                          rules process input from a party we have not authenticated. An
+ *                          unverified envelope is also not REJECTED — a rejection is a protocol act
+ *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
+ *                          naming an unauthenticated sender puts their claim in our permanent log.
+ *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
+ *                          a redelivery that goes unacked never lets the sender settle it); a gap
+ *                          or a fork refuses.
+ *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
+ *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
+ *                          peer has decided, so the sender must stop retrying and supersede.
+ */
+import { decodeDocumentUpdateEnvelope, documentEnvelopeHash, buildDocumentUpdateTbs, verifyDocumentChainLink, } from "@cello-protocol/protocol-types";
+/** The agreed property, read from the row rather than from whoever called us. */
+function appendOnly(doc) {
+    return doc.properties.append_only === true;
+}
+export class DocumentInbound {
+    #d;
+    constructor(deps) {
+        this.#d = deps;
+    }
+    /**
+     * The clientIDs this sender has SIGNED for on this document: the one this envelope declares,
+     * plus every one previously admitted from them. Both are authenticated — each arrived inside a
+     * verified TBS — so the set can only grow through signatures the peer actually made.
+     */
+    #boundClientIds(ownerAgentId, env) {
+        return [
+            ...new Set([
+                env.sender_client_id,
+                ...this.#d.store.senderClientIdsFor(ownerAgentId, env.document_id, env.sender_agent_id),
+            ]),
+        ];
+    }
+    /**
+     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
+     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
+     * log is indistinguishable from a real one that fails to verify — so the async is real, not
+     * incidental.
+     *
+     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
+     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
+     * stored before its successor is checked.
+     */
+    async receive(ownerAgentId, wire, nowMs, correlationId = "inbound") {
+        // 1. DECODE.
+        let env;
+        try {
+            env = decodeDocumentUpdateEnvelope(wire);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.#d.logger.warn("document.inbound.malformed", { detail, correlationId });
+            // ONE reason code, with the upstream message in the detail. Two kinds of failure arrive here:
+            // our own decoder's named refusals ("document_envelope_missing_field: …"), and CBOR/lib0
+            // errors from bytes that are not a CBOR map at all ("Data read, but end of buffer not
+            // reached"). Splitting the message on ":" turned the second kind into a reason code made of
+            // English prose, which nothing can match on and which reads as a crash rather than a refusal.
+            return { ok: false, reason: "document_inbound_malformed", detail };
+        }
+        const envelopeHash = documentEnvelopeHash(env);
+        // 2. KNOW the document.
+        const doc = this.#d.store.getDocument(ownerAgentId, env.document_id);
+        if (!doc) {
+            return {
+                ok: false,
+                reason: "document_unknown",
+                detail: `no document ${env.document_id.slice(0, 16)}… for this agent`,
+            };
+        }
+        // 2b. The document must still ACCEPT. `acceptsUpdates` exists for exactly this and carries a
+        // comment describing the bug it was written to fix — "after a restart the document row said
+        // `stalled` while the daemon happily accepted updates on it". The only inbound path in the
+        // codebase was reintroducing it, and a killed document is defined by LIFECYCLE-1 as one that
+        // stops accepting.
+        if (doc.status === "killed" || doc.status === "closed") {
+            return {
+                ok: false,
+                reason: doc.status === "killed" ? "document_killed" : "document_closed",
+                detail: doc.status === "killed"
+                    ? "this document was ended locally and no longer accepts updates"
+                    : "this document was closed by agreement and no longer accepts updates",
+            };
+        }
+        const accepts = this.#d.rejections.acceptsUpdates(ownerAgentId, env.document_id);
+        if (!accepts.ok) {
+            // The stall reason, composed by the unit that owns the stall. Reporting this envelope's own
+            // gate verdict instead would send an operator to the append-only rule for a document that has
+            // been frozen for days.
+            return { ok: false, reason: accepts.reason, detail: accepts.detail };
+        }
+        // 3. The sender must be THIS document's peer.
+        if (env.sender_agent_id !== doc.peerAgentId) {
+            this.#d.logger.warn("document.inbound.not_peer", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                peerAgentId: doc.peerAgentId,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_sender_not_peer",
+                // The peer's identity is NOT in the reply. This sender has not authenticated, and anyone
+                // reaching the channel with a guessed or leaked document_id would otherwise learn who the
+                // owner collaborates with. The full detail is in the warn above, where it belongs.
+                detail: "you are not a party to this document",
+            };
+        }
+        // 4. VERIFY, before the gate. See the header.
+        if (!this.#d.verifySignature(env.sender_agent_id, buildDocumentUpdateTbs(env), env.signature)) {
+            this.#d.logger.error("document.inbound.signature_invalid", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                envelopeHash,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_signature_invalid",
+                detail: `the envelope claims to come from ${env.sender_agent_id} but its signature does not ` +
+                    `verify against that agent — nothing was recorded`,
+            };
+        }
+        // 5. CHAIN. A redelivery is expected traffic and must still be answered.
+        // Hash-only. Reading the whole log meant materializing every payload BLOB on every inbound
+        // update, just to build a set for one membership test.
+        const known = this.#d.store.knownEnvelopeHashesBySender(ownerAgentId, env.document_id, env.sender_agent_id);
+        const head = this.#d.store.lastEnvelopeHashBySender(ownerAgentId, env.document_id, env.sender_agent_id);
+        let duplicate;
+        try {
+            duplicate = verifyDocumentChainLink(env, { head, known }).duplicate;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.#d.logger.warn("document.inbound.chain_refused", {
+                documentId: env.document_id,
+                correlationId,
+                detail,
+            });
+            // MATCHED against the known set, not split on ":". This file explains sixty lines earlier why
+            // splitting an upstream message produces reason codes made of English prose — and the old
+            // `?? "document_chain_broken"` fallback mislabelled a FORK as a gap, which is precisely the
+            // distinction the envelope module went out of its way to create.
+            const reason = ["document_chain_forked", "document_chain_broken"].find((r) => detail.startsWith(r));
+            return { ok: false, reason: reason ?? "document_chain_refused", detail };
+        }
+        if (duplicate) {
+            // ACK, and change nothing. Not acking would leave the sender retrying an envelope we already
+            // hold, forever; applying it again is unnecessary (Yjs is idempotent) and appending it again
+            // is refused by the store anyway.
+            this.#d.logger.info("document.inbound.duplicate", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                envelopeHash,
+                correlationId,
+            });
+            return { ok: true, admitted: true, envelopeHash, duplicate: true };
+        }
+        // 5b. ALREADY REJECTED? A rejected envelope's hash is deliberately never written to the log, so
+        // it is not in `known` and a redelivery is NOT a duplicate. Without this it re-ran the gate,
+        // was rejected again, and `reject()` minted a fresh nonce — advancing the retry round. Since
+        // MAX_REJECTED_ROUNDS is 3, a peer whose ACKS ARE BEING LOST — which is delivery's ordinary
+        // retry behaviour — permanently stalled the shared document in three attempts, with no
+        // hostility required. Hostile, it was a one-line denial of service.
+        //
+        // Re-answered with the RECORDED reason: the peer needs the same answer it was given before, so
+        // it supersedes rather than retries.
+        const alreadyRejected = this.#d.store
+            .listQuarantined(ownerAgentId, env.document_id)
+            .find((q) => q.rejectedEnvelopeHash === envelopeHash);
+        if (alreadyRejected) {
+            this.#d.logger.info("document.inbound.already_rejected", {
+                documentId: env.document_id,
+                envelopeHash,
+                correlationId,
+            });
+            return {
+                ok: true,
+                admitted: false,
+                envelopeHash,
+                rejectionReason: alreadyRejected.reason,
+                duplicate: false,
+            };
+        }
+        // 6. GATE — against the LIVE doc, which the gate itself trials on a copy.
+        const live = this.#d.liveDocFor(ownerAgentId, env.document_id);
+        const verdict = this.#d.gate.validate(live, env.update, {
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            // DERIVED from authenticated data, not from a seam nobody produces. ENVELOPE-1 puts
+            // `sender_client_id` inside the signed TBS precisely because "this envelope is where it is
+            // learned" — and the assembler was decoding it, verifying the signature over it, and then
+            // throwing it away, leaving rule (h) wired to a function with no implementation. Left as a
+            // seam it would default to wrong in whichever direction its implementer guessed: `[]`
+            // refuses every peer update, the union of everything observed admits anything.
+            //
+            // §14 forbids persisting a clientID for REUSE; recording which ones a peer has SIGNED for
+            // is the opposite — it is the binding the gate's rule exists to check.
+            senderClientIds: this.#boundClientIds(ownerAgentId, env),
+            declaredDocumentId: env.document_id,
+            declaredEncoding: env.update_encoding,
+            // THE PERSISTED PROPERTY, not a caller option defaulting to off. append_only is agreed at
+            // the handshake and stored on the row, and the gate's own header says it "is the only thing
+            // standing between a bound peer and erasure" — rule (h) provably cannot see a deletion.
+            // Taking it from an option meant a document configured append-only was unprotected unless
+            // every future call site remembered to pass the flag.
+            appendOnly: appendOnly(doc),
+        }, nowMs);
+        if (!verdict.admit) {
+            // 7a. REJECT. The bytes are held, a 0x05 leaf references them, and the peer is ANSWERED —
+            // a rejection is an ack for delivery purposes, so the sender stops retrying and supersedes.
+            const rejection = await this.#d.rejections.reject(ownerAgentId, env.document_id, {
+                rejectedEnvelopeHash: envelopeHash,
+                quarantined: verdict.quarantined,
+                reason: verdict.reason,
+                detail: verdict.detail,
+                senderAgentId: env.sender_agent_id,
+                rejectedDocPrevHash: env.doc_prev_hash,
+                rule: verdict.rule,
+                limit: verdict.limit,
+                // The OWNER signs its own rejection, over the canonical preimage (DOD-DOC-REJECT-2).
+                sign: (tbs) => this.#d.sign(ownerAgentId, tbs),
+                nowMs,
+            });
+            return {
+                ok: true,
+                admitted: false,
+                envelopeHash,
+                // The signed refusal, for the caller to transmit. Absent on a duplicate — we already told
+                // them once, and re-sending would advance their round counter for a retry that never
+                // happened, driving the document to `stalled` early.
+                ...(rejection.wire ? { rejectionWire: rejection.wire } : {}),
+                rejectionReason: verdict.reason,
+                duplicate: false,
+            };
+        }
+        // 7b. ADMIT. The log first, then the live document: an update applied but not logged is one
+        // the operator can read and cannot rebuild, and a rebuild is how the document survives a
+        // restart. The other order loses content; this order at worst repeats an idempotent apply.
+        this.#d.store.appendEnvelope(ownerAgentId, {
+            envelopeHash,
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            docPrevHash: env.doc_prev_hash,
+            epochId: env.epoch_id,
+            signature: env.signature,
+            stateVector: env.state_vector,
+            payload: env.update,
+            kind: "update",
+            referencesEnvelopeHash: null,
+            // Recorded so the authorship binding for this peer is derived from what they SIGNED, not
+            // from a seam somebody has to remember to implement.
+            senderClientId: env.sender_client_id,
+            createdAtMs: nowMs,
+        });
+        this.#d.engine.applyUpdateOrThrow(live, env.update);
+        // §3.2 step 4: admit AND CLEAR THE QUARANTINE. This is the supersession closing — the held
+        // bytes are released, the chain bridge stub for the superseded envelope goes with them, and
+        // `document.supersession.admitted` finally has a producer. Without it the entries stayed held
+        // forever and the event was a name with nothing behind it.
+        if (env.doc_prev_hash !== null) {
+            this.#d.rejections.clearQuarantine(ownerAgentId, env.document_id, env.doc_prev_hash);
+        }
+        this.#d.logger.info("document.inbound.admitted", {
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            envelopeHash,
+            correlationId,
+        });
+        return { ok: true, admitted: true, envelopeHash, duplicate: false };
+    }
+}
+//# sourceMappingURL=document-inbound.js.map

package/dist/document-inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-inbound.js","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,gCAAgC,CAAC;AA4CxC,iFAAiF;AACjF,SAAS,UAAU,CAAC,GAAuC;IACzD,OAAO,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,EAAE,CAAsB;IAEjC,YAAY,IAAyB;QACnC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAoB,EAAE,GAA2B;QAC/D,OAAO;YACL,GAAG,IAAI,GAAG,CAAS;gBACjB,GAAG,CAAC,gBAAgB;gBACpB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC;aACxF,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,IAAgB,EAChB,KAAa,EACb,aAAa,GAAG,SAAS;QAEzB,aAAa;QACb,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7E,8FAA8F;YAC9F,yFAAyF;YACzF,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE/C,wBAAwB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACtE,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,4FAA4F;QAC5F,2FAA2F;QAC3F,6FAA6F;QAC7F,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;gBACvE,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,QAAQ;oBACrB,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,qEAAqE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,4FAA4F;YAC5F,8FAA8F;YAC9F,wBAAwB;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,8CAA8C;QAC9C,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B;gBAClC,yFAAyF;gBACzF,0FAA0F;gBAC1F,mFAAmF;gBACnF,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EACJ,oCAAoC,GAAG,CAAC,eAAe,8BAA8B;oBACrF,kDAAkD;aACrD,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CACrD,YAAY,EACZ,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,eAAe,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACxG,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,uBAAuB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACpD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa;gBACb,MAAM;aACP,CAAC,CAAC;YACH,8FAA8F;YAC9F,0FAA0F;YAC1F,4FAA4F;YAC5F,iEAAiE;YACjE,MAAM,MAAM,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3E,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,6FAA6F;YAC7F,6FAA6F;YAC7F,kCAAkC;YAClC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAChD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,uFAAuF;QACvF,oEAAoE;QACpE,EAAE;QACF,+FAA+F;QAC/F,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK;aAClC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC;aAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,YAAY,CAAC,CAAC;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACvD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,eAAe,EAAE,eAAe,CAAC,MAAM;gBACvC,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CACnC,IAAI,EACJ,GAAG,CAAC,MAAM,EACV;YACE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,oFAAoF;YACpF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,sFAAsF;YACtF,+EAA+E;YAC/E,EAAE;YACF,0FAA0F;YAC1F,uEAAuE;YACvE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC;YACxD,kBAAkB,EAAE,GAAG,CAAC,WAAW;YACnC,gBAAgB,EAAE,GAAG,CAAC,eAAe;YACrC,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,0FAA0F;YAC1F,sDAAsD;YACtD,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC;SAC5B,EACD,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,0FAA0F;YAC1F,4FAA4F;YAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC/E,oBAAoB,EAAE,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,mBAAmB,EAAE,GAAG,CAAC,aAAa;gBACtC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,qFAAqF;gBACrF,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;gBAC9C,KAAK;aACN,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,0FAA0F;gBAC1F,qFAAqF;gBACrF,qDAAqD;gBACrD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YACzC,YAAY;YACZ,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,IAAI,EAAE,QAAQ;YACd,sBAAsB,EAAE,IAAI;YAC5B,yFAAyF;YACzF,qDAAqD;YACrD,cAAc,EAAE,GAAG,CAAC,gBAAgB;YACpC,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpD,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;CACF"}

package/dist/document-layer.d.ts

@@ -0,0 +1,137 @@
+/**
+ * DOD-DOC-INBOUND-2 / DOD-DOC-DELIVERY-2 — the composition of the document layer.
+ *
+ * Everything M14 built is a unit with injected seams. This is where they become one thing, and it
+ * is a module rather than a block inside `daemon.ts` for one reason: the assembly makes decisions.
+ * Which verifier, which live-doc policy, and — the one that matters — whether the layer is present
+ * at all.
+ *
+ * ── ALL OR NOTHING ────────────────────────────────────────────────────────────────────────────
+ *
+ * The layer is built completely or not built. There is no partially-wired mode, because every
+ * half-wiring is a distinct silent failure: an inbound path with no ack producer leaves the peer
+ * retrying until their document stalls; a delivery worker with no inbound counterpart publishes
+ * envelopes nobody can answer. `DOD-DOC-DELIVERY-2` records that ordering constraint on its own
+ * line, and this is where it is enforced instead of remembered.
+ *
+ * ── THE VERIFIER IS REQUIRED, AND RESOLVES THROUGH THE CALLER ─────────────────────────────────
+ *
+ * Signature verification needs an agent id → public key mapping, which lives with the daemon's
+ * contact and session state rather than here. It is passed in, and there is no default: a default
+ * would be a default answer to "is this authentic", and both inbound paths refuse rather than
+ * admit when it says no.
+ */
+import { DocumentStore } from "./document-store.js";
+import { DocumentEngine } from "./document-engine.js";
+import { DocumentRejections } from "./document-rejection.js";
+import { DocumentFrameRouter } from "./document-frame-router.js";
+import { LiveDocuments } from "./document-live-docs.js";
+import { DocumentLifecycle } from "./document-lifecycle.js";
+import { DocumentNotifications } from "./document-notify.js";
+import { DocumentHandshake } from "./document-handshake.js";
+import { DocumentWritePath } from "./document-write-path.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+export interface DocumentLayerDeps {
+    db: DaemonDatabase;
+    logger: Logger;
+    /**
+     * The public key an agent id signs with, or null when this daemon cannot resolve one.
+     *
+     * REQUIRED. Returning null means "cannot verify", which both inbound paths treat as a refusal —
+     * the same answer as a bad signature, because admitting an envelope we cannot authenticate is
+     * the outcome the whole verify step exists to prevent.
+     *
+     * Injected rather than computed here even though M14-D5 makes a remote agent id BE its pubkey
+     * hex, because the daemon may want to refuse a peer it has no contact for, or resolve through a
+     * different binding later. `agentPublicKeyFromId` below is the default implementation.
+     */
+    publicKeyFor(agentId: string): Uint8Array | null;
+    /**
+     * The stable owner key for a daemon agent NAME — our own K_local pubkey hex (M14-D5).
+     *
+     * The session content path knows agents by name; every document row is scoped by owner key. Both
+     * halves of the layer must agree, and the delivery sweep already uses the pubkey hex. See
+     * `DocumentFrameRouterDeps.ownerKeyFor` for what a disagreement hides.
+     */
+    ownerKeyFor(agentName: string): string | null;
+    /** Tell the peer about a unilateral end. Injected — the transport is not this layer's. */
+    notifyPeer(documentId: string, verb: "kill" | "close"): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Undo one envelope's operations on the live document, for withdraw. */
+    rollback(ownerAgentId: string, documentId: string, envelopeHash: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    /**
+     * Sign as a given agent. Takes the agent id so a rejection cannot be signed with the wrong key —
+     * the first version took no arguments and the composition root reached for whichever key
+     * provider was first in a map, which is fabricated crypto wearing a real signature.
+     *
+     * ASYNC because signing goes through a key provider, and that async is what forced the router to
+     * split synchronous CLASSIFICATION from asynchronous HANDLING.
+     */
+    sign(ownerAgentId: string, tbs: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Put an already-encoded frame on the wire to a peer — the ack, today.
+     *
+     * Injected because the transport is not this layer's, and REQUIRED for the same reason the layer
+     * is all-or-nothing: an inbound path that cannot answer leaves every sender retrying until their
+     * document stalls.
+     */
+    /**
+     * Where documents are materialized as files. Absent disables the file surface entirely — the
+     * content verbs still work, and nothing silently half-writes.
+     */
+    workspaceRoot?: string;
+    sendFrame(ownerAgentId: string, peerAgentId: string, bytes: Uint8Array): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+export interface DocumentLayer {
+    store: DocumentStore;
+    /** The file projection, or null when no workspace root was configured. */
+    writePath: DocumentWritePath | null;
+    handshake: DocumentHandshake;
+    engine: DocumentEngine;
+    live: LiveDocuments;
+    lifecycle: DocumentLifecycle;
+    notifications: DocumentNotifications;
+    rejections: DocumentRejections;
+    router: DocumentFrameRouter;
+    /**
+     * The hook `SessionNodeManager.setOnDocumentFrame` takes. Handed out ready-shaped so the
+     * composition root does not re-derive the adapter — and so the `consumed` contract has exactly
+     * one definition.
+     */
+    onDocumentFrame(agentName: string, sessionId: string, content: Uint8Array, senderPubkey: string, correlationId?: string): {
+        consumed: boolean;
+        kind?: string;
+        ok?: boolean;
+        reason?: string;
+    };
+}
+/**
+ * The default `publicKeyFor`: a remote agent's id IS its K_local public key, hex-encoded (M14-D5).
+ *
+ * `agent_id` in this daemon is a LOCAL primary key on the `agents` table — it names rows in our own
+ * database and cannot identify a remote peer. The pubkey is the only self-verifying identifier
+ * available: the signature checks against it directly, with no lookup that could be stale, missing
+ * or poisoned sitting on the critical path of every authentication.
+ *
+ * Malformed input returns null rather than throwing, and null is a refusal. An id that is not a
+ * 32-byte hex key is not "a peer we have no key for" — it is a frame that does not follow the
+ * protocol — but both must refuse, and refusing loudly at the verify step is where it belongs.
+ */
+export declare function agentPublicKeyFromId(agentId: string): Uint8Array | null;
+export declare function createDocumentLayer(deps: DocumentLayerDeps): DocumentLayer;
+//# sourceMappingURL=document-layer.d.ts.map

package/dist/document-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-layer.d.ts","sourceRoot":"","sources":["../src/document-layer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAc7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,cAAc,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IACjD;;;;;;OAMG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,0FAA0F;IAC1F,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GAAG,OAAO,GACrB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzD,yEAAyE;IACzE,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD;;;;;;;OAOG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjE;;;;;;OAMG;IACH;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,aAAa,EAAE,qBAAqB,CAAC;IACrC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,GACrB;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAGvE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAwN1E"}