@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/document-handshake.js

@@ -1,452 +0,0 @@
-/**
- * DOD-DOC-HANDSHAKE-1 — the document handshake, daemon side (§16.3).
- *
- * Mirrors the attestation-consent pattern operators already understand: a proposal arrives, sits
- * as a pending item, and is accepted or refused once. On accept both sides mint the document from
- * the agreed starting content.
- *
- * ── WHY ACCEPTANCE IS COMPARE-AND-SET ─────────────────────────────────────────────────────────
- *
- * `UPDATE … WHERE consent_state = 'pending'`, and the row count is the answer. Read-then-write
- * would let two concurrent accepts — an agent and a CLI, or two windows on one machine, both real
- * on a multi-attended daemon — each see `pending`, each create the document, and each report
- * success. Worse in the other direction: a REFUSED proposal re-read as pending would be accepted
- * after the operator declined it, which is the one outcome consent exists to make impossible.
- *
- * The same reasoning applies to refuse. Both transitions are terminal and both are guarded.
- *
- * ── WHY THE SEAM IS CHECKED AGAIN HERE ────────────────────────────────────────────────────────
- *
- * `seamViolation` already ran when the proposal was recorded. It runs again at accept because the
- * proposer and the accepter run DIFFERENT BUILDS: a peer one version ahead can propose a value
- * this build cannot honour, and if only the proposer validated, whichever side is newer would
- * silently decide the terms for both. Re-checking at the transition is also what makes an upgrade
- * safe — a proposal recorded under an older build cannot be accepted under rules it predates.
- */
-import { buildDocumentProposalTbs, decodeDocumentProposal, documentFeatureIncompatibility, documentIdFromProposal, encodeDocumentProposal, seamViolation, } from "@cello-protocol/protocol-types";
-import { addColumnIfMissing } from "./column-birth.js";
-/**
- * NOTE FOR THE NEXT COLUMN. `CREATE TABLE IF NOT EXISTS` is correct only while no daemon has ever
- * created this table — true today, since it is new in an unreleased milestone. The moment any dev
- * or staging DB holds it, adding a column here returns silently and that column never appears on
- * an upgraded database while fresh installs get it. That divergence has already shipped once in
- * this repo (see `consent-migration.ts`). Any future column needs a `PRAGMA table_info` birth-gated
- * ALTER under `BEGIN IMMEDIATE`, following that file.
- */
-const CREATE_PROPOSALS_SQL = `
-  CREATE TABLE IF NOT EXISTS document_proposals (
-    owner_agent_id  TEXT    NOT NULL,
-    document_id     TEXT    NOT NULL,
-    proposer_agent_id TEXT  NOT NULL,
-    peer_agent_id   TEXT    NOT NULL,
-    -- The proposal envelope as it arrived. Kept whole rather than exploded into columns, because
-    -- document_id is the hash of exactly these bytes: reconstructing them from columns would make
-    -- the identity depend on this schema's round-trip fidelity forever.
-    envelope        BLOB    NOT NULL,
-    consent_state   TEXT    NOT NULL CHECK (consent_state IN ('pending', 'accepted', 'refused')),
-    -- Why it was refused, when it was. An operator who declined a proposal weeks ago, or whose
-    -- daemon declined it on a seam violation, has no other record of which it was.
-    refusal_reason  TEXT,
-    created_at      INTEGER NOT NULL,
-    decided_at      INTEGER,
-    PRIMARY KEY (owner_agent_id, document_id),
-    CHECK (consent_state <> 'refused' OR refusal_reason IS NOT NULL)
-  );
-`;
-/**
- * COLUMN BIRTH for the peer's answer to a proposal WE authored (the `document_proposal_ack` frame).
- *
- * Separate from the CREATE because a daemon that already holds proposals must gain the columns
- * without losing them. `ALTER TABLE ... ADD COLUMN` throws on a re-run, which is why each is
- * wrapped rather than guarded by a version number nobody maintains.
- *
- * Distinct from `consent_state`, which is OUR decision about THEIR proposal. Overloading one column
- * for both directions is how "we accepted" and "they accepted" become indistinguishable — and the
- * operator surface exists precisely to tell those apart.
- */
-const PEER_DECISION_COLUMNS = [
-    { column: "peer_accepted", sql: "ALTER TABLE document_proposals ADD COLUMN peer_accepted INTEGER" },
-    { column: "peer_reason", sql: "ALTER TABLE document_proposals ADD COLUMN peer_reason TEXT" },
-    { column: "peer_decided_at", sql: "ALTER TABLE document_proposals ADD COLUMN peer_decided_at INTEGER" },
-    // DID OUR OFFER ACTUALLY LEAVE? Nothing durable recorded it, so `peerAccepted: null` meant both
-    // "they have not decided" and "they were never asked" — and the shipped skill told the operator
-    // to WAIT, which is wrong for the second. The only place the send outcome ever appeared was the
-    // transient response to the propose call itself.
-    { column: "proposal_sent_at", sql: "ALTER TABLE document_proposals ADD COLUMN proposal_sent_at INTEGER" },
-];
-export class DocumentHandshake {
-    #db;
-    #logger;
-    #verify;
-    constructor(db, logger, verify) {
-        this.#db = db;
-        this.#logger = logger;
-        this.#verify = verify;
-        this.#db.exec(CREATE_PROPOSALS_SQL);
-        for (const { column, sql } of PEER_DECISION_COLUMNS) {
-            addColumnIfMissing(this.#db, this.#logger, { table: "document_proposals", column, sql });
-        }
-    }
-    /**
-     * Record an arriving proposal as PENDING, or refuse it outright.
-     *
-     * A seam violation or a version mismatch is recorded as `refused` with its reason rather than
-     * dropped, so the operator can see that a peer tried and why it could not proceed. A dropped
-     * proposal is indistinguishable from a peer that never sent one.
-     */
-    recordProposal(ownerAgentId, wire, nowMs) {
-        const envelope = decodeDocumentProposal(wire);
-        const documentId = documentIdFromProposal(envelope);
-        // AUTHENTICITY FIRST, and it is fatal rather than a recorded refusal. The operator's consent
-        // decision rests entirely on the proposal having come from the agent it names, and an
-        // unverified proposal must not reach the inbox at all — `ON CONFLICT DO NOTHING` means the
-        // FIRST arrival's bytes are the permanent record for a document_id, so anyone who observed the
-        // honest proposal (and therefore knows the nonce) could race a byte-variant carrying junk,
-        // win the primary key, and permanently poison the id while the honest proposal is silently
-        // discarded. The proposer would have to re-propose under a new nonce with no signal why.
-        if (!this.#verify(envelope.proposer_agent_id, buildDocumentProposalTbs(envelope), envelope.signature)) {
-            this.#logger.error("document.proposal.signature_invalid", {
-                documentId,
-                proposerAgentId: envelope.proposer_agent_id,
-            });
-            throw new Error(`document_proposal_signature_invalid: the proposal claims to come from ` +
-                `${envelope.proposer_agent_id} but its signature does not verify against that agent`);
-        }
-        // ADDRESSED TO US. `ownerAgentId` comes from the caller and `peer_agent_id` comes from the
-        // wire, and on a multi-agent daemon — which is why owner_agent_id is in the key at all — an
-        // unchecked pair lets a proposal addressed to agent Z be recorded under agent Y and accepted
-        // BY agent Y. Consent would then be taken from a party the proposal never named, while the
-        // document_id (which does commit to peer_agent_id) says otherwise, with no error anywhere.
-        if (envelope.peer_agent_id !== ownerAgentId) {
-            this.#logger.warn("document.proposal.wrong_peer", {
-                documentId,
-                addressedTo: envelope.peer_agent_id,
-                recordedFor: ownerAgentId,
-            });
-            throw new Error(`document_proposal_wrong_peer: this proposal is addressed to ${envelope.peer_agent_id}, ` +
-                `not to ${ownerAgentId} — consent belongs to the agent the proposer named`);
-        }
-        // The HUMAN answer, not a machine label. The clause exists because the alternative to a
-        // sentence is a proposal that is never answered, which surfaces as a hang and gets diagnosed
-        // as a network fault — and because "upgrade" is useless without saying WHOSE client.
-        const incompatible = documentFeatureIncompatibility(envelope.feature_version);
-        const reason = incompatible ?? seamViolation(envelope.properties);
-        this.#db
-            .prepare(`INSERT INTO document_proposals
-           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
-            consent_state, refusal_reason, created_at, decided_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
-            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(encodeDocumentProposal(envelope)), reason ? "refused" : "pending", reason, nowMs, reason ? nowMs : null);
-        // READ BACK THE ROW, do not report what we intended. On a redelivery the INSERT does nothing —
-        // correct — and returning the state we would have written announces a decision the operator
-        // already made as still awaiting one, and logs an arrival that did not happen.
-        const stored = this.get(ownerAgentId, documentId);
-        const state = stored?.consentState ?? (reason ? "refused" : "pending");
-        const storedReason = stored?.refusalReason ?? reason ?? undefined;
-        if (state === "refused") {
-            this.#logger.warn("document.proposal.refused", {
-                documentId,
-                reason: storedReason,
-                autoRefused: true,
-            });
-            return { documentId, state, reason: storedReason };
-        }
-        if (state === "pending") {
-            // `document.proposal.received` per the DoD taxonomy — this fires when a proposal ARRIVES.
-            this.#logger.info("document.proposal.received", {
-                documentId,
-                proposerAgentId: envelope.proposer_agent_id,
-            });
-        }
-        return { documentId, state, ...(storedReason ? { reason: storedReason } : {}) };
-    }
-    /**
-     * Record a proposal WE authored, so it can be re-sent without minting a new one.
-     *
-     * The proposer had no record of the envelope it sent. That is fine until the send fails — an
-     * offline peer is the ordinary case — and then the document exists locally with no way to reach
-     * the counterparty: re-proposing mints a fresh nonce, hence a fresh `document_id`, hence a second
-     * document, leaving the first as an orphan the operator cannot explain or clear.
-     *
-     * Stored `accepted`, because we consented by authoring it — so it never appears in our own inbox
-     * (`pending` filters on state), which would be an offer to ourselves.
-     *
-     * Deliberately NOT routed through `recordProposal`: that path's checks are for a proposal
-     * ARRIVING — verify the signature against the named proposer, and refuse one not addressed to us.
-     * Ours is addressed to the peer by definition, so reusing that path would require weakening the
-     * check that stops a proposal being recorded under an agent it never named.
-     */
-    /**
-     * M14B / DOD-MP-JOIN-1 — record the genesis of a document this agent JOINED.
-     *
-     * The joiner is neither the proposer nor the named peer, so both existing paths refuse this
-     * envelope by design (`recordProposal` demands we are the addressee; `recordOutgoing` claims
-     * authorship). Stored `accepted` because the joiner's consent is their signed join answer —
-     * and stored at all because `LiveDocuments` reads `starting_content` from this table: without
-     * the row, a joined document rebuilds from an empty epoch zero and silently diverges from
-     * every other holder.
-     *
-     * The caller passes the RECEIVED genesis bytes; they are stored verbatim, not re-encoded.
-     */
-    recordJoined(ownerAgentId, receivedGenesis, nowMs) {
-        const envelope = decodeDocumentProposal(receivedGenesis);
-        const documentId = documentIdFromProposal(envelope);
-        this.#db
-            .prepare(`INSERT INTO document_proposals
-           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
-            consent_state, refusal_reason, created_at, decided_at)
-         VALUES (?, ?, ?, ?, ?, 'accepted', NULL, ?, ?)
-         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
-            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(receivedGenesis), nowMs, nowMs);
-        return documentId;
-    }
-    recordOutgoing(ownerAgentId, envelope, nowMs) {
-        const documentId = documentIdFromProposal(envelope);
-        this.#db
-            .prepare(`INSERT INTO document_proposals
-           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
-            consent_state, refusal_reason, created_at, decided_at)
-         VALUES (?, ?, ?, ?, ?, 'accepted', NULL, ?, ?)
-         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
-            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(encodeDocumentProposal(envelope)), nowMs, nowMs);
-        return documentId;
-    }
-    /**
-     * Record the PEER's answer to a proposal we authored.
-     *
-     * The caller verifies the signature first — this only stores. Kept as its own method rather than
-     * folded into `accept`/`refuse` because those are OUR decision about THEIR proposal, and this is
-     * the mirror: their decision about ours. Collapsing them would put a peer-controlled reason
-     * through a path whose refusal text is written by the local operator.
-     *
-     * SETTLE ONCE. A second, contradicting answer is refused rather than applied: a peer that
-     * accepted must not be able to later claim it refused, or the proposer tears down a document the
-     * peer is still editing.
-     */
-    recordPeerDecision(ownerAgentId, documentId, 
-    /**
-     * WHO IS ANSWERING. Required, and checked against the proposal's own peer.
-     *
-     * The caller verifies the ack's signature against the agent the frame NAMES, which proves the
-     * frame is authentic and says nothing about whether that agent was ever entitled to answer. Any
-     * third party with a session to us could sign a well-formed ack for a document we proposed to
-     * someone else, and it landed as that someone's decision — reported to the operator as "they
-     * said no" for a peer who never saw it. Worse, settle-once is by VALUE, so the real peer's
-     * later genuine answer contradicts and is discarded: the poisoned state is permanent.
-     *
-     * Verified is not authorized. The old control path had
-     * carried this check from the start; the ack path was written without it.
-     */
-    ackerAgentId, decision) {
-        const record = this.get(ownerAgentId, documentId);
-        if (!record) {
-            return {
-                ok: false,
-                reason: "document_proposal_unknown",
-                detail: `no proposal ${documentId.slice(0, 16)}… authored by this agent`,
-            };
-        }
-        if (ackerAgentId !== record.peerAgentId) {
-            this.#logger.warn("document.proposal.ack_not_peer", {
-                documentId,
-                claimedBy: ackerAgentId,
-                peerAgentId: record.peerAgentId,
-            });
-            return {
-                ok: false,
-                reason: "document_proposal_ack_not_peer",
-                detail: `${ackerAgentId} is not the party this proposal was addressed to (${record.peerAgentId}), ` +
-                    `so their answer is not the decision it asks for`,
-            };
-        }
-        if (record.proposerAgentId !== ownerAgentId) {
-            // Their answer to their OWN proposal is not a thing. Recording it would overwrite this
-            // operator's consent decision with the counterparty's assertion about it.
-            return {
-                ok: false,
-                reason: "document_proposal_not_ours",
-                detail: `proposal ${documentId.slice(0, 16)}… was authored by the peer, not by this agent`,
-            };
-        }
-        const already = this.#peerDecision(ownerAgentId, documentId);
-        if (already !== null) {
-            if (already === decision.accepted)
-                return { ok: true };
-            return {
-                ok: false,
-                reason: "document_proposal_ack_contradicts",
-                detail: `the peer already answered this proposal with ${already ? "accepted" : "refused"} and now ` +
-                    `says ${decision.accepted ? "accepted" : "refused"} — a decision is made once, and both ` +
-                    `signatures are retained`,
-            };
-        }
-        this.#db
-            .prepare(`UPDATE document_proposals SET peer_accepted = ?, peer_reason = ?, peer_decided_at = ?
-          WHERE owner_agent_id = ? AND document_id = ?`)
-            .run(decision.accepted ? 1 : 0, decision.reason ?? null, decision.decidedAtMs, ownerAgentId, documentId);
-        this.#logger.info("document.proposal.answered", {
-            documentId,
-            accepted: decision.accepted,
-            reason: decision.reason,
-        });
-        return { ok: true };
-    }
-    /** The peer's answer to a proposal we authored: true accepted, false refused, null unanswered. */
-    peerDecision(ownerAgentId, documentId) {
-        return this.#peerDecision(ownerAgentId, documentId);
-    }
-    /**
-     * The peer's answer AND the words they sent with it.
-     *
-     * The reason was stored and never read by anything — write-only, which defeats the entire
-     * justification for putting it on the wire and making it mandatory there: "a refusal the proposer
-     * cannot see a reason for leaves them unable to propose anything better". Enforced at the
-     * signature, discarded at the last hop.
-     */
-    peerAnswer(ownerAgentId, documentId) {
-        const row = this.#db
-            .prepare("SELECT peer_accepted, peer_reason FROM document_proposals WHERE owner_agent_id = ? AND document_id = ?")
-            .get(ownerAgentId, documentId);
-        if (!row || row.peer_accepted === null)
-            return { accepted: null, reason: null };
-        return { accepted: row.peer_accepted === 1, reason: row.peer_reason ?? null };
-    }
-    #peerDecision(ownerAgentId, documentId) {
-        const row = this.#db
-            .prepare("SELECT peer_accepted FROM document_proposals WHERE owner_agent_id = ? AND document_id = ?")
-            .get(ownerAgentId, documentId);
-        return row?.peer_accepted === null || row?.peer_accepted === undefined ? null : row.peer_accepted === 1;
-    }
-    /** Proposals still awaiting a decision — the operator's inbox for documents. */
-    pending(ownerAgentId) {
-        return this.#rows(ownerAgentId, "WHERE owner_agent_id = ? AND consent_state = 'pending'", []);
-    }
-    get(ownerAgentId, documentId) {
-        const rows = this.#rows(ownerAgentId, "WHERE owner_agent_id = ? AND document_id = ?", [documentId]);
-        return rows[0] ?? null;
-    }
-    /**
-     * Accept a pending proposal. Compare-and-set: the transition happens iff the row was still
-     * pending, and the affected-row count is what says so.
-     */
-    accept(ownerAgentId, documentId, nowMs) {
-        const record = this.get(ownerAgentId, documentId);
-        if (!record) {
-            return {
-                ok: false,
-                reason: "document_proposal_unknown",
-                detail: `no proposal ${documentId.slice(0, 16)}… for this agent`,
-            };
-        }
-        // Re-checked at the transition, not merely at arrival — the proposer runs a different build.
-        const violation = seamViolation(record.envelope.properties);
-        if (violation) {
-            // TRANSITION, do not just refuse the call. Leaving the row pending gives the operator an
-            // inbox entry they can never clear, carrying no reason — while the arrival path records one
-            // for the identical condition. Two behaviours for one fact, and the one that persists is the
-            // one with no explanation attached.
-            if (record.consentState === "pending") {
-                this.#db
-                    .prepare(`UPDATE document_proposals SET consent_state = 'refused', refusal_reason = ?,
-                    decided_at = ?
-              WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
-                    .run(violation, nowMs, ownerAgentId, documentId);
-                this.#logger.warn("document.proposal.refused", {
-                    documentId,
-                    reason: violation,
-                    autoRefused: true,
-                    at: "accept",
-                });
-            }
-            return { ok: false, reason: "document_seam_violation", detail: violation };
-        }
-        const info = this.#db
-            .prepare(`UPDATE document_proposals SET consent_state = 'accepted', decided_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
-            .run(nowMs, ownerAgentId, documentId);
-        if (Number(info.changes) === 0) {
-            // The row exists but was not pending. Naming the state it IS in is the whole value of the
-            // message: "already accepted" and "you refused this" are different facts to an operator, and
-            // a generic failure would read as a bug in the handshake.
-            const now = this.get(ownerAgentId, documentId);
-            return {
-                ok: false,
-                reason: "document_proposal_not_pending",
-                detail: `proposal ${documentId.slice(0, 16)}… is ${now?.consentState ?? "gone"}` +
-                    (now?.refusalReason ? ` (${now.refusalReason})` : "") +
-                    " — a consent decision is made once",
-            };
-        }
-        this.#logger.info("document.proposal.accepted", { documentId });
-        return { ok: true, documentId, envelope: record.envelope };
-    }
-    /** Refuse a pending proposal. Same compare-and-set guard; a reason is mandatory. */
-    refuse(ownerAgentId, documentId, reason, nowMs) {
-        if (reason.trim().length === 0) {
-            // The column's CHECK enforces this too. Refused here so the caller gets a usable error
-            // rather than a constraint violation naming a column.
-            throw new Error("document_refusal_reason_required: a refusal must say why");
-        }
-        const info = this.#db
-            .prepare(`UPDATE document_proposals SET consent_state = 'refused', refusal_reason = ?, decided_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
-            .run(reason, nowMs, ownerAgentId, documentId);
-        if (Number(info.changes) === 0) {
-            const now = this.get(ownerAgentId, documentId);
-            // A PROPOSAL THAT DOES NOT EXIST IS NOT ONE THAT WAS ALREADY DECIDED. `accept` checks for the
-            // row first and answers `document_proposal_unknown`; this went straight to the UPDATE, found
-            // zero changes, and reported a typo'd id as "is unknown — a consent decision is made once".
-            // That asserts a decision was recorded, about a proposal nobody ever made, and sends the
-            // operator looking for who made it.
-            if (!now) {
-                return {
-                    ok: false,
-                    reason: "document_proposal_unknown",
-                    detail: `no proposal ${documentId.slice(0, 16)}… for this agent — check the id against ` +
-                        `cello_doc_inbox`,
-                };
-            }
-            return {
-                ok: false,
-                reason: "document_proposal_not_pending",
-                detail: `proposal ${documentId.slice(0, 16)}… is ${now.consentState} — a consent decision is made once`,
-            };
-        }
-        this.#logger.info("document.proposal.refused", { documentId, reason, autoRefused: false });
-        return { ok: true };
-    }
-    /** Record that OUR proposal for this document actually left the machine. */
-    markProposalSent(ownerAgentId, documentId, nowMs) {
-        this.#db
-            .prepare(`UPDATE document_proposals SET proposal_sent_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND proposal_sent_at IS NULL`)
-            .run(nowMs, ownerAgentId, documentId);
-    }
-    /** Has our proposal for this document left? False also covers "we never authored one". */
-    proposalSent(ownerAgentId, documentId) {
-        const row = this.#db
-            .prepare(`SELECT proposal_sent_at FROM document_proposals
-          WHERE owner_agent_id = ? AND document_id = ? AND proposal_sent_at IS NOT NULL LIMIT 1`)
-            .get(ownerAgentId, documentId);
-        return row !== undefined;
-    }
-    #rows(ownerAgentId, where, extra) {
-        const rows = this.#db
-            .prepare(`SELECT * FROM document_proposals ${where} ORDER BY created_at ASC, rowid ASC`)
-            .all(ownerAgentId, ...extra);
-        return rows.map((r) => ({
-            documentId: r["document_id"],
-            proposerAgentId: r["proposer_agent_id"],
-            peerAgentId: r["peer_agent_id"],
-            envelope: decodeDocumentProposal(new Uint8Array(r["envelope"])),
-            consentState: r["consent_state"],
-            refusalReason: r["refusal_reason"] ?? undefined,
-            peerAccepted: r["peer_accepted"] == null ? null : r["peer_accepted"] === 1,
-            peerReason: r["peer_reason"] ?? undefined,
-            createdAtMs: r["created_at"],
-            decidedAtMs: r["decided_at"] ?? undefined,
-        }));
-    }
-}
-//# sourceMappingURL=document-handshake.js.map

package/dist/document-handshake.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-handshake.js","sourceRoot":"","sources":["../src/document-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,GAGd,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAevD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;CAmB5B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAG;IAC5B,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iEAAiE,EAAE;IACnG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,4DAA4D,EAAE;IAC5F,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,mEAAmE,EAAE;IACvG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,iDAAiD;IACjD,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,oEAAoE,EAAE;CAC1G,CAAC;AAoBF,MAAM,OAAO,iBAAiB;IACnB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAChB,OAAO,CAA4B;IAE5C,YAAY,EAAkB,EAAE,MAAc,EAAE,MAAiC;QAC/E,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,qBAAqB,EAAE,CAAC;YACpD,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,YAAoB,EACpB,IAAgB,EAChB,KAAa;QAEb,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAEpD,6FAA6F;QAC7F,sFAAsF;QACtF,2FAA2F;QAC3F,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACxD,UAAU;gBACV,eAAe,EAAE,QAAQ,CAAC,iBAAiB;aAC5C,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,GAAG,QAAQ,CAAC,iBAAiB,uDAAuD,CACvF,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,IAAI,QAAQ,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAChD,UAAU;gBACV,WAAW,EAAE,QAAQ,CAAC,aAAa;gBACnC,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,+DAA+D,QAAQ,CAAC,aAAa,IAAI;gBACvF,UAAU,YAAY,oDAAoD,CAC7E,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,6FAA6F;QAC7F,qFAAqF;QACrF,MAAM,YAAY,GAAG,8BAA8B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,YAAY,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,EAC7C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC9B,MAAM,EACN,KAAK,EACL,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACtB,CAAC;QAEJ,+FAA+F;QAC/F,4FAA4F;QAC5F,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,aAAa,IAAI,MAAM,IAAI,SAAS,CAAC;QAElE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC7C,UAAU;gBACV,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,0FAA0F;YAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC9C,UAAU;gBACV,eAAe,EAAE,QAAQ,CAAC,iBAAiB;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,YAAoB,EAAE,eAA2B,EAAE,KAAa;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAC5B,KAAK,EACL,KAAK,CACN,CAAC;QACJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,YAAoB,EAAE,QAAkC,EAAE,KAAa;QACpF,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,EAC7C,KAAK,EACL,KAAK,CACN,CAAC;QACJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,kBAAkB,CAChB,YAAoB,EACpB,UAAkB;IAClB;;;;;;;;;;;;OAYG;IACH,YAAoB,EACpB,QAAqE;QAErE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBAClD,UAAU;gBACV,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EACJ,GAAG,YAAY,qDAAqD,MAAM,CAAC,WAAW,KAAK;oBAC3F,iDAAiD;aACpD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;YAC5C,uFAAuF;YACvF,0EAA0E;YAC1E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+CAA+C;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,KAAK,QAAQ,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mCAAmC;gBAC3C,MAAM,EACJ,gDAAgD,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,WAAW;oBAC3F,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,uCAAuC;oBACzF,yBAAyB;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;uDAC+C,CAChD;aACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC9C,UAAU;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,kGAAkG;IAClG,YAAY,CAAC,YAAoB,EAAE,UAAkB;QACnD,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CACR,YAAoB,EACpB,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN,wGAAwG,CACzG;aACA,GAAG,CAAC,YAAY,EAAE,UAAU,CAA6E,CAAC;QAC7G,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,aAAa,CAAC,YAAoB,EAAE,UAAkB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,2FAA2F,CAAC;aACpG,GAAG,CAAC,YAAY,EAAE,UAAU,CAAiD,CAAC;QACjF,OAAO,GAAG,EAAE,aAAa,KAAK,IAAI,IAAI,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC;IAC1G,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,YAAoB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,wDAAwD,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,UAAkB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,YAAY,EACZ,8CAA8C,EAC9C,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAoB,EAAE,UAAkB,EAAE,KAAa;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACjE,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,yFAAyF;YACzF,4FAA4F;YAC5F,6FAA6F;YAC7F,oCAAoC;YACpC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG;qBACL,OAAO,CACN;;yFAE6E,CAC9E;qBACA,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBAC7C,UAAU;oBACV,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,EAAE,EAAE,QAAQ;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;qFAC6E,CAC9E;aACA,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,0FAA0F;YAC1F,6FAA6F;YAC7F,0DAA0D;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EACJ,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,YAAY,IAAI,MAAM,EAAE;oBACxE,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,oCAAoC;aACvC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAED,oFAAoF;IACpF,MAAM,CACJ,YAAoB,EACpB,UAAkB,EAClB,MAAc,EACd,KAAa;QAEb,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,sDAAsD;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;qFAC6E,CAC9E;aACA,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/C,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,yFAAyF;YACzF,oCAAoC;YACpC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,2BAA2B;oBACnC,MAAM,EACJ,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C;wBAChF,iBAAiB;iBACpB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EAAE,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,YAAY,oCAAoC;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,gBAAgB,CAAC,YAAoB,EAAE,UAAkB,EAAE,KAAa;QACtE,IAAI,CAAC,GAAG;aACL,OAAO,CACN;oFAC4E,CAC7E;aACA,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,0FAA0F;IAC1F,YAAY,CAAC,YAAoB,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;gGACwF,CACzF;aACA,GAAG,CAAC,YAAY,EAAE,UAAU,CAA8C,CAAC;QAC9E,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAgB;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,oCAAoC,KAAK,qCAAqC,CAAC;aACvF,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,CAAmC,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,UAAU,EAAE,CAAC,CAAC,aAAa,CAAW;YACtC,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAW;YACjD,WAAW,EAAE,CAAC,CAAC,eAAe,CAAW;YACzC,QAAQ,EAAE,sBAAsB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAe,CAAC,CAAC;YAC7E,YAAY,EAAE,CAAC,CAAC,eAAe,CAAyB;YACxD,aAAa,EAAG,CAAC,CAAC,gBAAgB,CAAmB,IAAI,SAAS;YAClE,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;YAC1E,UAAU,EAAG,CAAC,CAAC,aAAa,CAAmB,IAAI,SAAS;YAC5D,WAAW,EAAE,CAAC,CAAC,YAAY,CAAW;YACtC,WAAW,EAAG,CAAC,CAAC,YAAY,CAAmB,IAAI,SAAS;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/document-inbound.d.ts

@@ -1,162 +0,0 @@
-/**
- * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
- *
- * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
- * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
- * assembling them, and assembling them is not clerical work — **the order is the security
- * property**. A check performed after admission is a check that did not protect anything.
- *
- * The order, and what each step is protecting:
- *
- *   1. DECODE          — refuse malformed input before any of it is interpreted.
- *   2. VERIFY the signature — FIRST, because everything after it is either a judgement about a
- *                          party or an ANSWER to one. It needs nothing but the envelope: the agent
- *                          id is the Ed25519 public key (M14-D5). It ran at step 4 until a live
- *                          defect forced it earlier — see `terminal` on InboundResult. An
- *                          unverified envelope is also not REJECTED: a rejection is a protocol act
- *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
- *                          naming an unauthenticated sender puts their claim in our permanent log.
- *   3. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
- *                          TERMINAL: we will never hold it, so the sender is told and stops.
- *   4. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
- *                          belong here at all, and is not a rejection case (there is no
- *                          collaboration to supersede). Refused SILENTLY — see `terminal`.
- *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
- *                          a redelivery that goes unacked never lets the sender settle it); a gap
- *                          or a fork refuses.
- *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
- *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
- *                          peer has decided, so the sender must stop retrying and supersede.
- */
-import * as Y from "yjs";
-import type { DocumentStore } from "./document-store.js";
-import type { DocumentEngine } from "./document-engine.js";
-import type { DocumentGate } from "./document-gate.js";
-import type { DocumentRejections } from "./document-rejection.js";
-import type { Logger } from "./types.js";
-export type InboundResult = {
-    ok: true;
-    admitted: true;
-    envelopeHash: string;
-    duplicate: boolean;
-} | {
-    ok: true;
-    admitted: false;
-    envelopeHash: string;
-    rejectionReason: string;
-    duplicate: false;
-    /** The signed `document_rejection` to put on the wire. Absent when this refusal is a repeat. */
-    rejectionWire?: Uint8Array;
-} | {
-    ok: false;
-    reason: string;
-    detail: string;
-    terminal?: undefined;
-}
-/**
- * A TERMINAL refusal — redelivering this envelope can never change the answer, and the sender was
- * AUTHENTICATED, so their delivery is settled with a rejection ack rather than left outstanding.
- * The plain refusal above means "stay silent and let them retry".
- *
- * Both conditions are load-bearing. Without terminal, a peer who refused the proposal is
- * redelivered to indefinitely (found live: 74 sends). Without authentication, the ack answers
- * whoever reached the channel rather than a known party.
- *
- * `terminal` AND `envelopeHash` are ONE variant, not two optional fields, because the router can
- * only act when it has both — and with them independent, setting `terminal` while forgetting the
- * hash produced no ack, no log line, and silently reinstated the defect this unit closed. A type
- * that can express the broken state eventually will.
- */
- | {
-    ok: false;
-    reason: string;
-    detail: string;
-    terminal: true;
-    envelopeHash: string;
-};
-export interface DocumentInboundDeps {
-    store: DocumentStore;
-    /**
-     * DOD-DOC-SCREEN-CONTENT-1 — screen the PROJECTED TEXT, at the shadow.
-     *
-     * The gate already applies the update to an inert shadow copy and computes the readable
-     * before/after text. Until this seam existed, the only rule reading that text was a character
-     * denylist, while the layer that judges MEANING sat at the wire — where a document frame is a
-     * signed binary envelope and the text screener was decoding it as UTF-8 and judging mojibake.
-     *
-     * Optional because it is Layer 2 and Layer 2 degrades by design (no model → no verdict → admit).
-     * It returns BLOCK or nothing: a `redact` verdict cannot be honoured on a CRDT replica, so a
-     * rewrite-worthy finding either refuses or is carried as evidence — there is no third outcome,
-     * which is the contract this whole path is built on.
-     */
-    screenProjected?: (text: string, ctx: {
-        ownerAgentId: string;
-        documentId: string;
-        senderAgentId: string;
-        correlationId?: string;
-    }) => Promise<{
-        block: boolean;
-        reason?: string;
-    }>;
-    engine: DocumentEngine;
-    gate: DocumentGate;
-    rejections: DocumentRejections;
-    logger: Logger;
-    /**
-     * Verify the envelope signature against `sender_agent_id`. INJECTED and REQUIRED — this module
-     * cannot resolve an agent id to a public key, and a default would be a default answer to "is this
-     * authentic", which is the one question that must never have one.
-     */
-    verifySignature(senderAgentId: string, tbs: Uint8Array, signature: Uint8Array): boolean;
-    /** The live document to apply admitted updates to. */
-    liveDocFor(ownerAgentId: string, documentId: string): Y.Doc;
-    /** SYNC-D8 — the ONE fold-derived standing (R17 + removed/unknown); the walk is deleted. */
-    standingOf(ownerAgentId: string, documentId: string, agentId: string): "participant" | "invited" | "removed" | "stranger" | "unknown";
-    /**
-     * DOD-MP-INBOUND-N-1 — the CURRENT derived holders, or null when the chain does not derive.
-     * When it derives, membership is the WHOLE sender gate — the genesis-peer column is a
-     * bilateral-legacy fallback, never a permanent credential (the same rule the ack gate
-     * learned in FANOUT-1's review).
-     */
-    currentHolders(ownerAgentId: string, documentId: string): string[] | null;
-    /**
-     * SYNC-G1 — the derived state AT the envelope's signed governance frontier (R20's input).
-     * `missing` names ancestors not yet held: the caller answers NON-terminally and the exchange
-     * delivers governance first.
-     */
-    deriveAtFrontier(ownerAgentId: string, documentId: string, frontier: readonly string[]): {
-        ok: true;
-        participants: ReadonlySet<string>;
-        invited: ReadonlySet<string>;
-        /** R30: content whose named world is already ENDED is refused everywhere. */
-        ended: "closed" | "killed" | null;
-    } | {
-        ok: false;
-        reason: string;
-        missing?: string[];
-    };
-    /**
-     * Sign as the OWNING agent, over the rejection's canonical preimage (DOD-DOC-REJECT-2).
-     *
-     * Takes the agent so it cannot sign with the wrong key. ASYNC, and that is what makes `receive`
-     * async: signing goes through a key provider, and REJECT-1 requires a real signature rather than
-     * a placeholder.
-     */
-    sign(ownerAgentId: string, tbs: Uint8Array): Promise<Uint8Array>;
-}
-export declare class DocumentInbound {
-    #private;
-    constructor(deps: DocumentInboundDeps);
-    /**
-     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
-     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
-     * log is indistinguishable from a real one that fails to verify — so the async is real, not
-     * incidental.
-     *
-     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
-     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
-     * stored before its successor is checked.
-     */
-    receive(ownerAgentId: string, wire: Uint8Array, nowMs: number, correlationId?: string): Promise<InboundResult>;
-}
-//# sourceMappingURL=document-inbound.d.ts.map

package/dist/document-inbound.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-inbound.d.ts","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAQzB,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACtE;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,KAAK,CAAC;IACjB,gGAAgG;IAChG,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B,GAID;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE;AACrE;;;;;;;;;;;;;GAaG;GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7F,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IACxF,sDAAsD;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IAC5D,4FAA4F;IAC5F,UAAU,CACR,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAClE;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAEzB;QACE,EAAE,EAAE,IAAI,CAAC;QACT,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,6EAA6E;QAC7E,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;KACnC,GACD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACtD;;;;;;OAMG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClE;AAOD,qBAAa,eAAe;;gBAGd,IAAI,EAAE,mBAAmB;IAkBrC;;;;;;;;;OASG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,SAAY,GACxB,OAAO,CAAC,aAAa,CAAC;CA8e1B"}