@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/document-inbound.js

@@ -1,530 +0,0 @@
-/**
- * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
- *
- * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
- * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
- * assembling them, and assembling them is not clerical work — **the order is the security
- * property**. A check performed after admission is a check that did not protect anything.
- *
- * The order, and what each step is protecting:
- *
- *   1. DECODE          — refuse malformed input before any of it is interpreted.
- *   2. VERIFY the signature — FIRST, because everything after it is either a judgement about a
- *                          party or an ANSWER to one. It needs nothing but the envelope: the agent
- *                          id is the Ed25519 public key (M14-D5). It ran at step 4 until a live
- *                          defect forced it earlier — see `terminal` on InboundResult. An
- *                          unverified envelope is also not REJECTED: a rejection is a protocol act
- *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
- *                          naming an unauthenticated sender puts their claim in our permanent log.
- *   3. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
- *                          TERMINAL: we will never hold it, so the sender is told and stops.
- *   4. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
- *                          belong here at all, and is not a rejection case (there is no
- *                          collaboration to supersede). Refused SILENTLY — see `terminal`.
- *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
- *                          a redelivery that goes unacked never lets the sender settle it); a gap
- *                          or a fork refuses.
- *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
- *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
- *                          peer has decided, so the sender must stop retrying and supersede.
- */
-import { decodeDocumentUpdateEnvelope, documentEnvelopeHash, buildDocumentUpdateTbs, verifyDocumentChainLink, } from "@cello-protocol/protocol-types";
-import { SEMANTIC_RULE_ID } from "./document-screen.js";
-import { extractErrorMessage } from "./error-message.js";
-/** The agreed property, read from the row rather than from whoever called us. */
-function appendOnly(doc) {
-    return doc.properties.append_only === true;
-}
-export class DocumentInbound {
-    #d;
-    constructor(deps) {
-        this.#d = deps;
-    }
-    /**
-     * The clientIDs this sender has SIGNED for on this document: the one this envelope declares,
-     * plus every one previously admitted from them. Both are authenticated — each arrived inside a
-     * verified TBS — so the set can only grow through signatures the peer actually made.
-     */
-    #boundClientIds(ownerAgentId, env) {
-        return [
-            ...new Set([
-                env.sender_client_id,
-                ...this.#d.store.senderClientIdsFor(ownerAgentId, env.document_id, env.sender_agent_id),
-            ]),
-        ];
-    }
-    /**
-     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
-     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
-     * log is indistinguishable from a real one that fails to verify — so the async is real, not
-     * incidental.
-     *
-     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
-     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
-     * stored before its successor is checked.
-     */
-    async receive(ownerAgentId, wire, nowMs, correlationId = "inbound") {
-        // 1. DECODE.
-        let env;
-        try {
-            env = decodeDocumentUpdateEnvelope(wire);
-        }
-        catch (err) {
-            const detail = extractErrorMessage(err);
-            this.#d.logger.warn("document.inbound.malformed", { detail, correlationId });
-            // ONE reason code, with the upstream message in the detail. Two kinds of failure arrive here:
-            // our own decoder's named refusals ("document_envelope_missing_field: …"), and CBOR/lib0
-            // errors from bytes that are not a CBOR map at all ("Data read, but end of buffer not
-            // reached"). Splitting the message on ":" turned the second kind into a reason code made of
-            // English prose, which nothing can match on and which reads as a crash rather than a refusal.
-            return { ok: false, reason: "document_inbound_malformed", detail };
-        }
-        const envelopeHash = documentEnvelopeHash(env);
-        // 2. VERIFY the signature — BEFORE the document is even looked up.
-        //
-        // It used to run at step 4, after the lookup and the peer check, and the header's reasoning for
-        // that was sound as far as it went: verify before the GATE, so pluggable rules never process
-        // bytes from a party we have not authenticated. Verifying EARLIER satisfies that strictly more.
-        //
-        // What forced the move is `terminal` below. A terminal refusal is answered with a SIGNED ack
-        // addressed to `sender_agent_id`, and producing one for a sender we have not authenticated
-        // would answer whoever reached the channel rather than a known peer. Authentication has to
-        // precede the first refusal we are willing to answer, and `document_unknown` is now one.
-        //
-        // It needs nothing from the document: the agent id IS the Ed25519 public key (M14-D5), so this
-        // is self-contained on the envelope. The cost is an Ed25519 verify (~50µs) on envelopes for
-        // documents we do not hold — paid to avoid a delivery that never settles.
-        if (!this.#d.verifySignature(env.sender_agent_id, buildDocumentUpdateTbs(env), env.signature)) {
-            this.#d.logger.error("document.inbound.signature_invalid", {
-                documentId: env.document_id,
-                senderAgentId: env.sender_agent_id,
-                envelopeHash,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "document_signature_invalid",
-                detail: `the envelope claims to come from ${env.sender_agent_id} but its signature does not ` +
-                    `verify against that agent — nothing was recorded`,
-            };
-        }
-        // 3. KNOW the document.
-        const doc = this.#d.store.getDocument(ownerAgentId, env.document_id);
-        if (!doc) {
-            // TERMINAL. We hold no such document and never will — this is what the far side of a REFUSED
-            // proposal looks like, and it was leaving the sender redelivering forever: the router only
-            // acks `ok: true` results, so an `ok: false` refusal settled nothing and the delivery worker
-            // re-sent on every tick. Observed live on `662743b1…`, stuck at `pendingSent: 1`.
-            //
-            // Safe to answer because step 2 authenticated the sender, and it discloses nothing they do
-            // not already have: they authored an envelope for this document_id, and the answer is "no".
-            return {
-                ok: false,
-                reason: "document_unknown",
-                terminal: true,
-                envelopeHash,
-                detail: `no document ${env.document_id.slice(0, 16)}… for this agent`,
-            };
-        }
-        // 4. THE SENDER GATE (DOD-MP-INBOUND-N-1), BEFORE any lifecycle answer — the order is the
-        // disclosure boundary: every later branch may answer with a SIGNED ACK, and an ack to a
-        // non-party confirms the document exists and what state it is in. When the chain DERIVES,
-        // derived membership is
-        // the whole gate — a joined third holder's envelope is as admissible as the genesis peer's,
-        // and a removed genesis peer's is not admissible at all. Only when the chain cannot answer
-        // (bilateral legacy, no genesis record) does the row's peer column stand in.
-        // SYNC-G1 (R20): admissibility is ruled AT THE ENVELOPE'S SIGNED FRONTIER — the governance
-        // world its author actually held — never at our current state, which refuses a removed
-        // author's legitimate earlier work and breaks convergence for every holder who was behind
-        // at removal time (the AC14 case; the old epoch-equality gate broke it three documented
-        // times). An honest removed daemon names a frontier containing its own removal and refuses
-        // HERE, by name (AC13); a backdating daemon admits exactly what an honest holder at that
-        // position could have authored — the same bounded concession the governance fold accepted,
-        // and the fold's removal dominance keeps such a daemon out of governance regardless.
-        const senderHolders = this.#d.currentHolders(ownerAgentId, env.document_id);
-        let senderIsParty;
-        if (senderHolders === null) {
-            // Bilateral legacy — no derivable chain; the row's peer column is the membership. A
-            // genesis-less document can hold no validated entries, so `standingOf` answers `unknown`
-            // here and the removed branch below is unreachable in practice — kept so the two paths
-            // cannot drift about what "removed" means (SYNC-D8: one derivation).
-            if (this.#d.standingOf(ownerAgentId, env.document_id, env.sender_agent_id) === "removed") {
-                this.#d.logger.warn("document.inbound.sender_removed", {
-                    documentId: env.document_id,
-                    senderAgentId: env.sender_agent_id,
-                    correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: "document_sender_removed",
-                    terminal: true,
-                    envelopeHash,
-                    detail: "this holder was removed from the document — the removal is forward-only (your " +
-                        "copy is yours), but new edits are no longer accepted",
-                };
-            }
-            senderIsParty = env.sender_agent_id === doc.peerAgentId;
-        }
-        else {
-            const at = this.#d.deriveAtFrontier(ownerAgentId, env.document_id, env.governance_parents);
-            if (!at.ok) {
-                // Ancestors not held: the governance is IN FLIGHT — non-terminal, the exchange
-                // delivers governance before content and this envelope admits on redelivery.
-                this.#d.logger.warn("document.inbound.governance_in_flight", {
-                    documentId: env.document_id,
-                    senderAgentId: env.sender_agent_id,
-                    missing: at.missing ?? [],
-                    correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: "document_governance_in_flight",
-                    envelopeHash,
-                    detail: `this update names governance ancestors this holder does not yet hold — ` +
-                        `reconcile delivers governance first; retry after it lands`,
-                };
-            }
-            // R30 / AC16: an ending among the envelope's own named ancestors means its author KNEW
-            // the document was over when they wrote — refused everywhere, terminally, including from
-            // a modified daemon: the parents are inside the signature.
-            if (at.ended !== null) {
-                this.#d.logger.warn("document.inbound.authored_after_ending", {
-                    documentId: env.document_id,
-                    senderAgentId: env.sender_agent_id,
-                    ended: at.ended,
-                    correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: "document_authored_after_ending",
-                    terminal: true,
-                    envelopeHash,
-                    detail: `this update names a governance world in which the document was already ` +
-                        `${at.ended} - content authored after an ending is refused everywhere (R30)`,
-                };
-            }
-            senderIsParty = at.participants.has(env.sender_agent_id);
-        }
-        if (!senderIsParty) {
-            // A REMOVED former holder is upgraded from the silent stranger-refusal to the TERMINAL
-            // named one (REMOVE-1 review F4): they hold the removal fact already — no new disclosure —
-            // and the silent path left their delivery worker redelivering forever, which is the exact
-            // silent drop the DoD line forbids. A true stranger still gets silence.
-            if (this.#d.standingOf(ownerAgentId, env.document_id, env.sender_agent_id) === "removed") {
-                this.#d.logger.warn("document.inbound.sender_removed", {
-                    documentId: env.document_id,
-                    senderAgentId: env.sender_agent_id,
-                    correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: "document_sender_removed",
-                    terminal: true,
-                    envelopeHash,
-                    detail: "this holder was removed from the document — the removal is forward-only (your " +
-                        "copy is yours), but new edits are no longer accepted",
-                };
-            }
-            // The wire stays silent (the disclosure decision stands); the LOG names the refusal, so
-            // the operator debugging "the new collaborator's edits aren't landing" has a line to find.
-            // An admission still in flight resolves by the sender's ordinary retry after it lands.
-            this.#d.logger.warn("document.inbound.not_peer", {
-                documentId: env.document_id,
-                senderAgentId: env.sender_agent_id,
-                peerAgentId: doc.peerAgentId,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "document_sender_not_peer",
-                // The peer's identity is NOT in the reply, and there is NO ack — silence is the answer. A
-                // third party is authenticated as themselves but is not a party to this document, so
-                // nothing about it is theirs to learn.
-                //
-                // A residual one-bit oracle remains and is accepted deliberately: a prober who already
-                // holds a valid document_id learns "exists" from the ABSENCE of an ack, since an unknown
-                // document answers and a known one does not. Closing that would mean acking non-parties,
-                // which discloses strictly more. It is bounded by document_id being a 32-byte hash
-                // (`documentIdFromProposal`), unguessable and never published.
-                detail: "you are not a party to this document",
-            };
-        }
-        // 4a. A DAEMON THAT KNOWS ITSELF REMOVED STOPS APPLYING (DOD-MP-REMOVE-1's other half):
-        // "new edits stop flowing either way" is a lie if the removed party's own daemon keeps
-        // admitting what still arrives from holders whose worker has not yet gated. TERMINAL — the
-        // sender's delivery settles instead of retrying at a door that will never open.
-        if (this.#d.standingOf(ownerAgentId, env.document_id, ownerAgentId) === "removed") {
-            this.#d.logger.warn("document.inbound.recipient_removed", {
-                documentId: env.document_id,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "document_recipient_removed",
-                terminal: true,
-                envelopeHash,
-                detail: "this daemon was removed from the document's arrangement — the local copy remains, " +
-                    "but new edits are no longer applied",
-            };
-        }
-        // 4b (SYNC-G1): the epoch-equality ruling and the current-state removed-sender check are
-        // GONE — both are the causal sender gate's job now, ruled at the envelope's signed
-        // frontier before anything else ran. (D7: the epoch stamp itself dies with this phase.)
-        // 5. The document must still ACCEPT — but for a document whose chain DERIVES, the ending
-        // ruling already happened at step 4 (R30: an ending in the envelope's own named ancestors
-        // refuses terminally; a frontier free of endings MUST be admitted, AC16 — the last edits
-        // before an agreed close are precisely the content the exchange still owes every holder,
-        // and the status column is a display projection that can lag the fold; review F1). Only a
-        // LEGACY document — no derivable chain, so no frontier to rule at — is judged by its stored
-        // status here, because for the pre-pivot bilateral record the column IS its ending.
-        if (senderHolders === null && (doc.status === "killed" || doc.status === "closed")) {
-            // TERMINAL, and for the same reason `document_stalled` below is NOT: these are DECISIONS.
-            // Nothing the sender does makes a killed or closed legacy document accept this envelope.
-            return {
-                ok: false,
-                reason: doc.status === "killed" ? "document_killed" : "document_closed",
-                terminal: true,
-                envelopeHash,
-                detail: doc.status === "killed"
-                    ? "this document was ended locally and no longer accepts updates"
-                    : "this document was closed by agreement and no longer accepts updates",
-            };
-        }
-        const accepts = this.#d.rejections.acceptsUpdates(ownerAgentId, env.document_id);
-        if (!accepts.ok) {
-            // The stall reason, composed by the unit that owns the stall. Reporting this envelope's own
-            // gate verdict instead would send an operator to the append-only rule for a document that has
-            // been frozen for days.
-            return { ok: false, reason: accepts.reason, detail: accepts.detail };
-        }
-        // 5. CHAIN. A redelivery is expected traffic and must still be answered.
-        // Hash-only. Reading the whole log meant materializing every payload BLOB on every inbound
-        // update, just to build a set for one membership test.
-        const known = this.#d.store.knownEnvelopeHashesBySender(ownerAgentId, env.document_id, env.sender_agent_id);
-        const head = this.#d.store.lastEnvelopeHashBySender(ownerAgentId, env.document_id, env.sender_agent_id);
-        let duplicate;
-        try {
-            duplicate = verifyDocumentChainLink(env, { head, known }).duplicate;
-        }
-        catch (err) {
-            const detail = extractErrorMessage(err);
-            this.#d.logger.warn("document.inbound.chain_refused", {
-                documentId: env.document_id,
-                correlationId,
-                detail,
-                // THE COMPARISON ITSELF, not just its verdict.
-                //
-                // The stall path was chased through three fixes on the strength of "the chain was refused",
-                // and each fix was reasoned about rather than measured. What was never printed is the only
-                // thing that decides it: the link the sender claimed, the head we were holding, and whether
-                // we had seen it before. A refusal that names its verdict and hides its inputs is why that
-                // took three rounds — the same shape as reading a log tail for an event that is emitted
-                // earlier, twice today.
-                claimedPrev: env.doc_prev_hash,
-                ourHead: head,
-                prevIsKnown: env.doc_prev_hash !== null && known.has(env.doc_prev_hash),
-                knownCount: known.size,
-            });
-            // MATCHED against the known set, not split on ":". This file explains sixty lines earlier why
-            // splitting an upstream message produces reason codes made of English prose — and the old
-            // `?? "document_chain_broken"` fallback mislabelled a FORK as a gap, which is precisely the
-            // distinction the envelope module went out of its way to create.
-            const reason = ["document_chain_forked", "document_chain_broken"].find((r) => detail.startsWith(r));
-            // A FORK IS TERMINAL; A GAP IS NOT. The distinction the envelope module went out of its way
-            // to create decides this too. A gap means the predecessor has not arrived YET, so redelivery
-            // is exactly the recovery path and the sender must keep trying. A fork means the sender
-            // chained onto something that is not our head and never was — our log is append-only, so
-            // there is no repair, and no number of redeliveries changes the answer.
-            //
-            // Left non-terminal, a fork walked to the unacked ceiling and surfaced as "Their client may
-            // not support shared documents yet" — an error naming the wrong subsystem entirely, for a
-            // condition the receiver had diagnosed precisely.
-            if (reason === "document_chain_forked") {
-                return { ok: false, reason, detail, terminal: true, envelopeHash };
-            }
-            return { ok: false, reason: reason ?? "document_chain_refused", detail };
-        }
-        if (duplicate) {
-            // ACK, and change nothing. Not acking would leave the sender retrying an envelope we already
-            // hold, forever; applying it again is unnecessary (Yjs is idempotent) and appending it again
-            // is refused by the store anyway.
-            this.#d.logger.info("document.inbound.duplicate", {
-                documentId: env.document_id,
-                senderAgentId: env.sender_agent_id,
-                envelopeHash,
-                correlationId,
-            });
-            return { ok: true, admitted: true, envelopeHash, duplicate: true };
-        }
-        // 5b. ALREADY REJECTED? A rejected envelope's hash is deliberately never written to the log, so
-        // it is not in `known` and a redelivery is NOT a duplicate. Without this it re-ran the gate,
-        // was rejected again, and `reject()` minted a fresh nonce — advancing the retry round. Since
-        // MAX_REJECTED_ROUNDS is 3, a peer whose ACKS ARE BEING LOST — which is delivery's ordinary
-        // retry behaviour — permanently stalled the shared document in three attempts, with no
-        // hostility required. Hostile, it was a one-line denial of service.
-        //
-        // Re-answered with the RECORDED reason: the peer needs the same answer it was given before, so
-        // it supersedes rather than retries.
-        const alreadyRejected = this.#d.store
-            .listQuarantined(ownerAgentId, env.document_id)
-            .find((q) => q.rejectedEnvelopeHash === envelopeHash);
-        if (alreadyRejected) {
-            this.#d.logger.info("document.inbound.already_rejected", {
-                documentId: env.document_id,
-                envelopeHash,
-                correlationId,
-            });
-            return {
-                ok: true,
-                admitted: false,
-                envelopeHash,
-                rejectionReason: alreadyRejected.reason,
-                duplicate: false,
-            };
-        }
-        // 6. GATE — against the LIVE doc, which the gate itself trials on a copy.
-        const live = this.#d.liveDocFor(ownerAgentId, env.document_id);
-        const verdict = this.#d.gate.validate(live, env.update, {
-            documentId: env.document_id,
-            senderAgentId: env.sender_agent_id,
-            // DERIVED from authenticated data, not from a seam nobody produces. ENVELOPE-1 puts
-            // `sender_client_id` inside the signed TBS precisely because "this envelope is where it is
-            // learned" — and the assembler was decoding it, verifying the signature over it, and then
-            // throwing it away, leaving rule (h) wired to a function with no implementation. Left as a
-            // seam it would default to wrong in whichever direction its implementer guessed: `[]`
-            // refuses every peer update, the union of everything observed admits anything.
-            //
-            // §14 forbids persisting a clientID for REUSE; recording which ones a peer has SIGNED for
-            // is the opposite — it is the binding the gate's rule exists to check.
-            senderClientIds: this.#boundClientIds(ownerAgentId, env),
-            declaredDocumentId: env.document_id,
-            declaredEncoding: env.update_encoding,
-            // THE PERSISTED PROPERTY, not a caller option defaulting to off. append_only is agreed at
-            // the handshake and stored on the row, and the gate's own header says it "is the only thing
-            // standing between a bound peer and erasure" — rule (h) provably cannot see a deletion.
-            // Taking it from an option meant a document configured append-only was unprotected unless
-            // every future call site remembered to pass the flag.
-            appendOnly: appendOnly(doc),
-            // The AGREED profile, from the same persisted row and for the same reason.
-            ...(typeof doc.properties.content_profile === "string"
-                ? { contentProfile: doc.properties.content_profile }
-                : {}),
-        }, nowMs);
-        if (!verdict.admit) {
-            // 7a. REJECT. The bytes are held, a 0x05 leaf references them, and the peer is ANSWERED —
-            // a rejection is an ack for delivery purposes, so the sender stops retrying and supersedes.
-            const rejection = await this.#d.rejections.reject(ownerAgentId, env.document_id, {
-                rejectedEnvelopeHash: envelopeHash,
-                quarantined: verdict.quarantined,
-                reason: verdict.reason,
-                detail: verdict.detail,
-                senderAgentId: env.sender_agent_id,
-                rejectedDocPrevHash: env.doc_prev_hash,
-                rule: verdict.rule,
-                limit: verdict.limit,
-                // The OWNER signs its own rejection, over the canonical preimage (DOD-DOC-REJECT-2).
-                sign: (tbs) => this.#d.sign(ownerAgentId, tbs),
-                nowMs,
-            });
-            return {
-                ok: true,
-                admitted: false,
-                envelopeHash,
-                // The signed refusal, for the caller to transmit. Absent on a duplicate — we already told
-                // them once, and re-sending would advance their round counter for a retry that never
-                // happened, driving the document to `stalled` early.
-                ...(rejection.wire ? { rejectionWire: rejection.wire } : {}),
-                rejectionReason: verdict.reason,
-                duplicate: false,
-            };
-        }
-        // 7a-bis. THE SEMANTIC SCREEN, on the text the update WOULD produce.
-        //
-        // Placed here and nowhere else for two reasons. The shadow is inert — nothing in it can reach
-        // the operator or their agent until the admit below — so this is the last moment the content is
-        // both READABLE and harmless. And the gate's `validate` is synchronous while the gateway is a
-        // separate program, so the call cannot live inside a rule.
-        //
-        // Only the INSERTED text is screened. A deletion carries no new content, and re-screening the
-        // whole document would refuse a peer's edit for prose that was already admitted days ago.
-        const semantic = this.#d.screenProjected && verdict.projectedDiff.inserted.length > 0
-            ? await this.#d.screenProjected(verdict.projectedDiff.inserted, {
-                ownerAgentId,
-                documentId: env.document_id,
-                senderAgentId: env.sender_agent_id,
-                ...(correlationId !== undefined ? { correlationId } : {}),
-            })
-            : null;
-        if (semantic?.block === true) {
-            // REFUSED, NOT REWRITTEN, and the bytes are HELD — the same treatment every other refusal
-            // gets, so the peer's chain stays bridgeable and they are told once, by name.
-            const rejection = await this.#d.rejections.reject(ownerAgentId, env.document_id, {
-                rejectedEnvelopeHash: envelopeHash,
-                // COPIED, and copied BEFORE the awaits above. The caller's buffer may be a pooled network
-                // read; `reject()` copies too, but by then a gateway round trip and a signing call have
-                // both happened, and DOD-DOC-REJECT-1 would hash bytes that are no longer the ones refused
-                // — into a 0x05 leaf, silently. The gate's own quarantine copies for this reason.
-                quarantined: new Uint8Array(env.update),
-                reason: "document_content_injection",
-                // WHICH screen refused. Dropping it leaves an operator unable to see what ruled, which is
-                // exactly what document-rejection.ts's header says a refusal must never do.
-                rule: SEMANTIC_RULE_ID,
-                ...(semantic.reason !== undefined ? { detail: semantic.reason } : {}),
-                senderAgentId: env.sender_agent_id,
-                rejectedDocPrevHash: env.doc_prev_hash,
-                sign: (tbs) => this.#d.sign(ownerAgentId, tbs),
-                nowMs,
-            });
-            this.#d.logger.warn("document.inbound.injection_refused", {
-                documentId: env.document_id,
-                senderAgentId: env.sender_agent_id,
-                envelopeHash,
-                reason: semantic.reason,
-                correlationId,
-            });
-            return {
-                ok: true,
-                admitted: false,
-                envelopeHash,
-                ...(rejection.wire ? { rejectionWire: rejection.wire } : {}),
-                rejectionReason: "document_content_injection",
-                duplicate: false,
-            };
-        }
-        // 7b. ADMIT. The log first, then the live document: an update applied but not logged is one
-        // the operator can read and cannot rebuild, and a rebuild is how the document survives a
-        // restart. The other order loses content; this order at worst repeats an idempotent apply.
-        this.#d.store.appendEnvelope(ownerAgentId, {
-            envelopeHash,
-            documentId: env.document_id,
-            senderAgentId: env.sender_agent_id,
-            docPrevHash: env.doc_prev_hash,
-            governanceParents: [...env.governance_parents],
-            signature: env.signature,
-            stateVector: env.state_vector,
-            payload: env.update,
-            kind: "update",
-            referencesEnvelopeHash: null,
-            // Recorded so the authorship binding for this peer is derived from what they SIGNED, not
-            // from a seam somebody has to remember to implement.
-            senderClientId: env.sender_client_id,
-            createdAtMs: nowMs,
-        });
-        this.#d.engine.applyUpdateOrThrow(live, env.update);
-        // §3.2 step 4: admit AND CLEAR THE QUARANTINE. This is the supersession closing — the held
-        // bytes are released, the chain bridge stub for the superseded envelope goes with them, and
-        // `document.supersession.admitted` finally has a producer. Without it the entries stayed held
-        // forever and the event was a name with nothing behind it.
-        if (env.doc_prev_hash !== null) {
-            this.#d.rejections.clearQuarantine(ownerAgentId, env.document_id, env.doc_prev_hash);
-        }
-        this.#d.logger.info("document.inbound.admitted", {
-            documentId: env.document_id,
-            senderAgentId: env.sender_agent_id,
-            envelopeHash,
-            correlationId,
-        });
-        return { ok: true, admitted: true, envelopeHash, duplicate: false };
-    }
-}
-//# sourceMappingURL=document-inbound.js.map

package/dist/document-inbound.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-inbound.js","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAyGzD,iFAAiF;AACjF,SAAS,UAAU,CAAC,GAAuC;IACzD,OAAO,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,EAAE,CAAsB;IAEjC,YAAY,IAAyB;QACnC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAoB,EAAE,GAA2B;QAC/D,OAAO;YACL,GAAG,IAAI,GAAG,CAAS;gBACjB,GAAG,CAAC,gBAAgB;gBACpB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC;aACxF,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,IAAgB,EAChB,KAAa,EACb,aAAa,GAAG,SAAS;QAEzB,aAAa;QACb,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7E,8FAA8F;YAC9F,yFAAyF;YACzF,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE/C,mEAAmE;QACnE,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,EAAE;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,EAAE;QACF,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EACJ,oCAAoC,GAAG,CAAC,eAAe,8BAA8B;oBACrF,kDAAkD;aACrD,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,6FAA6F;YAC7F,2FAA2F;YAC3F,6FAA6F;YAC7F,kFAAkF;YAClF,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACtE,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,0FAA0F;QAC1F,wBAAwB;QACxB,4FAA4F;QAC5F,2FAA2F;QAC3F,6EAA6E;QAC7E,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,wFAAwF;QACxF,2FAA2F;QAC3F,yFAAyF;QACzF,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,aAAsB,CAAC;QAC3B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,oFAAoF;YACpF,yFAAyF;YACzF,uFAAuF;YACvF,qEAAqE;YACrE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBACrD,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,gFAAgF;wBAChF,sDAAsD;iBACzD,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,gBAAgB,CACjC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,kBAAkB,CACtD,CAAC;YACF,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACX,+EAA+E;gBAC/E,6EAA6E;gBAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;oBAC3D,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE;oBACzB,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,+BAA+B;oBACvC,YAAY;oBACZ,MAAM,EACJ,yEAAyE;wBACzE,2DAA2D;iBAC9D,CAAC;YACJ,CAAC;YACD,uFAAuF;YACvF,yFAAyF;YACzF,2DAA2D;YAC3D,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBAC5D,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gCAAgC;oBACxC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,yEAAyE;wBACzE,GAAG,EAAE,CAAC,KAAK,iEAAiE;iBAC/E,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,uFAAuF;YACvF,2FAA2F;YAC3F,0FAA0F;YAC1F,wEAAwE;YACxE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBACrD,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,gFAAgF;wBAChF,sDAAsD;iBACzD,CAAC;YACJ,CAAC;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B;gBAClC,0FAA0F;gBAC1F,qFAAqF;gBACrF,uCAAuC;gBACvC,EAAE;gBACF,uFAAuF;gBACvF,yFAAyF;gBACzF,yFAAyF;gBACzF,mFAAmF;gBACnF,+DAA+D;gBAC/D,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,gFAAgF;QAChF,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YAClF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACxD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EACJ,oFAAoF;oBACpF,qCAAqC;aACxC,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,0FAA0F;QAC1F,4FAA4F;QAC5F,oFAAoF;QACpF,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnF,0FAA0F;YAC1F,yFAAyF;YACzF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;gBACvE,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,QAAQ;oBACrB,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,qEAAqE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,4FAA4F;YAC5F,8FAA8F;YAC9F,wBAAwB;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,yEAAyE;QACzE,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CACrD,YAAY,EACZ,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,eAAe,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACxG,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,uBAAuB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACpD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa;gBACb,MAAM;gBACN,+CAA+C;gBAC/C,EAAE;gBACF,4FAA4F;gBAC5F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,wFAAwF;gBACxF,wBAAwB;gBACxB,WAAW,EAAE,GAAG,CAAC,aAAa;gBAC9B,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;gBACvE,UAAU,EAAE,KAAK,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,8FAA8F;YAC9F,0FAA0F;YAC1F,4FAA4F;YAC5F,iEAAiE;YACjE,MAAM,MAAM,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3E,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAC;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,yFAAyF;YACzF,wEAAwE;YACxE,EAAE;YACF,4FAA4F;YAC5F,0FAA0F;YAC1F,kDAAkD;YAClD,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,6FAA6F;YAC7F,6FAA6F;YAC7F,kCAAkC;YAClC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAChD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,uFAAuF;QACvF,oEAAoE;QACpE,EAAE;QACF,+FAA+F;QAC/F,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK;aAClC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC;aAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,YAAY,CAAC,CAAC;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACvD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,eAAe,EAAE,eAAe,CAAC,MAAM;gBACvC,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CACnC,IAAI,EACJ,GAAG,CAAC,MAAM,EACV;YACE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,oFAAoF;YACpF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,sFAAsF;YACtF,+EAA+E;YAC/E,EAAE;YACF,0FAA0F;YAC1F,uEAAuE;YACvE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC;YACxD,kBAAkB,EAAE,GAAG,CAAC,WAAW;YACnC,gBAAgB,EAAE,GAAG,CAAC,eAAe;YACrC,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,0FAA0F;YAC1F,sDAAsD;YACtD,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC;YAC3B,2EAA2E;YAC3E,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,CAAC,eAAe,KAAK,QAAQ;gBACpD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,EACD,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,0FAA0F;YAC1F,4FAA4F;YAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC/E,oBAAoB,EAAE,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,mBAAmB,EAAE,GAAG,CAAC,aAAa;gBACtC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,qFAAqF;gBACrF,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;gBAC9C,KAAK;aACN,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,0FAA0F;gBAC1F,qFAAqF;gBACrF,qDAAqD;gBACrD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,8FAA8F;QAC9F,2DAA2D;QAC3D,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnF,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC5D,YAAY;gBACZ,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7B,0FAA0F;YAC1F,8EAA8E;YAC9E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC/E,oBAAoB,EAAE,YAAY;gBAClC,0FAA0F;gBAC1F,wFAAwF;gBACxF,2FAA2F;gBAC3F,kFAAkF;gBAClF,WAAW,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,4BAA4B;gBACpC,0FAA0F;gBAC1F,4EAA4E;gBAC5E,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,mBAAmB,EAAE,GAAG,CAAC,aAAa;gBACtC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;gBAC9C,KAAK;aACN,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACxD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,eAAe,EAAE,4BAA4B;gBAC7C,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YACzC,YAAY;YACZ,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,iBAAiB,EAAE,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,IAAI,EAAE,QAAQ;YACd,sBAAsB,EAAE,IAAI;YAC5B,yFAAyF;YACzF,qDAAqD;YACrD,cAAc,EAAE,GAAG,CAAC,gBAAgB;YACpC,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpD,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;CACF"}