@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/document-reconcile-scheduler.js

@@ -1,303 +0,0 @@
-/**
- * SYNC-P5 (R39–R43) — WHEN reconciling is attempted. The exchange itself (P3) is stateless and
- * idempotent; this module only decides moments, and every piece of state it holds is VOLATILE
- * scheduling state in the R41 sense: it may delay an exchange, it must never forbid one, gate
- * admissibility, or survive a restart as authority. Losing all of it costs at most one sweep
- * interval of latency.
- *
- * The three triggers (R39):
- *  1. committing an entry / publishing — the layer nudges directly (P4's `nudgeSeats` and the
- *     entry fan-out); not this module's job.
- *  2. a party becoming reachable — `onReachable`, wired to session establishment. An explicit
- *     reachability signal RESETS backoff: the backoff modeled "they do not answer", and here
- *     they demonstrably just did.
- *  3. the periodic sweep — `sweep`, wired to a timer. Bounded per R43: batched per party (R16's
- *     cap is the exchange's own), and — DOD-DOC-PUSH-NOT-POLL-1 — it speaks only for a party we
- *     HOLD something for. A timer is not a reason to speak.
- *
- * R42: the in-flight mark is TIME-BOUNDED and released LOUDLY on expiry. An unbounded in-flight
- * mark is the stall this milestone already paid for twice.
- *
- * DOD-DOC-PUSH-NOT-POLL-1 (Andre, 2026-08-18) — WHAT THE TIMER MAY NO LONGER DO, and what it cost.
- * The suppressor used to be a BELIEF with an expiry: a party was skipped only while every shared
- * document read in_sync AND had been exchanged within ten minutes. Past the window it asked again
- * whether or not anything had changed. Measured live: three agents, thirty documents, the freshest
- * exchange days old, and one stale timestamp kept a whole party — fourteen documents — sweeping
- * every 120 seconds forever. Each of those frames takes a position in the CONVERSATION's hash
- * chain, so a quiet document spends a real conversation's sequence numbers: 34 positions on one
- * live session, 2 of them actual messages, and the seal refused `session_incomplete`.
- *
- * The rule now: WE SPEAK WHEN WE HOLD SOMETHING THE PARTY HAS NOT CONFIRMED RECEIVING, and an
- * unchanged holding is offered once, not on every tick. Nothing pending, no frame, no position.
- *
- * THE GATE IS ON THE DECISION, NOT ON THE FRAME'S CONTENTS (review F2). Once one document has
- * justified speaking to a party, the frame carries every document shared with them: a block is
- * POSITIONS ONLY, and the responder replies solely for a document where one side is actually
- * ahead — so a quiet document rides along for bytes, never for a frame or a position. Narrowing
- * the list would have dropped the pull for those documents and saved nothing.
- *
- * THE TRADE, STATED RATHER THAN HIDDEN: `pendingFor` can only see what we hold that they lack —
- * never what they hold that we lack — so removing the expiry removes the timer-driven PULL. The
- * pull moves onto the two triggers that are events rather than clocks: their publish nudges us
- * (R39 trigger 1), and a session with them coming up sweeps everything (`onReachable`, which
- * deliberately does NOT inherit the pending gate).
- *
- * THE THIRD TRADE, WHICH IS A REMOVAL CASE (review F4). A removed holder is in neither the
- * participants nor the invited set of the remover's derived state, so the REMOVER never sweeps to
- * them — there is no push and no nudge in that direction. Their primary notice is the parked frame
- * the relay holds; when that is gone, the backstop was their own belief expiring and asking, which
- * earned the terminal `document_reconcile_removed` answer. That backstop now waits for them to
- * hold something pending — their next write, or their next session. This WIDENS a gap the M14B
- * board already names (DOD-SYNC-P6, "R32's terminal-refusal delivery is not exercised by the
- * enforcers"); it does not open a new one, and nothing here forbids the exchange.
- */
-import { extractErrorMessage } from "./error-message.js";
-/** How long one attempt may hold the in-flight mark before the sweep stops honoring it. */
-export const RECONCILE_INFLIGHT_BOUND_MS = 60_000;
-/** First back-off step for a party that did not answer; doubles per consecutive failure. */
-export const RECONCILE_BACKOFF_BASE_MS = 30_000;
-export const RECONCILE_BACKOFF_CAP_MS = 15 * 60_000;
-/** R16's per-frame batching ceiling, honored by chunking a party's documents. */
-export const RECONCILE_BATCH_CAP = 32;
-export class ReconcileScheduler {
-    #d;
-    /** Volatile by design (R41): keyed per (owner, party); dies with the process. */
-    #state = new Map();
-    /** DOD-M12B-SHUTDOWN-1: set by stop(); every entry point refuses once it is true. */
-    #stopped = false;
-    constructor(deps) {
-        this.#d = deps;
-    }
-    /**
-     * DOD-M12B-SHUTDOWN-1 — refuse all further work. Idempotent, and one-way on purpose.
-     *
-     * Clearing the sweep timer stops the NEXT tick and nothing else: the pass already running walks
-     * every agent, and each step dials a peer and opens a session. Measured 2026-08-17 — `cello
-     * logout` reported the daemon down, the socket was already gone, and the process ran on for 30+
-     * seconds still logging `document.reconcile.sweep`, dialling on its way out. It took a signal to
-     * exit. A shutdown that keeps starting new outbound work is not draining.
-     *
-     * Guarded at the top of the two entry points that START work — `sweep` and `onReachable` — so
-     * `sweepTargets`, a database read, is not run either, AND inside the sweep's own party loop so a
-     * pass already running stops at the next party rather than finishing its round. `noteRefusal`
-     * deliberately still runs: it records an outcome and starts nothing.
-     *
-     * Never un-set: a reachability trigger firing from a session tearing down during shutdown must
-     * not be able to restart the sweeper on the way out.
-     */
-    stop() {
-        if (this.#stopped)
-            return;
-        this.#stopped = true;
-        this.#d.logger.info("document.reconcile.stopped", {
-            reason: "shutdown",
-            impact: "no further reconcile attempts will be started",
-        });
-    }
-    #key(ownerAgentId, peerAgentId) {
-        return `${ownerAgentId}\u0000${peerAgentId}`;
-    }
-    #stateFor(key) {
-        let s = this.#state.get(key);
-        if (!s) {
-            s = {
-                nextAttemptMs: 0,
-                failures: 0,
-                inFlightUntilMs: null,
-                lastPendingSignature: null,
-                repeats: 0,
-                quietUntilMs: 0,
-            };
-            this.#state.set(key, s);
-        }
-        return s;
-    }
-    /**
-     * What we hold for this party that they have not confirmed, across the documents we share:
-     * `null` when there is nothing anywhere. One computation for both triggers, so an offer made by
-     * one is recognised as already-made by the other.
-     */
-    #holdingFor(ownerAgentId, peerAgentId, docs) {
-        const parts = [];
-        for (const documentId of docs) {
-            const pending = this.#d.pendingFor(ownerAgentId, documentId, peerAgentId);
-            if (pending !== null)
-                parts.push(`${documentId}=${pending}`);
-        }
-        return parts.length === 0 ? null : parts.join("\n");
-    }
-    /**
-     * R39's second trigger: this party is demonstrably reachable RIGHT NOW — a session with them
-     * just came up. Backoff is reset (it modeled silence; they answered) and the attempt fires
-     * for every shared document, in R16-capped batches.
-     *
-     * DELIBERATELY EXEMPT FROM THE PENDING GATE (DOD-DOC-PUSH-NOT-POLL-1). The gate can only see
-     * what we hold that they lack; the exchange is the only thing that sees the other direction.
-     * Take the gate off the timer and this becomes where the PULL lives, so gating it here too
-     * would leave nothing that ever asks.
-     *
-     * It DOES record what it just offered (review F3). Nulling that instead cost one guaranteed
-     * duplicate frame per session establishment — the sweep tick minutes later would find no
-     * record of the offer, treat an unchanged holding as new, and spend another position in the
-     * conversation's hash chain. That is the exact currency this unit defends.
-     */
-    async onReachable(ownerAgentId, peerAgentId) {
-        if (this.#stopped)
-            return;
-        const docs = this.#d.sweepTargets(ownerAgentId).get(peerAgentId);
-        if (!docs || docs.length === 0)
-            return;
-        const s = this.#stateFor(this.#key(ownerAgentId, peerAgentId));
-        // They answered: silence is no longer the model, so both ladders start over.
-        s.failures = 0;
-        s.repeats = 0;
-        s.nextAttemptMs = 0;
-        s.quietUntilMs = 0;
-        await this.#attempt(ownerAgentId, peerAgentId, docs, s, this.#holdingFor(ownerAgentId, peerAgentId, docs));
-    }
-    /**
-     * A PEER ANSWERED "NO". That is an answer, and it must slow the asking down.
-     *
-     * `#attempt` can only see whether the FRAME WAS SENT — the refusal arrives later, on its own
-     * inbound frame, and until now it was logged and dropped. So a peer refusing every exchange was
-     * indistinguishable from a peer answering fine: `failures` reset to 0, `nextAttemptMs` to now,
-     * and the sweep asked again immediately. Measured 321 attempts against two documents in 85
-     * minutes, refused every time, zero successes.
-     *
-     * R41 IS PRESERVED: this DELAYS an exchange, it never forbids one. A terminal refusal jumps
-     * straight to the cap rather than retiring the party, because "terminal" is one holder's current
-     * derivation — a later entry can make the same exchange admissible again, and scheduling state
-     * must never be the thing that forbids it. `onReachable` still clears it outright.
-     */
-    noteRefusal(ownerAgentId, peerAgentId, terminal) {
-        const s = this.#stateFor(this.#key(ownerAgentId, peerAgentId));
-        const now = this.#d.now();
-        const base = this.#d.backoffBaseMs ?? RECONCILE_BACKOFF_BASE_MS;
-        if (terminal) {
-            s.nextAttemptMs = now + RECONCILE_BACKOFF_CAP_MS;
-        }
-        else {
-            s.failures += 1;
-            s.nextAttemptMs = now + Math.min(base * 2 ** (s.failures - 1), RECONCILE_BACKOFF_CAP_MS);
-        }
-        this.#d.logger.info("document.reconcile.refusal_backoff", {
-            peerAgentId, terminal, failures: s.failures, nextAttemptInMs: s.nextAttemptMs - now,
-        });
-    }
-    /** R39's third trigger — one bounded pass for one owner. */
-    async sweep(ownerAgentId) {
-        const result = {
-            attempted: 0, skippedBackoff: 0, skippedInFlight: 0,
-            skippedQuiet: 0, skippedNothingPending: 0, failed: 0,
-        };
-        // DOD-M12B-SHUTDOWN-1: the in-flight pass stops HERE, not at the next timer tick.
-        if (this.#stopped)
-            return result;
-        const now = this.#d.now();
-        for (const [peerAgentId, docs] of this.#d.sweepTargets(ownerAgentId)) {
-            // DOD-M12B-SHUTDOWN-1: INSIDE the loop, not only at the entry. A guard on entry alone stops
-            // the NEXT agent while the one being swept goes on dialling every remaining party — which on
-            // a single-agent daemon, the measured case, buys nothing at all. Each of those dials can
-            // create a session node AFTER gracefulShutdown has already flipped active rows to interrupted
-            // and snapshotted the node list, leaving a row nothing will clear and a node nobody stops.
-            if (this.#stopped)
-                break;
-            if (docs.length === 0)
-                continue;
-            const s = this.#stateFor(this.#key(ownerAgentId, peerAgentId));
-            if (s.inFlightUntilMs !== null) {
-                if (now < s.inFlightUntilMs) {
-                    result.skippedInFlight += 1;
-                    continue;
-                }
-                // RELEASED LOUDLY (R42): an attempt held its mark past the bound. The mark is dropped
-                // so the sweep proceeds — an unbounded in-flight mark is the stall this milestone
-                // already paid for twice.
-                this.#d.logger.warn("document.reconcile.inflight_expired", {
-                    peerAgentId, heldMs: now - (s.inFlightUntilMs - RECONCILE_INFLIGHT_BOUND_MS),
-                });
-                s.inFlightUntilMs = null;
-            }
-            if (now < s.nextAttemptMs) {
-                result.skippedBackoff += 1;
-                continue;
-            }
-            // DOD-DOC-PUSH-NOT-POLL-1 — the only reason to speak: we hold something they have not
-            // confirmed receiving. No holding, no frame and no sequence position, however long ago
-            // this party last exchanged.
-            const signature = this.#holdingFor(ownerAgentId, peerAgentId, docs);
-            if (signature === null) {
-                result.skippedNothingPending += 1;
-                continue;
-            }
-            // Offered already, and nothing has changed since. A real change steps over this — it is a
-            // trigger (R39), not noise — but the refusal/failure backoff checked ABOVE is never stepped
-            // over, which is what keeps DOD-SYNC-REFUSAL-BACKOFF-1 intact. The order of these two
-            // blocks is the guarantee; a test pins it.
-            if (signature === s.lastPendingSignature && now < s.quietUntilMs) {
-                result.skippedQuiet += 1;
-                continue;
-            }
-            result.attempted += 1;
-            // EVERY shared document rides the frame, not just the ones that justified it (review F2):
-            // a block carries positions only, and the responder answers solely where a side is ahead,
-            // so the quiet documents cost bytes rather than a frame — and keep their pull.
-            const ok = await this.#attempt(ownerAgentId, peerAgentId, docs, s, signature);
-            if (!ok)
-                result.failed += 1;
-        }
-        return result;
-    }
-    async #attempt(ownerAgentId, peerAgentId, docs, s, signature) {
-        // Read BEFORE the send: whether this round is a re-offer decides the cadence below.
-        const repeat = signature !== null && signature === s.lastPendingSignature;
-        const started = this.#d.now();
-        s.inFlightUntilMs = started + RECONCILE_INFLIGHT_BOUND_MS;
-        let allOk = true;
-        try {
-            for (let i = 0; i < docs.length; i += RECONCILE_BATCH_CAP) {
-                // DOD-M12B-SHUTDOWN-1: between batches too — one party can carry many documents, and each
-                // batch is another dial.
-                if (this.#stopped)
-                    break;
-                const batch = docs.slice(i, i + RECONCILE_BATCH_CAP);
-                const sent = await this.#d.initiateReconcile(ownerAgentId, peerAgentId, batch);
-                if (!sent.ok) {
-                    allOk = false;
-                    this.#d.logger.warn("document.reconcile.sweep_attempt_failed", {
-                        peerAgentId, documents: batch.length, reason: sent.reason ?? "send_failed",
-                    });
-                    break; // one dead transport answers for the whole party this round
-                }
-            }
-        }
-        catch (err) {
-            allOk = false;
-            this.#d.logger.warn("document.reconcile.sweep_attempt_failed", {
-                peerAgentId, reason: extractErrorMessage(err),
-            });
-        }
-        finally {
-            s.inFlightUntilMs = null;
-        }
-        const now = this.#d.now();
-        const base = this.#d.backoffBaseMs ?? RECONCILE_BACKOFF_BASE_MS;
-        if (allOk) {
-            s.failures = 0;
-            s.nextAttemptMs = now;
-            // THE SEND SUCCEEDING MEANS THE FRAME WENT OUT, NEVER THAT THE PARTY ACTED ON IT. An
-            // invitation nobody accepts stays pending forever, so without this the sweep re-offered the
-            // identical holding on every tick — one frame each, each one spending a position in the
-            // conversation's hash chain. Every re-offer doubles the silence, up to the same cap.
-            s.repeats = repeat ? s.repeats + 1 : 1;
-            s.lastPendingSignature = signature;
-            s.quietUntilMs = now + Math.min(base * 2 ** (s.repeats - 1), RECONCILE_BACKOFF_CAP_MS);
-        }
-        else {
-            s.failures += 1;
-            s.nextAttemptMs = now + Math.min(base * 2 ** (s.failures - 1), RECONCILE_BACKOFF_CAP_MS);
-        }
-        return allOk;
-    }
-}
-//# sourceMappingURL=document-reconcile-scheduler.js.map

package/dist/document-reconcile-scheduler.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-reconcile-scheduler.js","sourceRoot":"","sources":["../src/document-reconcile-scheduler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAiEtC,MAAM,OAAO,kBAAkB;IACpB,EAAE,CAAyB;IACpC,iFAAiF;IACxE,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,qFAAqF;IACrF,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,IAA4B;QACtC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAChD,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,+CAA+C;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,YAAoB,EAAE,WAAmB;QAC5C,OAAO,GAAG,YAAY,SAAS,WAAW,EAAE,CAAC;IAC/C,CAAC;IAED,SAAS,CAAC,GAAW;QACnB,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG;gBACF,aAAa,EAAE,CAAC;gBAChB,QAAQ,EAAE,CAAC;gBACX,eAAe,EAAE,IAAI;gBACrB,oBAAoB,EAAE,IAAI;gBAC1B,OAAO,EAAE,CAAC;gBACV,YAAY,EAAE,CAAC;aAChB,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH,WAAW,CACT,YAAoB,EACpB,WAAmB,EACnB,IAAuB;QAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAC1E,IAAI,OAAO,KAAK,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,YAAoB,EAAE,WAAmB;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/D,6EAA6E;QAC7E,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,QAAQ,CACjB,YAAY,EACZ,WAAW,EACX,IAAI,EACJ,CAAC,EACD,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,CAClD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,YAAoB,EAAE,WAAmB,EAAE,QAAiB;QACtE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,IAAI,yBAAyB,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,CAAC,CAAC,aAAa,GAAG,GAAG,GAAG,wBAAwB,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;YACxD,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,aAAa,GAAG,GAAG;SACpF,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,KAAK,CAAC,KAAK,CAAC,YAAoB;QAC9B,MAAM,MAAM,GAAgB;YAC1B,SAAS,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC;YACnD,YAAY,EAAE,CAAC,EAAE,qBAAqB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC;QACF,kFAAkF;QAClF,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;YACrE,4FAA4F;YAC5F,6FAA6F;YAC7F,yFAAyF;YACzF,8FAA8F;YAC9F,2FAA2F;YAC3F,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC/B,IAAI,GAAG,GAAG,CAAC,CAAC,eAAe,EAAE,CAAC;oBAC5B,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,sFAAsF;gBACtF,kFAAkF;gBAClF,0BAA0B;gBAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;oBACzD,WAAW,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,GAAG,2BAA2B,CAAC;iBAC7E,CAAC,CAAC;gBACH,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;gBAC1B,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,sFAAsF;YACtF,uFAAuF;YACvF,6BAA6B;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACpE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC;gBAClC,SAAS;YACX,CAAC;YACD,0FAA0F;YAC1F,4FAA4F;YAC5F,sFAAsF;YACtF,2CAA2C;YAC3C,IAAI,SAAS,KAAK,CAAC,CAAC,oBAAoB,IAAI,GAAG,GAAG,CAAC,CAAC,YAAY,EAAE,CAAC;gBACjE,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACtB,0FAA0F;YAC1F,0FAA0F;YAC1F,+EAA+E;YAC/E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC9E,IAAI,CAAC,EAAE;gBAAE,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,YAAoB,EACpB,WAAmB,EACnB,IAAuB,EACvB,CAAa,EACb,SAAwB;QAExB,oFAAoF;QACpF,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,CAAC,CAAC,oBAAoB,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC,CAAC,eAAe,GAAG,OAAO,GAAG,2BAA2B,CAAC;QAC1D,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,mBAAmB,EAAE,CAAC;gBAC1D,0FAA0F;gBAC1F,yBAAyB;gBACzB,IAAI,IAAI,CAAC,QAAQ;oBAAE,MAAM;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC;gBACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC/E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,KAAK,GAAG,KAAK,CAAC;oBACd,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;wBAC7D,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa;qBAC3E,CAAC,CAAC;oBACH,MAAM,CAAC,4DAA4D;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,KAAK,GAAG,KAAK,CAAC;YACd,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;gBAC7D,WAAW,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,IAAI,yBAAyB,CAAC;QAChE,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;YACtB,qFAAqF;YACrF,4FAA4F;YAC5F,wFAAwF;YACxF,qFAAqF;YACrF,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC,CAAC,oBAAoB,GAAG,SAAS,CAAC;YACnC,CAAC,CAAC,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/document-rejection.d.ts

@@ -1,251 +0,0 @@
-/**
- * DOD-DOC-REJECT-1 — rejection and supersession (§3.2, §16.7-2).
- *
- * ── WHY SUPERSESSION, AND NOT "BOTH SIDES ROLL BACK" ──────────────────────────────────────────
- *
- * The naive protocol is: the receiver discards, the sender undoes locally, and both return to the
- * pre-update state. It does not work, and the reason is a property of CRDTs rather than a bug.
- *
- * **Yjs undo adds INVERSES; it does not erase.** The rejected operations stay in the sender's
- * document. So every later update the sender computes against the receiver's state vector
- * re-transmits them, and the receiver — which refuses to hold them — can never integrate the
- * legitimate work stacked causally on top, because Yjs will not apply operations whose
- * predecessors are missing. A permanent causal gap, from a protocol that looked symmetric.
- *
- * The protocol that works (§3.2):
- *   1. The receiver rejects with a REASON — a protocol message and its own `0x05` leaf, never a
- *      silent drop. The update goes to quarantine, held rather than discarded.
- *   2. The sender rolls back locally, which emits inverses into its own log and leaves an
- *      auditable "wrote X, was rejected, undid X" trail.
- *   3. The sender publishes a SUPERSEDING update against the receiver's state vector, which
- *      necessarily carries the rejected operations PLUS their inverses plus any new work.
- *   4. The receiver validates the now-clean projected diff — the rejected content nets to zero —
- *      admits it, and clears the quarantine. Causality intact, both parties converge, and the
- *      rejected content survives only as inert tombstones.
- *
- * ── SCOPE ─────────────────────────────────────────────────────────────────────────────────────
- *
- * This proves the protocol against STORE-1's local envelope log. The CBOR wire encoding is
- * DOD-DOC-ENVELOPE-1's job and the cross-daemon proof is DOD-DOC-E2E-REJECT-1's.
- */
-import * as Y from "yjs";
-import type { DocumentStore } from "./document-store.js";
-import type { Logger } from "./types.js";
-/**
- * The document stalls on the THIRD rejected round: the original refusal, one superseding attempt,
- * and no more (§16.7-2 "one retry, then freeze").
- *
- * Counted in rounds rather than retries because the previous spelling — a `REJECTION_RETRY_LIMIT`
- * of 1 compared as `round > LIMIT + 1` — permitted two retries under a name that said one, which
- * is the kind of thing the next edit gets wrong.
- *
- * Bounded at all because an unbounded retry loop between two daemons that disagree is not
- * convergence, it is a hot loop neither operator can see. Stalling is the visible failure.
- */
-export declare const MAX_REJECTED_ROUNDS = 3;
-export interface RejectionInput {
-    /** The envelope being rejected — the `0x05` leaf references this hash (§9). */
-    rejectedEnvelopeHash: string;
-    /** The bytes, held rather than discarded (§3.2). Supplied by the gate's quarantine verdict. */
-    quarantined: Uint8Array;
-    /**
-     * The refused envelope's OWN chain link — `null` only when the refused envelope was genuinely
-     * that sender's first. REQUIRED rather than optional: the refused envelope is deliberately never
-     * written to the log, so this is the only thing keeping the peer's next link resolvable, and an
-     * omitted value would default every refused envelope to a genesis stub — manufacturing exactly
-     * the fork the bridge exists to prevent. The caller decoded the envelope; it knows.
-     */
-    rejectedDocPrevHash: string | null;
-    reason: string;
-    detail?: string;
-    senderAgentId: string;
-    /** Which pluggable rule refused, when one did (from the gate's verdict). */
-    rule?: string;
-    /** The limit breached, when one was (from the gate's verdict). */
-    limit?: {
-        name: string;
-        limit: number;
-        actual: number;
-    };
-    /**
-     * Sign the rejection's canonical preimage (DOD-DOC-REJECT-2).
-     *
-     * The caller supplies the SIGNER, not the signature: a signature with no defined preimage is a
-     * field that can only be filled dishonestly, which is exactly what this used to be. An all-zero
-     * placeholder written into an immutable log is indistinguishable from a real signature that
-     * fails to verify, so a later verifier would send an operator to the crypto layer for a value
-     * nobody ever signed.
-     */
-    sign(tbs: Uint8Array): Promise<Uint8Array>;
-    /**
-     * The clock, passed in rather than read here. The rejection's timestamp is SIGNED, so it must be
-     * the same value in the preimage and in the row — reading `Date.now()` twice would sign one
-     * moment and store another.
-     */
-    nowMs: number;
-}
-export interface RejectionOutcome {
-    /** The document has exhausted its retries and stopped accepting updates. */
-    stalled: boolean;
-    /** How many rejections this document has seen, including this one. */
-    round: number;
-    /**
-     * The signed rejection, encoded, for the caller to put on the wire — or absent when this was a
-     * duplicate and nothing new was authored.
-     *
-     * RETURNED, because it was not, and the consequence was that the entire retry protocol was
-     * unreachable. The envelope was built here, signed here, leafed here, and then discarded: nothing
-     * in production ever called `encodeDocumentRejection`. So the refusing side kept a perfect local
-     * record of a decision it never communicated, and the sender — whose round counter is advanced by
-     * RECEIVING this frame — never advanced past round zero. A peer whose every update is refused
-     * republished forever, and its own surface said `active` the whole time. Measured live.
-     */
-    wire?: Uint8Array;
-}
-export interface QuarantineEntry {
-    rejectedEnvelopeHash: string;
-    quarantined: Uint8Array;
-    reason: string;
-    detail?: string;
-    /** Which rule refused, and the number it refused on. Surfaced, not just stored. */
-    rule?: string;
-    limitName?: string;
-    limitValue?: number;
-    limitActual?: number;
-    /** SYNC-R35: the exact signed refusal frame, when this row was written after the column shipped. */
-    rejectionWire?: Uint8Array;
-}
-/** A handle over the sender's local edits, so a rejection can be rolled back as inverses. */
-export interface TrackedEdits {
-    readonly doc: Y.Doc;
-    readonly undoManager: Y.UndoManager;
-    /**
-     * Release the tracker. Required, not optional hygiene: the depth guard in `rollback` admits
-     * exactly one stacked edit, so the only workable pattern is a FRESH tracker per publish — which
-     * means one live UndoManager per publish on a long-lived Y.Doc, each holding `afterTransaction`
-     * observers and accumulating undo items that retain deleted structs. Call it once the rejection
-     * is resolved, either way.
-     */
-    dispose(): void;
-    /** Stack depth when tracking began, so `rollback` can prove it is undoing the right item. */
-    readonly depthAtTracking: number;
-}
-/**
- * The placeholder `state_vector` a rejection row carries.
- *
- * ONE ZERO BYTE, not an empty array. See the call site for why: SQLCipher binds a zero-length blob
- * as NULL and the column is NOT NULL, so an empty vector throws on the driver production uses and
- * on no driver the tests use. The value is meaningless by design — a rejection has no state vector —
- * and it is named rather than inlined so nobody "tidies" it back to `new Uint8Array(0)`.
- */
-export declare const REJECTION_STATE_VECTOR: Uint8Array<ArrayBuffer>;
-export declare class DocumentRejections {
-    #private;
-    constructor(store: DocumentStore, logger: Logger);
-    /**
-     * Record a rejection: a `0x05` row referencing the rejected envelope, the quarantined bytes
-     * held, and a policy record carrying the reason.
-     *
-     * The envelope log is append-only, so this is a NEW ROW — nothing is edited or removed.
-     *
-     * ── HOW A REFUSAL IS ACTUALLY REALIZED, AND WHY NOT THE WAY §9 SAYS ─────────────────────────
-     *
-     * §9 phrases effectiveness as a replay-time set property: "an update leaf is effective iff no
-     * rejection leaf references it". Implemented literally that is unsound, and it was measured
-     * rather than argued. Sender publishes a base, then a refused update, then rolls back and
-     * supersedes. Replaying the log while SKIPPING the refused leaf gives:
-     *
-     *     text "agreed base. "   pendingStructs PRESENT   pendingDs PRESENT
-     *
-     * The supersession is causally stacked on the refused operations — the rollback is a DELETION of
-     * those structs and the new work is positioned after them — so dropping them leaves everything
-     * later permanently pending. The document reads as complete and is silently missing the
-     * legitimate work. §16.7-5 already retired §9's "document-log order" phrasing; this retires its
-     * effectiveness phrasing on the same grounds.
-     *
-     * What is sound: the receiver NEVER WRITES the refused payload to its log. There is nothing to
-     * subtract at replay because it was never added, and the peer's supersession — computed against
-     * the RECEIVER's state vector per §3.2 step 3 — is self-contained. Measured on the same fixture:
-     *
-     *     text "agreed base. clean text. "   pendingStructs null   pendingDs null   converged true
-     *
-     * The refused bytes do travel again inside that supersession, carrying their own inverses, which
-     * is precisely "inverses, not erasure" (§3.2) — the content nets to zero and survives only as
-     * tombstones. The bytes we refused live in `document_quarantine`, and the chain bridges across
-     * the refused envelope so the peer's next link still resolves (see `verifyChainLinkage`).
-     */
-    reject(agentId: string, documentId: string, input: RejectionInput): Promise<RejectionOutcome>;
-    /**
-     * Record a rejection ARRIVING from the peer — the receiving half of §3.2's "both sides".
-     *
-     * ── THE ROUTING DECISION (the DoD requires it resolved in-unit) ─────────────────────────────
-     *
-     * A document rejection is written **daemon-side**, into this document's own log and quarantine,
-     * NOT through the gateway record store's `source` discriminator.
-     *
-     * The gateway's record store exists for SCREENING verdicts, and most V1 rejection reasons are
-     * not screening at all — `append_only`, the receiver-local limits, malformed updates, unresolved
-     * dependencies. Routing every document rejection through a screening store would file structural
-     * protocol events as policy verdicts, and it would couple this unit to a schema owned by a
-     * component that is not involved. DOD-DOC-SCREEN-1 is parked, so that coupling would also have
-     * to be built speculatively and unwound if screening lands differently.
-     *
-     * When SCREEN-1 does land, a rejection whose reason came from the screening rule can ADDITIONALLY
-     * write a gateway record — the discriminator exists for exactly that, and adding it later costs
-     * nothing, whereas removing a premature coupling costs a migration.
-     */
-    recordIncomingRejection(agentId: string, documentId: string, input: {
-        /** The peer's 0x05 leaf hash — the row's identity, so a redelivery does not advance a round. */
-        rejectionEnvelopeHash: string;
-        rejectedEnvelopeHash: string;
-        reason: string;
-        detail?: string;
-        fromAgentId: string;
-    }): {
-        stalled: boolean;
-        round: number;
-    };
-    /** Entries held for this document — never admitted, never discarded (§3.2). From the store. */
-    quarantined(agentId: string, documentId: string): QuarantineEntry[];
-    /** Clear one entry once its superseding update has been admitted (§3.2 step 4). */
-    clearQuarantine(agentId: string, documentId: string, rejectedEnvelopeHash: string): void;
-    /**
-     * Whether this document still accepts updates.
-     *
-     * A stalled document REFUSES, naming the reason it stalled — both operators need to see why,
-     * because a document that silently stops converging is the failure this exists to prevent.
-     */
-    acceptsUpdates(agentId: string, documentId: string): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-        detail: string;
-    };
-    /**
-     * Start tracking local edits so a rejection can be rolled back.
-     *
-     * Yjs's own UndoManager, deliberately: rolling back by hand would mean computing inverses, and
-     * the inverse of a CRDT operation is not something to hand-roll — the whole reason supersession
-     * works is that Yjs's undo produces operations that compose correctly with everything stacked
-     * on top of them.
-     */
-    trackLocalEdits(doc: Y.Doc): TrackedEdits;
-    /**
-     * Roll back the last tracked edit, as INVERSES.
-     *
-     * The sender's history grows rather than shrinking. That is not a limitation to work around: it
-     * is what leaves an auditable "wrote X, was rejected, undid X" trail, and what lets the
-     * superseding update carry the rejected operations plus their inverses so causality survives.
-     *
-     * **PRECONDITION: roll back before making further local edits.** Yjs's UndoManager undoes the
-     * most recent stack item, and it cannot undo one out of order — so a sender that keeps editing
-     * after a rejection arrives and then rolls back would undo the WRONG transaction. §3.2's
-     * ordering is steps 2 then 3 for exactly this reason: roll back, THEN do new work, THEN
-     * publish the supersession that carries all three. A caller that needs to interleave has a
-     * genuine design question, not a call-order detail, and it belongs in the unit that wires
-     * publish to the receive path.
-     */
-    rollback(tracked: TrackedEdits): void;
-}
-//# sourceMappingURL=document-rejection.d.ts.map

package/dist/document-rejection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-rejection.d.ts","sourceRoot":"","sources":["../src/document-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAQzB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;;OAMG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD;;;;;;;;OAQG;IACH,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oGAAoG;IACpG,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;IACpC;;;;;;OAMG;IACH,OAAO,IAAI,IAAI,CAAC;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,yBAAsB,CAAC;AAE1D,qBAAa,kBAAkB;;gBAIjB,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM;IAKhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAkKnG;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CACrB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,gGAAgG;QAChG,qBAAqB,EAAE,MAAM,CAAC;QAC9B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GACA;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAoDtC,+FAA+F;IAC/F,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE;IAcnE,mFAAmF;IACnF,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,IAAI;IAQxF;;;;;OAKG;IACH,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAkB/D;;;;;;;OAOG;IACH,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,YAAY;IAuBzC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;CAkCtC"}