@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/document-screen.js

@@ -1,223 +0,0 @@
-/**
- * DOD-DOC-SCREEN-1 — the document content gate: REFUSE, never mutate.
- *
- * ── WHY A DOCUMENT DOES NOT GET THE MESSAGE SANITIZER ─────────────────────────────────────────
- *
- * The inbound message path may REWRITE content on a `redact` verdict: the operator sees a sanitized
- * form while the leaf still binds the original. That is right for conversation and catastrophic for
- * a document. Measured on 2026-08-05 against eighteen realistic samples, six were silently altered:
- *
- *   कर्‍म → कर्म          a different Hindi word; the ZWJ is orthography in Devanagari
- *   👨‍👩‍👧 → 👨👩👧      one family emoji becomes three separate people
- *   Ｈｅｌｌｏ → Hello      full-width is how CJK users type
- *   file is ½ → file is 1⁄2   ligatures and fractions normalised away
- *   <|im_start|> → ␠      a document ABOUT prompt formats loses its subject
- *
- * For a CRDT replica that is not a false positive. It is permanent divergence: the receiver applies
- * different bytes than the sender signed, both sides believe they converged, and nothing reports
- * it. And screening the PROJECTION instead does not help — documents are read-WRITE, so the next
- * write-back diffs the operator's screened file against their replica and publishes the redaction
- * as a real, signed edit that deletes the peer's content.
- *
- * So this rule has exactly two outcomes: carry the text exactly, or refuse the envelope. There is
- * no third return value, and that is deliberate — a rule that COULD return replacement text would
- * eventually be used to.
- *
- * ── WHAT IT REFUSES, AND WHY THAT LIST IS SHORT ───────────────────────────────────────────────
- *
- * Only characters whose presence changes what the text MEANS to a reader or a model, independent of
- * language:
- *
- *   - BIDI overrides and isolates, which make what an operator reads differ from what the document
- *     says. In a shared document that is a signature on content the signer did not see.
- *   - Chat-template control markers, which are not content in any document — they are an attempt to
- *     address the reader's model rather than the reader.
- *
- * NOT on the list: zero-width joiners, full-width forms, ligatures, typographic punctuation,
- * combining marks. Every one of those is legitimate text in some language, and refusing them would
- * make CELLO unusable for the operators most likely to need it. Zero-width SPACE is refused —
- * it joins nothing, and its only use in a document is to hide a boundary.
- *
- * This is the denylist half. `DOD-DOC-PROFILE-1` adds the allowlist: a codepoint set agreed at the
- * handshake and bound into `document_id`, which is a stronger instrument because it is decided at
- * consent rather than argued at the boundary. This rule stays underneath it — a profile a peer
- * never agreed to cannot be used to smuggle a BIDI override.
- */
-import { PRIVILEGED_TURN_MARKERS, pipeTurnMarkerRegex } from "@cello-protocol/gateway";
-import { profileViolation } from "./document-profile.js";
-/** Named so a refusal can say which rule fired without the sender parsing prose (§16.7-6). */
-export const SCREEN_RULE_ID = "document_content_screen";
-/** Named separately so a refusal says WHICH screen refused — the gateway's, not this module's. */
-export const SEMANTIC_RULE_ID = "document_content_semantic_screen";
-/** Named separately so a refusal says whether the AGREED profile or the default floor refused. */
-export const PROFILE_RULE_ID = "document_content_profile";
-/**
- * The one sentence every surface uses to say WHY, so the four call sites cannot describe the same
- * rule differently. It names both halves: the earlier wording described only the invisible-character
- * half, which reads as nonsense to an operator who was refused for `[INST]`.
- */
-export const SCREEN_GUIDANCE = "These are either invisible or direction-altering characters, which make what a reader SEES " +
-    "differ from what the document SAYS, or chat-template markers, which address a reader's model " +
-    "rather than the reader.";
-/**
- * Codepoints refused anywhere in inserted text.
- *
- * Every entry needs a reason that survives the question "is this legitimate in some language?" —
- * because for almost every invisible character the answer is yes, and the audit above is what
- * happens when that question is not asked.
- */
-const REFUSED_CODEPOINTS = new Set([
-    0x200b, // ZERO WIDTH SPACE — joins nothing; in a document it only hides a boundary
-    0x202a, // LEFT-TO-RIGHT EMBEDDING
-    0x202b, // RIGHT-TO-LEFT EMBEDDING
-    0x202c, // POP DIRECTIONAL FORMATTING
-    0x202d, // LEFT-TO-RIGHT OVERRIDE
-    0x202e, // RIGHT-TO-LEFT OVERRIDE — renders text as something other than it is
-    0x2066, // LEFT-TO-RIGHT ISOLATE
-    0x2067, // RIGHT-TO-LEFT ISOLATE
-    0x2068, // FIRST STRONG ISOLATE
-    0x2069, // POP DIRECTIONAL ISOLATE
-]);
-/**
- * Markers that address the READER'S MODEL rather than the reader.
- *
- * THE LIST IS THE MESSAGE PATH'S LIST. Two copies of a security literal drift, and this one had
- * drifted: four markers where the sanitizer strips ten, and matched case-sensitively where the
- * sanitizer is deliberately case-insensitive ("bypassable by shift-key" is its own wording). So
- * `[SYSTEM]`, `<<SYS>>`, `[INST]`, `SYSTEM PROMPT:` and `<|IM_START|>` reached an operator's agent
- * through a shared document while being stripped out of every message. The affordance prefix is the
- * sharpest: the sanitizer strips it so relayed text cannot forge local provenance, and a document
- * carried it verbatim.
- *
- * Same list, different remedy — the message path strips, a signed CRDT replica cannot be rewritten,
- * so this path REFUSES. Refusing is honest: a document about prompt formats is told which literal
- * to quote differently, where erasing would change its subject without saying so.
- *
- * NOT taken from the sanitizer, deliberately: its `### Instruction:` heading family and its `</s>`
- * pattern are ordinary markdown and ordinary prose in a technical document. Refusing those would
- * refuse legitimate writing, which is the false-positive class this whole rule exists to avoid.
- */
-/**
- * The prose-ambiguous members of the shared list, excluded HERE and only here.
- *
- * A message gets these STRIPPED, which costs a reader a few characters. A document gets a hard
- * REFUSAL, and these three are ordinary English and ordinary markup:
- *   - `SYSTEM PROMPT:` — "Here is the system prompt: keep it short" is a sentence someone writes.
- *   - `<system>` / `</system>` — a tag in any XML or config document.
- * Refusing them would refuse legitimate writing, which is the false-positive class this whole rule
- * exists to avoid, and the same objection that kept `### Instruction:` and `</s>` off the list.
- * Excluded by name rather than by omission so the choice is visible and testable.
- */
-export const PROSE_AMBIGUOUS = ["SYSTEM PROMPT:", "<system>", "</system>"];
-const REFUSED_MARKERS = PRIVILEGED_TURN_MARKERS.filter((m) => !PROSE_AMBIGUOUS.includes(m));
-/** `U+XXXX`, uppercase, at least four digits — the form a human reads and a machine can match. */
-function formatCodepoint(cp) {
-    return `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`;
-}
-/** A literal is data, not a pattern — `[SYSTEM]` is a character class until it is escaped. */
-function escapeForRegex(literal) {
-    return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
- * The rule. Null admits; anything else refuses.
- *
- * Offsets are in CODE POINTS, not UTF-16 units, because they exist for a human or an agent to find
- * the character in their own editor — and an offset that lands mid-surrogate in a document with an
- * emoji in it is worse than none.
- */
-/**
- * The denylist scan itself, over plain text — no gate, no diff, no context.
- *
- * Extracted so the AUTHORING check and the RECEIVING gate cannot drift. Two implementations of one
- * rule is how a sender-side "advisory" ends up refusing things the receiver admits, or worse
- * admitting things it refuses — and this milestone has now been bitten four times by a second copy
- * of a rule that was supposed to match the first.
- *
- * Returns null when the text is clean; otherwise every distinct offender, a count, and CODE-POINT
- * offsets (not UTF-16, which lands mid-surrogate in any document containing an emoji).
- */
-export function screenText(text) {
-    if (text.length === 0)
-        return null;
-    const codepoints = new Set();
-    const offsets = [];
-    let index = 0;
-    for (const ch of text) {
-        const cp = ch.codePointAt(0);
-        if (REFUSED_CODEPOINTS.has(cp)) {
-            codepoints.add(formatCodepoint(cp));
-            offsets.push(index);
-        }
-        index++;
-    }
-    // Case-INSENSITIVE. `[CELLO Security Layer, Local]` is the same claim of provenance to a model as
-    // the lowercase form, so a case-sensitive search leaves every marker bypassable by shift-key —
-    // the sanitizer's own reasoning, which this path did not carry.
-    //
-    // Matched on the ORIGINAL text with a case-insensitive pattern, never by scanning a lowercased
-    // copy: `toLowerCase` can change UTF-16 LENGTH (`İ` lowercases to two units), so an index into the
-    // copy does not address the original and the reported offset skews by one per such character.
-    // Offsets exist for a human to find the marker in their own editor — a wrong one is worse than none.
-    for (const marker of REFUSED_MARKERS) {
-        for (const m of text.matchAll(new RegExp(escapeForRegex(marker), "gi"))) {
-            // The marker AS WRITTEN in the list, not as the sender cased it — the sender needs to know
-            // which literal to stop emitting, and its casing is not the thing being refused.
-            codepoints.add(marker);
-            offsets.push([...text.slice(0, m.index)].length);
-        }
-    }
-    // Any pipe-delimited turn marker, not an enumerated four — a model family this build has never
-    // heard of names its turns the same way, and enumerating them is a list that is always one short.
-    for (const m of text.matchAll(pipeTurnMarkerRegex())) {
-        // LOWERCASED, for the reason the literal branch names the list form: this string is read back to
-        // the operator's agent in the refusal guidance, and reflecting an attacker's exact casing puts
-        // the very marker the message path exists to strip into a model's context.
-        codepoints.add(m[0].toLowerCase());
-        offsets.push([...text.slice(0, m.index)].length);
-    }
-    if (codepoints.size === 0)
-        return null;
-    offsets.sort((a, b) => a - b);
-    return { codepoints: [...codepoints], count: offsets.length, offsets };
-}
-export const screeningRule = (diff, context) => {
-    const text = diff.inserted;
-    if (text.length === 0)
-        return null;
-    // THE AGREED PROFILE FIRST (DOD-DOC-PROFILE-1). An allowlist is the stronger instrument — the
-    // decision was made once, at consent, by a human who was engaged — so when a document has one it
-    // answers before the denylist argues character by character.
-    //
-    // It cannot WIDEN anything: every profile still refuses what the denylist below refuses, so a
-    // peer cannot ask for a permissive profile at consent time as a way out of screening. Enforced
-    // here because the sender's own enforcement is unverifiable; that is the security half, and the
-    // authoring check is the ergonomics half, not a substitute for it.
-    const violation = profileViolation(context.contentProfile, text);
-    if (violation) {
-        return {
-            reason: "document_profile_violation",
-            detail: JSON.stringify({ rule: PROFILE_RULE_ID, ...violation }),
-        };
-    }
-    // ONE implementation, shared with the authoring check — see `screenText`.
-    const found = screenText(text);
-    if (!found)
-        return null;
-    const { codepoints, count, offsets } = found;
-    return {
-        reason: "document_content_refused",
-        // MACHINE-READABLE (§16.7-6). The default resolution is that the SENDER adopts the receiver's
-        // rule for this document — rules compose toward strict — and that only works if the sender can
-        // tell which character to stop emitting. Prose cannot carry that.
-        //
-        // Every distinct offender is named, not just the first: one round trip per character would be a
-        // rejection round each, and the protocol stalls at three.
-        detail: JSON.stringify({
-            rule: SCREEN_RULE_ID,
-            codepoints,
-            count,
-            offsets,
-        }),
-    };
-};
-//# sourceMappingURL=document-screen.js.map

package/dist/document-screen.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-screen.js","sourceRoot":"","sources":["../src/document-screen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAExD,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAEnE,kGAAkG;AAClG,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,6FAA6F;IAC7F,+FAA+F;IAC/F,yBAAyB,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,MAAM,EAAE,2EAA2E;IACnF,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,6BAA6B;IACrC,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,sEAAsE;IAC9E,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,0BAA0B;CACnC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB,CAAC,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AAE9F,MAAM,eAAe,GAAsB,uBAAuB,CAAC,MAAM,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpC,CAAC;AAEF,kGAAkG;AAClG,SAAS,eAAe,CAAC,EAAU;IACjC,OAAO,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;IACD,kGAAkG;IAClG,+FAA+F;IAC/F,gEAAgE;IAChE,EAAE;IACF,+FAA+F;IAC/F,mGAAmG;IACnG,8FAA8F;IAC9F,qGAAqG;IACrG,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACxE,2FAA2F;YAC3F,iFAAiF;YACjF,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC;QACrD,iGAAiG;QACjG,+FAA+F;QAC/F,2EAA2E;QAC3E,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAa,CAAC,IAAmB,EAAE,OAAoB,EAAE,EAAE;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,8FAA8F;IAC9F,iGAAiG;IACjG,6DAA6D;IAC7D,EAAE;IACF,8FAA8F;IAC9F,+FAA+F;IAC/F,gGAAgG;IAChG,mEAAmE;IACnE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,MAAM,EAAE,4BAA4B;YACpC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,SAAS,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAE7C,OAAO;QACL,MAAM,EAAE,0BAA0B;QAClC,8FAA8F;QAC9F,+FAA+F;QAC/F,kEAAkE;QAClE,EAAE;QACF,gGAAgG;QAChG,0DAA0D;QAC1D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;YACrB,IAAI,EAAE,cAAc;YACpB,UAAU;YACV,KAAK;YACL,OAAO;SACR,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/document-store.d.ts

@@ -1,372 +0,0 @@
-/**
- * DOD-DOC-STORE-1 — the daemon's three document tables (§16.7-12).
- *
- * TWO LAYERS, NOT ONE (§14). Storing only a merged Yjs binary would discard the signed envelope
- * chain that makes a seal verifiable, so both are kept:
- *
- *   `document_envelopes`  — the IMMUTABLE log: signatures, provenance, the per-document chain.
- *                           This is the truth.
- *   `document_snapshots`  — a MATERIALIZATION for fast start. Disposable by construction:
- *                           delete it and it rebuilds from the log, byte-identical.
- *
- * The distinction is load-bearing rather than stylistic. Live Yjs state deliberately does NOT
- * survive a daemon restart — CELLO's invariant is daemon-up-is-CELLO-on — and that is only safe
- * because the log makes rebuilding a lookup rather than an archaeology exercise.
- *
- * THIS MODULE PERSISTS; IT DOES NOT APPLY. Replay is INJECTED (`rebuildSnapshot`), so the store
- * owns *what to replay and in what order* while the engine (DOD-DOC-ENGINE-1) owns *how to
- * apply*. That keeps `yjs` out of this file's imports entirely and keeps the P0/P1 boundary
- * honest — a store that quietly grew a Y.Doc would be the engine wearing a store's name.
- *
- * WHAT IS NEVER STORED HERE: a Yjs clientID. §14's one-line rule is "let Yjs mint its own per
- * live Y.Doc; never derive it from agent identity, never persist and restore one." DOD-DOC-FUZZ-1
- * measured the cost of getting this wrong — two live docs sharing a clientID means the colliding
- * writer silently wins, the honest client's update is accepted-and-dropped, and the result is a
- * splice of two authors with an EMPTY pending set and no error on any path. So the snapshot
- * stores a binary and a state vector, and nothing that could be restored into a live document as
- * an identity.
- *
- * KEYED ON STABLE IDS ONLY. `agent_id` and `document_id`, never `agent_name` — it is a mutable
- * display label and reusable after retirement. The M7 session tables join on `agent_name`; that
- * is a known defect (`DOD-AGENT-ID-JOINKEY-1`), not a precedent to copy.
- */
-import type { DaemonDatabase } from "./sqlcipher-db.js";
-import type { Logger } from "./types.js";
-/** Lifecycle states a document can hold (§3.5). `stalled` is DOD-DOC-REJECT-1's terminal state. */
-export type DocumentStatus = "active" | "closed" | "killed" | "stalled";
-/**
- * What an envelope IS, as opposed to what it says. A withdrawal or a rejection is a NEW ROW that
- * references an earlier envelope — never an edit to it. The log is append-only, so the only way
- * to say "that one no longer counts" is to add a record saying so.
- */
-export type DocumentEnvelopeKind = "update" | "withdrawal" | "rejection";
-/**
- * RE-EXPORTED, not redefined.
- *
- * This was a second, structurally-similar interface declared here, and that is a drift risk with
- * teeth: `properties` is inside the proposal's SIGNED preimage and `seamViolation` reads it, so two
- * definitions of what a property is means two answers to what is admissible — one enforced at the
- * signature and one at the store. They agreed by coincidence, and the first field added to one of
- * them would have ended that quietly.
- */
-export type { DocumentProperties } from "@cello-protocol/protocol-types";
-import type { DocumentProperties } from "@cello-protocol/protocol-types";
-export interface DocumentRow {
-    documentId: string;
-    ownerAgentId: string;
-    peerAgentId: string;
-    documentType: string;
-    properties: DocumentProperties;
-    status: DocumentStatus;
-    createdAtMs: number;
-}
-export interface DocumentEnvelopeRow {
-    /** Content hash of the envelope — the stable identity, and the log's primary key. */
-    envelopeHash: string;
-    documentId: string;
-    /** WHO authored it. The chain is per-sender, so this is what partitions it. */
-    senderAgentId: string;
-    /** The sender's previous envelope for this document, or null at genesis (§9.1). */
-    docPrevHash: string | null;
-    signature: Uint8Array;
-    /** The sender's Yjs state vector at publish time (§7). */
-    stateVector: Uint8Array;
-    /** NULLABLE — a purged envelope keeps its hash and signature, proving it existed (§16.7-12). */
-    payload: Uint8Array | null;
-    /** SYNC-G1: the author's governance frontier at authoring — entry hashes, from the signed TBS. */
-    governanceParents: string[];
-    kind: DocumentEnvelopeKind;
-    /** For a withdrawal or rejection: the envelope it concerns. */
-    referencesEnvelopeHash?: string | null;
-    createdAtMs: number;
-    /** The Yjs clientID this sender signed for — the gate's authorship binding. */
-    senderClientId?: number | null;
-    /** Position in this document's log. Assigned on append; absent until then. */
-    logIndex?: number;
-}
-export interface QuarantineRow {
-    documentId: string;
-    /** The 0x05 leaf this row belongs to — the PK. One leaf, one row; see the table comment. */
-    rejectionEnvelopeHash: string;
-    rejectedEnvelopeHash: string;
-    /** The refused envelope's own author and chain link, so the chain verifier can bridge it. */
-    rejectedSenderAgentId: string;
-    rejectedDocPrevHash: string | null;
-    payload: Uint8Array;
-    reason: string;
-    detail?: string;
-    /** Which pluggable rule refused, when one did — the gate produces this and it must not be lost. */
-    rule?: string;
-    limitName?: string;
-    limitValue?: number;
-    limitActual?: number;
-    /** SYNC-R35: the exact signed refusal frame; absent on rows born before it. */
-    rejectionWire?: Uint8Array;
-    createdAtMs: number;
-}
-export interface DocumentSnapshot {
-    binary: Uint8Array;
-    stateVector: Uint8Array;
-    /**
-     * The `log_index` of the last envelope this snapshot reflects. §14 is explicit about why it is
-     * stored rather than derived: with it, "where does the snapshot sit relative to the log" is a
-     * lookup; without it, every rebuild works it out from scratch.
-     *
-     * **-1 means nothing has been applied.** The resume point is ALWAYS `lastAppliedIndex + 1`,
-     * so an empty log yields 0 and `getEnvelopesSince(0)` reads the whole log — the sentinel and
-     * the convention are chosen to agree.
-     */
-    lastAppliedIndex: number;
-}
-/** Thrown when a read path refuses to materialize over a chain that does not verify. */
-export declare class DocumentChainError extends Error {
-    readonly reason: "document_chain_broken" | "document_chain_forked";
-    readonly detail: string;
-    constructor(reason: "document_chain_broken" | "document_chain_forked", detail: string);
-}
-export type ChainVerdict = {
-    ok: true;
-} | {
-    ok: false;
-    reason: "document_chain_broken" | "document_chain_forked";
-    detail: string;
-};
-/**
- * Injected by the engine: fold an ordered envelope list into a materialized state.
- *
- * Takes ROWS, not bare payloads. The engine has to distinguish an update from a withdrawal or a
- * rejection to fold correctly — a withdrawn envelope's payload must not be applied — and it
- * cannot do that from `Uint8Array[]`. The store supplies the WHOLE log in order — withdrawal and
- * rejection records included, payload-free though they are; deciding what counts is the engine's
- * call, not the store's.
- */
-export type ReplayFn = (envelopes: DocumentEnvelopeRow[]) => {
-    binary: Uint8Array;
-    stateVector: Uint8Array;
-};
-export declare class DocumentStore {
-    #private;
-    /**
-     * The underlying handle, for modules that own their OWN tables alongside this one
-     * (DocumentLifecycle). Deliberately not a licence to query this store's tables from outside —
-     * every one of them has a method here, and a second query path is a second set of rules about
-     * scoping that nobody remembers to keep in step.
-     */
-    get rawDb(): DaemonDatabase;
-    constructor(db: DaemonDatabase, logger: Logger);
-    createDocument(row: DocumentRow): void;
-    getDocument(ownerAgentId: string, documentId: string): DocumentRow | null;
-    listDocuments(ownerAgentId: string): DocumentRow[];
-    setDocumentStatus(ownerAgentId: string, documentId: string, status: DocumentStatus): void;
-    /**
-     * Append an envelope at the next log position.
-     *
-     * IMMUTABLE AT A HASH: the conflict clause is scoped to the envelope hash ALONE, so a
-     * re-delivery — or a peer replaying the same hash with different bytes — cannot overwrite what
-     * was recorded. Returns whether a new row was written, so the caller can tell a genuine append
-     * from a duplicate rather than inferring it.
-     *
-     * Scoped deliberately, not written as a bare `OR IGNORE`: that form suppresses CHECK, UNIQUE
-     * and NOT NULL as well, which on an append-only log means a malformed `kind` or a colliding
-     * `log_index` would be DROPPED and reported to the caller as an already-seen duplicate. Every
-     * constraint except the hash conflict must throw, or `false` means three different things the
-     * caller cannot tell apart.
-     */
-    appendEnvelope(ownerAgentId: string, envelope: DocumentEnvelopeRow): boolean;
-    /**
-     * Envelopes at or after `fromIndex`, in log order. This is what makes `lastAppliedIndex` the
-     * lookup §14 asks for: resume an incremental rebuild at `lastAppliedIndex + 1` without reading
-     * the whole log.
-     */
-    getEnvelopesSince(ownerAgentId: string, documentId: string, fromIndex: number): DocumentEnvelopeRow[];
-    getEnvelopeLog(ownerAgentId: string, documentId: string): DocumentEnvelopeRow[];
-    /**
-     * Verify each sender's `doc_prev_hash` chain independently.
-     *
-     * The log interleaves both parties' envelopes, so there is no single total order to check —
-     * §16.7-5 defines replay set-based per epoch for exactly this reason. What must hold is that
-     * every sender's own links form one unbroken chain from a single genesis.
-     *
-     * A break REFUSES and names the sender and the missing predecessor. Skipping the leaf and
-     * carrying on would leave a document that reads as complete while missing operations, which is
-     * the silent-divergence failure the chain exists to prevent.
-     *
-     * LINKAGE ONLY — the name says so deliberately. This verifies no signature and does not check
-     * that `envelope_hash` hashes the content; neither is possible here (no key, no encoder). A
-     * caller must not read `ok: true` as authenticity — that belongs to the engine.
-     */
-    verifyChainLinkage(ownerAgentId: string, documentId: string): ChainVerdict;
-    /**
-     * Hold a refused update's bytes. Idempotent per REJECTION (per 0x05 leaf), not per refused
-     * envelope — one envelope may be refused across several retry rounds and each round's reason,
-     * rule and limit are distinct facts an operator needs.
-     *
-     * Returns whether a row was written, so a caller never has to infer it. The previous signature
-     * returned void and the conflict clause silently dropped every round after the first.
-     */
-    holdQuarantined(ownerAgentId: string, row: QuarantineRow): boolean;
-    listQuarantined(ownerAgentId: string, documentId: string): QuarantineRow[];
-    /**
-     * Release every entry for a refused envelope once its superseding update has been admitted.
-     * Returns whether anything was released. Keyed by the REFUSED envelope rather than the rejection
-     * leaf, because admitting the supersession resolves all of that envelope's rounds at once.
-     */
-    releaseQuarantined(ownerAgentId: string, documentId: string, rejectedEnvelopeHash: string): boolean;
-    /**
-     * Every envelope hash we hold from one sender. Hash-only on purpose: the caller needs a set for a
-     * membership test, and `getEnvelopeLog` selects `*` — including every payload BLOB — so building
-     * that set from it materialized the whole document's content on every inbound update.
-     */
-    knownEnvelopeHashesBySender(ownerAgentId: string, documentId: string, senderAgentId: string): Set<string>;
-    /** The clientIDs one sender has signed for on this document. Also hash-free — see above. */
-    senderClientIdsFor(ownerAgentId: string, documentId: string, senderAgentId: string): number[];
-    /**
-     * The state vector the PEER last told us they had — from their most recent envelope.
-     *
-     * This is what a publish diffs against (§3.2 step 3, §7): an update computed against what they
-     * have already seen carries exactly the operations they lack. Diffing against OUR OWN snapshot
-     * instead publishes what we have not yet snapshotted, which is a different question with an
-     * answer that happens to look plausible.
-     */
-    peerStateVector(ownerAgentId: string, documentId: string, peerAgentId: string): Uint8Array | null;
-    /**
-     * The state vector OUR last published envelope carried — what we had when we last spoke.
-     *
-     * Distinct from `peerStateVector`, and the distinction is the point: that one answers "what does
-     * the peer lack" (what to send), this one answers "has anything changed since I last published"
-     * (whether to send at all). Conflating them meant a republish with no edits still produced a
-     * non-empty update, because before the peer has ever published the diff is the whole document.
-     */
-    lastPublishedStateVector(ownerAgentId: string, documentId: string, senderAgentId: string): Uint8Array | null;
-    /** The rejecting agent's most recent envelope for this document, for chain linkage. */
-    /**
-     * The head of a sender's chain AS WE SEE IT — including envelopes we REFUSED.
-     *
-     * A refused envelope is never written to `document_envelopes`, but the sender's chain does not
-     * rewind: their supersession links to the envelope we just refused. Taking the head from the log
-     * alone meant that link never matched, so the supersession was refused as `document_chain_broken`
-     * — and so was everything after it, forever. Measured against two real daemons: the gate fired
-     * ONCE and the next three envelopes never reached it, so the retry round stuck at 1 and the
-     * document could never reach the stall the protocol defines.
-     *
-     * That is the bridge the quarantine was built for — it stores the refused envelope's own author
-     * and prev-hash saying exactly this — and it had only ever been applied to `verifyChainLinkage`,
-     * the local replay check. An earlier attempt added the quarantine to the KNOWN-hash set, which
-     * was not enough and is worth recording: `known` answers "have I seen this before" (duplicate
-     * detection), while the forward link is checked against the HEAD. Bridging the wrong one looks
-     * right and changes nothing.
-     *
-     * `log_index` and the quarantine's `created_at` are different clocks, so they are not merged into
-     * one ORDER BY. Whichever is newer by arrival is the head: a refusal always happens after the
-     * envelope it refuses, so a quarantine row newer than the last admitted envelope IS the head.
-     */
-    lastEnvelopeHashBySender(ownerAgentId: string, documentId: string, senderAgentId: string): string | null;
-    /**
-     * Envelopes this agent authored that the peer has not acknowledged, and whose next attempt is
-     * due. DERIVED — there is no queue. Survives a restart because the log does.
-     *
-     * Scoped to `senderAgentId = ownerAgentId`: an envelope we RECEIVED is not ours to deliver, and
-     * without the scope a receiver would helpfully re-send the sender's own updates back at it.
-     */
-    /**
-     * The document's CURRENT epoch: the head of its recorded amendment chain, 0 at genesis.
-     * Trustworthy for stamping because every append site rules on admissibility before
-     * recording — a row in document_amendments is post-validation by invariant (M14B Entry 5).
-     */
-    /** SYNC-P5 (review F6) — per-sender envelope counts without hauling payload blobs. */
-    envelopeCountsBySender(ownerAgentId: string, documentId: string): Map<string, number>;
-    /** SYNC-P5 — record what a party's exchange just showed us (display cache; see the table). */
-    recordPartyView(ownerAgentId: string, documentId: string, partyAgentId: string, view: {
-        govSeqs: Record<string, number>;
-        contentCounts: Record<string, number>;
-        refused: string[];
-    }, nowMs: number): void;
-    partyView(ownerAgentId: string, documentId: string, partyAgentId: string): {
-        lastExchangeMs: number;
-        govSeqs: Record<string, number>;
-        contentCounts: Record<string, number>;
-        refused: string[];
-    } | null;
-    /** Record a rejection the PEER sent us. Returns whether a row was written (idempotent by leaf). */
-    recordRejectionReceived(ownerAgentId: string, row: {
-        documentId: string;
-        rejectionEnvelopeHash: string;
-        rejectedEnvelopeHash: string;
-        fromAgentId: string;
-        reason: string;
-        detail?: string;
-        createdAtMs: number;
-    }): boolean;
-    /**
-     * DOD-DOC-SCREEN-1 (§16.7-16) — SENDER ADOPTS THE RECEIVER'S RULE.
-     *
-     * The codepoints this peer has actually refused for this document, learned from their own signed
-     * refusals rather than assumed. Rules compose toward STRICT: once they have said no to a
-     * character, we stop emitting it, so the same refusal cannot be spent twice — and three refusals
-     * stall the document, which makes every avoidable one expensive.
-     *
-     * Scoped to (owner, document), never global. A rule adopted for one document must not silently
-     * narrow what an operator may write everywhere else — the peer refused it HERE, under the profile
-     * agreed HERE, and another peer may accept it happily.
-     *
-     * Stored as the refusal's own machine-readable codepoints, which is why the refusal was made
-     * machine-readable in the first place: prose cannot be adopted.
-     */
-    adoptedRefusedCodepoints(ownerAgentId: string, documentId: string): Set<string>;
-    /**
-     * How many ROUNDS this document has been through — DISTINCT refused envelopes, not rows.
-     *
-     * ONE REFUSED ENVELOPE IS ONE ROUND, however many times the refusal is announced. A peer's refusal
-     * arrives TWICE by design: once as the signed `document_rejection` frame, and once as the ack that
-     * settles the delivery (`admitted: false`). Both are recorded — correctly, they are two real
-     * events — but the table is keyed on the ANNOUNCEMENT's hash, so the two land as separate rows.
-     *
-     * Counting rows therefore advanced the round by two per refusal, and `MAX_REJECTED_ROUNDS` is 3 —
-     * so a document stalled after TWO refusals instead of three, cutting the supersede-and-retry
-     * budget the protocol grants an operator by a third. Measured: the stall enforcer's sender was
-     * refused at attempt 2 with `document_stalled`.
-     *
-     * Counted rather than deduplicated on write, deliberately. Both announcements genuinely happened
-     * and the audit record should say so; what was wrong is the arithmetic built on top of it. And a
-     * UNIQUE index on the refused hash would fail to create on any database that already holds the
-     * duplicate rows this fix is about.
-     *
-     * Same principle as `ackRecordHash` one layer down — that one collapsed repeated ACKS of one
-     * envelope; this collapses the two KINDS of announcement of one refusal.
-     */
-    countRejectionsReceived(ownerAgentId: string, documentId: string): number;
-    /**
-     * Was a rejection received for THIS envelope? Envelope-scoped on purpose: the document-scoped
-     * reader below answers a different question, and using it to decide whether one envelope was
-     * refused makes a rejection of any OTHER envelope in the document look like a rejection of this
-     * one.
-     */
-    rejectionReceivedFor(ownerAgentId: string, documentId: string, envelopeHash: string): boolean;
-    /** The most recently received rejection, for the reason an operator is shown on a stall. */
-    latestRejectionReceived(ownerAgentId: string, documentId: string): {
-        reason: string;
-        detail?: string;
-        fromAgentId: string;
-    } | null;
-    /**
-     * How many rejection records this document carries, PER REJECTING AGENT — the retry round.
-     *
-     * Scoped by author, because a mutual exchange puts both directions' 0x05 leaves in one document
-     * log. Counting across senders conflated them, so two peers each rejecting once read as round 2
-     * and the document stalled at half the intended rounds.
-     */
-    countRejections(ownerAgentId: string, documentId: string, rejectingAgentId: string): number;
-    getSnapshot(ownerAgentId: string, documentId: string): DocumentSnapshot | null;
-    /** REPLACES — a snapshot is a cache of the log, not a second log. */
-    putSnapshot(ownerAgentId: string, documentId: string, snapshot: DocumentSnapshot): void;
-    deleteSnapshot(ownerAgentId: string, documentId: string): void;
-    /**
-     * Rebuild a snapshot from the envelope log alone, using the caller's replay function.
-     *
-     * Payload-stripped envelopes (purged, or withdrawal/rejection records that carry none)
-     * contribute nothing to replay but STILL COUNT toward `lastAppliedIndex` — otherwise the next
-     * incremental rebuild would start behind them and replay them forever.
-     */
-    rebuildSnapshot(ownerAgentId: string, documentId: string, replay: ReplayFn): DocumentSnapshot;
-}
-//# sourceMappingURL=document-store.d.ts.map

package/dist/document-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-store.d.ts","sourceRoot":"","sources":["../src/document-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAOzC,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAEzE;;;;;;;;GAQG;AACH,YAAY,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAGzE,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,UAAU,CAAC;IACtB,0DAA0D;IAC1D,WAAW,EAAE,UAAU,CAAC;IACxB,gGAAgG;IAChG,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC3B,kGAAkG;IAClG,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,+DAA+D;IAC/D,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6FAA6F;IAC7F,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,OAAO,EAAE,UAAU,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wFAAwF;AACxF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,uBAAuB,GAAG,uBAAuB,EAAE,MAAM,EAAE,MAAM;CAMtF;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F;;;;;;;;GAQG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,KAAK;IAC3D,MAAM,EAAE,UAAU,CAAC;IACnB,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAuIF,qBAAa,aAAa;;IAIxB;;;;;OAKG;IACH,IAAI,KAAK,IAAI,cAAc,CAE1B;gBAEW,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAuE9C,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;IAsBtC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAQzE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE;IAOlD,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI;IAQzF;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO;IAoD5E;;;;OAIG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAWrG,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAU/E;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY;IAsH1E;;;;;;;OAOG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO;IA8BlE,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE;IA6B1E;;;;OAIG;IACH,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,GAAG,OAAO;IAUnG;;;;OAIG;IACH,2BAA2B,CACzB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,GAAG,CAAC,MAAM,CAAC;IA+Bd,4FAA4F;IAC5F,kBAAkB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE;IAW7F;;;;;;;OAOG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAWjG;;;;;;;OAOG;IACH,wBAAwB,CACtB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,GACpB,UAAU,GAAG,IAAI;IAWpB,uFAAuF;IACvF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IA6BxG;;;;;;OAMG;IACH;;;;OAIG;IACH,sFAAsF;IACtF,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAWrF,8FAA8F;IAC9F,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,EACD,KAAK,EAAE,MAAM,GACZ,IAAI;IAoBP,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,IAAI;IAkBR,mGAAmG;IACnG,uBAAuB,CACrB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE;QACH,UAAU,EAAE,MAAM,CAAC;QACnB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,GACA,OAAO;IAsBV;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAwB/E;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAUzE;;;;;OAKG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAU7F,4FAA4F;IAC5F,uBAAuB,CACrB,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAelE;;;;;;OAMG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM;IAa3F,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAY9E,qEAAqE;IACrE,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAgBvF,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAM9D;;;;;;OAMG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,gBAAgB;CAiC9F"}