@cello-protocol/daemon 0.0.226 → 0.0.227

package/dist/document-gate.js

@@ -1,509 +0,0 @@
-/**
- * DOD-DOC-GATE-1 — the validation gate (§3.2).
- *
- *   arrive → shadow-apply → validate the PROJECTED DIFF → admit or quarantine
- *
- * The shadow document is rebuilt from ACCEPTED state and discarded. Validation asks a question;
- * admitting is a separate, explicit act, so a refused update never touches the live document.
- *
- * ── WHY THE RULES ARE WHAT THEY ARE ───────────────────────────────────────────────────────────
- *
- * Every rule here answers something DOD-DOC-FUZZ-1 MEASURED against real Yjs, and six of the nine
- * are the ACCEPT class — input `Y.applyUpdate` returns SUCCESS for. That matters because the V1
- * posture is "cap, catch, contain" (§16.7-7), and none of its three legs catches an accept: the
- * size cap sees a small update, the try/catch sees success, and "structural limits on the shadow"
- * has nothing to measure because the shadow looks fine. Measured, in order:
- *
- *   (a) an update whose dependencies never arrive is ACCEPTED and RETAINED forever — a peer
- *       streams those until the daemon dies, and a try/catch sees only success;
- *   (b) an update carries NO document identity, so one built on a different document merges
- *       silently — binding is out-of-band work the gate must do;
- *   (c) V2-format bytes are accepted by the v1 decoder and silently drop all content;
- *   (d) trailing bytes past the decoder's cursor are ignored, so unlimited byte strings decode to
- *       identical state — which makes an update's hash a poor identifier for what it says, and
- *       that hash becomes a `0x04` leaf;
- *   (h) authorship IS the clientID, so a colliding one silently wins and the honest client's
- *       update is then accepted-and-dropped, leaving a splice of two authors with an EMPTY
- *       pending set — the (a) rule cannot see this, which is why (h) is separate;
- *   (i) a ten-byte well-formed update deletes a document's entire content. Structural limits are
- *       UPPER bounds, so a shrinking update passes every one of them.
- *
- * The remaining three are the throw class: a size floor (e) because an empty update throws a lib0
- * decoder string rather than a protocol fault, one typed reason per throw (g), and a nesting-depth
- * limit (f) because Yjs bounds depth not at all and the size cap bounds it poorly — ~16 bytes per
- * level, so roughly 65,000 levels fit inside 1 MiB.
- *
- * ── QUARANTINE, NEVER DISCARD ─────────────────────────────────────────────────────────────────
- *
- * A refused update is HELD. Every path out of this gate — including an unexpected failure inside
- * a rule — produces a verdict and an event. A gate that admitted on internal error would be
- * strictly worse than one with no rules at all, and one that dropped silently would diverge the
- * two copies permanently and invisibly (§3.2).
- */
-import * as Y from "yjs";
-import { extractErrorMessage } from "./error-message.js";
-/** The one accepted update encoding (§16.7-8 pins it in the protocol types). */
-export const UPDATE_ENCODING_V1 = "yjs-v1";
-/** Published so a peer can discover them — a receiver-local limit nobody can learn is not a protocol. */
-export const DEFAULT_GATE_LIMITS = {
-    // Deliberately the same number the engine enforces, taken from the engine at construction so
-    // the two cannot drift into two sources of truth.
-    maxUpdateBytes: 1024 * 1024,
-    maxDocumentBytes: 8 * 1024 * 1024,
-    maxNestingDepth: 64,
-    maxUpdatesPerMinute: 120,
-};
-export class DocumentGate {
-    #engine;
-    #limits;
-    #logger;
-    #rules = new Map();
-    /** senderAgentId → recent admission timestamps, for the rate limit. */
-    #recent = new Map();
-    constructor(engine, limits, logger) {
-        this.#engine = engine;
-        // The engine already enforces a pre-parse cap; take it rather than repeat the constant, so a
-        // change in one place cannot leave the gate admitting what the engine will refuse.
-        this.#limits = { ...DEFAULT_GATE_LIMITS, maxUpdateBytes: engine.maxUpdateBytes, ...limits };
-        this.#logger = logger;
-    }
-    limits() {
-        return { ...this.#limits };
-    }
-    /** Register a pluggable rule. The screening rule (DOD-DOC-SCREEN-1) plugs in here. */
-    addRule(name, rule) {
-        this.#rules.set(name, rule);
-    }
-    /**
-     * Validate an incoming update against the accepted state.
-     *
-     * Never mutates `accepted`. Never throws — every failure, including an unexpected one inside a
-     * rule, becomes a quarantine verdict.
-     */
-    validate(accepted, update, context, now = Date.now()) {
-        try {
-            return this.#validate(accepted, update, context, now);
-        }
-        catch (err) {
-            // The catch-all is the no-silent-drop invariant made structural: a rule with a bug in it
-            // must not become an admission.
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_gate_rule_failed",
-                detail: extractErrorMessage(err),
-            });
-        }
-    }
-    #validate(accepted, update, context, now) {
-        // ── Pre-parse, before Yjs sees the bytes ────────────────────────────────
-        if (update.length > this.#limits.maxUpdateBytes) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_too_large",
-                limit: { name: "maxUpdateBytes", limit: this.#limits.maxUpdateBytes, actual: update.length },
-            });
-        }
-        if (update.length < 2) {
-            // (e) The floor. Below it Yjs throws "Unexpected end of array" — a decoder string naming
-            // lib0 internals rather than a protocol fault the peer could act on.
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_too_small",
-                detail: `${update.length} bytes is below the 2-byte minimum for a Yjs update`,
-            });
-        }
-        // (c) V2 bytes are ACCEPTED by the v1 decoder and silently drop all content, so the encoding
-        // is pinned. Declared, not sniffed — see GateContext.
-        if (context.declaredEncoding !== UPDATE_ENCODING_V1) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_encoding_unsupported",
-                detail: `envelope declares encoding ${JSON.stringify(context.declaredEncoding ?? null)}; ` +
-                    `only ${UPDATE_ENCODING_V1} is accepted, and v2 bytes decode to an empty document without error`,
-            });
-        }
-        // (b) An update carries NO document identity, so the binding is the envelope's and the check
-        // is the receiver's. ABSENT IS NOT FINE: an unbound update is refused, not trusted.
-        if (context.declaredDocumentId !== context.documentId) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_foreign_origin",
-                detail: `envelope declares document ${String(context.declaredDocumentId ?? "(none)").slice(0, 16)}… ` +
-                    `but this is ${context.documentId.slice(0, 16)}… — updates carry no document identity, so ` +
-                    `a well-formed update built on another document would otherwise merge silently`,
-            });
-        }
-        // ── Rate, per sender ────────────────────────────────────────────────────
-        // Counted on ARRIVAL, after the cheap pre-parse checks and BEFORE the shadow rebuild.
-        // Counting admissions instead left a peer who sends only invalid updates un-rate-limited,
-        // and everything past this point costs a full encode+apply of the whole document per attempt.
-        const window = (this.#recent.get(context.senderAgentId) ?? []).filter((t) => now - t < 60_000);
-        if (window.length >= this.#limits.maxUpdatesPerMinute) {
-            this.#recent.set(context.senderAgentId, window);
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_rate_exceeded",
-                limit: {
-                    name: "maxUpdatesPerMinute",
-                    limit: this.#limits.maxUpdatesPerMinute,
-                    actual: window.length + 1,
-                },
-            });
-        }
-        window.push(now);
-        this.#recent.set(context.senderAgentId, window);
-        // Prune senders whose window has emptied, so the map does not accumulate one entry per peer
-        // for the life of the process.
-        for (const [sender, times] of this.#recent) {
-            if (times.length > 0 && now - times[times.length - 1] > 60_000)
-                this.#recent.delete(sender);
-        }
-        // ── Shadow apply, on state rebuilt from ACCEPTED — never long-lived ─────
-        const shadow = new Y.Doc();
-        try {
-            Y.applyUpdate(shadow, Y.encodeStateAsUpdate(accepted));
-        }
-        catch (err) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_accepted_state_unreadable",
-                detail: extractErrorMessage(err),
-            });
-        }
-        const beforeText = shadow.getText("content").toString();
-        const beforeKeys = new Map(Object.entries(shadow.getMap("data").toJSON()));
-        try {
-            Y.applyUpdate(shadow, update);
-        }
-        catch (err) {
-            // (g) ONE typed reason per throw. The decoder string is useful and travels as detail —
-            // it is simply not a reason an operator or a policy log can key on.
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_malformed",
-                detail: extractErrorMessage(err),
-            });
-        }
-        // (a) Yjs returned success — that is not evidence the update integrated. BOTH pending sets
-        // count: an update carrying a DELETE SET for structs the receiver has never seen leaves
-        // pendingStructs null and pendingDs populated, and that retains forever exactly as the
-        // struct case does. Reading one field was coding the mechanism; the rule is about whether
-        // the update actually integrated.
-        const pendingStructs = shadow.store.pendingStructs;
-        const pendingDs = shadow.store.pendingDs;
-        if (pendingStructs !== null || pendingDs !== null) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_unresolved_dependencies",
-                detail: pendingStructs
-                    ? `depends on ${pendingStructs.missing.size} client(s) whose earlier operations are absent`
-                    : `carries a delete set referring to operations this document has never seen`,
-            });
-        }
-        // (d) Re-encode THE UPDATE ITSELF and compare. Comparing against the canonical DELTA looked
-        // equivalent and is not: a peer that batches several transactions (the normal shape for an
-        // append-only log) or sends full state (what y-protocols sync step 2 does with no state
-        // vector) produces an update legitimately LARGER than the delta, and both were measured
-        // being refused as "trailing bytes" — an attack label on a benign encoding, which sends an
-        // operator hunting a malicious peer while the document stops converging.
-        //
-        // `Y.diffUpdate` against an empty state vector re-encodes the update's own content and drops
-        // slack. `Y.mergeUpdates([padded])` does NOT — it preserves the padding — so it is not a
-        // usable detector here.
-        let canonicalUpdate;
-        try {
-            canonicalUpdate = Y.diffUpdate(update, Y.encodeStateVector(new Y.Doc()));
-        }
-        catch (err) {
-            // A throw here is a malformed update, not an internal rule failure — labelling it
-            // document_gate_rule_failed would name this gate's exit point rather than the peer's fault.
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_malformed",
-                detail: extractErrorMessage(err),
-            });
-        }
-        const reEncoded = Y.encodeStateAsUpdate(shadow);
-        if (update.length > canonicalUpdate.length) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_update_trailing_bytes",
-                detail: `${update.length - canonicalUpdate.length} bytes past the decoder's cursor — the encoding ` +
-                    `would otherwise be malleable, and this update's hash becomes a 0x04 leaf`,
-            });
-        }
-        // (b) and (h): who wrote this, and on what.
-        const authorship = this.#checkAuthorship(accepted, shadow, context);
-        if (authorship)
-            return this.#quarantine(context, update, authorship);
-        // ── The PROJECTED DIFF — what the update would do ───────────────────────
-        const afterText = shadow.getText("content").toString();
-        const afterKeys = new Map(Object.entries(shadow.getMap("data").toJSON()));
-        const diff = {
-            inserted: insertedText(update),
-            deletedChars: deletedCount(beforeText, afterText),
-            changedKeys: [...new Set([...beforeKeys.keys(), ...afterKeys.keys()])].filter((k) => JSON.stringify(beforeKeys.get(k)) !== JSON.stringify(afterKeys.get(k))),
-            resultingBytes: reEncoded.length,
-            maxDepth: deepestRoot(shadow, this.#limits.maxNestingDepth),
-        };
-        // ── Structural limits, on the projected result ──────────────────────────
-        if (diff.resultingBytes > this.#limits.maxDocumentBytes) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_too_large",
-                limit: { name: "maxDocumentBytes", limit: this.#limits.maxDocumentBytes, actual: diff.resultingBytes },
-            });
-        }
-        if (diff.maxDepth > this.#limits.maxNestingDepth) {
-            return this.#quarantine(context, update, {
-                admit: false,
-                reason: "document_nesting_too_deep",
-                limit: { name: "maxNestingDepth", limit: this.#limits.maxNestingDepth, actual: diff.maxDepth },
-            });
-        }
-        // (i) append_only, judged on the PROJECTED DIFF rather than the update's size — a ten-byte
-        // update deletes everything and every structural limit passes it.
-        //
-        // Measured in BOTH coordinate spaces the write path projects from. Diffing only the text root
-        // made append_only a COMPLETE NO-OP for json documents, whose content lives in the map: an
-        // 8-byte update emptied `data` with deletedChars = 0 and was admitted.
-        if (context.appendOnly === true) {
-            // The UPDATE'S OWN DELETE SET, not a projection diff. Measured, it is exactly the right
-            // question and the projection was not:
-            //   - it is root- and type-agnostic, so an append-only document is protected whatever roots
-            //     a peer chooses — the previous version protected `content` and `data` and nothing else,
-            //     which is no protection at all when the peer names the roots;
-            //   - a map key REWRITE deletes the old item, so §16.7-1's "deletes OR EDITS" falls out;
-            //   - and growing a NESTED entry deletes nothing, so it is admitted. The projection diff
-            //     compared top-level keys with JSON.stringify and called that a removal, refusing the
-            //     very append the feature is named for and telling the operator content was removed
-            //     when nothing was.
-            const deletions = countDeletions(update);
-            if (deletions > 0) {
-                return this.#quarantine(context, update, {
-                    admit: false,
-                    reason: "document_append_only_violation",
-                    detail: `the update deletes or rewrites ${deletions} existing range(s); this document ` +
-                        `accepts appends only`,
-                });
-            }
-        }
-        // ── Pluggable rules (DOD-DOC-SCREEN-1 registers here) ───────────────────
-        for (const [name, rule] of this.#rules) {
-            const refusal = rule(diff, context);
-            if (refusal) {
-                return this.#quarantine(context, update, { admit: false, ...refusal, rule: name });
-            }
-        }
-        this.#logger.info("document.update.admitted", {
-            documentId: context.documentId,
-            senderAgentId: context.senderAgentId,
-            insertedChars: diff.inserted.length,
-            deletedChars: diff.deletedChars,
-        });
-        return { admit: true, projectedDiff: diff };
-    }
-    /**
-     * (h) Every client whose CLOCK ADVANCED must be one this peer is bound to.
-     *
-     * The first version asked whether a clientID was NEW — exempting any already present in the
-     * accepted state, including the document owner's own. That is exactly the attack AC (h) was
-     * written from, and it was measured working: integrate the accepted state, THEN set clientID to
-     * the owner's, and the forged update is admitted and attributed to the owner ("FORGED honest
-     * content"), with an empty pending set so rule (a) cannot see it either. Setting the clientID
-     * after integration sidesteps Yjs's own "Changed the client-id" guard; a hand-rolled encoder
-     * needs no trick at all.
-     *
-     * Advancement is the right question for INSERTIONS: a peer never legitimately advances another
-     * client's clock. Reusing a clock position below the owner's is deduped by Yjs, and one above
-     * leaves a gap that rule (a) catches.
-     *
-     * IT DOES NOT COVER DELETIONS. A Yjs delete set carries no clientID and advances no clock, so a
-     * BOUND peer can delete the owner's content and this rule sees nothing — which is legitimate
-     * CRDT behaviour for an authorized writer, not a forgery, but it means `append_only` is the only
-     * thing standing between a bound peer and erasure, and it defaults off. Recorded rather than
-     * left for a reader to infer, and carried as an AC on DOD-DOC-REJECT-1.
-     */
-    #checkAuthorship(accepted, shadow, context) {
-        const before = Y.decodeStateVector(Y.encodeStateVector(accepted));
-        const after = Y.decodeStateVector(Y.encodeStateVector(shadow));
-        const bound = new Set(context.senderClientIds);
-        const advanced = [];
-        for (const [client, clock] of after) {
-            if (clock > (before.get(client) ?? 0))
-                advanced.push(client);
-        }
-        const unbound = advanced.filter((c) => !bound.has(c));
-        if (unbound.length > 0) {
-            return {
-                admit: false,
-                reason: "document_update_unbound_client",
-                detail: `clientID(s) ${unbound.join(", ")} advanced but are not bound to sender ` +
-                    `${context.senderAgentId.slice(0, 16)}… — either an update authored under another ` +
-                    `party's identity, or relayed third-party operations, which V1 does not support ` +
-                    `(relayed third-party operations — pass-through, M14-P8 — are not supported)`,
-            };
-        }
-        return null;
-    }
-    #quarantine(context, update, verdict) {
-        // A quarantined update is HELD — never admitted, never discarded — so the record carries what
-        // is needed to act on it: which document, which peer, and why (§3.2).
-        this.#logger.warn("document.update.quarantined", {
-            documentId: context.documentId,
-            senderAgentId: context.senderAgentId,
-            reason: verdict.reason,
-            detail: verdict.detail,
-            limit: verdict.limit,
-            rule: verdict.rule,
-        });
-        // COPY. Storing the caller's reference would let a pooled network read buffer be reused
-        // underneath us, so DOD-DOC-REJECT-1 would hash bytes that are no longer the ones refused —
-        // into a 0x05 leaf, silently.
-        return { ...verdict, quarantined: new Uint8Array(update) };
-    }
-}
-/**
- * Every string this update INSERTS, read from the update's own insert set.
- *
- * The previous implementation compared the projected text before and after and returned the span
- * between a common prefix and a fixed-length tail. Measured, that both MISSES and OVER-INCLUDES,
- * and screening consumes this value:
- *
- *   - a net-SHRINKING update returned `""` — so a peer deleting 500 characters while inserting a
- *     200-character payload was screened by nothing at all;
- *   - inserting one character at position 0 of a long document returned that document's own opening
- *     prose and EXCLUDED a payload appended at the end;
- *   - and it read `getText("content")` only, so for a `json` document — whose content lives in the
- *     map root — it was permanently `""`. The gate's `append_only` rule already carries this exact
- *     lesson in its own comment; the fix was applied there and not here.
- *
- * Reading the update's insert set answers the real question and is root- and type-agnostic, exactly
- * as `countDeletions` is for the delete set. Order is not meaningful and is not relied on: the
- * consumer scans for offending substrings, so a separator between runs is enough to stop two
- * adjacent inserts fusing into a marker neither one contains.
- */
-function insertedText(update) {
-    try {
-        const { structs } = Y.decodeUpdate(update);
-        const parts = [];
-        for (const st of structs) {
-            const content = st.content;
-            if (content === undefined)
-                continue;
-            if (typeof content.str === "string") {
-                parts.push(content.str);
-                continue;
-            }
-            // A map/array insert carries JS values rather than a string run. Anything a reader could read
-            // as text counts — a json document's content is exactly this shape.
-            if (typeof content.getContent === "function") {
-                for (const v of content.getContent()) {
-                    if (typeof v === "string")
-                        parts.push(v);
-                    else if (v !== null && typeof v === "object")
-                        parts.push(JSON.stringify(v));
-                }
-            }
-        }
-        return parts.join("\n");
-    }
-    catch {
-        // Undecodable here means the malformed check upstream already refused it. Returning "" would
-        // silently skip screening, so this must never be the path a real update takes — and it is not:
-        // `Y.applyUpdate` has already succeeded on the shadow by the time this runs.
-        return "";
-    }
-}
-function deletedCount(before, after) {
-    let from = 0;
-    const max = Math.min(before.length, after.length);
-    while (from < max && before[from] === after[from])
-        from++;
-    let suffix = 0;
-    while (suffix < before.length - from &&
-        suffix < after.length - from &&
-        before[before.length - 1 - suffix] === after[after.length - 1 - suffix]) {
-        suffix++;
-    }
-    return Math.max(0, before.length - from - suffix);
-}
-/**
- * The deepest nesting across EVERY root, whatever shape that root is.
- *
- * Two things this must not do, both measured going wrong:
- *
- * 1. **It must not recurse.** `YMap.toJSON()` and a recursive depth walk are mutually recursive,
- *    and past roughly a thousand levels they throw `RangeError: Maximum call stack size exceeded`.
- *    A `catch` around that returned 0, which INVERTED the rule — 30 levels were caught and 5,000
- *    sailed through, so the deeper the attack the more certain it passed. Worse, it converted the
- *    gate's own fail-safe catch-all into an admission. This walk is iterative and bails the moment
- *    it passes the limit it is enforcing, so it never goes deeper than it has to.
- * 2. **It must not instantiate roots by a guessed type.** `doc.getMap(name)` MIGRATES an
- *    uninstantiated root to a map in place, so an Array- or Text-shaped root became an empty map
- *    and reported depth 0 — the same bypass, reached with a different type. Walking Yjs's own item
- *    graph is shape-agnostic: a nested type is a nested type whether it hangs off `_map` or the
- *    `_start` list.
- */
-function deepestRoot(doc, bailAt) {
-    let deepest = 0;
-    const stack = [];
-    for (const root of doc.share.values()) {
-        stack.push({ type: root, depth: 0 });
-    }
-    while (stack.length > 0) {
-        const { type, depth } = stack.pop();
-        if (depth > deepest)
-            deepest = depth;
-        // Never walk deeper than the limit under enforcement — the answer cannot change.
-        if (deepest > bailAt)
-            return deepest;
-        const internals = type;
-        if (internals._map) {
-            for (const item of internals._map.values()) {
-                const nested = nestedType(item);
-                if (nested)
-                    stack.push({ type: nested, depth: depth + 1 });
-            }
-        }
-        let item = internals._start;
-        while (item) {
-            const nested = nestedType(item);
-            if (nested)
-                stack.push({ type: nested, depth: depth + 1 });
-            item = item.right;
-        }
-    }
-    return deepest;
-}
-/** The type nested inside an item, or null when the item holds a plain value. */
-function nestedType(item) {
-    const content = item?.content;
-    if (content instanceof Y.ContentType) {
-        return content.type;
-    }
-    return null;
-}
-/**
- * How many ranges this update deletes — the basis for `append_only`.
- *
- * The update's own delete set, rather than a diff of the projected document. Measured, that is
- * the right question and a projection diff was not: this is root- and type-agnostic (so a peer
- * cannot escape by naming its own roots), a map-key rewrite deletes the old item so §16.7-1's
- * "deletes OR EDITS" falls out, and growing a nested entry deletes nothing so it is admitted.
- */
-function countDeletions(update) {
-    try {
-        const { ds } = Y.decodeUpdate(update);
-        let total = 0;
-        for (const ranges of ds.clients.values())
-            total += ranges.length;
-        return total;
-    }
-    catch {
-        // Undecodable here means the malformed check upstream already refused it. Inventing an
-        // append_only violation from a decode failure would name the wrong cause.
-        return 0;
-    }
-}
-//# sourceMappingURL=document-gate.js.map

package/dist/document-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-gate.js","sourceRoot":"","sources":["../src/document-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAa3C,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,6FAA6F;IAC7F,kDAAkD;IAClD,cAAc,EAAE,IAAI,GAAG,IAAI;IAC3B,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IACjC,eAAe,EAAE,EAAE;IACnB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAgFF,MAAM,OAAO,YAAY;IACd,OAAO,CAAiB;IACxB,OAAO,CAAa;IACpB,OAAO,CAAS;IAChB,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,uEAAuE;IAC9D,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,YAAY,MAAsB,EAAE,MAA2B,EAAE,MAAc;QAC7E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,6FAA6F;QAC7F,mFAAmF;QACnF,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC5F,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,sFAAsF;IACtF,OAAO,CAAC,IAAY,EAAE,IAAc;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAe,EAAE,MAAkB,EAAE,OAAoB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yFAAyF;YACzF,gCAAgC;YAChC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,CAAC,QAAe,EAAE,MAAkB,EAAE,OAAoB,EAAE,GAAW;QAC9E,2EAA2E;QAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,yFAAyF;YACzF,qEAAqE;YACrE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,qDAAqD;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,sDAAsD;QACtD,IAAI,OAAO,CAAC,gBAAgB,KAAK,kBAAkB,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sCAAsC;gBAC9C,MAAM,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI;oBACxF,QAAQ,kBAAkB,sEAAsE;aACnG,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,oFAAoF;QACpF,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,8BAA8B,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;oBACnG,eAAe,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6CAA6C;oBAC3F,+EAA+E;aAClF,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,sFAAsF;QACtF,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,+BAA+B;gBACvC,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;oBACvC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAChD,4FAA4F;QAC5F,+BAA+B;QAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/F,CAAC;QAED,2EAA2E;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oCAAoC;gBAC5C,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,CAAC;QAEtG,IAAI,CAAC;YACH,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,uFAAuF;YACvF,oEAAoE;YACpE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,wFAAwF;QACxF,uFAAuF;QACvF,0FAA0F;QAC1F,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACzC,IAAI,cAAc,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yCAAyC;gBACjD,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,cAAc,cAAc,CAAC,OAAO,CAAC,IAAI,gDAAgD;oBAC3F,CAAC,CAAC,2EAA2E;aAChF,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,2FAA2F;QAC3F,wFAAwF;QACxF,wFAAwF;QACxF,2FAA2F;QAC3F,yEAAyE;QACzE,EAAE;QACF,6FAA6F;QAC7F,yFAAyF;QACzF,wBAAwB;QACxB,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,kFAAkF;YAClF,4FAA4F;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,kDAAkD;oBACjG,0EAA0E;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAErE,2EAA2E;QAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,CAAC;QACrG,MAAM,IAAI,GAAkB;YAC1B,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC;YAC9B,YAAY,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC;YACjD,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC9E;YACD,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D,CAAC;QAEF,2EAA2E;QAC3E,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,kEAAkE;QAClE,EAAE;QACF,8FAA8F;QAC9F,2FAA2F;QAC3F,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAChC,wFAAwF;YACxF,uCAAuC;YACvC,4FAA4F;YAC5F,6FAA6F;YAC7F,mEAAmE;YACnE,yFAAyF;YACzF,yFAAyF;YACzF,0FAA0F;YAC1F,wFAAwF;YACxF,wBAAwB;YACxB,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;oBACvC,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,gCAAgC;oBACxC,MAAM,EAAE,kCAAkC,SAAS,oCAAoC;wBACrF,sBAAsB;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CACd,QAAe,EACf,MAAa,EACb,OAAoB;QAEpB,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;oBAC/E,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C;oBACnF,iFAAiF;oBACjF,6EAA6E;aAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,OAAoB,EAAE,MAAkB,EAAE,OAA4C;QAChG,8FAA8F;QAC9F,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,wFAAwF;QACxF,4FAA4F;QAC5F,8BAA8B;QAC9B,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAI,EAAmE,CAAC,OAAO,CAAC;YAC7F,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3E,8FAA8F;YAC9F,oEAAoE;YACpE,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;yBACpC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,+FAA+F;QAC/F,6EAA6E;QAC7E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OACE,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI;QAC7B,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,EACvE,CAAC;QACD,MAAM,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,GAAU,EAAE,MAAc;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAA4D,EAAE,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACrC,IAAI,KAAK,GAAG,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC;QACrC,iFAAiF;QACjF,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,OAAO,CAAC;QAErC,MAAM,SAAS,GAAG,IAGjB,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,GAAG,IAAI,CAAC,KAAoB,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAA8C;IAChE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,IAA+B,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAkB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,0EAA0E;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/document-handlers.d.ts

@@ -1,47 +0,0 @@
-/**
- * DOD-DOC-TOOLS-1 — the operator's surface onto documents.
- *
- * Until this module existed, nothing in production called `createDocument`. Every unit below it was
- * built and tested, and none of it was reachable: no operator could propose a document, so no
- * document existed, so the delivery sweep was a no-op by construction and the inbound path never
- * had anything addressed to it. The layer was complete and unreachable, which reads exactly like a
- * layer that works.
- *
- * ── WHY PROPOSE AND ACCEPT ARE SEPARATE VERBS ─────────────────────────────────────────────────
- *
- * A document is a standing agreement to apply a counterparty's signed operations to local state.
- * That is a larger grant than receiving a message, and §16.3 puts a human consent decision in front
- * of it. Accepting is the moment the operator agrees; everything after is the CRDT converging
- * without asking again. So the proposal is recorded, listed, and answered once — never inferred
- * from the first update arriving.
- *
- * ── WRITE IS FULL-CONTENT, NOT A PATCH ────────────────────────────────────────────────────────
- *
- * `cello_doc_write` takes the document's whole new text and the engine diffs it against the live
- * doc. An agent that emits a patch has to be right about offsets in a document its peer is
- * concurrently editing, and a wrong offset in a CRDT is not a rejected patch — it is a permanent,
- * silent corruption that both sides converge on. Full content moves that problem to a diff run
- * against the state the operator actually saw.
- */
-import type { IpcHandler } from "./ipc-server.js";
-import type { Logger } from "./types.js";
-import type { DocumentLayer } from "./document-layer.js";
-import type { DocumentPublish } from "./document-publish.js";
-import type { DocumentDeliveryTransport } from "./document-delivery-transport.js";
-export interface DocumentHandlerDeps {
-    handlers: Map<string, IpcHandler>;
-    logger: Logger;
-    layer: DocumentLayer;
-    publish: DocumentPublish;
-    /** Per-agent, because a session and a signature both belong to exactly one agent. */
-    transportFor(agentName: string): DocumentDeliveryTransport;
-    /** Which agent is this call for? Resolved from the connection, or named explicitly. */
-    resolveAgent(connectionId: string, explicit?: string): string | null;
-    /** Agent NAME to the stable owner key every document row is scoped by (M14-D5). */
-    ownerKeyFor(agentName: string): string | null;
-    /** Sign as the named agent. */
-    sign(agentName: string, tbs: Uint8Array): Promise<Uint8Array>;
-    now(): number;
-}
-export declare function registerDocumentHandlers(deps: DocumentHandlerDeps): void;
-//# sourceMappingURL=document-handlers.d.ts.map

package/dist/document-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"document-handlers.d.ts","sourceRoot":"","sources":["../src/document-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA2BH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAmClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAalF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,qFAAqF;IACrF,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAC;IAC3D,uFAAuF;IACvF,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrE,mFAAmF;IACnF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,GAAG,IAAI,MAAM,CAAC;CACf;AAYD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA+uExE"}