@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/document-gate.js

@@ -0,0 +1,509 @@
+/**
+ * DOD-DOC-GATE-1 — the validation gate (§3.2).
+ *
+ *   arrive → shadow-apply → validate the PROJECTED DIFF → admit or quarantine
+ *
+ * The shadow document is rebuilt from ACCEPTED state and discarded. Validation asks a question;
+ * admitting is a separate, explicit act, so a refused update never touches the live document.
+ *
+ * ── WHY THE RULES ARE WHAT THEY ARE ───────────────────────────────────────────────────────────
+ *
+ * Every rule here answers something DOD-DOC-FUZZ-1 MEASURED against real Yjs, and six of the nine
+ * are the ACCEPT class — input `Y.applyUpdate` returns SUCCESS for. That matters because the V1
+ * posture is "cap, catch, contain" (§16.7-7), and none of its three legs catches an accept: the
+ * size cap sees a small update, the try/catch sees success, and "structural limits on the shadow"
+ * has nothing to measure because the shadow looks fine. Measured, in order:
+ *
+ *   (a) an update whose dependencies never arrive is ACCEPTED and RETAINED forever — a peer
+ *       streams those until the daemon dies, and a try/catch sees only success;
+ *   (b) an update carries NO document identity, so one built on a different document merges
+ *       silently — binding is out-of-band work the gate must do;
+ *   (c) V2-format bytes are accepted by the v1 decoder and silently drop all content;
+ *   (d) trailing bytes past the decoder's cursor are ignored, so unlimited byte strings decode to
+ *       identical state — which makes an update's hash a poor identifier for what it says, and
+ *       that hash becomes a `0x04` leaf;
+ *   (h) authorship IS the clientID, so a colliding one silently wins and the honest client's
+ *       update is then accepted-and-dropped, leaving a splice of two authors with an EMPTY
+ *       pending set — the (a) rule cannot see this, which is why (h) is separate;
+ *   (i) a ten-byte well-formed update deletes a document's entire content. Structural limits are
+ *       UPPER bounds, so a shrinking update passes every one of them.
+ *
+ * The remaining three are the throw class: a size floor (e) because an empty update throws a lib0
+ * decoder string rather than a protocol fault, one typed reason per throw (g), and a nesting-depth
+ * limit (f) because Yjs bounds depth not at all and the size cap bounds it poorly — ~16 bytes per
+ * level, so roughly 65,000 levels fit inside 1 MiB.
+ *
+ * ── QUARANTINE, NEVER DISCARD ─────────────────────────────────────────────────────────────────
+ *
+ * A refused update is HELD. Every path out of this gate — including an unexpected failure inside
+ * a rule — produces a verdict and an event. A gate that admitted on internal error would be
+ * strictly worse than one with no rules at all, and one that dropped silently would diverge the
+ * two copies permanently and invisibly (§3.2).
+ */
+import * as Y from "yjs";
+import { extractErrorMessage } from "./error-message.js";
+/** The one accepted update encoding (§16.7-8 pins it in the protocol types). */
+export const UPDATE_ENCODING_V1 = "yjs-v1";
+/** Published so a peer can discover them — a receiver-local limit nobody can learn is not a protocol. */
+export const DEFAULT_GATE_LIMITS = {
+    // Deliberately the same number the engine enforces, taken from the engine at construction so
+    // the two cannot drift into two sources of truth.
+    maxUpdateBytes: 1024 * 1024,
+    maxDocumentBytes: 8 * 1024 * 1024,
+    maxNestingDepth: 64,
+    maxUpdatesPerMinute: 120,
+};
+export class DocumentGate {
+    #engine;
+    #limits;
+    #logger;
+    #rules = new Map();
+    /** senderAgentId → recent admission timestamps, for the rate limit. */
+    #recent = new Map();
+    constructor(engine, limits, logger) {
+        this.#engine = engine;
+        // The engine already enforces a pre-parse cap; take it rather than repeat the constant, so a
+        // change in one place cannot leave the gate admitting what the engine will refuse.
+        this.#limits = { ...DEFAULT_GATE_LIMITS, maxUpdateBytes: engine.maxUpdateBytes, ...limits };
+        this.#logger = logger;
+    }
+    limits() {
+        return { ...this.#limits };
+    }
+    /** Register a pluggable rule. The screening rule (DOD-DOC-SCREEN-1) plugs in here. */
+    addRule(name, rule) {
+        this.#rules.set(name, rule);
+    }
+    /**
+     * Validate an incoming update against the accepted state.
+     *
+     * Never mutates `accepted`. Never throws — every failure, including an unexpected one inside a
+     * rule, becomes a quarantine verdict.
+     */
+    validate(accepted, update, context, now = Date.now()) {
+        try {
+            return this.#validate(accepted, update, context, now);
+        }
+        catch (err) {
+            // The catch-all is the no-silent-drop invariant made structural: a rule with a bug in it
+            // must not become an admission.
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_gate_rule_failed",
+                detail: extractErrorMessage(err),
+            });
+        }
+    }
+    #validate(accepted, update, context, now) {
+        // ── Pre-parse, before Yjs sees the bytes ────────────────────────────────
+        if (update.length > this.#limits.maxUpdateBytes) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_too_large",
+                limit: { name: "maxUpdateBytes", limit: this.#limits.maxUpdateBytes, actual: update.length },
+            });
+        }
+        if (update.length < 2) {
+            // (e) The floor. Below it Yjs throws "Unexpected end of array" — a decoder string naming
+            // lib0 internals rather than a protocol fault the peer could act on.
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_too_small",
+                detail: `${update.length} bytes is below the 2-byte minimum for a Yjs update`,
+            });
+        }
+        // (c) V2 bytes are ACCEPTED by the v1 decoder and silently drop all content, so the encoding
+        // is pinned. Declared, not sniffed — see GateContext.
+        if (context.declaredEncoding !== UPDATE_ENCODING_V1) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_encoding_unsupported",
+                detail: `envelope declares encoding ${JSON.stringify(context.declaredEncoding ?? null)}; ` +
+                    `only ${UPDATE_ENCODING_V1} is accepted, and v2 bytes decode to an empty document without error`,
+            });
+        }
+        // (b) An update carries NO document identity, so the binding is the envelope's and the check
+        // is the receiver's. ABSENT IS NOT FINE: an unbound update is refused, not trusted.
+        if (context.declaredDocumentId !== context.documentId) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_foreign_origin",
+                detail: `envelope declares document ${String(context.declaredDocumentId ?? "(none)").slice(0, 16)}… ` +
+                    `but this is ${context.documentId.slice(0, 16)}… — updates carry no document identity, so ` +
+                    `a well-formed update built on another document would otherwise merge silently`,
+            });
+        }
+        // ── Rate, per sender ────────────────────────────────────────────────────
+        // Counted on ARRIVAL, after the cheap pre-parse checks and BEFORE the shadow rebuild.
+        // Counting admissions instead left a peer who sends only invalid updates un-rate-limited,
+        // and everything past this point costs a full encode+apply of the whole document per attempt.
+        const window = (this.#recent.get(context.senderAgentId) ?? []).filter((t) => now - t < 60_000);
+        if (window.length >= this.#limits.maxUpdatesPerMinute) {
+            this.#recent.set(context.senderAgentId, window);
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_rate_exceeded",
+                limit: {
+                    name: "maxUpdatesPerMinute",
+                    limit: this.#limits.maxUpdatesPerMinute,
+                    actual: window.length + 1,
+                },
+            });
+        }
+        window.push(now);
+        this.#recent.set(context.senderAgentId, window);
+        // Prune senders whose window has emptied, so the map does not accumulate one entry per peer
+        // for the life of the process.
+        for (const [sender, times] of this.#recent) {
+            if (times.length > 0 && now - times[times.length - 1] > 60_000)
+                this.#recent.delete(sender);
+        }
+        // ── Shadow apply, on state rebuilt from ACCEPTED — never long-lived ─────
+        const shadow = new Y.Doc();
+        try {
+            Y.applyUpdate(shadow, Y.encodeStateAsUpdate(accepted));
+        }
+        catch (err) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_accepted_state_unreadable",
+                detail: extractErrorMessage(err),
+            });
+        }
+        const beforeText = shadow.getText("content").toString();
+        const beforeKeys = new Map(Object.entries(shadow.getMap("data").toJSON()));
+        try {
+            Y.applyUpdate(shadow, update);
+        }
+        catch (err) {
+            // (g) ONE typed reason per throw. The decoder string is useful and travels as detail —
+            // it is simply not a reason an operator or a policy log can key on.
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_malformed",
+                detail: extractErrorMessage(err),
+            });
+        }
+        // (a) Yjs returned success — that is not evidence the update integrated. BOTH pending sets
+        // count: an update carrying a DELETE SET for structs the receiver has never seen leaves
+        // pendingStructs null and pendingDs populated, and that retains forever exactly as the
+        // struct case does. Reading one field was coding the mechanism; the rule is about whether
+        // the update actually integrated.
+        const pendingStructs = shadow.store.pendingStructs;
+        const pendingDs = shadow.store.pendingDs;
+        if (pendingStructs !== null || pendingDs !== null) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_unresolved_dependencies",
+                detail: pendingStructs
+                    ? `depends on ${pendingStructs.missing.size} client(s) whose earlier operations are absent`
+                    : `carries a delete set referring to operations this document has never seen`,
+            });
+        }
+        // (d) Re-encode THE UPDATE ITSELF and compare. Comparing against the canonical DELTA looked
+        // equivalent and is not: a peer that batches several transactions (the normal shape for an
+        // append-only log) or sends full state (what y-protocols sync step 2 does with no state
+        // vector) produces an update legitimately LARGER than the delta, and both were measured
+        // being refused as "trailing bytes" — an attack label on a benign encoding, which sends an
+        // operator hunting a malicious peer while the document stops converging.
+        //
+        // `Y.diffUpdate` against an empty state vector re-encodes the update's own content and drops
+        // slack. `Y.mergeUpdates([padded])` does NOT — it preserves the padding — so it is not a
+        // usable detector here.
+        let canonicalUpdate;
+        try {
+            canonicalUpdate = Y.diffUpdate(update, Y.encodeStateVector(new Y.Doc()));
+        }
+        catch (err) {
+            // A throw here is a malformed update, not an internal rule failure — labelling it
+            // document_gate_rule_failed would name this gate's exit point rather than the peer's fault.
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_malformed",
+                detail: extractErrorMessage(err),
+            });
+        }
+        const reEncoded = Y.encodeStateAsUpdate(shadow);
+        if (update.length > canonicalUpdate.length) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_update_trailing_bytes",
+                detail: `${update.length - canonicalUpdate.length} bytes past the decoder's cursor — the encoding ` +
+                    `would otherwise be malleable, and this update's hash becomes a 0x04 leaf`,
+            });
+        }
+        // (b) and (h): who wrote this, and on what.
+        const authorship = this.#checkAuthorship(accepted, shadow, context);
+        if (authorship)
+            return this.#quarantine(context, update, authorship);
+        // ── The PROJECTED DIFF — what the update would do ───────────────────────
+        const afterText = shadow.getText("content").toString();
+        const afterKeys = new Map(Object.entries(shadow.getMap("data").toJSON()));
+        const diff = {
+            inserted: insertedText(update),
+            deletedChars: deletedCount(beforeText, afterText),
+            changedKeys: [...new Set([...beforeKeys.keys(), ...afterKeys.keys()])].filter((k) => JSON.stringify(beforeKeys.get(k)) !== JSON.stringify(afterKeys.get(k))),
+            resultingBytes: reEncoded.length,
+            maxDepth: deepestRoot(shadow, this.#limits.maxNestingDepth),
+        };
+        // ── Structural limits, on the projected result ──────────────────────────
+        if (diff.resultingBytes > this.#limits.maxDocumentBytes) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_too_large",
+                limit: { name: "maxDocumentBytes", limit: this.#limits.maxDocumentBytes, actual: diff.resultingBytes },
+            });
+        }
+        if (diff.maxDepth > this.#limits.maxNestingDepth) {
+            return this.#quarantine(context, update, {
+                admit: false,
+                reason: "document_nesting_too_deep",
+                limit: { name: "maxNestingDepth", limit: this.#limits.maxNestingDepth, actual: diff.maxDepth },
+            });
+        }
+        // (i) append_only, judged on the PROJECTED DIFF rather than the update's size — a ten-byte
+        // update deletes everything and every structural limit passes it.
+        //
+        // Measured in BOTH coordinate spaces the write path projects from. Diffing only the text root
+        // made append_only a COMPLETE NO-OP for json documents, whose content lives in the map: an
+        // 8-byte update emptied `data` with deletedChars = 0 and was admitted.
+        if (context.appendOnly === true) {
+            // The UPDATE'S OWN DELETE SET, not a projection diff. Measured, it is exactly the right
+            // question and the projection was not:
+            //   - it is root- and type-agnostic, so an append-only document is protected whatever roots
+            //     a peer chooses — the previous version protected `content` and `data` and nothing else,
+            //     which is no protection at all when the peer names the roots;
+            //   - a map key REWRITE deletes the old item, so §16.7-1's "deletes OR EDITS" falls out;
+            //   - and growing a NESTED entry deletes nothing, so it is admitted. The projection diff
+            //     compared top-level keys with JSON.stringify and called that a removal, refusing the
+            //     very append the feature is named for and telling the operator content was removed
+            //     when nothing was.
+            const deletions = countDeletions(update);
+            if (deletions > 0) {
+                return this.#quarantine(context, update, {
+                    admit: false,
+                    reason: "document_append_only_violation",
+                    detail: `the update deletes or rewrites ${deletions} existing range(s); this document ` +
+                        `accepts appends only`,
+                });
+            }
+        }
+        // ── Pluggable rules (DOD-DOC-SCREEN-1 registers here) ───────────────────
+        for (const [name, rule] of this.#rules) {
+            const refusal = rule(diff, context);
+            if (refusal) {
+                return this.#quarantine(context, update, { admit: false, ...refusal, rule: name });
+            }
+        }
+        this.#logger.info("document.update.admitted", {
+            documentId: context.documentId,
+            senderAgentId: context.senderAgentId,
+            insertedChars: diff.inserted.length,
+            deletedChars: diff.deletedChars,
+        });
+        return { admit: true, projectedDiff: diff };
+    }
+    /**
+     * (h) Every client whose CLOCK ADVANCED must be one this peer is bound to.
+     *
+     * The first version asked whether a clientID was NEW — exempting any already present in the
+     * accepted state, including the document owner's own. That is exactly the attack AC (h) was
+     * written from, and it was measured working: integrate the accepted state, THEN set clientID to
+     * the owner's, and the forged update is admitted and attributed to the owner ("FORGED honest
+     * content"), with an empty pending set so rule (a) cannot see it either. Setting the clientID
+     * after integration sidesteps Yjs's own "Changed the client-id" guard; a hand-rolled encoder
+     * needs no trick at all.
+     *
+     * Advancement is the right question for INSERTIONS: a peer never legitimately advances another
+     * client's clock. Reusing a clock position below the owner's is deduped by Yjs, and one above
+     * leaves a gap that rule (a) catches.
+     *
+     * IT DOES NOT COVER DELETIONS. A Yjs delete set carries no clientID and advances no clock, so a
+     * BOUND peer can delete the owner's content and this rule sees nothing — which is legitimate
+     * CRDT behaviour for an authorized writer, not a forgery, but it means `append_only` is the only
+     * thing standing between a bound peer and erasure, and it defaults off. Recorded rather than
+     * left for a reader to infer, and carried as an AC on DOD-DOC-REJECT-1.
+     */
+    #checkAuthorship(accepted, shadow, context) {
+        const before = Y.decodeStateVector(Y.encodeStateVector(accepted));
+        const after = Y.decodeStateVector(Y.encodeStateVector(shadow));
+        const bound = new Set(context.senderClientIds);
+        const advanced = [];
+        for (const [client, clock] of after) {
+            if (clock > (before.get(client) ?? 0))
+                advanced.push(client);
+        }
+        const unbound = advanced.filter((c) => !bound.has(c));
+        if (unbound.length > 0) {
+            return {
+                admit: false,
+                reason: "document_update_unbound_client",
+                detail: `clientID(s) ${unbound.join(", ")} advanced but are not bound to sender ` +
+                    `${context.senderAgentId.slice(0, 16)}… — either an update authored under another ` +
+                    `party's identity, or relayed third-party operations, which V1 does not support ` +
+                    `(relayed third-party operations — pass-through, M14-P8 — are not supported)`,
+            };
+        }
+        return null;
+    }
+    #quarantine(context, update, verdict) {
+        // A quarantined update is HELD — never admitted, never discarded — so the record carries what
+        // is needed to act on it: which document, which peer, and why (§3.2).
+        this.#logger.warn("document.update.quarantined", {
+            documentId: context.documentId,
+            senderAgentId: context.senderAgentId,
+            reason: verdict.reason,
+            detail: verdict.detail,
+            limit: verdict.limit,
+            rule: verdict.rule,
+        });
+        // COPY. Storing the caller's reference would let a pooled network read buffer be reused
+        // underneath us, so DOD-DOC-REJECT-1 would hash bytes that are no longer the ones refused —
+        // into a 0x05 leaf, silently.
+        return { ...verdict, quarantined: new Uint8Array(update) };
+    }
+}
+/**
+ * Every string this update INSERTS, read from the update's own insert set.
+ *
+ * The previous implementation compared the projected text before and after and returned the span
+ * between a common prefix and a fixed-length tail. Measured, that both MISSES and OVER-INCLUDES,
+ * and screening consumes this value:
+ *
+ *   - a net-SHRINKING update returned `""` — so a peer deleting 500 characters while inserting a
+ *     200-character payload was screened by nothing at all;
+ *   - inserting one character at position 0 of a long document returned that document's own opening
+ *     prose and EXCLUDED a payload appended at the end;
+ *   - and it read `getText("content")` only, so for a `json` document — whose content lives in the
+ *     map root — it was permanently `""`. The gate's `append_only` rule already carries this exact
+ *     lesson in its own comment; the fix was applied there and not here.
+ *
+ * Reading the update's insert set answers the real question and is root- and type-agnostic, exactly
+ * as `countDeletions` is for the delete set. Order is not meaningful and is not relied on: the
+ * consumer scans for offending substrings, so a separator between runs is enough to stop two
+ * adjacent inserts fusing into a marker neither one contains.
+ */
+function insertedText(update) {
+    try {
+        const { structs } = Y.decodeUpdate(update);
+        const parts = [];
+        for (const st of structs) {
+            const content = st.content;
+            if (content === undefined)
+                continue;
+            if (typeof content.str === "string") {
+                parts.push(content.str);
+                continue;
+            }
+            // A map/array insert carries JS values rather than a string run. Anything a reader could read
+            // as text counts — a json document's content is exactly this shape.
+            if (typeof content.getContent === "function") {
+                for (const v of content.getContent()) {
+                    if (typeof v === "string")
+                        parts.push(v);
+                    else if (v !== null && typeof v === "object")
+                        parts.push(JSON.stringify(v));
+                }
+            }
+        }
+        return parts.join("\n");
+    }
+    catch {
+        // Undecodable here means the malformed check upstream already refused it. Returning "" would
+        // silently skip screening, so this must never be the path a real update takes — and it is not:
+        // `Y.applyUpdate` has already succeeded on the shadow by the time this runs.
+        return "";
+    }
+}
+function deletedCount(before, after) {
+    let from = 0;
+    const max = Math.min(before.length, after.length);
+    while (from < max && before[from] === after[from])
+        from++;
+    let suffix = 0;
+    while (suffix < before.length - from &&
+        suffix < after.length - from &&
+        before[before.length - 1 - suffix] === after[after.length - 1 - suffix]) {
+        suffix++;
+    }
+    return Math.max(0, before.length - from - suffix);
+}
+/**
+ * The deepest nesting across EVERY root, whatever shape that root is.
+ *
+ * Two things this must not do, both measured going wrong:
+ *
+ * 1. **It must not recurse.** `YMap.toJSON()` and a recursive depth walk are mutually recursive,
+ *    and past roughly a thousand levels they throw `RangeError: Maximum call stack size exceeded`.
+ *    A `catch` around that returned 0, which INVERTED the rule — 30 levels were caught and 5,000
+ *    sailed through, so the deeper the attack the more certain it passed. Worse, it converted the
+ *    gate's own fail-safe catch-all into an admission. This walk is iterative and bails the moment
+ *    it passes the limit it is enforcing, so it never goes deeper than it has to.
+ * 2. **It must not instantiate roots by a guessed type.** `doc.getMap(name)` MIGRATES an
+ *    uninstantiated root to a map in place, so an Array- or Text-shaped root became an empty map
+ *    and reported depth 0 — the same bypass, reached with a different type. Walking Yjs's own item
+ *    graph is shape-agnostic: a nested type is a nested type whether it hangs off `_map` or the
+ *    `_start` list.
+ */
+function deepestRoot(doc, bailAt) {
+    let deepest = 0;
+    const stack = [];
+    for (const root of doc.share.values()) {
+        stack.push({ type: root, depth: 0 });
+    }
+    while (stack.length > 0) {
+        const { type, depth } = stack.pop();
+        if (depth > deepest)
+            deepest = depth;
+        // Never walk deeper than the limit under enforcement — the answer cannot change.
+        if (deepest > bailAt)
+            return deepest;
+        const internals = type;
+        if (internals._map) {
+            for (const item of internals._map.values()) {
+                const nested = nestedType(item);
+                if (nested)
+                    stack.push({ type: nested, depth: depth + 1 });
+            }
+        }
+        let item = internals._start;
+        while (item) {
+            const nested = nestedType(item);
+            if (nested)
+                stack.push({ type: nested, depth: depth + 1 });
+            item = item.right;
+        }
+    }
+    return deepest;
+}
+/** The type nested inside an item, or null when the item holds a plain value. */
+function nestedType(item) {
+    const content = item?.content;
+    if (content instanceof Y.ContentType) {
+        return content.type;
+    }
+    return null;
+}
+/**
+ * How many ranges this update deletes — the basis for `append_only`.
+ *
+ * The update's own delete set, rather than a diff of the projected document. Measured, that is
+ * the right question and a projection diff was not: this is root- and type-agnostic (so a peer
+ * cannot escape by naming its own roots), a map-key rewrite deletes the old item so §16.7-1's
+ * "deletes OR EDITS" falls out, and growing a nested entry deletes nothing so it is admitted.
+ */
+function countDeletions(update) {
+    try {
+        const { ds } = Y.decodeUpdate(update);
+        let total = 0;
+        for (const ranges of ds.clients.values())
+            total += ranges.length;
+        return total;
+    }
+    catch {
+        // Undecodable here means the malformed check upstream already refused it. Inventing an
+        // append_only violation from a decode failure would name the wrong cause.
+        return 0;
+    }
+}
+//# sourceMappingURL=document-gate.js.map

package/dist/document-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-gate.js","sourceRoot":"","sources":["../src/document-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAGzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAa3C,yGAAyG;AACzG,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,6FAA6F;IAC7F,kDAAkD;IAClD,cAAc,EAAE,IAAI,GAAG,IAAI;IAC3B,gBAAgB,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;IACjC,eAAe,EAAE,EAAE;IACnB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAgFF,MAAM,OAAO,YAAY;IACd,OAAO,CAAiB;IACxB,OAAO,CAAa;IACpB,OAAO,CAAS;IAChB,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,uEAAuE;IAC9D,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,YAAY,MAAsB,EAAE,MAA2B,EAAE,MAAc;QAC7E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,6FAA6F;QAC7F,mFAAmF;QACnF,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,mBAAmB,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC5F,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,sFAAsF;IACtF,OAAO,CAAC,IAAY,EAAE,IAAc;QAClC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,QAAe,EAAE,MAAkB,EAAE,OAAoB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,yFAAyF;YACzF,gCAAgC;YAChC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,CAAC,QAAe,EAAE,MAAkB,EAAE,OAAoB,EAAE,GAAW;QAC9E,2EAA2E;QAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,yFAAyF;YACzF,qEAAqE;YACrE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,qDAAqD;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,sDAAsD;QACtD,IAAI,OAAO,CAAC,gBAAgB,KAAK,kBAAkB,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,sCAAsC;gBAC9C,MAAM,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI;oBACxF,QAAQ,kBAAkB,sEAAsE;aACnG,CAAC,CAAC;QACL,CAAC;QAED,6FAA6F;QAC7F,oFAAoF;QACpF,IAAI,OAAO,CAAC,kBAAkB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,8BAA8B,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;oBACnG,eAAe,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6CAA6C;oBAC3F,+EAA+E;aAClF,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,sFAAsF;QACtF,0FAA0F;QAC1F,8FAA8F;QAC9F,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,+BAA+B;gBACvC,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;oBACvC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAChD,4FAA4F;QAC5F,+BAA+B;QAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/F,CAAC;QAED,2EAA2E;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oCAAoC;gBAC5C,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,CAAC;QAEtG,IAAI,CAAC;YACH,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,uFAAuF;YACvF,oEAAoE;YACpE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,wFAAwF;QACxF,uFAAuF;QACvF,0FAA0F;QAC1F,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QACzC,IAAI,cAAc,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yCAAyC;gBACjD,MAAM,EAAE,cAAc;oBACpB,CAAC,CAAC,cAAc,cAAc,CAAC,OAAO,CAAC,IAAI,gDAAgD;oBAC3F,CAAC,CAAC,2EAA2E;aAChF,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,2FAA2F;QAC3F,wFAAwF;QACxF,wFAAwF;QACxF,2FAA2F;QAC3F,yEAAyE;QACzE,EAAE;QACF,6FAA6F;QAC7F,yFAAyF;QACzF,wBAAwB;QACxB,IAAI,eAA2B,CAAC;QAChC,IAAI,CAAC;YACH,eAAe,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,kFAAkF;YAClF,4FAA4F;YAC5F,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,kDAAkD;oBACjG,0EAA0E;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAErE,2EAA2E;QAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAA6B,CAAC,CAAC,CAAC;QACrG,MAAM,IAAI,GAAkB;YAC1B,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC;YAC9B,YAAY,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC;YACjD,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC9E;YACD,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D,CAAC;QAEF,2EAA2E;QAC3E,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;gBACvC,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,2BAA2B;gBACnC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;aAC/F,CAAC,CAAC;QACL,CAAC;QAED,2FAA2F;QAC3F,kEAAkE;QAClE,EAAE;QACF,8FAA8F;QAC9F,2FAA2F;QAC3F,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAChC,wFAAwF;YACxF,uCAAuC;YACvC,4FAA4F;YAC5F,6FAA6F;YAC7F,mEAAmE;YACnE,yFAAyF;YACzF,yFAAyF;YACzF,0FAA0F;YAC1F,wFAAwF;YACxF,wBAAwB;YACxB,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE;oBACvC,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,gCAAgC;oBACxC,MAAM,EAAE,kCAAkC,SAAS,oCAAoC;wBACrF,sBAAsB;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACnC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CACd,QAAe,EACf,MAAa,EACb,OAAoB;QAEpB,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EAAE,eAAe,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;oBAC/E,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C;oBACnF,iFAAiF;oBACjF,6EAA6E;aAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,OAAoB,EAAE,MAAkB,EAAE,OAA4C;QAChG,8FAA8F;QAC9F,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,wFAAwF;QACxF,4FAA4F;QAC5F,8BAA8B;QAC9B,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7D,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,OAAO,GAAI,EAAmE,CAAC,OAAO,CAAC;YAC7F,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3E,8FAA8F;YAC9F,oEAAoE;YACpE,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC7C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;yBACpC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,+FAA+F;QAC/F,6EAA6E;QAC7E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;QAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OACE,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI;QAC7B,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,EACvE,CAAC;QACD,MAAM,EAAE,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAAC,GAAU,EAAE,MAAc;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAA4D,EAAE,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QACrC,IAAI,KAAK,GAAG,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC;QACrC,iFAAiF;QACjF,IAAI,OAAO,GAAG,MAAM;YAAE,OAAO,OAAO,CAAC;QAErC,MAAM,SAAS,GAAG,IAGjB,CAAC;QACF,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC;QAC5B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,IAAI,GAAG,IAAI,CAAC,KAAoB,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAA8C;IAChE,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,IAAI,OAAO,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,IAA+B,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAkB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;QACvF,0EAA0E;QAC1E,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/document-handlers.d.ts

@@ -0,0 +1,47 @@
+/**
+ * DOD-DOC-TOOLS-1 — the operator's surface onto documents.
+ *
+ * Until this module existed, nothing in production called `createDocument`. Every unit below it was
+ * built and tested, and none of it was reachable: no operator could propose a document, so no
+ * document existed, so the delivery sweep was a no-op by construction and the inbound path never
+ * had anything addressed to it. The layer was complete and unreachable, which reads exactly like a
+ * layer that works.
+ *
+ * ── WHY PROPOSE AND ACCEPT ARE SEPARATE VERBS ─────────────────────────────────────────────────
+ *
+ * A document is a standing agreement to apply a counterparty's signed operations to local state.
+ * That is a larger grant than receiving a message, and §16.3 puts a human consent decision in front
+ * of it. Accepting is the moment the operator agrees; everything after is the CRDT converging
+ * without asking again. So the proposal is recorded, listed, and answered once — never inferred
+ * from the first update arriving.
+ *
+ * ── WRITE IS FULL-CONTENT, NOT A PATCH ────────────────────────────────────────────────────────
+ *
+ * `cello_doc_write` takes the document's whole new text and the engine diffs it against the live
+ * doc. An agent that emits a patch has to be right about offsets in a document its peer is
+ * concurrently editing, and a wrong offset in a CRDT is not a rejected patch — it is a permanent,
+ * silent corruption that both sides converge on. Full content moves that problem to a diff run
+ * against the state the operator actually saw.
+ */
+import type { IpcHandler } from "./ipc-server.js";
+import type { Logger } from "./types.js";
+import type { DocumentLayer } from "./document-layer.js";
+import type { DocumentPublish } from "./document-publish.js";
+import type { DocumentDeliveryTransport } from "./document-delivery-transport.js";
+export interface DocumentHandlerDeps {
+    handlers: Map<string, IpcHandler>;
+    logger: Logger;
+    layer: DocumentLayer;
+    publish: DocumentPublish;
+    /** Per-agent, because a session and a signature both belong to exactly one agent. */
+    transportFor(agentName: string): DocumentDeliveryTransport;
+    /** Which agent is this call for? Resolved from the connection, or named explicitly. */
+    resolveAgent(connectionId: string, explicit?: string): string | null;
+    /** Agent NAME to the stable owner key every document row is scoped by (M14-D5). */
+    ownerKeyFor(agentName: string): string | null;
+    /** Sign as the named agent. */
+    sign(agentName: string, tbs: Uint8Array): Promise<Uint8Array>;
+    now(): number;
+}
+export declare function registerDocumentHandlers(deps: DocumentHandlerDeps): void;
+//# sourceMappingURL=document-handlers.d.ts.map

package/dist/document-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-handlers.d.ts","sourceRoot":"","sources":["../src/document-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA2BH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAmClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAalF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,qFAAqF;IACrF,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAC;IAC3D,uFAAuF;IACvF,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrE,mFAAmF;IACnF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,GAAG,IAAI,MAAM,CAAC;CACf;AAYD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA+uExE"}