@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/document-handshake.js

@@ -0,0 +1,452 @@
+/**
+ * DOD-DOC-HANDSHAKE-1 — the document handshake, daemon side (§16.3).
+ *
+ * Mirrors the attestation-consent pattern operators already understand: a proposal arrives, sits
+ * as a pending item, and is accepted or refused once. On accept both sides mint the document from
+ * the agreed starting content.
+ *
+ * ── WHY ACCEPTANCE IS COMPARE-AND-SET ─────────────────────────────────────────────────────────
+ *
+ * `UPDATE … WHERE consent_state = 'pending'`, and the row count is the answer. Read-then-write
+ * would let two concurrent accepts — an agent and a CLI, or two windows on one machine, both real
+ * on a multi-attended daemon — each see `pending`, each create the document, and each report
+ * success. Worse in the other direction: a REFUSED proposal re-read as pending would be accepted
+ * after the operator declined it, which is the one outcome consent exists to make impossible.
+ *
+ * The same reasoning applies to refuse. Both transitions are terminal and both are guarded.
+ *
+ * ── WHY THE SEAM IS CHECKED AGAIN HERE ────────────────────────────────────────────────────────
+ *
+ * `seamViolation` already ran when the proposal was recorded. It runs again at accept because the
+ * proposer and the accepter run DIFFERENT BUILDS: a peer one version ahead can propose a value
+ * this build cannot honour, and if only the proposer validated, whichever side is newer would
+ * silently decide the terms for both. Re-checking at the transition is also what makes an upgrade
+ * safe — a proposal recorded under an older build cannot be accepted under rules it predates.
+ */
+import { buildDocumentProposalTbs, decodeDocumentProposal, documentFeatureIncompatibility, documentIdFromProposal, encodeDocumentProposal, seamViolation, } from "@cello-protocol/protocol-types";
+import { addColumnIfMissing } from "./column-birth.js";
+/**
+ * NOTE FOR THE NEXT COLUMN. `CREATE TABLE IF NOT EXISTS` is correct only while no daemon has ever
+ * created this table — true today, since it is new in an unreleased milestone. The moment any dev
+ * or staging DB holds it, adding a column here returns silently and that column never appears on
+ * an upgraded database while fresh installs get it. That divergence has already shipped once in
+ * this repo (see `consent-migration.ts`). Any future column needs a `PRAGMA table_info` birth-gated
+ * ALTER under `BEGIN IMMEDIATE`, following that file.
+ */
+const CREATE_PROPOSALS_SQL = `
+  CREATE TABLE IF NOT EXISTS document_proposals (
+    owner_agent_id  TEXT    NOT NULL,
+    document_id     TEXT    NOT NULL,
+    proposer_agent_id TEXT  NOT NULL,
+    peer_agent_id   TEXT    NOT NULL,
+    -- The proposal envelope as it arrived. Kept whole rather than exploded into columns, because
+    -- document_id is the hash of exactly these bytes: reconstructing them from columns would make
+    -- the identity depend on this schema's round-trip fidelity forever.
+    envelope        BLOB    NOT NULL,
+    consent_state   TEXT    NOT NULL CHECK (consent_state IN ('pending', 'accepted', 'refused')),
+    -- Why it was refused, when it was. An operator who declined a proposal weeks ago, or whose
+    -- daemon declined it on a seam violation, has no other record of which it was.
+    refusal_reason  TEXT,
+    created_at      INTEGER NOT NULL,
+    decided_at      INTEGER,
+    PRIMARY KEY (owner_agent_id, document_id),
+    CHECK (consent_state <> 'refused' OR refusal_reason IS NOT NULL)
+  );
+`;
+/**
+ * COLUMN BIRTH for the peer's answer to a proposal WE authored (the `document_proposal_ack` frame).
+ *
+ * Separate from the CREATE because a daemon that already holds proposals must gain the columns
+ * without losing them. `ALTER TABLE ... ADD COLUMN` throws on a re-run, which is why each is
+ * wrapped rather than guarded by a version number nobody maintains.
+ *
+ * Distinct from `consent_state`, which is OUR decision about THEIR proposal. Overloading one column
+ * for both directions is how "we accepted" and "they accepted" become indistinguishable — and the
+ * operator surface exists precisely to tell those apart.
+ */
+const PEER_DECISION_COLUMNS = [
+    { column: "peer_accepted", sql: "ALTER TABLE document_proposals ADD COLUMN peer_accepted INTEGER" },
+    { column: "peer_reason", sql: "ALTER TABLE document_proposals ADD COLUMN peer_reason TEXT" },
+    { column: "peer_decided_at", sql: "ALTER TABLE document_proposals ADD COLUMN peer_decided_at INTEGER" },
+    // DID OUR OFFER ACTUALLY LEAVE? Nothing durable recorded it, so `peerAccepted: null` meant both
+    // "they have not decided" and "they were never asked" — and the shipped skill told the operator
+    // to WAIT, which is wrong for the second. The only place the send outcome ever appeared was the
+    // transient response to the propose call itself.
+    { column: "proposal_sent_at", sql: "ALTER TABLE document_proposals ADD COLUMN proposal_sent_at INTEGER" },
+];
+export class DocumentHandshake {
+    #db;
+    #logger;
+    #verify;
+    constructor(db, logger, verify) {
+        this.#db = db;
+        this.#logger = logger;
+        this.#verify = verify;
+        this.#db.exec(CREATE_PROPOSALS_SQL);
+        for (const { column, sql } of PEER_DECISION_COLUMNS) {
+            addColumnIfMissing(this.#db, this.#logger, { table: "document_proposals", column, sql });
+        }
+    }
+    /**
+     * Record an arriving proposal as PENDING, or refuse it outright.
+     *
+     * A seam violation or a version mismatch is recorded as `refused` with its reason rather than
+     * dropped, so the operator can see that a peer tried and why it could not proceed. A dropped
+     * proposal is indistinguishable from a peer that never sent one.
+     */
+    recordProposal(ownerAgentId, wire, nowMs) {
+        const envelope = decodeDocumentProposal(wire);
+        const documentId = documentIdFromProposal(envelope);
+        // AUTHENTICITY FIRST, and it is fatal rather than a recorded refusal. The operator's consent
+        // decision rests entirely on the proposal having come from the agent it names, and an
+        // unverified proposal must not reach the inbox at all — `ON CONFLICT DO NOTHING` means the
+        // FIRST arrival's bytes are the permanent record for a document_id, so anyone who observed the
+        // honest proposal (and therefore knows the nonce) could race a byte-variant carrying junk,
+        // win the primary key, and permanently poison the id while the honest proposal is silently
+        // discarded. The proposer would have to re-propose under a new nonce with no signal why.
+        if (!this.#verify(envelope.proposer_agent_id, buildDocumentProposalTbs(envelope), envelope.signature)) {
+            this.#logger.error("document.proposal.signature_invalid", {
+                documentId,
+                proposerAgentId: envelope.proposer_agent_id,
+            });
+            throw new Error(`document_proposal_signature_invalid: the proposal claims to come from ` +
+                `${envelope.proposer_agent_id} but its signature does not verify against that agent`);
+        }
+        // ADDRESSED TO US. `ownerAgentId` comes from the caller and `peer_agent_id` comes from the
+        // wire, and on a multi-agent daemon — which is why owner_agent_id is in the key at all — an
+        // unchecked pair lets a proposal addressed to agent Z be recorded under agent Y and accepted
+        // BY agent Y. Consent would then be taken from a party the proposal never named, while the
+        // document_id (which does commit to peer_agent_id) says otherwise, with no error anywhere.
+        if (envelope.peer_agent_id !== ownerAgentId) {
+            this.#logger.warn("document.proposal.wrong_peer", {
+                documentId,
+                addressedTo: envelope.peer_agent_id,
+                recordedFor: ownerAgentId,
+            });
+            throw new Error(`document_proposal_wrong_peer: this proposal is addressed to ${envelope.peer_agent_id}, ` +
+                `not to ${ownerAgentId} — consent belongs to the agent the proposer named`);
+        }
+        // The HUMAN answer, not a machine label. The clause exists because the alternative to a
+        // sentence is a proposal that is never answered, which surfaces as a hang and gets diagnosed
+        // as a network fault — and because "upgrade" is useless without saying WHOSE client.
+        const incompatible = documentFeatureIncompatibility(envelope.feature_version);
+        const reason = incompatible ?? seamViolation(envelope.properties);
+        this.#db
+            .prepare(`INSERT INTO document_proposals
+           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
+            consent_state, refusal_reason, created_at, decided_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
+            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(encodeDocumentProposal(envelope)), reason ? "refused" : "pending", reason, nowMs, reason ? nowMs : null);
+        // READ BACK THE ROW, do not report what we intended. On a redelivery the INSERT does nothing —
+        // correct — and returning the state we would have written announces a decision the operator
+        // already made as still awaiting one, and logs an arrival that did not happen.
+        const stored = this.get(ownerAgentId, documentId);
+        const state = stored?.consentState ?? (reason ? "refused" : "pending");
+        const storedReason = stored?.refusalReason ?? reason ?? undefined;
+        if (state === "refused") {
+            this.#logger.warn("document.proposal.refused", {
+                documentId,
+                reason: storedReason,
+                autoRefused: true,
+            });
+            return { documentId, state, reason: storedReason };
+        }
+        if (state === "pending") {
+            // `document.proposal.received` per the DoD taxonomy — this fires when a proposal ARRIVES.
+            this.#logger.info("document.proposal.received", {
+                documentId,
+                proposerAgentId: envelope.proposer_agent_id,
+            });
+        }
+        return { documentId, state, ...(storedReason ? { reason: storedReason } : {}) };
+    }
+    /**
+     * Record a proposal WE authored, so it can be re-sent without minting a new one.
+     *
+     * The proposer had no record of the envelope it sent. That is fine until the send fails — an
+     * offline peer is the ordinary case — and then the document exists locally with no way to reach
+     * the counterparty: re-proposing mints a fresh nonce, hence a fresh `document_id`, hence a second
+     * document, leaving the first as an orphan the operator cannot explain or clear.
+     *
+     * Stored `accepted`, because we consented by authoring it — so it never appears in our own inbox
+     * (`pending` filters on state), which would be an offer to ourselves.
+     *
+     * Deliberately NOT routed through `recordProposal`: that path's checks are for a proposal
+     * ARRIVING — verify the signature against the named proposer, and refuse one not addressed to us.
+     * Ours is addressed to the peer by definition, so reusing that path would require weakening the
+     * check that stops a proposal being recorded under an agent it never named.
+     */
+    /**
+     * M14B / DOD-MP-JOIN-1 — record the genesis of a document this agent JOINED.
+     *
+     * The joiner is neither the proposer nor the named peer, so both existing paths refuse this
+     * envelope by design (`recordProposal` demands we are the addressee; `recordOutgoing` claims
+     * authorship). Stored `accepted` because the joiner's consent is their signed join answer —
+     * and stored at all because `LiveDocuments` reads `starting_content` from this table: without
+     * the row, a joined document rebuilds from an empty epoch zero and silently diverges from
+     * every other holder.
+     *
+     * The caller passes the RECEIVED genesis bytes; they are stored verbatim, not re-encoded.
+     */
+    recordJoined(ownerAgentId, receivedGenesis, nowMs) {
+        const envelope = decodeDocumentProposal(receivedGenesis);
+        const documentId = documentIdFromProposal(envelope);
+        this.#db
+            .prepare(`INSERT INTO document_proposals
+           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
+            consent_state, refusal_reason, created_at, decided_at)
+         VALUES (?, ?, ?, ?, ?, 'accepted', NULL, ?, ?)
+         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
+            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(receivedGenesis), nowMs, nowMs);
+        return documentId;
+    }
+    recordOutgoing(ownerAgentId, envelope, nowMs) {
+        const documentId = documentIdFromProposal(envelope);
+        this.#db
+            .prepare(`INSERT INTO document_proposals
+           (owner_agent_id, document_id, proposer_agent_id, peer_agent_id, envelope,
+            consent_state, refusal_reason, created_at, decided_at)
+         VALUES (?, ?, ?, ?, ?, 'accepted', NULL, ?, ?)
+         ON CONFLICT (owner_agent_id, document_id) DO NOTHING`)
+            .run(ownerAgentId, documentId, envelope.proposer_agent_id, envelope.peer_agent_id, Buffer.from(encodeDocumentProposal(envelope)), nowMs, nowMs);
+        return documentId;
+    }
+    /**
+     * Record the PEER's answer to a proposal we authored.
+     *
+     * The caller verifies the signature first — this only stores. Kept as its own method rather than
+     * folded into `accept`/`refuse` because those are OUR decision about THEIR proposal, and this is
+     * the mirror: their decision about ours. Collapsing them would put a peer-controlled reason
+     * through a path whose refusal text is written by the local operator.
+     *
+     * SETTLE ONCE. A second, contradicting answer is refused rather than applied: a peer that
+     * accepted must not be able to later claim it refused, or the proposer tears down a document the
+     * peer is still editing.
+     */
+    recordPeerDecision(ownerAgentId, documentId, 
+    /**
+     * WHO IS ANSWERING. Required, and checked against the proposal's own peer.
+     *
+     * The caller verifies the ack's signature against the agent the frame NAMES, which proves the
+     * frame is authentic and says nothing about whether that agent was ever entitled to answer. Any
+     * third party with a session to us could sign a well-formed ack for a document we proposed to
+     * someone else, and it landed as that someone's decision — reported to the operator as "they
+     * said no" for a peer who never saw it. Worse, settle-once is by VALUE, so the real peer's
+     * later genuine answer contradicts and is discarded: the poisoned state is permanent.
+     *
+     * Verified is not authorized. The old control path had
+     * carried this check from the start; the ack path was written without it.
+     */
+    ackerAgentId, decision) {
+        const record = this.get(ownerAgentId, documentId);
+        if (!record) {
+            return {
+                ok: false,
+                reason: "document_proposal_unknown",
+                detail: `no proposal ${documentId.slice(0, 16)}… authored by this agent`,
+            };
+        }
+        if (ackerAgentId !== record.peerAgentId) {
+            this.#logger.warn("document.proposal.ack_not_peer", {
+                documentId,
+                claimedBy: ackerAgentId,
+                peerAgentId: record.peerAgentId,
+            });
+            return {
+                ok: false,
+                reason: "document_proposal_ack_not_peer",
+                detail: `${ackerAgentId} is not the party this proposal was addressed to (${record.peerAgentId}), ` +
+                    `so their answer is not the decision it asks for`,
+            };
+        }
+        if (record.proposerAgentId !== ownerAgentId) {
+            // Their answer to their OWN proposal is not a thing. Recording it would overwrite this
+            // operator's consent decision with the counterparty's assertion about it.
+            return {
+                ok: false,
+                reason: "document_proposal_not_ours",
+                detail: `proposal ${documentId.slice(0, 16)}… was authored by the peer, not by this agent`,
+            };
+        }
+        const already = this.#peerDecision(ownerAgentId, documentId);
+        if (already !== null) {
+            if (already === decision.accepted)
+                return { ok: true };
+            return {
+                ok: false,
+                reason: "document_proposal_ack_contradicts",
+                detail: `the peer already answered this proposal with ${already ? "accepted" : "refused"} and now ` +
+                    `says ${decision.accepted ? "accepted" : "refused"} — a decision is made once, and both ` +
+                    `signatures are retained`,
+            };
+        }
+        this.#db
+            .prepare(`UPDATE document_proposals SET peer_accepted = ?, peer_reason = ?, peer_decided_at = ?
+          WHERE owner_agent_id = ? AND document_id = ?`)
+            .run(decision.accepted ? 1 : 0, decision.reason ?? null, decision.decidedAtMs, ownerAgentId, documentId);
+        this.#logger.info("document.proposal.answered", {
+            documentId,
+            accepted: decision.accepted,
+            reason: decision.reason,
+        });
+        return { ok: true };
+    }
+    /** The peer's answer to a proposal we authored: true accepted, false refused, null unanswered. */
+    peerDecision(ownerAgentId, documentId) {
+        return this.#peerDecision(ownerAgentId, documentId);
+    }
+    /**
+     * The peer's answer AND the words they sent with it.
+     *
+     * The reason was stored and never read by anything — write-only, which defeats the entire
+     * justification for putting it on the wire and making it mandatory there: "a refusal the proposer
+     * cannot see a reason for leaves them unable to propose anything better". Enforced at the
+     * signature, discarded at the last hop.
+     */
+    peerAnswer(ownerAgentId, documentId) {
+        const row = this.#db
+            .prepare("SELECT peer_accepted, peer_reason FROM document_proposals WHERE owner_agent_id = ? AND document_id = ?")
+            .get(ownerAgentId, documentId);
+        if (!row || row.peer_accepted === null)
+            return { accepted: null, reason: null };
+        return { accepted: row.peer_accepted === 1, reason: row.peer_reason ?? null };
+    }
+    #peerDecision(ownerAgentId, documentId) {
+        const row = this.#db
+            .prepare("SELECT peer_accepted FROM document_proposals WHERE owner_agent_id = ? AND document_id = ?")
+            .get(ownerAgentId, documentId);
+        return row?.peer_accepted === null || row?.peer_accepted === undefined ? null : row.peer_accepted === 1;
+    }
+    /** Proposals still awaiting a decision — the operator's inbox for documents. */
+    pending(ownerAgentId) {
+        return this.#rows(ownerAgentId, "WHERE owner_agent_id = ? AND consent_state = 'pending'", []);
+    }
+    get(ownerAgentId, documentId) {
+        const rows = this.#rows(ownerAgentId, "WHERE owner_agent_id = ? AND document_id = ?", [documentId]);
+        return rows[0] ?? null;
+    }
+    /**
+     * Accept a pending proposal. Compare-and-set: the transition happens iff the row was still
+     * pending, and the affected-row count is what says so.
+     */
+    accept(ownerAgentId, documentId, nowMs) {
+        const record = this.get(ownerAgentId, documentId);
+        if (!record) {
+            return {
+                ok: false,
+                reason: "document_proposal_unknown",
+                detail: `no proposal ${documentId.slice(0, 16)}… for this agent`,
+            };
+        }
+        // Re-checked at the transition, not merely at arrival — the proposer runs a different build.
+        const violation = seamViolation(record.envelope.properties);
+        if (violation) {
+            // TRANSITION, do not just refuse the call. Leaving the row pending gives the operator an
+            // inbox entry they can never clear, carrying no reason — while the arrival path records one
+            // for the identical condition. Two behaviours for one fact, and the one that persists is the
+            // one with no explanation attached.
+            if (record.consentState === "pending") {
+                this.#db
+                    .prepare(`UPDATE document_proposals SET consent_state = 'refused', refusal_reason = ?,
+                    decided_at = ?
+              WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
+                    .run(violation, nowMs, ownerAgentId, documentId);
+                this.#logger.warn("document.proposal.refused", {
+                    documentId,
+                    reason: violation,
+                    autoRefused: true,
+                    at: "accept",
+                });
+            }
+            return { ok: false, reason: "document_seam_violation", detail: violation };
+        }
+        const info = this.#db
+            .prepare(`UPDATE document_proposals SET consent_state = 'accepted', decided_at = ?
+          WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
+            .run(nowMs, ownerAgentId, documentId);
+        if (Number(info.changes) === 0) {
+            // The row exists but was not pending. Naming the state it IS in is the whole value of the
+            // message: "already accepted" and "you refused this" are different facts to an operator, and
+            // a generic failure would read as a bug in the handshake.
+            const now = this.get(ownerAgentId, documentId);
+            return {
+                ok: false,
+                reason: "document_proposal_not_pending",
+                detail: `proposal ${documentId.slice(0, 16)}… is ${now?.consentState ?? "gone"}` +
+                    (now?.refusalReason ? ` (${now.refusalReason})` : "") +
+                    " — a consent decision is made once",
+            };
+        }
+        this.#logger.info("document.proposal.accepted", { documentId });
+        return { ok: true, documentId, envelope: record.envelope };
+    }
+    /** Refuse a pending proposal. Same compare-and-set guard; a reason is mandatory. */
+    refuse(ownerAgentId, documentId, reason, nowMs) {
+        if (reason.trim().length === 0) {
+            // The column's CHECK enforces this too. Refused here so the caller gets a usable error
+            // rather than a constraint violation naming a column.
+            throw new Error("document_refusal_reason_required: a refusal must say why");
+        }
+        const info = this.#db
+            .prepare(`UPDATE document_proposals SET consent_state = 'refused', refusal_reason = ?, decided_at = ?
+          WHERE owner_agent_id = ? AND document_id = ? AND consent_state = 'pending'`)
+            .run(reason, nowMs, ownerAgentId, documentId);
+        if (Number(info.changes) === 0) {
+            const now = this.get(ownerAgentId, documentId);
+            // A PROPOSAL THAT DOES NOT EXIST IS NOT ONE THAT WAS ALREADY DECIDED. `accept` checks for the
+            // row first and answers `document_proposal_unknown`; this went straight to the UPDATE, found
+            // zero changes, and reported a typo'd id as "is unknown — a consent decision is made once".
+            // That asserts a decision was recorded, about a proposal nobody ever made, and sends the
+            // operator looking for who made it.
+            if (!now) {
+                return {
+                    ok: false,
+                    reason: "document_proposal_unknown",
+                    detail: `no proposal ${documentId.slice(0, 16)}… for this agent — check the id against ` +
+                        `cello_doc_inbox`,
+                };
+            }
+            return {
+                ok: false,
+                reason: "document_proposal_not_pending",
+                detail: `proposal ${documentId.slice(0, 16)}… is ${now.consentState} — a consent decision is made once`,
+            };
+        }
+        this.#logger.info("document.proposal.refused", { documentId, reason, autoRefused: false });
+        return { ok: true };
+    }
+    /** Record that OUR proposal for this document actually left the machine. */
+    markProposalSent(ownerAgentId, documentId, nowMs) {
+        this.#db
+            .prepare(`UPDATE document_proposals SET proposal_sent_at = ?
+          WHERE owner_agent_id = ? AND document_id = ? AND proposal_sent_at IS NULL`)
+            .run(nowMs, ownerAgentId, documentId);
+    }
+    /** Has our proposal for this document left? False also covers "we never authored one". */
+    proposalSent(ownerAgentId, documentId) {
+        const row = this.#db
+            .prepare(`SELECT proposal_sent_at FROM document_proposals
+          WHERE owner_agent_id = ? AND document_id = ? AND proposal_sent_at IS NOT NULL LIMIT 1`)
+            .get(ownerAgentId, documentId);
+        return row !== undefined;
+    }
+    #rows(ownerAgentId, where, extra) {
+        const rows = this.#db
+            .prepare(`SELECT * FROM document_proposals ${where} ORDER BY created_at ASC, rowid ASC`)
+            .all(ownerAgentId, ...extra);
+        return rows.map((r) => ({
+            documentId: r["document_id"],
+            proposerAgentId: r["proposer_agent_id"],
+            peerAgentId: r["peer_agent_id"],
+            envelope: decodeDocumentProposal(new Uint8Array(r["envelope"])),
+            consentState: r["consent_state"],
+            refusalReason: r["refusal_reason"] ?? undefined,
+            peerAccepted: r["peer_accepted"] == null ? null : r["peer_accepted"] === 1,
+            peerReason: r["peer_reason"] ?? undefined,
+            createdAtMs: r["created_at"],
+            decidedAtMs: r["decided_at"] ?? undefined,
+        }));
+    }
+}
+//# sourceMappingURL=document-handshake.js.map

package/dist/document-handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-handshake.js","sourceRoot":"","sources":["../src/document-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,GAGd,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAevD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;CAmB5B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,qBAAqB,GAAG;IAC5B,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,iEAAiE,EAAE;IACnG,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,4DAA4D,EAAE;IAC5F,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,mEAAmE,EAAE;IACvG,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,iDAAiD;IACjD,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,oEAAoE,EAAE;CAC1G,CAAC;AAoBF,MAAM,OAAO,iBAAiB;IACnB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAChB,OAAO,CAA4B;IAE5C,YAAY,EAAkB,EAAE,MAAc,EAAE,MAAiC;QAC/E,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,qBAAqB,EAAE,CAAC;YACpD,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,YAAoB,EACpB,IAAgB,EAChB,KAAa;QAEb,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAEpD,6FAA6F;QAC7F,sFAAsF;QACtF,2FAA2F;QAC3F,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACtG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE;gBACxD,UAAU;gBACV,eAAe,EAAE,QAAQ,CAAC,iBAAiB;aAC5C,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,wEAAwE;gBACtE,GAAG,QAAQ,CAAC,iBAAiB,uDAAuD,CACvF,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,IAAI,QAAQ,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAChD,UAAU;gBACV,WAAW,EAAE,QAAQ,CAAC,aAAa;gBACnC,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,+DAA+D,QAAQ,CAAC,aAAa,IAAI;gBACvF,UAAU,YAAY,oDAAoD,CAC7E,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,6FAA6F;QAC7F,qFAAqF;QACrF,MAAM,YAAY,GAAG,8BAA8B,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,YAAY,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAElE,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,EAC7C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC9B,MAAM,EACN,KAAK,EACL,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CACtB,CAAC;QAEJ,+FAA+F;QAC/F,4FAA4F;QAC5F,+EAA+E;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,aAAa,IAAI,MAAM,IAAI,SAAS,CAAC;QAElE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC7C,UAAU;gBACV,MAAM,EAAE,YAAY;gBACpB,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,0FAA0F;YAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC9C,UAAU;gBACV,eAAe,EAAE,QAAQ,CAAC,iBAAiB;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,YAAoB,EAAE,eAA2B,EAAE,KAAa;QAC3E,MAAM,QAAQ,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAC5B,KAAK,EACL,KAAK,CACN,CAAC;QACJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,YAAoB,EAAE,QAAkC,EAAE,KAAa;QACpF,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;8DAIsD,CACvD;aACA,GAAG,CACF,YAAY,EACZ,UAAU,EACV,QAAQ,CAAC,iBAAiB,EAC1B,QAAQ,CAAC,aAAa,EACtB,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,EAC7C,KAAK,EACL,KAAK,CACN,CAAC;QACJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,kBAAkB,CAChB,YAAoB,EACpB,UAAkB;IAClB;;;;;;;;;;;;OAYG;IACH,YAAoB,EACpB,QAAqE;QAErE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBAClD,UAAU;gBACV,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,gCAAgC;gBACxC,MAAM,EACJ,GAAG,YAAY,qDAAqD,MAAM,CAAC,WAAW,KAAK;oBAC3F,iDAAiD;aACpD,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,eAAe,KAAK,YAAY,EAAE,CAAC;YAC5C,uFAAuF;YACvF,0EAA0E;YAC1E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,+CAA+C;aAC3F,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,OAAO,KAAK,QAAQ,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACvD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mCAAmC;gBAC3C,MAAM,EACJ,gDAAgD,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,WAAW;oBAC3F,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,uCAAuC;oBACzF,yBAAyB;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG;aACL,OAAO,CACN;uDAC+C,CAChD;aACA,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC9C,UAAU;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,kGAAkG;IAClG,YAAY,CAAC,YAAoB,EAAE,UAAkB;QACnD,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CACR,YAAoB,EACpB,UAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN,wGAAwG,CACzG;aACA,GAAG,CAAC,YAAY,EAAE,UAAU,CAA6E,CAAC;QAC7G,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;IAChF,CAAC;IAED,aAAa,CAAC,YAAoB,EAAE,UAAkB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,2FAA2F,CAAC;aACpG,GAAG,CAAC,YAAY,EAAE,UAAU,CAAiD,CAAC;QACjF,OAAO,GAAG,EAAE,aAAa,KAAK,IAAI,IAAI,GAAG,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC;IAC1G,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,YAAoB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,wDAAwD,EAAE,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,GAAG,CAAC,YAAoB,EAAE,UAAkB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CACrB,YAAY,EACZ,8CAA8C,EAC9C,CAAC,UAAU,CAAC,CACb,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAoB,EAAE,UAAkB,EAAE,KAAa;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,2BAA2B;gBACnC,MAAM,EAAE,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACjE,CAAC;QACJ,CAAC;QAED,6FAA6F;QAC7F,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,SAAS,EAAE,CAAC;YACd,yFAAyF;YACzF,4FAA4F;YAC5F,6FAA6F;YAC7F,oCAAoC;YACpC,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,GAAG;qBACL,OAAO,CACN;;yFAE6E,CAC9E;qBACA,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;oBAC7C,UAAU;oBACV,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,IAAI;oBACjB,EAAE,EAAE,QAAQ;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;qFAC6E,CAC9E;aACA,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,0FAA0F;YAC1F,6FAA6F;YAC7F,0DAA0D;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EACJ,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,YAAY,IAAI,MAAM,EAAE;oBACxE,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,oCAAoC;aACvC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC;IAED,oFAAoF;IACpF,MAAM,CACJ,YAAoB,EACpB,UAAkB,EAClB,MAAc,EACd,KAAa;QAEb,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,uFAAuF;YACvF,sDAAsD;YACtD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;qFAC6E,CAC9E;aACA,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAEhD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/C,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,yFAAyF;YACzF,oCAAoC;YACpC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,2BAA2B;oBACnC,MAAM,EACJ,eAAe,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C;wBAChF,iBAAiB;iBACpB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,+BAA+B;gBACvC,MAAM,EAAE,YAAY,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,CAAC,YAAY,oCAAoC;aACxG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,4EAA4E;IAC5E,gBAAgB,CAAC,YAAoB,EAAE,UAAkB,EAAE,KAAa;QACtE,IAAI,CAAC,GAAG;aACL,OAAO,CACN;oFAC4E,CAC7E;aACA,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,0FAA0F;IAC1F,YAAY,CAAC,YAAoB,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;gGACwF,CACzF;aACA,GAAG,CAAC,YAAY,EAAE,UAAU,CAA8C,CAAC;QAC9E,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,KAAa,EAAE,KAAgB;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,oCAAoC,KAAK,qCAAqC,CAAC;aACvF,GAAG,CAAC,YAAY,EAAE,GAAG,KAAK,CAAmC,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,UAAU,EAAE,CAAC,CAAC,aAAa,CAAW;YACtC,eAAe,EAAE,CAAC,CAAC,mBAAmB,CAAW;YACjD,WAAW,EAAE,CAAC,CAAC,eAAe,CAAW;YACzC,QAAQ,EAAE,sBAAsB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAe,CAAC,CAAC;YAC7E,YAAY,EAAE,CAAC,CAAC,eAAe,CAAyB;YACxD,aAAa,EAAG,CAAC,CAAC,gBAAgB,CAAmB,IAAI,SAAS;YAClE,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;YAC1E,UAAU,EAAG,CAAC,CAAC,aAAa,CAAmB,IAAI,SAAS;YAC5D,WAAW,EAAE,CAAC,CAAC,YAAY,CAAW;YACtC,WAAW,EAAG,CAAC,CAAC,YAAY,CAAmB,IAAI,SAAS;SAC7D,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/document-inbound.d.ts

@@ -0,0 +1,162 @@
+/**
+ * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
+ *
+ * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
+ * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
+ * assembling them, and assembling them is not clerical work — **the order is the security
+ * property**. A check performed after admission is a check that did not protect anything.
+ *
+ * The order, and what each step is protecting:
+ *
+ *   1. DECODE          — refuse malformed input before any of it is interpreted.
+ *   2. VERIFY the signature — FIRST, because everything after it is either a judgement about a
+ *                          party or an ANSWER to one. It needs nothing but the envelope: the agent
+ *                          id is the Ed25519 public key (M14-D5). It ran at step 4 until a live
+ *                          defect forced it earlier — see `terminal` on InboundResult. An
+ *                          unverified envelope is also not REJECTED: a rejection is a protocol act
+ *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
+ *                          naming an unauthenticated sender puts their claim in our permanent log.
+ *   3. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
+ *                          TERMINAL: we will never hold it, so the sender is told and stops.
+ *   4. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
+ *                          belong here at all, and is not a rejection case (there is no
+ *                          collaboration to supersede). Refused SILENTLY — see `terminal`.
+ *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
+ *                          a redelivery that goes unacked never lets the sender settle it); a gap
+ *                          or a fork refuses.
+ *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
+ *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
+ *                          peer has decided, so the sender must stop retrying and supersede.
+ */
+import * as Y from "yjs";
+import type { DocumentStore } from "./document-store.js";
+import type { DocumentEngine } from "./document-engine.js";
+import type { DocumentGate } from "./document-gate.js";
+import type { DocumentRejections } from "./document-rejection.js";
+import type { Logger } from "./types.js";
+export type InboundResult = {
+    ok: true;
+    admitted: true;
+    envelopeHash: string;
+    duplicate: boolean;
+} | {
+    ok: true;
+    admitted: false;
+    envelopeHash: string;
+    rejectionReason: string;
+    duplicate: false;
+    /** The signed `document_rejection` to put on the wire. Absent when this refusal is a repeat. */
+    rejectionWire?: Uint8Array;
+} | {
+    ok: false;
+    reason: string;
+    detail: string;
+    terminal?: undefined;
+}
+/**
+ * A TERMINAL refusal — redelivering this envelope can never change the answer, and the sender was
+ * AUTHENTICATED, so their delivery is settled with a rejection ack rather than left outstanding.
+ * The plain refusal above means "stay silent and let them retry".
+ *
+ * Both conditions are load-bearing. Without terminal, a peer who refused the proposal is
+ * redelivered to indefinitely (found live: 74 sends). Without authentication, the ack answers
+ * whoever reached the channel rather than a known party.
+ *
+ * `terminal` AND `envelopeHash` are ONE variant, not two optional fields, because the router can
+ * only act when it has both — and with them independent, setting `terminal` while forgetting the
+ * hash produced no ack, no log line, and silently reinstated the defect this unit closed. A type
+ * that can express the broken state eventually will.
+ */
+ | {
+    ok: false;
+    reason: string;
+    detail: string;
+    terminal: true;
+    envelopeHash: string;
+};
+export interface DocumentInboundDeps {
+    store: DocumentStore;
+    /**
+     * DOD-DOC-SCREEN-CONTENT-1 — screen the PROJECTED TEXT, at the shadow.
+     *
+     * The gate already applies the update to an inert shadow copy and computes the readable
+     * before/after text. Until this seam existed, the only rule reading that text was a character
+     * denylist, while the layer that judges MEANING sat at the wire — where a document frame is a
+     * signed binary envelope and the text screener was decoding it as UTF-8 and judging mojibake.
+     *
+     * Optional because it is Layer 2 and Layer 2 degrades by design (no model → no verdict → admit).
+     * It returns BLOCK or nothing: a `redact` verdict cannot be honoured on a CRDT replica, so a
+     * rewrite-worthy finding either refuses or is carried as evidence — there is no third outcome,
+     * which is the contract this whole path is built on.
+     */
+    screenProjected?: (text: string, ctx: {
+        ownerAgentId: string;
+        documentId: string;
+        senderAgentId: string;
+        correlationId?: string;
+    }) => Promise<{
+        block: boolean;
+        reason?: string;
+    }>;
+    engine: DocumentEngine;
+    gate: DocumentGate;
+    rejections: DocumentRejections;
+    logger: Logger;
+    /**
+     * Verify the envelope signature against `sender_agent_id`. INJECTED and REQUIRED — this module
+     * cannot resolve an agent id to a public key, and a default would be a default answer to "is this
+     * authentic", which is the one question that must never have one.
+     */
+    verifySignature(senderAgentId: string, tbs: Uint8Array, signature: Uint8Array): boolean;
+    /** The live document to apply admitted updates to. */
+    liveDocFor(ownerAgentId: string, documentId: string): Y.Doc;
+    /** SYNC-D8 — the ONE fold-derived standing (R17 + removed/unknown); the walk is deleted. */
+    standingOf(ownerAgentId: string, documentId: string, agentId: string): "participant" | "invited" | "removed" | "stranger" | "unknown";
+    /**
+     * DOD-MP-INBOUND-N-1 — the CURRENT derived holders, or null when the chain does not derive.
+     * When it derives, membership is the WHOLE sender gate — the genesis-peer column is a
+     * bilateral-legacy fallback, never a permanent credential (the same rule the ack gate
+     * learned in FANOUT-1's review).
+     */
+    currentHolders(ownerAgentId: string, documentId: string): string[] | null;
+    /**
+     * SYNC-G1 — the derived state AT the envelope's signed governance frontier (R20's input).
+     * `missing` names ancestors not yet held: the caller answers NON-terminally and the exchange
+     * delivers governance first.
+     */
+    deriveAtFrontier(ownerAgentId: string, documentId: string, frontier: readonly string[]): {
+        ok: true;
+        participants: ReadonlySet<string>;
+        invited: ReadonlySet<string>;
+        /** R30: content whose named world is already ENDED is refused everywhere. */
+        ended: "closed" | "killed" | null;
+    } | {
+        ok: false;
+        reason: string;
+        missing?: string[];
+    };
+    /**
+     * Sign as the OWNING agent, over the rejection's canonical preimage (DOD-DOC-REJECT-2).
+     *
+     * Takes the agent so it cannot sign with the wrong key. ASYNC, and that is what makes `receive`
+     * async: signing goes through a key provider, and REJECT-1 requires a real signature rather than
+     * a placeholder.
+     */
+    sign(ownerAgentId: string, tbs: Uint8Array): Promise<Uint8Array>;
+}
+export declare class DocumentInbound {
+    #private;
+    constructor(deps: DocumentInboundDeps);
+    /**
+     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
+     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
+     * log is indistinguishable from a real one that fails to verify — so the async is real, not
+     * incidental.
+     *
+     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
+     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
+     * stored before its successor is checked.
+     */
+    receive(ownerAgentId: string, wire: Uint8Array, nowMs: number, correlationId?: string): Promise<InboundResult>;
+}
+//# sourceMappingURL=document-inbound.d.ts.map

package/dist/document-inbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-inbound.d.ts","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAQzB,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GACtE;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,KAAK,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,KAAK,CAAC;IACjB,gGAAgG;IAChG,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B,GAID;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE;AACrE;;;;;;;;;;;;;GAaG;GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7F,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC;IACxF,sDAAsD;IACtD,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;IAC5D,4FAA4F;IAC5F,UAAU,CACR,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAClE;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,MAAM,EAAE,GAEzB;QACE,EAAE,EAAE,IAAI,CAAC;QACT,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,6EAA6E;QAC7E,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;KACnC,GACD;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACtD;;;;;;OAMG;IACH,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAClE;AAOD,qBAAa,eAAe;;gBAGd,IAAI,EAAE,mBAAmB;IAkBrC;;;;;;;;;OASG;IACG,OAAO,CACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,aAAa,SAAY,GACxB,OAAO,CAAC,aAAa,CAAC;CA8e1B"}