@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/document-inbound.js

@@ -0,0 +1,530 @@
+/**
+ * DOD-DOC-INBOUND-1 — the receiving half (§3.2, §14, §16.4).
+ *
+ * Every P2 unit built a piece of this. ENVELOPE-1 decodes and checks the chain link, GATE-1
+ * decides, REJECT-1 records a refusal and quarantines the bytes, ENGINE-1 applies. Nothing owned
+ * assembling them, and assembling them is not clerical work — **the order is the security
+ * property**. A check performed after admission is a check that did not protect anything.
+ *
+ * The order, and what each step is protecting:
+ *
+ *   1. DECODE          — refuse malformed input before any of it is interpreted.
+ *   2. VERIFY the signature — FIRST, because everything after it is either a judgement about a
+ *                          party or an ANSWER to one. It needs nothing but the envelope: the agent
+ *                          id is the Ed25519 public key (M14-D5). It ran at step 4 until a live
+ *                          defect forced it earlier — see `terminal` on InboundResult. An
+ *                          unverified envelope is also not REJECTED: a rejection is a protocol act
+ *                          that presumes an authenticated counterparty, and writing a 0x05 leaf
+ *                          naming an unauthenticated sender puts their claim in our permanent log.
+ *   3. KNOW the document — an envelope for a document we do not hold has no context to judge it in.
+ *                          TERMINAL: we will never hold it, so the sender is told and stops.
+ *   4. SENDER is the peer — a document is a pairwise agreement; a third party's envelope does not
+ *                          belong here at all, and is not a rejection case (there is no
+ *                          collaboration to supersede). Refused SILENTLY — see `terminal`.
+ *   5. CHAIN link      — a redelivery is benign and must still ACK (delivery retries by design, and
+ *                          a redelivery that goes unacked never lets the sender settle it); a gap
+ *                          or a fork refuses.
+ *   6. GATE            — the §3.2 validation, against a TRIAL copy so a refusal cannot have landed.
+ *   7. ADMIT or REJECT — and either way, ANSWER. A rejection is an ack for delivery purposes: the
+ *                          peer has decided, so the sender must stop retrying and supersede.
+ */
+import { decodeDocumentUpdateEnvelope, documentEnvelopeHash, buildDocumentUpdateTbs, verifyDocumentChainLink, } from "@cello-protocol/protocol-types";
+import { SEMANTIC_RULE_ID } from "./document-screen.js";
+import { extractErrorMessage } from "./error-message.js";
+/** The agreed property, read from the row rather than from whoever called us. */
+function appendOnly(doc) {
+    return doc.properties.append_only === true;
+}
+export class DocumentInbound {
+    #d;
+    constructor(deps) {
+        this.#d = deps;
+    }
+    /**
+     * The clientIDs this sender has SIGNED for on this document: the one this envelope declares,
+     * plus every one previously admitted from them. Both are authenticated — each arrived inside a
+     * verified TBS — so the set can only grow through signatures the peer actually made.
+     */
+    #boundClientIds(ownerAgentId, env) {
+        return [
+            ...new Set([
+                env.sender_client_id,
+                ...this.#d.store.senderClientIdsFor(ownerAgentId, env.document_id, env.sender_agent_id),
+            ]),
+        ];
+    }
+    /**
+     * ASYNC because a gate refusal must SIGN a `0x05` leaf, and signing goes through an async key
+     * provider. REJECT-1 refuses to fabricate a signature — an all-zero placeholder in an immutable
+     * log is indistinguishable from a real one that fails to verify — so the async is real, not
+     * incidental.
+     *
+     * The session content path still decides the LEAF KIND synchronously; `DocumentFrameRouter`
+     * splits the two, and serializes the handling per owner so an envelope's predecessor is always
+     * stored before its successor is checked.
+     */
+    async receive(ownerAgentId, wire, nowMs, correlationId = "inbound") {
+        // 1. DECODE.
+        let env;
+        try {
+            env = decodeDocumentUpdateEnvelope(wire);
+        }
+        catch (err) {
+            const detail = extractErrorMessage(err);
+            this.#d.logger.warn("document.inbound.malformed", { detail, correlationId });
+            // ONE reason code, with the upstream message in the detail. Two kinds of failure arrive here:
+            // our own decoder's named refusals ("document_envelope_missing_field: …"), and CBOR/lib0
+            // errors from bytes that are not a CBOR map at all ("Data read, but end of buffer not
+            // reached"). Splitting the message on ":" turned the second kind into a reason code made of
+            // English prose, which nothing can match on and which reads as a crash rather than a refusal.
+            return { ok: false, reason: "document_inbound_malformed", detail };
+        }
+        const envelopeHash = documentEnvelopeHash(env);
+        // 2. VERIFY the signature — BEFORE the document is even looked up.
+        //
+        // It used to run at step 4, after the lookup and the peer check, and the header's reasoning for
+        // that was sound as far as it went: verify before the GATE, so pluggable rules never process
+        // bytes from a party we have not authenticated. Verifying EARLIER satisfies that strictly more.
+        //
+        // What forced the move is `terminal` below. A terminal refusal is answered with a SIGNED ack
+        // addressed to `sender_agent_id`, and producing one for a sender we have not authenticated
+        // would answer whoever reached the channel rather than a known peer. Authentication has to
+        // precede the first refusal we are willing to answer, and `document_unknown` is now one.
+        //
+        // It needs nothing from the document: the agent id IS the Ed25519 public key (M14-D5), so this
+        // is self-contained on the envelope. The cost is an Ed25519 verify (~50µs) on envelopes for
+        // documents we do not hold — paid to avoid a delivery that never settles.
+        if (!this.#d.verifySignature(env.sender_agent_id, buildDocumentUpdateTbs(env), env.signature)) {
+            this.#d.logger.error("document.inbound.signature_invalid", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                envelopeHash,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_signature_invalid",
+                detail: `the envelope claims to come from ${env.sender_agent_id} but its signature does not ` +
+                    `verify against that agent — nothing was recorded`,
+            };
+        }
+        // 3. KNOW the document.
+        const doc = this.#d.store.getDocument(ownerAgentId, env.document_id);
+        if (!doc) {
+            // TERMINAL. We hold no such document and never will — this is what the far side of a REFUSED
+            // proposal looks like, and it was leaving the sender redelivering forever: the router only
+            // acks `ok: true` results, so an `ok: false` refusal settled nothing and the delivery worker
+            // re-sent on every tick. Observed live on `662743b1…`, stuck at `pendingSent: 1`.
+            //
+            // Safe to answer because step 2 authenticated the sender, and it discloses nothing they do
+            // not already have: they authored an envelope for this document_id, and the answer is "no".
+            return {
+                ok: false,
+                reason: "document_unknown",
+                terminal: true,
+                envelopeHash,
+                detail: `no document ${env.document_id.slice(0, 16)}… for this agent`,
+            };
+        }
+        // 4. THE SENDER GATE (DOD-MP-INBOUND-N-1), BEFORE any lifecycle answer — the order is the
+        // disclosure boundary: every later branch may answer with a SIGNED ACK, and an ack to a
+        // non-party confirms the document exists and what state it is in. When the chain DERIVES,
+        // derived membership is
+        // the whole gate — a joined third holder's envelope is as admissible as the genesis peer's,
+        // and a removed genesis peer's is not admissible at all. Only when the chain cannot answer
+        // (bilateral legacy, no genesis record) does the row's peer column stand in.
+        // SYNC-G1 (R20): admissibility is ruled AT THE ENVELOPE'S SIGNED FRONTIER — the governance
+        // world its author actually held — never at our current state, which refuses a removed
+        // author's legitimate earlier work and breaks convergence for every holder who was behind
+        // at removal time (the AC14 case; the old epoch-equality gate broke it three documented
+        // times). An honest removed daemon names a frontier containing its own removal and refuses
+        // HERE, by name (AC13); a backdating daemon admits exactly what an honest holder at that
+        // position could have authored — the same bounded concession the governance fold accepted,
+        // and the fold's removal dominance keeps such a daemon out of governance regardless.
+        const senderHolders = this.#d.currentHolders(ownerAgentId, env.document_id);
+        let senderIsParty;
+        if (senderHolders === null) {
+            // Bilateral legacy — no derivable chain; the row's peer column is the membership. A
+            // genesis-less document can hold no validated entries, so `standingOf` answers `unknown`
+            // here and the removed branch below is unreachable in practice — kept so the two paths
+            // cannot drift about what "removed" means (SYNC-D8: one derivation).
+            if (this.#d.standingOf(ownerAgentId, env.document_id, env.sender_agent_id) === "removed") {
+                this.#d.logger.warn("document.inbound.sender_removed", {
+                    documentId: env.document_id,
+                    senderAgentId: env.sender_agent_id,
+                    correlationId,
+                });
+                return {
+                    ok: false,
+                    reason: "document_sender_removed",
+                    terminal: true,
+                    envelopeHash,
+                    detail: "this holder was removed from the document — the removal is forward-only (your " +
+                        "copy is yours), but new edits are no longer accepted",
+                };
+            }
+            senderIsParty = env.sender_agent_id === doc.peerAgentId;
+        }
+        else {
+            const at = this.#d.deriveAtFrontier(ownerAgentId, env.document_id, env.governance_parents);
+            if (!at.ok) {
+                // Ancestors not held: the governance is IN FLIGHT — non-terminal, the exchange
+                // delivers governance before content and this envelope admits on redelivery.
+                this.#d.logger.warn("document.inbound.governance_in_flight", {
+                    documentId: env.document_id,
+                    senderAgentId: env.sender_agent_id,
+                    missing: at.missing ?? [],
+                    correlationId,
+                });
+                return {
+                    ok: false,
+                    reason: "document_governance_in_flight",
+                    envelopeHash,
+                    detail: `this update names governance ancestors this holder does not yet hold — ` +
+                        `reconcile delivers governance first; retry after it lands`,
+                };
+            }
+            // R30 / AC16: an ending among the envelope's own named ancestors means its author KNEW
+            // the document was over when they wrote — refused everywhere, terminally, including from
+            // a modified daemon: the parents are inside the signature.
+            if (at.ended !== null) {
+                this.#d.logger.warn("document.inbound.authored_after_ending", {
+                    documentId: env.document_id,
+                    senderAgentId: env.sender_agent_id,
+                    ended: at.ended,
+                    correlationId,
+                });
+                return {
+                    ok: false,
+                    reason: "document_authored_after_ending",
+                    terminal: true,
+                    envelopeHash,
+                    detail: `this update names a governance world in which the document was already ` +
+                        `${at.ended} - content authored after an ending is refused everywhere (R30)`,
+                };
+            }
+            senderIsParty = at.participants.has(env.sender_agent_id);
+        }
+        if (!senderIsParty) {
+            // A REMOVED former holder is upgraded from the silent stranger-refusal to the TERMINAL
+            // named one (REMOVE-1 review F4): they hold the removal fact already — no new disclosure —
+            // and the silent path left their delivery worker redelivering forever, which is the exact
+            // silent drop the DoD line forbids. A true stranger still gets silence.
+            if (this.#d.standingOf(ownerAgentId, env.document_id, env.sender_agent_id) === "removed") {
+                this.#d.logger.warn("document.inbound.sender_removed", {
+                    documentId: env.document_id,
+                    senderAgentId: env.sender_agent_id,
+                    correlationId,
+                });
+                return {
+                    ok: false,
+                    reason: "document_sender_removed",
+                    terminal: true,
+                    envelopeHash,
+                    detail: "this holder was removed from the document — the removal is forward-only (your " +
+                        "copy is yours), but new edits are no longer accepted",
+                };
+            }
+            // The wire stays silent (the disclosure decision stands); the LOG names the refusal, so
+            // the operator debugging "the new collaborator's edits aren't landing" has a line to find.
+            // An admission still in flight resolves by the sender's ordinary retry after it lands.
+            this.#d.logger.warn("document.inbound.not_peer", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                peerAgentId: doc.peerAgentId,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_sender_not_peer",
+                // The peer's identity is NOT in the reply, and there is NO ack — silence is the answer. A
+                // third party is authenticated as themselves but is not a party to this document, so
+                // nothing about it is theirs to learn.
+                //
+                // A residual one-bit oracle remains and is accepted deliberately: a prober who already
+                // holds a valid document_id learns "exists" from the ABSENCE of an ack, since an unknown
+                // document answers and a known one does not. Closing that would mean acking non-parties,
+                // which discloses strictly more. It is bounded by document_id being a 32-byte hash
+                // (`documentIdFromProposal`), unguessable and never published.
+                detail: "you are not a party to this document",
+            };
+        }
+        // 4a. A DAEMON THAT KNOWS ITSELF REMOVED STOPS APPLYING (DOD-MP-REMOVE-1's other half):
+        // "new edits stop flowing either way" is a lie if the removed party's own daemon keeps
+        // admitting what still arrives from holders whose worker has not yet gated. TERMINAL — the
+        // sender's delivery settles instead of retrying at a door that will never open.
+        if (this.#d.standingOf(ownerAgentId, env.document_id, ownerAgentId) === "removed") {
+            this.#d.logger.warn("document.inbound.recipient_removed", {
+                documentId: env.document_id,
+                correlationId,
+            });
+            return {
+                ok: false,
+                reason: "document_recipient_removed",
+                terminal: true,
+                envelopeHash,
+                detail: "this daemon was removed from the document's arrangement — the local copy remains, " +
+                    "but new edits are no longer applied",
+            };
+        }
+        // 4b (SYNC-G1): the epoch-equality ruling and the current-state removed-sender check are
+        // GONE — both are the causal sender gate's job now, ruled at the envelope's signed
+        // frontier before anything else ran. (D7: the epoch stamp itself dies with this phase.)
+        // 5. The document must still ACCEPT — but for a document whose chain DERIVES, the ending
+        // ruling already happened at step 4 (R30: an ending in the envelope's own named ancestors
+        // refuses terminally; a frontier free of endings MUST be admitted, AC16 — the last edits
+        // before an agreed close are precisely the content the exchange still owes every holder,
+        // and the status column is a display projection that can lag the fold; review F1). Only a
+        // LEGACY document — no derivable chain, so no frontier to rule at — is judged by its stored
+        // status here, because for the pre-pivot bilateral record the column IS its ending.
+        if (senderHolders === null && (doc.status === "killed" || doc.status === "closed")) {
+            // TERMINAL, and for the same reason `document_stalled` below is NOT: these are DECISIONS.
+            // Nothing the sender does makes a killed or closed legacy document accept this envelope.
+            return {
+                ok: false,
+                reason: doc.status === "killed" ? "document_killed" : "document_closed",
+                terminal: true,
+                envelopeHash,
+                detail: doc.status === "killed"
+                    ? "this document was ended locally and no longer accepts updates"
+                    : "this document was closed by agreement and no longer accepts updates",
+            };
+        }
+        const accepts = this.#d.rejections.acceptsUpdates(ownerAgentId, env.document_id);
+        if (!accepts.ok) {
+            // The stall reason, composed by the unit that owns the stall. Reporting this envelope's own
+            // gate verdict instead would send an operator to the append-only rule for a document that has
+            // been frozen for days.
+            return { ok: false, reason: accepts.reason, detail: accepts.detail };
+        }
+        // 5. CHAIN. A redelivery is expected traffic and must still be answered.
+        // Hash-only. Reading the whole log meant materializing every payload BLOB on every inbound
+        // update, just to build a set for one membership test.
+        const known = this.#d.store.knownEnvelopeHashesBySender(ownerAgentId, env.document_id, env.sender_agent_id);
+        const head = this.#d.store.lastEnvelopeHashBySender(ownerAgentId, env.document_id, env.sender_agent_id);
+        let duplicate;
+        try {
+            duplicate = verifyDocumentChainLink(env, { head, known }).duplicate;
+        }
+        catch (err) {
+            const detail = extractErrorMessage(err);
+            this.#d.logger.warn("document.inbound.chain_refused", {
+                documentId: env.document_id,
+                correlationId,
+                detail,
+                // THE COMPARISON ITSELF, not just its verdict.
+                //
+                // The stall path was chased through three fixes on the strength of "the chain was refused",
+                // and each fix was reasoned about rather than measured. What was never printed is the only
+                // thing that decides it: the link the sender claimed, the head we were holding, and whether
+                // we had seen it before. A refusal that names its verdict and hides its inputs is why that
+                // took three rounds — the same shape as reading a log tail for an event that is emitted
+                // earlier, twice today.
+                claimedPrev: env.doc_prev_hash,
+                ourHead: head,
+                prevIsKnown: env.doc_prev_hash !== null && known.has(env.doc_prev_hash),
+                knownCount: known.size,
+            });
+            // MATCHED against the known set, not split on ":". This file explains sixty lines earlier why
+            // splitting an upstream message produces reason codes made of English prose — and the old
+            // `?? "document_chain_broken"` fallback mislabelled a FORK as a gap, which is precisely the
+            // distinction the envelope module went out of its way to create.
+            const reason = ["document_chain_forked", "document_chain_broken"].find((r) => detail.startsWith(r));
+            // A FORK IS TERMINAL; A GAP IS NOT. The distinction the envelope module went out of its way
+            // to create decides this too. A gap means the predecessor has not arrived YET, so redelivery
+            // is exactly the recovery path and the sender must keep trying. A fork means the sender
+            // chained onto something that is not our head and never was — our log is append-only, so
+            // there is no repair, and no number of redeliveries changes the answer.
+            //
+            // Left non-terminal, a fork walked to the unacked ceiling and surfaced as "Their client may
+            // not support shared documents yet" — an error naming the wrong subsystem entirely, for a
+            // condition the receiver had diagnosed precisely.
+            if (reason === "document_chain_forked") {
+                return { ok: false, reason, detail, terminal: true, envelopeHash };
+            }
+            return { ok: false, reason: reason ?? "document_chain_refused", detail };
+        }
+        if (duplicate) {
+            // ACK, and change nothing. Not acking would leave the sender retrying an envelope we already
+            // hold, forever; applying it again is unnecessary (Yjs is idempotent) and appending it again
+            // is refused by the store anyway.
+            this.#d.logger.info("document.inbound.duplicate", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                envelopeHash,
+                correlationId,
+            });
+            return { ok: true, admitted: true, envelopeHash, duplicate: true };
+        }
+        // 5b. ALREADY REJECTED? A rejected envelope's hash is deliberately never written to the log, so
+        // it is not in `known` and a redelivery is NOT a duplicate. Without this it re-ran the gate,
+        // was rejected again, and `reject()` minted a fresh nonce — advancing the retry round. Since
+        // MAX_REJECTED_ROUNDS is 3, a peer whose ACKS ARE BEING LOST — which is delivery's ordinary
+        // retry behaviour — permanently stalled the shared document in three attempts, with no
+        // hostility required. Hostile, it was a one-line denial of service.
+        //
+        // Re-answered with the RECORDED reason: the peer needs the same answer it was given before, so
+        // it supersedes rather than retries.
+        const alreadyRejected = this.#d.store
+            .listQuarantined(ownerAgentId, env.document_id)
+            .find((q) => q.rejectedEnvelopeHash === envelopeHash);
+        if (alreadyRejected) {
+            this.#d.logger.info("document.inbound.already_rejected", {
+                documentId: env.document_id,
+                envelopeHash,
+                correlationId,
+            });
+            return {
+                ok: true,
+                admitted: false,
+                envelopeHash,
+                rejectionReason: alreadyRejected.reason,
+                duplicate: false,
+            };
+        }
+        // 6. GATE — against the LIVE doc, which the gate itself trials on a copy.
+        const live = this.#d.liveDocFor(ownerAgentId, env.document_id);
+        const verdict = this.#d.gate.validate(live, env.update, {
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            // DERIVED from authenticated data, not from a seam nobody produces. ENVELOPE-1 puts
+            // `sender_client_id` inside the signed TBS precisely because "this envelope is where it is
+            // learned" — and the assembler was decoding it, verifying the signature over it, and then
+            // throwing it away, leaving rule (h) wired to a function with no implementation. Left as a
+            // seam it would default to wrong in whichever direction its implementer guessed: `[]`
+            // refuses every peer update, the union of everything observed admits anything.
+            //
+            // §14 forbids persisting a clientID for REUSE; recording which ones a peer has SIGNED for
+            // is the opposite — it is the binding the gate's rule exists to check.
+            senderClientIds: this.#boundClientIds(ownerAgentId, env),
+            declaredDocumentId: env.document_id,
+            declaredEncoding: env.update_encoding,
+            // THE PERSISTED PROPERTY, not a caller option defaulting to off. append_only is agreed at
+            // the handshake and stored on the row, and the gate's own header says it "is the only thing
+            // standing between a bound peer and erasure" — rule (h) provably cannot see a deletion.
+            // Taking it from an option meant a document configured append-only was unprotected unless
+            // every future call site remembered to pass the flag.
+            appendOnly: appendOnly(doc),
+            // The AGREED profile, from the same persisted row and for the same reason.
+            ...(typeof doc.properties.content_profile === "string"
+                ? { contentProfile: doc.properties.content_profile }
+                : {}),
+        }, nowMs);
+        if (!verdict.admit) {
+            // 7a. REJECT. The bytes are held, a 0x05 leaf references them, and the peer is ANSWERED —
+            // a rejection is an ack for delivery purposes, so the sender stops retrying and supersedes.
+            const rejection = await this.#d.rejections.reject(ownerAgentId, env.document_id, {
+                rejectedEnvelopeHash: envelopeHash,
+                quarantined: verdict.quarantined,
+                reason: verdict.reason,
+                detail: verdict.detail,
+                senderAgentId: env.sender_agent_id,
+                rejectedDocPrevHash: env.doc_prev_hash,
+                rule: verdict.rule,
+                limit: verdict.limit,
+                // The OWNER signs its own rejection, over the canonical preimage (DOD-DOC-REJECT-2).
+                sign: (tbs) => this.#d.sign(ownerAgentId, tbs),
+                nowMs,
+            });
+            return {
+                ok: true,
+                admitted: false,
+                envelopeHash,
+                // The signed refusal, for the caller to transmit. Absent on a duplicate — we already told
+                // them once, and re-sending would advance their round counter for a retry that never
+                // happened, driving the document to `stalled` early.
+                ...(rejection.wire ? { rejectionWire: rejection.wire } : {}),
+                rejectionReason: verdict.reason,
+                duplicate: false,
+            };
+        }
+        // 7a-bis. THE SEMANTIC SCREEN, on the text the update WOULD produce.
+        //
+        // Placed here and nowhere else for two reasons. The shadow is inert — nothing in it can reach
+        // the operator or their agent until the admit below — so this is the last moment the content is
+        // both READABLE and harmless. And the gate's `validate` is synchronous while the gateway is a
+        // separate program, so the call cannot live inside a rule.
+        //
+        // Only the INSERTED text is screened. A deletion carries no new content, and re-screening the
+        // whole document would refuse a peer's edit for prose that was already admitted days ago.
+        const semantic = this.#d.screenProjected && verdict.projectedDiff.inserted.length > 0
+            ? await this.#d.screenProjected(verdict.projectedDiff.inserted, {
+                ownerAgentId,
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                ...(correlationId !== undefined ? { correlationId } : {}),
+            })
+            : null;
+        if (semantic?.block === true) {
+            // REFUSED, NOT REWRITTEN, and the bytes are HELD — the same treatment every other refusal
+            // gets, so the peer's chain stays bridgeable and they are told once, by name.
+            const rejection = await this.#d.rejections.reject(ownerAgentId, env.document_id, {
+                rejectedEnvelopeHash: envelopeHash,
+                // COPIED, and copied BEFORE the awaits above. The caller's buffer may be a pooled network
+                // read; `reject()` copies too, but by then a gateway round trip and a signing call have
+                // both happened, and DOD-DOC-REJECT-1 would hash bytes that are no longer the ones refused
+                // — into a 0x05 leaf, silently. The gate's own quarantine copies for this reason.
+                quarantined: new Uint8Array(env.update),
+                reason: "document_content_injection",
+                // WHICH screen refused. Dropping it leaves an operator unable to see what ruled, which is
+                // exactly what document-rejection.ts's header says a refusal must never do.
+                rule: SEMANTIC_RULE_ID,
+                ...(semantic.reason !== undefined ? { detail: semantic.reason } : {}),
+                senderAgentId: env.sender_agent_id,
+                rejectedDocPrevHash: env.doc_prev_hash,
+                sign: (tbs) => this.#d.sign(ownerAgentId, tbs),
+                nowMs,
+            });
+            this.#d.logger.warn("document.inbound.injection_refused", {
+                documentId: env.document_id,
+                senderAgentId: env.sender_agent_id,
+                envelopeHash,
+                reason: semantic.reason,
+                correlationId,
+            });
+            return {
+                ok: true,
+                admitted: false,
+                envelopeHash,
+                ...(rejection.wire ? { rejectionWire: rejection.wire } : {}),
+                rejectionReason: "document_content_injection",
+                duplicate: false,
+            };
+        }
+        // 7b. ADMIT. The log first, then the live document: an update applied but not logged is one
+        // the operator can read and cannot rebuild, and a rebuild is how the document survives a
+        // restart. The other order loses content; this order at worst repeats an idempotent apply.
+        this.#d.store.appendEnvelope(ownerAgentId, {
+            envelopeHash,
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            docPrevHash: env.doc_prev_hash,
+            governanceParents: [...env.governance_parents],
+            signature: env.signature,
+            stateVector: env.state_vector,
+            payload: env.update,
+            kind: "update",
+            referencesEnvelopeHash: null,
+            // Recorded so the authorship binding for this peer is derived from what they SIGNED, not
+            // from a seam somebody has to remember to implement.
+            senderClientId: env.sender_client_id,
+            createdAtMs: nowMs,
+        });
+        this.#d.engine.applyUpdateOrThrow(live, env.update);
+        // §3.2 step 4: admit AND CLEAR THE QUARANTINE. This is the supersession closing — the held
+        // bytes are released, the chain bridge stub for the superseded envelope goes with them, and
+        // `document.supersession.admitted` finally has a producer. Without it the entries stayed held
+        // forever and the event was a name with nothing behind it.
+        if (env.doc_prev_hash !== null) {
+            this.#d.rejections.clearQuarantine(ownerAgentId, env.document_id, env.doc_prev_hash);
+        }
+        this.#d.logger.info("document.inbound.admitted", {
+            documentId: env.document_id,
+            senderAgentId: env.sender_agent_id,
+            envelopeHash,
+            correlationId,
+        });
+        return { ok: true, admitted: true, envelopeHash, duplicate: false };
+    }
+}
+//# sourceMappingURL=document-inbound.js.map

package/dist/document-inbound.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-inbound.js","sourceRoot":"","sources":["../src/document-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAyGzD,iFAAiF;AACjF,SAAS,UAAU,CAAC,GAAuC;IACzD,OAAO,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,EAAE,CAAsB;IAEjC,YAAY,IAAyB;QACnC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAoB,EAAE,GAA2B;QAC/D,OAAO;YACL,GAAG,IAAI,GAAG,CAAS;gBACjB,GAAG,CAAC,gBAAgB;gBACpB,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC;aACxF,CAAC;SACH,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,YAAoB,EACpB,IAAgB,EAChB,KAAa,EACb,aAAa,GAAG,SAAS;QAEzB,aAAa;QACb,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YAC7E,8FAA8F;YAC9F,yFAAyF;YACzF,sFAAsF;YACtF,4FAA4F;YAC5F,8FAA8F;YAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE/C,mEAAmE;QACnE,EAAE;QACF,gGAAgG;QAChG,6FAA6F;QAC7F,gGAAgG;QAChG,EAAE;QACF,6FAA6F;QAC7F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,EAAE;QACF,+FAA+F;QAC/F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE;gBACzD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EACJ,oCAAoC,GAAG,CAAC,eAAe,8BAA8B;oBACrF,kDAAkD;aACrD,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,6FAA6F;YAC7F,2FAA2F;YAC3F,6FAA6F;YAC7F,kFAAkF;YAClF,EAAE;YACF,2FAA2F;YAC3F,4FAA4F;YAC5F,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB;aACtE,CAAC;QACJ,CAAC;QAED,0FAA0F;QAC1F,wFAAwF;QACxF,0FAA0F;QAC1F,wBAAwB;QACxB,4FAA4F;QAC5F,2FAA2F;QAC3F,6EAA6E;QAC7E,2FAA2F;QAC3F,uFAAuF;QACvF,0FAA0F;QAC1F,wFAAwF;QACxF,2FAA2F;QAC3F,yFAAyF;QACzF,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,aAAsB,CAAC;QAC3B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,oFAAoF;YACpF,yFAAyF;YACzF,uFAAuF;YACvF,qEAAqE;YACrE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBACrD,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,gFAAgF;wBAChF,sDAAsD;iBACzD,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,gBAAgB,CACjC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,kBAAkB,CACtD,CAAC;YACF,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACX,+EAA+E;gBAC/E,6EAA6E;gBAC7E,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;oBAC3D,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE;oBACzB,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,+BAA+B;oBACvC,YAAY;oBACZ,MAAM,EACJ,yEAAyE;wBACzE,2DAA2D;iBAC9D,CAAC;YACJ,CAAC;YACD,uFAAuF;YACvF,yFAAyF;YACzF,2DAA2D;YAC3D,IAAI,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBAC5D,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,gCAAgC;oBACxC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,yEAAyE;wBACzE,GAAG,EAAE,CAAC,KAAK,iEAAiE;iBAC/E,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,uFAAuF;YACvF,2FAA2F;YAC3F,0FAA0F;YAC1F,wEAAwE;YACxE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;oBACrD,UAAU,EAAE,GAAG,CAAC,WAAW;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;oBAClC,aAAa;iBACd,CAAC,CAAC;gBACH,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,IAAI;oBACd,YAAY;oBACZ,MAAM,EACJ,gFAAgF;wBAChF,sDAAsD;iBACzD,CAAC;YACJ,CAAC;YACD,wFAAwF;YACxF,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,0BAA0B;gBAClC,0FAA0F;gBAC1F,qFAAqF;gBACrF,uCAAuC;gBACvC,EAAE;gBACF,uFAAuF;gBACvF,yFAAyF;gBACzF,yFAAyF;gBACzF,mFAAmF;gBACnF,+DAA+D;gBAC/D,MAAM,EAAE,sCAAsC;aAC/C,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,gFAAgF;QAChF,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YAClF,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACxD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EACJ,oFAAoF;oBACpF,qCAAqC;aACxC,CAAC;QACJ,CAAC;QAED,yFAAyF;QACzF,mFAAmF;QACnF,wFAAwF;QACxF,yFAAyF;QACzF,0FAA0F;QAC1F,yFAAyF;QACzF,yFAAyF;QACzF,0FAA0F;QAC1F,4FAA4F;QAC5F,oFAAoF;QACpF,IAAI,aAAa,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnF,0FAA0F;YAC1F,yFAAyF;YACzF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB;gBACvE,QAAQ,EAAE,IAAI;gBACd,YAAY;gBACZ,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,QAAQ;oBACrB,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,qEAAqE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,4FAA4F;YAC5F,8FAA8F;YAC9F,wBAAwB;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,yEAAyE;QACzE,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CACrD,YAAY,EACZ,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,eAAe,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACxG,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,uBAAuB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;QACtE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACpD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa;gBACb,MAAM;gBACN,+CAA+C;gBAC/C,EAAE;gBACF,4FAA4F;gBAC5F,2FAA2F;gBAC3F,4FAA4F;gBAC5F,2FAA2F;gBAC3F,wFAAwF;gBACxF,wBAAwB;gBACxB,WAAW,EAAE,GAAG,CAAC,aAAa;gBAC9B,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;gBACvE,UAAU,EAAE,KAAK,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,8FAA8F;YAC9F,0FAA0F;YAC1F,4FAA4F;YAC5F,iEAAiE;YACjE,MAAM,MAAM,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3E,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CACrB,CAAC;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,yFAAyF;YACzF,wEAAwE;YACxE,EAAE;YACF,4FAA4F;YAC5F,0FAA0F;YAC1F,kDAAkD;YAClD,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;gBACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,wBAAwB,EAAE,MAAM,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,6FAA6F;YAC7F,6FAA6F;YAC7F,kCAAkC;YAClC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAChD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrE,CAAC;QAED,gGAAgG;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,4FAA4F;QAC5F,uFAAuF;QACvF,oEAAoE;QACpE,EAAE;QACF,+FAA+F;QAC/F,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK;aAClC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC;aAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,YAAY,CAAC,CAAC;QACxD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACvD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,eAAe,EAAE,eAAe,CAAC,MAAM;gBACvC,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CACnC,IAAI,EACJ,GAAG,CAAC,MAAM,EACV;YACE,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,oFAAoF;YACpF,2FAA2F;YAC3F,0FAA0F;YAC1F,2FAA2F;YAC3F,sFAAsF;YACtF,+EAA+E;YAC/E,EAAE;YACF,0FAA0F;YAC1F,uEAAuE;YACvE,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC;YACxD,kBAAkB,EAAE,GAAG,CAAC,WAAW;YACnC,gBAAgB,EAAE,GAAG,CAAC,eAAe;YACrC,0FAA0F;YAC1F,4FAA4F;YAC5F,wFAAwF;YACxF,0FAA0F;YAC1F,sDAAsD;YACtD,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC;YAC3B,2EAA2E;YAC3E,GAAG,CAAC,OAAO,GAAG,CAAC,UAAU,CAAC,eAAe,KAAK,QAAQ;gBACpD,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE;gBACpD,CAAC,CAAC,EAAE,CAAC;SACR,EACD,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,0FAA0F;YAC1F,4FAA4F;YAC5F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC/E,oBAAoB,EAAE,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,mBAAmB,EAAE,GAAG,CAAC,aAAa;gBACtC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,qFAAqF;gBACrF,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;gBAC9C,KAAK;aACN,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,0FAA0F;gBAC1F,qFAAqF;gBACrF,qDAAqD;gBACrD,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,eAAe,EAAE,OAAO,CAAC,MAAM;gBAC/B,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,EAAE;QACF,8FAA8F;QAC9F,gGAAgG;QAChG,8FAA8F;QAC9F,2DAA2D;QAC3D,EAAE;QACF,8FAA8F;QAC9F,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACnF,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE;gBAC5D,YAAY;gBACZ,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,QAAQ,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7B,0FAA0F;YAC1F,8EAA8E;YAC9E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC/E,oBAAoB,EAAE,YAAY;gBAClC,0FAA0F;gBAC1F,wFAAwF;gBACxF,2FAA2F;gBAC3F,kFAAkF;gBAClF,WAAW,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;gBACvC,MAAM,EAAE,4BAA4B;gBACpC,0FAA0F;gBAC1F,4EAA4E;gBAC5E,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,mBAAmB,EAAE,GAAG,CAAC,aAAa;gBACtC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC;gBAC9C,KAAK;aACN,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACxD,UAAU,EAAE,GAAG,CAAC,WAAW;gBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;gBAClC,YAAY;gBACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,aAAa;aACd,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,KAAK;gBACf,YAAY;gBACZ,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,eAAe,EAAE,4BAA4B;gBAC7C,SAAS,EAAE,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,4FAA4F;QAC5F,yFAAyF;QACzF,2FAA2F;QAC3F,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YACzC,YAAY;YACZ,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,WAAW,EAAE,GAAG,CAAC,aAAa;YAC9B,iBAAiB,EAAE,CAAC,GAAG,GAAG,CAAC,kBAAkB,CAAC;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,OAAO,EAAE,GAAG,CAAC,MAAM;YACnB,IAAI,EAAE,QAAQ;YACd,sBAAsB,EAAE,IAAI;YAC5B,yFAAyF;YACzF,qDAAqD;YACrD,cAAc,EAAE,GAAG,CAAC,gBAAgB;YACpC,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpD,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,2DAA2D;QAC3D,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;YAC/C,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,aAAa,EAAE,GAAG,CAAC,eAAe;YAClC,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;CACF"}