@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/document-rejection.js

@@ -0,0 +1,435 @@
+/**
+ * DOD-DOC-REJECT-1 — rejection and supersession (§3.2, §16.7-2).
+ *
+ * ── WHY SUPERSESSION, AND NOT "BOTH SIDES ROLL BACK" ──────────────────────────────────────────
+ *
+ * The naive protocol is: the receiver discards, the sender undoes locally, and both return to the
+ * pre-update state. It does not work, and the reason is a property of CRDTs rather than a bug.
+ *
+ * **Yjs undo adds INVERSES; it does not erase.** The rejected operations stay in the sender's
+ * document. So every later update the sender computes against the receiver's state vector
+ * re-transmits them, and the receiver — which refuses to hold them — can never integrate the
+ * legitimate work stacked causally on top, because Yjs will not apply operations whose
+ * predecessors are missing. A permanent causal gap, from a protocol that looked symmetric.
+ *
+ * The protocol that works (§3.2):
+ *   1. The receiver rejects with a REASON — a protocol message and its own `0x05` leaf, never a
+ *      silent drop. The update goes to quarantine, held rather than discarded.
+ *   2. The sender rolls back locally, which emits inverses into its own log and leaves an
+ *      auditable "wrote X, was rejected, undid X" trail.
+ *   3. The sender publishes a SUPERSEDING update against the receiver's state vector, which
+ *      necessarily carries the rejected operations PLUS their inverses plus any new work.
+ *   4. The receiver validates the now-clean projected diff — the rejected content nets to zero —
+ *      admits it, and clears the quarantine. Causality intact, both parties converge, and the
+ *      rejected content survives only as inert tombstones.
+ *
+ * ── SCOPE ─────────────────────────────────────────────────────────────────────────────────────
+ *
+ * This proves the protocol against STORE-1's local envelope log. The CBOR wire encoding is
+ * DOD-DOC-ENVELOPE-1's job and the cross-daemon proof is DOD-DOC-E2E-REJECT-1's.
+ */
+import * as Y from "yjs";
+import { buildDocumentRejectionTbs, documentRejectionHash, encodeDocumentRejection, DOCUMENT_REJECTION_VERSION, } from "@cello-protocol/protocol-types";
+/**
+ * The document stalls on the THIRD rejected round: the original refusal, one superseding attempt,
+ * and no more (§16.7-2 "one retry, then freeze").
+ *
+ * Counted in rounds rather than retries because the previous spelling — a `REJECTION_RETRY_LIMIT`
+ * of 1 compared as `round > LIMIT + 1` — permitted two retries under a name that said one, which
+ * is the kind of thing the next edit gets wrong.
+ *
+ * Bounded at all because an unbounded retry loop between two daemons that disagree is not
+ * convergence, it is a hot loop neither operator can see. Stalling is the visible failure.
+ */
+export const MAX_REJECTED_ROUNDS = 3;
+/**
+ * The placeholder `state_vector` a rejection row carries.
+ *
+ * ONE ZERO BYTE, not an empty array. See the call site for why: SQLCipher binds a zero-length blob
+ * as NULL and the column is NOT NULL, so an empty vector throws on the driver production uses and
+ * on no driver the tests use. The value is meaningless by design — a rejection has no state vector —
+ * and it is named rather than inlined so nobody "tidies" it back to `new Uint8Array(0)`.
+ */
+export const REJECTION_STATE_VECTOR = new Uint8Array([0]);
+export class DocumentRejections {
+    #store;
+    #logger;
+    constructor(store, logger) {
+        this.#store = store;
+        this.#logger = logger;
+    }
+    /**
+     * Record a rejection: a `0x05` row referencing the rejected envelope, the quarantined bytes
+     * held, and a policy record carrying the reason.
+     *
+     * The envelope log is append-only, so this is a NEW ROW — nothing is edited or removed.
+     *
+     * ── HOW A REFUSAL IS ACTUALLY REALIZED, AND WHY NOT THE WAY §9 SAYS ─────────────────────────
+     *
+     * §9 phrases effectiveness as a replay-time set property: "an update leaf is effective iff no
+     * rejection leaf references it". Implemented literally that is unsound, and it was measured
+     * rather than argued. Sender publishes a base, then a refused update, then rolls back and
+     * supersedes. Replaying the log while SKIPPING the refused leaf gives:
+     *
+     *     text "agreed base. "   pendingStructs PRESENT   pendingDs PRESENT
+     *
+     * The supersession is causally stacked on the refused operations — the rollback is a DELETION of
+     * those structs and the new work is positioned after them — so dropping them leaves everything
+     * later permanently pending. The document reads as complete and is silently missing the
+     * legitimate work. §16.7-5 already retired §9's "document-log order" phrasing; this retires its
+     * effectiveness phrasing on the same grounds.
+     *
+     * What is sound: the receiver NEVER WRITES the refused payload to its log. There is nothing to
+     * subtract at replay because it was never added, and the peer's supersession — computed against
+     * the RECEIVER's state vector per §3.2 step 3 — is self-contained. Measured on the same fixture:
+     *
+     *     text "agreed base. clean text. "   pendingStructs null   pendingDs null   converged true
+     *
+     * The refused bytes do travel again inside that supersession, carrying their own inverses, which
+     * is precisely "inverses, not erasure" (§3.2) — the content nets to zero and survives only as
+     * tombstones. The bytes we refused live in `document_quarantine`, and the chain bridges across
+     * the refused envelope so the peer's next link still resolves (see `verifyChainLinkage`).
+     */
+    async reject(agentId, documentId, input) {
+        // THE SIGNED PREIMAGE (DOD-DOC-REJECT-2). Until it existed, this method took a `signature` from
+        // its caller with nothing defining what that signature was OVER — so it could only ever be
+        // filled dishonestly, which is what writing the composition-root signer proved. The rejection
+        // is now built, signed, and its LEAF HASH derived from the same preimage: the leaf commits to
+        // exactly the bytes whose signature was verified.
+        // DUPLICATE DETECTION MOVED UP FRONT. It used to fall out of the leaf hash colliding, because
+        // that hash was sha256(envelope + reason + nonce) and a caller reusing the nonce produced the
+        // same row. The real preimage binds the ROUND and the TIMESTAMP, so two rejections of the same
+        // envelope for the same reason now hash differently and would each advance the round — driving
+        // a document to `stalled` on retries that never happened. The check has to be on what makes a
+        // rejection the SAME rejection: this envelope, refused for this reason, by us.
+        const already = this.#store
+            .listQuarantined(agentId, documentId)
+            .find((q) => q.rejectedEnvelopeHash === input.rejectedEnvelopeHash && q.reason === input.reason);
+        if (already) {
+            this.#logger.warn("document.rejection.duplicate", {
+                documentId,
+                rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+                reason: input.reason,
+            });
+            return {
+                stalled: this.#isStalled(agentId, documentId),
+                round: this.#round(agentId, documentId),
+            };
+        }
+        const round = this.#round(agentId, documentId) + 1;
+        const envelope = {
+            type: "document_rejection",
+            rejection_version: DOCUMENT_REJECTION_VERSION,
+            document_id: documentId,
+            rejected_envelope_hash: input.rejectedEnvelopeHash,
+            rejecting_agent_id: agentId,
+            reason: input.reason,
+            ...(input.detail === undefined ? {} : { detail: input.detail }),
+            round,
+            rejected_at_ms: input.nowMs,
+            signature: new Uint8Array(0),
+        };
+        envelope.signature = await input.sign(buildDocumentRejectionTbs(envelope));
+        // CHAIN IT. Writing `docPrevHash: null` made every rejection a second GENESIS row for this
+        // agent, so two rejections forked the chain — and the retry protocol guarantees at least two
+        // before a stall. `verifyChainLinkage` then refuses, and since `rebuildSnapshot` is how a
+        // document survives a restart, the document rebuilt until the next daemon start and was
+        // permanently unopenable after it. Measured. A rejection is this agent's own authored act, so
+        // it belongs in this agent's own chain.
+        const rejectionEnvelopeHash = documentRejectionHash(envelope);
+        const appended = this.#store.appendEnvelope(agentId, {
+            envelopeHash: rejectionEnvelopeHash,
+            documentId,
+            senderAgentId: agentId, // WE authored the rejection, whoever authored the update
+            docPrevHash: this.#store.lastEnvelopeHashBySender(agentId, documentId, agentId),
+            governanceParents: [],
+            signature: envelope.signature,
+            // A ONE-BYTE PLACEHOLDER, and it has to be — an empty blob here THREW on the real driver.
+            //
+            // A rejection asserts nothing about document state, so the honest value is empty, and that is
+            // what this was. `node:sqlite` (every unit test) binds a zero-length blob as an empty blob;
+            // `@signalapp/sqlcipher` (production) binds it as NULL, which violates
+            // `state_vector BLOB NOT NULL` and throws INSIDE this method — before the quarantine is
+            // written, before the refusal is signed, before the peer is answered.
+            //
+            // The cost of that was the whole stall path: the receiver held nothing from the sender, so
+            // `knownEnvelopeHashesBySender` returned an empty set and every later envelope was refused
+            // `document_chain_broken` forever. One gate refusal permanently broke the document. Four
+            // fixes reasoned about the chain-bridging logic, which was correct throughout; the row simply
+            // never existed. Pinned by `document-rejection-sqlcipher.test.ts`, which runs on the real
+            // driver precisely because a `node:sqlite` test cannot see this by construction.
+            //
+            // NOT relaxed to a nullable column, which would be the truer schema: SQLCipher is SQLite
+            // 3.50.4 and SQLite has never supported dropping NOT NULL in place, so it means a full table
+            // rebuild against operators' live document logs — a heavier risk than a documented byte.
+            stateVector: REJECTION_STATE_VECTOR,
+            payload: null, // an audit record carries no content
+            kind: "rejection",
+            referencesEnvelopeHash: input.rejectedEnvelopeHash,
+            createdAtMs: input.nowMs,
+        });
+        if (!appended) {
+            // The store tells callers whether a row was written precisely so this is not inferred. A
+            // duplicate must not advance the retry round, or a document reaches `stalled` with fewer
+            // rejection leaves than rounds and an auditor replaying the log cannot see why.
+            this.#logger.warn("document.rejection.duplicate", {
+                documentId,
+                rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+                reason: input.reason,
+            });
+            return { stalled: this.#isStalled(agentId, documentId), round: this.#round(agentId, documentId) };
+        }
+        // PERSISTED, not remembered. The 0x05 leaf references these bytes; holding them in a Map
+        // meant the reference outlived the thing it referenced across a restart.
+        const held = this.#store.holdQuarantined(agentId, {
+            documentId,
+            rejectionEnvelopeHash,
+            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+            // The refused envelope's own author and chain link, so `verifyChainLinkage` can bridge it —
+            // the peer chains its supersession onto an envelope our log deliberately never holds.
+            rejectedSenderAgentId: input.senderAgentId,
+            rejectedDocPrevHash: input.rejectedDocPrevHash,
+            // COPY: the caller's buffer may be a pooled network read, and a 0x05 leaf must reference
+            // the bytes that were actually refused.
+            payload: new Uint8Array(input.quarantined),
+            reason: input.reason,
+            detail: input.detail,
+            // The gate produces these deliberately; dropping them leaves an operator unable to see
+            // WHICH rule refused or WHAT number was exceeded.
+            rule: input.rule,
+            limitName: input.limit?.name,
+            limitValue: input.limit?.limit,
+            limitActual: input.limit?.actual,
+            // SYNC-R35: the EXACT signed frame, kept so the refusal travels by the ordinary exchange —
+            // a third holder wedged behind this hole can only learn its name and reason from us.
+            rejectionWire: new Uint8Array(encodeDocumentRejection(envelope)),
+            createdAtMs: input.nowMs,
+        });
+        if (!held) {
+            // Cannot happen while the leaf hash is unique per rejection, which the append above already
+            // established. Logged rather than assumed: the previous key silently dropped every round
+            // after the first, and the way that stayed invisible was precisely that nothing said so.
+            this.#logger.error("document.rejection.quarantine_not_written", {
+                documentId,
+                rejectionEnvelopeHash,
+                rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+            });
+        }
+        // The policy record — on BOTH sides, per §3.2. This is the sending half; the receiving half
+        // is written when a rejection arrives.
+        this.#logger.warn("document.rejection.sent", {
+            documentId,
+            senderAgentId: input.senderAgentId,
+            reason: input.reason,
+            detail: input.detail,
+            // Carried, not merely stored: an operator asking "why was this refused" needs the rule and
+            // the number, and a column no surface reads is a column that is not there.
+            rule: input.rule,
+            limitName: input.limit?.name,
+            limitValue: input.limit?.limit,
+            limitActual: input.limit?.actual,
+            round,
+        });
+        const stalled = round >= MAX_REJECTED_ROUNDS;
+        const alreadyStalled = this.#store.getDocument(agentId, documentId)?.status === "stalled";
+        if (stalled && !alreadyStalled) {
+            this.#store.setDocumentStatus(agentId, documentId, "stalled");
+            // Once, not on every subsequent refusal — a stalled document that keeps shouting is noise
+            // an operator learns to filter.
+            this.#logger.error("document.stalled", {
+                documentId,
+                reason: input.reason,
+                detail: input.detail,
+                rounds: round,
+            });
+        }
+        // The bytes go back to the caller so the peer can actually be told. See `RejectionOutcome.wire`.
+        return { stalled, round, wire: encodeDocumentRejection(envelope) };
+    }
+    /**
+     * Record a rejection ARRIVING from the peer — the receiving half of §3.2's "both sides".
+     *
+     * ── THE ROUTING DECISION (the DoD requires it resolved in-unit) ─────────────────────────────
+     *
+     * A document rejection is written **daemon-side**, into this document's own log and quarantine,
+     * NOT through the gateway record store's `source` discriminator.
+     *
+     * The gateway's record store exists for SCREENING verdicts, and most V1 rejection reasons are
+     * not screening at all — `append_only`, the receiver-local limits, malformed updates, unresolved
+     * dependencies. Routing every document rejection through a screening store would file structural
+     * protocol events as policy verdicts, and it would couple this unit to a schema owned by a
+     * component that is not involved. DOD-DOC-SCREEN-1 is parked, so that coupling would also have
+     * to be built speculatively and unwound if screening lands differently.
+     *
+     * When SCREEN-1 does land, a rejection whose reason came from the screening rule can ADDITIONALLY
+     * write a gateway record — the discriminator exists for exactly that, and adding it later costs
+     * nothing, whereas removing a premature coupling costs a migration.
+     */
+    recordIncomingRejection(agentId, documentId, input) {
+        // DURABLE, not a log line. Everything the PUBLISHING operator needs depends on this surviving
+        // a restart: why their work was refused, and how many rounds remain before the document
+        // stalls. It also has to exist for the retry bound to bind at all — the round was counted from
+        // rejections this agent AUTHORED, which on a pure publisher is zero forever, so the loop the
+        // limit exists to stop was the one side that had no limit.
+        const written = this.#store.recordRejectionReceived(agentId, {
+            documentId,
+            rejectionEnvelopeHash: input.rejectionEnvelopeHash,
+            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+            fromAgentId: input.fromAgentId,
+            reason: input.reason,
+            detail: input.detail,
+            createdAtMs: Date.now(),
+        });
+        const round = this.#store.countRejectionsReceived(agentId, documentId);
+        if (!written) {
+            this.#logger.warn("document.rejection.received_duplicate", {
+                documentId,
+                rejectionEnvelopeHash: input.rejectionEnvelopeHash,
+                round,
+            });
+            return { stalled: this.#isStalled(agentId, documentId), round };
+        }
+        this.#logger.warn("document.rejection.received", {
+            documentId,
+            fromAgentId: input.fromAgentId,
+            rejectedEnvelopeHash: input.rejectedEnvelopeHash,
+            reason: input.reason,
+            detail: input.detail,
+            round,
+        });
+        // The publisher stops superseding on the same threshold the receiver stops accepting on. Two
+        // sides of one bound: without this, the receiver freezes and the sender keeps retrying into a
+        // document that will never take it.
+        const stalled = round >= MAX_REJECTED_ROUNDS;
+        if (stalled && !this.#isStalled(agentId, documentId)) {
+            this.#store.setDocumentStatus(agentId, documentId, "stalled");
+            this.#logger.error("document.stalled", {
+                documentId,
+                reason: input.reason,
+                detail: input.detail,
+                rounds: round,
+                side: "publisher",
+            });
+        }
+        return { stalled, round };
+    }
+    /** Entries held for this document — never admitted, never discarded (§3.2). From the store. */
+    quarantined(agentId, documentId) {
+        return this.#store.listQuarantined(agentId, documentId).map((r) => ({
+            rejectedEnvelopeHash: r.rejectedEnvelopeHash,
+            quarantined: r.payload,
+            reason: r.reason,
+            detail: r.detail,
+            rule: r.rule,
+            limitName: r.limitName,
+            limitValue: r.limitValue,
+            limitActual: r.limitActual,
+            rejectionWire: r.rejectionWire,
+        }));
+    }
+    /** Clear one entry once its superseding update has been admitted (§3.2 step 4). */
+    clearQuarantine(agentId, documentId, rejectedEnvelopeHash) {
+        // Only announce an admission that actually happened — an event that fires on a no-op is a
+        // signal on the wrong case.
+        if (this.#store.releaseQuarantined(agentId, documentId, rejectedEnvelopeHash)) {
+            this.#logger.info("document.supersession.admitted", { documentId, rejectedEnvelopeHash });
+        }
+    }
+    /**
+     * Whether this document still accepts updates.
+     *
+     * A stalled document REFUSES, naming the reason it stalled — both operators need to see why,
+     * because a document that silently stops converging is the failure this exists to prevent.
+     */
+    acceptsUpdates(agentId, documentId) {
+        // Read the STORE, not memory. The status was persisted while the flag that gated this check
+        // was not, so after a restart the document row said `stalled` while the daemon happily
+        // accepted updates on it — the system reporting two contradictory states at once.
+        if (this.#isStalled(agentId, documentId)) {
+            const held = this.#store.listQuarantined(agentId, documentId);
+            const last = held[held.length - 1];
+            return {
+                ok: false,
+                reason: "document_stalled",
+                detail: `this document stopped accepting updates after ` +
+                    `${this.#round(agentId, documentId)} rejected rounds` +
+                    (last ? `; the most recent reason was ${last.reason}` : ""),
+            };
+        }
+        return { ok: true };
+    }
+    /**
+     * Start tracking local edits so a rejection can be rolled back.
+     *
+     * Yjs's own UndoManager, deliberately: rolling back by hand would mean computing inverses, and
+     * the inverse of a CRDT operation is not something to hand-roll — the whole reason supersession
+     * works is that Yjs's undo produces operations that compose correctly with everything stacked
+     * on top of them.
+     */
+    trackLocalEdits(doc) {
+        // The two roots this codebase's write path projects from, taken through their TYPED getters.
+        //
+        // Not the `doc.share` placeholders: `doc.get(name)` hands back the untyped AbstractType, and
+        // the typed getter later instantiates a DIFFERENT object — so the UndoManager would watch a
+        // root nobody edits and `undo()` would silently do nothing. Caught by the out-of-order guard
+        // below, which is the guard earning its keep on its first outing.
+        //
+        // Instantiating these two as Text and Map is not the guessed-type hazard GATE-1 measured:
+        // the write path DEFINES them as Text and Map. A document that puts content under any other
+        // root is not tracked here, and that is a real gap — recorded rather than papered over,
+        // because it belongs with whichever unit lets a document declare its own roots.
+        const undoManager = new Y.UndoManager([doc.getText("content"), doc.getMap("data")], {
+            captureTimeout: 0,
+        });
+        return {
+            doc,
+            undoManager,
+            depthAtTracking: undoManager.undoStack.length,
+            dispose: () => undoManager.destroy(),
+        };
+    }
+    /**
+     * Roll back the last tracked edit, as INVERSES.
+     *
+     * The sender's history grows rather than shrinking. That is not a limitation to work around: it
+     * is what leaves an auditable "wrote X, was rejected, undid X" trail, and what lets the
+     * superseding update carry the rejected operations plus their inverses so causality survives.
+     *
+     * **PRECONDITION: roll back before making further local edits.** Yjs's UndoManager undoes the
+     * most recent stack item, and it cannot undo one out of order — so a sender that keeps editing
+     * after a rejection arrives and then rolls back would undo the WRONG transaction. §3.2's
+     * ordering is steps 2 then 3 for exactly this reason: roll back, THEN do new work, THEN
+     * publish the supersession that carries all three. A caller that needs to interleave has a
+     * genuine design question, not a call-order detail, and it belongs in the unit that wires
+     * publish to the receive path.
+     */
+    rollback(tracked) {
+        // REFUSE rather than undo the wrong thing. Measured, the unguarded version had three failure
+        // modes that all reported success: nothing tracked (silent no-op), an untracked root (silent
+        // no-op), and — the damaging one — a sender that kept editing after the rejection arrived,
+        // where undo removed the agent's LEGITIMATE later work and KEPT the refused content. The
+        // supersession then re-ships the refused bytes, is rejected again, and the document stalls
+        // with a reason pointing at the peer while the operator's writing is gone.
+        const depth = tracked.undoManager.undoStack.length;
+        if (depth !== tracked.depthAtTracking + 1) {
+            throw new Error(`document_rollback_out_of_order: ${depth - tracked.depthAtTracking} local edit(s) are ` +
+                `stacked since tracking began, and Yjs can only undo the most recent — rolling back now ` +
+                `would discard the wrong work. Roll back before making further local edits (§3.2 step 2).`);
+        }
+        if (tracked.undoManager.undo() === null) {
+            throw new Error("document_rollback_nothing_tracked: no tracked edit to roll back — the rejected update " +
+                "was not produced through this tracker");
+        }
+    }
+    /** Derived from the log, not remembered — so it survives a restart. */
+    #round(agentId, documentId) {
+        // Scoped to the rejections THIS agent authored. A mutual exchange puts both directions' 0x05
+        // leaves in one document log, so an unscoped count conflated them and a document stalled at
+        // half the intended rounds the moment the peer also rejected something.
+        return this.#store.countRejections(agentId, documentId, agentId);
+    }
+    #isStalled(agentId, documentId) {
+        return this.#store.getDocument(agentId, documentId)?.status === "stalled";
+    }
+}
+//# sourceMappingURL=document-rejection.js.map

package/dist/document-rejection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-rejection.js","sourceRoot":"","sources":["../src/document-rejection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,GAE3B,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAyFrC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1D,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAgB;IACtB,OAAO,CAAS;IAEzB,YAAY,KAAoB,EAAE,MAAc;QAC9C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,UAAkB,EAAE,KAAqB;QACrE,gGAAgG;QAChG,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,kDAAkD;QAClD,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,8FAA8F;QAC9F,+EAA+E;QAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM;aACxB,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,KAAK,KAAK,CAAC,oBAAoB,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QACnG,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAChD,UAAU;gBACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC;gBAC7C,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;aACxC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,QAAQ,GAA8B;YAC1C,IAAI,EAAE,oBAAoB;YAC1B,iBAAiB,EAAE,0BAA0B;YAC7C,WAAW,EAAE,UAAU;YACvB,sBAAsB,EAAE,KAAK,CAAC,oBAAoB;YAClD,kBAAkB,EAAE,OAAO;YAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;SAC7B,CAAC;QACF,QAAQ,CAAC,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE3E,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,wFAAwF;QACxF,8FAA8F;QAC9F,wCAAwC;QACxC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;YACnD,YAAY,EAAE,qBAAqB;YACnC,UAAU;YACV,aAAa,EAAE,OAAO,EAAE,yDAAyD;YACjF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;YAC/E,iBAAiB,EAAE,EAAE;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,0FAA0F;YAC1F,EAAE;YACF,8FAA8F;YAC9F,4FAA4F;YAC5F,uEAAuE;YACvE,wFAAwF;YACxF,sEAAsE;YACtE,EAAE;YACF,2FAA2F;YAC3F,2FAA2F;YAC3F,yFAAyF;YACzF,8FAA8F;YAC9F,0FAA0F;YAC1F,iFAAiF;YACjF,EAAE;YACF,yFAAyF;YACzF,6FAA6F;YAC7F,yFAAyF;YACzF,WAAW,EAAE,sBAAsB;YACnC,OAAO,EAAE,IAAI,EAAE,qCAAqC;YACpD,IAAI,EAAE,WAAW;YACjB,sBAAsB,EAAE,KAAK,CAAC,oBAAoB;YAClD,WAAW,EAAE,KAAK,CAAC,KAAK;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yFAAyF;YACzF,yFAAyF;YACzF,gFAAgF;YAChF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE;gBAChD,UAAU;gBACV,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACpG,CAAC;QAED,yFAAyF;QACzF,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE;YAChD,UAAU;YACV,qBAAqB;YACrB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,4FAA4F;YAC5F,sFAAsF;YACtF,qBAAqB,EAAE,KAAK,CAAC,aAAa;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,yFAAyF;YACzF,wCAAwC;YACxC,OAAO,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,uFAAuF;YACvF,kDAAkD;YAClD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM;YAChC,2FAA2F;YAC3F,qFAAqF;YACrF,aAAa,EAAE,IAAI,UAAU,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAChE,WAAW,EAAE,KAAK,CAAC,KAAK;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,4FAA4F;YAC5F,yFAAyF;YACzF,yFAAyF;YACzF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE;gBAC9D,UAAU;gBACV,qBAAqB;gBACrB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;aACjD,CAAC,CAAC;QACL,CAAC;QAED,4FAA4F;QAC5F,uCAAuC;QACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAC3C,UAAU;YACV,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,2FAA2F;YAC3F,2EAA2E;YAC3E,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK;YAC9B,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM;YAChC,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;QAC1F,IAAI,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,0FAA0F;YAC1F,gCAAgC;YAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBACrC,UAAU;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QACD,iGAAiG;QACjG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CACrB,OAAe,EACf,UAAkB,EAClB,KAOC;QAED,8FAA8F;QAC9F,wFAAwF;QACxF,+FAA+F;QAC/F,6FAA6F;QAC7F,2DAA2D;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE;YAC3D,UAAU;YACV,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;gBACzD,UAAU;gBACV,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC/C,UAAU;YACV,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;SACN,CAAC,CAAC;QAEH,6FAA6F;QAC7F,8FAA8F;QAC9F,oCAAoC;QACpC,MAAM,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC;QAC7C,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBACrC,UAAU;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,+FAA+F;IAC/F,WAAW,CAAC,OAAe,EAAE,UAAkB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;YAC5C,WAAW,EAAE,CAAC,CAAC,OAAO;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,mFAAmF;IACnF,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,oBAA4B;QAC/E,0FAA0F;QAC1F,4BAA4B;QAC5B,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,cAAc,CACZ,OAAe,EACf,UAAkB;QAElB,4FAA4F;QAC5F,uFAAuF;QACvF,kFAAkF;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,gDAAgD;oBACtD,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,kBAAkB;oBACrD,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,GAAU;QACxB,6FAA6F;QAC7F,EAAE;QACF,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,kEAAkE;QAClE,EAAE;QACF,0FAA0F;QAC1F,4FAA4F;QAC5F,wFAAwF;QACxF,gFAAgF;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE;YAClF,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QACH,OAAO;YACL,GAAG;YACH,WAAW;YACX,eAAe,EAAE,WAAW,CAAC,SAAS,CAAC,MAAM;YAC7C,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;SACrC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAqB;QAC5B,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,yFAAyF;QACzF,2FAA2F;QAC3F,2EAA2E;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC;QACnD,IAAI,KAAK,KAAK,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,mCAAmC,KAAK,GAAG,OAAO,CAAC,eAAe,qBAAqB;gBACrF,yFAAyF;gBACzF,0FAA0F,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,uCAAuC,CAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,OAAe,EAAE,UAAkB;QACxC,6FAA6F;QAC7F,4FAA4F;QAC5F,wEAAwE;QACxE,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,UAAkB;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,SAAS,CAAC;IAC5E,CAAC;CACF"}

package/dist/document-screen.d.ts

@@ -0,0 +1,114 @@
+/**
+ * DOD-DOC-SCREEN-1 — the document content gate: REFUSE, never mutate.
+ *
+ * ── WHY A DOCUMENT DOES NOT GET THE MESSAGE SANITIZER ─────────────────────────────────────────
+ *
+ * The inbound message path may REWRITE content on a `redact` verdict: the operator sees a sanitized
+ * form while the leaf still binds the original. That is right for conversation and catastrophic for
+ * a document. Measured on 2026-08-05 against eighteen realistic samples, six were silently altered:
+ *
+ *   कर्‍म → कर्म          a different Hindi word; the ZWJ is orthography in Devanagari
+ *   👨‍👩‍👧 → 👨👩👧      one family emoji becomes three separate people
+ *   Ｈｅｌｌｏ → Hello      full-width is how CJK users type
+ *   file is ½ → file is 1⁄2   ligatures and fractions normalised away
+ *   <|im_start|> → ␠      a document ABOUT prompt formats loses its subject
+ *
+ * For a CRDT replica that is not a false positive. It is permanent divergence: the receiver applies
+ * different bytes than the sender signed, both sides believe they converged, and nothing reports
+ * it. And screening the PROJECTION instead does not help — documents are read-WRITE, so the next
+ * write-back diffs the operator's screened file against their replica and publishes the redaction
+ * as a real, signed edit that deletes the peer's content.
+ *
+ * So this rule has exactly two outcomes: carry the text exactly, or refuse the envelope. There is
+ * no third return value, and that is deliberate — a rule that COULD return replacement text would
+ * eventually be used to.
+ *
+ * ── WHAT IT REFUSES, AND WHY THAT LIST IS SHORT ───────────────────────────────────────────────
+ *
+ * Only characters whose presence changes what the text MEANS to a reader or a model, independent of
+ * language:
+ *
+ *   - BIDI overrides and isolates, which make what an operator reads differ from what the document
+ *     says. In a shared document that is a signature on content the signer did not see.
+ *   - Chat-template control markers, which are not content in any document — they are an attempt to
+ *     address the reader's model rather than the reader.
+ *
+ * NOT on the list: zero-width joiners, full-width forms, ligatures, typographic punctuation,
+ * combining marks. Every one of those is legitimate text in some language, and refusing them would
+ * make CELLO unusable for the operators most likely to need it. Zero-width SPACE is refused —
+ * it joins nothing, and its only use in a document is to hide a boundary.
+ *
+ * This is the denylist half. `DOD-DOC-PROFILE-1` adds the allowlist: a codepoint set agreed at the
+ * handshake and bound into `document_id`, which is a stronger instrument because it is decided at
+ * consent rather than argued at the boundary. This rule stays underneath it — a profile a peer
+ * never agreed to cannot be used to smuggle a BIDI override.
+ */
+import type { GateRule } from "./document-gate.js";
+/** Named so a refusal can say which rule fired without the sender parsing prose (§16.7-6). */
+export declare const SCREEN_RULE_ID = "document_content_screen";
+/** Named separately so a refusal says WHICH screen refused — the gateway's, not this module's. */
+export declare const SEMANTIC_RULE_ID = "document_content_semantic_screen";
+/** Named separately so a refusal says whether the AGREED profile or the default floor refused. */
+export declare const PROFILE_RULE_ID = "document_content_profile";
+/**
+ * The one sentence every surface uses to say WHY, so the four call sites cannot describe the same
+ * rule differently. It names both halves: the earlier wording described only the invisible-character
+ * half, which reads as nonsense to an operator who was refused for `[INST]`.
+ */
+export declare const SCREEN_GUIDANCE: string;
+/**
+ * Markers that address the READER'S MODEL rather than the reader.
+ *
+ * THE LIST IS THE MESSAGE PATH'S LIST. Two copies of a security literal drift, and this one had
+ * drifted: four markers where the sanitizer strips ten, and matched case-sensitively where the
+ * sanitizer is deliberately case-insensitive ("bypassable by shift-key" is its own wording). So
+ * `[SYSTEM]`, `<<SYS>>`, `[INST]`, `SYSTEM PROMPT:` and `<|IM_START|>` reached an operator's agent
+ * through a shared document while being stripped out of every message. The affordance prefix is the
+ * sharpest: the sanitizer strips it so relayed text cannot forge local provenance, and a document
+ * carried it verbatim.
+ *
+ * Same list, different remedy — the message path strips, a signed CRDT replica cannot be rewritten,
+ * so this path REFUSES. Refusing is honest: a document about prompt formats is told which literal
+ * to quote differently, where erasing would change its subject without saying so.
+ *
+ * NOT taken from the sanitizer, deliberately: its `### Instruction:` heading family and its `</s>`
+ * pattern are ordinary markdown and ordinary prose in a technical document. Refusing those would
+ * refuse legitimate writing, which is the false-positive class this whole rule exists to avoid.
+ */
+/**
+ * The prose-ambiguous members of the shared list, excluded HERE and only here.
+ *
+ * A message gets these STRIPPED, which costs a reader a few characters. A document gets a hard
+ * REFUSAL, and these three are ordinary English and ordinary markup:
+ *   - `SYSTEM PROMPT:` — "Here is the system prompt: keep it short" is a sentence someone writes.
+ *   - `<system>` / `</system>` — a tag in any XML or config document.
+ * Refusing them would refuse legitimate writing, which is the false-positive class this whole rule
+ * exists to avoid, and the same objection that kept `### Instruction:` and `</s>` off the list.
+ * Excluded by name rather than by omission so the choice is visible and testable.
+ */
+export declare const PROSE_AMBIGUOUS: readonly string[];
+/**
+ * The rule. Null admits; anything else refuses.
+ *
+ * Offsets are in CODE POINTS, not UTF-16 units, because they exist for a human or an agent to find
+ * the character in their own editor — and an offset that lands mid-surrogate in a document with an
+ * emoji in it is worse than none.
+ */
+/**
+ * The denylist scan itself, over plain text — no gate, no diff, no context.
+ *
+ * Extracted so the AUTHORING check and the RECEIVING gate cannot drift. Two implementations of one
+ * rule is how a sender-side "advisory" ends up refusing things the receiver admits, or worse
+ * admitting things it refuses — and this milestone has now been bitten four times by a second copy
+ * of a rule that was supposed to match the first.
+ *
+ * Returns null when the text is clean; otherwise every distinct offender, a count, and CODE-POINT
+ * offsets (not UTF-16, which lands mid-surrogate in any document containing an emoji).
+ */
+export declare function screenText(text: string): {
+    codepoints: string[];
+    count: number;
+    offsets: number[];
+} | null;
+export declare const screeningRule: GateRule;
+//# sourceMappingURL=document-screen.d.ts.map

package/dist/document-screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-screen.d.ts","sourceRoot":"","sources":["../src/document-screen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAA8B,MAAM,oBAAoB,CAAC;AAG/E,8FAA8F;AAC9F,eAAO,MAAM,cAAc,4BAA4B,CAAC;AAExD,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,qCAAqC,CAAC;AAEnE,kGAAkG;AAClG,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAGD,CAAC;AAsB5B;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAgD,CAAC;AAgB9F;;;;;;GAMG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAyC1G;AAED,eAAO,MAAM,aAAa,EAAE,QAwC3B,CAAC"}