@cello-protocol/protocol-types 0.0.44 → 0.0.45

package/dist/document-control.js

@@ -0,0 +1,174 @@
+/**
+ * DOD-DOC-TOOLS-1 — the document CONTROL frame: close and kill (§16.5).
+ *
+ * A unilateral end, told to the other party.
+ *
+ * ── WHY THE PEER MUST BE TOLD, AND WHY IT IS BEST-EFFORT ──────────────────────────────────────
+ *
+ * `DocumentLifecycle` already ends a document locally without asking anyone — that is deliberate: a
+ * kill is a safety verb, and a safety verb that needs the counterparty's cooperation is not one. But
+ * a peer who is never told keeps publishing into a document that will never answer. Their updates
+ * are refused at the far end forever, and nothing on their screen explains why. So the notification
+ * is REQUIRED to be attempted and ALLOWED to fail, and the operator is told which happened.
+ *
+ * ── CLOSE AND KILL ARE DIFFERENT FRAMES OF THE SAME SHAPE ─────────────────────────────────────
+ *
+ * `close` is "I am done with this, and I expect you are too" — the document settles when both sides
+ * have said it. `kill` is "this is over now", one-sided and immediate. They travel as one frame with
+ * a verb rather than two types because the receiving side's routing, verification and settle-once
+ * rules are identical, and two decoders for one shape is how the rules drift apart.
+ *
+ * The verb is REFUSED BY VALUE on decode. A third verb from a future build must not be admitted as
+ * one of these two — a `kill` silently read as a `close` would leave a killed document waiting for
+ * a reciprocal close that is never coming.
+ *
+ * ── WHY IT IS SIGNED ──────────────────────────────────────────────────────────────────────────
+ *
+ * A kill frame ends a collaboration. Unsigned, anyone reaching the channel could end any document
+ * between any two parties, and each operator would believe the other walked away. The signature
+ * covers the document id — which commits to both parties, the properties and the nonce — and the
+ * verb, because the whole statement is the claim.
+ */
+import { createHash } from "node:crypto";
+import { encodeCbor, decodeCbor } from "./cbor.js";
+/** Domain tag in slot 0. Distinct from every other document domain. */
+export const DOCUMENT_CONTROL_DOMAIN = "CELLO-DOCUMENT-CONTROL-v1";
+/** The frame version, ON THE WIRE, so skew is DETECTED rather than misread as a bad signature. */
+export const DOCUMENT_CONTROL_VERSION = 1;
+/** Peer-controlled display text bound for an operator's screen. Capped for that reason. */
+export const MAX_CONTROL_REASON_LENGTH = 200;
+/** The two ways a document ends. Closed set — see the header on refusing a third by value. */
+export const DOCUMENT_CONTROL_VERBS = ["close", "kill"];
+const HEX32 = /^[0-9a-f]{64}$/;
+function normalizeReason(reason) {
+    return reason === undefined || reason === "" ? null : reason;
+}
+export function assertDocumentControlConsistent(control) {
+    if (!DOCUMENT_CONTROL_VERBS.includes(control.verb)) {
+        throw new Error(`document_control_verb: expected one of ${DOCUMENT_CONTROL_VERBS.join(", ")}, got "${control.verb}"`);
+    }
+    if (!HEX32.test(control.document_id)) {
+        throw new Error("document_control_document_id: expected 64 lowercase hex characters");
+    }
+    const reason = normalizeReason(control.reason);
+    if (reason !== null && reason.length > MAX_CONTROL_REASON_LENGTH) {
+        throw new Error(`document_control_reason: a reason may be at most ${MAX_CONTROL_REASON_LENGTH} characters, ` +
+            `and this one is ${reason.length}`);
+    }
+}
+/**
+ * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
+ *
+ * An array rather than a map for the reason `cbor.ts` gives — this encoder is deliberately not
+ * deterministic for maps, so a map preimage would make the signature depend on the order the sender
+ * happened to build the object in, and two honest implementations would disagree.
+ */
+export function buildDocumentControlTbs(control, opts = {}) {
+    assertDocumentControlConsistent(control);
+    const preimage = encodeCbor([
+        DOCUMENT_CONTROL_DOMAIN,
+        control.control_version,
+        control.document_id,
+        control.sender_agent_id,
+        // THE VERB IS SIGNED. Unsigned, a captured `close` could be replayed as a `kill` — the peer
+        // would end a collaboration the sender only meant to wind down, with a valid signature on it.
+        control.verb,
+        normalizeReason(control.reason),
+        // BIGINT past 0xffffffff — cbor-x encodes a large JS number as IEEE float64 (`fb`) rather than
+        // uint64 (`1b`), so a canonically-encoding implementation would compute different TBS bytes and
+        // reject a GENUINE frame, surfacing as a signature failure that reads as forgery.
+        typeof control.sent_at_ms === "number" && control.sent_at_ms > 0xffffffff
+            ? BigInt(control.sent_at_ms)
+            : control.sent_at_ms,
+    ]);
+    if (opts.preHash === false)
+        return preimage;
+    return new Uint8Array(createHash("sha256").update(preimage).digest());
+}
+export function encodeDocumentControl(control) {
+    assertDocumentControlConsistent(control);
+    return encodeCbor({
+        type: control.type,
+        control_version: control.control_version,
+        document_id: control.document_id,
+        sender_agent_id: control.sender_agent_id,
+        verb: control.verb,
+        reason: normalizeReason(control.reason),
+        sent_at_ms: control.sent_at_ms,
+        signature: control.signature,
+    });
+}
+function present(map, field) {
+    if (!(field in map)) {
+        throw new Error(`document_control_missing_field: ${field} is mandatory and was not present`);
+    }
+    return map[field];
+}
+/**
+ * Decode and validate. Refuses rather than defaulting on every field.
+ *
+ * The one that matters most is `verb`. Defaulted or coerced, a `kill` read as a `close` leaves a
+ * killed document waiting for a reciprocal close that is never coming — the operator sees a
+ * collaboration that will not settle and no reason anywhere for why.
+ */
+export function decodeDocumentControl(bytes) {
+    const decoded = decodeCbor(bytes);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+        throw new Error("document_control_malformed: not a CBOR map");
+    }
+    const map = decoded;
+    if (present(map, "type") !== "document_control") {
+        throw new Error("document_control_type: expected document_control");
+    }
+    const version = present(map, "control_version");
+    if (typeof version !== "number" || !Number.isInteger(version)) {
+        throw new Error("document_control_version: must be an integer");
+    }
+    if (version !== DOCUMENT_CONTROL_VERSION) {
+        throw new Error(`document_control_version_unsupported: this build speaks version ${DOCUMENT_CONTROL_VERSION} ` +
+            `and the frame declares ${version} — the peer is running a newer CELLO and one of you needs ` +
+            `to upgrade`);
+    }
+    const documentId = present(map, "document_id");
+    if (typeof documentId !== "string" || !HEX32.test(documentId)) {
+        throw new Error("document_control_document_id: expected 64 lowercase hex characters");
+    }
+    const senderAgentId = present(map, "sender_agent_id");
+    if (typeof senderAgentId !== "string" || senderAgentId.length === 0) {
+        throw new Error("document_control_sender: must be a non-empty string");
+    }
+    const verb = present(map, "verb");
+    if (typeof verb !== "string" || !DOCUMENT_CONTROL_VERBS.includes(verb)) {
+        // REFUSED BY VALUE. A third verb from a future build must not be admitted as one of these two.
+        throw new Error(`document_control_verb_unsupported: this build understands ` +
+            `${DOCUMENT_CONTROL_VERBS.join(" and ")}, and the frame says "${String(verb)}" — the peer is ` +
+            `running a newer CELLO and one of you needs to upgrade`);
+    }
+    const reason = present(map, "reason");
+    if (reason !== null && typeof reason !== "string") {
+        throw new Error("document_control_reason: must be a string or null");
+    }
+    const sentAt = present(map, "sent_at_ms");
+    if (typeof sentAt !== "number" || !Number.isFinite(sentAt)) {
+        throw new Error("document_control_sent_at: must be a finite number");
+    }
+    const signature = present(map, "signature");
+    if (!(signature instanceof Uint8Array) || signature.length !== 64) {
+        throw new Error("document_control_signature: expected 64 bytes");
+    }
+    const control = {
+        type: "document_control",
+        control_version: version,
+        document_id: documentId,
+        sender_agent_id: senderAgentId,
+        verb: verb,
+        ...(reason !== null && reason !== "" ? { reason } : {}),
+        sent_at_ms: sentAt,
+        // COPIED out of the decode buffer — cbor-x returns byte strings as VIEWS into the input, so
+        // retaining one pins the whole frame and lets a later reuse mutate a verified signature.
+        signature: Uint8Array.from(signature),
+    };
+    assertDocumentControlConsistent(control);
+    return control;
+}
+//# sourceMappingURL=document-control.js.map

package/dist/document-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-control.js","sourceRoot":"","sources":["../src/document-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAEnE,kGAAkG;AAClG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,2FAA2F;AAC3F,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;AAGjE,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAgB/B,SAAS,eAAe,CAAC,MAA0B;IACjD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAAwB;IACtE,IAAI,CAAE,sBAA4C,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CACb,0CAA0C,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,IAAI,GAAG,CACrG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,oDAAoD,yBAAyB,eAAe;YAC1F,mBAAmB,MAAM,CAAC,MAAM,EAAE,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAwB,EACxB,OAA8B,EAAE;IAEhC,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,uBAAuB;QACvB,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,eAAe;QACvB,4FAA4F;QAC5F,8FAA8F;QAC9F,OAAO,CAAC,IAAI;QACZ,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,+FAA+F;QAC/F,gGAAgG;QAChG,kFAAkF;QAClF,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,UAAU;YACvE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAC5B,CAAC,CAAC,OAAO,CAAC,UAAU;KACvB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAwB;IAC5D,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QACvC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,mCAAmC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAE/C,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,mEAAmE,wBAAwB,GAAG;YAC5F,0BAA0B,OAAO,4DAA4D;YAC7F,YAAY,CACf,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACtD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAE,sBAA4C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,+FAA+F;QAC/F,MAAM,IAAI,KAAK,CACb,4DAA4D;YAC1D,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,kBAAkB;YAC9F,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,IAAI,EAAE,kBAAkB;QACxB,eAAe,EAAE,OAAO;QACxB,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,aAAa;QAC9B,IAAI,EAAE,IAA2B;QACjC,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,MAAM;QAClB,4FAA4F;QAC5F,yFAAyF;QACzF,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;KACtC,CAAC;IACF,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/document-envelope.d.ts

@@ -0,0 +1,132 @@
+/**
+ * DOD-DOC-ENVELOPE-1 — the document UPDATE envelope (§14).
+ *
+ * A distinct wire type from the handshake PROPOSAL envelope (whose hash mints the `document_id`).
+ * The two share the word, not the shape.
+ *
+ * ── WHY THREE OF THESE FIELDS ARE SECURITY FIELDS, NOT METADATA ───────────────────────────────
+ *
+ * DOD-DOC-GATE-1 enforces three bindings that no property of a Yjs update's BYTES can establish.
+ * The gate is only as trustworthy as the signature covering them, which is why all three sit
+ * inside the TBS rather than beside it:
+ *
+ *   `document_id`      A Yjs update carries no document identity. A well-formed update authored
+ *                      against a DIFFERENT document merges into this one silently and converges —
+ *                      there is no error, and the result is a splice of two documents.
+ *
+ *   `update_encoding`  v2-encoded bytes are ACCEPTED by the v1 decoder and silently drop all
+ *                      content. It cannot be sniffed either: a v2 update begins [0,0,…] and a
+ *                      legitimate pure-delete v1 delta begins [0,1,…], so a first-byte heuristic
+ *                      would refuse real deletions. The sender must SAY, under signature.
+ *
+ *   `sender_client_id` Authorship in Yjs IS the clientID, and the gate refuses any client whose
+ *                      clock advances without being bound to the sender. §14 forbids persisting or
+ *                      deriving a clientID (a shared one splices two authors together with an
+ *                      empty pending set — measured in DOD-DOC-FUZZ-1), so an honest peer mints a
+ *                      fresh one on every restart. The gate's rule is therefore correct ONLY if
+ *                      the binding is LEARNABLE, and this envelope is where it is learned. Outside
+ *                      the signature, "learnable" would mean "assertable by anyone on the wire".
+ *
+ * `epoch_id` and `doc_prev_hash` are not optional and are not defaulted (§14). An update that does
+ * not state its epoch cannot be verified unambiguously after a compaction, and the chain link is
+ * what lets the document log be extracted and verified across sealed sessions.
+ */
+/** Domain tag in slot 0 of the to-be-signed array. */
+export declare const DOCUMENT_UPDATE_DOMAIN = "CELLO-DOCUMENT-UPDATE-v1";
+/**
+ * The pinned Yjs update encoding (§16.7-8). Pinned in the protocol types precisely so that two
+ * supporting clients can never disagree silently — the failure mode of disagreement is an empty
+ * document, not an error.
+ */
+export declare const DOCUMENT_UPDATE_ENCODING_V1 = "yjs-v1";
+/** V1 has exactly one epoch. Compaction (which mints new epochs) is V2. */
+export declare const DOCUMENT_EPOCH_V1 = 0;
+export interface DocumentUpdateEnvelope {
+    type: "document_update";
+    /** Hash of the handshake proposal envelope that minted this document. */
+    document_id: string;
+    /** Constant `DOCUMENT_EPOCH_V1` in V1 — carried explicitly, never omitted. */
+    epoch_id: number;
+    /**
+     * The per-sender chain link: the `documentEnvelopeHash` of this sender's previous envelope for
+     * this document, or `null` for this sender's FIRST envelope. `null` and absent are different
+     * facts and are treated differently — see `decodeDocumentUpdateEnvelope`.
+     */
+    doc_prev_hash: string | null;
+    sender_agent_id: string;
+    /** The Yjs clientID this update was authored under. See the header. */
+    sender_client_id: number;
+    /** Always `DOCUMENT_UPDATE_ENCODING_V1` in V1. See the header. */
+    update_encoding: string;
+    /** The sender's Yjs state vector at publish (§7) — what it had seen when it authored. */
+    state_vector: Uint8Array;
+    /** The Yjs update payload. */
+    update: Uint8Array;
+    /** Ed25519 (RFC 8032) over `buildDocumentUpdateTbs`. */
+    signature: Uint8Array;
+}
+/**
+ * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
+ *
+ * An array, not a map, because `encodeCbor` is deliberately NOT deterministic for maps — keys
+ * follow insertion order and the header is not minimal-length (see `cbor.ts`). Two honest senders
+ * that built the same envelope in a different field order would produce different signatures over
+ * it. Arrays are order-fixed and self-delimiting, which also removes the concatenation ambiguity
+ * that length-framing exists to prevent.
+ *
+ * The `signature` is excluded, as it must be — a statement cannot cover its own signature.
+ *
+ * `preHash: false` returns the preimage itself rather than its digest; it exists for the hash
+ * construction below and for tests that need to inspect the structure.
+ */
+export declare function buildDocumentUpdateTbs(env: DocumentUpdateEnvelope, opts?: {
+    preHash?: boolean;
+}): Uint8Array;
+/**
+ * The envelope's identity: SHA-256 over the same preimage that is signed.
+ *
+ * Deliberately the SAME preimage, so a chain link commits to exactly the bytes whose signature was
+ * verified — a link can never point at an envelope other than the one that was authenticated.
+ *
+ * It therefore excludes the signature, which is the property the chain needs: a re-signed but
+ * otherwise identical envelope keeps its hash, so anything already pointing at it (the next
+ * envelope in the chain, a `0x05` rejection leaf) is not orphaned.
+ */
+export declare function documentEnvelopeHash(env: DocumentUpdateEnvelope): string;
+export declare function encodeDocumentUpdateEnvelope(env: DocumentUpdateEnvelope): Uint8Array;
+/**
+ * Decode and VALIDATE. Every refusal names the field, because the caller's next move is to tell an
+ * operator which peer sent what — an unnamed refusal is a label on the exit point, not a diagnosis.
+ */
+export declare function decodeDocumentUpdateEnvelope(bytes: Uint8Array): DocumentUpdateEnvelope;
+/**
+ * The receive-time chain check: does this envelope link to what we already hold from this sender?
+ *
+ * `known` is every envelope hash we hold from this sender for this document, and `head` is their
+ * most recent. Both, not just the head: replay is SET-based per §16.7-5, and delivery derives
+ * pending from the log and retries across restarts — so an older envelope arriving again, because
+ * its ack was lost while a later one landed, is designed behaviour. Comparing against the head
+ * alone recognised only the newest redelivery and reported every other one as a broken chain.
+ *
+ * The set is also what separates the two failures. A predecessor we have never seen is a GAP; a
+ * predecessor we hold that is not the head is a BRANCH. One reason string for both would hide a
+ * fork inside a delivery-shaped error.
+ *
+ * The refusal reasons are deliberately the SAME STRINGS the daemon's whole-log verifier uses
+ * (`DocumentStore.verifyChainLinkage`): `document_chain_forked` and `document_chain_broken`. Two
+ * vocabularies for one fact means a policy-log query or an operator keyed on one silently misses
+ * the other. The division of labour is real — this checks a single link on arrival, that one walks
+ * the whole log for reachability — but they are the same two failures.
+ *
+ * **LINKAGE ONLY — this is not authenticity.** `documentEnvelopeHash` excludes the signature, so
+ * `duplicate: true` means the TBS is byte-identical to one we hold, NOT that whoever sent it holds
+ * the key. A caller must verify the signature before consulting the chain; `duplicate` is the
+ * value most likely to be read as "already known, ack it and move on".
+ */
+export declare function verifyDocumentChainLink(env: DocumentUpdateEnvelope, sender: {
+    head: string | null;
+    known: ReadonlySet<string>;
+}): {
+    duplicate: boolean;
+};
+//# sourceMappingURL=document-envelope.d.ts.map

package/dist/document-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-envelope.d.ts","sourceRoot":"","sources":["../src/document-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAEjE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAKnC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,eAAe,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,YAAY,EAAE,UAAU,CAAC;IACzB,8BAA8B;IAC9B,MAAM,EAAE,UAAU,CAAC;IACnB,wDAAwD;IACxD,SAAS,EAAE,UAAU,CAAC;CACvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,sBAAsB,EAC3B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAcZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,sBAAsB,GAAG,MAAM,CAIxE;AAED,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,sBAAsB,GAAG,UAAU,CAapF;AAmCD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,UAAU,GAAG,sBAAsB,CAsEtF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,sBAAsB,EAC3B,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAAE,GAC1D;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,CAiCxB"}

package/dist/document-envelope.js

@@ -0,0 +1,243 @@
+/**
+ * DOD-DOC-ENVELOPE-1 — the document UPDATE envelope (§14).
+ *
+ * A distinct wire type from the handshake PROPOSAL envelope (whose hash mints the `document_id`).
+ * The two share the word, not the shape.
+ *
+ * ── WHY THREE OF THESE FIELDS ARE SECURITY FIELDS, NOT METADATA ───────────────────────────────
+ *
+ * DOD-DOC-GATE-1 enforces three bindings that no property of a Yjs update's BYTES can establish.
+ * The gate is only as trustworthy as the signature covering them, which is why all three sit
+ * inside the TBS rather than beside it:
+ *
+ *   `document_id`      A Yjs update carries no document identity. A well-formed update authored
+ *                      against a DIFFERENT document merges into this one silently and converges —
+ *                      there is no error, and the result is a splice of two documents.
+ *
+ *   `update_encoding`  v2-encoded bytes are ACCEPTED by the v1 decoder and silently drop all
+ *                      content. It cannot be sniffed either: a v2 update begins [0,0,…] and a
+ *                      legitimate pure-delete v1 delta begins [0,1,…], so a first-byte heuristic
+ *                      would refuse real deletions. The sender must SAY, under signature.
+ *
+ *   `sender_client_id` Authorship in Yjs IS the clientID, and the gate refuses any client whose
+ *                      clock advances without being bound to the sender. §14 forbids persisting or
+ *                      deriving a clientID (a shared one splices two authors together with an
+ *                      empty pending set — measured in DOD-DOC-FUZZ-1), so an honest peer mints a
+ *                      fresh one on every restart. The gate's rule is therefore correct ONLY if
+ *                      the binding is LEARNABLE, and this envelope is where it is learned. Outside
+ *                      the signature, "learnable" would mean "assertable by anyone on the wire".
+ *
+ * `epoch_id` and `doc_prev_hash` are not optional and are not defaulted (§14). An update that does
+ * not state its epoch cannot be verified unambiguously after a compaction, and the chain link is
+ * what lets the document log be extracted and verified across sealed sessions.
+ */
+import { createHash } from "node:crypto";
+import { encodeCbor, decodeCbor } from "./cbor.js";
+/** Domain tag in slot 0 of the to-be-signed array. */
+export const DOCUMENT_UPDATE_DOMAIN = "CELLO-DOCUMENT-UPDATE-v1";
+/**
+ * The pinned Yjs update encoding (§16.7-8). Pinned in the protocol types precisely so that two
+ * supporting clients can never disagree silently — the failure mode of disagreement is an empty
+ * document, not an error.
+ */
+export const DOCUMENT_UPDATE_ENCODING_V1 = "yjs-v1";
+/** V1 has exactly one epoch. Compaction (which mints new epochs) is V2. */
+export const DOCUMENT_EPOCH_V1 = 0;
+/** A 32-byte hex digest — the shape of `document_id` and of every chain link. */
+const HEX32 = /^[0-9a-f]{64}$/;
+/**
+ * The canonical to-be-signed preimage: a fixed-order CBOR ARRAY with the domain in slot 0.
+ *
+ * An array, not a map, because `encodeCbor` is deliberately NOT deterministic for maps — keys
+ * follow insertion order and the header is not minimal-length (see `cbor.ts`). Two honest senders
+ * that built the same envelope in a different field order would produce different signatures over
+ * it. Arrays are order-fixed and self-delimiting, which also removes the concatenation ambiguity
+ * that length-framing exists to prevent.
+ *
+ * The `signature` is excluded, as it must be — a statement cannot cover its own signature.
+ *
+ * `preHash: false` returns the preimage itself rather than its digest; it exists for the hash
+ * construction below and for tests that need to inspect the structure.
+ */
+export function buildDocumentUpdateTbs(env, opts = {}) {
+    const preimage = encodeCbor([
+        DOCUMENT_UPDATE_DOMAIN,
+        env.document_id,
+        env.epoch_id,
+        env.doc_prev_hash, // null encodes distinctly from any string — genesis is unambiguous
+        env.sender_agent_id,
+        env.sender_client_id,
+        env.update_encoding,
+        env.state_vector,
+        env.update,
+    ]);
+    if (opts.preHash === false)
+        return preimage;
+    return new Uint8Array(createHash("sha256").update(preimage).digest());
+}
+/**
+ * The envelope's identity: SHA-256 over the same preimage that is signed.
+ *
+ * Deliberately the SAME preimage, so a chain link commits to exactly the bytes whose signature was
+ * verified — a link can never point at an envelope other than the one that was authenticated.
+ *
+ * It therefore excludes the signature, which is the property the chain needs: a re-signed but
+ * otherwise identical envelope keeps its hash, so anything already pointing at it (the next
+ * envelope in the chain, a `0x05` rejection leaf) is not orphaned.
+ */
+export function documentEnvelopeHash(env) {
+    return createHash("sha256")
+        .update(buildDocumentUpdateTbs(env, { preHash: false }))
+        .digest("hex");
+}
+export function encodeDocumentUpdateEnvelope(env) {
+    return encodeCbor({
+        type: env.type,
+        document_id: env.document_id,
+        epoch_id: env.epoch_id,
+        doc_prev_hash: env.doc_prev_hash,
+        sender_agent_id: env.sender_agent_id,
+        sender_client_id: env.sender_client_id,
+        update_encoding: env.update_encoding,
+        state_vector: env.state_vector,
+        update: env.update,
+        signature: env.signature,
+    });
+}
+function requirePresent(map, field) {
+    // `in`, not a truthiness or nullish check. ABSENT and `null` are different facts: absent
+    // doc_prev_hash read as null would turn every gap in a chain into a fresh valid-looking genesis,
+    // and absent epoch_id read as 0 would make a post-compaction ambiguity silent. A decoder that
+    // supplies a default for a field the spec calls mandatory is manufacturing the sender's claim.
+    if (!(field in map)) {
+        throw new Error(`document_envelope_missing_field: ${field} is mandatory and was not present`);
+    }
+    return map[field];
+}
+function requireBytes(map, field) {
+    const value = requirePresent(map, field);
+    if (!(value instanceof Uint8Array)) {
+        throw new Error(`document_envelope_field_type: ${field} must be a CBOR byte string`);
+    }
+    // COPIED, not returned as-is. Measured: cbor-x returns byte strings as VIEWS into the buffer it
+    // was handed (`decoded.buffer === input.buffer`), so an aliased update mutates when the caller
+    // reuses or zeroes its read buffer — and a pooled network read buffer is exactly that. Every
+    // check in this decoder, and every check the gate makes afterwards, would then have been made
+    // against bytes that are no longer the bytes applied. The copy is also what makes the return
+    // type honest: a Buffer view and a Uint8Array are not interchangeable to a structural comparison.
+    return new Uint8Array(value);
+}
+function requireString(map, field) {
+    const value = requirePresent(map, field);
+    if (typeof value !== "string") {
+        throw new Error(`document_envelope_field_type: ${field} must be a text string`);
+    }
+    return value;
+}
+/**
+ * Decode and VALIDATE. Every refusal names the field, because the caller's next move is to tell an
+ * operator which peer sent what — an unnamed refusal is a label on the exit point, not a diagnosis.
+ */
+export function decodeDocumentUpdateEnvelope(bytes) {
+    const decoded = decodeCbor(bytes);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+        throw new Error("document_envelope_malformed: not a CBOR map");
+    }
+    const map = decoded;
+    const type = requireString(map, "type");
+    if (type !== "document_update") {
+        throw new Error(`document_envelope_type: expected document_update, got ${type}`);
+    }
+    const documentId = requireString(map, "document_id");
+    if (!HEX32.test(documentId)) {
+        throw new Error(`document_envelope_document_id: must be a 32-byte lowercase hex digest, got "${documentId}"`);
+    }
+    const epochId = requirePresent(map, "epoch_id");
+    if (typeof epochId !== "number" || !Number.isInteger(epochId)) {
+        throw new Error(`document_envelope_epoch: must be an integer, got ${String(epochId)}`);
+    }
+    if (epochId !== DOCUMENT_EPOCH_V1) {
+        // V2 introduces compaction and non-zero epochs. Accepting one now would mean applying an
+        // update whose base state this build cannot reconstruct.
+        throw new Error(`document_envelope_epoch: this build speaks epoch ${DOCUMENT_EPOCH_V1} only, got ${epochId}`);
+    }
+    const prev = requirePresent(map, "doc_prev_hash");
+    if (prev !== null && (typeof prev !== "string" || !HEX32.test(prev))) {
+        throw new Error(`document_envelope_prev_hash: must be a 32-byte hex digest or explicit null, got "${String(prev)}"`);
+    }
+    const senderAgentId = requireString(map, "sender_agent_id");
+    if (senderAgentId.length === 0) {
+        throw new Error("document_envelope_sender: sender_agent_id must not be empty");
+    }
+    const clientId = requirePresent(map, "sender_client_id");
+    if (typeof clientId !== "number" || !Number.isInteger(clientId) || clientId < 0) {
+        throw new Error(`document_envelope_client_id: must be a non-negative integer, got ${String(clientId)}`);
+    }
+    const encoding = requireString(map, "update_encoding");
+    if (encoding !== DOCUMENT_UPDATE_ENCODING_V1) {
+        // The one refusal that cannot be replaced by a heuristic. See the header.
+        throw new Error(`document_envelope_encoding: this build speaks ${DOCUMENT_UPDATE_ENCODING_V1} only, got "${encoding}"`);
+    }
+    return {
+        type: "document_update",
+        document_id: documentId,
+        epoch_id: epochId,
+        doc_prev_hash: prev,
+        sender_agent_id: senderAgentId,
+        sender_client_id: clientId,
+        update_encoding: encoding,
+        state_vector: requireBytes(map, "state_vector"),
+        update: requireBytes(map, "update"),
+        signature: requireBytes(map, "signature"),
+    };
+}
+/**
+ * The receive-time chain check: does this envelope link to what we already hold from this sender?
+ *
+ * `known` is every envelope hash we hold from this sender for this document, and `head` is their
+ * most recent. Both, not just the head: replay is SET-based per §16.7-5, and delivery derives
+ * pending from the log and retries across restarts — so an older envelope arriving again, because
+ * its ack was lost while a later one landed, is designed behaviour. Comparing against the head
+ * alone recognised only the newest redelivery and reported every other one as a broken chain.
+ *
+ * The set is also what separates the two failures. A predecessor we have never seen is a GAP; a
+ * predecessor we hold that is not the head is a BRANCH. One reason string for both would hide a
+ * fork inside a delivery-shaped error.
+ *
+ * The refusal reasons are deliberately the SAME STRINGS the daemon's whole-log verifier uses
+ * (`DocumentStore.verifyChainLinkage`): `document_chain_forked` and `document_chain_broken`. Two
+ * vocabularies for one fact means a policy-log query or an operator keyed on one silently misses
+ * the other. The division of labour is real — this checks a single link on arrival, that one walks
+ * the whole log for reachability — but they are the same two failures.
+ *
+ * **LINKAGE ONLY — this is not authenticity.** `documentEnvelopeHash` excludes the signature, so
+ * `duplicate: true` means the TBS is byte-identical to one we hold, NOT that whoever sent it holds
+ * the key. A caller must verify the signature before consulting the chain; `duplicate` is the
+ * value most likely to be read as "already known, ack it and move on".
+ */
+export function verifyDocumentChainLink(env, sender) {
+    if (sender.known.has(documentEnvelopeHash(env)))
+        return { duplicate: true };
+    if (env.doc_prev_hash === null) {
+        if (sender.head !== null) {
+            // Two roots for one sender. DOD-DOC-REJECT-1 measured what this costs: the chain no longer
+            // verifies, so the document rebuilds until the next daemon restart and is permanently
+            // unopenable after it. The log is append-only; there is no repair.
+            throw new Error(`document_chain_forked: ${env.sender_agent_id} sent a genesis envelope for document ` +
+                `${env.document_id}, but we already hold their chain at ${sender.head}`);
+        }
+        return { duplicate: false };
+    }
+    if (!sender.known.has(env.doc_prev_hash)) {
+        throw new Error(`document_chain_broken: ${env.sender_agent_id} chained to ${env.doc_prev_hash} for document ` +
+            `${env.document_id}, which we have never seen — their last envelope we hold is ` +
+            `${sender.head ?? "none (no envelope from this sender yet)"}`);
+    }
+    if (env.doc_prev_hash !== sender.head) {
+        throw new Error(`document_chain_forked: ${env.sender_agent_id} chained to ${env.doc_prev_hash} for document ` +
+            `${env.document_id}, which we hold but which is not their head ${sender.head} — a chain ` +
+            `branches nowhere`);
+    }
+    return { duplicate: false };
+}
+//# sourceMappingURL=document-envelope.js.map

package/dist/document-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-envelope.js","sourceRoot":"","sources":["../src/document-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC;AAEpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,iFAAiF;AACjF,MAAM,KAAK,GAAG,gBAAgB,CAAC;AA2B/B;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA2B,EAC3B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,sBAAsB;QACtB,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,aAAa,EAAE,mEAAmE;QACtF,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,gBAAgB;QACpB,GAAG,CAAC,eAAe;QACnB,GAAG,CAAC,YAAY;QAChB,GAAG,CAAC,MAAM;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAA2B;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,sBAAsB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAA2B;IACtE,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa;IACjE,yFAAyF;IACzF,iGAAiG;IACjG,8FAA8F;IAC9F,+FAA+F;IAC/F,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,mCAAmC,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa;IAC/D,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,6BAA6B,CAAC,CAAC;IACvF,CAAC;IACD,gGAAgG;IAChG,+FAA+F;IAC/F,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa;IAChE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,wBAAwB,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAiB;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAE/C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+EAA+E,UAAU,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,yFAAyF;QACzF,yDAAyD;QACzD,MAAM,IAAI,KAAK,CACb,oDAAoD,iBAAiB,cAAc,OAAO,EAAE,CAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,oFAAoF,MAAM,CAAC,IAAI,CAAC,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,CAAC,QAAQ,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,2BAA2B,EAAE,CAAC;QAC7C,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CACb,iDAAiD,2BAA2B,eAAe,QAAQ,GAAG,CACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,UAAU;QACvB,QAAQ,EAAE,OAAO;QACjB,aAAa,EAAE,IAAI;QACnB,eAAe,EAAE,aAAa;QAC9B,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC;QAC/C,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC;QACnC,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA2B,EAC3B,MAA2D;IAE3D,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE5E,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,2FAA2F;YAC3F,sFAAsF;YACtF,mEAAmE;YACnE,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,wCAAwC;gBACnF,GAAG,GAAG,CAAC,WAAW,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,eAAe,GAAG,CAAC,aAAa,gBAAgB;YAC3F,GAAG,GAAG,CAAC,WAAW,8DAA8D;YAChF,GAAG,MAAM,CAAC,IAAI,IAAI,yCAAyC,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,CAAC,eAAe,eAAe,GAAG,CAAC,aAAa,gBAAgB;YAC3F,GAAG,GAAG,CAAC,WAAW,+CAA+C,MAAM,CAAC,IAAI,aAAa;YACzF,kBAAkB,CACrB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}