@cello-protocol/protocol-types 0.0.53 → 0.0.54

package/dist/document-governance.js

@@ -0,0 +1,110 @@
+/**
+ * DOD-MP-GOVERN-1 — the signature-requirement policy. Rulings D2/D3 (2026-08-11), as code.
+ *
+ * The policy VALIDATES the collection's claimed required set; it does not mint one. "Any single
+ * admin may act" has no single answer to mint — {a} and {b} are both acceptable claims — so the
+ * seam is a verdict on what the collection claims, and the multisig layer then demands every
+ * claimed signature actually verify.
+ *
+ * The rules:
+ * - **Single-admin kinds** — `add_holder`, `promote_admin`, `remove_holder` (of a non-admin),
+ *   `change_property`: the claim is EXACTLY ONE current admin. A wider claim is refused, not
+ *   welcomed as extra-safe: every claimed signer must sign for the collection to complete, so an
+ *   inflated claim lets one absent co-signer veto an action the rule gives to any single admin —
+ *   a governance change smuggled through the claim.
+ * - **Voluntary leave** — `remove_holder` claimed by exactly the subject themselves is always
+ *   acceptable, admin or not. Leaving is theirs (D3).
+ * - **`remove_admin`** — the claim is exactly ALL OTHER admins; the subject neither required nor
+ *   counted. With exactly two admins NEITHER CAN REMOVE THE OTHER — by design, and the refusal
+ *   names the recourse (D3: stop working in it, duplicate it, start fresh without them).
+ * - **The holder door is not a bypass** — `remove_holder` of a CURRENT ADMIN (other than
+ *   voluntary leave) is refused: holder removal drops admin status too, so allowing it under the
+ *   single-admin rule would expel an admin on one signature, evading `remove_admin` and the
+ *   deadlock in one move. Demote first, under remove_admin's rule.
+ *
+ * Kind/subject semantics (does the subject hold? is it already an admin? last-admin protection)
+ * are `deriveArrangement`'s job and run BEFORE this policy is consulted — it may assume a
+ * semantically coherent amendment.
+ */
+function canonical(ids) {
+    return [...new Set(ids)].sort();
+}
+/** A duplicated claim is a builder bug, refused — deduping here would hand the multisig layer a
+ * collection it THROWS on (`multisig_duplicate_signer`), escaping DeriveResult's never-throw
+ * contract. The two layers agree: duplicates refuse, loudly, at the first gate they reach. */
+function hasDuplicates(ids) {
+    return new Set(ids).size !== ids.length;
+}
+function sameSet(a, b) {
+    return a.length === b.length && a.every((id, i) => id === b[i]);
+}
+export function documentGovernancePolicy(kind, subjectAgentId, state, claimedRequiredSet) {
+    if (hasDuplicates(claimedRequiredSet)) {
+        return {
+            ok: false,
+            reason: "governance_claim_shape: the claimed required set names a signer more than once",
+        };
+    }
+    const claimed = canonical(claimedRequiredSet);
+    if (claimed.length === 0) {
+        return {
+            ok: false,
+            reason: "governance_claim_shape: a collection nobody is required to sign authorizes nothing",
+        };
+    }
+    if (kind === "remove_admin") {
+        // deriveArrangement already refused a non-admin subject and the last-admin case.
+        if (state.admins.size === 2) {
+            return {
+                ok: false,
+                reason: "governance_two_admin_deadlock: with exactly two admins neither can remove the other " +
+                    "(D3, by design) — the recourse is to stop working in this document, duplicate it, and " +
+                    "start fresh without them",
+            };
+        }
+        const others = canonical([...state.admins].filter((id) => id !== subjectAgentId));
+        if (!sameSet(claimed, others)) {
+            return {
+                ok: false,
+                reason: `governance_remove_admin_set: removing an admin takes the signatures of ALL other ` +
+                    `admins [${others.join(", ")}] exactly — the subject neither required nor counted — ` +
+                    `and the collection claims [${claimed.join(", ")}]`,
+            };
+        }
+        return { ok: true };
+    }
+    // Voluntary leave: the subject signing their own removal, admin or not. Checked before the
+    // admin-door rule below so a leaving admin is not told to demote themselves first.
+    if (kind === "remove_holder" &&
+        subjectAgentId !== null &&
+        claimed.length === 1 &&
+        claimed[0] === subjectAgentId) {
+        return { ok: true };
+    }
+    if (kind === "remove_holder" && subjectAgentId !== null && state.admins.has(subjectAgentId)) {
+        return {
+            ok: false,
+            reason: "governance_remove_admin_first: removing an admin from the document takes the " +
+                "remove_admin rule (all other admins) — a single admin cannot expel a fellow admin " +
+                "through the holder door, and holder removal drops admin status too",
+        };
+    }
+    // The single-admin kinds: add_holder, promote_admin, remove_holder (non-admin), change_property.
+    if (claimed.length !== 1) {
+        return {
+            ok: false,
+            reason: `governance_claim_shape: ${kind} is a single-admin action and the collection claims ` +
+                `${claimed.length} required signers — a wider claim lets an absent co-signer veto what ` +
+                `the rule gives to any one admin`,
+        };
+    }
+    if (!state.admins.has(claimed[0])) {
+        return {
+            ok: false,
+            reason: `governance_not_admin: ${claimed[0]} holds no admin power over this document — ` +
+                `${kind} takes a current admin's signature`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=document-governance.js.map

package/dist/document-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-governance.js","sourceRoot":"","sources":["../src/document-governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,SAAS,SAAS,CAAC,GAAsB;IACvC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;8FAE8F;AAC9F,SAAS,aAAa,CAAC,GAAsB;IAC3C,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC;AAC1C,CAAC;AAED,SAAS,OAAO,CAAC,CAAoB,EAAE,CAAoB;IACzD,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAmB,EACnB,cAA6B,EAC7B,KAAyE,EACzE,kBAAqC;IAErC,IAAI,aAAa,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,iFAAiF;QACjF,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,sFAAsF;oBACtF,wFAAwF;oBACxF,0BAA0B;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,mFAAmF;oBACnF,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yDAAyD;oBACrF,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACtD,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,2FAA2F;IAC3F,mFAAmF;IACnF,IACE,IAAI,KAAK,eAAe;QACxB,cAAc,KAAK,IAAI;QACvB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,EAC7B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,IAAI,KAAK,eAAe,IAAI,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,+EAA+E;gBAC/E,oFAAoF;gBACpF,oEAAoE;SACvE,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,2BAA2B,IAAI,sDAAsD;gBACrF,GAAG,OAAO,CAAC,MAAM,uEAAuE;gBACxF,iCAAiC;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,yBAAyB,OAAO,CAAC,CAAC,CAAC,6CAA6C;gBAChF,GAAG,IAAI,oCAAoC;SAC9C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/document-join-answer.d.ts

@@ -0,0 +1,34 @@
+/**
+ * DOD-MP-JOIN-1 — the invitee's ANSWER to a join offer: a signed, settle-once fact.
+ *
+ * Keyed on the ADMITTING AMENDMENT'S HASH — the amendment is what the invitee answers, and a
+ * re-invitation after a refusal is a new amendment with a new hash, so two answers can never be
+ * confused. Its own frame for the proposal-ack reason: a join offer is not in the envelope log,
+ * so `document_ack` would settle a hash of nothing.
+ *
+ * Consent is local and final the moment the operator makes it; sending the answer is
+ * best-effort, and an unreachable inviter gets no veto over the invitee's choice — the same
+ * doctrine as the proposal ack.
+ */
+/** Domain tag in slot 0 of the to-be-signed array. */
+export declare const DOCUMENT_JOIN_ANSWER_DOMAIN = "CELLO-DOCUMENT-JOIN-ANSWER-v1";
+export declare const MAX_JOIN_REFUSAL_REASON_LENGTH = 512;
+export interface DocumentJoinAnswer {
+    type: "document_join_answer";
+    document_id: string;
+    /** Hex hash of the admitting `add_holder` amendment — the settle key. */
+    amendment_hash: string;
+    invitee_agent_id: string;
+    accepted: boolean;
+    /** Operator prose on a refusal; explicit null on an accept — never absent. */
+    refusal_reason: string | null;
+    answered_at_ms: number;
+    /** Ed25519 (RFC 8032) by the invitee over `buildDocumentJoinAnswerTbs`. */
+    signature: Uint8Array;
+}
+export declare function buildDocumentJoinAnswerTbs(answer: DocumentJoinAnswer, opts?: {
+    preHash?: boolean;
+}): Uint8Array;
+export declare function encodeDocumentJoinAnswer(answer: DocumentJoinAnswer): Uint8Array;
+export declare function decodeDocumentJoinAnswer(input: Uint8Array): DocumentJoinAnswer;
+//# sourceMappingURL=document-join-answer.d.ts.map

package/dist/document-join-answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-join-answer.d.ts","sourceRoot":"","sources":["../src/document-join-answer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,sDAAsD;AACtD,eAAO,MAAM,2BAA2B,kCAAkC,CAAC;AAE3E,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAcZ;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,UAAU,CAW/E;AAiBD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CA8C9E"}

package/dist/document-join-answer.js

@@ -0,0 +1,100 @@
+/**
+ * DOD-MP-JOIN-1 — the invitee's ANSWER to a join offer: a signed, settle-once fact.
+ *
+ * Keyed on the ADMITTING AMENDMENT'S HASH — the amendment is what the invitee answers, and a
+ * re-invitation after a refusal is a new amendment with a new hash, so two answers can never be
+ * confused. Its own frame for the proposal-ack reason: a join offer is not in the envelope log,
+ * so `document_ack` would settle a hash of nothing.
+ *
+ * Consent is local and final the moment the operator makes it; sending the answer is
+ * best-effort, and an unreachable inviter gets no veto over the invitee's choice — the same
+ * doctrine as the proposal ack.
+ */
+import { createHash } from "node:crypto";
+import { encodeCbor, decodeCbor } from "./cbor.js";
+/** Domain tag in slot 0 of the to-be-signed array. */
+export const DOCUMENT_JOIN_ANSWER_DOMAIN = "CELLO-DOCUMENT-JOIN-ANSWER-v1";
+export const MAX_JOIN_REFUSAL_REASON_LENGTH = 512;
+export function buildDocumentJoinAnswerTbs(answer, opts = {}) {
+    const preimage = encodeCbor([
+        DOCUMENT_JOIN_ANSWER_DOMAIN,
+        answer.document_id,
+        answer.amendment_hash,
+        answer.invitee_agent_id,
+        answer.accepted,
+        answer.refusal_reason,
+        typeof answer.answered_at_ms === "number" && answer.answered_at_ms > 0xffffffff
+            ? BigInt(answer.answered_at_ms)
+            : answer.answered_at_ms,
+    ]);
+    if (opts.preHash === false)
+        return preimage;
+    return new Uint8Array(createHash("sha256").update(preimage).digest());
+}
+export function encodeDocumentJoinAnswer(answer) {
+    return encodeCbor({
+        type: answer.type,
+        document_id: answer.document_id,
+        amendment_hash: answer.amendment_hash,
+        invitee_agent_id: answer.invitee_agent_id,
+        accepted: answer.accepted,
+        refusal_reason: answer.refusal_reason,
+        answered_at_ms: answer.answered_at_ms,
+        signature: answer.signature,
+    });
+}
+function present(map, field) {
+    if (!(field in map)) {
+        throw new Error(`document_join_answer_missing_field: ${field} is mandatory and was not present`);
+    }
+    return map[field];
+}
+function str(map, field) {
+    const v = present(map, field);
+    if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`document_join_answer_field_type: ${field} must be a non-empty text string`);
+    }
+    return v;
+}
+export function decodeDocumentJoinAnswer(input) {
+    const decoded = decodeCbor(input);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+        throw new Error("document_join_answer_malformed: not a CBOR map");
+    }
+    const map = decoded;
+    const type = str(map, "type");
+    if (type !== "document_join_answer") {
+        throw new Error(`document_join_answer_type: expected document_join_answer, got ${type}`);
+    }
+    const accepted = present(map, "accepted");
+    if (typeof accepted !== "boolean") {
+        throw new Error("document_join_answer_field_type: accepted must be a boolean — consent is never inferred " +
+            "from a truthy value");
+    }
+    const reason = present(map, "refusal_reason");
+    if (reason !== null && typeof reason !== "string") {
+        throw new Error("document_join_answer_field_type: refusal_reason must be a text string or explicit null");
+    }
+    if (typeof reason === "string" && reason.length > MAX_JOIN_REFUSAL_REASON_LENGTH) {
+        throw new Error(`document_join_answer_field_type: refusal_reason exceeds ${MAX_JOIN_REFUSAL_REASON_LENGTH} chars`);
+    }
+    const answeredAt = present(map, "answered_at_ms");
+    if (typeof answeredAt !== "number" || !Number.isInteger(answeredAt)) {
+        throw new Error("document_join_answer_field_type: answered_at_ms must be an integer");
+    }
+    const signature = present(map, "signature");
+    if (!(signature instanceof Uint8Array)) {
+        throw new Error("document_join_answer_field_type: signature must be a CBOR byte string");
+    }
+    return {
+        type: "document_join_answer",
+        document_id: str(map, "document_id"),
+        amendment_hash: str(map, "amendment_hash"),
+        invitee_agent_id: str(map, "invitee_agent_id"),
+        accepted,
+        refusal_reason: reason,
+        answered_at_ms: answeredAt,
+        signature: new Uint8Array(signature),
+    };
+}
+//# sourceMappingURL=document-join-answer.js.map

package/dist/document-join-answer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-join-answer.js","sourceRoot":"","sources":["../src/document-join-answer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEnD,sDAAsD;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAgBlD,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,2BAA2B;QAC3B,MAAM,CAAC,WAAW;QAClB,MAAM,CAAC,cAAc;QACrB,MAAM,CAAC,gBAAgB;QACvB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,cAAc;QACrB,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,GAAG,UAAU;YAC7E,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,cAAc;KAC1B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA0B;IACjE,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,mCAAmC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,kCAAkC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAiB;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,qBAAqB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CACb,2DAA2D,8BAA8B,QAAQ,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC;QAC1C,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,QAAQ;QACR,cAAc,EAAE,MAAM;QACtB,cAAc,EAAE,UAAU;QAC1B,SAAS,EAAE,IAAI,UAAU,CAAC,SAAS,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/document-join.d.ts

@@ -0,0 +1,83 @@
+/**
+ * DOD-MP-JOIN-1 — the join offer: how a third party enters an existing document.
+ *
+ * The offer is a courier, not an authority. It carries the RECEIVED BYTES of the genesis
+ * proposal, the full amendment chain (the pending `add_holder` last), and the envelope-log
+ * snapshot — and the invitee's daemon DERIVES the arrangement from those bytes through the same
+ * replay every holder runs. The invitee consents to what they computed, never to what they were
+ * told: an offer whose chain does not replay admits nobody, whatever its prose.
+ *
+ * ── WHY THE SIGNATURE BINDS EVERY CARRIED BYTE ────────────────────────────────────────────────
+ *
+ * The TBS commits to the hash of the genesis bytes, of each amendment, and of each log envelope.
+ * Each carried payload is ALSO independently verifiable (the genesis by its proposer's
+ * signature, each amendment by its collection, each envelope by its sender) — the offer-level
+ * binding exists so the inviter cannot assemble a misleading BUNDLE out of individually-valid
+ * pieces and later disown the assembly. Who showed the invitee what is on the record.
+ *
+ * ── NEITHER ALONE ADMITS ANYONE ───────────────────────────────────────────────────────────────
+ *
+ * A valid offer makes a join POSSIBLE; the invitee's signed accept makes it REAL (the daemon
+ * unit wires that consent through the settle-once ack pattern). This module rules only on the
+ * offer's validity — GOVERN-1's dispositioned consent clause lands in the daemon receive path.
+ */
+import { type DocumentProposalEnvelope } from "./document-proposal.js";
+import { type Arrangement, type ArrangementGenesis, type DocumentAmendmentEnvelope, type SignerPolicy } from "./document-amendment.js";
+/** Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags. */
+export declare const DOCUMENT_JOIN_OFFER_DOMAIN = "CELLO-DOCUMENT-JOIN-OFFER-v1";
+export interface DocumentJoinOffer {
+    type: "document_join_offer";
+    feature_version: number;
+    /** The admin authoring this offer — must be a claimed signer of the pending amendment. */
+    inviter_agent_id: string;
+    invitee_agent_id: string;
+    document_id: string;
+    /** The genesis proposal AS RECEIVED — the invitee re-derives `document_id` from these bytes. */
+    genesis: Uint8Array;
+    /** The full amendment chain as received bytes, ordered, the pending `add_holder` LAST. */
+    amendments: Uint8Array[];
+    /** The update-envelope log snapshot (D1's cheap path) — may be empty for a young document. */
+    envelope_log: Uint8Array[];
+    offered_at_ms: number;
+    /** Ed25519 (RFC 8032) by the inviter over `buildDocumentJoinOfferTbs`. */
+    signature: Uint8Array;
+}
+/**
+ * The canonical to-be-signed preimage. Payloads enter as HASHES (arrays of 32-byte digests are
+ * deterministic CBOR — the multisig precedent), so the signature binds every carried byte
+ * without re-encoding megabytes into the preimage.
+ */
+export declare function buildDocumentJoinOfferTbs(offer: DocumentJoinOffer, opts?: {
+    preHash?: boolean;
+}): Uint8Array;
+export declare function encodeDocumentJoinOffer(offer: DocumentJoinOffer): Uint8Array;
+export declare function decodeDocumentJoinOffer(input: Uint8Array): DocumentJoinOffer;
+/**
+ * The replay's starting facts, computed from a decoded genesis proposal — ONE implementation for
+ * every consumer (join validation, the daemon's amendment receive and accept paths), because two
+ * copies of the everyone-admin default is how two holders derive different arrangements from one
+ * genesis. Absent `admin_set` means both genesis participants govern (the bilateral default);
+ * `admin_set` itself lives on the ARRANGEMENT, not in the scalar properties bag the replay
+ * derives `change_property` against.
+ */
+export declare function arrangementGenesisFromProposal(genesis: DocumentProposalEnvelope): ArrangementGenesis;
+export type JoinOfferValidation = {
+    ok: true;
+    /** Derived by REPLAY of the carried bytes — the consent surface, computed not trusted. */
+    arrangement: Arrangement;
+    genesis: DocumentProposalEnvelope;
+    amendments: DocumentAmendmentEnvelope[];
+    /** Hex hash of the pending `add_holder` — the settle key for the invitee's answer. */
+    pendingAmendmentHash: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * The invitee's ruling on an offer. Order is the disclosure-and-trust boundary: the version
+ * answer first (a mismatched build must get a sentence, not a failed signature), then the
+ * inviter's signature (nothing else is worth computing on an unauthenticated bundle), then the
+ * carried payloads each on their own signatures, then the replay.
+ */
+export declare function validateDocumentJoinOffer(offer: DocumentJoinOffer, policy: SignerPolicy, verify: (agentId: string, tbs: Uint8Array, signature: Uint8Array) => boolean): JoinOfferValidation;
+//# sourceMappingURL=document-join.d.ts.map

package/dist/document-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-join.d.ts","sourceRoot":"","sources":["../src/document-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAEjC,kGAAkG;AAClG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,OAAO,EAAE,UAAU,CAAC;IACpB,0FAA0F;IAC1F,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,8FAA8F;IAC9F,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,UAAU,CAAC;CACvB;AAMD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,EACxB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,UAAU,CAgBZ;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,UAAU,CAa5E;AAiCD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CA8B5E;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wBAAwB,GAChC,kBAAkB,CAgBpB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,0FAA0F;IAC1F,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,wBAAwB,CAAC;IAClC,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,sFAAsF;IACtF,oBAAoB,EAAE,MAAM,CAAC;CAC9B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAMlC;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,GAC3E,mBAAmB,CAyFrB"}

package/dist/document-join.js

@@ -0,0 +1,225 @@
+/**
+ * DOD-MP-JOIN-1 — the join offer: how a third party enters an existing document.
+ *
+ * The offer is a courier, not an authority. It carries the RECEIVED BYTES of the genesis
+ * proposal, the full amendment chain (the pending `add_holder` last), and the envelope-log
+ * snapshot — and the invitee's daemon DERIVES the arrangement from those bytes through the same
+ * replay every holder runs. The invitee consents to what they computed, never to what they were
+ * told: an offer whose chain does not replay admits nobody, whatever its prose.
+ *
+ * ── WHY THE SIGNATURE BINDS EVERY CARRIED BYTE ────────────────────────────────────────────────
+ *
+ * The TBS commits to the hash of the genesis bytes, of each amendment, and of each log envelope.
+ * Each carried payload is ALSO independently verifiable (the genesis by its proposer's
+ * signature, each amendment by its collection, each envelope by its sender) — the offer-level
+ * binding exists so the inviter cannot assemble a misleading BUNDLE out of individually-valid
+ * pieces and later disown the assembly. Who showed the invitee what is on the record.
+ *
+ * ── NEITHER ALONE ADMITS ANYONE ───────────────────────────────────────────────────────────────
+ *
+ * A valid offer makes a join POSSIBLE; the invitee's signed accept makes it REAL (the daemon
+ * unit wires that consent through the settle-once ack pattern). This module rules only on the
+ * offer's validity — GOVERN-1's dispositioned consent clause lands in the daemon receive path.
+ */
+import { createHash } from "node:crypto";
+import { encodeCbor, decodeCbor } from "./cbor.js";
+import { DOCUMENT_FEATURE_VERSION, decodeDocumentProposal, documentIdFromProposal, buildDocumentProposalTbs, } from "./document-proposal.js";
+import { decodeDocumentAmendment, deriveArrangement, } from "./document-amendment.js";
+/** Domain tag in slot 0 of the to-be-signed array. Sibling of the other CELLO-DOCUMENT-* tags. */
+export const DOCUMENT_JOIN_OFFER_DOMAIN = "CELLO-DOCUMENT-JOIN-OFFER-v1";
+function sha256(bytes) {
+    return new Uint8Array(createHash("sha256").update(bytes).digest());
+}
+/**
+ * The canonical to-be-signed preimage. Payloads enter as HASHES (arrays of 32-byte digests are
+ * deterministic CBOR — the multisig precedent), so the signature binds every carried byte
+ * without re-encoding megabytes into the preimage.
+ */
+export function buildDocumentJoinOfferTbs(offer, opts = {}) {
+    const preimage = encodeCbor([
+        DOCUMENT_JOIN_OFFER_DOMAIN,
+        offer.feature_version,
+        offer.inviter_agent_id,
+        offer.invitee_agent_id,
+        offer.document_id,
+        sha256(offer.genesis),
+        offer.amendments.map(sha256),
+        offer.envelope_log.map(sha256),
+        typeof offer.offered_at_ms === "number" && offer.offered_at_ms > 0xffffffff
+            ? BigInt(offer.offered_at_ms)
+            : offer.offered_at_ms,
+    ]);
+    if (opts.preHash === false)
+        return preimage;
+    return sha256(preimage);
+}
+export function encodeDocumentJoinOffer(offer) {
+    return encodeCbor({
+        type: offer.type,
+        feature_version: offer.feature_version,
+        inviter_agent_id: offer.inviter_agent_id,
+        invitee_agent_id: offer.invitee_agent_id,
+        document_id: offer.document_id,
+        genesis: offer.genesis,
+        amendments: offer.amendments,
+        envelope_log: offer.envelope_log,
+        offered_at_ms: offer.offered_at_ms,
+        signature: offer.signature,
+    });
+}
+function present(map, field) {
+    if (!(field in map)) {
+        throw new Error(`document_join_missing_field: ${field} is mandatory and was not present`);
+    }
+    return map[field];
+}
+function str(map, field) {
+    const v = present(map, field);
+    if (typeof v !== "string" || v.length === 0) {
+        throw new Error(`document_join_field_type: ${field} must be a non-empty text string`);
+    }
+    return v;
+}
+function bytes(map, field) {
+    const v = present(map, field);
+    if (!(v instanceof Uint8Array)) {
+        throw new Error(`document_join_field_type: ${field} must be a CBOR byte string`);
+    }
+    return new Uint8Array(v);
+}
+function byteArray(map, field) {
+    const v = present(map, field);
+    if (!Array.isArray(v) || v.some((e) => !(e instanceof Uint8Array))) {
+        throw new Error(`document_join_field_type: ${field} must be an array of CBOR byte strings`);
+    }
+    return v.map((e) => new Uint8Array(e));
+}
+export function decodeDocumentJoinOffer(input) {
+    const decoded = decodeCbor(input);
+    if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) {
+        throw new Error("document_join_malformed: not a CBOR map");
+    }
+    const map = decoded;
+    const type = str(map, "type");
+    if (type !== "document_join_offer") {
+        throw new Error(`document_join_type: expected document_join_offer, got ${type}`);
+    }
+    const featureVersion = present(map, "feature_version");
+    if (typeof featureVersion !== "number" || !Number.isInteger(featureVersion) || featureVersion < 1) {
+        throw new Error("document_join_field_type: feature_version must be a positive integer");
+    }
+    const offeredAt = present(map, "offered_at_ms");
+    if (typeof offeredAt !== "number" || !Number.isInteger(offeredAt)) {
+        throw new Error("document_join_field_type: offered_at_ms must be an integer");
+    }
+    return {
+        type: "document_join_offer",
+        feature_version: featureVersion,
+        inviter_agent_id: str(map, "inviter_agent_id"),
+        invitee_agent_id: str(map, "invitee_agent_id"),
+        document_id: str(map, "document_id"),
+        genesis: bytes(map, "genesis"),
+        amendments: byteArray(map, "amendments"),
+        envelope_log: byteArray(map, "envelope_log"),
+        offered_at_ms: offeredAt,
+        signature: bytes(map, "signature"),
+    };
+}
+/**
+ * The replay's starting facts, computed from a decoded genesis proposal — ONE implementation for
+ * every consumer (join validation, the daemon's amendment receive and accept paths), because two
+ * copies of the everyone-admin default is how two holders derive different arrangements from one
+ * genesis. Absent `admin_set` means both genesis participants govern (the bilateral default);
+ * `admin_set` itself lives on the ARRANGEMENT, not in the scalar properties bag the replay
+ * derives `change_property` against.
+ */
+export function arrangementGenesisFromProposal(genesis) {
+    return {
+        documentId: documentIdFromProposal(genesis),
+        proposerAgentId: genesis.proposer_agent_id,
+        peerAgentId: genesis.peer_agent_id,
+        adminSet: genesis.properties.admin_set ?? [genesis.proposer_agent_id, genesis.peer_agent_id],
+        properties: {
+            assurance_tier: genesis.properties.assurance_tier,
+            schema_enforcement: genesis.properties.schema_enforcement,
+            topology: genesis.properties.topology,
+            append_only: genesis.properties.append_only,
+            ...(genesis.properties.content_profile !== undefined
+                ? { content_profile: genesis.properties.content_profile }
+                : {}),
+        },
+    };
+}
+function refuse(reason) {
+    return { ok: false, reason };
+}
+/**
+ * The invitee's ruling on an offer. Order is the disclosure-and-trust boundary: the version
+ * answer first (a mismatched build must get a sentence, not a failed signature), then the
+ * inviter's signature (nothing else is worth computing on an unauthenticated bundle), then the
+ * carried payloads each on their own signatures, then the replay.
+ */
+export function validateDocumentJoinOffer(offer, policy, verify) {
+    if (offer.feature_version !== DOCUMENT_FEATURE_VERSION) {
+        const side = offer.feature_version > DOCUMENT_FEATURE_VERSION
+            ? "upgrade this client to join it"
+            : "ask the inviter to upgrade theirs";
+        return refuse(`join_feature_version: the offer speaks document feature version ${offer.feature_version} ` +
+            `and this build speaks ${DOCUMENT_FEATURE_VERSION} — ${side}`);
+    }
+    if (!verify(offer.inviter_agent_id, buildDocumentJoinOfferTbs(offer), offer.signature)) {
+        return refuse(`join_signature_invalid: the offer claims to come from ${offer.inviter_agent_id} but its ` +
+            `signature does not verify against that agent — nothing about the bundle is trustworthy`);
+    }
+    let genesis;
+    try {
+        genesis = decodeDocumentProposal(offer.genesis);
+    }
+    catch (err) {
+        return refuse(`join_genesis_undecodable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (documentIdFromProposal(genesis) !== offer.document_id) {
+        return refuse(`join_genesis_mismatch: the carried genesis hashes to a different document than the offer ` +
+            `names — the anchor cannot be swapped`);
+    }
+    if (!verify(genesis.proposer_agent_id, buildDocumentProposalTbs(genesis), genesis.signature)) {
+        return refuse(`join_genesis_signature_invalid: the genesis proposal does not verify against its named ` +
+            `proposer ${genesis.proposer_agent_id}`);
+    }
+    if (offer.amendments.length === 0) {
+        return refuse("join_no_pending_amendment: an offer must carry the amendment chain ending in the " +
+            "add_holder that admits the invitee — an empty chain admits nobody");
+    }
+    let amendments;
+    try {
+        amendments = offer.amendments.map((a) => decodeDocumentAmendment(a));
+    }
+    catch (err) {
+        return refuse(`join_amendment_undecodable: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const derived = deriveArrangement(arrangementGenesisFromProposal(genesis), amendments, policy, verify);
+    if (!derived.ok) {
+        // The replay's reason IS the diagnosis — passed through, never substituted.
+        return refuse(derived.reason);
+    }
+    const pending = amendments[amendments.length - 1];
+    if (pending.body.kind !== "add_holder" || pending.body.subject_agent_id !== offer.invitee_agent_id) {
+        return refuse(`join_not_for_invitee: the chain's last amendment does not admit ${offer.invitee_agent_id} — ` +
+            `an offer is addressed to the holder its pending amendment names`);
+    }
+    if (!pending.collection.required_signers.includes(offer.inviter_agent_id)) {
+        return refuse(`join_inviter_not_signer: ${offer.inviter_agent_id} authored the offer but is not a claimed ` +
+            `signer of the admitting amendment — the offer's author must be behind the admission`);
+    }
+    return {
+        ok: true,
+        arrangement: derived.arrangement,
+        genesis,
+        amendments,
+        // Unconditional: after a successful replay the subject_hash provably equals the amendment
+        // hash, and a conditional empty-string key would collide every document on "" if the
+        // invariant ever broke — better to emit the hex of whatever verified.
+        pendingAmendmentHash: Buffer.from(pending.collection.subject_hash).toString("hex"),
+    };
+}
+//# sourceMappingURL=document-join.js.map

package/dist/document-join.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-join.js","sourceRoot":"","sources":["../src/document-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,GAKlB,MAAM,yBAAyB,CAAC;AAEjC,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AAoBzE,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAwB,EACxB,OAA8B,EAAE;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC;QAC1B,0BAA0B;QAC1B,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,gBAAgB;QACtB,KAAK,CAAC,WAAW;QACjB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9B,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,GAAG,UAAU;YACzE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;YAC7B,CAAC,CAAC,KAAK,CAAC,aAAa;KACxB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB;IAC9D,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAA4B,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,mCAAmC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,GAAG,CAAC,GAA4B,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,kCAAkC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B,EAAE,KAAa;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,6BAA6B,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B,EAAE,KAAa;IAC5D,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,wCAAwC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,CAAe,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAiB;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,eAAe,EAAE,cAAc;QAC/B,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,gBAAgB,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAC9C,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACpC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC;QAC9B,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC;QACxC,YAAY,EAAE,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC;QAC5C,aAAa,EAAE,SAAS;QACxB,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAiC;IAEjC,OAAO;QACL,UAAU,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,OAAO,CAAC,iBAAiB;QAC1C,WAAW,EAAE,OAAO,CAAC,aAAa;QAClC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,aAAa,CAAC;QAC5F,UAAU,EAAE;YACV,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc;YACjD,kBAAkB,EAAE,OAAO,CAAC,UAAU,CAAC,kBAAkB;YACzD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ;YACrC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW;YAC3C,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,KAAK,SAAS;gBAClD,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAcD,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAwB,EACxB,MAAoB,EACpB,MAA4E;IAE5E,IAAI,KAAK,CAAC,eAAe,KAAK,wBAAwB,EAAE,CAAC;QACvD,MAAM,IAAI,GACR,KAAK,CAAC,eAAe,GAAG,wBAAwB;YAC9C,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,mCAAmC,CAAC;QAC1C,OAAO,MAAM,CACX,mEAAmE,KAAK,CAAC,eAAe,GAAG;YACzF,yBAAyB,wBAAwB,MAAM,IAAI,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACvF,OAAO,MAAM,CACX,yDAAyD,KAAK,CAAC,gBAAgB,WAAW;YACxF,wFAAwF,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,MAAM,CACX,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1D,OAAO,MAAM,CACX,2FAA2F;YACzF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7F,OAAO,MAAM,CACX,yFAAyF;YACvF,YAAY,OAAO,CAAC,iBAAiB,EAAE,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CACX,mFAAmF;YACjF,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,UAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,MAAM,CACX,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAC/B,8BAA8B,CAAC,OAAO,CAAC,EACvC,UAAU,EACV,MAAM,EACN,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,4EAA4E;QAC5E,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACnG,OAAO,MAAM,CACX,mEAAmE,KAAK,CAAC,gBAAgB,KAAK;YAC5F,iEAAiE,CACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1E,OAAO,MAAM,CACX,4BAA4B,KAAK,CAAC,gBAAgB,2CAA2C;YAC3F,qFAAqF,CACxF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO;QACP,UAAU;QACV,0FAA0F;QAC1F,qFAAqF;QACrF,sEAAsE;QACtE,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KACnF,CAAC;AACJ,CAAC"}