@ifc-lite/collab-server 0.2.0

package/dist/persistence.js

@@ -0,0 +1,108 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Pluggable persistence interface.
+ *
+ * v0.2 ships two implementations:
+ *   - `MemoryPersistence` (default for tests)
+ *   - `FilePersistence`   (default for `start()` — append-only log per room)
+ *
+ * v0.5 will add S3 + Redis variants per spec §12.2.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export class MemoryPersistence {
+    logs = new Map();
+    async load(roomId) {
+        const arr = this.logs.get(roomId);
+        if (!arr || arr.length === 0)
+            return null;
+        return concat(arr);
+    }
+    async append(roomId, update) {
+        const arr = this.logs.get(roomId) ?? [];
+        arr.push(update);
+        this.logs.set(roomId, arr);
+    }
+    async compact(roomId, mergedState) {
+        this.logs.set(roomId, [mergedState]);
+    }
+    async drop(roomId) {
+        this.logs.delete(roomId);
+    }
+}
+/**
+ * Append-only file-per-room persistence.
+ *
+ * Update layout: each `append()` writes one frame `[length:u32][bytes]`
+ * to `<dataDir>/<sanitizedRoomId>.log`. `load()` reads the file and
+ * returns the concatenated payload.
+ *
+ * Compaction rewrites the log atomically by writing to a temp file then
+ * renaming.
+ */
+export class FilePersistence {
+    dataDir;
+    constructor(opts) {
+        this.dataDir = opts.dataDir;
+        fs.mkdirSync(this.dataDir, { recursive: true });
+    }
+    logPath(roomId) {
+        const safe = roomId.replace(/[^a-zA-Z0-9._-]/g, '_');
+        return path.join(this.dataDir, `${safe}.log`);
+    }
+    async load(roomId) {
+        const file = this.logPath(roomId);
+        if (!fs.existsSync(file))
+            return null;
+        const buf = await fs.promises.readFile(file);
+        if (buf.byteLength === 0)
+            return null;
+        const frames = [];
+        let offset = 0;
+        while (offset + 4 <= buf.byteLength) {
+            const len = buf.readUInt32LE(offset);
+            offset += 4;
+            if (offset + len > buf.byteLength)
+                break;
+            frames.push(new Uint8Array(buf.buffer, buf.byteOffset + offset, len));
+            offset += len;
+        }
+        if (frames.length === 0)
+            return null;
+        return concat(frames);
+    }
+    async append(roomId, update) {
+        const file = this.logPath(roomId);
+        const header = Buffer.alloc(4);
+        header.writeUInt32LE(update.byteLength, 0);
+        const body = Buffer.concat([header, Buffer.from(update)]);
+        await fs.promises.appendFile(file, body);
+    }
+    async compact(roomId, mergedState) {
+        const file = this.logPath(roomId);
+        const tmp = `${file}.tmp`;
+        const header = Buffer.alloc(4);
+        header.writeUInt32LE(mergedState.byteLength, 0);
+        await fs.promises.writeFile(tmp, Buffer.concat([header, Buffer.from(mergedState)]));
+        await fs.promises.rename(tmp, file);
+    }
+    async drop(roomId) {
+        const file = this.logPath(roomId);
+        if (fs.existsSync(file)) {
+            await fs.promises.unlink(file);
+        }
+    }
+}
+function concat(arr) {
+    const total = arr.reduce((n, a) => n + a.byteLength, 0);
+    const out = new Uint8Array(total);
+    let o = 0;
+    for (const a of arr) {
+        out.set(a, o);
+        o += a.byteLength;
+    }
+    return out;
+}
+//# sourceMappingURL=persistence.js.map

package/dist/persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.js","sourceRoot":"","sources":["../src/persistence.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAalC,MAAM,OAAO,iBAAiB;IACX,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAExD,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAAkB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,WAAuB;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;CACF;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IACT,OAAO,CAAS;IAEjC,YAAY,IAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,OAAO,CAAC,MAAc;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,UAAU;gBAAE,MAAM;YACzC,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAAkB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,WAAuB;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,MAAM,CAAC,GAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/rate-limit.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Per-peer write budget — open problem #10.
+ *
+ * AI agents (and over-eager scripts) can outwrite humans 100× in a
+ * sustained session. The server gates per-connection writes with a token
+ * bucket so a single agent peer can't starve real-time human edits.
+ *
+ * Default thresholds are generous; production deployments should tune
+ * them per role (humans get higher, service accounts lower).
+ */
+export interface RateLimitOptions {
+    /** Capacity of the token bucket — burst size. Default 200. */
+    capacity?: number;
+    /** Refill rate in tokens per second. Default 60. */
+    refillPerSecond?: number;
+}
+export interface RateLimiter {
+    /**
+     * Try to consume `n` tokens. Returns true if allowed, false if the
+     * bucket is empty.
+     */
+    tryConsume(n?: number): boolean;
+    /** Current available tokens (rounded). */
+    available(): number;
+    /** Reset the bucket to full. */
+    reset(): void;
+}
+export declare function createRateLimiter(opts?: RateLimitOptions): RateLimiter;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,0CAA0C;IAC1C,SAAS,IAAI,MAAM,CAAC;IACpB,gCAAgC;IAChC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,gBAAqB,GAAG,WAAW,CAiC1E"}

package/dist/rate-limit.js

@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+export function createRateLimiter(opts = {}) {
+    const capacity = opts.capacity ?? 200;
+    const refill = opts.refillPerSecond ?? 60;
+    let tokens = capacity;
+    let lastRefill = Date.now();
+    const top = () => {
+        const now = Date.now();
+        const elapsed = (now - lastRefill) / 1000;
+        if (elapsed > 0) {
+            tokens = Math.min(capacity, tokens + elapsed * refill);
+            lastRefill = now;
+        }
+    };
+    return {
+        tryConsume(n = 1) {
+            top();
+            if (tokens >= n) {
+                tokens -= n;
+                return true;
+            }
+            return false;
+        },
+        available() {
+            top();
+            return Math.floor(tokens);
+        },
+        reset() {
+            tokens = capacity;
+            lastRefill = Date.now();
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAgC/D,MAAM,UAAU,iBAAiB,CAAC,OAAyB,EAAE;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE5B,MAAM,GAAG,GAAG,GAAG,EAAE;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;YACvD,UAAU,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,CAAC,GAAG,CAAC;YACd,GAAG,EAAE,CAAC;YACN,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS;YACP,GAAG,EAAE,CAAC;YACN,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,KAAK;YACH,MAAM,GAAG,QAAQ,CAAC;YAClB,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/replay-protect.d.ts

@@ -0,0 +1,51 @@
+export interface UpdateEnvelope {
+    clientId: number;
+    clock: number;
+    payload: Uint8Array;
+    hmac: string;
+}
+export interface ReplayDecision {
+    ok: boolean;
+    reason?: 'bad-mac' | 'replay' | 'malformed';
+}
+export interface ReplayProtector {
+    /**
+     * Verify `envelope` against the configured secret + the tracked
+     * highest-seen clock. Increments the tracked clock on success.
+     */
+    verify(envelope: UpdateEnvelope): ReplayDecision;
+    /** Get the highest accepted clock for a clientId (0 if unseen). */
+    highestClock(clientId: number): number;
+    /** Reset internal state (tests / room recycling). */
+    reset(): void;
+}
+export interface ReplayProtectorOptions {
+    /** HMAC-SHA256 secret. Must match the client. */
+    secret: string;
+    /** Maximum clock drift accepted in either direction (default 0 = strict monotonic). */
+    driftTolerance?: number;
+}
+export declare function createReplayProtector(opts: ReplayProtectorOptions): ReplayProtector;
+/**
+ * Compute an HMAC-SHA256 hex digest over `(clientId || clock || payload)`.
+ * Exposed so clients in tests (and non-Node environments) can produce
+ * matching tags from the same canonical encoding.
+ */
+export declare function computeHmac(secret: Buffer, clientId: number, clock: number, payload: Uint8Array): string;
+export declare function decodeSignedFrame(frame: Uint8Array): UpdateEnvelope | null;
+export declare function encodeSignedFrame(envelope: UpdateEnvelope): Uint8Array;
+/**
+ * Adapter from a `ReplayProtector` to the server's `VerifyMessageFn`
+ * shape. Frames whose first byte is the `SIGNED_TAG` are parsed and
+ * verified; messages that aren't tagged are passed through (for clients
+ * that don't sign). To force-reject unsigned messages, set
+ * `requireSigned: true`.
+ */
+export declare function verifyWithReplayProtector(protector: ReplayProtector, options?: {
+    requireSigned?: boolean;
+}): (msg: Uint8Array) => {
+    ok: boolean;
+    reason?: string;
+    payload?: Uint8Array;
+};
+//# sourceMappingURL=replay-protect.d.ts.map

package/dist/replay-protect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-protect.d.ts","sourceRoot":"","sources":["../src/replay-protect.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;CAC7C;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,cAAc,CAAC;IACjD,mEAAmE;IACnE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,qDAAqD;IACrD,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,eAAe,CAoCnF;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAOxG;AAyBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,IAAI,CAS1E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,GAAG,UAAU,CAUtE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,eAAe,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,CAAC,GAAG,EAAE,UAAU,KAAK;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,UAAU,CAAA;CAAE,CAY7E"}

package/dist/replay-protect.js

@@ -0,0 +1,134 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Anti-replay verification (open problem #8).
+ *
+ * Every authenticated peer can send Y updates over the websocket. The
+ * server validates the JWT on connect, but unless the bytes themselves
+ * are signed, a malicious peer with a valid token can replay or forge
+ * updates.
+ *
+ * This module ships an opt-in HMAC-SHA256 verifier:
+ *   - Client side (out of scope here): tag each update with
+ *     `H = hmac_sha256(secret, clientId || clock || update)`.
+ *   - Server side: validate `H` and enforce monotonic clocks per
+ *     clientId so old payloads can't be replayed.
+ *
+ * The verifier is provided as a pure function so deployers wire it into
+ * their handler pipeline alongside the existing `canWrite` role check.
+ */
+import * as crypto from 'node:crypto';
+export function createReplayProtector(opts) {
+    const secret = Buffer.from(opts.secret, 'utf8');
+    const drift = opts.driftTolerance ?? 0;
+    const seen = new Map();
+    return {
+        verify(envelope) {
+            if (typeof envelope.clientId !== 'number' ||
+                typeof envelope.clock !== 'number' ||
+                !(envelope.payload instanceof Uint8Array) ||
+                typeof envelope.hmac !== 'string') {
+                return { ok: false, reason: 'malformed' };
+            }
+            const expected = computeHmac(secret, envelope.clientId, envelope.clock, envelope.payload);
+            if (!constantTimeEqual(envelope.hmac, expected)) {
+                return { ok: false, reason: 'bad-mac' };
+            }
+            const last = seen.get(envelope.clientId) ?? 0;
+            if (envelope.clock + drift <= last) {
+                return { ok: false, reason: 'replay' };
+            }
+            seen.set(envelope.clientId, envelope.clock);
+            return { ok: true };
+        },
+        highestClock(clientId) {
+            return seen.get(clientId) ?? 0;
+        },
+        reset() {
+            seen.clear();
+        },
+    };
+}
+/**
+ * Compute an HMAC-SHA256 hex digest over `(clientId || clock || payload)`.
+ * Exposed so clients in tests (and non-Node environments) can produce
+ * matching tags from the same canonical encoding.
+ */
+export function computeHmac(secret, clientId, clock, payload) {
+    const header = Buffer.alloc(16);
+    header.writeUInt32BE(0, 0);
+    header.writeUInt32BE(clientId >>> 0, 4);
+    header.writeUInt32BE(0, 8);
+    header.writeUInt32BE(clock >>> 0, 12);
+    return crypto.createHmac('sha256', secret).update(header).update(payload).digest('hex');
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/* ------------------------------------------------------------------ */
+/* Wire integration                                                     */
+/* ------------------------------------------------------------------ */
+/**
+ * Default envelope decoder for messages of the form
+ * `[1B SIGNED_TAG = 0xff][4B clientId][4B clock][32B HMAC hex'd ascii][N B payload]`.
+ *
+ * Total framing overhead is 1 + 4 + 4 + 64 + N = 73 + N bytes — small
+ * relative to typical Y updates. Apps with their own envelope can
+ * write a custom verifier instead.
+ */
+const SIGNED_TAG = 0xff;
+export function decodeSignedFrame(frame) {
+    if (frame.byteLength < 1 + 4 + 4 + 64)
+        return null;
+    if (frame[0] !== SIGNED_TAG)
+        return null;
+    const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+    const clientId = view.getUint32(1, false);
+    const clock = view.getUint32(5, false);
+    const hmac = new TextDecoder('ascii').decode(frame.subarray(9, 9 + 64));
+    const payload = frame.subarray(9 + 64);
+    return { clientId, clock, payload, hmac };
+}
+export function encodeSignedFrame(envelope) {
+    const payload = envelope.payload;
+    const out = new Uint8Array(1 + 4 + 4 + 64 + payload.byteLength);
+    out[0] = SIGNED_TAG;
+    const view = new DataView(out.buffer);
+    view.setUint32(1, envelope.clientId >>> 0, false);
+    view.setUint32(5, envelope.clock >>> 0, false);
+    out.set(new TextEncoder().encode(envelope.hmac), 9);
+    out.set(payload, 9 + 64);
+    return out;
+}
+/**
+ * Adapter from a `ReplayProtector` to the server's `VerifyMessageFn`
+ * shape. Frames whose first byte is the `SIGNED_TAG` are parsed and
+ * verified; messages that aren't tagged are passed through (for clients
+ * that don't sign). To force-reject unsigned messages, set
+ * `requireSigned: true`.
+ */
+export function verifyWithReplayProtector(protector, options = {}) {
+    return (msg) => {
+        if (msg.byteLength === 0 || msg[0] !== SIGNED_TAG) {
+            if (options.requireSigned)
+                return { ok: false, reason: 'unsigned' };
+            return { ok: true };
+        }
+        const envelope = decodeSignedFrame(msg);
+        if (!envelope)
+            return { ok: false, reason: 'malformed' };
+        const result = protector.verify(envelope);
+        if (!result.ok)
+            return { ok: false, reason: result.reason };
+        return { ok: true, payload: envelope.payload };
+    };
+}
+//# sourceMappingURL=replay-protect.js.map

package/dist/replay-protect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-protect.js","sourceRoot":"","sources":["../src/replay-protect.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAiCtC,MAAM,UAAU,qBAAqB,CAAC,IAA4B;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,OAAO;QACL,MAAM,CAAC,QAAQ;YACb,IACE,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBACrC,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBAClC,CAAC,CAAC,QAAQ,CAAC,OAAO,YAAY,UAAU,CAAC;gBACzC,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EACjC,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YAC5C,CAAC;YAED,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1F,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,CAAC,KAAK,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,YAAY,CAAC,QAAQ;YACnB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,QAAgB,EAAE,KAAa,EAAE,OAAmB;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,aAAa,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,UAAU,iBAAiB,CAAC,KAAiB;IACjD,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAwB;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAA0B,EAC1B,UAAuC,EAAE;IAEzC,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,aAAa;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC"}

package/dist/retention.d.ts

@@ -0,0 +1,32 @@
+export interface RetentionPolicy {
+    /** Keep the raw append-only log for this many days. Default 90. */
+    fullLogDays?: number;
+    /** Keep compacted snapshots for this many days. Default 365 * 5. */
+    snapshotsDays?: number;
+    /** Optional cap on total bytes per room. Soft — we trim oldest first. */
+    maxBytesPerRoom?: number;
+}
+export declare const DEFAULT_RETENTION: Required<Omit<RetentionPolicy, 'maxBytesPerRoom'>> & Pick<RetentionPolicy, 'maxBytesPerRoom'>;
+export interface RetentionDecision {
+    /** Files to delete entirely. */
+    drop: string[];
+    /** Bytes that will be reclaimed once `drop` is processed. */
+    reclaimBytes: number;
+}
+/**
+ * Plan retention for a directory of room logs/snapshots.
+ *
+ * Naming convention used by `FilePersistence`:
+ *   - `<roomId>.log`            ← active log (never deleted by this fn)
+ *   - `<roomId>.log.<isoStamp>` ← rotated logs (auditable)
+ *   - `<roomId>.snap.<isoStamp>` ← periodic snapshots (kept longer)
+ *
+ * Tools shipping their own naming convention can pass a custom matcher
+ * via the `classify` option.
+ */
+export declare function planRetention(dir: string, policy?: RetentionPolicy, options?: {
+    classify?: (file: string) => 'active' | 'log' | 'snapshot' | 'unknown';
+}): RetentionDecision;
+/** Apply a `RetentionDecision` to disk. Returns the bytes actually freed. */
+export declare function applyRetention(decision: RetentionDecision): Promise<number>;
+//# sourceMappingURL=retention.d.ts.map

package/dist/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,GAChF,IAAI,CAAC,eAAe,EAAE,iBAAiB,CAIxC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAC;CACtB;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,eAAoB,EAC5B,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,CAAA;CAAO,GACvF,iBAAiB,CAiDnB;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAejF"}

package/dist/retention.js

@@ -0,0 +1,112 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/**
+ * Retention policy (spec §12.2 + open problem #9).
+ *
+ * Storing every Y update for years × every project is expensive. The
+ * default policy we ship: keep the full update log for `fullLogDays`
+ * (90 by default), then keep only periodic snapshots after that.
+ *
+ * The server's `RoomManager` already compacts every `compactEvery`
+ * updates; this module adds the "drop old log frames" step that runs
+ * out-of-band. It is written as pure functions so a deployment can
+ * trigger it from cron, a queue, or a Lambda — wherever fits.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+export const DEFAULT_RETENTION = {
+    fullLogDays: 90,
+    snapshotsDays: 365 * 5,
+    maxBytesPerRoom: undefined,
+};
+/**
+ * Plan retention for a directory of room logs/snapshots.
+ *
+ * Naming convention used by `FilePersistence`:
+ *   - `<roomId>.log`            ← active log (never deleted by this fn)
+ *   - `<roomId>.log.<isoStamp>` ← rotated logs (auditable)
+ *   - `<roomId>.snap.<isoStamp>` ← periodic snapshots (kept longer)
+ *
+ * Tools shipping their own naming convention can pass a custom matcher
+ * via the `classify` option.
+ */
+export function planRetention(dir, policy = {}, options = {}) {
+    if (!fs.existsSync(dir))
+        return { drop: [], reclaimBytes: 0 };
+    const cfg = {
+        ...DEFAULT_RETENTION,
+        ...policy,
+    };
+    const classify = options.classify ?? defaultClassify;
+    const now = Date.now();
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    const facts = [];
+    for (const entry of entries) {
+        if (!entry.isFile())
+            continue;
+        const filePath = path.join(dir, entry.name);
+        const stat = fs.statSync(filePath);
+        facts.push({ filePath, bytes: stat.size, ageMs: now - stat.mtimeMs });
+    }
+    const drop = [];
+    let reclaim = 0;
+    for (const f of facts) {
+        const kind = classify(path.basename(f.filePath));
+        if (kind === 'active' || kind === 'unknown')
+            continue;
+        const ageDays = f.ageMs / (1000 * 60 * 60 * 24);
+        const maxDays = kind === 'snapshot' ? cfg.snapshotsDays : cfg.fullLogDays;
+        if (ageDays > maxDays) {
+            drop.push(f.filePath);
+            reclaim += f.bytes;
+        }
+    }
+    if (cfg.maxBytesPerRoom != null) {
+        // Trim from oldest until under cap.
+        const remaining = facts
+            .filter((f) => !drop.includes(f.filePath))
+            .sort((a, b) => b.ageMs - a.ageMs);
+        const total = remaining.reduce((s, f) => s + f.bytes, 0);
+        let over = total - cfg.maxBytesPerRoom;
+        while (over > 0 && remaining.length > 0) {
+            const oldest = remaining.shift();
+            const kind = classify(path.basename(oldest.filePath));
+            if (kind === 'active')
+                continue;
+            drop.push(oldest.filePath);
+            reclaim += oldest.bytes;
+            over -= oldest.bytes;
+        }
+    }
+    return { drop, reclaimBytes: reclaim };
+}
+/** Apply a `RetentionDecision` to disk. Returns the bytes actually freed. */
+export async function applyRetention(decision) {
+    let freed = 0;
+    for (const file of decision.drop) {
+        try {
+            const stat = await fs.promises.stat(file);
+            await fs.promises.unlink(file);
+            freed += stat.size;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                // eslint-disable-next-line no-console
+                console.error('[collab-server] retention unlink failed:', err);
+            }
+        }
+    }
+    return freed;
+}
+/** Default classifier matching `FilePersistence` naming. */
+function defaultClassify(name) {
+    if (/\.log$/.test(name))
+        return 'active';
+    if (/\.log\..+$/.test(name))
+        return 'log';
+    if (/\.snap\..+$/.test(name))
+        return 'snapshot';
+    return 'unknown';
+}
+//# sourceMappingURL=retention.js.map

package/dist/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;+DAE+D;AAE/D;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,MAAM,CAAC,MAAM,iBAAiB,GACe;IAC3C,WAAW,EAAE,EAAE;IACf,aAAa,EAAE,GAAG,GAAG,CAAC;IACtB,eAAe,EAAE,SAAS;CAC3B,CAAC;AAgBF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,SAA0B,EAAE,EAC5B,UAAsF,EAAE;IAExF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC9D,MAAM,GAAG,GACoC;QAC3C,GAAG,iBAAiB;QACpB,GAAG,MAAM;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;QAC1E,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QAChC,oCAAoC;QACpC,MAAM,SAAS,GAAG,KAAK;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,GAAG,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC;QACvC,OAAO,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAG,CAAC;YAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;YACxB,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA2B;IAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}