@opendatalabs/personal-server-ts-core 1.33.8 → 1.34.1

package/dist/sync/pdpp-import.d.ts

@@ -0,0 +1,192 @@
+/**
+ * Import qualifying synced DataPipe envelopes into the PDPP record store.
+ *
+ * The production path already existed end to end: Unity's OwnerDataClient
+ * writes an encrypted `DataFileEnvelope` and registers it with the Gateway,
+ * and `sync/workers/download.ts` downloads, decrypts and indexes it. What was
+ * missing was the last hop — that decrypted envelope reaching the PDPP record
+ * store, so a grant-bound client can read it. This module is that hop, and
+ * nothing else: it does not fetch, does not decrypt, and does not open a
+ * second ingestion surface. There is no web HTTP ingest here by design; the
+ * encrypted owner-data transport stays the only way data arrives.
+ *
+ * Why the metadata lives in `data.$pdpp`
+ * -------------------------------------
+ * The SDK's `DataFileEnvelopeSchema` accepts only `$schema`, `version`,
+ * `scope`, `schemaId`, `collectedAt` and `data`, and STRIPS unknown top-level
+ * keys. A `$pdpp` sibling of `scope` would therefore be silently deleted in
+ * transit — not rejected, deleted — so the producer nests it inside `data`,
+ * the one field whose interior the transport preserves verbatim. That is a
+ * transport constraint, not a preference.
+ *
+ * The consequence this module owns: `$pdpp` is import metadata that arrived
+ * inside the payload, so it must be removed before the record is stored.
+ * Otherwise every PDPP read would serve back a `$pdpp` blob that is not part
+ * of the source's declared schema, and a field projection computed from the
+ * declaration would not cover it.
+ *
+ * What is verified before anything is written
+ * -------------------------------------------
+ * Every check below is a fail-closed rejection, because the alternative is
+ * importing a record whose identity or authority we could not confirm:
+ *
+ *   1. `$pdpp.version === 1`. An unknown metadata version is refused rather
+ *      than interpreted under this version's assumptions.
+ *   2. The declaration digest is recomputed over the EXACT retained
+ *      declaration document this deployment booted with, and must equal the
+ *      digest the producer claims. This is the check that makes the rest
+ *      meaningful: without it the producer would be asserting its own
+ *      authority over the stream shape it is being validated against.
+ *   3. `scope`, `stream.name` and `primaryKey` must agree with that same
+ *      declaration, and `record.key` must agree with the payload's actual
+ *      primary-key values.
+ *
+ * Only then is `$pdpp` stripped and the record handed to the store.
+ *
+ * Instance derivation is PS-owned
+ * -------------------------------
+ * The producer supplies no instance id and must not: an instance handle is a
+ * statement about this deployment's connection inventory, which the producer
+ * cannot observe. The importer derives it through the same function the
+ * authorization and resource servers use, so an imported record is readable
+ * under a grant issued for the same source. An id that cannot be derived is a
+ * rejection, never an invention.
+ */
+import type { PdppRecordStore, StreamSemantics } from "../storage/pdpp-records/index.js";
+import type { Logger } from "../logger/index.js";
+/** The reserved key carrying PDPP import metadata inside `data`. */
+export declare const PDPP_METADATA_KEY = "$pdpp";
+/** The only `$pdpp.version` this importer understands. */
+export declare const SUPPORTED_PDPP_METADATA_VERSION = 1;
+/**
+ * The stream shape the importer validates against, projected from the
+ * deployment's retained declaration. Deliberately not the full declaration
+ * model: the importer only needs to answer "does this envelope match the
+ * document we retained?".
+ */
+export interface ImportStreamShape {
+    name: string;
+    primaryKey: string[];
+    semantics: StreamSemantics;
+}
+/**
+ * One retained declaration, as this deployment booted with it.
+ *
+ * The digest must be taken over the exact retained bytes, not over a
+ * re-serialization of a parsed snapshot. The distinction is the whole point
+ * of the check: the authorization store persists a parsed `snapshot_json`,
+ * and re-digesting that would produce a different value than the digest
+ * recorded at retrieval (key order, whitespace, and fields the parser does
+ * not carry). Digesting anything other than the retrieved bytes would be a
+ * check that passes against itself while proving nothing about what the
+ * producer actually read.
+ */
+export interface RetainedDeclaration {
+    sourceId: string;
+    version: string;
+    /**
+     * SHA-256 over the exact retained document, as bare lowercase hex.
+     *
+     * Passed in already computed rather than hashed here on purpose. This
+     * module is bundled into the browser lite runtime, where `node:crypto` does
+     * not exist; hashing here would break that build. The server computes it
+     * once at boot from the document it read — which is also the only place the
+     * original bytes exist — so doing it there costs nothing and keeps this
+     * module runtime-agnostic.
+     */
+    documentDigest: string;
+    streams: ImportStreamShape[];
+}
+export type PdppImportRejectionCode = "no_metadata" | "malformed_metadata" | "unsupported_metadata_version" | "unknown_source" | "digest_mismatch" | "declaration_version_mismatch" | "scope_mismatch" | "unknown_stream" | "primary_key_mismatch" | "semantics_mismatch" | "record_key_mismatch" | "no_instance" | "method_authority" | "store_rejected";
+export interface PdppImportRejection {
+    code: PdppImportRejectionCode;
+    message: string;
+}
+/**
+ * Whether a rejection is a settled verdict about the envelope itself.
+ *
+ * Callers use this to decide whether re-offering the same envelope later
+ * could ever change the answer. Fail-closed by construction: an unrecognized
+ * code is treated as transient, so a new failure mode is retried (visibly,
+ * with a logged outcome) rather than silently abandoned.
+ */
+export declare function isPermanentRejection(rejection: PdppImportRejection): boolean;
+export type PdppImportOutcome = 
+/** Not a PDPP-bearing envelope. Legacy-only, and not an error. */
+{
+    status: "skipped";
+}
+/** Imported a new version. */
+ | {
+    status: "imported";
+    instance: string;
+    stream: string;
+    recordKey: string;
+}
+/**
+ * Verified and already present unchanged. Deliberately distinct from
+ * "imported": re-writing it would allocate a new version and publish a
+ * spurious `changes_since` entry for a record that did not change.
+ */
+ | {
+    status: "unchanged";
+    instance: string;
+    stream: string;
+    recordKey: string;
+} | {
+    status: "rejected";
+    rejection: PdppImportRejection;
+};
+/** The envelope fields this importer reads. */
+export interface ImportableEnvelope {
+    scope: string;
+    collectedAt: string;
+    data: unknown;
+}
+export interface PdppImporterDeps {
+    store: PdppRecordStore;
+    /** The exact declarations this deployment retained at boot. */
+    declarations: RetainedDeclaration[];
+    /**
+     * PS-owned instance derivation, wired to the same inventory the AS and RS
+     * use so an imported record is readable under a grant for that source.
+     */
+    instanceFor: (sourceId: string) => string | undefined;
+    logger: Logger;
+}
+export interface PdppImporter {
+    /** Import one decrypted envelope. Never throws; failures are outcomes. */
+    importEnvelope(envelope: ImportableEnvelope): PdppImportOutcome;
+    /**
+     * Whether re-offering this already-indexed (scope, collectedAt) could still
+     * change anything.
+     *
+     * The retry path uses this to decide whether reading the envelope back off
+     * disk is worth doing at all. It answers false once an offer for that exact
+     * version has settled — imported, verified-unchanged, permanently rejected,
+     * or found to carry no `$pdpp` — because none of those can be changed by
+     * looking again. It answers true for a version never offered, and for one
+     * whose last attempt failed transiently.
+     *
+     * Deliberately in-memory and process-scoped. The answers it caches are all
+     * re-derivable: after a restart the first cycle re-reads each entry once and
+     * re-settles it. Persisting them would add schema and a migration to avoid
+     * a single bounded read per entry per boot, and would risk a stale "settled"
+     * row outliving the condition that produced it — the exact class of bug this
+     * whole retry path exists to fix.
+     */
+    needsRetry(scope: string, collectedAt: string): boolean;
+}
+/**
+ * Normalize a claimed digest to bare lowercase hex.
+ *
+ * The producer contract writes `sha256:<hex>`; this repo's
+ * `computeDeclarationDigest` returns bare hex with no prefix. Accepting both
+ * spellings of the same SHA-256 value keeps the two sides interoperable
+ * without either silently coercing the other. Any OTHER algorithm prefix
+ * returns null and fails the import: treating `md5:...` as if it were the
+ * SHA-256 we computed would turn the digest check into decoration.
+ */
+export declare function normalizeDigest(claimed: string): string | null;
+export declare function createPdppImporter(deps: PdppImporterDeps): PdppImporter;
+//# sourceMappingURL=pdpp-import.d.ts.map

package/dist/sync/pdpp-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-import.d.ts","sourceRoot":"","sources":["../../src/sync/pdpp-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,0DAA0D;AAC1D,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,uBAAuB,GAC/B,aAAa,GACb,oBAAoB,GACpB,8BAA8B,GAC9B,gBAAgB,GAChB,iBAAiB,GACjB,8BAA8B,GAC9B,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AA+CD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,MAAM,MAAM,iBAAiB;AAC3B,kEAAkE;AAChE;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,8BAA8B;GAC5B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC7E;;;;GAIG;GACD;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE3D,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,+DAA+D;IAC/D,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC;;;OAGG;IACH,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,cAAc,CAAC,QAAQ,EAAE,kBAAkB,GAAG,iBAAiB,CAAC;IAChE;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AA4BD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO9D;AAgJD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CAqPvE"}

package/dist/sync/pdpp-import.js

@@ -0,0 +1,441 @@
+/**
+ * Import qualifying synced DataPipe envelopes into the PDPP record store.
+ *
+ * The production path already existed end to end: Unity's OwnerDataClient
+ * writes an encrypted `DataFileEnvelope` and registers it with the Gateway,
+ * and `sync/workers/download.ts` downloads, decrypts and indexes it. What was
+ * missing was the last hop — that decrypted envelope reaching the PDPP record
+ * store, so a grant-bound client can read it. This module is that hop, and
+ * nothing else: it does not fetch, does not decrypt, and does not open a
+ * second ingestion surface. There is no web HTTP ingest here by design; the
+ * encrypted owner-data transport stays the only way data arrives.
+ *
+ * Why the metadata lives in `data.$pdpp`
+ * -------------------------------------
+ * The SDK's `DataFileEnvelopeSchema` accepts only `$schema`, `version`,
+ * `scope`, `schemaId`, `collectedAt` and `data`, and STRIPS unknown top-level
+ * keys. A `$pdpp` sibling of `scope` would therefore be silently deleted in
+ * transit — not rejected, deleted — so the producer nests it inside `data`,
+ * the one field whose interior the transport preserves verbatim. That is a
+ * transport constraint, not a preference.
+ *
+ * The consequence this module owns: `$pdpp` is import metadata that arrived
+ * inside the payload, so it must be removed before the record is stored.
+ * Otherwise every PDPP read would serve back a `$pdpp` blob that is not part
+ * of the source's declared schema, and a field projection computed from the
+ * declaration would not cover it.
+ *
+ * What is verified before anything is written
+ * -------------------------------------------
+ * Every check below is a fail-closed rejection, because the alternative is
+ * importing a record whose identity or authority we could not confirm:
+ *
+ *   1. `$pdpp.version === 1`. An unknown metadata version is refused rather
+ *      than interpreted under this version's assumptions.
+ *   2. The declaration digest is recomputed over the EXACT retained
+ *      declaration document this deployment booted with, and must equal the
+ *      digest the producer claims. This is the check that makes the rest
+ *      meaningful: without it the producer would be asserting its own
+ *      authority over the stream shape it is being validated against.
+ *   3. `scope`, `stream.name` and `primaryKey` must agree with that same
+ *      declaration, and `record.key` must agree with the payload's actual
+ *      primary-key values.
+ *
+ * Only then is `$pdpp` stripped and the record handed to the store.
+ *
+ * Instance derivation is PS-owned
+ * -------------------------------
+ * The producer supplies no instance id and must not: an instance handle is a
+ * statement about this deployment's connection inventory, which the producer
+ * cannot observe. The importer derives it through the same function the
+ * authorization and resource servers use, so an imported record is readable
+ * under a grant issued for the same source. An id that cannot be derived is a
+ * rejection, never an invention.
+ */
+import { computeRecordKeyFromData } from "../storage/pdpp-records/record-key.js";
+/** The reserved key carrying PDPP import metadata inside `data`. */
+export const PDPP_METADATA_KEY = "$pdpp";
+/** The only `$pdpp.version` this importer understands. */
+export const SUPPORTED_PDPP_METADATA_VERSION = 1;
+/**
+ * Rejection codes that describe the ENVELOPE rather than this deployment's
+ * current state. They are permanent verdicts: the same bytes re-read on a
+ * later cycle produce the same answer, so retrying them is work that can
+ * never succeed.
+ *
+ * `unknown_source` and `no_instance` are deliberately NOT here. Both depend
+ * on what this deployment has mounted — a declaration that is not retained
+ * yet, or an instance inventory that is not populated yet — and both start
+ * working once boot completes or an operator provisions the declaration.
+ * Treating them as permanent is exactly how an envelope gets stranded.
+ * `store_rejected` is likewise excluded: the store is infrastructure, and a
+ * write it refuses today may be accepted once it is healthy.
+ * `method_authority` IS here: the importer carries no acquisition method, so
+ * the store's method and binding checks (P8a, P8c) refuse it on every cycle.
+ */
+const PERMANENT_REJECTION_CODES = new Set([
+    "malformed_metadata",
+    "unsupported_metadata_version",
+    "digest_mismatch",
+    "declaration_version_mismatch",
+    "scope_mismatch",
+    "unknown_stream",
+    "primary_key_mismatch",
+    "semantics_mismatch",
+    "record_key_mismatch",
+    "method_authority",
+]);
+/**
+ * Store reasons from the method and binding checks. The importer writes
+ * without a method, so none of these can clear on a later cycle.
+ */
+const METHOD_AUTHORITY_REASONS = new Set([
+    "method_required",
+    "method_inactive",
+    "config_multiple_active_methods",
+    "binding_generation_mismatch",
+    "instance_bound_to_other_method",
+    "binding_required",
+    "blob_unclaimed",
+]);
+/**
+ * Whether a rejection is a settled verdict about the envelope itself.
+ *
+ * Callers use this to decide whether re-offering the same envelope later
+ * could ever change the answer. Fail-closed by construction: an unrecognized
+ * code is treated as transient, so a new failure mode is retried (visibly,
+ * with a logged outcome) rather than silently abandoned.
+ */
+export function isPermanentRejection(rejection) {
+    return PERMANENT_REJECTION_CODES.has(rejection.code);
+}
+function reject(code, message) {
+    return { status: "rejected", rejection: { code, message } };
+}
+/**
+ * Normalize a claimed digest to bare lowercase hex.
+ *
+ * The producer contract writes `sha256:<hex>`; this repo's
+ * `computeDeclarationDigest` returns bare hex with no prefix. Accepting both
+ * spellings of the same SHA-256 value keeps the two sides interoperable
+ * without either silently coercing the other. Any OTHER algorithm prefix
+ * returns null and fails the import: treating `md5:...` as if it were the
+ * SHA-256 we computed would turn the digest check into decoration.
+ */
+export function normalizeDigest(claimed) {
+    const trimmed = claimed.trim().toLowerCase();
+    const colon = trimmed.indexOf(":");
+    if (colon === -1)
+        return /^[0-9a-f]{64}$/.test(trimmed) ? trimmed : null;
+    if (trimmed.slice(0, colon) !== "sha256")
+        return null;
+    const hex = trimmed.slice(colon + 1);
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : null;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read `data.$pdpp` into a typed shape, or explain why it is not usable.
+ *
+ * Returns `null` for "no metadata present", which is the ordinary legacy
+ * case and must stay distinguishable from a malformed `$pdpp` — a producer
+ * that writes broken metadata should be visible, not silently treated as a
+ * legacy write.
+ */
+function readMetadata(data) {
+    if (!isRecord(data))
+        return null;
+    const raw = data[PDPP_METADATA_KEY];
+    if (raw === undefined)
+        return null;
+    if (!isRecord(raw))
+        return { ok: false, reason: "$pdpp is not an object" };
+    if (typeof raw.version !== "number") {
+        return { ok: false, reason: "$pdpp.version is missing or not a number" };
+    }
+    if (typeof raw.sourceId !== "string" || raw.sourceId.length === 0) {
+        return { ok: false, reason: "$pdpp.sourceId is missing" };
+    }
+    const declaration = raw.declaration;
+    if (!isRecord(declaration)) {
+        return { ok: false, reason: "$pdpp.declaration is missing" };
+    }
+    if (typeof declaration.digest !== "string" ||
+        declaration.digest.length === 0) {
+        return { ok: false, reason: "$pdpp.declaration.digest is missing" };
+    }
+    if (typeof declaration.version !== "string") {
+        return { ok: false, reason: "$pdpp.declaration.version is missing" };
+    }
+    const stream = raw.stream;
+    if (!isRecord(stream))
+        return { ok: false, reason: "$pdpp.stream is missing" };
+    if (typeof stream.name !== "string" || stream.name.length === 0) {
+        return { ok: false, reason: "$pdpp.stream.name is missing" };
+    }
+    if (typeof stream.scope !== "string" || stream.scope.length === 0) {
+        return { ok: false, reason: "$pdpp.stream.scope is missing" };
+    }
+    if (!Array.isArray(stream.primaryKey) ||
+        stream.primaryKey.length === 0 ||
+        !stream.primaryKey.every((f) => typeof f === "string")) {
+        return { ok: false, reason: "$pdpp.stream.primaryKey is missing" };
+    }
+    const record = raw.record;
+    if (!isRecord(record))
+        return { ok: false, reason: "$pdpp.record is missing" };
+    if (!isRecord(record.key)) {
+        return { ok: false, reason: "$pdpp.record.key is missing" };
+    }
+    const op = record.op ?? "upsert";
+    if (op !== "upsert" && op !== "delete") {
+        return {
+            ok: false,
+            reason: `$pdpp.record.op '${String(op)}' is not valid`,
+        };
+    }
+    return {
+        ok: true,
+        meta: {
+            version: raw.version,
+            sourceId: raw.sourceId,
+            declaration: {
+                source: typeof declaration.source === "string" ? declaration.source : "",
+                version: declaration.version,
+                upstreamCommit: typeof declaration.upstreamCommit === "string"
+                    ? declaration.upstreamCommit
+                    : null,
+                digest: declaration.digest,
+            },
+            stream: {
+                name: stream.name,
+                scope: stream.scope,
+                semantics: typeof stream.semantics === "string" ? stream.semantics : "",
+                primaryKey: stream.primaryKey,
+            },
+            record: { key: record.key, op },
+            ...(isRecord(raw.run) && {
+                run: {
+                    ...(typeof raw.run.id === "string" && { id: raw.run.id }),
+                    ...(typeof raw.run.source === "string" && { source: raw.run.source }),
+                },
+            }),
+        },
+    };
+}
+/** Remove `$pdpp` without mutating the caller's object. */
+function stripMetadata(data) {
+    const { [PDPP_METADATA_KEY]: _dropped, ...rest } = data;
+    return rest;
+}
+function sameArray(a, b) {
+    return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+/**
+ * Deep structural equality over JSON-shaped values.
+ *
+ * Used only to decide "did this record actually change?". Key order must not
+ * count as a change: the producer re-serializes the payload on every run, so
+ * an order-sensitive comparison would report every re-sync as a new version
+ * and fill `changes_since` with records that are byte-identical to what a
+ * client already read.
+ */
+function jsonEqual(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (a === null || b === null)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) {
+            return false;
+        }
+        return a.every((item, i) => jsonEqual(item, b[i]));
+    }
+    if (typeof a !== "object")
+        return false;
+    const ao = a;
+    const bo = b;
+    const aKeys = Object.keys(ao).sort();
+    const bKeys = Object.keys(bo).sort();
+    if (!sameArray(aKeys, bKeys))
+        return false;
+    return aKeys.every((k) => jsonEqual(ao[k], bo[k]));
+}
+export function createPdppImporter(deps) {
+    const { store, logger } = deps;
+    const bySourceId = new Map();
+    for (const declaration of deps.declarations) {
+        bySourceId.set(declaration.sourceId, declaration);
+    }
+    /**
+     * Versions whose import outcome cannot change on a later offer. Bounded by
+     * the number of distinct (scope, collectedAt) pairs this process sees, and
+     * holding only a short key per entry.
+     */
+    const settled = new Set();
+    const versionKey = (scope, collectedAt) => `${scope}@${collectedAt}`;
+    function needsRetry(scope, collectedAt) {
+        return !settled.has(versionKey(scope, collectedAt));
+    }
+    /**
+     * Record whether this version is done with, so the retry path can stop
+     * reading it back off disk every cycle.
+     *
+     * Only a transient rejection stays unsettled — that is the one outcome a
+     * later cycle can genuinely improve on.
+     */
+    function importAndSettle(envelope) {
+        const outcome = importEnvelope(envelope);
+        const retryable = outcome.status === "rejected" && !isPermanentRejection(outcome.rejection);
+        if (!retryable) {
+            settled.add(versionKey(envelope.scope, envelope.collectedAt));
+        }
+        return outcome;
+    }
+    function importEnvelope(envelope) {
+        const read = readMetadata(envelope.data);
+        if (read === null)
+            return { status: "skipped" };
+        if (!read.ok)
+            return reject("malformed_metadata", read.reason);
+        const meta = read.meta;
+        if (meta.version !== SUPPORTED_PDPP_METADATA_VERSION) {
+            return reject("unsupported_metadata_version", `$pdpp.version ${meta.version} is not supported (expected ${SUPPORTED_PDPP_METADATA_VERSION})`);
+        }
+        const retained = bySourceId.get(meta.sourceId);
+        if (!retained) {
+            return reject("unknown_source", `no retained declaration for source '${meta.sourceId}'`);
+        }
+        // The digest gate. Everything after this point is validated against a
+        // document we have confirmed is the one the producer claims to have read.
+        const claimed = normalizeDigest(meta.declaration.digest);
+        if (claimed === null) {
+            return reject("digest_mismatch", `declaration digest '${meta.declaration.digest}' is not a recognized sha256 digest`);
+        }
+        if (claimed !== retained.documentDigest.trim().toLowerCase()) {
+            return reject("digest_mismatch", `declaration digest does not match the retained declaration for '${meta.sourceId}'`);
+        }
+        if (meta.declaration.version !== retained.version) {
+            return reject("declaration_version_mismatch", `declaration version '${meta.declaration.version}' does not match retained version '${retained.version}'`);
+        }
+        // The scope the envelope was transported under must be the scope the
+        // metadata claims. Without this, metadata for one scope could ride on a
+        // blob decrypted under another scope's key.
+        if (meta.stream.scope !== envelope.scope) {
+            return reject("scope_mismatch", `$pdpp.stream.scope '${meta.stream.scope}' does not match envelope scope '${envelope.scope}'`);
+        }
+        const declaredStream = retained.streams.find((s) => s.name === meta.stream.name);
+        if (!declaredStream) {
+            return reject("unknown_stream", `stream '${meta.stream.name}' is not declared by the retained declaration for '${meta.sourceId}'`);
+        }
+        if (!sameArray(meta.stream.primaryKey, declaredStream.primaryKey)) {
+            return reject("primary_key_mismatch", `stream '${meta.stream.name}' declares primary key [${declaredStream.primaryKey.join(", ")}] but the envelope claims [${meta.stream.primaryKey.join(", ")}]`);
+        }
+        if (meta.stream.semantics.length > 0 &&
+            meta.stream.semantics !== declaredStream.semantics) {
+            return reject("semantics_mismatch", `stream '${meta.stream.name}' is ${declaredStream.semantics} here but the envelope claims '${meta.stream.semantics}'`);
+        }
+        const instance = deps.instanceFor(meta.sourceId);
+        if (!instance) {
+            return reject("no_instance", `no instance handle could be derived for source '${meta.sourceId}'`);
+        }
+        if (!isRecord(envelope.data)) {
+            return reject("malformed_metadata", "envelope data is not an object");
+        }
+        const payload = stripMetadata(envelope.data);
+        // `record.key` is the producer's claim about identity; the payload is the
+        // record. They must agree, or the record would be stored under a key that
+        // does not describe it — and a grant naming that key would authorize the
+        // wrong row.
+        let keyFromData;
+        let keyFromClaim;
+        try {
+            keyFromData = computeRecordKeyFromData(payload, declaredStream.primaryKey);
+            keyFromClaim = computeRecordKeyFromData(meta.record.key, declaredStream.primaryKey);
+        }
+        catch (err) {
+            return reject("record_key_mismatch", err.message);
+        }
+        if (keyFromData !== keyFromClaim) {
+            return reject("record_key_mismatch", "$pdpp.record.key does not match the payload's primary key values");
+        }
+        // Idempotency. `ingestBatch` allocates a NEW version on every accepted
+        // mutable_state upsert, so an unconditional re-ingest would bump the
+        // version and publish a `changes_since` entry every time the sync worker
+        // re-downloads an unchanged record — which it does on any full reconcile
+        // or retry. Comparing against the stored row first is what makes a repeat
+        // sync a no-op rather than a fabricated change.
+        // `getRecord` returns undefined for a deleted row as well as an absent
+        // one, which is exactly the distinction both branches below need.
+        const existing = store.getRecord(instance, meta.stream.name, keyFromData);
+        const unchanged = {
+            status: "unchanged",
+            instance,
+            stream: meta.stream.name,
+            recordKey: keyFromData,
+        };
+        if (meta.record.op === "delete") {
+            // A delete for a record we do not currently hold changes nothing.
+            // Ingesting it would write a tombstone announcing the removal of
+            // something this store never served — a fabricated change.
+            if (!existing)
+                return unchanged;
+        }
+        else if (existing &&
+            jsonEqual(existing.data, payload) &&
+            existing.emittedAt === envelope.collectedAt) {
+            return unchanged;
+        }
+        // A single-field key must stay a bare string. `encodeRecordKey` treats an
+        // array as a COMPOUND key and JSON-encodes it, so wrapping a lone value
+        // in an array would produce `["235680975"]` where the data yields
+        // `235680975` — a key/data mismatch the store rejects, on every record of
+        // every single-key stream.
+        const components = declaredStream.primaryKey.map((f) => String(payload[f]));
+        const input = {
+            instance,
+            stream: meta.stream.name,
+            key: components.length === 1 ? components[0] : components,
+            data: meta.record.op === "delete" ? null : payload,
+            emitted_at: envelope.collectedAt,
+            op: meta.record.op,
+        };
+        // One envelope per call, but through the batch API so the store's own
+        // transaction wraps the write: a failure rolls back rather than leaving
+        // a row without its history entry.
+        const result = store.ingestBatch([input], () => declaredStream.semantics, () => declaredStream.primaryKey);
+        if (result.rejected.length > 0) {
+            const reason = result.rejected[0].reason;
+            return reject(METHOD_AUTHORITY_REASONS.has(reason)
+                ? "method_authority"
+                : "store_rejected", reason);
+        }
+        if (result.accepted === 0) {
+            // append_only duplicate: the store treats it as a no-op, and so do we.
+            return {
+                status: "unchanged",
+                instance,
+                stream: meta.stream.name,
+                recordKey: keyFromData,
+            };
+        }
+        logger.info({
+            instance,
+            stream: meta.stream.name,
+            sourceId: meta.sourceId,
+            op: meta.record.op,
+            ...(meta.run?.id && { runId: meta.run.id }),
+        }, "Imported synced DataPipe record into the PDPP record store");
+        return {
+            status: "imported",
+            instance,
+            stream: meta.stream.name,
+            recordKey: keyFromData,
+        };
+    }
+    return { importEnvelope: importAndSettle, needsRetry };
+}
+//# sourceMappingURL=pdpp-import.js.map

package/dist/sync/pdpp-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pdpp-import.js","sourceRoot":"","sources":["../../src/sync/pdpp-import.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAOH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAGjF,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAgEjD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,yBAAyB,GAAyC,IAAI,GAAG,CAC7E;IACE,oBAAoB;IACpB,8BAA8B;IAC9B,iBAAiB;IACjB,8BAA8B;IAC9B,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;CACnB,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,iBAAiB;IACjB,iBAAiB;IACjB,gCAAgC;IAChC,6BAA6B;IAC7B,gCAAgC;IAChC,kBAAkB;IAClB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAA8B;IACjE,OAAO,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AA6ED,SAAS,MAAM,CACb,IAA6B,EAC7B,OAAe;IAEf,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CACnB,IAAa;IAEb,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAE3E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IACE,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ;QACtC,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChE,CAAC;IACD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACjC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC9B,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC;IACjC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,oBAAoB,MAAM,CAAC,EAAE,CAAC,gBAAgB;SACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE;YACJ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE;gBACX,MAAM,EACJ,OAAO,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAClE,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,cAAc,EACZ,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ;oBAC5C,CAAC,CAAC,WAAW,CAAC,cAAc;oBAC5B,CAAC,CAAC,IAAI;gBACV,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;gBACvE,UAAU,EAAE,MAAM,CAAC,UAAsB;aAC1C;YACD,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE;YAC/B,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;gBACvB,GAAG,EAAE;oBACH,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACzD,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;iBACtE;aACF,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,CAAW,EAAE,CAAW;IACzC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,CAAU,EAAE,CAAU;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;IACxC,MAAM,EAAE,GAAG,CAA4B,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC1D,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,WAAmB,EAAE,EAAE,CACxD,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC;IAE5B,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB;QACpD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,SAAS,eAAe,CAAC,QAA4B;QACnD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,SAAS,GACb,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS,cAAc,CAAC,QAA4B;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,IAAI,CAAC,OAAO,KAAK,+BAA+B,EAAE,CAAC;YACrD,OAAO,MAAM,CACX,8BAA8B,EAC9B,iBAAiB,IAAI,CAAC,OAAO,+BAA+B,+BAA+B,GAAG,CAC/F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CACX,gBAAgB,EAChB,uCAAuC,IAAI,CAAC,QAAQ,GAAG,CACxD,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CACX,iBAAiB,EACjB,uBAAuB,IAAI,CAAC,WAAW,CAAC,MAAM,qCAAqC,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7D,OAAO,MAAM,CACX,iBAAiB,EACjB,mEAAmE,IAAI,CAAC,QAAQ,GAAG,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClD,OAAO,MAAM,CACX,8BAA8B,EAC9B,wBAAwB,IAAI,CAAC,WAAW,CAAC,OAAO,sCAAsC,QAAQ,CAAC,OAAO,GAAG,CAC1G,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,MAAM,CACX,gBAAgB,EAChB,uBAAuB,IAAI,CAAC,MAAM,CAAC,KAAK,oCAAoC,QAAQ,CAAC,KAAK,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CACnC,CAAC;QACF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,MAAM,CACX,gBAAgB,EAChB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,sDAAsD,IAAI,CAAC,QAAQ,GAAG,CAClG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CACX,sBAAsB,EACtB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,2BAA2B,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7J,CAAC;QACJ,CAAC;QACD,IACE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,SAAS,EAClD,CAAC;YACD,OAAO,MAAM,CACX,oBAAoB,EACpB,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,cAAc,CAAC,SAAS,kCAAkC,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CACtH,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CACX,aAAa,EACb,mDAAmD,IAAI,CAAC,QAAQ,GAAG,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE7C,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,aAAa;QACb,IAAI,WAAmB,CAAC;QACxB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,wBAAwB,CACpC,OAAO,EACP,cAAc,CAAC,UAAU,CAC1B,CAAC;YACF,YAAY,GAAG,wBAAwB,CACrC,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,cAAc,CAAC,UAAU,CAC1B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,qBAAqB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,MAAM,CACX,qBAAqB,EACrB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG;YAChB,MAAM,EAAE,WAAoB;YAC5B,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,WAAW;SACvB,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,kEAAkE;YAClE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;aAAM,IACL,QAAQ;YACR,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YACjC,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,WAAW,EAC3C,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,kEAAkE;QAClE,0EAA0E;QAC1E,2BAA2B;QAC3B,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAA4B;YACrC,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,GAAG,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;YACzD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YAClD,UAAU,EAAE,QAAQ,CAAC,WAAW;YAChC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;SACnB,CAAC;QAEF,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAC9B,CAAC,KAAK,CAAC,EACP,GAAG,EAAE,CAAC,cAAc,CAAC,SAAS,EAC9B,GAAG,EAAE,CAAC,cAAc,CAAC,UAAU,CAChC,CAAC;QACF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACzC,OAAO,MAAM,CACX,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAClC,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,gBAAgB,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,uEAAuE;YACvE,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACxB,SAAS,EAAE,WAAW;aACvB,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;SAC5C,EACD,4DAA4D,CAC7D,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACxB,SAAS,EAAE,WAAW;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzD,CAAC"}