mindoodb 0.0.23 → 0.0.32

package/dist/core/accesscontrol/keyBagReconciler.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Internal (non-public) contract the tenant uses to drive the KeyBag import
+ * pass on its own directory (docs/accesscontrol.md §13).
+ *
+ * Deliberately NOT part of the public {@link MindooTenantDirectory} surface: the
+ * only reconcile entry point consumers see is
+ * `MindooTenant.reconcileKeyDistributionsForCurrentUser()`. The reconcile core
+ * sources its RSA-OAEP session key from the directory's own tenant, so no
+ * foreign decryption key is ever passed across an API boundary.
+ */
+export interface KeyBagReconciler {
+    /**
+     * Import the key versions pushed to `username` using the directory's OWN
+     * tenant session key, and remove pulled (revoked) ids. Returns the imported
+     * and removed key ids; both empty when the host is locked (no session key).
+     */
+    reconcileImportedKeysForCurrentUser(username: string): Promise<{
+        imported: string[];
+        removed: string[];
+    }>;
+}
+//# sourceMappingURL=keyBagReconciler.d.ts.map

package/dist/core/accesscontrol/keyBagReconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyBagReconciler.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/keyBagReconciler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,mCAAmC,CACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACvD"}

package/dist/core/accesscontrol/keyBagReconciler.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=keyBagReconciler.js.map

package/dist/core/accesscontrol/keyBagReconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyBagReconciler.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/keyBagReconciler.ts"],"names":[],"mappings":""}

package/dist/core/accesscontrol/materializationGuard.d.ts

@@ -0,0 +1,89 @@
+import { RuleType } from "./types";
+/**
+ * Pure helpers for client-side materialization defenses (docs/accesscontrol.md
+ * §10): mandatory snapshot head verification, op-type re-derivation, and the
+ * shape of the quarantine/audit log.
+ *
+ * Everything here is a pure function of its inputs so the materialization path
+ * stays deterministic across replicas — the property that makes "quarantine on
+ * receipt" safe under eventual consistency (§10).
+ */
+/** Why an entry was quarantined (for the audit log and tests). */
+export type QuarantineReason = "tier2_denied" | "tier1_recheck_denied" | "snapshot_head_mismatch" | "snapshot_untrusted_head" | "op_type_mismatch" | "cascade_dependent" | "invalid_signature" | "invalid_witness_receipt" | "directory_unavailable";
+/**
+ * One entry in the per-tenant quarantine/audit log (§10). Kept deliberately
+ * small and serializable so it can be surfaced in Haven's audit view and
+ * persisted alongside the store.
+ */
+export interface QuarantineRecord {
+    /** Store entry id that was quarantined. */
+    entryId: string;
+    /** Document the entry belonged to. */
+    docId: string;
+    /** Database id (sync context). */
+    dbid: string;
+    /** Signed operation type of the entry. */
+    entryType: string;
+    /** Why it was quarantined. */
+    reason: QuarantineReason;
+    /** Human-readable detail (e.g. the matched rule id / decision reason). */
+    detail: string;
+    /** Trusted time of the entry (`receivedAt ?? createdAt`). */
+    trustedTime: number;
+    /** When the quarantine decision was recorded locally (wall clock, audit only). */
+    recordedAt: number;
+    /** For cascades, the ancestor entry id that triggered this quarantine. */
+    causedByEntryId?: string;
+}
+/**
+ * Mandatory snapshot head verification (§10, "Snapshots"). A `doc_snapshot` is
+ * only trustworthy if the Automerge heads of the **decoded** snapshot exactly
+ * equal the covered dep heads declared in the store entry's
+ * `snapshotHeadHashes`. This prevents a snapshot from smuggling content the
+ * author was not allowed to write under the guise of a checkpoint.
+ *
+ * The comparison is order-independent (heads are a set) and exact (no missing
+ * or extra heads allowed).
+ *
+ * @param decodedHeads Automerge heads of the decoded snapshot document.
+ * @param declaredHeads `snapshotHeadHashes` from the signed store metadata.
+ * @returns true iff the two describe the identical set of heads.
+ */
+export declare function snapshotHeadsMatch(decodedHeads: readonly string[], declaredHeads: readonly string[] | undefined): boolean;
+/** Inputs needed to re-derive an entry's operation type from its decoded change. */
+export interface OpTypeDerivationInput {
+    /**
+     * Whether this change is the document's genesis change (no in-document
+     * Automerge parents). The first change of a document is a `doc_create`.
+     */
+    isGenesis: boolean;
+    /** Whether the document was deleted in the `before` (pre-change) state. */
+    beforeDeleted: boolean;
+    /** Whether the document is deleted in the `after` (post-change) state. */
+    afterDeleted: boolean;
+}
+/**
+ * Re-derive the operation type from the decoded change + lifecycle transition,
+ * independent of the signed `entryType` (§10, defense in depth). Used to reject
+ * an entry whose signed `entryType` was relabeled (e.g. a `doc_delete` disguised
+ * as a `doc_change` to dodge a delete rule).
+ *
+ * Derivation:
+ * - genesis change → `doc_create`
+ * - not-deleted → deleted → `doc_delete`
+ * - deleted → not-deleted → `doc_undelete`
+ * - otherwise → `doc_change`
+ *
+ * `doc_snapshot` is not a data-change and is derived/validated separately
+ * (snapshot head match), so it is not produced here.
+ */
+export declare function deriveDataOpType(input: OpTypeDerivationInput): RuleType;
+/**
+ * Whether a signed `entryType` is consistent with the type re-derived from the
+ * decoded change (§10). A `doc_create` and `doc_change` are *both* acceptable
+ * labels for a genesis-or-normal mutation only when they agree; delete and
+ * undelete must match exactly. We treat any disagreement as a mismatch (the
+ * safe, fail-closed choice).
+ */
+export declare function opTypeMatches(signedEntryType: string, derived: RuleType): boolean;
+//# sourceMappingURL=materializationGuard.d.ts.map

package/dist/core/accesscontrol/materializationGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"materializationGuard.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/materializationGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC;;;;;;;;GAQG;AAEH,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,sBAAsB,GACtB,wBAAwB,GACxB,yBAAyB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,mBAAmB,GACnB,yBAAyB,GAKzB,uBAAuB,CAAC;AAE5B;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3C,OAAO,CAYT;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,QAAQ,CAKvE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAEjF"}

package/dist/core/accesscontrol/materializationGuard.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snapshotHeadsMatch = snapshotHeadsMatch;
+exports.deriveDataOpType = deriveDataOpType;
+exports.opTypeMatches = opTypeMatches;
+/**
+ * Mandatory snapshot head verification (§10, "Snapshots"). A `doc_snapshot` is
+ * only trustworthy if the Automerge heads of the **decoded** snapshot exactly
+ * equal the covered dep heads declared in the store entry's
+ * `snapshotHeadHashes`. This prevents a snapshot from smuggling content the
+ * author was not allowed to write under the guise of a checkpoint.
+ *
+ * The comparison is order-independent (heads are a set) and exact (no missing
+ * or extra heads allowed).
+ *
+ * @param decodedHeads Automerge heads of the decoded snapshot document.
+ * @param declaredHeads `snapshotHeadHashes` from the signed store metadata.
+ * @returns true iff the two describe the identical set of heads.
+ */
+function snapshotHeadsMatch(decodedHeads, declaredHeads) {
+    const declared = declaredHeads ?? [];
+    if (decodedHeads.length !== declared.length)
+        return false;
+    const declaredSet = new Set(declared);
+    if (declaredSet.size !== declared.length) {
+        // Duplicate declared heads are malformed; require a clean set.
+        return false;
+    }
+    for (const head of decodedHeads) {
+        if (!declaredSet.has(head))
+            return false;
+    }
+    return true;
+}
+/**
+ * Re-derive the operation type from the decoded change + lifecycle transition,
+ * independent of the signed `entryType` (§10, defense in depth). Used to reject
+ * an entry whose signed `entryType` was relabeled (e.g. a `doc_delete` disguised
+ * as a `doc_change` to dodge a delete rule).
+ *
+ * Derivation:
+ * - genesis change → `doc_create`
+ * - not-deleted → deleted → `doc_delete`
+ * - deleted → not-deleted → `doc_undelete`
+ * - otherwise → `doc_change`
+ *
+ * `doc_snapshot` is not a data-change and is derived/validated separately
+ * (snapshot head match), so it is not produced here.
+ */
+function deriveDataOpType(input) {
+    if (input.isGenesis)
+        return "doc_create";
+    if (!input.beforeDeleted && input.afterDeleted)
+        return "doc_delete";
+    if (input.beforeDeleted && !input.afterDeleted)
+        return "doc_undelete";
+    return "doc_change";
+}
+/**
+ * Whether a signed `entryType` is consistent with the type re-derived from the
+ * decoded change (§10). A `doc_create` and `doc_change` are *both* acceptable
+ * labels for a genesis-or-normal mutation only when they agree; delete and
+ * undelete must match exactly. We treat any disagreement as a mismatch (the
+ * safe, fail-closed choice).
+ */
+function opTypeMatches(signedEntryType, derived) {
+    return signedEntryType === derived;
+}
+//# sourceMappingURL=materializationGuard.js.map

package/dist/core/accesscontrol/materializationGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materializationGuard.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/materializationGuard.ts"],"names":[],"mappings":";;AAoEA,gDAeC;AA8BD,4CAKC;AASD,sCAEC;AA3ED;;;;;;;;;;;;;GAaG;AACH,SAAgB,kBAAkB,CAChC,YAA+B,EAC/B,aAA4C;IAE5C,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,+DAA+D;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,gBAAgB,CAAC,KAA4B;IAC3D,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IACpE,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC;IACtE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,eAAuB,EAAE,OAAiB;IACtE,OAAO,eAAe,KAAK,OAAO,CAAC;AACrC,CAAC"}

package/dist/core/accesscontrol/quarantine.d.ts

@@ -0,0 +1,65 @@
+import { QuarantineRecord } from "./materializationGuard";
+/**
+ * Deterministic cascade-quarantine engine (docs/accesscontrol.md §10).
+ *
+ * When an entry is quarantined, every entry that causally depends on it
+ * (transitively, via Automerge change deps) must also be quarantined — a
+ * replica never materializes a change whose ancestor it rejected. The accepted
+ * set is therefore always a **causally-closed prefix**, identical across
+ * replicas that have synced to the same point.
+ *
+ * This module is a pure function of (entries, per-entry verdict): no I/O, no
+ * wall clock. The verdict callback supplies the Tier 2 / op-type / snapshot
+ * decision for an entry that has no quarantined ancestors; the cascade is
+ * handled here. Keeping it pure is what guarantees cross-replica convergence.
+ */
+/** Minimal entry shape the cascade engine needs. */
+export interface QuarantineCandidate {
+    /** Store entry id. */
+    id: string;
+    /** Document id. */
+    docId: string;
+    /** Entry ids this entry causally depends on (Automerge deps, store ids). */
+    dependencyIds: string[];
+    /** Signed operation type. */
+    entryType: string;
+    /** Trusted time (`receivedAt ?? createdAt`); used only for stable ordering. */
+    trustedTime: number;
+}
+/** A verdict for a single entry whose ancestors were all accepted. */
+export interface EntryVerdict {
+    /** Whether the entry is accepted (materialized). */
+    accepted: boolean;
+    /** When rejected, the audit record (without cascade bookkeeping). */
+    record?: Omit<QuarantineRecord, "recordedAt" | "causedByEntryId">;
+}
+/** Result of {@link computeAcceptedSet}. */
+export interface AcceptedSetResult {
+    /** Ids that are accepted (and may be materialized), in input order. */
+    acceptedIds: string[];
+    /** Ids that are quarantined (direct violation or cascade). */
+    quarantinedIds: string[];
+    /** Audit records for every quarantined entry. */
+    records: QuarantineRecord[];
+}
+/**
+ * Deterministic order for evaluation: ascending trusted time, then entry id as
+ * a stable tie-breaker. Mirrors the directory/materialization ordering so every
+ * replica evaluates entries in the same sequence (§10).
+ */
+export declare function sortForEvaluation<T extends QuarantineCandidate>(entries: readonly T[]): T[];
+/**
+ * Compute the causally-closed accepted set and the quarantine records.
+ *
+ * Entries are evaluated in deterministic trusted-time order. An entry is
+ * quarantined if (a) any of its dependencies was quarantined (cascade), or
+ * (b) the verdict callback rejects it. Cascade quarantines reference the first
+ * quarantined ancestor that caused them, for the audit trail.
+ *
+ * @param entries The candidate entries (any order; sorted internally).
+ * @param verdictFor Decides an entry assuming its ancestors are all accepted.
+ *   Only called for entries with no quarantined dependency.
+ * @param now Wall-clock timestamp for audit records (not used in any decision).
+ */
+export declare function computeAcceptedSet(entries: readonly QuarantineCandidate[], verdictFor: (entry: QuarantineCandidate) => EntryVerdict, now: number): AcceptedSetResult;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/core/accesscontrol/quarantine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/quarantine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AAEH,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,sBAAsB;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,GAAG,iBAAiB,CAAC,CAAC;CACnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iDAAiD;IACjD,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,mBAAmB,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAI3F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,SAAS,mBAAmB,EAAE,EACvC,UAAU,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,YAAY,EACxD,GAAG,EAAE,MAAM,GACV,iBAAiB,CAuDnB"}

package/dist/core/accesscontrol/quarantine.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sortForEvaluation = sortForEvaluation;
+exports.computeAcceptedSet = computeAcceptedSet;
+/**
+ * Deterministic order for evaluation: ascending trusted time, then entry id as
+ * a stable tie-breaker. Mirrors the directory/materialization ordering so every
+ * replica evaluates entries in the same sequence (§10).
+ */
+function sortForEvaluation(entries) {
+    return [...entries].sort((a, b) => a.trustedTime === b.trustedTime ? a.id.localeCompare(b.id) : a.trustedTime - b.trustedTime);
+}
+/**
+ * Compute the causally-closed accepted set and the quarantine records.
+ *
+ * Entries are evaluated in deterministic trusted-time order. An entry is
+ * quarantined if (a) any of its dependencies was quarantined (cascade), or
+ * (b) the verdict callback rejects it. Cascade quarantines reference the first
+ * quarantined ancestor that caused them, for the audit trail.
+ *
+ * @param entries The candidate entries (any order; sorted internally).
+ * @param verdictFor Decides an entry assuming its ancestors are all accepted.
+ *   Only called for entries with no quarantined dependency.
+ * @param now Wall-clock timestamp for audit records (not used in any decision).
+ */
+function computeAcceptedSet(entries, verdictFor, now) {
+    const ordered = sortForEvaluation(entries);
+    const acceptedIds = [];
+    const quarantinedIds = [];
+    const records = [];
+    // entry id -> the quarantined-ancestor id that taints it (for cascades).
+    const taintedBy = new Map();
+    const quarantined = new Set();
+    for (const entry of ordered) {
+        // Cascade: if any dependency is quarantined, this entry is too (§10).
+        const taintingDep = entry.dependencyIds.find((dep) => quarantined.has(dep));
+        if (taintingDep) {
+            const rootCause = taintedBy.get(taintingDep) ?? taintingDep;
+            quarantined.add(entry.id);
+            quarantinedIds.push(entry.id);
+            taintedBy.set(entry.id, rootCause);
+            records.push({
+                entryId: entry.id,
+                docId: entry.docId,
+                dbid: "",
+                entryType: entry.entryType,
+                reason: "cascade_dependent",
+                detail: `causally depends on quarantined entry ${taintingDep}`,
+                trustedTime: entry.trustedTime,
+                recordedAt: now,
+                causedByEntryId: rootCause,
+            });
+            continue;
+        }
+        const verdict = verdictFor(entry);
+        if (verdict.accepted) {
+            acceptedIds.push(entry.id);
+        }
+        else {
+            quarantined.add(entry.id);
+            quarantinedIds.push(entry.id);
+            taintedBy.set(entry.id, entry.id);
+            records.push({
+                recordedAt: now,
+                ...(verdict.record ?? {
+                    entryId: entry.id,
+                    docId: entry.docId,
+                    dbid: "",
+                    entryType: entry.entryType,
+                    reason: "tier2_denied",
+                    detail: "rejected by access policy",
+                    trustedTime: entry.trustedTime,
+                }),
+            });
+        }
+    }
+    return { acceptedIds, quarantinedIds, records };
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/core/accesscontrol/quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/quarantine.ts"],"names":[],"mappings":";;AAsDA,8CAIC;AAeD,gDA2DC;AAnFD;;;;GAIG;AACH,SAAgB,iBAAiB,CAAgC,OAAqB;IACpF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAChC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAC3F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAChC,OAAuC,EACvC,UAAwD,EACxD,GAAW;IAEX,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,sEAAsE;QACtE,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC;YAC5D,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,EAAE;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,yCAAyC,WAAW,EAAE;gBAC9D,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,GAAG;gBACf,eAAe,EAAE,SAAS;aAC3B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,GAAG;gBACf,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI;oBACpB,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,EAAE;oBACR,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,2BAA2B;oBACnC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC"}

package/dist/core/accesscontrol/receiptValidation.d.ts

@@ -0,0 +1,113 @@
+import { StoreEntryMetadata } from "../types";
+/**
+ * Receipt-time validation and the clock-skew guard (docs/accesscontrol.md §4,
+ * §5.4).
+ *
+ * A valid witness signature proves *who* signed and *what* it covers, but not
+ * that the `receivedAt` value is honest. A compromised witness could backdate
+ * `receivedAt` to slip an entry "before" a policy that would have denied it.
+ * Receivers therefore validate `receivedAt` in addition to the signature:
+ * per-witness monotonicity plus a wall-clock sanity check at receive time.
+ */
+/** Default tolerance for the client/server clock-skew guard (§4). */
+export declare const DEFAULT_CLOCK_SKEW_TOLERANCE_MS: number;
+/** How far in the past a `receivedAt` may be before it is *flagged* (not rejected). */
+export declare const DEFAULT_IMPLAUSIBLE_PAST_MS: number;
+/** Result of the clock-skew guard. */
+export interface ClockSkewResult {
+    ok: boolean;
+    skewMs: number;
+    toleranceMs: number;
+}
+/**
+ * Compare the local wall clock to the server's reported time (from
+ * `/sync/.../capabilities`), aborting sync if they diverge beyond tolerance
+ * (§4). This bounds how wrong a `createdAt` (and therefore a trusted-time
+ * decision) can be when a client edits offline then syncs.
+ */
+export declare function checkClockSkew(localTimeMs: number, serverTimeMs: number, toleranceMs?: number): ClockSkewResult;
+/** Capabilities a client reads from `GET /sync/.../capabilities` (§4, §12). */
+export interface NegotiableCapabilities {
+    /** Server wall clock (ms epoch), used for the clock-skew guard. */
+    serverTime?: number;
+    /** Whether the server understands witness fields / access control v1. */
+    supportsAccessControlV1?: boolean;
+}
+/** Outcome of the pre-sync capability negotiation (§12). */
+export interface SyncNegotiationResult {
+    /** Whether sync may proceed. */
+    ok: boolean;
+    /** Why sync was refused, when not ok. */
+    reason?: string;
+    /** The clock-skew measurement, when the server reported its time. */
+    clockSkew?: ClockSkewResult;
+    /** Whether the server enforces access control v1 (advisory for the client). */
+    accessControlAvailable: boolean;
+}
+/**
+ * Decide whether a client may proceed to sync, given the server's advertised
+ * capabilities (§12). Two gates:
+ *
+ * 1. **Clock-skew guard** (§4): if the server reported its time and the local
+ *    clock diverges beyond tolerance, refuse — a wrong local clock would make
+ *    `createdAt`-based trusted-time decisions unsafe.
+ * 2. **Strict mode** (§12): a per-tenant policy may refuse to sync against a
+ *    server that does not understand witness fields / access control v1.
+ *
+ * Pure and deterministic so it is trivially testable; the transport layer is a
+ * thin consumer.
+ */
+export declare function negotiateSync(localTimeMs: number, capabilities: NegotiableCapabilities, options?: {
+    strictMode?: boolean;
+    skewToleranceMs?: number;
+}): SyncNegotiationResult;
+/** Outcome of validating a single entry's witness receipt. */
+export interface ReceiptValidationResult {
+    /** Whether the receipt is acceptable (trusted witness, valid sig, sane time). */
+    ok: boolean;
+    /** Human-readable reason when not ok, or a flag note when ok-but-suspicious. */
+    reason?: string;
+    /** True when the entry carried no receipt at all (a local, not-yet-synced entry). */
+    noReceipt?: boolean;
+    /** True when the time looked implausibly old (accepted, but logged for audit). */
+    flaggedImplausiblePast?: boolean;
+}
+/** Inputs the validator needs that are not on the entry itself. */
+export interface ReceiptValidationContext {
+    /** Database id the entry belongs to (bound into the receipt signature). */
+    dbid: string;
+    /** Currently-trusted witness public keys (from the directory-state node, §6.4). */
+    trustedWitnessKeys: Set<string>;
+    /** Receiver wall clock at receive time (ms epoch). */
+    nowMs: number;
+    /** Clock-skew tolerance for the far-future rejection. */
+    skewToleranceMs?: number;
+    /** How far in the past is "implausible" (flagged, not rejected). */
+    implausiblePastMs?: number;
+}
+/**
+ * Validates witness receipts on incoming entries (§5.4). One instance should be
+ * kept per store so per-witness `receivedAt` monotonicity is enforced across
+ * the entries accepted from each witness.
+ */
+export declare class WitnessReceiptValidator {
+    /** Last accepted `receivedAt` per witness key (monotonicity, §5.4). */
+    private lastSeenByWitness;
+    /** Seed the per-witness high-water marks (e.g. from persisted state). */
+    constructor(initialLastSeen?: Map<string, number>);
+    /** The last-seen `receivedAt` for a witness, or undefined if none yet. */
+    getLastSeen(witnessPublicKey: string): number | undefined;
+    /**
+     * Validate the witness receipt on an entry. Returns `{ ok: true, noReceipt:
+     * true }` for entries with no receipt (local, not-yet-synced). Throws no
+     * exceptions for invalid receipts — it returns `{ ok: false, reason }` so the
+     * caller can quarantine.
+     */
+    validate(entry: StoreEntryMetadata, ctx: ReceiptValidationContext, subtle: SubtleCrypto): Promise<ReceiptValidationResult>;
+}
+/**
+ * The trusted time of an entry for all access-control evaluation: `receivedAt`
+ * when present (witness-assigned), otherwise `createdAt` (local entry). §5.1.
+ */
+export declare function trustedTimeOf(entry: Pick<StoreEntryMetadata, "receivedAt" | "createdAt">): number;
+//# sourceMappingURL=receiptValidation.d.ts.map

package/dist/core/accesscontrol/receiptValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiptValidation.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/receiptValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAG9C;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,QAAgB,CAAC;AAE7D,uFAAuF;AACvF,eAAO,MAAM,2BAA2B,QAA4B,CAAC;AAErE,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,WAAW,GAAE,MAAwC,GACpD,eAAe,CAGjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,gCAAgC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,+EAA+E;IAC/E,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,sBAAsB,EACpC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,qBAAqB,CA0BvB;AAED,8DAA8D;AAC9D,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,EAAE,EAAE,OAAO,CAAC;IACZ,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,qBAAa,uBAAuB;IAClC,uEAAuE;IACvE,OAAO,CAAC,iBAAiB,CAA6B;IAEtD,yEAAyE;gBAC7D,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAMjD,0EAA0E;IAC1E,WAAW,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIzD;;;;;OAKG;IACG,QAAQ,CACZ,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,wBAAwB,EAC7B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,uBAAuB,CAAC;CA+CpC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,WAAW,CAAC,GAAG,MAAM,CAEjG"}

package/dist/core/accesscontrol/receiptValidation.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WitnessReceiptValidator = exports.DEFAULT_IMPLAUSIBLE_PAST_MS = exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS = void 0;
+exports.checkClockSkew = checkClockSkew;
+exports.negotiateSync = negotiateSync;
+exports.trustedTimeOf = trustedTimeOf;
+const WitnessReceipt_1 = require("../crypto/WitnessReceipt");
+/**
+ * Receipt-time validation and the clock-skew guard (docs/accesscontrol.md §4,
+ * §5.4).
+ *
+ * A valid witness signature proves *who* signed and *what* it covers, but not
+ * that the `receivedAt` value is honest. A compromised witness could backdate
+ * `receivedAt` to slip an entry "before" a policy that would have denied it.
+ * Receivers therefore validate `receivedAt` in addition to the signature:
+ * per-witness monotonicity plus a wall-clock sanity check at receive time.
+ */
+/** Default tolerance for the client/server clock-skew guard (§4). */
+exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS = 5 * 60 * 1000; // 5 minutes
+/** How far in the past a `receivedAt` may be before it is *flagged* (not rejected). */
+exports.DEFAULT_IMPLAUSIBLE_PAST_MS = 365 * 24 * 60 * 60 * 1000; // ~1 year
+/**
+ * Compare the local wall clock to the server's reported time (from
+ * `/sync/.../capabilities`), aborting sync if they diverge beyond tolerance
+ * (§4). This bounds how wrong a `createdAt` (and therefore a trusted-time
+ * decision) can be when a client edits offline then syncs.
+ */
+function checkClockSkew(localTimeMs, serverTimeMs, toleranceMs = exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS) {
+    const skewMs = Math.abs(localTimeMs - serverTimeMs);
+    return { ok: skewMs <= toleranceMs, skewMs, toleranceMs };
+}
+/**
+ * Decide whether a client may proceed to sync, given the server's advertised
+ * capabilities (§12). Two gates:
+ *
+ * 1. **Clock-skew guard** (§4): if the server reported its time and the local
+ *    clock diverges beyond tolerance, refuse — a wrong local clock would make
+ *    `createdAt`-based trusted-time decisions unsafe.
+ * 2. **Strict mode** (§12): a per-tenant policy may refuse to sync against a
+ *    server that does not understand witness fields / access control v1.
+ *
+ * Pure and deterministic so it is trivially testable; the transport layer is a
+ * thin consumer.
+ */
+function negotiateSync(localTimeMs, capabilities, options) {
+    const accessControlAvailable = capabilities.supportsAccessControlV1 === true;
+    let clockSkew;
+    if (typeof capabilities.serverTime === "number") {
+        clockSkew = checkClockSkew(localTimeMs, capabilities.serverTime, options?.skewToleranceMs);
+        if (!clockSkew.ok) {
+            return {
+                ok: false,
+                reason: `clock skew ${clockSkew.skewMs}ms exceeds tolerance ${clockSkew.toleranceMs}ms`,
+                clockSkew,
+                accessControlAvailable,
+            };
+        }
+    }
+    if (options?.strictMode && !accessControlAvailable) {
+        return {
+            ok: false,
+            reason: "strict mode: server does not support access control v1",
+            clockSkew,
+            accessControlAvailable,
+        };
+    }
+    return { ok: true, clockSkew, accessControlAvailable };
+}
+/**
+ * Validates witness receipts on incoming entries (§5.4). One instance should be
+ * kept per store so per-witness `receivedAt` monotonicity is enforced across
+ * the entries accepted from each witness.
+ */
+class WitnessReceiptValidator {
+    /** Seed the per-witness high-water marks (e.g. from persisted state). */
+    constructor(initialLastSeen) {
+        /** Last accepted `receivedAt` per witness key (monotonicity, §5.4). */
+        this.lastSeenByWitness = new Map();
+        if (initialLastSeen) {
+            this.lastSeenByWitness = new Map(initialLastSeen);
+        }
+    }
+    /** The last-seen `receivedAt` for a witness, or undefined if none yet. */
+    getLastSeen(witnessPublicKey) {
+        return this.lastSeenByWitness.get(witnessPublicKey);
+    }
+    /**
+     * Validate the witness receipt on an entry. Returns `{ ok: true, noReceipt:
+     * true }` for entries with no receipt (local, not-yet-synced). Throws no
+     * exceptions for invalid receipts — it returns `{ ok: false, reason }` so the
+     * caller can quarantine.
+     */
+    async validate(entry, ctx, subtle) {
+        const { receivedAt, receivedByPublicKey, receivedDateSignature } = entry;
+        // No receipt: a purely local entry. Nothing to validate here.
+        if (receivedAt === undefined || !receivedByPublicKey || !receivedDateSignature) {
+            return { ok: true, noReceipt: true };
+        }
+        // The witness must be currently trusted (§6.4).
+        if (!ctx.trustedWitnessKeys.has(receivedByPublicKey)) {
+            return { ok: false, reason: "receipt from an untrusted witness key" };
+        }
+        // Cryptographically verify the signature over the §5.2 layout.
+        const fields = (0, WitnessReceipt_1.witnessFieldsFromEntry)(entry, {
+            dbid: ctx.dbid,
+            receivedAt,
+            receivedByPublicKey,
+        });
+        const sigValid = await (0, WitnessReceipt_1.verifyWitnessReceipt)(fields, receivedDateSignature, receivedByPublicKey, subtle);
+        if (!sigValid) {
+            return { ok: false, reason: "invalid witness signature" };
+        }
+        // Per-witness monotonicity: a witness cannot rewind its own clock (§5.4).
+        const lastSeen = this.lastSeenByWitness.get(receivedByPublicKey);
+        if (lastSeen !== undefined && receivedAt < lastSeen) {
+            return {
+                ok: false,
+                reason: `non-monotonic receivedAt (${receivedAt} < last-seen ${lastSeen}) from witness`,
+            };
+        }
+        // Wall-clock sanity at receive time (§5.4): reject far-future values.
+        const tolerance = ctx.skewToleranceMs ?? exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS;
+        if (receivedAt > ctx.nowMs + tolerance) {
+            return { ok: false, reason: "receivedAt is implausibly in the future" };
+        }
+        // Flag (but accept) implausibly old values for the audit log.
+        const implausiblePast = ctx.implausiblePastMs ?? exports.DEFAULT_IMPLAUSIBLE_PAST_MS;
+        const flaggedImplausiblePast = receivedAt < ctx.nowMs - implausiblePast;
+        // Accept and advance the monotonicity high-water mark.
+        this.lastSeenByWitness.set(receivedByPublicKey, receivedAt);
+        return { ok: true, flaggedImplausiblePast };
+    }
+}
+exports.WitnessReceiptValidator = WitnessReceiptValidator;
+/**
+ * The trusted time of an entry for all access-control evaluation: `receivedAt`
+ * when present (witness-assigned), otherwise `createdAt` (local entry). §5.1.
+ */
+function trustedTimeOf(entry) {
+    return entry.receivedAt ?? entry.createdAt;
+}
+//# sourceMappingURL=receiptValidation.js.map

package/dist/core/accesscontrol/receiptValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiptValidation.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/receiptValidation.ts"],"names":[],"mappings":";;;AAiCA,wCAOC;AAmCD,sCA8BC;AAgHD,sCAEC;AA1ND,6DAAwF;AAExF;;;;;;;;;GASG;AAEH,qEAAqE;AACxD,QAAA,+BAA+B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAE1E,uFAAuF;AAC1E,QAAA,2BAA2B,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAShF;;;;;GAKG;AACH,SAAgB,cAAc,CAC5B,WAAmB,EACnB,YAAoB,EACpB,cAAsB,uCAA+B;IAErD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC5D,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,SAAgB,aAAa,CAC3B,WAAmB,EACnB,YAAoC,EACpC,OAA4D;IAE5D,MAAM,sBAAsB,GAAG,YAAY,CAAC,uBAAuB,KAAK,IAAI,CAAC;IAE7E,IAAI,SAAsC,CAAC;IAC3C,IAAI,OAAO,YAAY,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAChD,SAAS,GAAG,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAC3F,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,cAAc,SAAS,CAAC,MAAM,wBAAwB,SAAS,CAAC,WAAW,IAAI;gBACvF,SAAS;gBACT,sBAAsB;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,UAAU,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,wDAAwD;YAChE,SAAS;YACT,sBAAsB;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC;AACzD,CAAC;AA4BD;;;;GAIG;AACH,MAAa,uBAAuB;IAIlC,yEAAyE;IACzE,YAAY,eAAqC;QAJjD,uEAAuE;QAC/D,sBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAIpD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,WAAW,CAAC,gBAAwB;QAClC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CACZ,KAAyB,EACzB,GAA6B,EAC7B,MAAoB;QAEpB,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,GAAG,KAAK,CAAC;QAEzE,8DAA8D;QAC9D,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,mBAAmB,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;QACxE,CAAC;QAED,+DAA+D;QAC/D,MAAM,MAAM,GAAG,IAAA,uCAAsB,EAAC,KAAK,EAAE;YAC3C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU;YACV,mBAAmB;SACpB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,qCAAoB,EAAC,MAAM,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACxG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAC5D,CAAC;QAED,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACjE,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,GAAG,QAAQ,EAAE,CAAC;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,6BAA6B,UAAU,gBAAgB,QAAQ,gBAAgB;aACxF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,IAAI,uCAA+B,CAAC;QACzE,IAAI,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC1E,CAAC;QAED,8DAA8D;QAC9D,MAAM,eAAe,GAAG,GAAG,CAAC,iBAAiB,IAAI,mCAA2B,CAAC;QAC7E,MAAM,sBAAsB,GAAG,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,eAAe,CAAC;QAExE,uDAAuD;QACvD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IAC9C,CAAC;CACF;AAzED,0DAyEC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,KAA2D;IACvF,OAAO,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC;AAC7C,CAAC"}