mindoodb 0.0.66 → 0.0.69

package/dist/core/quarantine/QuarantineView.d.ts

@@ -0,0 +1,90 @@
+/**
+ * One list for both kinds of quarantine.
+ *
+ * A change can be held back in two directions, and from the user's side they are
+ * the same complaint — "something I have is not where it should be, and nobody
+ * is retrying it":
+ *
+ * - **inbound** — an entry arrived here (over peer-to-peer sync, usually) and
+ *   was refused at materialization, so it sits in the local store without
+ *   affecting any document. Recorded in the metadata checkpoint, local to this
+ *   device, keyed per document. See `QuarantineRecord`.
+ * - **outbound** — an entry was written here and the server refused to ingest
+ *   it, so the push moved on without it. Recorded as a `qtn_` document in
+ *   `userdirectory`, which syncs to the whole tenant. See
+ *   {@link QuarantineRecordDoc}.
+ *
+ * The two live in different places for good reasons — an inbound refusal is a
+ * local verdict that every replica reaches on its own and would be pointless to
+ * broadcast, whereas an outbound one is exactly what other members need to see —
+ * but a user looking for a missing change does not know which of the two
+ * happened. So the storage stays split and the *reading* is unified here.
+ *
+ * ## Why the directions keep their own vocabulary
+ *
+ * Their reasons are genuinely different: an inbound refusal names the check that
+ * failed on this device (`tier2_denied`, `cascade_dependent`, …), an outbound one
+ * names what the server said (`policy`, `purged`, …). Flattening both into one
+ * enum would invent equivalences that do not hold, so {@link QuarantineViewRecord}
+ * is a discriminated union: `direction` tells a caller which vocabulary `reason`
+ * is drawn from, and which fields are even present.
+ */
+import type { QuarantineRecord, QuarantineReason } from "../accesscontrol/materializationGuard";
+import type { PutRejectionClass } from "../appendonlystores/types";
+import { type QuarantineRecordDoc } from "./QuarantineDocument";
+/** Which way the refused change was going. */
+export type QuarantineDirection = "inbound" | "outbound";
+/** What both directions can answer. */
+interface QuarantineViewCommon {
+    /** Database the refused entries belong to. */
+    dbid: string;
+    /** Document the refused entries belong to. */
+    documentId: string;
+    /** The refusing side's own wording, for the audit view. */
+    detail: string;
+    /** Refused entry ids, capped at {@link MAX_QUARANTINED_ENTRY_IDS}. */
+    entryIds: string[];
+    /** How many refused entries did not fit into {@link entryIds}. */
+    omittedEntryCount: number;
+    /** When this refusal was first seen. */
+    firstSeenAt: number;
+    /** When it was last confirmed. */
+    updatedAt: number;
+}
+/**
+ * One row of the unified quarantine view: all the entries of one document held
+ * back for one reason, in one direction.
+ */
+export type QuarantineViewRecord = (QuarantineViewCommon & {
+    direction: "inbound";
+    /** Which materialization check refused the entries on this device. */
+    reason: QuarantineReason;
+}) | (QuarantineViewCommon & {
+    direction: "outbound";
+    /** How the target classified its refusal. */
+    reason: PutRejectionClass;
+    /** Fingerprint of the signing key whose push was refused. */
+    signingKeyFingerprint: string;
+    /** The `qtn_` document holding this record, so a caller can withdraw it. */
+    recordDocId: string;
+});
+/**
+ * Fold the local materialization log into view rows.
+ *
+ * The log holds one record per entry, because an inbound refusal is decided per
+ * entry; the view groups them per (database, document, reason) so one poisoned
+ * entry dragging fifty dependents along reads as one problem rather than
+ * fifty-one — matching how the outbound records are already shaped.
+ */
+export declare function inboundQuarantineView(log: readonly QuarantineRecord[]): QuarantineViewRecord[];
+/** Turn verified `qtn_` records into view rows. */
+export declare function outboundQuarantineView(records: readonly QuarantineRecordDoc[]): QuarantineViewRecord[];
+/**
+ * The whole quarantine view, newest first.
+ *
+ * Newest first because the list is read when a change has gone missing, and the
+ * change someone is looking for is almost always the last one they made.
+ */
+export declare function mergeQuarantineViews(...groups: readonly (readonly QuarantineViewRecord[])[]): QuarantineViewRecord[];
+export {};
+//# sourceMappingURL=QuarantineView.d.ts.map

package/dist/core/quarantine/QuarantineView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineView.d.ts","sourceRoot":"","sources":["../../../src/core/quarantine/QuarantineView.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3F,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEzD,uCAAuC;AACvC,UAAU,oBAAoB;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B,CAAC,oBAAoB,GAAG;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,sEAAsE;IACtE,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC,GACF,CAAC,oBAAoB,GAAG;IACtB,SAAS,EAAE,UAAU,CAAC;IACtB,6CAA6C;IAC7C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,6DAA6D;IAC7D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEP;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,SAAS,gBAAgB,EAAE,GAC/B,oBAAoB,EAAE,CA4BxB;AAED,mDAAmD;AACnD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,mBAAmB,EAAE,GACtC,oBAAoB,EAAE,CAcxB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,MAAM,EAAE,SAAS,CAAC,SAAS,oBAAoB,EAAE,CAAC,EAAE,GACtD,oBAAoB,EAAE,CAUxB"}

package/dist/core/quarantine/QuarantineView.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * One list for both kinds of quarantine.
+ *
+ * A change can be held back in two directions, and from the user's side they are
+ * the same complaint — "something I have is not where it should be, and nobody
+ * is retrying it":
+ *
+ * - **inbound** — an entry arrived here (over peer-to-peer sync, usually) and
+ *   was refused at materialization, so it sits in the local store without
+ *   affecting any document. Recorded in the metadata checkpoint, local to this
+ *   device, keyed per document. See `QuarantineRecord`.
+ * - **outbound** — an entry was written here and the server refused to ingest
+ *   it, so the push moved on without it. Recorded as a `qtn_` document in
+ *   `userdirectory`, which syncs to the whole tenant. See
+ *   {@link QuarantineRecordDoc}.
+ *
+ * The two live in different places for good reasons — an inbound refusal is a
+ * local verdict that every replica reaches on its own and would be pointless to
+ * broadcast, whereas an outbound one is exactly what other members need to see —
+ * but a user looking for a missing change does not know which of the two
+ * happened. So the storage stays split and the *reading* is unified here.
+ *
+ * ## Why the directions keep their own vocabulary
+ *
+ * Their reasons are genuinely different: an inbound refusal names the check that
+ * failed on this device (`tier2_denied`, `cascade_dependent`, …), an outbound one
+ * names what the server said (`policy`, `purged`, …). Flattening both into one
+ * enum would invent equivalences that do not hold, so {@link QuarantineViewRecord}
+ * is a discriminated union: `direction` tells a caller which vocabulary `reason`
+ * is drawn from, and which fields are even present.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inboundQuarantineView = inboundQuarantineView;
+exports.outboundQuarantineView = outboundQuarantineView;
+exports.mergeQuarantineViews = mergeQuarantineViews;
+const QuarantineDocument_1 = require("./QuarantineDocument");
+/**
+ * Fold the local materialization log into view rows.
+ *
+ * The log holds one record per entry, because an inbound refusal is decided per
+ * entry; the view groups them per (database, document, reason) so one poisoned
+ * entry dragging fifty dependents along reads as one problem rather than
+ * fifty-one — matching how the outbound records are already shaped.
+ */
+function inboundQuarantineView(log) {
+    const rows = new Map();
+    for (const rec of log) {
+        const key = `${rec.dbid}\u0000${rec.docId}\u0000${rec.reason}`;
+        const existing = rows.get(key);
+        if (!existing) {
+            rows.set(key, {
+                direction: "inbound",
+                dbid: rec.dbid,
+                documentId: rec.docId,
+                reason: rec.reason,
+                detail: rec.detail,
+                entryIds: [rec.entryId],
+                omittedEntryCount: 0,
+                firstSeenAt: rec.recordedAt,
+                updatedAt: rec.recordedAt,
+            });
+            continue;
+        }
+        if (existing.entryIds.length < QuarantineDocument_1.MAX_QUARANTINED_ENTRY_IDS) {
+            existing.entryIds.push(rec.entryId);
+        }
+        else {
+            existing.omittedEntryCount += 1;
+        }
+        existing.firstSeenAt = Math.min(existing.firstSeenAt, rec.recordedAt);
+        existing.updatedAt = Math.max(existing.updatedAt, rec.recordedAt);
+    }
+    return [...rows.values()];
+}
+/** Turn verified `qtn_` records into view rows. */
+function outboundQuarantineView(records) {
+    return records.map((rec) => ({
+        direction: "outbound",
+        dbid: rec.dbid,
+        documentId: rec.quarantinedDocId,
+        reason: rec.rejectionClass,
+        detail: rec.reason,
+        entryIds: [...rec.entryIds],
+        omittedEntryCount: rec.omittedEntryCount,
+        firstSeenAt: rec.firstSeenAt,
+        updatedAt: rec.updatedAt,
+        signingKeyFingerprint: rec.signingKeyFingerprint,
+        recordDocId: rec.docId,
+    }));
+}
+/**
+ * The whole quarantine view, newest first.
+ *
+ * Newest first because the list is read when a change has gone missing, and the
+ * change someone is looking for is almost always the last one they made.
+ */
+function mergeQuarantineViews(...groups) {
+    const merged = groups.flat();
+    merged.sort((a, b) => b.updatedAt - a.updatedAt ||
+        a.dbid.localeCompare(b.dbid) ||
+        a.documentId.localeCompare(b.documentId) ||
+        a.reason.localeCompare(b.reason));
+    return merged;
+}
+//# sourceMappingURL=QuarantineView.js.map

package/dist/core/quarantine/QuarantineView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineView.js","sourceRoot":"","sources":["../../../src/core/quarantine/QuarantineView.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;AAuDH,sDA8BC;AAGD,wDAgBC;AAQD,oDAYC;AAxHD,6DAA2F;AA2C3F;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CACnC,GAAgC;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2D,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACZ,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,GAAG,CAAC,KAAK;gBACrB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,iBAAiB,EAAE,CAAC;gBACpB,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,8CAAyB,EAAE,CAAC;YACzD,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACtE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,mDAAmD;AACnD,SAAgB,sBAAsB,CACpC,OAAuC;IAEvC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3B,SAAS,EAAE,UAAmB;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,gBAAgB;QAChC,MAAM,EAAE,GAAG,CAAC,cAAc;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC3B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;QAChD,WAAW,EAAE,GAAG,CAAC,KAAK;KACvB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,GAAG,MAAoD;IAEvD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,CAAC,IAAI,CACT,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CACnC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/quarantine/recordPushRejections.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Turn what a push left behind into quarantine records.
+ *
+ * A client push uses the `"advance"` rejection policy: an entry the server
+ * refuses is stepped over so the rest of the database keeps syncing. That is the
+ * right trade — one refused entry must not stop a device from ever pushing
+ * again — but it means the cursor will never offer that entry a second time. If
+ * nothing writes it down at this moment, the change is gone with the process.
+ *
+ * This is the one place that happens, and it is deliberately *not* inside
+ * `pushChangesTo`: the records live in `userdirectory`, so recording them is a
+ * write to a different database than the one being pushed. A core sync call that
+ * quietly wrote somewhere else would be a surprise to every caller, and an
+ * expensive one — it would open the directory on every push. Callers that want
+ * the records ask for them.
+ */
+import type { MindooDB, SigningKeyPair } from "../types";
+import type { PutRejectionClass, RejectedPutEntry } from "../appendonlystores/types";
+/**
+ * Stands in for the document of an entry whose id follows neither the document
+ * nor the attachment scheme. Such an entry still has to be recorded — losing it
+ * silently is the whole problem — and `$` cannot begin a real document id, so
+ * this cannot collide with one.
+ */
+export declare const UNKNOWN_QUARANTINED_DOC_ID = "$unknown";
+/** What {@link recordPushRejections} managed to write. */
+export interface PushQuarantineResult {
+    /** One per record written or extended. */
+    recorded: Array<{
+        documentId: string;
+        rejectionClass: PutRejectionClass;
+        entryCount: number;
+    }>;
+    /**
+     * Refused entries that belong to a quarantine record themselves. Counted
+     * rather than recorded: a record about a refused record would be refused in
+     * turn, and each refusal would name a new document, so one server that turns
+     * away `qtn_` writes could otherwise make a device generate them without end.
+     */
+    skippedOwnRecords: number;
+    /** Records that could not be written, so a caller can log or retry them. */
+    failures: Array<{
+        documentId: string;
+        rejectionClass: PutRejectionClass;
+        error: string;
+    }>;
+}
+/**
+ * Write a quarantine record for every document a push was refused on.
+ *
+ * Grouped by (document, class) to match how the records are keyed, so a refusal
+ * that took a document's whole causal tail with it becomes one record holding
+ * many entry ids instead of one record per entry.
+ *
+ * Never throws: a device that cannot write the record has still lost the entry,
+ * and a failure here must not turn a partially-successful push into a failed
+ * one. Failures come back in {@link PushQuarantineResult.failures}.
+ */
+export declare function recordPushRejections(input: {
+    /** Id of the database whose push was refused. Not `userdirectory` as a rule. */
+    dbid: string;
+    /** The tenant's `userdirectory`, where the records live. */
+    userdirectoryDb: MindooDB;
+    /** What the push reported as refused. */
+    rejected: readonly RejectedPutEntry[];
+    /** Signing public key (PEM) of this device. */
+    signingPublicKey: string;
+    subtle: SubtleCrypto;
+    signingKeyPair?: SigningKeyPair;
+    signingKeyPassword?: string;
+    now?: number;
+}): Promise<PushQuarantineResult>;
+//# sourceMappingURL=recordPushRejections.d.ts.map

package/dist/core/quarantine/recordPushRejections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordPushRejections.d.ts","sourceRoot":"","sources":["../../../src/core/quarantine/recordPushRejections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKrF;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAAa,CAAC;AAErD,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,QAAQ,EAAE,KAAK,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,iBAAiB,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,EAAE,KAAK,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,cAAc,EAAE,iBAAiB,CAAC;QAClC,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;CACJ;AAWD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,eAAe,EAAE,QAAQ,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyEhC"}

package/dist/core/quarantine/recordPushRejections.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Turn what a push left behind into quarantine records.
+ *
+ * A client push uses the `"advance"` rejection policy: an entry the server
+ * refuses is stepped over so the rest of the database keeps syncing. That is the
+ * right trade — one refused entry must not stop a device from ever pushing
+ * again — but it means the cursor will never offer that entry a second time. If
+ * nothing writes it down at this moment, the change is gone with the process.
+ *
+ * This is the one place that happens, and it is deliberately *not* inside
+ * `pushChangesTo`: the records live in `userdirectory`, so recording them is a
+ * write to a different database than the one being pushed. A core sync call that
+ * quietly wrote somewhere else would be a surprise to every caller, and an
+ * expensive one — it would open the directory on every push. Callers that want
+ * the records ask for them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNKNOWN_QUARANTINED_DOC_ID = void 0;
+exports.recordPushRejections = recordPushRejections;
+const types_1 = require("../appendonlystores/types");
+const idGeneration_1 = require("../utils/idGeneration");
+const QuarantineDocument_1 = require("./QuarantineDocument");
+/**
+ * Stands in for the document of an entry whose id follows neither the document
+ * nor the attachment scheme. Such an entry still has to be recorded — losing it
+ * silently is the whole problem — and `$` cannot begin a real document id, so
+ * this cannot collide with one.
+ */
+exports.UNKNOWN_QUARANTINED_DOC_ID = "$unknown";
+/** Which document a refused entry belongs to. */
+function documentIdOf(entryId) {
+    return ((0, idGeneration_1.parseDocEntryId)(entryId)?.docId ??
+        (0, idGeneration_1.parseAttachmentChunkId)(entryId)?.docId ??
+        exports.UNKNOWN_QUARANTINED_DOC_ID);
+}
+/**
+ * Write a quarantine record for every document a push was refused on.
+ *
+ * Grouped by (document, class) to match how the records are keyed, so a refusal
+ * that took a document's whole causal tail with it becomes one record holding
+ * many entry ids instead of one record per entry.
+ *
+ * Never throws: a device that cannot write the record has still lost the entry,
+ * and a failure here must not turn a partially-successful push into a failed
+ * one. Failures come back in {@link PushQuarantineResult.failures}.
+ */
+async function recordPushRejections(input) {
+    const result = {
+        recorded: [],
+        skippedOwnRecords: 0,
+        failures: [],
+    };
+    if (input.rejected.length === 0) {
+        return result;
+    }
+    const groups = new Map();
+    for (const entry of input.rejected) {
+        const documentId = documentIdOf(entry.id);
+        if ((0, QuarantineDocument_1.isQuarantineDocId)(documentId)) {
+            result.skippedOwnRecords += 1;
+            continue;
+        }
+        const rejectionClass = (0, types_1.rejectionClassOf)(entry);
+        const key = `${documentId}\u0000${rejectionClass}`;
+        const group = groups.get(key);
+        if (group) {
+            group.entryIds.push(entry.id);
+        }
+        else {
+            groups.set(key, {
+                documentId,
+                rejectionClass,
+                // The first refusal's wording stands for the group: the target repeats
+                // itself across a causal cascade, and the class is what differs.
+                reason: entry.reason,
+                entryIds: [entry.id],
+            });
+        }
+    }
+    for (const group of groups.values()) {
+        try {
+            await (0, QuarantineDocument_1.recordPushQuarantine)({
+                db: input.userdirectoryDb,
+                signingPublicKey: input.signingPublicKey,
+                dbid: input.dbid,
+                quarantinedDocId: group.documentId,
+                rejectionClass: group.rejectionClass,
+                reason: group.reason,
+                entryIds: group.entryIds,
+                subtle: input.subtle,
+                signingKeyPair: input.signingKeyPair,
+                signingKeyPassword: input.signingKeyPassword,
+                now: input.now,
+            });
+            result.recorded.push({
+                documentId: group.documentId,
+                rejectionClass: group.rejectionClass,
+                entryCount: group.entryIds.length,
+            });
+        }
+        catch (error) {
+            result.failures.push({
+                documentId: group.documentId,
+                rejectionClass: group.rejectionClass,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=recordPushRejections.js.map

package/dist/core/quarantine/recordPushRejections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recordPushRejections.js","sourceRoot":"","sources":["../../../src/core/quarantine/recordPushRejections.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA2DH,oDAsFC;AA7ID,qDAA6D;AAC7D,wDAAgF;AAChF,6DAA+E;AAE/E;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG,UAAU,CAAC;AAyBrD,iDAAiD;AACjD,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,CACL,IAAA,8BAAe,EAAC,OAAO,CAAC,EAAE,KAAK;QAC/B,IAAA,qCAAsB,EAAC,OAAO,CAAC,EAAE,KAAK;QACtC,kCAA0B,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CAAC,KAa1C;IACC,MAAM,MAAM,GAAyB;QACnC,QAAQ,EAAE,EAAE;QACZ,iBAAiB,EAAE,CAAC;QACpB,QAAQ,EAAE,EAAE;KACb,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAQnB,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAA,sCAAiB,EAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,cAAc,GAAG,IAAA,wBAAgB,EAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,SAAS,cAAc,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,UAAU;gBACV,cAAc;gBACd,uEAAuE;gBACvE,iEAAiE;gBACjE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAA,yCAAoB,EAAC;gBACzB,EAAE,EAAE,KAAK,CAAC,eAAe;gBACzB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,gBAAgB,EAAE,KAAK,CAAC,UAAU;gBAClC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,GAAG,EAAE,KAAK,CAAC,GAAG;aACf,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/quarantine/resubmitQuarantined.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Offer quarantined entries to the server again.
+ *
+ * The push cursor has long since moved past these entries, so nothing will ever
+ * offer them on its own — that is the whole reason the records exist. Re-submit
+ * therefore goes straight to the target store with the specific entries, rather
+ * than rewinding the cursor: rewinding would re-scan the entire database to find
+ * a handful of entries, and would drag every *other* entry behind that position
+ * back through the refusal that made the cursor advance in the first place.
+ *
+ * ## Not every record may be tried again
+ *
+ * Filtered through {@link isResubmittableRejection}, and one of the exclusions is
+ * a matter of correctness rather than thrift: a `"purged"` refusal means the
+ * document's history was deliberately erased, so re-offering the entry is an
+ * attempt to undo that erasure. This function must never do it, whether it is
+ * called by a scheduler or by someone pressing a button.
+ */
+import type { ContentAddressedStore, PutRejectionClass, RejectedPutEntry } from "../appendonlystores/types";
+import type { MindooDB } from "../types";
+import { type QuarantineRecordDoc } from "./QuarantineDocument";
+/**
+ * How many records one pass tries.
+ *
+ * A pass runs whenever the tenant directory changes, and a record that still
+ * fails costs a round trip to learn nothing new. The budget keeps a backlog from
+ * turning every directory write into a burst of pushes; the remainder is tried
+ * by the next pass.
+ */
+export declare const DEFAULT_MAX_RESUBMIT_RECORDS = 25;
+/** What happened to one record. */
+export interface ResubmitOutcome {
+    /** The `qtn_` document this came from. */
+    recordDocId: string;
+    documentId: string;
+    rejectionClass: PutRejectionClass;
+    /** Entries the target took this time. */
+    accepted: string[];
+    /** Entries refused again. */
+    refused: RejectedPutEntry[];
+    /** Entries no longer in the local store, so nothing can be offered for them. */
+    missing: string[];
+    /** Whether the record was withdrawn. */
+    cleared: boolean;
+    /** Set when the attempt itself failed, rather than the entries being refused. */
+    error?: string;
+}
+export interface ResubmitResult {
+    outcomes: ResubmitOutcome[];
+    /**
+     * Records whose class rules out another attempt — permanently refused, or
+     * about a document that was purged on purpose.
+     */
+    skippedFinal: number;
+    /** Records left for the next pass by {@link DEFAULT_MAX_RESUBMIT_RECORDS}. */
+    notAttempted: number;
+}
+/**
+ * Re-offer the entries named by `records`, all of which must describe the
+ * database that `localStore` and `remoteStore` are two ends of.
+ *
+ * A record is withdrawn only when nothing about it is refused any more. A record
+ * that is *partly* accepted is deliberately left standing rather than rewritten
+ * to name fewer entries: rewriting it is a write, a write is something to push,
+ * and a push is what brings this function round again. It over-reports until the
+ * rest passes too, which is the cheaper of the two inaccuracies.
+ *
+ * Never throws — a re-submit is a background courtesy, and one unreachable
+ * server must not take the caller down with it.
+ */
+export declare function resubmitQuarantinedEntries(input: {
+    /** Records about one database. */
+    records: readonly QuarantineRecordDoc[];
+    localStore: ContentAddressedStore;
+    remoteStore: ContentAddressedStore;
+    /** Where the records live, so accepted ones can be withdrawn. */
+    userdirectoryDb: MindooDB;
+    subtle: SubtleCrypto;
+    maxRecords?: number;
+}): Promise<ResubmitResult>;
+//# sourceMappingURL=resubmitQuarantined.d.ts.map

package/dist/core/quarantine/resubmitQuarantined.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resubmitQuarantined.d.ts","sourceRoot":"","sources":["../../../src/core/quarantine/resubmitQuarantined.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,UAAU,CAAC;AACrD,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEvF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,iBAAiB,CAAC;IAClC,yCAAyC;IACzC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,gFAAgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,kCAAkC;IAClC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,UAAU,EAAE,qBAAqB,CAAC;IAClC,WAAW,EAAE,qBAAqB,CAAC;IACnC,iEAAiE;IACjE,eAAe,EAAE,QAAQ,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkE1B"}

package/dist/core/quarantine/resubmitQuarantined.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Offer quarantined entries to the server again.
+ *
+ * The push cursor has long since moved past these entries, so nothing will ever
+ * offer them on its own — that is the whole reason the records exist. Re-submit
+ * therefore goes straight to the target store with the specific entries, rather
+ * than rewinding the cursor: rewinding would re-scan the entire database to find
+ * a handful of entries, and would drag every *other* entry behind that position
+ * back through the refusal that made the cursor advance in the first place.
+ *
+ * ## Not every record may be tried again
+ *
+ * Filtered through {@link isResubmittableRejection}, and one of the exclusions is
+ * a matter of correctness rather than thrift: a `"purged"` refusal means the
+ * document's history was deliberately erased, so re-offering the entry is an
+ * attempt to undo that erasure. This function must never do it, whether it is
+ * called by a scheduler or by someone pressing a button.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_RESUBMIT_RECORDS = void 0;
+exports.resubmitQuarantinedEntries = resubmitQuarantinedEntries;
+const types_1 = require("../appendonlystores/types");
+const syncStores_1 = require("../appendonlystores/syncStores");
+const QuarantineDocument_1 = require("./QuarantineDocument");
+/**
+ * How many records one pass tries.
+ *
+ * A pass runs whenever the tenant directory changes, and a record that still
+ * fails costs a round trip to learn nothing new. The budget keeps a backlog from
+ * turning every directory write into a burst of pushes; the remainder is tried
+ * by the next pass.
+ */
+exports.DEFAULT_MAX_RESUBMIT_RECORDS = 25;
+/**
+ * Re-offer the entries named by `records`, all of which must describe the
+ * database that `localStore` and `remoteStore` are two ends of.
+ *
+ * A record is withdrawn only when nothing about it is refused any more. A record
+ * that is *partly* accepted is deliberately left standing rather than rewritten
+ * to name fewer entries: rewriting it is a write, a write is something to push,
+ * and a push is what brings this function round again. It over-reports until the
+ * rest passes too, which is the cheaper of the two inaccuracies.
+ *
+ * Never throws — a re-submit is a background courtesy, and one unreachable
+ * server must not take the caller down with it.
+ */
+async function resubmitQuarantinedEntries(input) {
+    const budget = input.maxRecords ?? exports.DEFAULT_MAX_RESUBMIT_RECORDS;
+    const result = { outcomes: [], skippedFinal: 0, notAttempted: 0 };
+    const candidates = [];
+    for (const record of input.records) {
+        if ((0, types_1.isResubmittableRejection)(record.rejectionClass)) {
+            candidates.push(record);
+        }
+        else {
+            result.skippedFinal += 1;
+        }
+    }
+    if (candidates.length > budget) {
+        result.notAttempted = candidates.length - budget;
+        candidates.length = budget;
+    }
+    for (const record of candidates) {
+        const outcome = {
+            recordDocId: record.docId,
+            documentId: record.quarantinedDocId,
+            rejectionClass: record.rejectionClass,
+            accepted: [],
+            refused: [],
+            missing: [],
+            cleared: false,
+        };
+        result.outcomes.push(outcome);
+        try {
+            const entries = await input.localStore.getEntries([...record.entryIds]);
+            const found = new Map(entries.map((entry) => [entry.id, entry]));
+            outcome.missing = record.entryIds.filter((id) => !found.has(id));
+            if (entries.length === 0) {
+                // Every entry is gone locally. Nothing can ever be offered for this
+                // record, so leaving it would make it permanent.
+                await clearRecord(input, record);
+                outcome.cleared = true;
+                continue;
+            }
+            const { receipts, batchRejected } = (0, syncStores_1.normalizePutResult)(await input.remoteStore.putEntries(entries));
+            // Without this the entries stay provisional locally even though the target
+            // has now witnessed them, and their trusted time never settles.
+            if (receipts.length > 0 && input.localStore.applyWitnessReceipts) {
+                await input.localStore.applyWitnessReceipts(receipts);
+            }
+            const refusedIds = new Set(batchRejected.map((entry) => entry.id));
+            outcome.refused = batchRejected;
+            outcome.accepted = entries
+                .map((entry) => entry.id)
+                .filter((id) => !refusedIds.has(id));
+            if (outcome.refused.length === 0) {
+                await clearRecord(input, record);
+                outcome.cleared = true;
+            }
+        }
+        catch (error) {
+            outcome.error = error instanceof Error ? error.message : String(error);
+        }
+    }
+    return result;
+}
+async function clearRecord(input, record) {
+    await (0, QuarantineDocument_1.clearQuarantineRecord)({
+        db: input.userdirectoryDb,
+        key: {
+            signingKeyFingerprint: record.signingKeyFingerprint,
+            dbid: record.dbid,
+            quarantinedDocId: record.quarantinedDocId,
+            rejectionClass: record.rejectionClass,
+        },
+        subtle: input.subtle,
+    });
+}
+//# sourceMappingURL=resubmitQuarantined.js.map

package/dist/core/quarantine/resubmitQuarantined.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resubmitQuarantined.js","sourceRoot":"","sources":["../../../src/core/quarantine/resubmitQuarantined.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAgEH,gEA2EC;AApID,qDAAqE;AACrE,+DAAoE;AAEpE,6DAAuF;AAEvF;;;;;;;GAOG;AACU,QAAA,4BAA4B,GAAG,EAAE,CAAC;AA+B/C;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,0BAA0B,CAAC,KAShD;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,oCAA4B,CAAC;IAChE,MAAM,MAAM,GAAmB,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAElF,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,IAAA,gCAAwB,EAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;YACpD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAoB;YAC/B,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,UAAU,EAAE,MAAM,CAAC,gBAAgB;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,KAAK;SACf,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAiB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,oEAAoE;gBACpE,iDAAiD;gBACjD,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,IAAA,+BAAkB,EACpD,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAC5C,CAAC;YACF,2EAA2E;YAC3E,gEAAgE;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;gBACjE,MAAM,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,OAAO;iBACvB,GAAG,CAAC,CAAC,KAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;iBACpC,MAAM,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAE/C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAA0D,EAC1D,MAA2B;IAE3B,MAAM,IAAA,0CAAqB,EAAC;QAC1B,EAAE,EAAE,KAAK,CAAC,eAAe;QACzB,GAAG,EAAE;YACH,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC"}