@acornly/adapter-firebase 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Free Solo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,104 @@
-# Temporary Holding Version
+# @acornly/adapter-firebase
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A `StorageAdapter` that keeps Acornly notes in a site's own Firestore, with no Acornly Cloud involved. The site pays its own Firebase bill and Acornly charges nothing.
+
+The adapter reads and writes as whoever is signed in on the site's Firebase Auth, or as a visitor when nobody is. The Firestore security rules this package ships decide what each of them may see and change.
+
+## Set up Firebase
+
+1. Deploy the rules and indexes that ship in the package, [`firestore.rules`](firestore.rules) and [`firestore.indexes.json`](firestore.indexes.json) (also under `node_modules/@acornly/adapter-firebase/`). If the site has no rules of its own, point `firebase.json` at them and run `firebase deploy --only firestore`:
+
+   ```json
+   {
+     "firestore": {
+       "rules": "node_modules/@acornly/adapter-firebase/firestore.rules",
+       "indexes": "node_modules/@acornly/adapter-firebase/firestore.indexes.json"
+     }
+   }
+   ```
+
+   If it has, copy the functions and the `acornly_` matches into its rules file, and the indexes into its indexes file. Everything they cover is in collections prefixed with `acornly_`.
+
+2. List the scopes the site accepts notes in, as documents in `acornly_scopes` whose id is the scope. Signed-in users can write only to these, plus their own `user:<uid>` scope. Clients cannot write this collection, so add them in the Firebase console or with the Admin SDK:
+
+   ```ts
+   await admin.firestore().doc("acornly_scopes/app:my-site").set({});
+   // Let visitors who are not signed in read the public notes in this scope:
+   await admin.firestore().doc("acornly_scopes/web:example.com").set({ anonymousRead: true });
+   ```
+
+3. Turn on a sign-in method in Firebase Authentication. Notes are written as the signed-in Firebase user, and anonymous sign-ins cannot write.
+
+## Use it
+
+```ts
+import { initializeApp } from "firebase/app";
+import { getAuth } from "firebase/auth";
+import { getFirestore } from "firebase/firestore";
+import { FirebaseAdapter } from "@acornly/adapter-firebase";
+
+const app = initializeApp(firebaseConfig);
+const adapter = new FirebaseAdapter({ firestore: getFirestore(app), auth: getAuth(app) });
+```
+
+`firebase` 12 or later in 12.x is a peer dependency: the adapter uses the site's app and adds nothing to the bundle for it.
+
+## Access rules
+
+| Who                            | Can read                                      | Can write                                                                   |
+| ------------------------------ | --------------------------------------------- | --------------------------------------------------------------------------- |
+| The note's creator             | Their own notes, always                       | Edit or remove their own notes, in listed scopes or their own `user:` scope |
+| Anyone signed in               | `public` notes                                | New notes in listed scopes and their own `user:` scope                      |
+| A visitor who is not signed in | `public` notes in scopes with `anonymousRead` | Nothing                                                                     |
+| The site's server (Admin SDK)  | Everything (security rules do not apply)      | Anything, so it must keep the fields below consistent itself                |
+
+- Firebase's anonymous sign-ins count as visitors who are not signed in, although they have a user id.
+- Two audiences are supported: `private` (only the creator) and `public`. Circles, user lists and links need Acornly Cloud and are refused.
+- Each note is one document in `acornly_annotations`, named by the note's id. Ids are 1 to 128 letters, digits, `_`, `~` or `-` (Acornly's are ULIDs), so a reply's target IRI holds its parent's id unescaped. Notes imported from W3C files keep their ids, so an import whose ids are IRIs (such as Hypothesis URLs) is refused here; give such notes new ids first.
+- The document holds the annotation as JSON (`json`, up to 64 KB) and, beside it, the fields the rules check: the author's `uid`, `creatorId`, `scope`, `source` (`target.source`), `parent`, `threadRoot`, `depth`, `parentRev`, `audience`, `modified`, `rev` and `deleted`. When the adapter reads a note, those fields take precedence over the JSON's copy of them, so nobody can make a note look like it is somewhere or for someone it is not. The rest of the annotation is stored as sent, so validate notes from other users before trusting their shape. A document whose JSON is not an object with `target` and `ext` is skipped.
+- Scopes are `app:`, `web:` or `user:` followed by anything but `/`. `modified` is an ISO 8601 time with a `Z` or an offset.
+- `uid` is the signed-in user who created the note, checked by the rules. Show that as the author: the annotation's own `creator` field is whatever the client sent.
+- `rev` is checked by the rules: a note starts at 1 and each update adds one. Every write is a Firestore transaction that reads the note first, so of two concurrent edits one wins and the other gets a `ConflictError`.
+- Context on context (replies, tags, reactions, highlights on a note) targets its parent: `target.source` is `urn:contexthive:annotation:<parent id>`, and it carries `ext.threadRoot` and `ext.depth`. Add it with `adapter.threads.addChild` (or core's `addContext`). The rules check it against the stored parent: the parent must exist, be readable by the replier and not be deleted, and the child must have its scope, thread root, the next depth, and a parent rev the parent has had. The rules cannot see quotes inside the JSON, so only the adapter checks that `ext.parentRev` is set exactly when the child quotes its parent. A child can narrow its parent's audience (a private reply under a public note) but never widen it, on create or on edit. Children nest to any depth.
+- Each note keeps the ids of its direct children in `kids`, changed only in the same write that adds or removes that child, which the rules check. That is how a delete knows a note still has children, even ones the deleter cannot read. It also means anyone who can read a note can read the ids of all its direct children, private ones included, and ULIDs carry their creation time: a private reply's existence and time are not secret, only its content and author.
+- Plain updates keep the tree: no note moves to another scope, document or thread, `ext.depth`, `ext.parentRev` and the target stay, `ext.deleted` changes only through a delete, a deleted placeholder cannot be edited, and a note with replies keeps its `creator.id`. Plain removes refuse replies and notes with replies; the rules refuse removing a note that has children from any client.
+- Delete with `adapter.threads.deleteNode` (or core's `deleteContext`). Only the author can delete a note (and anyone signed in can remove a placeholder with no children left). One with any reply, even one the author cannot see, becomes a placeholder: no body, author name or edited mark, `ext.deleted: true`. One without replies is removed, and so is each placeholder above it left with none, whoever wrote it: the rules let anyone remove a placeholder whose last child goes in the same write. A long chain of placeholders goes six at a time, each step its own transaction, since Firestore allows the rules of one write 20 document lookups; should a later step fail, the placeholders it leaves have no children and readers never see them.
+- **Replies under a narrowed note stay readable.** Firestore rules check each note on its own and cannot follow a reply's parents, so when a note is narrowed from public to private, other people's public replies below it stay readable to anyone signed in who asks for them, by id or by loading the thread. Core's `assembleThread`, which the SDK and the built-in UI use, hides them; the private note itself stays private. Delete or narrow such replies when that is not enough.
+- Edit history lives in `acornly_versions` (`adapter.versions`), one document per note holding its saved versions. Only the note's author can save, read or clear them; removing a note or turning it into a placeholder drops them. A Firestore document holds 1 MiB, so when a note's versions outgrow that, the oldest are dropped.
+- Deleting a Firebase Auth user leaves their notes. Remove them from the site's server with the Admin SDK, which the rules do not check: delete a user's notes without replies, and turn ones with replies into placeholders, taking each removed note out of its parent's `kids`.
+- `modified` comes from the client and is what `list({ since })` compares, so a client with a wrong clock (or one that writes a time far ahead) can make its edit invisible, or always present, to other clients' delta syncs. Treat delta sync as a shortcut and resync with a full `list` now and then.
+- Ids are chosen by the client, so creating an id that already exists fails even when the existing note is hidden. Use random ids (Acornly's are ULIDs) so this reveals nothing. Reading an id behaves the same way: Firestore refuses a hidden note but reports a missing one as missing, so a probe can tell that a hidden id exists.
+- Edits need the scope to still be listed (or be the author's own `user:` scope), as on Supabase; deletes do not, so a delisted scope's notes can still be removed by their authors.
+- A parent's `kids` lives in its document, which Firestore caps at 1 MiB: a note can take tens of thousands of direct children, not more.
+- Each reply, tag or reaction also writes its parent's document (its `kids`). Firestore sustains about one write a second to one document and a transaction gives up after five retries, so a burst of reactions on one note can fail some of them.
+- Writes need a connection: Firestore transactions fail offline, whatever the site's cache settings.
+
+## What it costs
+
+Firestore bills each document a query returns or a rule looks up, not each request, so a page's notes cost reads in proportion to how many there are:
+
+- `list` runs two queries for someone signed in (public notes, and their own) and one for a visitor, and is billed one read per note returned, at least one per query. A delta sync (`since`) reads only the notes changed since.
+- Loading a thread reads its root and every node in it. Counting replies (`threads.countChildren`) reads each parent and runs two count queries, billed one read per 1,000 replies counted.
+- `subscribe` keeps two snapshot listeners open per page, billed one read per note when they start and one per note changed while they run. A listener that reconnects after being offline for more than 30 minutes is billed as if it started again.
+- Each write is a transaction that reads the note (and a reply's parent, a delete's placeholders above it), and the rules' lookups of other documents are billed as reads too: a few per write.
+
+A page with many notes and many visitors can add up. Firestore's own usage tab shows the reads; budget alerts in the Google Cloud console warn before a bill grows.
+
+## Live updates
+
+`subscribe` listens to Firestore snapshots of the page's public notes and of the caller's own notes, which the same rules filter. A subscriber hears about its own adapter's writes at once and does not hear them again when the snapshot echoes them. Unlike Supabase Realtime, a note narrowed from public to private, or deleted, is told to other readers as removed.
+
+- **Replies are not followed.** A subscription follows one page, and replies target their parent rather than the page, so subscribers hear about a note turning into a placeholder but not about replies being added or edited. Load threads with `threads.listThread` when they are opened.
+- **Who is signed in is read when subscribing.** After someone signs in or out, subscribe again. Reloading the document with the SDK's `setDocument`, as the getting-started guide does when the user changes, does that.
+- **A listener that fails stops.** A visitor subscribing to a scope without `anonymousRead`, or rules that are not deployed, end the subscription; `onListenError` (default `console.error`) is told why.
+
+## Develop
+
+The rules and the adapter are tested against the Firestore and Auth emulators, with the shared contract suites and the access-rule tests in `test/`. The emulators need Java 21; `firebase-tools` comes from `pnpm dlx`, at the version pinned in the `test:emulator` script, and downloads the Firestore emulator on first use.
+
+```sh
+cd packages/adapter-firebase
+pnpm test:emulator   # starts the emulators from firebase.json, runs the tests, stops them
+```
+
+`scripts/ci-local.sh adapter-firebase` runs the same.

package/dist/index.d.ts

@@ -0,0 +1,96 @@
+import type { Auth } from "firebase/auth";
+import { type Firestore, type FirestoreError } from "firebase/firestore";
+import { type Annotation, type ChangeEvent, type ListQuery, type StorageAdapter, type ThreadStore, type Unsubscribe, type VersionStore } from "@acornly/core";
+export interface FirebaseAdapterOptions {
+    /** The site's own Firestore, with the shipped `firestore.rules` deployed to it. */
+    firestore: Firestore;
+    /**
+     * The site's Firebase Auth. The adapter reads and writes as whoever is signed in on it, or as a
+     * visitor when nobody is. Anonymous sign-ins count as visitors: they read, but cannot write.
+     */
+    auth: Auth;
+    /**
+     * Called when a subscription's snapshot listener fails, for example when a visitor who is not
+     * signed in subscribes to a scope without `anonymousRead`, or the rules are not deployed.
+     * Firestore stops a failed listener; subscribe again to retry. Defaults to `console.error`.
+     */
+    onListenError?: (error: FirestoreError) => void;
+}
+/**
+ * Keeps annotations in a site's own Firestore, checked by the security rules this package ships
+ * (`firestore.rules`). Each write is a Firestore transaction that reads what it depends on, so
+ * concurrent edits conflict instead of overwriting each other, and the rules check every write.
+ *
+ * Subscribers hear about this adapter's own writes at once, and about everyone else's through
+ * Firestore snapshot listeners, which the same rules filter.
+ */
+export declare class FirebaseAdapter implements StorageAdapter {
+    readonly capabilities: {
+        realtime: boolean;
+        search: boolean;
+        offline: boolean;
+    };
+    private readonly db;
+    private readonly auth;
+    private readonly notes;
+    private readonly listeners;
+    private readonly onListenError;
+    constructor(options: FirebaseAdapterOptions);
+    /** Earlier versions, in `acornly_versions`: only the note's author can save or read them. */
+    readonly versions: VersionStore;
+    /**
+     * Reply threads. Each write is one transaction, and the rules check each new child against
+     * its parent and keep every note's list of children in step, so a delete knows whether a note
+     * still has children, even ones the deleter cannot read.
+     */
+    readonly threads: ThreadStore;
+    /**
+     * Removes `start` in `tx`, then each placeholder above it left with no children, up to
+     * `CHAIN_STEP` notes, and takes the last one out of the children of the note above it. `next`
+     * is that note when it is a placeholder left with no children, still to remove.
+     */
+    private removeUp;
+    list(q: ListQuery): Promise<Annotation[]>;
+    get(id: string): Promise<Annotation | null>;
+    create(a: Annotation): Promise<Annotation>;
+    update(a: Annotation, expectedRev: number): Promise<Annotation>;
+    remove(id: string, expectedRev: number): Promise<void>;
+    subscribe(q: Omit<ListQuery, "since">, onChange: (e: ChangeEvent) => void): Unsubscribe;
+    /** Who is signed in: `member` when with an account, not an anonymous sign-in. */
+    private who;
+    /** The signed-in account a write is made as. */
+    private writer;
+    private noteRef;
+    private versionsRef;
+    /** The stored note, or null when it is missing or the caller cannot read it. */
+    private readDoc;
+    /**
+     * The notes matching `constraints` that the caller can read: the public ones, and their own.
+     * The rules refuse any query that could return a note the caller cannot read, so each query
+     * asks for one of those two kinds.
+     */
+    private readAll;
+    /**
+     * Runs a query. A visitor is refused a scope without `anonymousRead` as a whole query, which
+     * reads as finding nothing, as it would under row-level security.
+     */
+    private fetch;
+    private count;
+    /**
+     * Runs `body` in a Firestore transaction, which Firestore may retry when what it read changed
+     * meanwhile. The rules refusing a write becomes a plain "not allowed".
+     */
+    private transact;
+    /**
+     * Plain updates keep the tree: no note moves to another scope, document or thread, `deleted`
+     * changes only through `deleteNode`, a placeholder is never edited, a note with children keeps
+     * its author, and a child keeps its parent rev and gets no wider than its parent. The rules
+     * check the same, but cannot say which rule a write broke.
+     */
+    private checkTreeKept;
+    private onRemote;
+    /** Tells this adapter's subscribers about one of its own writes. */
+    private emit;
+    private tell;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAeL,KAAK,SAAS,EACd,KAAK,cAAc,EAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAUL,KAAK,UAAU,EACf,KAAK,WAAW,EAEhB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,SAAS,EAAE,SAAS,CAAC;IACrB;;;OAGG;IACH,IAAI,EAAE,IAAI,CAAC;IACX;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACjD;AA0ED;;;;;;;GAOG;AACH,qBAAa,eAAgB,YAAW,cAAc;IACpD,QAAQ,CAAC,YAAY;;;;MAAqD;IAC1E,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkC;gBAEpD,OAAO,EAAE,sBAAsB;IAO3C,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAyC7B;IAEF;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,WAAW,CAsG3B;IAEF;;;;OAIG;YACW,QAAQ;IAiChB,IAAI,CAAC,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAMzC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAK3C,MAAM,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAyB1C,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAa/D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5D,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,WAAW,KAAK,IAAI,GAAG,WAAW;IAgEvF,iFAAiF;YACnE,GAAG;IAMjB,gDAAgD;YAClC,MAAM;IAMpB,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,WAAW;IAInB,gFAAgF;YAClE,OAAO;IAWrB;;;;OAIG;YACW,OAAO;IAgBrB;;;OAGG;YACW,KAAK;YAUL,KAAK;IASnB;;;OAGG;YACW,QAAQ;IAStB;;;;;OAKG;YACW,aAAa;IAiC3B,OAAO,CAAC,QAAQ;IA2BhB,oEAAoE;IACpE,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,IAAI;CAUb"}

package/dist/index.js

@@ -0,0 +1,696 @@
+import { arrayRemove, arrayUnion, collection, doc, getCountFromServer, getDoc, getDocs, onSnapshot, query, runTransaction, where, } from "firebase/firestore";
+import { afterAnnotationPrefix, AudienceError, ConflictError, NotFoundError, ThreadError, checkChild, isWithinAudience, parentIdOf, placeholderOf, } from "@acornly/core";
+/** Collections the shipped rules cover. */
+const NOTES = "acornly_annotations";
+const VERSIONS = "acornly_versions";
+/** Ids the rules accept: no character needs escaping in a target IRI or a document path. */
+const ID = /^[A-Za-z0-9_~-]{1,128}$/;
+/** The rules' limit on a note's JSON. */
+const MAX_JSON = 65_536;
+/** What the saved versions of one note may take, below Firestore's 1 MiB per document. */
+const MAX_VERSION_BYTES = 1_000_000;
+/**
+ * Notes one transaction removes at most when a delete takes placeholders above it along. The
+ * rules look up a few documents for each, and Firestore allows a write 20 lookups.
+ */
+const CHAIN_STEP = 6;
+/** How long to wait for the snapshot echo of an own remove before giving up on it. */
+const ECHO_WAIT_MS = 30_000;
+/**
+ * Keeps annotations in a site's own Firestore, checked by the security rules this package ships
+ * (`firestore.rules`). Each write is a Firestore transaction that reads what it depends on, so
+ * concurrent edits conflict instead of overwriting each other, and the rules check every write.
+ *
+ * Subscribers hear about this adapter's own writes at once, and about everyone else's through
+ * Firestore snapshot listeners, which the same rules filter.
+ */
+export class FirebaseAdapter {
+    capabilities = { realtime: true, search: false, offline: false };
+    db;
+    auth;
+    notes;
+    listeners = new Set();
+    onListenError;
+    constructor(options) {
+        this.db = options.firestore;
+        this.auth = options.auth;
+        this.notes = collection(this.db, NOTES);
+        this.onListenError = options.onListenError ?? ((error) => console.error(error));
+    }
+    /** Earlier versions, in `acornly_versions`: only the note's author can save or read them. */
+    versions = {
+        saveVersion: async (a) => {
+            const me = await this.writer();
+            const ref = this.versionsRef(a.id);
+            await this.transact(a.id, async (tx) => {
+                const note = await readIn(tx, this.noteRef(a.id));
+                // Gone or deleted meanwhile (an edit that raced a delete): there is nothing to keep.
+                if (typeof note === "string" || note.doc.deleted)
+                    return;
+                if (note.doc.uid !== me.uid) {
+                    throw new Error(`Not allowed to keep versions of annotation ${a.id}`);
+                }
+                const stored = await tx.get(ref);
+                const items = { ...(stored.data()?.items ?? {}) };
+                const key = String(a.ext.rev);
+                items[key] = JSON.stringify(a);
+                // Firestore documents hold 1 MiB: the oldest versions make way.
+                const revs = Object.keys(items)
+                    .filter((k) => k !== key)
+                    .sort((x, y) => Number(x) - Number(y));
+                while (revs.length && versionBytes(items) > MAX_VERSION_BYTES)
+                    delete items[revs.shift()];
+                tx.set(ref, { uid: me.uid, items });
+            });
+        },
+        listVersions: async (id) => {
+            let stored;
+            try {
+                stored = await getDoc(this.versionsRef(id));
+            }
+            catch (err) {
+                if (isDenied(err))
+                    return [];
+                throw err;
+            }
+            const items = stored.data()?.items ?? {};
+            return Object.keys(items)
+                .sort((x, y) => Number(x) - Number(y))
+                .map((k) => JSON.parse(items[k]));
+        },
+        clearVersions: async (id) => {
+            await this.transact(id, async (tx) => {
+                tx.delete(this.versionsRef(id));
+            });
+        },
+    };
+    /**
+     * Reply threads. Each write is one transaction, and the rules check each new child against
+     * its parent and keep every note's list of children in step, so a delete knows whether a note
+     * still has children, even ones the deleter cannot read.
+     */
+    threads = {
+        listThread: async (q) => {
+            const [root, below] = await Promise.all([
+                this.get(q.threadRoot),
+                this.readAll([where("scope", "==", q.scope), where("threadRoot", "==", q.threadRoot)]),
+            ]);
+            // Only a root starts a thread; a reply's id finds nothing, as on other backends.
+            return root && root.ext.scope === q.scope && root.ext.threadRoot == null
+                ? [root, ...below]
+                : below;
+        },
+        countChildren: async (ids) => {
+            const counts = Object.fromEntries(ids.map((id) => [id, 0]));
+            const me = await this.who();
+            await Promise.all([...new Set(ids)].map(async (id) => {
+                // Children share the parent's scope; a query names it so the rules can check a visitor
+                // against that scope's `anonymousRead`.
+                const parent = await this.readDoc(id);
+                if (!parent)
+                    return;
+                const under = [where("scope", "==", parent.scope), where("parent", "==", id)];
+                const counted = [query(this.notes, ...under, where("audience", "==", "public"))];
+                if (me?.member) {
+                    counted.push(query(this.notes, ...under, where("uid", "==", me.uid), where("audience", "==", "private")));
+                }
+                const totals = await Promise.all(counted.map((c) => this.count(c, me?.member ?? false)));
+                counts[id] = totals.reduce((sum, n) => sum + n, 0);
+            }));
+            return counts;
+        },
+        addChild: async (child) => {
+            const parentId = parentIdOf(child);
+            if (parentId === null)
+                throw new Error(`Annotation ${child.id} is not context on context`);
+            const me = await this.writer();
+            const stored = storedAt(child, 1);
+            const fields = fieldsOf(stored, me.uid, [], null);
+            await this.transact(child.id, async (tx) => {
+                const parent = await readIn(tx, this.noteRef(parentId));
+                if (typeof parent === "string")
+                    throw new NotFoundError(parentId);
+                const parentNote = toAnnotation(parentId, parent.doc);
+                if (!parentNote)
+                    throw new ThreadError(`Annotation ${parentId} cannot be read`);
+                checkChild(child, parentNote);
+                if ((await readIn(tx, this.noteRef(child.id))) !== "missing") {
+                    throw new Error(`Annotation ${child.id} already exists`);
+                }
+                tx.set(this.noteRef(child.id), fields);
+                tx.update(this.noteRef(parentId), { kids: arrayUnion(child.id), kidChange: child.id });
+            });
+            this.emit({ type: "created", annotation: stored });
+            return structuredClone(stored);
+        },
+        deleteNode: async (id, expectedRev, now) => {
+            const me = await this.writer();
+            const result = await this.transact(id, async (tx) => {
+                const target = current(id, expectedRev, await readIn(tx, this.noteRef(id)), me.uid);
+                if (target.deleted)
+                    throw new ThreadError(`Annotation ${id} is already deleted`);
+                if (target.kids.length) {
+                    const note = toAnnotation(id, target);
+                    if (!note)
+                        throw new Error(`Annotation ${id} is not stored as an annotation`);
+                    const placeholder = placeholderOf(note, now);
+                    const stored = storedAt(placeholder, target.rev + 1);
+                    tx.set(this.noteRef(id), fieldsOf(stored, target.uid, target.kids, target.kidChange));
+                    tx.delete(this.versionsRef(id));
+                    return { placeholder: stored };
+                }
+                // Reads come before writes in a transaction.
+                const removal = await this.removeUp(tx, id, target);
+                tx.delete(this.versionsRef(id));
+                return removal;
+            });
+            if ("placeholder" in result) {
+                this.emit({ type: "updated", annotation: result.placeholder });
+                return { placeholder: structuredClone(result.placeholder), removed: [] };
+            }
+            // A long chain of placeholders goes a few at a time, each step its own transaction. Should
+            // a later step fail, the placeholders it left have no children, which readers never see.
+            const removed = [...result.removed];
+            let step = result;
+            while (step.next !== null) {
+                const top = step.next;
+                step = await this.transact(top, async (tx) => {
+                    const found = await readIn(tx, this.noteRef(top));
+                    if (typeof found === "string" || !found.doc.deleted || found.doc.kids.length) {
+                        return { removed: [], next: null };
+                    }
+                    return this.removeUp(tx, top, found.doc);
+                }).catch(() => ({ removed: [], next: null }));
+                removed.push(...step.removed);
+            }
+            for (const r of removed) {
+                this.emit({ type: "removed", id: r.id }, { scope: r.doc.scope, document: r.doc.source });
+            }
+            return { removed: removed.map((r) => r.id) };
+        },
+    };
+    /**
+     * Removes `start` in `tx`, then each placeholder above it left with no children, up to
+     * `CHAIN_STEP` notes, and takes the last one out of the children of the note above it. `next`
+     * is that note when it is a placeholder left with no children, still to remove.
+     */
+    async removeUp(tx, start, startDoc) {
+        const removed = [{ id: start, doc: startDoc }];
+        let parentId = startDoc.parent;
+        let parent = "missing";
+        while (parentId !== null) {
+            parent = await readIn(tx, this.noteRef(parentId));
+            const below = removed[removed.length - 1].id;
+            if (typeof parent === "string" ||
+                !parent.doc.deleted ||
+                parent.doc.kids.length !== 1 ||
+                parent.doc.kids[0] !== below ||
+                removed.length === CHAIN_STEP) {
+                break;
+            }
+            removed.push({ id: parentId, doc: parent.doc });
+            parentId = parent.doc.parent;
+        }
+        for (const r of removed)
+            tx.delete(this.noteRef(r.id));
+        if (parentId === null || parent === "missing")
+            return { removed, next: null };
+        // The note above loses the last removed one from its children. One the deleter cannot read
+        // (narrowed since) still exists, and the rules let anyone make this change.
+        const last = removed[removed.length - 1].id;
+        tx.update(this.noteRef(parentId), { kids: arrayRemove(last), kidChange: last });
+        const emptied = typeof parent !== "string" &&
+            parent.doc.deleted &&
+            parent.doc.kids.length === 1 &&
+            parent.doc.kids[0] === last;
+        return { removed, next: emptied ? parentId : null };
+    }
+    async list(q) {
+        const constraints = [where("scope", "==", q.scope), where("source", "==", q.documentId)];
+        if (q.since !== undefined)
+            constraints.push(where("modified", ">", q.since));
+        return this.readAll(constraints);
+    }
+    async get(id) {
+        const found = await this.readDoc(id);
+        return found ? toAnnotation(id, found) : null;
+    }
+    async create(a) {
+        if (isAnnotationTarget(a.target.source)) {
+            throw new ThreadError(`Annotation ${a.id} targets an annotation; use threads.addChild`);
+        }
+        if ((a.ext.threadRoot ?? null) !== null ||
+            (a.ext.depth ?? 0) !== 0 ||
+            a.ext.parentRev !== undefined) {
+            throw new ThreadError(`Annotation ${a.id} has thread fields but targets a page`);
+        }
+        const me = await this.writer();
+        const stored = storedAt(a, 1);
+        const fields = fieldsOf(stored, me.uid, [], null);
+        await this.transact(a.id, async (tx) => {
+            // A note the caller cannot read is "hidden", which is taken too.
+            if ((await readIn(tx, this.noteRef(a.id))) !== "missing") {
+                throw new Error(`Annotation ${a.id} already exists`);
+            }
+            tx.set(this.noteRef(a.id), fields);
+        });
+        this.emit({ type: "created", annotation: stored });
+        return structuredClone(stored);
+    }
+    async update(a, expectedRev) {
+        const me = await this.writer();
+        const stored = await this.transact(a.id, async (tx) => {
+            const existing = current(a.id, expectedRev, await readIn(tx, this.noteRef(a.id)), me.uid);
+            await this.checkTreeKept(tx, a, existing);
+            const next = storedAt(a, existing.rev + 1);
+            tx.set(this.noteRef(a.id), fieldsOf(next, existing.uid, existing.kids, existing.kidChange));
+            return next;
+        });
+        this.emit({ type: "updated", annotation: stored });
+        return structuredClone(stored);
+    }
+    async remove(id, expectedRev) {
+        const me = await this.writer();
+        const removed = await this.transact(id, async (tx) => {
+            const existing = current(id, expectedRev, await readIn(tx, this.noteRef(id)), me.uid);
+            if (existing.kids.length) {
+                throw new ThreadError(`Annotation ${id} has children; use threads.deleteNode`);
+            }
+            if (existing.parent !== null) {
+                throw new ThreadError(`Annotation ${id} is context on context; use threads.deleteNode`);
+            }
+            tx.delete(this.noteRef(id));
+            tx.delete(this.versionsRef(id));
+            return existing;
+        });
+        this.emit({ type: "removed", id }, { scope: removed.scope, document: removed.source });
+    }
+    subscribe(q, onChange) {
+        const listener = {
+            documentId: q.documentId,
+            scope: q.scope,
+            onChange,
+            told: new Map(),
+            removing: new Map(),
+            stopped: false,
+        };
+        this.listeners.add(listener);
+        const stops = [];
+        void this.who().then((me) => {
+            if (listener.stopped)
+                return;
+            const base = [where("scope", "==", q.scope), where("source", "==", q.documentId)];
+            // Public notes, and the caller's own of any audience. The own feed tells about the
+            // caller's notes, so the public feed skips them.
+            const feeds = [
+                {
+                    feed: query(this.notes, ...base, where("audience", "==", "public")),
+                    skipUid: me?.member ? me.uid : null,
+                },
+            ];
+            if (me?.member) {
+                feeds.push({ feed: query(this.notes, ...base, where("uid", "==", me.uid)), skipUid: null });
+            }
+            for (const { feed, skipUid } of feeds) {
+                // The first snapshot is what already exists, not a change: its revs are only noted, so
+                // later snapshots (the server's, when the first came from the cache) tell what differs.
+                // A server snapshot that changes nothing raises no callback, so none is waited for.
+                let first = true;
+                stops.push(onSnapshot(feed, (snap) => {
+                    if (listener.stopped)
+                        return;
+                    if (first) {
+                        first = false;
+                        for (const d of snap.docs) {
+                            const data = d.data();
+                            if (skipUid !== null && data.uid === skipUid)
+                                continue;
+                            if (!listener.told.has(d.id))
+                                listener.told.set(d.id, data.rev);
+                        }
+                        return;
+                    }
+                    for (const change of snap.docChanges()) {
+                        const d = change.doc.data();
+                        if (skipUid !== null && d.uid === skipUid)
+                            continue;
+                        this.onRemote(listener, change.type, change.doc.id, d);
+                    }
+                }, (error) => {
+                    if (!listener.stopped)
+                        this.onListenError(error);
+                }));
+            }
+        }, this.onListenError);
+        return () => {
+            listener.stopped = true;
+            this.listeners.delete(listener);
+            for (const stop of stops)
+                stop();
+        };
+    }
+    /** Who is signed in: `member` when with an account, not an anonymous sign-in. */
+    async who() {
+        await this.auth.authStateReady();
+        const user = this.auth.currentUser;
+        return user ? { uid: user.uid, member: !user.isAnonymous } : null;
+    }
+    /** The signed-in account a write is made as. */
+    async writer() {
+        const me = await this.who();
+        if (!me?.member)
+            throw new Error("Sign in with an account to write notes");
+        return me;
+    }
+    noteRef(id) {
+        return doc(this.notes, checkId(id));
+    }
+    versionsRef(id) {
+        return doc(this.db, VERSIONS, checkId(id));
+    }
+    /** The stored note, or null when it is missing or the caller cannot read it. */
+    async readDoc(id) {
+        if (!ID.test(id))
+            return null;
+        try {
+            const snap = await getDoc(this.noteRef(id));
+            return snap.exists() ? snap.data() : null;
+        }
+        catch (err) {
+            if (isDenied(err))
+                return null;
+            throw err;
+        }
+    }
+    /**
+     * The notes matching `constraints` that the caller can read: the public ones, and their own.
+     * The rules refuse any query that could return a note the caller cannot read, so each query
+     * asks for one of those two kinds.
+     */
+    async readAll(constraints) {
+        const me = await this.who();
+        const queries = [query(this.notes, ...constraints, where("audience", "==", "public"))];
+        if (me?.member)
+            queries.push(query(this.notes, ...constraints, where("uid", "==", me.uid)));
+        const byId = new Map();
+        for (const snap of await Promise.all(queries.map((q) => this.fetch(q, me?.member ?? false)))) {
+            for (const d of snap) {
+                const a = toAnnotation(d.id, d.data);
+                if (a)
+                    byId.set(d.id, a);
+            }
+        }
+        return [...byId.values()].sort((x, y) => x.modified === y.modified ? (x.id < y.id ? -1 : 1) : x.modified < y.modified ? -1 : 1);
+    }
+    /**
+     * Runs a query. A visitor is refused a scope without `anonymousRead` as a whole query, which
+     * reads as finding nothing, as it would under row-level security.
+     */
+    async fetch(q, member) {
+        try {
+            const snap = await getDocs(q);
+            return snap.docs.map((d) => ({ id: d.id, data: d.data() }));
+        }
+        catch (err) {
+            if (!member && isDenied(err))
+                return [];
+            throw err;
+        }
+    }
+    async count(q, member) {
+        try {
+            return (await getCountFromServer(q)).data().count;
+        }
+        catch (err) {
+            if (!member && isDenied(err))
+                return 0;
+            throw err;
+        }
+    }
+    /**
+     * Runs `body` in a Firestore transaction, which Firestore may retry when what it read changed
+     * meanwhile. The rules refusing a write becomes a plain "not allowed".
+     */
+    async transact(id, body) {
+        try {
+            return await runTransaction(this.db, body);
+        }
+        catch (err) {
+            if (isDenied(err))
+                throw new Error(`Not allowed to change annotation ${id}`, { cause: err });
+            throw err;
+        }
+    }
+    /**
+     * Plain updates keep the tree: no note moves to another scope, document or thread, `deleted`
+     * changes only through `deleteNode`, a placeholder is never edited, a note with children keeps
+     * its author, and a child keeps its parent rev and gets no wider than its parent. The rules
+     * check the same, but cannot say which rule a write broke.
+     */
+    async checkTreeKept(tx, next, existing) {
+        if ((next.ext.deleted ?? false) !== existing.deleted) {
+            throw new ThreadError(`Annotation ${next.id} is deleted or restored only by deleteNode`);
+        }
+        if (existing.deleted)
+            throw new ThreadError(`Annotation ${next.id} is deleted`);
+        if (next.ext.scope !== existing.scope || next.target.source !== existing.source) {
+            throw new ThreadError(`Annotation ${next.id} cannot move to another scope or document`);
+        }
+        if (existing.kids.length && (next.creator?.id ?? null) !== existing.creatorId) {
+            throw new ThreadError(`Annotation ${next.id} has replies; its author stays`);
+        }
+        if ((next.ext.threadRoot ?? null) !== existing.threadRoot ||
+            (next.ext.depth ?? 0) !== existing.depth ||
+            (next.ext.parentRev ?? null) !== existing.parentRev) {
+            throw new ThreadError(`Annotation ${next.id} cannot move in its thread`);
+        }
+        checkAudience(next);
+        // An unchanged or narrower audience is fine even if the parent was narrowed meanwhile.
+        if (existing.parent === null || next.ext.audience.kind === existing.audience)
+            return;
+        if (next.ext.audience.kind === "private")
+            return;
+        const parent = await readIn(tx, this.noteRef(existing.parent));
+        // A parent the caller cannot read is private to someone else, and the rules let a child widen
+        // only under a stored public parent.
+        if (typeof parent === "string" ||
+            !isWithinAudience(next.ext.audience, { kind: parent.doc.audience })) {
+            throw new AudienceError(`Annotation ${next.id} cannot be wider than its parent`);
+        }
+    }
+    onRemote(listener, type, id, d) {
+        let removing = listener.removing.get(id);
+        if (removing !== undefined && Date.now() > removing) {
+            // The echo never came (the listener never had the note); stop waiting for it.
+            listener.removing.delete(id);
+            removing = undefined;
+        }
+        if (type === "removed") {
+            listener.removing.delete(id);
+            if (listener.told.get(id) === "removed")
+                return;
+            listener.told.set(id, "removed");
+            this.tell(listener, { type: "removed", id });
+            return;
+        }
+        // A snapshot from before this adapter's own remove of the note.
+        if (removing !== undefined)
+            return;
+        const annotation = toAnnotation(id, d);
+        if (!annotation)
+            return;
+        const last = listener.told.get(id);
+        if (typeof last === "number" && last >= d.rev)
+            return;
+        listener.told.set(id, d.rev);
+        this.tell(listener, {
+            type: type === "added" || last === "removed" ? "created" : "updated",
+            annotation,
+        });
+    }
+    /** Tells this adapter's subscribers about one of its own writes. */
+    emit(event, where) {
+        const document = where?.document ?? event.annotation.target.source;
+        const scope = where?.scope ?? event.annotation.ext.scope;
+        for (const l of this.listeners) {
+            if (l.documentId !== document || l.scope !== scope)
+                continue;
+            if (event.type === "removed") {
+                l.removing.set(event.id, Date.now() + ECHO_WAIT_MS);
+                if (l.told.get(event.id) === "removed")
+                    continue;
+                l.told.set(event.id, "removed");
+            }
+            else {
+                const last = l.told.get(event.annotation.id);
+                // The snapshot echo beat the response: already told.
+                if (typeof last === "number" && last >= event.annotation.ext.rev)
+                    continue;
+                l.told.set(event.annotation.id, event.annotation.ext.rev);
+            }
+            this.tell(l, event);
+        }
+    }
+    tell(listener, event) {
+        // A throwing listener must not fail a write that has already committed.
+        try {
+            listener.onChange(structuredClone(event));
+        }
+        catch (err) {
+            queueMicrotask(() => {
+                throw err;
+            });
+        }
+    }
+}
+/** `a` as stored at `rev`, a copy the caller cannot change. */
+function storedAt(a, rev) {
+    return structuredClone({ ...a, ext: { ...a.ext, rev } });
+}
+/** The document for `a`, which is already at its stored rev. */
+function fieldsOf(a, uid, kids, kidChange) {
+    checkId(a.id);
+    checkAudience(a);
+    for (const [name, value] of [
+        ["ext.scope", a.ext.scope],
+        ["target.source", a.target.source],
+        ["modified", a.modified],
+    ]) {
+        if (typeof value !== "string")
+            throw new TypeError(`Annotation ${a.id}: ${name} must be text`);
+    }
+    const creatorId = a.creator?.id ?? null;
+    if (creatorId !== null && typeof creatorId !== "string") {
+        throw new TypeError(`Annotation ${a.id}: creator.id must be text`);
+    }
+    const json = JSON.stringify(a);
+    if (json.length > MAX_JSON)
+        throw new Error(`Annotation ${a.id} is larger than 64 KB`);
+    return {
+        uid,
+        creatorId,
+        scope: a.ext.scope,
+        source: a.target.source,
+        parent: parentIdOf(a),
+        threadRoot: a.ext.threadRoot ?? null,
+        depth: a.ext.depth ?? 0,
+        parentRev: a.ext.parentRev ?? null,
+        audience: a.ext.audience.kind,
+        modified: a.modified,
+        rev: a.ext.rev,
+        deleted: a.ext.deleted ?? false,
+        kids,
+        kidChange,
+        json,
+    };
+}
+/**
+ * The annotation a document holds, with the fields the rules check taking precedence over the
+ * JSON's copy of them, or null when the JSON is not an annotation.
+ */
+function toAnnotation(id, d) {
+    let a;
+    try {
+        a = JSON.parse(d.json);
+    }
+    catch {
+        return null;
+    }
+    if (!isObject(a) || !isObject(a.target) || !isObject(a.ext))
+        return null;
+    a.id = id;
+    a.modified = d.modified;
+    a.target.source = d.source;
+    const ext = a.ext;
+    ext.scope = d.scope;
+    ext.rev = d.rev;
+    if (!isObject(ext.audience) || ext.audience.kind !== d.audience) {
+        ext.audience = { kind: d.audience };
+    }
+    if ((ext.threadRoot ?? null) !== d.threadRoot) {
+        if (d.threadRoot === null)
+            delete ext.threadRoot;
+        else
+            ext.threadRoot = d.threadRoot;
+    }
+    if ((ext.depth ?? 0) !== d.depth) {
+        if (d.depth === 0)
+            delete ext.depth;
+        else
+            ext.depth = d.depth;
+    }
+    if ((ext.parentRev ?? null) !== d.parentRev) {
+        if (d.parentRev === null)
+            delete ext.parentRev;
+        else
+            ext.parentRev = d.parentRev;
+    }
+    if ((ext.deleted ?? false) !== d.deleted) {
+        if (d.deleted)
+            ext.deleted = true;
+        else
+            delete ext.deleted;
+    }
+    if ((a.creator?.id ?? null) !== d.creatorId) {
+        if (d.creatorId === null)
+            delete a.creator;
+        else
+            a.creator = { id: d.creatorId };
+    }
+    return a;
+}
+/** The note a transaction read, if it exists at `expectedRev`. */
+function current(id, expectedRev, found, uid) {
+    // A note the caller cannot read is missing to them, as under row-level security.
+    if (typeof found === "string")
+        throw new NotFoundError(id);
+    if (found.doc.uid !== uid)
+        throw new Error(`Not allowed to change annotation ${id}`);
+    if (found.doc.rev !== expectedRev)
+        throw new ConflictError(id, expectedRev, found.doc.rev);
+    return found.doc;
+}
+async function readIn(tx, ref) {
+    try {
+        const snap = await tx.get(ref);
+        return snap.exists() ? { doc: snap.data() } : "missing";
+    }
+    catch (err) {
+        if (isDenied(err))
+            return "hidden";
+        throw err;
+    }
+}
+function checkId(id) {
+    if (typeof id !== "string" || !ID.test(id)) {
+        throw new Error(`Annotation id ${JSON.stringify(id)} is not 1 to 128 letters, digits, "_", "~" or "-"`);
+    }
+    return id;
+}
+/** Only private and public notes are stored; other audiences need Acornly Cloud. */
+function checkAudience(a) {
+    const kind = a.ext.audience?.kind;
+    if (kind !== "private" && kind !== "public") {
+        throw new AudienceError(`Annotation ${a.id}: the Firebase adapter stores private and public notes only`);
+    }
+}
+function versionBytes(items) {
+    const encoder = new TextEncoder();
+    let total = 0;
+    for (const [k, v] of Object.entries(items))
+        total += encoder.encode(k + v).length + 2;
+    return total;
+}
+function isDenied(err) {
+    // By its code: Firestore's own errors are not always `instanceof` the exported class.
+    return err?.code === "permission-denied";
+}
+function isObject(x) {
+    return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+function isAnnotationTarget(source) {
+    if (typeof source !== "string")
+        return false;
+    return afterAnnotationPrefix(source) !== undefined;
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,UAAU,EACV,UAAU,EACV,GAAG,EACH,kBAAkB,EAClB,MAAM,EACN,OAAO,EACP,UAAU,EACV,KAAK,EACL,cAAc,EACd,KAAK,GASN,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,aAAa,EACb,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,aAAa,GASd,MAAM,eAAe,CAAC;AAoEvB,2CAA2C;AAC3C,MAAM,KAAK,GAAG,qBAAqB,CAAC;AACpC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,4FAA4F;AAC5F,MAAM,EAAE,GAAG,yBAAyB,CAAC;AAErC,yCAAyC;AACzC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,sFAAsF;AACtF,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B;;;;;;;GAOG;AACH,MAAM,OAAO,eAAe;IACjB,YAAY,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzD,EAAE,CAAY;IACd,IAAI,CAAO;IACX,KAAK,CAAsB;IAC3B,SAAS,GAAG,IAAI,GAAG,EAAY,CAAC;IAChC,aAAa,CAAkC;IAEhE,YAAY,OAA+B;QACzC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,6FAA6F;IACpF,QAAQ,GAAiB;QAChC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClD,qFAAqF;gBACrF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,OAAO;gBACzD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAE,MAAM,CAAC,IAAI,EAA8B,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC/B,gEAAgE;gBAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;qBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC;qBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzC,OAAO,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,iBAAiB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAG,CAAC,CAAC;gBAC3F,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAwB,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACzB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,GAAG,CAAC;oBAAE,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAI,MAAM,CAAC,IAAI,EAA8B,EAAE,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;iBACtB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAe,CAAC,CAAC;QACrD,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACnC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IAEF;;;;OAIG;IACM,OAAO,GAAgB;QAC9B,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;aACvF,CAAC,CAAC;YACH,iFAAiF;YACjF,OAAO,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI;gBACtE,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;gBAClB,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC3B,MAAM,MAAM,GAA2B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACjC,uFAAuF;gBACvF,wCAAwC;gBACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACtC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9E,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACjF,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACV,KAAK,CACH,IAAI,CAAC,KAAK,EACV,GAAG,KAAK,EACR,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAC1B,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CACnC,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;gBACzF,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC,CAAC,CACH,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,4BAA4B,CAAC,CAAC;YAC3F,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBACzC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxD,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAClE,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtD,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,WAAW,CAAC,cAAc,QAAQ,iBAAiB,CAAC,CAAC;gBAChF,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC7D,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAC3D,CAAC;gBACD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;gBACvC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBAClD,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;gBACpF,IAAI,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;gBACjF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;oBACtC,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;oBAC9E,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBACrD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;oBACtF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;oBAChC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBACjC,CAAC;gBACD,6CAA6C;gBAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,aAAa,IAAI,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC3E,CAAC;YACD,2FAA2F;YAC3F,yFAAyF;YACzF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,IAAI,GAAY,MAAM,CAAC;YAC3B,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;gBACtB,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAoB,EAAE;oBAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBAC7E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;oBACrC,CAAC;oBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC,CAAC,CAAC,KAAK,CAAC,GAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvD,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAyB,CAAC;QACtE,CAAC;KACF,CAAC;IAEF;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,EAAe,EAAE,KAAa,EAAE,QAAiB;QACtE,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,IAAI,MAAM,GAAU,SAAS,CAAC;QAC9B,OAAO,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;YAC9C,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO;gBACnB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;gBAC5B,OAAO,CAAC,MAAM,KAAK,UAAU,EAC7B,CAAC;gBACD,MAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC9E,2FAA2F;QAC3F,4EAA4E;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,GAAG,CAAC,OAAO;YAClB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAY;QACrB,MAAM,WAAW,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAa;QACxB,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,8CAA8C,CAAC,CAAC;QAC1F,CAAC;QACD,IACE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;YACnC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;YACxB,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,EAC7B,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACrC,iEAAiE;YACjE,IAAI,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;YACvD,CAAC;YACD,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,CAAa,EAAE,WAAmB;QAC7C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC3C,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,WAAmB;QAC1C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;YACtF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,uCAAuC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,gDAAgD,CAAC,CAAC;YAC1F,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,SAAS,CAAC,CAA2B,EAAE,QAAkC;QACvE,MAAM,QAAQ,GAAa;YACzB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ;YACR,IAAI,EAAE,IAAI,GAAG,EAAE;YACf,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YAC1B,IAAI,QAAQ,CAAC,OAAO;gBAAE,OAAO;YAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAClF,mFAAmF;YACnF,iDAAiD;YACjD,MAAM,KAAK,GAA8C;gBACvD;oBACE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;oBACnE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;iBACpC;aACF,CAAC;YACF,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,CAAC;gBACtC,uFAAuF;gBACvF,wFAAwF;gBACxF,oFAAoF;gBACpF,IAAI,KAAK,GAAG,IAAI,CAAC;gBACjB,KAAK,CAAC,IAAI,CACR,UAAU,CACR,IAAI,EACJ,CAAC,IAAI,EAAE,EAAE;oBACP,IAAI,QAAQ,CAAC,OAAO;wBAAE,OAAO;oBAC7B,IAAI,KAAK,EAAE,CAAC;wBACV,KAAK,GAAG,KAAK,CAAC;wBACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;4BAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAa,CAAC;4BACjC,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;gCAAE,SAAS;4BACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gCAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;wBAClE,CAAC;wBACD,OAAO;oBACT,CAAC;oBACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;wBACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAa,CAAC;wBACvC,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;4BAAE,SAAS;wBACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;oBACR,IAAI,CAAC,QAAQ,CAAC,OAAO;wBAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACnD,CAAC,CACF,CACF,CAAC;YACJ,CAAC;QACH,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC;IACJ,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAED,gDAAgD;IACxC,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,EAAE,EAAE,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,OAAO,CAAC,EAAU;QACxB,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,EAAU;QAC5B,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,OAAO,CAAC,EAAU;QAC9B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,EAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAC,WAA8B;QAClD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,EAAE,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACtF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,KAAK,CAAC,CAAQ,EAAE,MAAe;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAa,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,CAAQ,EAAE,MAAe;QAC3C,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,QAAQ,CAAI,EAAU,EAAE,IAAqC;QACzE,IAAI,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7F,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,EAAe,EAAE,IAAgB,EAAE,QAAiB;QAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CAAC,cAAc,IAAI,CAAC,EAAE,4CAA4C,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,cAAc,IAAI,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,WAAW,CAAC,cAAc,IAAI,CAAC,EAAE,gCAAgC,CAAC,CAAC;QAC/E,CAAC;QACD,IACE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,UAAU;YACrD,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,KAAK;YACxC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,QAAQ,CAAC,SAAS,EACnD,CAAC;YACD,MAAM,IAAI,WAAW,CAAC,cAAc,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC3E,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,uFAAuF;QACvF,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ;YAAE,OAAO;QACrF,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,8FAA8F;QAC9F,qCAAqC;QACrC,IACE,OAAO,MAAM,KAAK,QAAQ;YAC1B,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EACnE,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,cAAc,IAAI,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,QAAkB,EAAE,IAAwB,EAAE,EAAU,EAAE,CAAU;QACnF,IAAI,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACpD,8EAA8E;YAC9E,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,QAAQ,GAAG,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,OAAO;YAChD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,gEAAgE;QAChE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO;QACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YAClB,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACpE,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IAC5D,IAAI,CAAC,KAAkB,EAAE,KAA2C;QAC1E,MAAM,QAAQ,GACZ,KAAK,EAAE,QAAQ,IAAK,KAAoC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAK,KAAoC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QACzF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;gBAAE,SAAS;YAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC7C,qDAAqD;gBACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG;oBAAE,SAAS;gBAC3E,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,QAAkB,EAAE,KAAkB;QACjD,wEAAwE;QACxE,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,cAAc,CAAC,GAAG,EAAE;gBAClB,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,+DAA+D;AAC/D,SAAS,QAAQ,CAAC,CAAa,EAAE,GAAW;IAC1C,OAAO,eAAe,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,CAAa,EAAE,GAAW,EAAE,IAAc,EAAE,SAAwB;IACpF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,aAAa,CAAC,CAAC,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1B,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,IAAI,eAAe,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC;IACxC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,cAAc,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACvF,OAAO;QACL,GAAG;QACH,SAAS;QACT,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM;QACvB,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI;QACpC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI;QAClC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAA2B;QACpD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;QACd,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK;QAC/B,IAAI;QACJ,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,EAAU,EAAE,CAAU;IAC1C,IAAI,CAAa,CAAC;IAClB,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAe,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IACV,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAClB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,UAAU,CAAC;;YAC5C,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;;YAC/B,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,SAAS,CAAC;;YAC1C,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;;YAC7B,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;;YACtC,CAAC,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kEAAkE;AAClE,SAAS,OAAO,CAAC,EAAU,EAAE,WAAmB,EAAE,KAAY,EAAE,GAAW;IACzE,iFAAiF;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,WAAW;QAAE,MAAM,IAAI,aAAa,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAe,EAAE,GAAsB;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACnC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,mDAAmD,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,CAAa;IAClC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CACrB,cAAc,CAAC,CAAC,EAAE,6DAA6D,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA6B;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC5B,sFAAsF;IACtF,OAAQ,GAAiC,EAAE,IAAI,KAAK,mBAAmB,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,qBAAqB,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;AACrD,CAAC"}

package/firestore.indexes.json

@@ -0,0 +1,41 @@
+{
+  "indexes": [
+    {
+      "collectionGroup": "acornly_annotations",
+      "queryScope": "COLLECTION",
+      "fields": [
+        { "fieldPath": "scope", "order": "ASCENDING" },
+        { "fieldPath": "source", "order": "ASCENDING" },
+        { "fieldPath": "audience", "order": "ASCENDING" },
+        { "fieldPath": "modified", "order": "ASCENDING" }
+      ]
+    },
+    {
+      "collectionGroup": "acornly_annotations",
+      "queryScope": "COLLECTION",
+      "fields": [
+        { "fieldPath": "scope", "order": "ASCENDING" },
+        { "fieldPath": "source", "order": "ASCENDING" },
+        { "fieldPath": "uid", "order": "ASCENDING" },
+        { "fieldPath": "modified", "order": "ASCENDING" }
+      ]
+    }
+  ],
+  "fieldOverrides": [
+    {
+      "collectionGroup": "acornly_annotations",
+      "fieldPath": "json",
+      "indexes": []
+    },
+    {
+      "collectionGroup": "acornly_annotations",
+      "fieldPath": "kids",
+      "indexes": []
+    },
+    {
+      "collectionGroup": "acornly_versions",
+      "fieldPath": "items",
+      "indexes": []
+    }
+  ]
+}

package/firestore.rules

@@ -0,0 +1,200 @@
+rules_version = '2';
+
+// Who may read and write Acornly notes in a site's own Firestore (@acornly/adapter-firebase).
+// Deploy them as they are, or merge the `acornly_` matches into the site's own rules. The
+// package's README explains each rule.
+//
+// acornly_annotations/{id}: one note. `json` is the annotation as the client wrote it; the
+// other fields are what these rules check, and the adapter overrides the annotation's copy of them
+// with these when it reads. `kids` lists the ids of the note's direct children (replies, tags,
+// reactions), kept in step with them by the same write, so deletes can tell whether a note still
+// has children, even ones the deleter cannot read. `kidChange` names the child the last change to
+// `kids` added or removed.
+// acornly_versions/{id}: the author's saved earlier versions of note `id`.
+// acornly_scopes/{scope}: the scopes signed-in users may write in, written by the site's
+// server or the console only. `anonymousRead: true` lets visitors who are not signed in read the
+// public notes in that scope.
+service cloud.firestore {
+  match /databases/{database}/documents {
+    function notePath(id) {
+      return /databases/$(database)/documents/acornly_annotations/$(id);
+    }
+
+    function scopePath(scope) {
+      return /databases/$(database)/documents/acornly_scopes/$(scope);
+    }
+
+    // Signed in with an account. Firebase's anonymous sign-ins count as visitors.
+    function member() {
+      return request.auth != null
+        && request.auth.token.firebase.sign_in_provider != 'anonymous';
+    }
+
+    function isMe(uid) {
+      return request.auth != null && uid == request.auth.uid;
+    }
+
+    function canRead(n) {
+      return isMe(n.uid)
+        || (n.audience == 'public'
+          && (member() || get(scopePath(n.scope)).data.get('anonymousRead', false) == true));
+    }
+
+    function canWriteIn(scope) {
+      return scope == 'user:' + request.auth.uid || exists(scopePath(scope));
+    }
+
+    // The fields every stored note has, with their types. Ids are limited to characters that
+    // need no escaping in a target IRI, so a child's `source` is the prefix and its parent's id.
+    function wellFormed(id, n) {
+      return id.matches('[A-Za-z0-9_~-]{1,128}')
+        && n.keys().hasOnly(['uid', 'creatorId', 'scope', 'source', 'parent', 'threadRoot',
+          'depth', 'parentRev', 'audience', 'modified', 'rev', 'deleted', 'kids', 'kidChange',
+          'json'])
+        && n.keys().hasAll(['uid', 'creatorId', 'scope', 'source', 'parent', 'threadRoot',
+          'depth', 'parentRev', 'audience', 'modified', 'rev', 'deleted', 'kids', 'kidChange',
+          'json'])
+        && n.uid is string
+        && (n.creatorId == null || n.creatorId is string)
+        && n.scope is string && n.scope.size() <= 512 && n.scope.matches('(app|web|user):[^/]+')
+        && n.source is string && n.source.size() > 0 && n.source.size() <= 1500
+        && n.audience in ['private', 'public']
+        && n.modified is string
+        && n.modified.matches('[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?(Z|[+-][0-9]{2}:[0-9]{2})')
+        && n.rev is int
+        && n.deleted is bool
+        && n.kids is list
+        && (n.kidChange == null || n.kidChange is string)
+        && n.json is string && n.json.size() <= 65536
+        && n.depth is int
+        && (n.parentRev == null || n.parentRev is int)
+        && ((n.parent == null && n.threadRoot == null && n.depth == 0 && n.parentRev == null
+            && !n.source.lower().matches('(?s)urn:contexthive:annotation:.*'))
+          || (n.parent is string && n.source == 'urn:contexthive:annotation:' + n.parent
+            && n.threadRoot is string && n.depth >= 1));
+    }
+
+    // A new child, checked against its parent as stored: the parent exists, is not deleted and
+    // is readable by the writer, and the child carries its scope, thread, the next depth, a
+    // parent rev the parent has had, and an audience no wider than the parent's. The same write
+    // adds the child to the parent's `kids`.
+    function childFits(id, n) {
+      let parent = notePath(n.parent);
+      return exists(parent)
+        && !get(parent).data.deleted
+        && canRead(get(parent).data)
+        && n.scope == get(parent).data.scope
+        && n.threadRoot == (get(parent).data.threadRoot == null
+          ? n.parent : get(parent).data.threadRoot)
+        && n.depth == get(parent).data.depth + 1
+        && (n.parentRev == null || (n.parentRev >= 1 && n.parentRev <= get(parent).data.rev))
+        && (get(parent).data.audience == 'public' || n.audience == 'private')
+        && getAfter(parent).data.kids == get(parent).data.kids.concat([id])
+        && getAfter(parent).data.kidChange == id;
+    }
+
+    // A change to `kids` alone, made by the same write that creates or removes that child.
+    function kidsFollowChild(id) {
+      let n = request.resource.data;
+      let o = resource.data;
+      let kid = n.kidChange;
+      return n.diff(o).affectedKeys().hasOnly(['kids', 'kidChange'])
+        && kid is string
+        && ((n.kids == o.kids.concat([kid])
+            && !exists(notePath(kid))
+            && existsAfter(notePath(kid))
+            && getAfter(notePath(kid)).data.parent == id)
+          || (kid in o.kids
+            && n.kids == o.kids.removeAll([kid])
+            && exists(notePath(kid))
+            && !existsAfter(notePath(kid))
+            && get(notePath(kid)).data.parent == id));
+    }
+
+    // The author's own edit, in a scope they may still write in: the next rev, nothing that
+    // places the note in its thread changes,
+    // a note with children keeps its author, and a child gets no wider than its parent.
+    function authorEdits(id) {
+      let n = request.resource.data;
+      let o = resource.data;
+      return isMe(o.uid)
+        && !o.deleted
+        && !n.deleted
+        && wellFormed(id, n)
+        && canWriteIn(n.scope)
+        && n.diff(o).unchangedKeys().hasAll(['uid', 'scope', 'source', 'parent', 'threadRoot',
+          'depth', 'parentRev', 'kids', 'kidChange'])
+        && n.rev == o.rev + 1
+        && (o.kids.size() == 0 || n.creatorId == o.creatorId)
+        && (n.parent == null
+          || n.audience == o.audience
+          || n.audience == 'private'
+          || (exists(notePath(n.parent)) && get(notePath(n.parent)).data.audience == 'public'));
+    }
+
+    // The author deletes a note that has children: it stays as a placeholder.
+    function authorLeavesPlaceholder(id) {
+      let n = request.resource.data;
+      let o = resource.data;
+      return isMe(o.uid)
+        && !o.deleted
+        && n.deleted
+        && o.kids.size() > 0
+        && wellFormed(id, n)
+        && n.diff(o).unchangedKeys().hasAll(['uid', 'creatorId', 'scope', 'source', 'parent',
+          'threadRoot', 'depth', 'parentRev', 'audience', 'kids', 'kidChange'])
+        && n.rev == o.rev + 1;
+    }
+
+    // A note that goes is taken out of its parent's `kids` by the same write, or its parent goes
+    // with it.
+    function leavesParent(id, n) {
+      return n.parent == null
+        || !existsAfter(notePath(n.parent))
+        || (getAfter(notePath(n.parent)).data.kidChange == id
+          && getAfter(notePath(n.parent)).data.kids
+            == get(notePath(n.parent)).data.kids.removeAll([id]));
+    }
+
+    match /acornly_annotations/{id} {
+      allow get: if resource == null || canRead(resource.data);
+      allow list: if canRead(resource.data);
+
+      allow create: if member()
+        && wellFormed(id, request.resource.data)
+        && isMe(request.resource.data.uid)
+        && request.resource.data.rev == 1
+        && !request.resource.data.deleted
+        && request.resource.data.kids.size() == 0
+        && request.resource.data.kidChange == null
+        && canWriteIn(request.resource.data.scope)
+        && (request.resource.data.parent == null || childFits(id, request.resource.data));
+
+      allow update: if member()
+        && (kidsFollowChild(id) || authorEdits(id) || authorLeavesPlaceholder(id));
+
+      // The author removes a note without children, or anyone removes a placeholder whose last
+      // child goes in the same write.
+      allow delete: if member()
+        && leavesParent(id, resource.data)
+        && ((isMe(resource.data.uid) && !resource.data.deleted && resource.data.kids.size() == 0)
+          || (resource.data.deleted
+            && (resource.data.kids.size() == 0
+              || (resource.data.kids.size() == 1
+                && !existsAfter(notePath(resource.data.kids[0]))))));
+    }
+
+    match /acornly_versions/{id} {
+      allow get: if resource == null || isMe(resource.data.uid);
+      allow create, update: if member()
+        && request.resource.data.keys().hasOnly(['uid', 'items'])
+        && isMe(request.resource.data.uid)
+        && request.resource.data.items is map
+        && (resource == null || isMe(resource.data.uid))
+        && exists(notePath(id))
+        && isMe(get(notePath(id)).data.uid)
+        && !get(notePath(id)).data.deleted;
+      allow delete: if resource == null || isMe(resource.data.uid);
+    }
+  }
+}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@acornly/adapter-firebase",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Firebase StorageAdapter: notes in a site's own Firestore, with the security rules to run there",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/free-solo/contexthive.git",
+    "directory": "packages/adapter-firebase"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "firestore.rules",
+    "firestore.indexes.json"
+  ],
+  "dependencies": {
+    "@acornly/core": "0.1.0"
+  },
+  "peerDependencies": {
+    "firebase": "^12.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "firebase": "^12.19.0",
+    "vitest": "^3.2.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test:emulator": "pnpm dlx firebase-tools@15.32.1 emulators:exec --only firestore,auth --project demo-acornly 'vitest run --config test/vitest.config.ts'"
+  }
 }