@aigne/afs-did-space 1.12.0-beta.5

package/dist/share-declaration.mjs

@@ -0,0 +1,221 @@
+import { AFSAlreadyExistsError, AFSError, AFSForbiddenError, AFSValidationError } from "@aigne/afs";
+import { load } from "js-yaml";
+
+//#region src/share-declaration.ts
+/**
+* Phase 0.2 — ShareDeclaration: YAML schema parsing + path helpers.
+*
+* Exported functions used by Phase 0.3 (ShareResolver) and Phase 0.4 (writeHandler hook):
+*   - parseShareDeclaration
+*   - isShareDeclarationPath
+*   - isShareReservedPath
+*   - deriveSourcePath
+*   - mapShareErrorToAFSError
+*/
+const KNOWN_FIELDS = new Set([
+	"slug",
+	"kind",
+	"status",
+	"expires_at",
+	"password",
+	"visibility",
+	"description",
+	"domain"
+]);
+const SLUG_REGEX = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
+const MAX_CONTENT_BYTES = 4096;
+const MAX_DESCRIPTION_LENGTH = 200;
+/**
+* Parse and validate a `.share` file's content.
+*
+* Validation order (strict, per spec):
+*  1. Size check (> 4096 bytes) — before YAML parse
+*  2. Empty content (0 bytes) → { ok: true, data: {} }
+*  3. UTF-8 decode (fatal mode)
+*  4. YAML parse with maxAliasCount: 0
+*  5. Unknown field detection
+*  6. slug format
+*  7. kind enum
+*  8. status enum
+*  9. description length
+* 10. expires_at format
+* 11. password structure
+*/
+function parseShareDeclaration(content) {
+	if (content.byteLength > MAX_CONTENT_BYTES) return {
+		ok: false,
+		code: "share-content-too-large",
+		message: `Content size ${content.byteLength} bytes exceeds ${MAX_CONTENT_BYTES} byte limit`,
+		detail: {
+			sizeBytes: content.byteLength,
+			limit: MAX_CONTENT_BYTES
+		}
+	};
+	if (content.byteLength === 0) return {
+		ok: true,
+		data: {}
+	};
+	let text;
+	try {
+		text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+	} catch {
+		return {
+			ok: false,
+			code: "share-yaml-parse-error",
+			message: "Content is not valid UTF-8"
+		};
+	}
+	let parsed;
+	try {
+		parsed = load(text);
+	} catch (err) {
+		return {
+			ok: false,
+			code: "share-yaml-parse-error",
+			message: err instanceof Error ? err.message : String(err),
+			detail: err
+		};
+	}
+	if (parsed == null) return {
+		ok: true,
+		data: {}
+	};
+	if (typeof parsed !== "object" || Array.isArray(parsed)) return {
+		ok: false,
+		code: "share-yaml-parse-error",
+		message: "Expected a YAML mapping (object), got a different type"
+	};
+	const obj = parsed;
+	for (const key of Object.keys(obj)) if (!KNOWN_FIELDS.has(key)) return {
+		ok: false,
+		code: "share-field-unknown",
+		message: `Unknown field: ${key}`,
+		detail: { field: key }
+	};
+	if (obj.slug !== void 0) {
+		if (typeof obj.slug !== "string" || !SLUG_REGEX.test(obj.slug)) return {
+			ok: false,
+			code: "share-slug-invalid",
+			message: `slug must match /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/, got: ${JSON.stringify(obj.slug)}`,
+			detail: { slug: obj.slug }
+		};
+	}
+	if (obj.kind !== void 0) {
+		if (obj.kind !== "raw" && obj.kind !== "web") return {
+			ok: false,
+			code: "share-kind-invalid",
+			message: `kind must be "raw" or "web", got: ${JSON.stringify(obj.kind)}`,
+			detail: { kind: obj.kind }
+		};
+	}
+	if (obj.status !== void 0) {
+		if (obj.status !== "active" && obj.status !== "revoked") return {
+			ok: false,
+			code: "share-status-invalid",
+			message: `status must be "active" or "revoked", got: ${JSON.stringify(obj.status)}`,
+			detail: { status: obj.status }
+		};
+	}
+	if (obj.description !== void 0) {
+		if (typeof obj.description !== "string" || obj.description.length > MAX_DESCRIPTION_LENGTH) return {
+			ok: false,
+			code: "share-field-invalid",
+			message: `description must be a string with at most ${MAX_DESCRIPTION_LENGTH} characters`,
+			detail: { field: "description" }
+		};
+	}
+	if (obj.expires_at !== void 0) {
+		if (typeof obj.expires_at !== "string" || !isValidExpiresAt(obj.expires_at)) return {
+			ok: false,
+			code: "share-field-invalid",
+			message: `expires_at must be a valid ISO 8601 datetime or Unix milliseconds string`,
+			detail: { field: "expires_at" }
+		};
+	}
+	if (obj.password !== void 0) {
+		const pwd = obj.password;
+		if (typeof pwd !== "object" || pwd === null || Array.isArray(pwd) || pwd.algorithm !== "argon2id" || typeof pwd.hash !== "string") return {
+			ok: false,
+			code: "share-field-invalid",
+			message: "password must be {algorithm: \"argon2id\", hash: string}",
+			detail: { field: "password" }
+		};
+	}
+	return {
+		ok: true,
+		data: obj
+	};
+}
+function isValidExpiresAt(value) {
+	if (/^\d+$/.test(value)) return true;
+	const d = new Date(value);
+	return !Number.isNaN(d.getTime());
+}
+/**
+* Returns true if `path` is a `.share` declaration file (in-tree or sidecar).
+*
+* Examples:
+*   `.share`          → true  (root in-tree)
+*   `/.share`         → true  (root in-tree with leading slash)
+*   `docs/.share`     → true  (subdirectory in-tree)
+*   `file.pdf.share`  → true  (sidecar)
+*   `.shares/foo`     → false (reserved virtual view)
+*   `README.md`       → false
+*/
+function isShareDeclarationPath(path) {
+	return (path.startsWith("/") ? path.slice(1) : path).endsWith(".share");
+}
+/**
+* Derives the source path from a declaration path.
+*
+* Examples:
+*   `.share`          → `""`        (root in-tree → source is root directory)
+*   `docs/.share`     → `"docs"`
+*   `file.pdf.share`  → `"file.pdf"`
+*/
+function deriveSourcePath(declPath) {
+	const p = declPath.startsWith("/") ? declPath.slice(1) : declPath;
+	if (p.endsWith("/.share")) return p.slice(0, -7);
+	return p.slice(0, -6);
+}
+/**
+* Returns true if `path` is a reserved share virtual path (read-only view, not writable).
+*
+* Reserved paths:
+*   `.shares`                      → the root virtual share listing
+*   `.shares/<anything>`           → entries under the root listing
+*   `instances/<iid>/.shares`      → per-instance listing
+*   `instances/<iid>/.shares/<…>`  → per-instance listing entries
+*/
+function isShareReservedPath(path) {
+	const norm = path.replace(/^\/+/, "");
+	if (norm === ".shares" || norm.startsWith(".shares/")) return true;
+	if (/^instances\/[^/]+\/\.shares(\/|$)/.test(norm)) return true;
+	return false;
+}
+/**
+* Maps a ShareResolver / parser error code to the appropriate AFS error type
+* so that writeHandler can throw with the correct HTTP status code.
+*/
+function mapShareErrorToAFSError(code, message, path) {
+	switch (code) {
+		case "share-yaml-parse-error":
+		case "share-content-too-large":
+		case "share-field-unknown":
+		case "share-field-invalid":
+		case "share-slug-invalid":
+		case "share-kind-invalid":
+		case "share-status-invalid":
+		case "share-web-no-decl":
+		case "share-sidecar-target-missing":
+		case "share-nested": return new AFSValidationError(`[${path}] ${code}: ${message}`);
+		case "share-path-forbidden":
+		case "share-path-reserved": return new AFSForbiddenError(path, code);
+		case "share-slug-conflict": return new AFSAlreadyExistsError(path, message);
+		default: return new AFSError(`${code}: ${message}`, code);
+	}
+}
+
+//#endregion
+export { deriveSourcePath, isShareDeclarationPath, isShareReservedPath, mapShareErrorToAFSError, parseShareDeclaration };
+//# sourceMappingURL=share-declaration.mjs.map

package/dist/share-declaration.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-declaration.mjs","names":["yamlParse"],"sources":["../src/share-declaration.ts"],"sourcesContent":["/**\n * Phase 0.2 — ShareDeclaration: YAML schema parsing + path helpers.\n *\n * Exported functions used by Phase 0.3 (ShareResolver) and Phase 0.4 (writeHandler hook):\n *   - parseShareDeclaration\n *   - isShareDeclarationPath\n *   - isShareReservedPath\n *   - deriveSourcePath\n *   - mapShareErrorToAFSError\n */\n\nimport { AFSAlreadyExistsError, AFSError, AFSForbiddenError, AFSValidationError } from \"@aigne/afs\";\nimport { load as yamlParse } from \"js-yaml\";\n\n// ─── Types ────────────────────────────────────────────────────────────────────\n\n/** All fields are optional; an empty file is equivalent to `{}`. */\nexport interface ShareDeclaration {\n  slug?: string;\n  kind?: \"raw\" | \"web\";\n  status?: \"active\" | \"revoked\";\n  expires_at?: string; // ISO 8601 or Unix ms string\n  password?: { algorithm: \"argon2id\"; hash: string };\n  visibility?: \"public\" | \"unlisted\";\n  description?: string; // max 200 characters\n  domain?: string; // Phase 2 only\n}\n\ntype ParseOk = { ok: true; data: ShareDeclaration };\ntype ParseFail = { ok: false; code: string; message: string; detail?: unknown };\nexport type ParseResult = ParseOk | ParseFail;\n\n// ─── Constants ────────────────────────────────────────────────────────────────\n\nconst KNOWN_FIELDS = new Set([\n  \"slug\",\n  \"kind\",\n  \"status\",\n  \"expires_at\",\n  \"password\",\n  \"visibility\",\n  \"description\",\n  \"domain\",\n]);\n\nconst SLUG_REGEX = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;\n\nconst MAX_CONTENT_BYTES = 4096;\nconst MAX_DESCRIPTION_LENGTH = 200;\n\n// ─── Parser ───────────────────────────────────────────────────────────────────\n\n/**\n * Parse and validate a `.share` file's content.\n *\n * Validation order (strict, per spec):\n *  1. Size check (> 4096 bytes) — before YAML parse\n *  2. Empty content (0 bytes) → { ok: true, data: {} }\n *  3. UTF-8 decode (fatal mode)\n *  4. YAML parse with maxAliasCount: 0\n *  5. Unknown field detection\n *  6. slug format\n *  7. kind enum\n *  8. status enum\n *  9. description length\n * 10. expires_at format\n * 11. password structure\n */\nexport function parseShareDeclaration(content: Uint8Array): ParseResult {\n  // Step 1: size check — MUST happen before YAML parse\n  if (content.byteLength > MAX_CONTENT_BYTES) {\n    return {\n      ok: false,\n      code: \"share-content-too-large\",\n      message: `Content size ${content.byteLength} bytes exceeds ${MAX_CONTENT_BYTES} byte limit`,\n      detail: { sizeBytes: content.byteLength, limit: MAX_CONTENT_BYTES },\n    };\n  }\n\n  // Step 2: empty content\n  if (content.byteLength === 0) {\n    return { ok: true, data: {} };\n  }\n\n  // Step 3: UTF-8 decode (fatal — reject non-UTF-8 bytes)\n  let text: string;\n  try {\n    text = new TextDecoder(\"utf-8\", { fatal: true }).decode(content);\n  } catch {\n    return {\n      ok: false,\n      code: \"share-yaml-parse-error\",\n      message: \"Content is not valid UTF-8\",\n    };\n  }\n\n  // Step 4: YAML parse (content size already capped at 4096 bytes above)\n  let parsed: unknown;\n  try {\n    parsed = yamlParse(text);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    return {\n      ok: false,\n      code: \"share-yaml-parse-error\",\n      message: msg,\n      detail: err,\n    };\n  }\n\n  // null / undefined YAML (empty doc, comment-only, \"---\\n\") → empty declaration\n  if (parsed == null) {\n    return { ok: true, data: {} };\n  }\n\n  // Must be a plain object\n  if (typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return {\n      ok: false,\n      code: \"share-yaml-parse-error\",\n      message: \"Expected a YAML mapping (object), got a different type\",\n    };\n  }\n\n  const obj = parsed as Record<string, unknown>;\n\n  // Step 5: unknown fields\n  for (const key of Object.keys(obj)) {\n    if (!KNOWN_FIELDS.has(key)) {\n      return {\n        ok: false,\n        code: \"share-field-unknown\",\n        message: `Unknown field: ${key}`,\n        detail: { field: key },\n      };\n    }\n  }\n\n  // Step 6: slug format\n  if (obj.slug !== undefined) {\n    if (typeof obj.slug !== \"string\" || !SLUG_REGEX.test(obj.slug)) {\n      return {\n        ok: false,\n        code: \"share-slug-invalid\",\n        message: `slug must match /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/, got: ${JSON.stringify(obj.slug)}`,\n        detail: { slug: obj.slug },\n      };\n    }\n  }\n\n  // Step 7: kind enum\n  if (obj.kind !== undefined) {\n    if (obj.kind !== \"raw\" && obj.kind !== \"web\") {\n      return {\n        ok: false,\n        code: \"share-kind-invalid\",\n        message: `kind must be \"raw\" or \"web\", got: ${JSON.stringify(obj.kind)}`,\n        detail: { kind: obj.kind },\n      };\n    }\n  }\n\n  // Step 8: status enum\n  if (obj.status !== undefined) {\n    if (obj.status !== \"active\" && obj.status !== \"revoked\") {\n      return {\n        ok: false,\n        code: \"share-status-invalid\",\n        message: `status must be \"active\" or \"revoked\", got: ${JSON.stringify(obj.status)}`,\n        detail: { status: obj.status },\n      };\n    }\n  }\n\n  // Step 9: description length\n  if (obj.description !== undefined) {\n    if (typeof obj.description !== \"string\" || obj.description.length > MAX_DESCRIPTION_LENGTH) {\n      return {\n        ok: false,\n        code: \"share-field-invalid\",\n        message: `description must be a string with at most ${MAX_DESCRIPTION_LENGTH} characters`,\n        detail: { field: \"description\" },\n      };\n    }\n  }\n\n  // Step 10: expires_at format\n  if (obj.expires_at !== undefined) {\n    if (typeof obj.expires_at !== \"string\" || !isValidExpiresAt(obj.expires_at)) {\n      return {\n        ok: false,\n        code: \"share-field-invalid\",\n        message: `expires_at must be a valid ISO 8601 datetime or Unix milliseconds string`,\n        detail: { field: \"expires_at\" },\n      };\n    }\n  }\n\n  // Step 11: password structure\n  if (obj.password !== undefined) {\n    const pwd = obj.password as Record<string, unknown>;\n    if (\n      typeof pwd !== \"object\" ||\n      pwd === null ||\n      Array.isArray(pwd) ||\n      pwd.algorithm !== \"argon2id\" ||\n      typeof pwd.hash !== \"string\"\n    ) {\n      return {\n        ok: false,\n        code: \"share-field-invalid\",\n        message: 'password must be {algorithm: \"argon2id\", hash: string}',\n        detail: { field: \"password\" },\n      };\n    }\n  }\n\n  return { ok: true, data: obj as ShareDeclaration };\n}\n\nfunction isValidExpiresAt(value: string): boolean {\n  // Accept Unix milliseconds (all-digit string)\n  if (/^\\d+$/.test(value)) return true;\n  // Accept ISO 8601 (anything Date can parse)\n  const d = new Date(value);\n  return !Number.isNaN(d.getTime());\n}\n\n// ─── Path helpers ─────────────────────────────────────────────────────────────\n\n/**\n * Returns true if `path` is a `.share` declaration file (in-tree or sidecar).\n *\n * Examples:\n *   `.share`          → true  (root in-tree)\n *   `/.share`         → true  (root in-tree with leading slash)\n *   `docs/.share`     → true  (subdirectory in-tree)\n *   `file.pdf.share`  → true  (sidecar)\n *   `.shares/foo`     → false (reserved virtual view)\n *   `README.md`       → false\n */\nexport function isShareDeclarationPath(path: string): boolean {\n  const p = path.startsWith(\"/\") ? path.slice(1) : path;\n  // All three cases (.share, dir/.share, file.pdf.share) end with \".share\"\n  // Note: \".shares\" ends with \".shares\", not \".share\", so it correctly returns false\n  return p.endsWith(\".share\");\n}\n\n/**\n * Derives the source path from a declaration path.\n *\n * Examples:\n *   `.share`          → `\"\"`        (root in-tree → source is root directory)\n *   `docs/.share`     → `\"docs\"`\n *   `file.pdf.share`  → `\"file.pdf\"`\n */\nexport function deriveSourcePath(declPath: string): string {\n  const p = declPath.startsWith(\"/\") ? declPath.slice(1) : declPath;\n  if (p.endsWith(\"/.share\")) return p.slice(0, -\"/.share\".length);\n  // Root in-tree (\".share\") → slice(0, -6) === \"\" ✓; sidecar (\"file.pdf.share\") → \"file.pdf\" ✓\n  return p.slice(0, -\".share\".length);\n}\n\n/**\n * Returns true if `path` is a reserved share virtual path (read-only view, not writable).\n *\n * Reserved paths:\n *   `.shares`                      → the root virtual share listing\n *   `.shares/<anything>`           → entries under the root listing\n *   `instances/<iid>/.shares`      → per-instance listing\n *   `instances/<iid>/.shares/<…>`  → per-instance listing entries\n */\nexport function isShareReservedPath(path: string): boolean {\n  const norm = path.replace(/^\\/+/, \"\");\n  if (norm === \".shares\" || norm.startsWith(\".shares/\")) return true;\n  if (/^instances\\/[^/]+\\/\\.shares(\\/|$)/.test(norm)) return true;\n  return false;\n}\n\n// ─── Error mapper ─────────────────────────────────────────────────────────────\n\n/**\n * Maps a ShareResolver / parser error code to the appropriate AFS error type\n * so that writeHandler can throw with the correct HTTP status code.\n */\nexport function mapShareErrorToAFSError(\n  code: string,\n  message: string,\n  path: string,\n): AFSValidationError | AFSForbiddenError | AFSAlreadyExistsError | AFSError {\n  switch (code) {\n    // 400 Bad Request — validation\n    case \"share-yaml-parse-error\":\n    case \"share-content-too-large\":\n    case \"share-field-unknown\":\n    case \"share-field-invalid\":\n    case \"share-slug-invalid\":\n    case \"share-kind-invalid\":\n    case \"share-status-invalid\":\n    case \"share-web-no-decl\":\n    case \"share-sidecar-target-missing\":\n    case \"share-nested\":\n      return new AFSValidationError(`[${path}] ${code}: ${message}`);\n    // 403 Forbidden\n    case \"share-path-forbidden\":\n    case \"share-path-reserved\":\n      return new AFSForbiddenError(path, code);\n    // 409 Conflict — slug already used by a different decl_path\n    case \"share-slug-conflict\":\n      return new AFSAlreadyExistsError(path, message);\n    // 500 fallback\n    default:\n      return new AFSError(`${code}: ${message}`, code);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAkCA,MAAM,eAAe,IAAI,IAAI;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,MAAM,aAAa;AAEnB,MAAM,oBAAoB;AAC1B,MAAM,yBAAyB;;;;;;;;;;;;;;;;;AAoB/B,SAAgB,sBAAsB,SAAkC;AAEtE,KAAI,QAAQ,aAAa,kBACvB,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS,gBAAgB,QAAQ,WAAW,iBAAiB,kBAAkB;EAC/E,QAAQ;GAAE,WAAW,QAAQ;GAAY,OAAO;GAAmB;EACpE;AAIH,KAAI,QAAQ,eAAe,EACzB,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE;EAAE;CAI/B,IAAI;AACJ,KAAI;AACF,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,QAAQ;SAC1D;AACN,SAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS;GACV;;CAIH,IAAI;AACJ,KAAI;AACF,WAASA,KAAU,KAAK;UACjB,KAAK;AAEZ,SAAO;GACL,IAAI;GACJ,MAAM;GACN,SAJU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;GAK1D,QAAQ;GACT;;AAIH,KAAI,UAAU,KACZ,QAAO;EAAE,IAAI;EAAM,MAAM,EAAE;EAAE;AAI/B,KAAI,OAAO,WAAW,YAAY,MAAM,QAAQ,OAAO,CACrD,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS;EACV;CAGH,MAAM,MAAM;AAGZ,MAAK,MAAM,OAAO,OAAO,KAAK,IAAI,CAChC,KAAI,CAAC,aAAa,IAAI,IAAI,CACxB,QAAO;EACL,IAAI;EACJ,MAAM;EACN,SAAS,kBAAkB;EAC3B,QAAQ,EAAE,OAAO,KAAK;EACvB;AAKL,KAAI,IAAI,SAAS,QACf;MAAI,OAAO,IAAI,SAAS,YAAY,CAAC,WAAW,KAAK,IAAI,KAAK,CAC5D,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,6DAA6D,KAAK,UAAU,IAAI,KAAK;GAC9F,QAAQ,EAAE,MAAM,IAAI,MAAM;GAC3B;;AAKL,KAAI,IAAI,SAAS,QACf;MAAI,IAAI,SAAS,SAAS,IAAI,SAAS,MACrC,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,qCAAqC,KAAK,UAAU,IAAI,KAAK;GACtE,QAAQ,EAAE,MAAM,IAAI,MAAM;GAC3B;;AAKL,KAAI,IAAI,WAAW,QACjB;MAAI,IAAI,WAAW,YAAY,IAAI,WAAW,UAC5C,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,8CAA8C,KAAK,UAAU,IAAI,OAAO;GACjF,QAAQ,EAAE,QAAQ,IAAI,QAAQ;GAC/B;;AAKL,KAAI,IAAI,gBAAgB,QACtB;MAAI,OAAO,IAAI,gBAAgB,YAAY,IAAI,YAAY,SAAS,uBAClE,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS,6CAA6C,uBAAuB;GAC7E,QAAQ,EAAE,OAAO,eAAe;GACjC;;AAKL,KAAI,IAAI,eAAe,QACrB;MAAI,OAAO,IAAI,eAAe,YAAY,CAAC,iBAAiB,IAAI,WAAW,CACzE,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS;GACT,QAAQ,EAAE,OAAO,cAAc;GAChC;;AAKL,KAAI,IAAI,aAAa,QAAW;EAC9B,MAAM,MAAM,IAAI;AAChB,MACE,OAAO,QAAQ,YACf,QAAQ,QACR,MAAM,QAAQ,IAAI,IAClB,IAAI,cAAc,cAClB,OAAO,IAAI,SAAS,SAEpB,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS;GACT,QAAQ,EAAE,OAAO,YAAY;GAC9B;;AAIL,QAAO;EAAE,IAAI;EAAM,MAAM;EAAyB;;AAGpD,SAAS,iBAAiB,OAAwB;AAEhD,KAAI,QAAQ,KAAK,MAAM,CAAE,QAAO;CAEhC,MAAM,IAAI,IAAI,KAAK,MAAM;AACzB,QAAO,CAAC,OAAO,MAAM,EAAE,SAAS,CAAC;;;;;;;;;;;;;AAgBnC,SAAgB,uBAAuB,MAAuB;AAI5D,SAHU,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,EAAE,GAAG,MAGxC,SAAS,SAAS;;;;;;;;;;AAW7B,SAAgB,iBAAiB,UAA0B;CACzD,MAAM,IAAI,SAAS,WAAW,IAAI,GAAG,SAAS,MAAM,EAAE,GAAG;AACzD,KAAI,EAAE,SAAS,UAAU,CAAE,QAAO,EAAE,MAAM,GAAG,GAAkB;AAE/D,QAAO,EAAE,MAAM,GAAG,GAAiB;;;;;;;;;;;AAYrC,SAAgB,oBAAoB,MAAuB;CACzD,MAAM,OAAO,KAAK,QAAQ,QAAQ,GAAG;AACrC,KAAI,SAAS,aAAa,KAAK,WAAW,WAAW,CAAE,QAAO;AAC9D,KAAI,oCAAoC,KAAK,KAAK,CAAE,QAAO;AAC3D,QAAO;;;;;;AAST,SAAgB,wBACd,MACA,SACA,MAC2E;AAC3E,SAAQ,MAAR;EAEE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,eACH,QAAO,IAAI,mBAAmB,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU;EAEhE,KAAK;EACL,KAAK,sBACH,QAAO,IAAI,kBAAkB,MAAM,KAAK;EAE1C,KAAK,sBACH,QAAO,IAAI,sBAAsB,MAAM,QAAQ;EAEjD,QACE,QAAO,IAAI,SAAS,GAAG,KAAK,IAAI,WAAW,KAAK"}

package/dist/share-hook.cjs

@@ -0,0 +1,63 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+const require_share_declaration = require('./share-declaration.cjs');
+let _aigne_afs = require("@aigne/afs");
+
+//#region src/share-hook.ts
+/**
+* Phase 0.4 — Share write/delete hooks for all DID Space write paths.
+*
+* Provides applyShareWriteHook and applyShareDeleteHook, shared utilities
+* called from all three write paths:
+*   - CloudflareDIDSpace.internalWrite (REST API)
+*   - DIDSpaceProvider.internalWrite (SyncEngine)
+*   - DIDSpaceProvider.writeHandler (AFS protocol)
+*
+* Separated from share-declaration.ts to avoid circular imports:
+*   share-hook.ts → share-resolve.ts + share-declaration.ts
+*   share-resolve.ts → share-declaration.ts
+*   share-declaration.ts → (no share deps)
+*/
+/**
+* applyShareWriteHook — called in any DID Space write path for .share files.
+*
+* phase="pre-io": validates BEFORE R2 PUT (dryRun=true).
+*   Validation failure → throws AFS error; R2/D1 not written.
+*
+* phase="post-io": reconciles AFTER R2 + tree_entries written (dryRun=false).
+*   Failure → throws AFSError (eventual consistency; R2 already written).
+*/
+async function applyShareWriteHook(params) {
+	if (!params.resolver || !require_share_declaration.isShareDeclarationPath(params.afsPath)) return;
+	const { afsPath, treePath, bytes, cid, ownerDid, resolver, phase } = params;
+	if (phase === "pre-io") {
+		const validation = await resolver.reconcileFromDecl({
+			declPath: treePath,
+			declContent: bytes,
+			declCid: cid,
+			ownerDid,
+			dryRun: true
+		});
+		if (!validation.ok) throw require_share_declaration.mapShareErrorToAFSError(validation.code, validation.message, afsPath);
+	} else {
+		const result = await resolver.reconcileFromDecl({
+			declPath: treePath,
+			declContent: bytes,
+			declCid: cid,
+			ownerDid
+		});
+		if (!result.ok) throw new _aigne_afs.AFSError(`share-index-failed: ${result.code} — ${result.message}`, result.code);
+	}
+}
+/**
+* applyShareDeleteHook — called in any DID Space delete path for .share files.
+*
+* Should be called AFTER tree_entries is deleted, to clean up shares index.
+*/
+async function applyShareDeleteHook(params) {
+	if (!params.resolver || !require_share_declaration.isShareDeclarationPath(params.afsPath)) return;
+	await params.resolver.reconcileDelete(params.ownerDid, params.treePath);
+}
+
+//#endregion
+exports.applyShareDeleteHook = applyShareDeleteHook;
+exports.applyShareWriteHook = applyShareWriteHook;

package/dist/share-hook.mjs

@@ -0,0 +1,62 @@
+import { isShareDeclarationPath, mapShareErrorToAFSError } from "./share-declaration.mjs";
+import { AFSError } from "@aigne/afs";
+
+//#region src/share-hook.ts
+/**
+* Phase 0.4 — Share write/delete hooks for all DID Space write paths.
+*
+* Provides applyShareWriteHook and applyShareDeleteHook, shared utilities
+* called from all three write paths:
+*   - CloudflareDIDSpace.internalWrite (REST API)
+*   - DIDSpaceProvider.internalWrite (SyncEngine)
+*   - DIDSpaceProvider.writeHandler (AFS protocol)
+*
+* Separated from share-declaration.ts to avoid circular imports:
+*   share-hook.ts → share-resolve.ts + share-declaration.ts
+*   share-resolve.ts → share-declaration.ts
+*   share-declaration.ts → (no share deps)
+*/
+/**
+* applyShareWriteHook — called in any DID Space write path for .share files.
+*
+* phase="pre-io": validates BEFORE R2 PUT (dryRun=true).
+*   Validation failure → throws AFS error; R2/D1 not written.
+*
+* phase="post-io": reconciles AFTER R2 + tree_entries written (dryRun=false).
+*   Failure → throws AFSError (eventual consistency; R2 already written).
+*/
+async function applyShareWriteHook(params) {
+	if (!params.resolver || !isShareDeclarationPath(params.afsPath)) return;
+	const { afsPath, treePath, bytes, cid, ownerDid, resolver, phase } = params;
+	if (phase === "pre-io") {
+		const validation = await resolver.reconcileFromDecl({
+			declPath: treePath,
+			declContent: bytes,
+			declCid: cid,
+			ownerDid,
+			dryRun: true
+		});
+		if (!validation.ok) throw mapShareErrorToAFSError(validation.code, validation.message, afsPath);
+	} else {
+		const result = await resolver.reconcileFromDecl({
+			declPath: treePath,
+			declContent: bytes,
+			declCid: cid,
+			ownerDid
+		});
+		if (!result.ok) throw new AFSError(`share-index-failed: ${result.code} — ${result.message}`, result.code);
+	}
+}
+/**
+* applyShareDeleteHook — called in any DID Space delete path for .share files.
+*
+* Should be called AFTER tree_entries is deleted, to clean up shares index.
+*/
+async function applyShareDeleteHook(params) {
+	if (!params.resolver || !isShareDeclarationPath(params.afsPath)) return;
+	await params.resolver.reconcileDelete(params.ownerDid, params.treePath);
+}
+
+//#endregion
+export { applyShareDeleteHook, applyShareWriteHook };
+//# sourceMappingURL=share-hook.mjs.map

package/dist/share-hook.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-hook.mjs","names":[],"sources":["../src/share-hook.ts"],"sourcesContent":["/**\n * Phase 0.4 — Share write/delete hooks for all DID Space write paths.\n *\n * Provides applyShareWriteHook and applyShareDeleteHook, shared utilities\n * called from all three write paths:\n *   - CloudflareDIDSpace.internalWrite (REST API)\n *   - DIDSpaceProvider.internalWrite (SyncEngine)\n *   - DIDSpaceProvider.writeHandler (AFS protocol)\n *\n * Separated from share-declaration.ts to avoid circular imports:\n *   share-hook.ts → share-resolve.ts + share-declaration.ts\n *   share-resolve.ts → share-declaration.ts\n *   share-declaration.ts → (no share deps)\n */\n\nimport { AFSError } from \"@aigne/afs\";\nimport { isShareDeclarationPath, mapShareErrorToAFSError } from \"./share-declaration.js\";\nimport type { ShareResolver } from \"./share-resolve.js\";\n\n/**\n * applyShareWriteHook — called in any DID Space write path for .share files.\n *\n * phase=\"pre-io\": validates BEFORE R2 PUT (dryRun=true).\n *   Validation failure → throws AFS error; R2/D1 not written.\n *\n * phase=\"post-io\": reconciles AFTER R2 + tree_entries written (dryRun=false).\n *   Failure → throws AFSError (eventual consistency; R2 already written).\n */\nexport async function applyShareWriteHook(params: {\n  afsPath: string;\n  treePath: string;\n  bytes: Uint8Array;\n  cid: string;\n  ownerDid: string;\n  resolver: ShareResolver | undefined;\n  phase: \"pre-io\" | \"post-io\";\n}): Promise<void> {\n  if (!params.resolver || !isShareDeclarationPath(params.afsPath)) return;\n\n  const { afsPath, treePath, bytes, cid, ownerDid, resolver, phase } = params;\n\n  if (phase === \"pre-io\") {\n    const validation = await resolver.reconcileFromDecl({\n      declPath: treePath,\n      declContent: bytes,\n      declCid: cid,\n      ownerDid,\n      dryRun: true,\n    });\n    if (!validation.ok) {\n      throw mapShareErrorToAFSError(validation.code, validation.message, afsPath);\n    }\n  } else {\n    // post-io: R2 already written — best-effort D1 update\n    const result = await resolver.reconcileFromDecl({\n      declPath: treePath,\n      declContent: bytes,\n      declCid: cid,\n      ownerDid,\n    });\n    if (!result.ok) {\n      throw new AFSError(`share-index-failed: ${result.code} — ${result.message}`, result.code);\n    }\n  }\n}\n\n/**\n * applyShareDeleteHook — called in any DID Space delete path for .share files.\n *\n * Should be called AFTER tree_entries is deleted, to clean up shares index.\n */\nexport async function applyShareDeleteHook(params: {\n  afsPath: string;\n  treePath: string;\n  ownerDid: string;\n  resolver: ShareResolver | undefined;\n}): Promise<void> {\n  if (!params.resolver || !isShareDeclarationPath(params.afsPath)) return;\n  await params.resolver.reconcileDelete(params.ownerDid, params.treePath);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,oBAAoB,QAQxB;AAChB,KAAI,CAAC,OAAO,YAAY,CAAC,uBAAuB,OAAO,QAAQ,CAAE;CAEjE,MAAM,EAAE,SAAS,UAAU,OAAO,KAAK,UAAU,UAAU,UAAU;AAErE,KAAI,UAAU,UAAU;EACtB,MAAM,aAAa,MAAM,SAAS,kBAAkB;GAClD,UAAU;GACV,aAAa;GACb,SAAS;GACT;GACA,QAAQ;GACT,CAAC;AACF,MAAI,CAAC,WAAW,GACd,OAAM,wBAAwB,WAAW,MAAM,WAAW,SAAS,QAAQ;QAExE;EAEL,MAAM,SAAS,MAAM,SAAS,kBAAkB;GAC9C,UAAU;GACV,aAAa;GACb,SAAS;GACT;GACD,CAAC;AACF,MAAI,CAAC,OAAO,GACV,OAAM,IAAI,SAAS,uBAAuB,OAAO,KAAK,KAAK,OAAO,WAAW,OAAO,KAAK;;;;;;;;AAU/F,eAAsB,qBAAqB,QAKzB;AAChB,KAAI,CAAC,OAAO,YAAY,CAAC,uBAAuB,OAAO,QAAQ,CAAE;AACjE,OAAM,OAAO,SAAS,gBAAgB,OAAO,UAAU,OAAO,SAAS"}

package/dist/share-resolve.cjs

@@ -0,0 +1,176 @@
+const require_share_declaration = require('./share-declaration.cjs');
+
+//#region src/share-resolve.ts
+/**
+* Phase 0.4 — ShareResolver: storage-agnostic share reconcile orchestrator.
+*
+* Holds the reconcile BUSINESS LOGIC (YAML parse + schema validation, reserved
+* / forbidden / traversal path checks, sourcePath derivation, nested-share
+* detection, kind auto-detection, slug determination + conflict check) and
+* delegates ALL `shares` table access to an injected {@link ShareStore}. This
+* mirrors the repo's `DIDSpaceResolver + KeyValueStore` precedent — one
+* orchestrator, swappable backend (D1 / libsql), no adapter.
+*
+* Identity is owner-scoped: `(ownerDid, declPath)` is the composite key, so two
+* owners that share one D1 / one daemon-global `_shares.db` never clobber each
+* other (CRITICAL #1 fix). `slug` stays globally unique.
+*
+* Offline full rebuild (`reconcileAll`) is intentionally NOT here — see
+* `D1ShareReconciler` in d1-share-store.ts (D1-only, needs an ObjectStore).
+*/
+/** 21-character random ID using Web Crypto (base-36, no external deps). */
+function generateId() {
+	return Array.from(crypto.getRandomValues(new Uint8Array(16)), (b) => b.toString(36).padStart(2, "0")).join("").slice(0, 21);
+}
+/** Paths under these prefixes are forbidden from having shares. */
+const FORBIDDEN_PREFIXES = ["config/", "vault/"];
+function isForbiddenPath(path) {
+	const p = path.startsWith("/") ? path.slice(1) : path;
+	return FORBIDDEN_PREFIXES.some((prefix) => p.startsWith(prefix));
+}
+function hasPathTraversal(path) {
+	return path.split("/").includes("..");
+}
+/** Returns true if the declPath is a sidecar (not root, not in-tree /.share). */
+function isSidecarPath(declPath) {
+	const p = declPath.startsWith("/") ? declPath.slice(1) : declPath;
+	return p !== ".share" && !p.endsWith("/.share");
+}
+var ShareResolver = class {
+	constructor(store, treeIndex) {
+		this.store = store;
+		this.treeIndex = treeIndex;
+	}
+	resolveBySlug(slug) {
+		return this.store.resolveBySlug(slug);
+	}
+	listByOwner(ownerDid) {
+		return this.store.listByOwner(ownerDid);
+	}
+	listByInstance(ownerDid, instanceDid) {
+		return this.store.listByInstance(ownerDid, instanceDid);
+	}
+	readShare(ownerDid, slug) {
+		return this.store.readByOwnerAndSlug(ownerDid, slug);
+	}
+	findByOwnerAndDeclPath(ownerDid, declPath) {
+		return this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+	}
+	async reconcileFromDecl(params) {
+		const { declPath, declContent, declCid, ownerDid, dryRun = false } = params;
+		const parsed = require_share_declaration.parseShareDeclaration(declContent);
+		if (!parsed.ok) return parsed;
+		if (require_share_declaration.isShareReservedPath(declPath)) return {
+			ok: false,
+			code: "share-path-reserved",
+			message: `Path is reserved and cannot have a share declaration: ${declPath}`
+		};
+		if (isForbiddenPath(declPath)) return {
+			ok: false,
+			code: "share-path-forbidden",
+			message: `Path prefix is forbidden for share declarations: ${declPath}`
+		};
+		if (hasPathTraversal(declPath)) return {
+			ok: false,
+			code: "share-path-forbidden",
+			message: `Path traversal detected in declaration path: ${declPath}`
+		};
+		const sourcePath = require_share_declaration.deriveSourcePath(declPath);
+		const isSidecar = isSidecarPath(declPath);
+		if (sourcePath !== "") {
+			const nested = await this.store.findNestedConflict(ownerDid, declPath, sourcePath);
+			if (nested) return {
+				ok: false,
+				code: "share-nested",
+				message: `Share declaration conflicts with ${nested}`
+			};
+		}
+		if (isSidecar && this.treeIndex && sourcePath) {
+			if (!await this.treeIndex.get(sourcePath, { includeContent: false })) return {
+				ok: false,
+				code: "share-sidecar-target-missing",
+				message: `Sidecar target file not found: ${sourcePath}`
+			};
+		}
+		let resolvedKind;
+		if (parsed.data.kind) {
+			resolvedKind = parsed.data.kind;
+			if (resolvedKind === "web" && this.treeIndex) {
+				const webPrefix = sourcePath ? `${sourcePath}/.web/` : ".web/";
+				const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });
+				if (entries.length === 0) return {
+					ok: false,
+					code: "share-web-no-decl",
+					message: `kind:web requires a .web/ directory at ${webPrefix}`
+				};
+			}
+		} else if (isSidecar) resolvedKind = "raw";
+		else if (this.treeIndex) {
+			const webPrefix = sourcePath ? `${sourcePath}/.web/` : ".web/";
+			const { entries } = await this.treeIndex.list(webPrefix, { limit: 1 });
+			resolvedKind = entries.length > 0 ? "web" : "raw";
+		} else resolvedKind = "raw";
+		const existing = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+		let slug;
+		if (parsed.data.slug) slug = parsed.data.slug;
+		else if (existing) slug = existing.slug;
+		else slug = generateId();
+		if (!existing || existing.slug !== slug) {
+			const conflicting = await this.store.findSlugConflict(slug, ownerDid, declPath);
+			if (conflicting) return {
+				ok: false,
+				code: "share-slug-conflict",
+				message: `Slug "${slug}" is already claimed by ${conflicting}`
+			};
+		}
+		const now = Date.now();
+		const id = existing?.id ?? generateId();
+		const status = parsed.data.status ?? "active";
+		if (dryRun) return {
+			ok: true,
+			entry: {
+				id,
+				ownerDid,
+				sourcePath,
+				declPath,
+				slug,
+				kind: resolvedKind,
+				status,
+				declCid,
+				config: parsed.data,
+				createdAt: existing?.createdAt ?? now,
+				updatedAt: now
+			}
+		};
+		const row = {
+			id,
+			owner_did: ownerDid,
+			source_path: sourcePath,
+			decl_path: declPath,
+			slug,
+			kind: resolvedKind,
+			status,
+			decl_cid: declCid,
+			config_json: JSON.stringify(parsed.data),
+			created_at: existing?.createdAt ?? now,
+			updated_at: now
+		};
+		await this.store.upsert(row);
+		const final = await this.store.findByOwnerAndDeclPath(ownerDid, declPath);
+		if (!final) return {
+			ok: false,
+			code: "share-internal-error",
+			message: "Failed to read back the upserted share row"
+		};
+		return {
+			ok: true,
+			entry: final
+		};
+	}
+	reconcileDelete(ownerDid, declPath) {
+		return this.store.deleteByOwnerAndDeclPath(ownerDid, declPath);
+	}
+};
+
+//#endregion
+exports.ShareResolver = ShareResolver;

package/dist/share-resolve.d.cts

@@ -0,0 +1,36 @@
+import { ShareEntry, ShareStore } from "./share-store.cjs";
+import { TreeIndex } from "./tree-index.cjs";
+
+//#region src/share-resolve.d.ts
+type ReconcileOk = {
+  ok: true;
+  entry: ShareEntry;
+};
+type ReconcileFail = {
+  ok: false;
+  code: string;
+  message: string;
+  detail?: unknown;
+};
+type ReconcileResult = ReconcileOk | ReconcileFail;
+declare class ShareResolver {
+  private store;
+  private treeIndex?;
+  constructor(store: ShareStore, treeIndex?: TreeIndex | undefined);
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+  listByOwner(ownerDid: string): Promise<ShareEntry[]>;
+  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]>;
+  readShare(ownerDid: string, slug: string): Promise<ShareEntry | null>;
+  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null>;
+  reconcileFromDecl(params: {
+    declPath: string;
+    declContent: Uint8Array;
+    declCid: string;
+    ownerDid: string;
+    dryRun?: boolean;
+  }): Promise<ReconcileResult>;
+  reconcileDelete(ownerDid: string, declPath: string): Promise<void>;
+}
+//#endregion
+export { ShareResolver };
+//# sourceMappingURL=share-resolve.d.cts.map

package/dist/share-resolve.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-resolve.d.cts","names":[],"sources":["../src/share-resolve.ts"],"mappings":";;;;KAyDK,WAAA;EAAgB,EAAA;EAAU,KAAA,EAAO,UAAA;AAAA;AAAA,KACjC,aAAA;EAAkB,EAAA;EAAW,IAAA;EAAc,OAAA;EAAiB,MAAA;AAAA;AAAA,KAC5D,eAAA,GAAkB,WAAA,GAAc,aAAA;AAAA,cAIxB,aAAA;EAAA,QAED,KAAA;EAAA,QAMA,SAAA;cANA,KAAA,EAAO,UAAA,EAMP,SAAA,GAAY,SAAA;EAKtB,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;EAMrC,WAAA,CAAY,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAIvC,cAAA,CAAe,QAAA,UAAkB,WAAA,WAAsB,OAAA,CAAQ,UAAA;EAI/D,SAAA,CAAU,QAAA,UAAkB,IAAA,WAAe,OAAA,CAAQ,UAAA;EAInD,sBAAA,CAAuB,QAAA,UAAkB,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAM9D,iBAAA,CAAkB,MAAA;IACtB,QAAA;IACA,WAAA,EAAa,UAAA;IACb,OAAA;IACA,QAAA;IACA,MAAA;EAAA,IACE,OAAA,CAAQ,eAAA;EAyKZ,eAAA,CAAgB,QAAA,UAAkB,QAAA,WAAmB,OAAA;AAAA"}

package/dist/share-resolve.d.mts

@@ -0,0 +1,36 @@
+import { ShareEntry, ShareStore } from "./share-store.mjs";
+import { TreeIndex } from "./tree-index.mjs";
+
+//#region src/share-resolve.d.ts
+type ReconcileOk = {
+  ok: true;
+  entry: ShareEntry;
+};
+type ReconcileFail = {
+  ok: false;
+  code: string;
+  message: string;
+  detail?: unknown;
+};
+type ReconcileResult = ReconcileOk | ReconcileFail;
+declare class ShareResolver {
+  private store;
+  private treeIndex?;
+  constructor(store: ShareStore, treeIndex?: TreeIndex | undefined);
+  resolveBySlug(slug: string): Promise<ShareEntry | null>;
+  listByOwner(ownerDid: string): Promise<ShareEntry[]>;
+  listByInstance(ownerDid: string, instanceDid: string): Promise<ShareEntry[]>;
+  readShare(ownerDid: string, slug: string): Promise<ShareEntry | null>;
+  findByOwnerAndDeclPath(ownerDid: string, declPath: string): Promise<ShareEntry | null>;
+  reconcileFromDecl(params: {
+    declPath: string;
+    declContent: Uint8Array;
+    declCid: string;
+    ownerDid: string;
+    dryRun?: boolean;
+  }): Promise<ReconcileResult>;
+  reconcileDelete(ownerDid: string, declPath: string): Promise<void>;
+}
+//#endregion
+export { ShareResolver };
+//# sourceMappingURL=share-resolve.d.mts.map

package/dist/share-resolve.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-resolve.d.mts","names":[],"sources":["../src/share-resolve.ts"],"mappings":";;;;KAyDK,WAAA;EAAgB,EAAA;EAAU,KAAA,EAAO,UAAA;AAAA;AAAA,KACjC,aAAA;EAAkB,EAAA;EAAW,IAAA;EAAc,OAAA;EAAiB,MAAA;AAAA;AAAA,KAC5D,eAAA,GAAkB,WAAA,GAAc,aAAA;AAAA,cAIxB,aAAA;EAAA,QAED,KAAA;EAAA,QAMA,SAAA;cANA,KAAA,EAAO,UAAA,EAMP,SAAA,GAAY,SAAA;EAKtB,aAAA,CAAc,IAAA,WAAe,OAAA,CAAQ,UAAA;EAMrC,WAAA,CAAY,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAIvC,cAAA,CAAe,QAAA,UAAkB,WAAA,WAAsB,OAAA,CAAQ,UAAA;EAI/D,SAAA,CAAU,QAAA,UAAkB,IAAA,WAAe,OAAA,CAAQ,UAAA;EAInD,sBAAA,CAAuB,QAAA,UAAkB,QAAA,WAAmB,OAAA,CAAQ,UAAA;EAM9D,iBAAA,CAAkB,MAAA;IACtB,QAAA;IACA,WAAA,EAAa,UAAA;IACb,OAAA;IACA,QAAA;IACA,MAAA;EAAA,IACE,OAAA,CAAQ,eAAA;EAyKZ,eAAA,CAAgB,QAAA,UAAkB,QAAA,WAAmB,OAAA;AAAA"}