@aigne/afs-did-space 1.12.0-beta.5

package/dist/cid-byte-cache.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid-byte-cache.mjs","names":[],"sources":["../src/cid-byte-cache.ts"],"sourcesContent":["/**\n * Content-addressed byte cache for the DID-Space object store.\n *\n * DID Space stores every blob once at the canonical key `objects/{cid}`, where\n * `cid` is a pure SHA-256 content hash (see {@link computeCID}) — no scope, no\n * owner, no salt. That makes the mapping `cid → bytes` **immutable**: the bytes\n * behind a given cid can never change. So a cache keyed by cid is ALWAYS valid —\n * it needs no TTL and no invalidation. A re-publish writes new bytes under a NEW\n * cid; the path→cid lookup (a cheap indexed D1/SQLite query, done fresh on every\n * read) points at the new cid, which simply misses the cache and is fetched once.\n * This is why re-published content is visible immediately even with caching on.\n *\n * The cache is a bounded LRU (bytes-budgeted). It wraps the object store — the\n * provider read path is unchanged and hits the cache transparently. Because cids\n * are global (identical bytes → identical cid across all users), this also dedups\n * hot blobs across a space's readers, matching the \"global object pool\" storage\n * design (see cloudflare.ts constructor).\n *\n * This lives INSIDE the provider layer on purpose (AFS-Only I/O: caching is the\n * store's own concern, invisible above the AFS interface — not a hand-rolled\n * cache in application/serve code).\n */\n\nimport type {\n  ObjectStore,\n  ObjectStoreHeadResult,\n  ObjectStoreListOptions,\n  ObjectStoreListResult,\n  ObjectStoreObject,\n} from \"@aigne/afs-r2\";\n\n/** Canonical prefix under which content-addressed blobs live: `objects/{cid}`. */\nconst OBJECT_KEY_PREFIX = \"objects/\";\n\n/** Total bytes the cache may hold before LRU eviction kicks in (per instance). */\nconst DEFAULT_MAX_TOTAL_BYTES = 64 * 1024 * 1024; // 64 MiB\n/**\n * Largest single object we cache. Bigger blobs (large media / bundles) are left\n * uncached: they'd evict many small hot files, and the ≳8 MiB range is\n * download-plane territory (served R2-direct, never read through the Worker).\n */\nconst DEFAULT_MAX_ENTRY_BYTES = 4 * 1024 * 1024; // 4 MiB\n\nconst UTF8_DECODER = new TextDecoder();\n/** Synthetic timestamp for cached objects — object-store metadata is never read\n * from `get()` (the provider takes size/mtime from the tree index), so a fixed\n * epoch is faithful and avoids a per-entry Date allocation. */\nconst SYNTHETIC_UPLOADED = new Date(0);\n\nexport interface CidByteCacheOptions {\n  /** Total byte budget before LRU eviction. Default 64 MiB. */\n  maxTotalBytes?: number;\n  /** Per-object cap; larger objects are not cached. Default 4 MiB. */\n  maxEntryBytes?: number;\n}\n\n/**\n * Bounded LRU cache of `cid → bytes`. Insertion order in the backing Map is the\n * LRU order; a `get` re-inserts (bumps to most-recently-used).\n */\nexport class CidByteCache {\n  private readonly map = new Map<string, Uint8Array>();\n  private readonly maxTotalBytes: number;\n  private readonly maxEntryBytes: number;\n  private totalBytes = 0;\n\n  constructor(options?: CidByteCacheOptions) {\n    this.maxTotalBytes = options?.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;\n    this.maxEntryBytes = options?.maxEntryBytes ?? DEFAULT_MAX_ENTRY_BYTES;\n  }\n\n  get(cid: string): Uint8Array | undefined {\n    const bytes = this.map.get(cid);\n    if (bytes === undefined) return undefined;\n    // LRU bump: delete + re-set moves the key to the end (most-recent).\n    this.map.delete(cid);\n    this.map.set(cid, bytes);\n    return bytes;\n  }\n\n  set(cid: string, bytes: Uint8Array): void {\n    if (bytes.byteLength > this.maxEntryBytes) return; // too big to cache\n    const existing = this.map.get(cid);\n    if (existing !== undefined) {\n      this.totalBytes -= existing.byteLength;\n      this.map.delete(cid);\n    }\n    this.map.set(cid, bytes);\n    this.totalBytes += bytes.byteLength;\n    this.evictToBudget();\n  }\n\n  delete(cid: string): void {\n    const existing = this.map.get(cid);\n    if (existing === undefined) return;\n    this.totalBytes -= existing.byteLength;\n    this.map.delete(cid);\n  }\n\n  /** Test/introspection helper. */\n  get size(): number {\n    return this.map.size;\n  }\n\n  private evictToBudget(): void {\n    while (this.totalBytes > this.maxTotalBytes) {\n      const oldest = this.map.keys().next().value as string | undefined;\n      if (oldest === undefined) break;\n      const evicted = this.map.get(oldest);\n      if (evicted !== undefined) this.totalBytes -= evicted.byteLength;\n      this.map.delete(oldest);\n    }\n  }\n}\n\n/** Build a minimal ObjectStoreObject that serves cached bytes. */\nfunction objectFromBytes(key: string, bytes: Uint8Array): ObjectStoreObject {\n  return {\n    key,\n    size: bytes.byteLength,\n    uploaded: SYNTHETIC_UPLOADED,\n    async text() {\n      return UTF8_DECODER.decode(bytes);\n    },\n    async arrayBuffer() {\n      // Copy so a caller can't mutate the cached buffer.\n      return bytes.slice().buffer;\n    },\n  };\n}\n\n/**\n * ObjectStore decorator that serves `objects/{cid}` reads from an in-memory\n * {@link CidByteCache}. Non-`objects/` keys and all writes/lists pass straight\n * through. `delete` drops the cid from the cache (belt-and-suspenders against GC\n * — a still-referenced object is never GC'd, so this rarely matters).\n */\nexport class CachingObjectStore implements ObjectStore {\n  constructor(\n    private readonly inner: ObjectStore,\n    private readonly cache: CidByteCache,\n  ) {}\n\n  private cidOf(key: string): string | undefined {\n    return key.startsWith(OBJECT_KEY_PREFIX) ? key.slice(OBJECT_KEY_PREFIX.length) : undefined;\n  }\n\n  async get(key: string): Promise<ObjectStoreObject | null> {\n    const cid = this.cidOf(key);\n    if (cid === undefined) return this.inner.get(key);\n\n    const cached = this.cache.get(cid);\n    if (cached !== undefined) return objectFromBytes(key, cached);\n\n    const obj = await this.inner.get(key);\n    if (!obj) return null;\n    const bytes = new Uint8Array(await obj.arrayBuffer());\n    this.cache.set(cid, bytes);\n    return objectFromBytes(key, bytes);\n  }\n\n  put(key: string, value: string | ArrayBuffer | ReadableStream): Promise<void> {\n    // Content-addressed: a re-put of the same cid is the same bytes, nothing to\n    // invalidate. Just delegate (do NOT populate the cache from a ReadableStream).\n    return this.inner.put(key, value);\n  }\n\n  async delete(key: string): Promise<void> {\n    const cid = this.cidOf(key);\n    if (cid !== undefined) this.cache.delete(cid);\n    return this.inner.delete(key);\n  }\n\n  list(options?: ObjectStoreListOptions): Promise<ObjectStoreListResult> {\n    return this.inner.list(options);\n  }\n\n  head(key: string): Promise<ObjectStoreHeadResult | null> {\n    return this.inner.head(key);\n  }\n}\n"],"mappings":";;AAgCA,MAAM,oBAAoB;;AAG1B,MAAM,0BAA0B,KAAK,OAAO;;;;;;AAM5C,MAAM,0BAA0B,IAAI,OAAO;AAE3C,MAAM,eAAe,IAAI,aAAa;;;;AAItC,MAAM,qCAAqB,IAAI,KAAK,EAAE;;;;;AAatC,IAAa,eAAb,MAA0B;CACxB,AAAiB,sBAAM,IAAI,KAAyB;CACpD,AAAiB;CACjB,AAAiB;CACjB,AAAQ,aAAa;CAErB,YAAY,SAA+B;AACzC,OAAK,gBAAgB,SAAS,iBAAiB;AAC/C,OAAK,gBAAgB,SAAS,iBAAiB;;CAGjD,IAAI,KAAqC;EACvC,MAAM,QAAQ,KAAK,IAAI,IAAI,IAAI;AAC/B,MAAI,UAAU,OAAW,QAAO;AAEhC,OAAK,IAAI,OAAO,IAAI;AACpB,OAAK,IAAI,IAAI,KAAK,MAAM;AACxB,SAAO;;CAGT,IAAI,KAAa,OAAyB;AACxC,MAAI,MAAM,aAAa,KAAK,cAAe;EAC3C,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;AAClC,MAAI,aAAa,QAAW;AAC1B,QAAK,cAAc,SAAS;AAC5B,QAAK,IAAI,OAAO,IAAI;;AAEtB,OAAK,IAAI,IAAI,KAAK,MAAM;AACxB,OAAK,cAAc,MAAM;AACzB,OAAK,eAAe;;CAGtB,OAAO,KAAmB;EACxB,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;AAClC,MAAI,aAAa,OAAW;AAC5B,OAAK,cAAc,SAAS;AAC5B,OAAK,IAAI,OAAO,IAAI;;;CAItB,IAAI,OAAe;AACjB,SAAO,KAAK,IAAI;;CAGlB,AAAQ,gBAAsB;AAC5B,SAAO,KAAK,aAAa,KAAK,eAAe;GAC3C,MAAM,SAAS,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;AACtC,OAAI,WAAW,OAAW;GAC1B,MAAM,UAAU,KAAK,IAAI,IAAI,OAAO;AACpC,OAAI,YAAY,OAAW,MAAK,cAAc,QAAQ;AACtD,QAAK,IAAI,OAAO,OAAO;;;;;AAM7B,SAAS,gBAAgB,KAAa,OAAsC;AAC1E,QAAO;EACL;EACA,MAAM,MAAM;EACZ,UAAU;EACV,MAAM,OAAO;AACX,UAAO,aAAa,OAAO,MAAM;;EAEnC,MAAM,cAAc;AAElB,UAAO,MAAM,OAAO,CAAC;;EAExB;;;;;;;;AASH,IAAa,qBAAb,MAAuD;CACrD,YACE,AAAiB,OACjB,AAAiB,OACjB;EAFiB;EACA;;CAGnB,AAAQ,MAAM,KAAiC;AAC7C,SAAO,IAAI,WAAW,kBAAkB,GAAG,IAAI,MAAM,EAAyB,GAAG;;CAGnF,MAAM,IAAI,KAAgD;EACxD,MAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,MAAI,QAAQ,OAAW,QAAO,KAAK,MAAM,IAAI,IAAI;EAEjD,MAAM,SAAS,KAAK,MAAM,IAAI,IAAI;AAClC,MAAI,WAAW,OAAW,QAAO,gBAAgB,KAAK,OAAO;EAE7D,MAAM,MAAM,MAAM,KAAK,MAAM,IAAI,IAAI;AACrC,MAAI,CAAC,IAAK,QAAO;EACjB,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI,aAAa,CAAC;AACrD,OAAK,MAAM,IAAI,KAAK,MAAM;AAC1B,SAAO,gBAAgB,KAAK,MAAM;;CAGpC,IAAI,KAAa,OAA6D;AAG5E,SAAO,KAAK,MAAM,IAAI,KAAK,MAAM;;CAGnC,MAAM,OAAO,KAA4B;EACvC,MAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,MAAI,QAAQ,OAAW,MAAK,MAAM,OAAO,IAAI;AAC7C,SAAO,KAAK,MAAM,OAAO,IAAI;;CAG/B,KAAK,SAAkE;AACrE,SAAO,KAAK,MAAM,KAAK,QAAQ;;CAGjC,KAAK,KAAoD;AACvD,SAAO,KAAK,MAAM,KAAK,IAAI"}

package/dist/cid.cjs

@@ -0,0 +1,68 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+let multiformats_bases_base64 = require("multiformats/bases/base64");
+let multiformats_cid = require("multiformats/cid");
+let multiformats_codecs_raw = require("multiformats/codecs/raw");
+multiformats_codecs_raw = require_rolldown_runtime.__toESM(multiformats_codecs_raw);
+let multiformats_hashes_digest = require("multiformats/hashes/digest");
+
+//#region src/cid.ts
+const SHA256_CODE = 18;
+/**
+* Compute a CID v1 (raw codec + SHA-256) for the given content.
+* Uses Web Crypto API (crypto.subtle) — works in Workers, browsers, and Node.js 15+.
+*/
+async function computeCID(content) {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+	const hashBuffer = await crypto.subtle.digest("SHA-256", bytes);
+	const digest = (0, multiformats_hashes_digest.create)(SHA256_CODE, new Uint8Array(hashBuffer));
+	return multiformats_cid.CID.createV1(multiformats_codecs_raw.code, digest).toString();
+}
+/**
+* Compute the canonical `x-amz-checksum-sha256` value (`base64pad` of the
+* 32-byte SHA-256 digest) directly from content — the SAME encoding
+* {@link cidToChecksumSha256} derives from a CID. This lets the commit path
+* verify a client-supplied inline copy against the session's stored
+* `checksum_sha256` with ONE native SHA-256 and a byte compare, WITHOUT
+* rebuilding a CID string or `CID.parse` (the digest-pre verify,
+* inline-content-commit §5.1).
+*
+* The encoding MUST be `base64pad` (RFC4648 WITH padding) to land on the same
+* alphabet as `cidToChecksumSha256` / the prepared session value — a no-pad
+* `base64`/`base64url` would drop the trailing `=` and never match (a silent
+* fail-closed that would drop every inline copy).
+*/
+async function checksumSha256OfContent(content) {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+	const hashBuffer = await crypto.subtle.digest("SHA-256", bytes);
+	return multiformats_bases_base64.base64pad.baseEncode(new Uint8Array(hashBuffer));
+}
+/**
+* Derive the canonical `x-amz-checksum-sha256` value (base64 of the 32-byte
+* SHA-256 digest) from a DID Space CID — the bridge between content addressing
+* and S3/R2 checksum enforcement (design §8).
+*
+* Accepts ONLY CIDv1 with raw codec (0x55) + SHA-256 multihash (0x12) — the
+* exact shape `computeCID` produces. Any other codec/hash, or a malformed CID,
+* is bad input and throws (the prepare-upload handler maps this to a validation
+* error). The output is byte-equivalent to
+* `base64(crypto.subtle.digest("SHA-256", bytes))`, which is what R2 expects in
+* the pinned checksum header (P0-verified, p0-measurements.md §5).
+*/
+function cidToChecksumSha256(cid) {
+	let parsed;
+	try {
+		parsed = multiformats_cid.CID.parse(cid);
+	} catch (err) {
+		throw new Error(`invalid CID: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed.code !== multiformats_codecs_raw.code) throw new Error(`CID codec must be raw (0x${multiformats_codecs_raw.code.toString(16)}), got 0x${parsed.code.toString(16)}`);
+	if (parsed.multihash.code !== SHA256_CODE) throw new Error(`CID hash must be sha256 (0x${SHA256_CODE.toString(16)}), got 0x${parsed.multihash.code.toString(16)}`);
+	const digest = parsed.multihash.digest;
+	if (digest.length !== 32) throw new Error(`sha256 digest must be 32 bytes, got ${digest.length}`);
+	return multiformats_bases_base64.base64pad.baseEncode(digest);
+}
+
+//#endregion
+exports.checksumSha256OfContent = checksumSha256OfContent;
+exports.cidToChecksumSha256 = cidToChecksumSha256;
+exports.computeCID = computeCID;

package/dist/cid.d.cts

@@ -0,0 +1,22 @@
+//#region src/cid.d.ts
+/**
+ * Compute a CID v1 (raw codec + SHA-256) for the given content.
+ * Uses Web Crypto API (crypto.subtle) — works in Workers, browsers, and Node.js 15+.
+ */
+declare function computeCID(content: string | Uint8Array): Promise<string>;
+/**
+ * Derive the canonical `x-amz-checksum-sha256` value (base64 of the 32-byte
+ * SHA-256 digest) from a DID Space CID — the bridge between content addressing
+ * and S3/R2 checksum enforcement (design §8).
+ *
+ * Accepts ONLY CIDv1 with raw codec (0x55) + SHA-256 multihash (0x12) — the
+ * exact shape `computeCID` produces. Any other codec/hash, or a malformed CID,
+ * is bad input and throws (the prepare-upload handler maps this to a validation
+ * error). The output is byte-equivalent to
+ * `base64(crypto.subtle.digest("SHA-256", bytes))`, which is what R2 expects in
+ * the pinned checksum header (P0-verified, p0-measurements.md §5).
+ */
+declare function cidToChecksumSha256(cid: string): string;
+//#endregion
+export { cidToChecksumSha256, computeCID };
+//# sourceMappingURL=cid.d.cts.map

package/dist/cid.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid.d.cts","names":[],"sources":["../src/cid.ts"],"mappings":";;AAWA;;;iBAAsB,UAAA,CAAW,OAAA,WAAkB,UAAA,GAAa,OAAA;;;;;;;;;;;;;iBA2ChD,mBAAA,CAAoB,GAAA"}

package/dist/cid.d.mts

@@ -0,0 +1,22 @@
+//#region src/cid.d.ts
+/**
+ * Compute a CID v1 (raw codec + SHA-256) for the given content.
+ * Uses Web Crypto API (crypto.subtle) — works in Workers, browsers, and Node.js 15+.
+ */
+declare function computeCID(content: string | Uint8Array): Promise<string>;
+/**
+ * Derive the canonical `x-amz-checksum-sha256` value (base64 of the 32-byte
+ * SHA-256 digest) from a DID Space CID — the bridge between content addressing
+ * and S3/R2 checksum enforcement (design §8).
+ *
+ * Accepts ONLY CIDv1 with raw codec (0x55) + SHA-256 multihash (0x12) — the
+ * exact shape `computeCID` produces. Any other codec/hash, or a malformed CID,
+ * is bad input and throws (the prepare-upload handler maps this to a validation
+ * error). The output is byte-equivalent to
+ * `base64(crypto.subtle.digest("SHA-256", bytes))`, which is what R2 expects in
+ * the pinned checksum header (P0-verified, p0-measurements.md §5).
+ */
+declare function cidToChecksumSha256(cid: string): string;
+//#endregion
+export { cidToChecksumSha256, computeCID };
+//# sourceMappingURL=cid.d.mts.map

package/dist/cid.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid.d.mts","names":[],"sources":["../src/cid.ts"],"mappings":";;AAWA;;;iBAAsB,UAAA,CAAW,OAAA,WAAkB,UAAA,GAAa,OAAA;;;;;;;;;;;;;iBA2ChD,mBAAA,CAAoB,GAAA"}

package/dist/cid.mjs

@@ -0,0 +1,65 @@
+import { base64pad } from "multiformats/bases/base64";
+import { CID } from "multiformats/cid";
+import * as raw from "multiformats/codecs/raw";
+import { create } from "multiformats/hashes/digest";
+
+//#region src/cid.ts
+const SHA256_CODE = 18;
+/**
+* Compute a CID v1 (raw codec + SHA-256) for the given content.
+* Uses Web Crypto API (crypto.subtle) — works in Workers, browsers, and Node.js 15+.
+*/
+async function computeCID(content) {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+	const hashBuffer = await crypto.subtle.digest("SHA-256", bytes);
+	const digest = create(SHA256_CODE, new Uint8Array(hashBuffer));
+	return CID.createV1(raw.code, digest).toString();
+}
+/**
+* Compute the canonical `x-amz-checksum-sha256` value (`base64pad` of the
+* 32-byte SHA-256 digest) directly from content — the SAME encoding
+* {@link cidToChecksumSha256} derives from a CID. This lets the commit path
+* verify a client-supplied inline copy against the session's stored
+* `checksum_sha256` with ONE native SHA-256 and a byte compare, WITHOUT
+* rebuilding a CID string or `CID.parse` (the digest-pre verify,
+* inline-content-commit §5.1).
+*
+* The encoding MUST be `base64pad` (RFC4648 WITH padding) to land on the same
+* alphabet as `cidToChecksumSha256` / the prepared session value — a no-pad
+* `base64`/`base64url` would drop the trailing `=` and never match (a silent
+* fail-closed that would drop every inline copy).
+*/
+async function checksumSha256OfContent(content) {
+	const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+	const hashBuffer = await crypto.subtle.digest("SHA-256", bytes);
+	return base64pad.baseEncode(new Uint8Array(hashBuffer));
+}
+/**
+* Derive the canonical `x-amz-checksum-sha256` value (base64 of the 32-byte
+* SHA-256 digest) from a DID Space CID — the bridge between content addressing
+* and S3/R2 checksum enforcement (design §8).
+*
+* Accepts ONLY CIDv1 with raw codec (0x55) + SHA-256 multihash (0x12) — the
+* exact shape `computeCID` produces. Any other codec/hash, or a malformed CID,
+* is bad input and throws (the prepare-upload handler maps this to a validation
+* error). The output is byte-equivalent to
+* `base64(crypto.subtle.digest("SHA-256", bytes))`, which is what R2 expects in
+* the pinned checksum header (P0-verified, p0-measurements.md §5).
+*/
+function cidToChecksumSha256(cid) {
+	let parsed;
+	try {
+		parsed = CID.parse(cid);
+	} catch (err) {
+		throw new Error(`invalid CID: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed.code !== raw.code) throw new Error(`CID codec must be raw (0x${raw.code.toString(16)}), got 0x${parsed.code.toString(16)}`);
+	if (parsed.multihash.code !== SHA256_CODE) throw new Error(`CID hash must be sha256 (0x${SHA256_CODE.toString(16)}), got 0x${parsed.multihash.code.toString(16)}`);
+	const digest = parsed.multihash.digest;
+	if (digest.length !== 32) throw new Error(`sha256 digest must be 32 bytes, got ${digest.length}`);
+	return base64pad.baseEncode(digest);
+}
+
+//#endregion
+export { checksumSha256OfContent, cidToChecksumSha256, computeCID };
+//# sourceMappingURL=cid.mjs.map

package/dist/cid.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cid.mjs","names":["createDigest"],"sources":["../src/cid.ts"],"sourcesContent":["import { base64pad } from \"multiformats/bases/base64\";\nimport { CID } from \"multiformats/cid\";\nimport * as raw from \"multiformats/codecs/raw\";\nimport { create as createDigest } from \"multiformats/hashes/digest\";\n\nconst SHA256_CODE = 0x12;\n\n/**\n * Compute a CID v1 (raw codec + SHA-256) for the given content.\n * Uses Web Crypto API (crypto.subtle) — works in Workers, browsers, and Node.js 15+.\n */\nexport async function computeCID(content: string | Uint8Array): Promise<string> {\n  const bytes = typeof content === \"string\" ? new TextEncoder().encode(content) : content;\n  // Pass Uint8Array directly — NOT bytes.buffer — to avoid hashing the entire\n  // underlying ArrayBuffer when bytes is a view into a Node.js Buffer pool.\n  const hashBuffer = await crypto.subtle.digest(\"SHA-256\", bytes as unknown as ArrayBuffer);\n  const digest = createDigest(SHA256_CODE, new Uint8Array(hashBuffer));\n  return CID.createV1(raw.code, digest).toString();\n}\n\n/**\n * Compute the canonical `x-amz-checksum-sha256` value (`base64pad` of the\n * 32-byte SHA-256 digest) directly from content — the SAME encoding\n * {@link cidToChecksumSha256} derives from a CID. This lets the commit path\n * verify a client-supplied inline copy against the session's stored\n * `checksum_sha256` with ONE native SHA-256 and a byte compare, WITHOUT\n * rebuilding a CID string or `CID.parse` (the digest-pre verify,\n * inline-content-commit §5.1).\n *\n * The encoding MUST be `base64pad` (RFC4648 WITH padding) to land on the same\n * alphabet as `cidToChecksumSha256` / the prepared session value — a no-pad\n * `base64`/`base64url` would drop the trailing `=` and never match (a silent\n * fail-closed that would drop every inline copy).\n */\nexport async function checksumSha256OfContent(content: string | Uint8Array): Promise<string> {\n  const bytes = typeof content === \"string\" ? new TextEncoder().encode(content) : content;\n  // Pass the Uint8Array view directly (NOT bytes.buffer) — same Buffer-pool\n  // caveat as computeCID.\n  const hashBuffer = await crypto.subtle.digest(\"SHA-256\", bytes as unknown as ArrayBuffer);\n  return base64pad.baseEncode(new Uint8Array(hashBuffer));\n}\n\n/**\n * Derive the canonical `x-amz-checksum-sha256` value (base64 of the 32-byte\n * SHA-256 digest) from a DID Space CID — the bridge between content addressing\n * and S3/R2 checksum enforcement (design §8).\n *\n * Accepts ONLY CIDv1 with raw codec (0x55) + SHA-256 multihash (0x12) — the\n * exact shape `computeCID` produces. Any other codec/hash, or a malformed CID,\n * is bad input and throws (the prepare-upload handler maps this to a validation\n * error). The output is byte-equivalent to\n * `base64(crypto.subtle.digest(\"SHA-256\", bytes))`, which is what R2 expects in\n * the pinned checksum header (P0-verified, p0-measurements.md §5).\n */\nexport function cidToChecksumSha256(cid: string): string {\n  let parsed: CID;\n  try {\n    parsed = CID.parse(cid);\n  } catch (err) {\n    throw new Error(`invalid CID: ${err instanceof Error ? err.message : String(err)}`);\n  }\n  if (parsed.code !== raw.code) {\n    throw new Error(\n      `CID codec must be raw (0x${raw.code.toString(16)}), got 0x${parsed.code.toString(16)}`,\n    );\n  }\n  if (parsed.multihash.code !== SHA256_CODE) {\n    throw new Error(\n      `CID hash must be sha256 (0x${SHA256_CODE.toString(16)}), got 0x${parsed.multihash.code.toString(16)}`,\n    );\n  }\n  const digest = parsed.multihash.digest;\n  if (digest.length !== 32) {\n    throw new Error(`sha256 digest must be 32 bytes, got ${digest.length}`);\n  }\n  // `base64pad` is RFC4648 base64 WITH padding; `baseEncode` yields the raw\n  // alphabet with no multibase prefix — byte-equivalent to Node's\n  // `Buffer.toString(\"base64\")` and to what R2 expects in x-amz-checksum-sha256\n  // (the no-pad `base64` variant would drop the trailing \"=\" and fail).\n  return base64pad.baseEncode(digest);\n}\n"],"mappings":";;;;;;AAKA,MAAM,cAAc;;;;;AAMpB,eAAsB,WAAW,SAA+C;CAC9E,MAAM,QAAQ,OAAO,YAAY,WAAW,IAAI,aAAa,CAAC,OAAO,QAAQ,GAAG;CAGhF,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAgC;CACzF,MAAM,SAASA,OAAa,aAAa,IAAI,WAAW,WAAW,CAAC;AACpE,QAAO,IAAI,SAAS,IAAI,MAAM,OAAO,CAAC,UAAU;;;;;;;;;;;;;;;;AAiBlD,eAAsB,wBAAwB,SAA+C;CAC3F,MAAM,QAAQ,OAAO,YAAY,WAAW,IAAI,aAAa,CAAC,OAAO,QAAQ,GAAG;CAGhF,MAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,MAAgC;AACzF,QAAO,UAAU,WAAW,IAAI,WAAW,WAAW,CAAC;;;;;;;;;;;;;;AAezD,SAAgB,oBAAoB,KAAqB;CACvD,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,MAAM,IAAI;UAChB,KAAK;AACZ,QAAM,IAAI,MAAM,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAAG;;AAErF,KAAI,OAAO,SAAS,IAAI,KACtB,OAAM,IAAI,MACR,4BAA4B,IAAI,KAAK,SAAS,GAAG,CAAC,WAAW,OAAO,KAAK,SAAS,GAAG,GACtF;AAEH,KAAI,OAAO,UAAU,SAAS,YAC5B,OAAM,IAAI,MACR,8BAA8B,YAAY,SAAS,GAAG,CAAC,WAAW,OAAO,UAAU,KAAK,SAAS,GAAG,GACrG;CAEH,MAAM,SAAS,OAAO,UAAU;AAChC,KAAI,OAAO,WAAW,GACpB,OAAM,IAAI,MAAM,uCAAuC,OAAO,SAAS;AAMzE,QAAO,UAAU,WAAW,OAAO"}

package/dist/client.cjs

@@ -0,0 +1,221 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+const require_http = require('./transports/http.cjs');
+const require_static = require('./transports/static.cjs');
+const require_types = require('./transports/types.cjs');
+const require_ws = require('./transports/ws.cjs');
+let _aigne_afs_provider = require("@aigne/afs/provider");
+
+//#region src/client.ts
+const FORWARDED_OPERATIONS = [
+	"list",
+	"read",
+	"write",
+	"delete",
+	"stat",
+	"search",
+	"exec",
+	"explain"
+];
+const REQUIRED_TRANSPORT_METHODS = [
+	"list",
+	"read",
+	"write",
+	"delete",
+	"stat",
+	"search",
+	"exec",
+	"explain"
+];
+/**
+* Implement {@link AFSEventFilter}'s wildcard match for `type`. Mirrors the
+* helper used by the core event router: `"test:*"` matches `"test:anything"`,
+* everything else is an exact compare.
+*/
+function matchEventType(eventType, filterType) {
+	if (filterType.endsWith(":*")) return eventType.startsWith(filterType.slice(0, -1));
+	return eventType === filterType;
+}
+function assertTransportShape(transport) {
+	if (!transport || typeof transport !== "object") throw new Error("DIDSpaceClient: transport is required");
+	if (!require_types.isTransportKind(transport.kind)) throw new Error(`DIDSpaceClient: transport.kind must be 'http' | 'ws' | 'static-readonly' (got: ${String(transport.kind)})`);
+	for (const method of REQUIRED_TRANSPORT_METHODS) if (typeof transport[method] !== "function") throw new Error(`DIDSpaceClient: transport is missing required method: ${method}`);
+}
+var DIDSpaceClient = class extends _aigne_afs_provider.AFSBaseProvider {
+	name;
+	description;
+	accessMode;
+	transport;
+	constructor(options) {
+		super();
+		assertTransportShape(options.transport);
+		this.transport = options.transport;
+		this.name = options.name ?? "did-space-client";
+		this.description = options.description;
+		this.accessMode = options.accessMode ?? (this.transport.kind === "static-readonly" ? "readonly" : "readwrite");
+		const unsupported = this.unsupportedOps();
+		for (const op of FORWARDED_OPERATIONS) {
+			if (unsupported.has(op)) continue;
+			delete this[op];
+		}
+		if (this.accessMode === "readonly") {
+			this.write = void 0;
+			this.delete = void 0;
+		}
+	}
+	/**
+	* Operations the transport is known *not* to support (e.g. HTTP REST
+	* does not expose stat/search/exec/explain). Used at construction time
+	* to keep those methods `undefined` so AFS routing knows.
+	*/
+	unsupportedOps() {
+		const set = /* @__PURE__ */ new Set();
+		if (this.transport.kind === "http") {
+			set.add("stat");
+			set.add("search");
+			set.add("exec");
+			set.add("explain");
+		} else if (this.transport.kind === "static-readonly") {
+			set.add("search");
+			set.add("exec");
+		}
+		return set;
+	}
+	list(path, options) {
+		return this.transport.list(path, options);
+	}
+	read(path, options) {
+		return this.transport.read(path, options);
+	}
+	write(path, payload, options) {
+		return this.transport.write(path, payload, options);
+	}
+	delete(path, options) {
+		return this.transport.delete(path, options);
+	}
+	stat(path, options) {
+		return this.transport.stat(path, options);
+	}
+	search(path, query, options) {
+		return this.transport.search(path, query, options);
+	}
+	exec(path, args, options) {
+		return this.transport.exec(path, args, options);
+	}
+	explain(path, options) {
+		return this.transport.explain(path, options);
+	}
+	/**
+	* Subscribe to push events from the transport. Only WS supports this today.
+	*
+	* Conforms to `AFSRoot.subscribe(filter, callback)` so this provider can be
+	* mounted via `MaterializedMount` like any other. The underlying transport's
+	* subscribe is path-based and async, so:
+	*   - `filter.path` is mapped to the transport's `path` argument (only the
+	*     path dimension of {@link AFSEventFilter} is honored today; other
+	*     filter dimensions are applied client-side in the wrapped callback)
+	*   - the async `Promise<Unsubscribe>` returned by the transport is bridged
+	*     to a sync {@link AFSUnsubscribe} that cancels whether or not the
+	*     underlying subscribe has resolved yet
+	*/
+	subscribe(filter, callback) {
+		if (typeof this.transport.subscribe !== "function") throw new Error(`DIDSpaceClient: transport (${this.transport.kind}) does not support subscribe`);
+		const path = filter.path ?? "/";
+		const matches = (event) => {
+			if (filter.type !== void 0 && !matchEventType(event.type, filter.type)) return false;
+			if (filter.scope !== void 0 && event.scope !== filter.scope) return false;
+			if (filter.source !== void 0 && event.source !== filter.source) return false;
+			return true;
+		};
+		let cancelled = false;
+		let unsubscribe;
+		this.transport.subscribe(path, (event) => {
+			if (cancelled) return;
+			if (!matches(event)) return;
+			callback(event);
+		}).then((fn) => {
+			if (cancelled) {
+				fn();
+				return;
+			}
+			unsubscribe = fn;
+		}).catch(() => {});
+		return () => {
+			cancelled = true;
+			if (unsubscribe) unsubscribe();
+		};
+	}
+	/** Tear down the underlying transport (idempotent). */
+	async close() {
+		if (typeof this.transport.close === "function") await this.transport.close();
+	}
+};
+const UNSAFE_SCHEMES = new Set([
+	"file:",
+	"javascript:",
+	"data:",
+	"ftp:"
+]);
+function assertSafeUrl(rawUrl) {
+	let parsed;
+	try {
+		parsed = new URL(rawUrl);
+	} catch {
+		throw new Error(`connectDIDSpace: invalid URL: ${rawUrl}`);
+	}
+	if (UNSAFE_SCHEMES.has(parsed.protocol)) throw new Error(`connectDIDSpace: refusing unsafe URL scheme '${parsed.protocol}'`);
+}
+/**
+* Construct a ready-to-mount {@link DIDSpaceClient} from a transport
+* config. For long-lived transports (WS) the underlying connection is
+* established before the client is returned.
+*/
+async function connectDIDSpace(options) {
+	const cfg = options.transport;
+	if (!cfg || typeof cfg !== "object") throw new Error("connectDIDSpace: options.transport is required");
+	if (!require_types.isTransportKind(cfg.kind)) throw new Error(`connectDIDSpace: unknown transport kind '${String(cfg.kind)}' (expected 'http' | 'ws' | 'static-readonly')`);
+	let transport;
+	switch (cfg.kind) {
+		case "http":
+			if (!cfg.url) throw new Error("connectDIDSpace: http transport requires url");
+			if (!cfg.token) throw new Error("connectDIDSpace: http transport requires token");
+			assertSafeUrl(cfg.url);
+			transport = new require_http.HttpTransport({
+				url: cfg.url,
+				token: cfg.token
+			});
+			break;
+		case "ws": {
+			if (!cfg.url) throw new Error("connectDIDSpace: ws transport requires url");
+			if (!cfg.token) throw new Error("connectDIDSpace: ws transport requires token");
+			assertSafeUrl(cfg.url);
+			const ws = new require_ws.WsTransport({
+				url: cfg.url,
+				token: cfg.token,
+				namespace: cfg.namespace,
+				requestTimeout: cfg.requestTimeout
+			});
+			await ws.connect();
+			transport = ws;
+			break;
+		}
+		case "static-readonly":
+			if (!cfg.url) throw new Error("connectDIDSpace: static-readonly transport requires url");
+			assertSafeUrl(cfg.url);
+			transport = new require_static.StaticReadonlyTransport({
+				url: cfg.url,
+				token: cfg.token,
+				allowPrivateNetwork: cfg.allowPrivateNetwork
+			});
+			break;
+	}
+	return new DIDSpaceClient({
+		transport,
+		name: options.name,
+		description: options.description,
+		accessMode: options.accessMode
+	});
+}
+
+//#endregion
+exports.DIDSpaceClient = DIDSpaceClient;
+exports.connectDIDSpace = connectDIDSpace;

package/dist/client.d.cts

@@ -0,0 +1,72 @@
+import { Transport, TransportConfig } from "./transports/types.cjs";
+import { AFSAccessMode, AFSDeleteOptions, AFSDeleteResult, AFSEventCallback, AFSEventFilter, AFSExecOptions, AFSExecResult, AFSExplainOptions, AFSExplainResult, AFSListOptions, AFSListResult, AFSReadOptions, AFSReadResult, AFSSearchOptions, AFSSearchResult, AFSStatOptions, AFSStatResult, AFSUnsubscribe, AFSWriteEntryPayload, AFSWriteOptions, AFSWriteResult } from "@aigne/afs";
+import { AFSBaseProvider } from "@aigne/afs/provider";
+
+//#region src/client.d.ts
+interface DIDSpaceClientOptions {
+  transport: Transport;
+  /** Optional name for the mount; default `did-space-client`. */
+  name?: string;
+  /** Optional description. */
+  description?: string;
+  /**
+   * Override the access mode. Defaults to `readonly` for
+   * `static-readonly` transports, `readwrite` for the others.
+   */
+  accessMode?: AFSAccessMode;
+}
+declare class DIDSpaceClient extends AFSBaseProvider {
+  readonly name: string;
+  readonly description?: string;
+  readonly accessMode: AFSAccessMode;
+  private readonly transport;
+  constructor(options: DIDSpaceClientOptions);
+  /**
+   * Operations the transport is known *not* to support (e.g. HTTP REST
+   * does not expose stat/search/exec/explain). Used at construction time
+   * to keep those methods `undefined` so AFS routing knows.
+   */
+  private unsupportedOps;
+  list(path: string, options?: AFSListOptions): Promise<AFSListResult>;
+  read(path: string, options?: AFSReadOptions): Promise<AFSReadResult>;
+  write(path: string, payload: AFSWriteEntryPayload, options?: AFSWriteOptions): Promise<AFSWriteResult>;
+  delete(path: string, options?: AFSDeleteOptions): Promise<AFSDeleteResult>;
+  stat(path: string, options?: AFSStatOptions): Promise<AFSStatResult>;
+  search(path: string, query: string, options?: AFSSearchOptions): Promise<AFSSearchResult>;
+  exec(path: string, args: Record<string, unknown>, options: AFSExecOptions): Promise<AFSExecResult>;
+  explain(path: string, options?: AFSExplainOptions): Promise<AFSExplainResult>;
+  /**
+   * Subscribe to push events from the transport. Only WS supports this today.
+   *
+   * Conforms to `AFSRoot.subscribe(filter, callback)` so this provider can be
+   * mounted via `MaterializedMount` like any other. The underlying transport's
+   * subscribe is path-based and async, so:
+   *   - `filter.path` is mapped to the transport's `path` argument (only the
+   *     path dimension of {@link AFSEventFilter} is honored today; other
+   *     filter dimensions are applied client-side in the wrapped callback)
+   *   - the async `Promise<Unsubscribe>` returned by the transport is bridged
+   *     to a sync {@link AFSUnsubscribe} that cancels whether or not the
+   *     underlying subscribe has resolved yet
+   */
+  subscribe(filter: AFSEventFilter, callback: AFSEventCallback): AFSUnsubscribe;
+  /** Tear down the underlying transport (idempotent). */
+  close(): Promise<void>;
+}
+interface ConnectDIDSpaceOptions {
+  transport: TransportConfig;
+  /** See `DIDSpaceClientOptions.name`. */
+  name?: string;
+  /** See `DIDSpaceClientOptions.description`. */
+  description?: string;
+  /** See `DIDSpaceClientOptions.accessMode`. */
+  accessMode?: AFSAccessMode;
+}
+/**
+ * Construct a ready-to-mount {@link DIDSpaceClient} from a transport
+ * config. For long-lived transports (WS) the underlying connection is
+ * established before the client is returned.
+ */
+declare function connectDIDSpace(options: ConnectDIDSpaceOptions): Promise<DIDSpaceClient>;
+//#endregion
+export { ConnectDIDSpaceOptions, DIDSpaceClient, DIDSpaceClientOptions, connectDIDSpace };
+//# sourceMappingURL=client.d.cts.map

package/dist/client.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;UA0HiB,qBAAA;EACf,SAAA,EAAW,SAAA;EAwFgD;EAtF3D,IAAA;EA0F+D;EAxF/D,WAAA;EA+FY;;;;EA1FZ,UAAA,GAAa,aAAA;AAAA;AAAA,cAGF,cAAA,SAAuB,eAAA;EAAA,SAChB,IAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA,EAAY,aAAA;EAAA,iBACb,SAAA;cAEL,OAAA,EAAS,qBAAA;EA+G0C;;;;;EAAA,QA3EvD,cAAA;EAkBC,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,KAAA,CACP,IAAA,UACA,OAAA,EAAS,oBAAA,EACT,OAAA,GAAU,eAAA,GACT,OAAA,CAAQ,cAAA;EAIF,MAAA,CAAO,IAAA,UAAc,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAI1D,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,MAAA,CACP,IAAA,UACA,KAAA,UACA,OAAA,GAAU,gBAAA,GACT,OAAA,CAAQ,eAAA;EAIF,IAAA,CACP,IAAA,UACA,IAAA,EAAM,MAAA,mBACN,OAAA,EAAS,cAAA,GACR,OAAA,CAAQ,aAAA;EAIF,OAAA,CAAQ,IAAA,UAAc,OAAA,GAAU,iBAAA,GAAoB,OAAA,CAAQ,gBAAA;EA1D7D;;;;;;;;;;;;;EA2ER,SAAA,CAAU,MAAA,EAAQ,cAAA,EAAgB,QAAA,EAAU,gBAAA,GAAmB,cAAA;EAhD7D;EAyFI,KAAA,CAAA,GAAS,OAAA;AAAA;AAAA,UAWA,sBAAA;EACf,SAAA,EAAW,eAAA;EAlGR;EAoGH,IAAA;EAhGS;EAkGT,WAAA;EAlGwC;EAoGxC,UAAA,GAAa,aAAA;AAAA;;;;;;iBAsBO,eAAA,CAAgB,OAAA,EAAS,sBAAA,GAAyB,OAAA,CAAQ,cAAA"}

package/dist/client.d.mts

@@ -0,0 +1,72 @@
+import { Transport, TransportConfig } from "./transports/types.mjs";
+import { AFSAccessMode, AFSDeleteOptions, AFSDeleteResult, AFSEventCallback, AFSEventFilter, AFSExecOptions, AFSExecResult, AFSExplainOptions, AFSExplainResult, AFSListOptions, AFSListResult, AFSReadOptions, AFSReadResult, AFSSearchOptions, AFSSearchResult, AFSStatOptions, AFSStatResult, AFSUnsubscribe, AFSWriteEntryPayload, AFSWriteOptions, AFSWriteResult } from "@aigne/afs";
+import { AFSBaseProvider } from "@aigne/afs/provider";
+
+//#region src/client.d.ts
+interface DIDSpaceClientOptions {
+  transport: Transport;
+  /** Optional name for the mount; default `did-space-client`. */
+  name?: string;
+  /** Optional description. */
+  description?: string;
+  /**
+   * Override the access mode. Defaults to `readonly` for
+   * `static-readonly` transports, `readwrite` for the others.
+   */
+  accessMode?: AFSAccessMode;
+}
+declare class DIDSpaceClient extends AFSBaseProvider {
+  readonly name: string;
+  readonly description?: string;
+  readonly accessMode: AFSAccessMode;
+  private readonly transport;
+  constructor(options: DIDSpaceClientOptions);
+  /**
+   * Operations the transport is known *not* to support (e.g. HTTP REST
+   * does not expose stat/search/exec/explain). Used at construction time
+   * to keep those methods `undefined` so AFS routing knows.
+   */
+  private unsupportedOps;
+  list(path: string, options?: AFSListOptions): Promise<AFSListResult>;
+  read(path: string, options?: AFSReadOptions): Promise<AFSReadResult>;
+  write(path: string, payload: AFSWriteEntryPayload, options?: AFSWriteOptions): Promise<AFSWriteResult>;
+  delete(path: string, options?: AFSDeleteOptions): Promise<AFSDeleteResult>;
+  stat(path: string, options?: AFSStatOptions): Promise<AFSStatResult>;
+  search(path: string, query: string, options?: AFSSearchOptions): Promise<AFSSearchResult>;
+  exec(path: string, args: Record<string, unknown>, options: AFSExecOptions): Promise<AFSExecResult>;
+  explain(path: string, options?: AFSExplainOptions): Promise<AFSExplainResult>;
+  /**
+   * Subscribe to push events from the transport. Only WS supports this today.
+   *
+   * Conforms to `AFSRoot.subscribe(filter, callback)` so this provider can be
+   * mounted via `MaterializedMount` like any other. The underlying transport's
+   * subscribe is path-based and async, so:
+   *   - `filter.path` is mapped to the transport's `path` argument (only the
+   *     path dimension of {@link AFSEventFilter} is honored today; other
+   *     filter dimensions are applied client-side in the wrapped callback)
+   *   - the async `Promise<Unsubscribe>` returned by the transport is bridged
+   *     to a sync {@link AFSUnsubscribe} that cancels whether or not the
+   *     underlying subscribe has resolved yet
+   */
+  subscribe(filter: AFSEventFilter, callback: AFSEventCallback): AFSUnsubscribe;
+  /** Tear down the underlying transport (idempotent). */
+  close(): Promise<void>;
+}
+interface ConnectDIDSpaceOptions {
+  transport: TransportConfig;
+  /** See `DIDSpaceClientOptions.name`. */
+  name?: string;
+  /** See `DIDSpaceClientOptions.description`. */
+  description?: string;
+  /** See `DIDSpaceClientOptions.accessMode`. */
+  accessMode?: AFSAccessMode;
+}
+/**
+ * Construct a ready-to-mount {@link DIDSpaceClient} from a transport
+ * config. For long-lived transports (WS) the underlying connection is
+ * established before the client is returned.
+ */
+declare function connectDIDSpace(options: ConnectDIDSpaceOptions): Promise<DIDSpaceClient>;
+//#endregion
+export { ConnectDIDSpaceOptions, DIDSpaceClient, DIDSpaceClientOptions, connectDIDSpace };
+//# sourceMappingURL=client.d.mts.map

package/dist/client.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;UA0HiB,qBAAA;EACf,SAAA,EAAW,SAAA;EAwFgD;EAtF3D,IAAA;EA0F+D;EAxF/D,WAAA;EA+FY;;;;EA1FZ,UAAA,GAAa,aAAA;AAAA;AAAA,cAGF,cAAA,SAAuB,eAAA;EAAA,SAChB,IAAA;EAAA,SACA,WAAA;EAAA,SACA,UAAA,EAAY,aAAA;EAAA,iBACb,SAAA;cAEL,OAAA,EAAS,qBAAA;EA+G0C;;;;;EAAA,QA3EvD,cAAA;EAkBC,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,KAAA,CACP,IAAA,UACA,OAAA,EAAS,oBAAA,EACT,OAAA,GAAU,eAAA,GACT,OAAA,CAAQ,cAAA;EAIF,MAAA,CAAO,IAAA,UAAc,OAAA,GAAU,gBAAA,GAAmB,OAAA,CAAQ,eAAA;EAI1D,IAAA,CAAK,IAAA,UAAc,OAAA,GAAU,cAAA,GAAiB,OAAA,CAAQ,aAAA;EAItD,MAAA,CACP,IAAA,UACA,KAAA,UACA,OAAA,GAAU,gBAAA,GACT,OAAA,CAAQ,eAAA;EAIF,IAAA,CACP,IAAA,UACA,IAAA,EAAM,MAAA,mBACN,OAAA,EAAS,cAAA,GACR,OAAA,CAAQ,aAAA;EAIF,OAAA,CAAQ,IAAA,UAAc,OAAA,GAAU,iBAAA,GAAoB,OAAA,CAAQ,gBAAA;EA1D7D;;;;;;;;;;;;;EA2ER,SAAA,CAAU,MAAA,EAAQ,cAAA,EAAgB,QAAA,EAAU,gBAAA,GAAmB,cAAA;EAhD7D;EAyFI,KAAA,CAAA,GAAS,OAAA;AAAA;AAAA,UAWA,sBAAA;EACf,SAAA,EAAW,eAAA;EAlGR;EAoGH,IAAA;EAhGS;EAkGT,WAAA;EAlGwC;EAoGxC,UAAA,GAAa,aAAA;AAAA;;;;;;iBAsBO,eAAA,CAAgB,OAAA,EAAS,sBAAA,GAAyB,OAAA,CAAQ,cAAA"}