@aigne/aos 0.2.0-beta

package/dist/http/ingest-facade.cjs

@@ -0,0 +1,315 @@
+let ufo = require("ufo");
+let _aigne_afs = require("@aigne/afs");
+let _aigne_afs_did_space = require("@aigne/afs-did-space");
+
+//#region src/http/ingest-facade.ts
+/**
+* ingest-facade — the browser upload plane's server host (design §4.2, D1
+* candidate-b). The afs-rpc handler intercepts the root-visible facade actions
+*
+*   /.actions/ingest-prepare   — plan + (grant) mint PUT grants + open a session
+*   /.actions/commit-upload    — commit uploaded objects' metadata
+*   /.actions/abort-upload     — abort a session (staged objects → GC)
+*
+* and injects them into `list('/.actions')`, so the browser only ever speaks in
+* ROOT-VISIBLE paths (`/user/docs/a.pdf`) and never learns the mount boundary.
+*
+* Why a handler intercept (not a provider): the upload-plane actions
+* (prepare/commit/abort-upload) take PROVIDER-RELATIVE paths (`/docs/a.pdf`) but
+* the browser only knows root-visible paths. The intercept holds the composed
+* per-request `SessionUserAFS` (writable `/user`) + verified caller, runs the
+* shared `planIngest()` (one planning impl, core), then strips the mount prefix
+* and delegates to the target mount's prepare/commit/abort-upload. The
+* root-visible↔provider-relative translation lives only here — the browser never
+* does mount math, and we never produce a `tree/user/...` double-prefix key.
+*
+* Transport split (design §4.4a): these are all `exec` (HTTP fast-path, CSRF +
+* effect-gated). The legacy fallback's batchWrite is the browser's job (WS).
+*/
+/** Capability-discovery version the browser checks before using this chain. */
+const INGEST_PROTOCOL_VERSION = 1;
+/** The three root-visible facade action names. */
+const INGEST_FACADE_ACTIONS = [
+	"ingest-prepare",
+	"commit-upload",
+	"abort-upload"
+];
+/**
+* v1 grant mount used when there is no path to derive it from (abort-upload
+* carries only a sessionId). v1 supports a single grant mount; prepare/commit
+* derive the mount from their path args, abort falls back to this.
+*/
+const V1_GRANT_MOUNT = "/user";
+/** True for the three root-visible facade exec paths (exact match only). */
+function isIngestFacadePath(path) {
+	return INGEST_FACADE_ACTIONS.some((a) => path === `/.actions/${a}`);
+}
+/**
+* Append the three facade entries to a `list('/.actions')` result so the browser
+* discovers the chain by listing the ROOT `/.actions` (design §4.5). Idempotent
+* (won't duplicate an id already present) — applied identically in all scopes.
+*/
+function injectIngestFacadeList(data) {
+	const arr = Array.isArray(data) ? [...data] : [];
+	const have = new Set(arr.map((e) => e?.id));
+	for (const name of INGEST_FACADE_ACTIONS) {
+		if (have.has(name)) continue;
+		arr.push({
+			id: name,
+			path: (0, ufo.joinURL)("/.actions", name),
+			meta: {
+				kind: "afs:executable",
+				protocolVersion: INGEST_PROTOCOL_VERSION
+			}
+		});
+	}
+	return arr;
+}
+/** v1: the mount prefix is the first path segment (`/user/docs` → `/user`). */
+function mountPrefixOf(path) {
+	const seg = path.split("/").filter(Boolean)[0];
+	return seg ? `/${seg}` : null;
+}
+/** Strip the mount prefix → provider-relative path (`/user/docs/a.pdf` → `/docs/a.pdf`). */
+function stripMount(path, mountPrefix) {
+	if (path === mountPrefix) return "/";
+	const rel = path.slice(mountPrefix.length);
+	return rel.startsWith("/") ? rel : `/${rel}`;
+}
+/** Re-add the mount prefix → root-visible path (`/docs/a.pdf` → `/user/docs/a.pdf`). */
+function addMount(providerRel, mountPrefix) {
+	return (0, ufo.joinURL)(mountPrefix, providerRel);
+}
+/** Read the target mount's `prepare-upload.grantCapability` (design §4.5). */
+async function isGrantCapable(afs, mountPrefix, context) {
+	try {
+		const r = await afs.list((0, ufo.joinURL)(mountPrefix, ".actions"), { context });
+		return (Array.isArray(r?.data) ? r.data : []).find((e) => e.id === "prepare-upload")?.meta?.grantCapability === true;
+	} catch {
+		return false;
+	}
+}
+function asStr(v) {
+	return typeof v === "string" && v ? v : void 0;
+}
+async function execIngestPrepare(afs, args, context, limits) {
+	const targetDir = asStr(args.targetDir);
+	if (!targetDir) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "targetDir must be a non-empty string"
+	};
+	const conflict = (0, _aigne_afs.normalizeConflict)(args.conflict) ?? "rename";
+	const rawEntries = Array.isArray(args.entries) ? args.entries : null;
+	if (!rawEntries || rawEntries.length === 0) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entries must be a non-empty array"
+	};
+	const inputs = [];
+	for (const raw of rawEntries) {
+		const entry = raw;
+		const relPath = asStr(entry.relPath);
+		if (!relPath) return {
+			ok: false,
+			code: "AFS_VALIDATION_ERROR",
+			error: "every entry needs a non-empty relPath"
+		};
+		inputs.push({
+			relPath,
+			size: typeof entry.size === "number" && entry.size >= 0 ? entry.size : 0,
+			mimeType: asStr(entry.mimeType),
+			cid: asStr(entry.cid)
+		});
+	}
+	const plan = await (0, _aigne_afs.planIngest)(afs, targetDir, inputs.map((e) => ({
+		name: e.relPath,
+		relPath: e.relPath
+	})), conflict);
+	const mountPrefix = mountPrefixOf(targetDir);
+	const grantCapable = mountPrefix ? await isGrantCapable(afs, mountPrefix, context) : false;
+	const wantAbsent = conflict === "rename" || conflict === "error";
+	const responseEntries = [];
+	const grantInputs = [];
+	for (const pe of plan.entries) {
+		if (pe.status === "skipped") {
+			responseEntries.push({
+				relPath: pe.relPath,
+				finalPath: pe.finalPath,
+				status: "skipped"
+			});
+			continue;
+		}
+		if (pe.status === "failed") {
+			responseEntries.push({
+				relPath: pe.relPath,
+				finalPath: pe.finalPath,
+				status: "failed",
+				error: pe.error
+			});
+			continue;
+		}
+		const finalPath = pe.finalPath;
+		const ifMatch = wantAbsent ? _aigne_afs_did_space.AFS_IFMATCH_ABSENT : void 0;
+		const ref = {
+			relPath: pe.relPath,
+			finalPath,
+			status: "needs-upload",
+			...ifMatch ? { ifMatch } : {}
+		};
+		responseEntries.push(ref);
+		const src = inputs[pe.index];
+		const size = src?.size ?? 0;
+		const failTooLarge = (capBytes, planeNote) => {
+			ref.status = "failed";
+			ref.error = {
+				code: "FILE_TOO_LARGE",
+				message: `File exceeds the ${capBytes}-byte ${planeNote} (declared ${size} bytes)`
+			};
+			delete ref.ifMatch;
+		};
+		if (size > limits.maxBytes) failTooLarge(limits.maxBytes, "upload limit");
+		else if (grantCapable && mountPrefix && src?.cid && size > 0) grantInputs.push({
+			ref,
+			providerRelPath: stripMount(finalPath, mountPrefix),
+			cid: src.cid,
+			size,
+			mimeType: src.mimeType,
+			ifMatch
+		});
+		else if (size > limits.legacyMaxBytes) failTooLarge(limits.legacyMaxBytes, "legacy upload limit (configure an R2 signer for larger files)");
+	}
+	let mode = "legacy";
+	let sessionId;
+	let expiresAt;
+	if (grantInputs.length > 0 && mountPrefix) {
+		const prepRes = await afs.exec((0, ufo.joinURL)(mountPrefix, ".actions/prepare-upload"), { entries: grantInputs.map((g) => ({
+			path: g.providerRelPath,
+			cid: g.cid,
+			size: g.size,
+			...g.mimeType ? { mimeType: g.mimeType } : {},
+			...g.ifMatch ? { ifMatch: g.ifMatch } : {}
+		})) }, { context });
+		if (!prepRes?.success) return {
+			ok: false,
+			code: prepRes?.error?.code ?? "AFS_ERROR",
+			error: prepRes?.error?.message ?? "prepare-upload failed"
+		};
+		const pdata = prepRes.data;
+		mode = "grant";
+		sessionId = pdata.sessionId;
+		expiresAt = pdata.expiresAt;
+		const byPath = new Map((pdata.entries ?? []).map((e) => [e.path, e]));
+		for (const g of grantInputs) {
+			const pe = byPath.get(g.providerRelPath);
+			if (!pe) continue;
+			g.ref.objectKey = pe.objectKey;
+			g.ref.checksumSha256 = pe.checksumSha256;
+			if (pe.grant) g.ref.grant = pe.grant;
+		}
+	}
+	return {
+		ok: true,
+		data: {
+			mode,
+			protocolVersion: INGEST_PROTOCOL_VERSION,
+			...sessionId ? {
+				sessionId,
+				expiresAt
+			} : {},
+			entries: responseEntries
+		}
+	};
+}
+async function execCommitUpload(afs, args, context) {
+	const sessionId = asStr(args.sessionId);
+	if (!sessionId) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "sessionId required"
+	};
+	const rawEntries = Array.isArray(args.entries) ? args.entries : null;
+	if (!rawEntries || rawEntries.length === 0) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entries must be a non-empty array"
+	};
+	const firstPath = asStr(rawEntries[0]?.path);
+	const mountPrefix = firstPath ? mountPrefixOf(firstPath) : null;
+	if (!mountPrefix) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entry.path must be a root-visible path"
+	};
+	const providerEntries = rawEntries.map((raw) => {
+		const e = raw;
+		const p = asStr(e.path);
+		return {
+			...e,
+			path: p ? stripMount(p, mountPrefix) : p
+		};
+	});
+	const res = await afs.exec((0, ufo.joinURL)(mountPrefix, ".actions/commit-upload"), {
+		sessionId,
+		entries: providerEntries
+	}, { context });
+	if (!res?.success) return {
+		ok: false,
+		code: res?.error?.code ?? "AFS_ERROR",
+		error: res?.error?.message ?? "commit-upload failed"
+	};
+	const data = res.data;
+	if (Array.isArray(data?.results)) data.results = data.results.map((r) => {
+		const out = { ...r };
+		const rp = asStr(r.path);
+		if (rp) out.path = addMount(rp, mountPrefix);
+		const inner = r.data;
+		if (inner && asStr(inner.path)) out.data = {
+			...inner,
+			path: addMount(inner.path, mountPrefix)
+		};
+		return out;
+	});
+	return {
+		ok: true,
+		data
+	};
+}
+async function execAbortUpload(afs, args, context) {
+	const sessionId = asStr(args.sessionId);
+	if (!sessionId) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "sessionId required"
+	};
+	const res = await afs.exec((0, ufo.joinURL)(V1_GRANT_MOUNT, ".actions/abort-upload"), { sessionId }, { context });
+	if (!res?.success) return {
+		ok: false,
+		code: res?.error?.code ?? "AFS_ERROR",
+		error: res?.error?.message ?? "abort-upload failed"
+	};
+	return {
+		ok: true,
+		data: res.data
+	};
+}
+/**
+* Run a root-visible facade exec. Caller MUST pre-check {@link isIngestFacadePath}.
+* The authed-caller floor (design §4.7: all three are write-effect) is enforced
+* here — the CSRF/Origin guard is the afs-rpc handler's job upstream.
+*/
+async function execIngestFacade(input) {
+	const { afs, path, args, context, caller } = input;
+	if (!caller?.did) return {
+		status: 401,
+		error: "Authentication required for upload"
+	};
+	if (path === "/.actions/ingest-prepare") return execIngestPrepare(afs, args, context, input.limits ?? _aigne_afs.UPLOAD_LIMIT_DEFAULTS);
+	if (path === "/.actions/commit-upload") return execCommitUpload(afs, args, context);
+	return execAbortUpload(afs, args, context);
+}
+
+//#endregion
+exports.execIngestFacade = execIngestFacade;
+exports.injectIngestFacadeList = injectIngestFacadeList;
+exports.isIngestFacadePath = isIngestFacadePath;

package/dist/http/ingest-facade.mjs

@@ -0,0 +1,314 @@
+import { joinURL } from "ufo";
+import { UPLOAD_LIMIT_DEFAULTS, normalizeConflict, planIngest } from "@aigne/afs";
+import { AFS_IFMATCH_ABSENT } from "@aigne/afs-did-space";
+
+//#region src/http/ingest-facade.ts
+/**
+* ingest-facade — the browser upload plane's server host (design §4.2, D1
+* candidate-b). The afs-rpc handler intercepts the root-visible facade actions
+*
+*   /.actions/ingest-prepare   — plan + (grant) mint PUT grants + open a session
+*   /.actions/commit-upload    — commit uploaded objects' metadata
+*   /.actions/abort-upload     — abort a session (staged objects → GC)
+*
+* and injects them into `list('/.actions')`, so the browser only ever speaks in
+* ROOT-VISIBLE paths (`/user/docs/a.pdf`) and never learns the mount boundary.
+*
+* Why a handler intercept (not a provider): the upload-plane actions
+* (prepare/commit/abort-upload) take PROVIDER-RELATIVE paths (`/docs/a.pdf`) but
+* the browser only knows root-visible paths. The intercept holds the composed
+* per-request `SessionUserAFS` (writable `/user`) + verified caller, runs the
+* shared `planIngest()` (one planning impl, core), then strips the mount prefix
+* and delegates to the target mount's prepare/commit/abort-upload. The
+* root-visible↔provider-relative translation lives only here — the browser never
+* does mount math, and we never produce a `tree/user/...` double-prefix key.
+*
+* Transport split (design §4.4a): these are all `exec` (HTTP fast-path, CSRF +
+* effect-gated). The legacy fallback's batchWrite is the browser's job (WS).
+*/
+/** Capability-discovery version the browser checks before using this chain. */
+const INGEST_PROTOCOL_VERSION = 1;
+/** The three root-visible facade action names. */
+const INGEST_FACADE_ACTIONS = [
+	"ingest-prepare",
+	"commit-upload",
+	"abort-upload"
+];
+/**
+* v1 grant mount used when there is no path to derive it from (abort-upload
+* carries only a sessionId). v1 supports a single grant mount; prepare/commit
+* derive the mount from their path args, abort falls back to this.
+*/
+const V1_GRANT_MOUNT = "/user";
+/** True for the three root-visible facade exec paths (exact match only). */
+function isIngestFacadePath(path) {
+	return INGEST_FACADE_ACTIONS.some((a) => path === `/.actions/${a}`);
+}
+/**
+* Append the three facade entries to a `list('/.actions')` result so the browser
+* discovers the chain by listing the ROOT `/.actions` (design §4.5). Idempotent
+* (won't duplicate an id already present) — applied identically in all scopes.
+*/
+function injectIngestFacadeList(data) {
+	const arr = Array.isArray(data) ? [...data] : [];
+	const have = new Set(arr.map((e) => e?.id));
+	for (const name of INGEST_FACADE_ACTIONS) {
+		if (have.has(name)) continue;
+		arr.push({
+			id: name,
+			path: joinURL("/.actions", name),
+			meta: {
+				kind: "afs:executable",
+				protocolVersion: INGEST_PROTOCOL_VERSION
+			}
+		});
+	}
+	return arr;
+}
+/** v1: the mount prefix is the first path segment (`/user/docs` → `/user`). */
+function mountPrefixOf(path) {
+	const seg = path.split("/").filter(Boolean)[0];
+	return seg ? `/${seg}` : null;
+}
+/** Strip the mount prefix → provider-relative path (`/user/docs/a.pdf` → `/docs/a.pdf`). */
+function stripMount(path, mountPrefix) {
+	if (path === mountPrefix) return "/";
+	const rel = path.slice(mountPrefix.length);
+	return rel.startsWith("/") ? rel : `/${rel}`;
+}
+/** Re-add the mount prefix → root-visible path (`/docs/a.pdf` → `/user/docs/a.pdf`). */
+function addMount(providerRel, mountPrefix) {
+	return joinURL(mountPrefix, providerRel);
+}
+/** Read the target mount's `prepare-upload.grantCapability` (design §4.5). */
+async function isGrantCapable(afs, mountPrefix, context) {
+	try {
+		const r = await afs.list(joinURL(mountPrefix, ".actions"), { context });
+		return (Array.isArray(r?.data) ? r.data : []).find((e) => e.id === "prepare-upload")?.meta?.grantCapability === true;
+	} catch {
+		return false;
+	}
+}
+function asStr(v) {
+	return typeof v === "string" && v ? v : void 0;
+}
+async function execIngestPrepare(afs, args, context, limits) {
+	const targetDir = asStr(args.targetDir);
+	if (!targetDir) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "targetDir must be a non-empty string"
+	};
+	const conflict = normalizeConflict(args.conflict) ?? "rename";
+	const rawEntries = Array.isArray(args.entries) ? args.entries : null;
+	if (!rawEntries || rawEntries.length === 0) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entries must be a non-empty array"
+	};
+	const inputs = [];
+	for (const raw of rawEntries) {
+		const entry = raw;
+		const relPath = asStr(entry.relPath);
+		if (!relPath) return {
+			ok: false,
+			code: "AFS_VALIDATION_ERROR",
+			error: "every entry needs a non-empty relPath"
+		};
+		inputs.push({
+			relPath,
+			size: typeof entry.size === "number" && entry.size >= 0 ? entry.size : 0,
+			mimeType: asStr(entry.mimeType),
+			cid: asStr(entry.cid)
+		});
+	}
+	const plan = await planIngest(afs, targetDir, inputs.map((e) => ({
+		name: e.relPath,
+		relPath: e.relPath
+	})), conflict);
+	const mountPrefix = mountPrefixOf(targetDir);
+	const grantCapable = mountPrefix ? await isGrantCapable(afs, mountPrefix, context) : false;
+	const wantAbsent = conflict === "rename" || conflict === "error";
+	const responseEntries = [];
+	const grantInputs = [];
+	for (const pe of plan.entries) {
+		if (pe.status === "skipped") {
+			responseEntries.push({
+				relPath: pe.relPath,
+				finalPath: pe.finalPath,
+				status: "skipped"
+			});
+			continue;
+		}
+		if (pe.status === "failed") {
+			responseEntries.push({
+				relPath: pe.relPath,
+				finalPath: pe.finalPath,
+				status: "failed",
+				error: pe.error
+			});
+			continue;
+		}
+		const finalPath = pe.finalPath;
+		const ifMatch = wantAbsent ? AFS_IFMATCH_ABSENT : void 0;
+		const ref = {
+			relPath: pe.relPath,
+			finalPath,
+			status: "needs-upload",
+			...ifMatch ? { ifMatch } : {}
+		};
+		responseEntries.push(ref);
+		const src = inputs[pe.index];
+		const size = src?.size ?? 0;
+		const failTooLarge = (capBytes, planeNote) => {
+			ref.status = "failed";
+			ref.error = {
+				code: "FILE_TOO_LARGE",
+				message: `File exceeds the ${capBytes}-byte ${planeNote} (declared ${size} bytes)`
+			};
+			delete ref.ifMatch;
+		};
+		if (size > limits.maxBytes) failTooLarge(limits.maxBytes, "upload limit");
+		else if (grantCapable && mountPrefix && src?.cid && size > 0) grantInputs.push({
+			ref,
+			providerRelPath: stripMount(finalPath, mountPrefix),
+			cid: src.cid,
+			size,
+			mimeType: src.mimeType,
+			ifMatch
+		});
+		else if (size > limits.legacyMaxBytes) failTooLarge(limits.legacyMaxBytes, "legacy upload limit (configure an R2 signer for larger files)");
+	}
+	let mode = "legacy";
+	let sessionId;
+	let expiresAt;
+	if (grantInputs.length > 0 && mountPrefix) {
+		const prepRes = await afs.exec(joinURL(mountPrefix, ".actions/prepare-upload"), { entries: grantInputs.map((g) => ({
+			path: g.providerRelPath,
+			cid: g.cid,
+			size: g.size,
+			...g.mimeType ? { mimeType: g.mimeType } : {},
+			...g.ifMatch ? { ifMatch: g.ifMatch } : {}
+		})) }, { context });
+		if (!prepRes?.success) return {
+			ok: false,
+			code: prepRes?.error?.code ?? "AFS_ERROR",
+			error: prepRes?.error?.message ?? "prepare-upload failed"
+		};
+		const pdata = prepRes.data;
+		mode = "grant";
+		sessionId = pdata.sessionId;
+		expiresAt = pdata.expiresAt;
+		const byPath = new Map((pdata.entries ?? []).map((e) => [e.path, e]));
+		for (const g of grantInputs) {
+			const pe = byPath.get(g.providerRelPath);
+			if (!pe) continue;
+			g.ref.objectKey = pe.objectKey;
+			g.ref.checksumSha256 = pe.checksumSha256;
+			if (pe.grant) g.ref.grant = pe.grant;
+		}
+	}
+	return {
+		ok: true,
+		data: {
+			mode,
+			protocolVersion: INGEST_PROTOCOL_VERSION,
+			...sessionId ? {
+				sessionId,
+				expiresAt
+			} : {},
+			entries: responseEntries
+		}
+	};
+}
+async function execCommitUpload(afs, args, context) {
+	const sessionId = asStr(args.sessionId);
+	if (!sessionId) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "sessionId required"
+	};
+	const rawEntries = Array.isArray(args.entries) ? args.entries : null;
+	if (!rawEntries || rawEntries.length === 0) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entries must be a non-empty array"
+	};
+	const firstPath = asStr(rawEntries[0]?.path);
+	const mountPrefix = firstPath ? mountPrefixOf(firstPath) : null;
+	if (!mountPrefix) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "entry.path must be a root-visible path"
+	};
+	const providerEntries = rawEntries.map((raw) => {
+		const e = raw;
+		const p = asStr(e.path);
+		return {
+			...e,
+			path: p ? stripMount(p, mountPrefix) : p
+		};
+	});
+	const res = await afs.exec(joinURL(mountPrefix, ".actions/commit-upload"), {
+		sessionId,
+		entries: providerEntries
+	}, { context });
+	if (!res?.success) return {
+		ok: false,
+		code: res?.error?.code ?? "AFS_ERROR",
+		error: res?.error?.message ?? "commit-upload failed"
+	};
+	const data = res.data;
+	if (Array.isArray(data?.results)) data.results = data.results.map((r) => {
+		const out = { ...r };
+		const rp = asStr(r.path);
+		if (rp) out.path = addMount(rp, mountPrefix);
+		const inner = r.data;
+		if (inner && asStr(inner.path)) out.data = {
+			...inner,
+			path: addMount(inner.path, mountPrefix)
+		};
+		return out;
+	});
+	return {
+		ok: true,
+		data
+	};
+}
+async function execAbortUpload(afs, args, context) {
+	const sessionId = asStr(args.sessionId);
+	if (!sessionId) return {
+		ok: false,
+		code: "AFS_VALIDATION_ERROR",
+		error: "sessionId required"
+	};
+	const res = await afs.exec(joinURL(V1_GRANT_MOUNT, ".actions/abort-upload"), { sessionId }, { context });
+	if (!res?.success) return {
+		ok: false,
+		code: res?.error?.code ?? "AFS_ERROR",
+		error: res?.error?.message ?? "abort-upload failed"
+	};
+	return {
+		ok: true,
+		data: res.data
+	};
+}
+/**
+* Run a root-visible facade exec. Caller MUST pre-check {@link isIngestFacadePath}.
+* The authed-caller floor (design §4.7: all three are write-effect) is enforced
+* here — the CSRF/Origin guard is the afs-rpc handler's job upstream.
+*/
+async function execIngestFacade(input) {
+	const { afs, path, args, context, caller } = input;
+	if (!caller?.did) return {
+		status: 401,
+		error: "Authentication required for upload"
+	};
+	if (path === "/.actions/ingest-prepare") return execIngestPrepare(afs, args, context, input.limits ?? UPLOAD_LIMIT_DEFAULTS);
+	if (path === "/.actions/commit-upload") return execCommitUpload(afs, args, context);
+	return execAbortUpload(afs, args, context);
+}
+
+//#endregion
+export { execIngestFacade, injectIngestFacadeList, isIngestFacadePath };
+//# sourceMappingURL=ingest-facade.mjs.map

package/dist/http/ingest-facade.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-facade.mjs","names":[],"sources":["../../src/http/ingest-facade.ts"],"sourcesContent":["/**\n * ingest-facade — the browser upload plane's server host (design §4.2, D1\n * candidate-b). The afs-rpc handler intercepts the root-visible facade actions\n *\n *   /.actions/ingest-prepare   — plan + (grant) mint PUT grants + open a session\n *   /.actions/commit-upload    — commit uploaded objects' metadata\n *   /.actions/abort-upload     — abort a session (staged objects → GC)\n *\n * and injects them into `list('/.actions')`, so the browser only ever speaks in\n * ROOT-VISIBLE paths (`/user/docs/a.pdf`) and never learns the mount boundary.\n *\n * Why a handler intercept (not a provider): the upload-plane actions\n * (prepare/commit/abort-upload) take PROVIDER-RELATIVE paths (`/docs/a.pdf`) but\n * the browser only knows root-visible paths. The intercept holds the composed\n * per-request `SessionUserAFS` (writable `/user`) + verified caller, runs the\n * shared `planIngest()` (one planning impl, core), then strips the mount prefix\n * and delegates to the target mount's prepare/commit/abort-upload. The\n * root-visible↔provider-relative translation lives only here — the browser never\n * does mount math, and we never produce a `tree/user/...` double-prefix key.\n *\n * Transport split (design §4.4a): these are all `exec` (HTTP fast-path, CSRF +\n * effect-gated). The legacy fallback's batchWrite is the browser's job (WS).\n */\n\nimport {\n  type IngestAFS,\n  normalizeConflict,\n  planIngest,\n  UPLOAD_LIMIT_DEFAULTS,\n  type UploadLimits,\n} from \"@aigne/afs\";\nimport { AFS_IFMATCH_ABSENT } from \"@aigne/afs-did-space\";\nimport { joinURL } from \"ufo\";\n\n/** Capability-discovery version the browser checks before using this chain. */\nexport const INGEST_PROTOCOL_VERSION = 1;\n\n/** The three root-visible facade action names. */\nexport const INGEST_FACADE_ACTIONS = [\"ingest-prepare\", \"commit-upload\", \"abort-upload\"] as const;\n\n/**\n * v1 grant mount used when there is no path to derive it from (abort-upload\n * carries only a sessionId). v1 supports a single grant mount; prepare/commit\n * derive the mount from their path args, abort falls back to this.\n */\nconst V1_GRANT_MOUNT = \"/user\";\n\n/** A minimal AFS surface the facade needs: plan via stat, delegate via exec/list. */\nexport interface FacadeAFS extends IngestAFS {\n  exec(\n    path: string,\n    args: Record<string, unknown>,\n    options?: unknown,\n  ): Promise<{\n    success?: boolean;\n    data?: unknown;\n    error?: { code?: string; message?: string };\n  }>;\n  list(path: string, options?: unknown): Promise<{ data?: unknown }>;\n}\n\n/** Caller shape the facade needs (authed-caller gate). */\ninterface FacadeCaller {\n  did?: string | null;\n}\n\n/**\n * Discriminated facade outcome. The afs-rpc handler maps it to a Response:\n *  - `{ status }`  → `fail(status, error)` (401 authed-caller floor)\n *  - `{ ok: true }`  → 200 `{ ok: true, data }`\n *  - `{ ok: false }` → 200 `{ ok: false, error, code? }` (semantic failure)\n */\nexport type FacadeResult =\n  | { status: 401 | 403; error: string }\n  | { ok: true; data: unknown }\n  | { ok: false; error: string; code?: string };\n\n/** True for the three root-visible facade exec paths (exact match only). */\nexport function isIngestFacadePath(path: string): boolean {\n  return INGEST_FACADE_ACTIONS.some((a) => path === `/.actions/${a}`);\n}\n\n/**\n * Append the three facade entries to a `list('/.actions')` result so the browser\n * discovers the chain by listing the ROOT `/.actions` (design §4.5). Idempotent\n * (won't duplicate an id already present) — applied identically in all scopes.\n */\nexport function injectIngestFacadeList(data: unknown): unknown[] {\n  const arr = Array.isArray(data) ? [...data] : [];\n  const have = new Set(arr.map((e) => (e as { id?: string } | null)?.id));\n  for (const name of INGEST_FACADE_ACTIONS) {\n    if (have.has(name)) continue;\n    arr.push({\n      id: name,\n      path: joinURL(\"/.actions\", name),\n      meta: { kind: \"afs:executable\", protocolVersion: INGEST_PROTOCOL_VERSION },\n    });\n  }\n  return arr;\n}\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\n/** v1: the mount prefix is the first path segment (`/user/docs` → `/user`). */\nfunction mountPrefixOf(path: string): string | null {\n  const seg = path.split(\"/\").filter(Boolean)[0];\n  return seg ? `/${seg}` : null;\n}\n\n/** Strip the mount prefix → provider-relative path (`/user/docs/a.pdf` → `/docs/a.pdf`). */\nfunction stripMount(path: string, mountPrefix: string): string {\n  if (path === mountPrefix) return \"/\";\n  const rel = path.slice(mountPrefix.length);\n  return rel.startsWith(\"/\") ? rel : `/${rel}`;\n}\n\n/** Re-add the mount prefix → root-visible path (`/docs/a.pdf` → `/user/docs/a.pdf`). */\nfunction addMount(providerRel: string, mountPrefix: string): string {\n  return joinURL(mountPrefix, providerRel);\n}\n\n/** Read the target mount's `prepare-upload.grantCapability` (design §4.5). */\nasync function isGrantCapable(\n  afs: FacadeAFS,\n  mountPrefix: string,\n  context: Record<string, unknown>,\n): Promise<boolean> {\n  try {\n    const r = await afs.list(joinURL(mountPrefix, \".actions\"), { context });\n    const entries = (Array.isArray(r?.data) ? r.data : []) as Array<{\n      id?: string;\n      meta?: { grantCapability?: unknown };\n    }>;\n    return entries.find((e) => e.id === \"prepare-upload\")?.meta?.grantCapability === true;\n  } catch {\n    return false;\n  }\n}\n\nfunction asStr(v: unknown): string | undefined {\n  return typeof v === \"string\" && v ? v : undefined;\n}\n\n// ── ingest-prepare ───────────────────────────────────────────────────────────\n\ninterface PrepareEntryInput {\n  relPath: string;\n  size: number;\n  mimeType?: string;\n  cid?: string;\n}\n\nasync function execIngestPrepare(\n  afs: FacadeAFS,\n  args: Record<string, unknown>,\n  context: Record<string, unknown>,\n  limits: UploadLimits,\n): Promise<FacadeResult> {\n  const targetDir = asStr(args.targetDir);\n  if (!targetDir) {\n    return {\n      ok: false,\n      code: \"AFS_VALIDATION_ERROR\",\n      error: \"targetDir must be a non-empty string\",\n    };\n  }\n  const conflict = normalizeConflict(args.conflict) ?? \"rename\";\n  const rawEntries = Array.isArray(args.entries) ? args.entries : null;\n  if (!rawEntries || rawEntries.length === 0) {\n    return { ok: false, code: \"AFS_VALIDATION_ERROR\", error: \"entries must be a non-empty array\" };\n  }\n  const inputs: PrepareEntryInput[] = [];\n  for (const raw of rawEntries) {\n    const entry = raw as { relPath?: unknown; size?: unknown; mimeType?: unknown; cid?: unknown };\n    const relPath = asStr(entry.relPath);\n    if (!relPath) {\n      return {\n        ok: false,\n        code: \"AFS_VALIDATION_ERROR\",\n        error: \"every entry needs a non-empty relPath\",\n      };\n    }\n    inputs.push({\n      relPath,\n      size: typeof entry.size === \"number\" && entry.size >= 0 ? entry.size : 0,\n      mimeType: asStr(entry.mimeType),\n      cid: asStr(entry.cid),\n    });\n  }\n\n  // Plan (the single shared planning impl, core). finalPath is root-visible.\n  const plan = await planIngest(\n    afs,\n    targetDir,\n    inputs.map((e) => ({ name: e.relPath, relPath: e.relPath })),\n    conflict,\n  );\n\n  const mountPrefix = mountPrefixOf(targetDir);\n  const grantCapable = mountPrefix ? await isGrantCapable(afs, mountPrefix, context) : false;\n\n  // The conflict intent that must survive the prepare→write window (D3 §4.2a):\n  // rename/error mean \"do not clobber\" → expected-absent precondition.\n  const wantAbsent = conflict === \"rename\" || conflict === \"error\";\n\n  interface ResponseEntry {\n    relPath: string;\n    finalPath: string | null;\n    status: string;\n    error?: { code: string; message: string };\n    ifMatch?: string;\n    objectKey?: string;\n    checksumSha256?: string;\n    grant?: unknown;\n  }\n  interface GrantInput {\n    ref: ResponseEntry;\n    providerRelPath: string;\n    cid: string;\n    size: number;\n    mimeType?: string;\n    ifMatch?: string;\n  }\n\n  const responseEntries: ResponseEntry[] = [];\n  const grantInputs: GrantInput[] = [];\n\n  for (const pe of plan.entries) {\n    if (pe.status === \"skipped\") {\n      responseEntries.push({ relPath: pe.relPath, finalPath: pe.finalPath, status: \"skipped\" });\n      continue;\n    }\n    if (pe.status === \"failed\") {\n      responseEntries.push({\n        relPath: pe.relPath,\n        finalPath: pe.finalPath,\n        status: \"failed\",\n        error: pe.error,\n      });\n      continue;\n    }\n    // pending ⇒ finalPath non-null (planIngest invariant).\n    const finalPath = pe.finalPath!;\n    const ifMatch = wantAbsent ? AFS_IFMATCH_ABSENT : undefined;\n    const ref: ResponseEntry = {\n      relPath: pe.relPath,\n      finalPath,\n      status: \"needs-upload\",\n      ...(ifMatch ? { ifMatch } : {}),\n    };\n    responseEntries.push(ref);\n\n    const src = inputs[pe.index];\n    const size = src?.size ?? 0;\n    // upload-limits Phase 2 — declared-size routing + early reject (design §5).\n    // Best-effort BANDWIDTH optimization (the real boundary is Phase 1's\n    // decoded-byte WS cap). FILE_TOO_LARGE is PER-ENTRY (status:\"failed\" +\n    // error.code, like NO_PLAN_ENTRY/REL_TRAVERSAL) — NOT a throw — so the rest\n    // of the batch still plans + grants. The server decides routing here; it\n    // never trusts the client to self-limit.\n    const failTooLarge = (capBytes: number, planeNote: string) => {\n      ref.status = \"failed\";\n      ref.error = {\n        code: \"FILE_TOO_LARGE\",\n        message: `File exceeds the ${capBytes}-byte ${planeNote} (declared ${size} bytes)`,\n      };\n      delete ref.ifMatch; // a rejected entry is never uploaded\n    };\n    if (size > limits.maxBytes) {\n      // Over the grant-plane (R2-direct) product cap — reject on either plane.\n      failTooLarge(limits.maxBytes, \"upload limit\");\n    } else if (grantCapable && mountPrefix && src?.cid && size > 0) {\n      // grant-capable(signer) AND cid present AND 0 < size ≤ maxBytes → grant.\n      grantInputs.push({\n        ref,\n        providerRelPath: stripMount(finalPath, mountPrefix),\n        cid: src.cid,\n        size,\n        mimeType: src.mimeType,\n        ifMatch,\n      });\n    } else if (size > limits.legacyMaxBytes) {\n      // No grant capability (no signer / no cid / unknown size) AND too big for\n      // the legacy through-memory plane → reject. CRITICAL: never silently fall\n      // through to an UNCAPPED legacy write (design §5 / review R2).\n      failTooLarge(\n        limits.legacyMaxBytes,\n        \"legacy upload limit (configure an R2 signer for larger files)\",\n      );\n    }\n    // else → legacy: ref stays \"needs-upload\" (Phase 1 decoded-byte cap backstops);\n    // unknown/0 declared size also lands here (never granted on a 0 size).\n  }\n\n  let mode: \"grant\" | \"legacy\" = \"legacy\";\n  let sessionId: string | undefined;\n  let expiresAt: string | undefined;\n\n  if (grantInputs.length > 0 && mountPrefix) {\n    const prepRes = await afs.exec(\n      joinURL(mountPrefix, \".actions/prepare-upload\"),\n      {\n        entries: grantInputs.map((g) => ({\n          path: g.providerRelPath,\n          cid: g.cid,\n          size: g.size,\n          ...(g.mimeType ? { mimeType: g.mimeType } : {}),\n          ...(g.ifMatch ? { ifMatch: g.ifMatch } : {}),\n        })),\n      },\n      { context },\n    );\n    if (!prepRes?.success) {\n      return {\n        ok: false,\n        code: prepRes?.error?.code ?? \"AFS_ERROR\",\n        error: prepRes?.error?.message ?? \"prepare-upload failed\",\n      };\n    }\n    const pdata = prepRes.data as {\n      sessionId?: string;\n      expiresAt?: string;\n      entries?: Array<{\n        path?: string;\n        objectKey?: string;\n        checksumSha256?: string;\n        grant?: unknown;\n      }>;\n    };\n    mode = \"grant\";\n    sessionId = pdata.sessionId;\n    expiresAt = pdata.expiresAt;\n    const byPath = new Map((pdata.entries ?? []).map((e) => [e.path, e]));\n    for (const g of grantInputs) {\n      const pe = byPath.get(g.providerRelPath);\n      if (!pe) continue;\n      g.ref.objectKey = pe.objectKey;\n      g.ref.checksumSha256 = pe.checksumSha256;\n      if (pe.grant) g.ref.grant = pe.grant;\n    }\n  }\n\n  return {\n    ok: true,\n    data: {\n      mode,\n      protocolVersion: INGEST_PROTOCOL_VERSION,\n      ...(sessionId ? { sessionId, expiresAt } : {}),\n      entries: responseEntries,\n    },\n  };\n}\n\n// ── commit-upload ────────────────────────────────────────────────────────────\n\nasync function execCommitUpload(\n  afs: FacadeAFS,\n  args: Record<string, unknown>,\n  context: Record<string, unknown>,\n): Promise<FacadeResult> {\n  const sessionId = asStr(args.sessionId);\n  if (!sessionId) {\n    return { ok: false, code: \"AFS_VALIDATION_ERROR\", error: \"sessionId required\" };\n  }\n  const rawEntries = Array.isArray(args.entries) ? args.entries : null;\n  if (!rawEntries || rawEntries.length === 0) {\n    return { ok: false, code: \"AFS_VALIDATION_ERROR\", error: \"entries must be a non-empty array\" };\n  }\n  const firstPath = asStr((rawEntries[0] as { path?: unknown })?.path);\n  const mountPrefix = firstPath ? mountPrefixOf(firstPath) : null;\n  if (!mountPrefix) {\n    return {\n      ok: false,\n      code: \"AFS_VALIDATION_ERROR\",\n      error: \"entry.path must be a root-visible path\",\n    };\n  }\n\n  // Translate every entry's root-visible path → provider-relative for the mount.\n  const providerEntries = rawEntries.map((raw) => {\n    const e = raw as Record<string, unknown>;\n    const p = asStr(e.path);\n    return { ...e, path: p ? stripMount(p, mountPrefix) : p };\n  });\n\n  const res = await afs.exec(\n    joinURL(mountPrefix, \".actions/commit-upload\"),\n    { sessionId, entries: providerEntries },\n    { context },\n  );\n  if (!res?.success) {\n    return {\n      ok: false,\n      code: res?.error?.code ?? \"AFS_ERROR\",\n      error: res?.error?.message ?? \"commit-upload failed\",\n    };\n  }\n  // Re-add the mount prefix on every result path → root-visible for the browser.\n  const data = res.data as { results?: Array<Record<string, unknown>> } & Record<string, unknown>;\n  if (Array.isArray(data?.results)) {\n    data.results = data.results.map((r) => {\n      const out = { ...r };\n      const rp = asStr(r.path);\n      if (rp) out.path = addMount(rp, mountPrefix);\n      const inner = r.data as { path?: unknown } | undefined;\n      if (inner && asStr(inner.path)) {\n        out.data = { ...inner, path: addMount(inner.path as string, mountPrefix) };\n      }\n      return out;\n    });\n  }\n  return { ok: true, data };\n}\n\n// ── abort-upload ─────────────────────────────────────────────────────────────\n\nasync function execAbortUpload(\n  afs: FacadeAFS,\n  args: Record<string, unknown>,\n  context: Record<string, unknown>,\n): Promise<FacadeResult> {\n  const sessionId = asStr(args.sessionId);\n  if (!sessionId) {\n    return { ok: false, code: \"AFS_VALIDATION_ERROR\", error: \"sessionId required\" };\n  }\n  // abort carries no path; v1 routes to the single grant mount.\n  const res = await afs.exec(\n    joinURL(V1_GRANT_MOUNT, \".actions/abort-upload\"),\n    { sessionId },\n    { context },\n  );\n  if (!res?.success) {\n    return {\n      ok: false,\n      code: res?.error?.code ?? \"AFS_ERROR\",\n      error: res?.error?.message ?? \"abort-upload failed\",\n    };\n  }\n  return { ok: true, data: res.data };\n}\n\n// ── dispatch ─────────────────────────────────────────────────────────────────\n\n/**\n * Run a root-visible facade exec. Caller MUST pre-check {@link isIngestFacadePath}.\n * The authed-caller floor (design §4.7: all three are write-effect) is enforced\n * here — the CSRF/Origin guard is the afs-rpc handler's job upstream.\n */\nexport async function execIngestFacade(input: {\n  afs: FacadeAFS;\n  path: string;\n  args: Record<string, unknown>;\n  context: Record<string, unknown>;\n  caller: FacadeCaller | null;\n  /**\n   * Server-enforced upload caps (upload-limits Phase 2). The handler resolves\n   * them at the runtime single env-read point; only ingest-prepare consumes them\n   * (declared-size routing). Optional → safe defaults (never unlimited).\n   */\n  limits?: UploadLimits;\n}): Promise<FacadeResult> {\n  const { afs, path, args, context, caller } = input;\n  if (!caller?.did) {\n    return { status: 401, error: \"Authentication required for upload\" };\n  }\n  if (path === \"/.actions/ingest-prepare\") {\n    return execIngestPrepare(afs, args, context, input.limits ?? UPLOAD_LIMIT_DEFAULTS);\n  }\n  if (path === \"/.actions/commit-upload\") return execCommitUpload(afs, args, context);\n  return execAbortUpload(afs, args, context);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,0BAA0B;;AAGvC,MAAa,wBAAwB;CAAC;CAAkB;CAAiB;CAAe;;;;;;AAOxF,MAAM,iBAAiB;;AAiCvB,SAAgB,mBAAmB,MAAuB;AACxD,QAAO,sBAAsB,MAAM,MAAM,SAAS,aAAa,IAAI;;;;;;;AAQrE,SAAgB,uBAAuB,MAA0B;CAC/D,MAAM,MAAM,MAAM,QAAQ,KAAK,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE;CAChD,MAAM,OAAO,IAAI,IAAI,IAAI,KAAK,MAAO,GAA8B,GAAG,CAAC;AACvE,MAAK,MAAM,QAAQ,uBAAuB;AACxC,MAAI,KAAK,IAAI,KAAK,CAAE;AACpB,MAAI,KAAK;GACP,IAAI;GACJ,MAAM,QAAQ,aAAa,KAAK;GAChC,MAAM;IAAE,MAAM;IAAkB,iBAAiB;IAAyB;GAC3E,CAAC;;AAEJ,QAAO;;;AAMT,SAAS,cAAc,MAA6B;CAClD,MAAM,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC;AAC5C,QAAO,MAAM,IAAI,QAAQ;;;AAI3B,SAAS,WAAW,MAAc,aAA6B;AAC7D,KAAI,SAAS,YAAa,QAAO;CACjC,MAAM,MAAM,KAAK,MAAM,YAAY,OAAO;AAC1C,QAAO,IAAI,WAAW,IAAI,GAAG,MAAM,IAAI;;;AAIzC,SAAS,SAAS,aAAqB,aAA6B;AAClE,QAAO,QAAQ,aAAa,YAAY;;;AAI1C,eAAe,eACb,KACA,aACA,SACkB;AAClB,KAAI;EACF,MAAM,IAAI,MAAM,IAAI,KAAK,QAAQ,aAAa,WAAW,EAAE,EAAE,SAAS,CAAC;AAKvE,UAJiB,MAAM,QAAQ,GAAG,KAAK,GAAG,EAAE,OAAO,EAAE,EAItC,MAAM,MAAM,EAAE,OAAO,iBAAiB,EAAE,MAAM,oBAAoB;SAC3E;AACN,SAAO;;;AAIX,SAAS,MAAM,GAAgC;AAC7C,QAAO,OAAO,MAAM,YAAY,IAAI,IAAI;;AAY1C,eAAe,kBACb,KACA,MACA,SACA,QACuB;CACvB,MAAM,YAAY,MAAM,KAAK,UAAU;AACvC,KAAI,CAAC,UACH,QAAO;EACL,IAAI;EACJ,MAAM;EACN,OAAO;EACR;CAEH,MAAM,WAAW,kBAAkB,KAAK,SAAS,IAAI;CACrD,MAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,UAAU;AAChE,KAAI,CAAC,cAAc,WAAW,WAAW,EACvC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAwB,OAAO;EAAqC;CAEhG,MAAM,SAA8B,EAAE;AACtC,MAAK,MAAM,OAAO,YAAY;EAC5B,MAAM,QAAQ;EACd,MAAM,UAAU,MAAM,MAAM,QAAQ;AACpC,MAAI,CAAC,QACH,QAAO;GACL,IAAI;GACJ,MAAM;GACN,OAAO;GACR;AAEH,SAAO,KAAK;GACV;GACA,MAAM,OAAO,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,MAAM,OAAO;GACvE,UAAU,MAAM,MAAM,SAAS;GAC/B,KAAK,MAAM,MAAM,IAAI;GACtB,CAAC;;CAIJ,MAAM,OAAO,MAAM,WACjB,KACA,WACA,OAAO,KAAK,OAAO;EAAE,MAAM,EAAE;EAAS,SAAS,EAAE;EAAS,EAAE,EAC5D,SACD;CAED,MAAM,cAAc,cAAc,UAAU;CAC5C,MAAM,eAAe,cAAc,MAAM,eAAe,KAAK,aAAa,QAAQ,GAAG;CAIrF,MAAM,aAAa,aAAa,YAAY,aAAa;CAqBzD,MAAM,kBAAmC,EAAE;CAC3C,MAAM,cAA4B,EAAE;AAEpC,MAAK,MAAM,MAAM,KAAK,SAAS;AAC7B,MAAI,GAAG,WAAW,WAAW;AAC3B,mBAAgB,KAAK;IAAE,SAAS,GAAG;IAAS,WAAW,GAAG;IAAW,QAAQ;IAAW,CAAC;AACzF;;AAEF,MAAI,GAAG,WAAW,UAAU;AAC1B,mBAAgB,KAAK;IACnB,SAAS,GAAG;IACZ,WAAW,GAAG;IACd,QAAQ;IACR,OAAO,GAAG;IACX,CAAC;AACF;;EAGF,MAAM,YAAY,GAAG;EACrB,MAAM,UAAU,aAAa,qBAAqB;EAClD,MAAM,MAAqB;GACzB,SAAS,GAAG;GACZ;GACA,QAAQ;GACR,GAAI,UAAU,EAAE,SAAS,GAAG,EAAE;GAC/B;AACD,kBAAgB,KAAK,IAAI;EAEzB,MAAM,MAAM,OAAO,GAAG;EACtB,MAAM,OAAO,KAAK,QAAQ;EAO1B,MAAM,gBAAgB,UAAkB,cAAsB;AAC5D,OAAI,SAAS;AACb,OAAI,QAAQ;IACV,MAAM;IACN,SAAS,oBAAoB,SAAS,QAAQ,UAAU,aAAa,KAAK;IAC3E;AACD,UAAO,IAAI;;AAEb,MAAI,OAAO,OAAO,SAEhB,cAAa,OAAO,UAAU,eAAe;WACpC,gBAAgB,eAAe,KAAK,OAAO,OAAO,EAE3D,aAAY,KAAK;GACf;GACA,iBAAiB,WAAW,WAAW,YAAY;GACnD,KAAK,IAAI;GACT;GACA,UAAU,IAAI;GACd;GACD,CAAC;WACO,OAAO,OAAO,eAIvB,cACE,OAAO,gBACP,gEACD;;CAML,IAAI,OAA2B;CAC/B,IAAI;CACJ,IAAI;AAEJ,KAAI,YAAY,SAAS,KAAK,aAAa;EACzC,MAAM,UAAU,MAAM,IAAI,KACxB,QAAQ,aAAa,0BAA0B,EAC/C,EACE,SAAS,YAAY,KAAK,OAAO;GAC/B,MAAM,EAAE;GACR,KAAK,EAAE;GACP,MAAM,EAAE;GACR,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,GAAG,EAAE;GAC9C,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,EAAE;GAC5C,EAAE,EACJ,EACD,EAAE,SAAS,CACZ;AACD,MAAI,CAAC,SAAS,QACZ,QAAO;GACL,IAAI;GACJ,MAAM,SAAS,OAAO,QAAQ;GAC9B,OAAO,SAAS,OAAO,WAAW;GACnC;EAEH,MAAM,QAAQ,QAAQ;AAUtB,SAAO;AACP,cAAY,MAAM;AAClB,cAAY,MAAM;EAClB,MAAM,SAAS,IAAI,KAAK,MAAM,WAAW,EAAE,EAAE,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACrE,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,KAAK,OAAO,IAAI,EAAE,gBAAgB;AACxC,OAAI,CAAC,GAAI;AACT,KAAE,IAAI,YAAY,GAAG;AACrB,KAAE,IAAI,iBAAiB,GAAG;AAC1B,OAAI,GAAG,MAAO,GAAE,IAAI,QAAQ,GAAG;;;AAInC,QAAO;EACL,IAAI;EACJ,MAAM;GACJ;GACA,iBAAiB;GACjB,GAAI,YAAY;IAAE;IAAW;IAAW,GAAG,EAAE;GAC7C,SAAS;GACV;EACF;;AAKH,eAAe,iBACb,KACA,MACA,SACuB;CACvB,MAAM,YAAY,MAAM,KAAK,UAAU;AACvC,KAAI,CAAC,UACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAwB,OAAO;EAAsB;CAEjF,MAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ,GAAG,KAAK,UAAU;AAChE,KAAI,CAAC,cAAc,WAAW,WAAW,EACvC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAwB,OAAO;EAAqC;CAEhG,MAAM,YAAY,MAAO,WAAW,IAA2B,KAAK;CACpE,MAAM,cAAc,YAAY,cAAc,UAAU,GAAG;AAC3D,KAAI,CAAC,YACH,QAAO;EACL,IAAI;EACJ,MAAM;EACN,OAAO;EACR;CAIH,MAAM,kBAAkB,WAAW,KAAK,QAAQ;EAC9C,MAAM,IAAI;EACV,MAAM,IAAI,MAAM,EAAE,KAAK;AACvB,SAAO;GAAE,GAAG;GAAG,MAAM,IAAI,WAAW,GAAG,YAAY,GAAG;GAAG;GACzD;CAEF,MAAM,MAAM,MAAM,IAAI,KACpB,QAAQ,aAAa,yBAAyB,EAC9C;EAAE;EAAW,SAAS;EAAiB,EACvC,EAAE,SAAS,CACZ;AACD,KAAI,CAAC,KAAK,QACR,QAAO;EACL,IAAI;EACJ,MAAM,KAAK,OAAO,QAAQ;EAC1B,OAAO,KAAK,OAAO,WAAW;EAC/B;CAGH,MAAM,OAAO,IAAI;AACjB,KAAI,MAAM,QAAQ,MAAM,QAAQ,CAC9B,MAAK,UAAU,KAAK,QAAQ,KAAK,MAAM;EACrC,MAAM,MAAM,EAAE,GAAG,GAAG;EACpB,MAAM,KAAK,MAAM,EAAE,KAAK;AACxB,MAAI,GAAI,KAAI,OAAO,SAAS,IAAI,YAAY;EAC5C,MAAM,QAAQ,EAAE;AAChB,MAAI,SAAS,MAAM,MAAM,KAAK,CAC5B,KAAI,OAAO;GAAE,GAAG;GAAO,MAAM,SAAS,MAAM,MAAgB,YAAY;GAAE;AAE5E,SAAO;GACP;AAEJ,QAAO;EAAE,IAAI;EAAM;EAAM;;AAK3B,eAAe,gBACb,KACA,MACA,SACuB;CACvB,MAAM,YAAY,MAAM,KAAK,UAAU;AACvC,KAAI,CAAC,UACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAwB,OAAO;EAAsB;CAGjF,MAAM,MAAM,MAAM,IAAI,KACpB,QAAQ,gBAAgB,wBAAwB,EAChD,EAAE,WAAW,EACb,EAAE,SAAS,CACZ;AACD,KAAI,CAAC,KAAK,QACR,QAAO;EACL,IAAI;EACJ,MAAM,KAAK,OAAO,QAAQ;EAC1B,OAAO,KAAK,OAAO,WAAW;EAC/B;AAEH,QAAO;EAAE,IAAI;EAAM,MAAM,IAAI;EAAM;;;;;;;AAUrC,eAAsB,iBAAiB,OAYb;CACxB,MAAM,EAAE,KAAK,MAAM,MAAM,SAAS,WAAW;AAC7C,KAAI,CAAC,QAAQ,IACX,QAAO;EAAE,QAAQ;EAAK,OAAO;EAAsC;AAErE,KAAI,SAAS,2BACX,QAAO,kBAAkB,KAAK,MAAM,SAAS,MAAM,UAAU,sBAAsB;AAErF,KAAI,SAAS,0BAA2B,QAAO,iBAAiB,KAAK,MAAM,QAAQ;AACnF,QAAO,gBAAgB,KAAK,MAAM,QAAQ"}