@embedpdf/engine-core 3.0.0-next.13 → 3.0.0-next.15

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","names":[],"sources":["../src/promise/AbortablePromise.ts","../src/engine/document-security-state.ts","../src/engine/DocumentRenderService.ts","../src/engine/passwordPrompt.ts","../src/wire/WirePack.ts"],"sourcesContent":["import { AbortError } from './AbortError';\n\nexport type AbortableExecutor<T, P> = (\n  resolve: (value: T | PromiseLike<T>) => void,\n  reject: (reason: unknown) => void,\n  progress: (p: P) => void,\n  signal: AbortSignal,\n) => void;\n\n/**\n * Awaitable Promise subclass with abort and progress.\n *\n * Symbol.species returns plain Promise so chained .then/.catch/.finally\n * return regular promises and never try to synthesize a new\n * AbortablePromise (which would have no executor).\n *\n * Settlement contract:\n *   - The first settlement wins. resolve/reject handed to the executor\n *     are wrapped so that any subsequent call (whether by the executor,\n *     by abort(), or by both racing) becomes a silent no-op.\n *   - abort() rejects the public promise with AbortError immediately,\n *     even if the executor never observes the AbortSignal. The executor\n *     still receives the AbortSignal so it can stop real work\n *     cooperatively (release a queue slot, abort fetch, post a worker\n *     abort, etc.). Anything the executor does after that — including\n *     a late resolve(value), a late reject(error), or a rejected inner\n *     Promise inside AbortablePromise.run — is dropped silently.\n *   - abort() after settlement is a no-op.\n */\nexport class AbortablePromise<T, P = never> extends Promise<T> {\n  static override get [Symbol.species](): PromiseConstructor {\n    return Promise;\n  }\n\n  readonly signal: AbortSignal;\n\n  private readonly _ctrl: AbortController;\n  private readonly _progressCbs: Set<(p: P) => void>;\n  private readonly _state: { settled: boolean };\n  private readonly _internalReject: (reason: unknown) => void;\n\n  constructor(executor: AbortableExecutor<T, P>) {\n    const ctrl = new AbortController();\n    const progressCbs = new Set<(p: P) => void>();\n    const state = { settled: false };\n    let capturedReject!: (reason: unknown) => void;\n\n    super((resolve, reject) => {\n      capturedReject = reject;\n\n      const wrappedResolve = (value: T | PromiseLike<T>) => {\n        if (state.settled) return;\n        state.settled = true;\n        resolve(value);\n      };\n      const wrappedReject = (reason: unknown) => {\n        if (state.settled) return;\n        state.settled = true;\n        reject(reason);\n      };\n      const progress = (p: P) => {\n        if (state.settled) return;\n        for (const cb of progressCbs) {\n          try {\n            cb(p);\n          } catch {\n            // ignore subscriber errors\n          }\n        }\n      };\n\n      executor(wrappedResolve, wrappedReject, progress, ctrl.signal);\n    });\n\n    this._ctrl = ctrl;\n    this.signal = ctrl.signal;\n    this._progressCbs = progressCbs;\n    this._state = state;\n    this._internalReject = capturedReject;\n  }\n\n  /**\n   * Abort the underlying operation.\n   *\n   * - If the promise has already settled, this is a no-op.\n   * - Otherwise the public promise rejects synchronously with an\n   *   AbortError (wrapping the supplied reason if it is not already an\n   *   AbortError) and the AbortSignal fires for any cooperative\n   *   cancellation the executor wired up.\n   */\n  abort(reason?: unknown): void {\n    if (this._state.settled) return;\n    if (this._ctrl.signal.aborted) return;\n\n    const err = reason instanceof AbortError ? reason : new AbortError(reason);\n\n    // Mark settled before signalling so any abort listener the executor\n    // attached cannot race a late resolve/reject through the wrapped\n    // settlers (they all consult state.settled).\n    this._state.settled = true;\n    this._ctrl.abort(err);\n    this._internalReject(err);\n  }\n\n  /**\n   * Subscribe to progress events. Returns an unsubscribe function.\n   */\n  onProgress(cb: (p: P) => void): () => void {\n    this._progressCbs.add(cb);\n    return () => {\n      this._progressCbs.delete(cb);\n    };\n  }\n\n  /**\n   * Wrap a value in an already-resolved AbortablePromise. Mirrors Promise.resolve.\n   */\n  static resolveValue<T>(value: T | PromiseLike<T>): AbortablePromise<T> {\n    return new AbortablePromise<T>((resolve) => resolve(value));\n  }\n\n  /**\n   * Wrap a thrown reason in an already-rejected AbortablePromise.\n   */\n  static rejectReason<T = never>(reason: unknown): AbortablePromise<T> {\n    return new AbortablePromise<T>((_resolve, reject) => reject(reason));\n  }\n\n  /**\n   * Run an async function as an AbortablePromise so callers get .abort() and .signal.\n   * The async function receives the AbortSignal (and a progress emitter) so it can\n   * cooperate with the abort.\n   *\n   * If abort() fires while the inner async function is still running, the\n   * public promise rejects with AbortError immediately. The inner async\n   * function's eventual settlement (resolve or reject) is funneled through\n   * the wrapped settlers and silently dropped — including a late rejection\n   * from the underlying work, which prevents an UnhandledRejection because\n   * the .then(resolve, reject) below \"handles\" it via the no-op.\n   */\n  static run<T, P = never>(\n    fn: (signal: AbortSignal, progress: (p: P) => void) => Promise<T>,\n  ): AbortablePromise<T, P> {\n    return new AbortablePromise<T, P>((resolve, reject, progress, signal) => {\n      fn(signal, progress).then(resolve, reject);\n    });\n  }\n}\n","import type {\n  DocumentAccessReason,\n  DocumentSecurityState,\n  PdfPermissionAdvisory,\n  PdfPermissionInfo,\n} from './DocumentSecurityService';\nimport type { PdfBits } from '../auth/scope';\nimport type { DocumentSecurityProbeInfo } from '../wire/worker-protocol';\n\nexport interface DocumentHeadLike {\n  encryption: {\n    state: DocumentSecurityState['encryption']['state'];\n    requiresPassword: boolean | null;\n  };\n  permissions: DocumentSecurityState['permissions'];\n  access: DocumentSecurityState['access'];\n}\n\nexport function securityStateFromHead(head: DocumentHeadLike): DocumentSecurityState {\n  return {\n    encryption: {\n      state: head.encryption.state,\n      requiresPassword: head.encryption.requiresPassword,\n    },\n    permissions: { ...head.permissions },\n    access: {\n      required: head.access.required,\n      reasons: [...head.access.reasons],\n      ...(head.access.endpoint ? { endpoint: head.access.endpoint } : {}),\n    },\n  };\n}\n\nexport function permissionInfoFromProbe(info: DocumentSecurityProbeInfo): PdfPermissionInfo | null {\n  if (info.pdfPermissionsBits === null) return null;\n  return {\n    known: true,\n    bits: info.pdfPermissionsBits,\n    allAllowed: info.pdfPermissionsAllAllowed,\n    openedAs: info.pdfOpenedAs,\n    securityHandlerRevision: info.securityHandlerRevision,\n  };\n}\n\n/**\n * Same as {@link permissionInfoFromProbe} but additionally populates\n * `flags` (typed PdfBits view) and `advisory` (capability-shaped\n * booleans for UI badges). Used by routes that have a decoded `PdfBits`\n * in hand — notably `/access`, which always does.\n *\n * Returns `null` for the same reason as the base function — when the\n * PDF hasn't been probed yet so bits are unknown.\n */\nexport function permissionInfoWithAdvisory(\n  info: DocumentSecurityProbeInfo,\n  pdfBits: PdfBits,\n): PdfPermissionInfo | null {\n  const base = permissionInfoFromProbe(info);\n  if (!base) return null;\n  return {\n    ...base,\n    flags: pdfBits,\n    advisory: advisoryFromPdfBits(pdfBits),\n  };\n}\n\n/**\n * Translate a {@link PdfBits} view into the capability-shaped\n * {@link PdfPermissionAdvisory}. The rules here MUST mirror the bit\n * combinations the scope resolver uses for `pdf.permissions`\n * expansion — `doc.print.high` requires bit 12 AND bit 3, etc.\n */\nexport function advisoryFromPdfBits(b: PdfBits): PdfPermissionAdvisory {\n  return {\n    canPrint: b.bit3,\n    canPrintHigh: b.bit12 && b.bit3,\n    canCopy: b.bit5,\n    canAnnotate: b.bit6,\n    canFillForms: b.bit6 || b.bit9,\n    canModifyForms: b.bit6 && b.bit4,\n    canModifyPages: b.bit4,\n    canAssemble: b.bit11,\n  };\n}\n\nexport function securityStateFromProbe(\n  info: DocumentSecurityProbeInfo,\n  opts: { accessEndpoint?: string; cdnRequired?: boolean } = {},\n): DocumentSecurityState {\n  const permission = permissionInfoFromProbe(info);\n  const reasons: DocumentAccessReason[] = [];\n  if (info.encryptionRequiresPassword === true && !permission) reasons.push('password');\n  if (opts.cdnRequired) reasons.push('cdn');\n  if (info.encryptionState === 'unknown') reasons.push('permissions-unknown');\n\n  return {\n    encryption: {\n      state: info.encryptionState,\n      requiresPassword: info.encryptionRequiresPassword,\n    },\n    permissions: {\n      known: permission?.known ?? false,\n      bits: permission?.bits ?? null,\n      allAllowed: permission?.allAllowed ?? null,\n      openedAs: permission?.openedAs ?? null,\n      securityHandlerRevision: permission?.securityHandlerRevision ?? null,\n      canUpgradeToOwner: info.encryptionState === 'encrypted' && info.pdfOpenedAs !== 'owner',\n    },\n    access: {\n      required: reasons.length > 0,\n      reasons,\n      ...(reasons.length > 0 && opts.accessEndpoint ? { endpoint: opts.accessEndpoint } : {}),\n    },\n  };\n}\n","import { EngineError } from '../errors/EngineError';\nimport { EngineErrorCode } from '../errors/EngineErrorCode';\nimport type { PageRenderViewport } from '../dto/PageRender';\n\n/**\n * The engine's render-parameter policy.\n *\n * - `continuous` — any viewport renders exactly as requested. The LOCAL\n *   engine always answers this: rendering is in-process, there is no\n *   shared cache to protect, and exactness is the local product promise.\n * - `lattice` — the deployment treats a finite set of render points as\n *   durable, CDN-shared artifacts. The bounded quantity\n *   is OUTPUT PIXELS, never zoom:\n *\n *   - `fullPage.widths` — full-page renders quantize on `viewport.width`\n *     (a scale lattice bounds artifact COUNT but not SIZE: PDF page space\n *     is effectively unbounded, so scale 1 of a poster page is a memory\n *     bomb while width caps the dominant dimension by construction).\n *   - `tiles` — RESERVED for the deep-zoom vertical: a scale-based\n *     pyramid × fixed tile size, where per-job cost is constant. Absent\n *     until the tiling plugin ships; reserving the shape keeps the SDK\n *     contract from churning twice.\n *   - `maxRenderPixels` — the worker-side output budget for degenerate\n *     geometry (width bounds width, not height).\n *\n * The SDK never conforms a request implicitly — the same `render.image`\n * call must not return different pixels on local vs cloud. Conformance is\n * the caller's visible choice via {@link snapFullPageViewport}.\n */\nexport type EngineRenderPolicy =\n  | { readonly kind: 'continuous' }\n  | {\n      readonly kind: 'lattice';\n      readonly fullPage: { readonly widths: readonly number[] };\n      readonly tiles?: {\n        readonly tileSizes: readonly number[];\n        readonly scales: readonly number[];\n      };\n      /**\n       * Annotation-appearance lattice — SCALE-based, unlike full pages:\n       * an appearance is sized by `annotation.rect × scale`, rects span\n       * orders of magnitude (a 4pt caret vs a page-sized stamp), and the\n       * composite must track the PAGE's effective render scale or\n       * annotations sit blurry on a crisp raster. Small images → the\n       * ladder affords finer, taller steps than pages ever could.\n       */\n      readonly appearances?: { readonly scales: readonly number[] };\n      readonly maxRenderPixels?: number;\n      readonly formats: readonly ('webp' | 'png')[];\n      readonly background: 'white';\n      readonly enforced: boolean;\n    };\n\nexport const CONTINUOUS_RENDER_POLICY: EngineRenderPolicy = { kind: 'continuous' };\n\n/**\n * Document-scoped render policy surface (`doc.render`). Async because the\n * cloud engine learns its policy from `/v1/access`; the local engine\n * resolves immediately with `continuous`.\n *\n * Per-page rendering itself stays on `page(pon).render` — this service\n * carries POLICY, not pixels.\n */\nexport interface DocumentRenderService {\n  policy(): Promise<EngineRenderPolicy>;\n}\n\n/**\n * Conform a FULL-PAGE viewport to a render policy — the ONE snap\n * implementation, shared by every engine and plugin. Pure and explicit\n * by design:\n *\n * - `continuous` → identity (local/cloud plugin code stays byte-identical).\n * - `lattice` → returns a `width`-kind viewport at the smallest ladder\n *   width ≥ the requested detail (snap UP: always crisp, CSS downscales\n *   for free), capped at the largest width — detail beyond the cap is the\n *   tile pyramid's job, by design.\n * - `scale`-kind requests convert through the page's width in PDF user\n *   units — pass `opts.pageWidth` (the caller has it from the layout);\n *   omitting it for a scale viewport under a lattice policy is a\n *   programmer error and throws `InvalidArg`.\n */\nexport function snapFullPageViewport(\n  policy: EngineRenderPolicy,\n  viewport: PageRenderViewport,\n  opts?: { pageWidth?: number },\n): PageRenderViewport {\n  if (policy.kind === 'continuous') return viewport;\n  if (policy.fullPage.widths.length === 0) {\n    throw new EngineError(EngineErrorCode.InvalidArg, 'render policy has an empty width ladder');\n  }\n  const widths = [...policy.fullPage.widths].sort((a, b) => a - b);\n\n  let requested: number;\n  if (viewport.kind === 'width') {\n    requested = viewport.width;\n  } else {\n    const pageWidth = opts?.pageWidth;\n    if (pageWidth === undefined || pageWidth <= 0) {\n      throw new EngineError(\n        EngineErrorCode.InvalidArg,\n        'snapping a scale viewport to a width lattice requires opts.pageWidth',\n      );\n    }\n    requested = (viewport.scale ?? 1) * pageWidth;\n  }\n\n  const snapped = widths.find((width) => width >= requested) ?? widths[widths.length - 1]!;\n  return { kind: 'width', width: snapped };\n}\n\n/**\n * Conform an annotation-appearance scale to the policy's appearance\n * lattice. Same discipline as {@link snapFullPageViewport}: identity on\n * continuous (and when the policy carries no appearance block), snap UP,\n * cap at the largest point. Callers derive `scale` from the page's\n * effective render scale (`snappedWidth / pageWidth`, × devicePixelRatio\n * as needed) so composites stay crisp against the page raster.\n */\nexport function snapAppearanceScale(policy: EngineRenderPolicy, scale: number): number {\n  if (policy.kind === 'continuous' || policy.appearances === undefined) return scale;\n  if (policy.appearances.scales.length === 0) {\n    throw new EngineError(\n      EngineErrorCode.InvalidArg,\n      'render policy has an empty appearance-scale lattice',\n    );\n  }\n  const scales = [...policy.appearances.scales].sort((a, b) => a - b);\n  return scales.find((s) => s >= scale) ?? scales[scales.length - 1]!;\n}\n\n/**\n * Conform a tile-pyramid scale to the policy's tile lattice — the third\n * member of the `snap<PolicyBlock><Quantity>` family. Identity on\n * continuous and while the deployment doesn't advertise a `tiles` block\n * (the block is reserved until the deep-zoom vertical ships server-side;\n * the tiling client uses its own default pyramid then — see\n * plugin-render). Snap UP, cap at the largest scale: per-tile cost is\n * constant by construction (`tileSize²` pixels regardless of level), so\n * the cap bounds artifact COUNT, not memory.\n */\nexport function snapTileScale(policy: EngineRenderPolicy, scale: number): number {\n  if (policy.kind === 'continuous' || policy.tiles === undefined) return scale;\n  if (policy.tiles.scales.length === 0) {\n    throw new EngineError(\n      EngineErrorCode.InvalidArg,\n      'render policy has an empty tile-scale lattice',\n    );\n  }\n  const scales = [...policy.tiles.scales].sort((a, b) => a - b);\n  return scales.find((s) => s >= scale) ?? scales[scales.length - 1]!;\n}\n","/**\n * Unified \"should I ask the user for a password?\" shape.\n *\n * A PDF has two distinct password moments:\n *   1. **Required** — the document is encrypted and we couldn't read\n *      anything anonymously. The dev MUST gather a password and call\n *      `unlock()` before any other operation succeeds.\n *   2. **Optional** — the document is open and readable, but more\n *      permissions become available with the owner password. The dev\n *      MAY surface an \"unlock for full access\" affordance.\n *\n * Plus the trivial third state: **none** — nothing to do.\n *\n * The discriminated union encodes the invariants:\n *   - `required` and `optional` cannot both be true (a doc you can't\n *     read can't be \"upgraded\" — you have to read first).\n *   - `hint` is only present when meaningful (no hint in the `none` arm,\n *     mandatory `owner` hint in `optional` since that's the only thing\n *     an upgrade asks for).\n *\n * Computed identically on local + cloud via\n * {@link passwordPromptFromState} so the dev's UI gating code is\n * engine-agnostic.\n */\nimport type { DocumentSecurityState } from './DocumentSecurityService';\n\nexport type PasswordPrompt =\n  | { readonly state: 'none' }\n  | { readonly state: 'required'; readonly hint: 'user' | 'owner' | null }\n  | { readonly state: 'optional'; readonly hint: 'owner' };\n\n/**\n * Derive the high-level password prompt from the raw security state.\n *\n * The function is pure and total — every `DocumentSecurityState`\n * maps to exactly one `PasswordPrompt`. Use this as the SINGLE source\n * of truth wherever the SDK exposes a \"do you need a password?\" flag:\n * both `LocalDocumentSecurityService` and `CloudDocumentSecurityService`\n * call it, so the contract can never drift.\n *\n * Mapping rules (top to bottom; first match wins):\n *\n *   1. encryption.state === 'none'\n *      → { state: 'none' }              the document isn't encrypted\n *\n *   2. !permissions.known\n *      → { state: 'required', hint: null }   we haven't probed yet; can't\n *                                            tell user-vs-owner; show\n *                                            generic prompt\n *\n *   3. requiresPassword && openedAs === 'none'\n *      → { state: 'required', hint: 'user' }   encrypted, anonymous open\n *                                              failed → user pwd needed\n *\n *   4. openedAs === 'owner'\n *      → { state: 'none' }              already at the top — nothing more\n *                                       to unlock\n *\n *   5. permissions.canUpgradeToOwner === true\n *      → { state: 'optional', hint: 'owner' }   open as user (or as none\n *                                               for owner-pwd-only docs)\n *                                               but more is available\n *\n *   6. fallthrough → { state: 'none' }   open and nothing more available\n */\nexport function passwordPromptFromState(state: DocumentSecurityState): PasswordPrompt {\n  if (state.encryption.state === 'none') {\n    return { state: 'none' };\n  }\n\n  if (!state.permissions.known) {\n    return { state: 'required', hint: null };\n  }\n\n  if (state.encryption.requiresPassword && state.permissions.openedAs === 'none') {\n    return { state: 'required', hint: 'user' };\n  }\n\n  if (state.permissions.openedAs === 'owner') {\n    return { state: 'none' };\n  }\n\n  if (state.permissions.canUpgradeToOwner) {\n    return { state: 'optional', hint: 'owner' };\n  }\n\n  return { state: 'none' };\n}\n","/**\n * Wire-level packaging for messages crossing a Web Worker / Node\n * `worker_thread` boundary.\n *\n * `WirePack<P>` is the typed pair every producer hands to a transport:\n * the structured payload (validated against the wire schema) and an\n * explicit, ordered list of `Transferable` objects that the producer\n * intends to move (zero-copy) to the receiver.\n *\n * Why this is a first-class type and not a transport-side argument:\n *\n *   - **Producer is the only one who knows.** Whether a particular\n *     `ArrayBuffer` should be moved (zero-copy, sender's reference\n *     detached) or copied (structured-cloned, both sides retain\n *     access) is a semantic decision belonging to the code that\n *     produced the buffer. Inferring it later — by walking the\n *     payload looking for `ArrayBuffer` instances and assuming they\n *     should all be transferred — is the v2 footgun this design\n *     replaces.\n *\n *   - **Type-checked at the boundary.** A handler returning\n *     `WirePack<RenderResult>` cannot forget to declare its\n *     transfer list; the producer literally writes\n *     `wirePack({ ..., pixels }, [pixels.buffer])` in a single\n *     return statement. Forgetting yields a structurally identical\n *     copy (slow but correct), never a silent leak.\n *\n *   - **Symmetric across the boundary.** Same `WirePack<P>` on the\n *     request path (main → worker) and the response path (worker →\n *     main). Inline transports treat `transfer` as a no-op since\n *     there's no thread boundary to cross.\n *\n *   - **Schema-orthogonal.** Zod schemas validate `payload` and\n *     nothing else. `transfer` is not data; it's a memory-ownership\n *     manifest, and the design keeps those concerns separate.\n *\n * The receiver of a `postMessage(payload, { transfer })` call gets\n * the payload back **with the listed buffers already moved into it**\n * — there's no second argument on the receiving end. So `WirePack`\n * only ever travels the producer-to-transport leg of the trip; the\n * consumer side just sees the unwrapped `payload`.\n */\nexport interface WirePack<P> {\n  readonly payload: P;\n  readonly transfer: readonly Transferable[];\n}\n\n/**\n * Singleton empty transfer list. Frozen so accidental in-place\n * mutation throws in strict mode rather than silently mutating the\n * default for future calls.\n */\nexport const EMPTY_TRANSFER: readonly Transferable[] = Object.freeze([]);\n\n/**\n * Producer-side helper: pair a typed payload with its transfer list.\n *\n * The `transfer` argument is optional; omitting it (or passing `[]`)\n * is the explicit, type-checked way to say \"I declare this message\n * carries no transferables.\" That's structurally identical to the\n * shape the v2 walker generated for non-binary messages, but here\n * the declaration is at construction time, in the producer's own\n * code, where the knowledge actually lives.\n *\n *   wirePack({ kind: 'metadata.read', jobId, docId })\n *   wirePack({ kind: 'open.fatMem', jobId, docId, bytes }, [bytes])\n *   wirePack({ tag: 'page.render', pixels }, [pixels.buffer])\n */\nexport function wirePack<P>(\n  payload: P,\n  transfer: readonly Transferable[] = EMPTY_TRANSFER,\n): WirePack<P> {\n  return { payload, transfer };\n}\n"],"mappings":";;;;;;;AA8BuB,kBAAA,OAAO;;;;;;;;;;;;;;;;;;;;;AAD9B,IAAa,mBAAb,MAAa,yBAAuC,QAAW;CAC7D,YAAA,mBAA2D;EACzD,OAAO;CACT;CASA,YAAY,UAAmC;EAC7C,MAAM,OAAO,IAAI,gBAAgB;EACjC,MAAM,8BAAc,IAAI,IAAoB;EAC5C,MAAM,QAAQ,EAAE,SAAS,MAAM;EAC/B,IAAI;EAEJ,OAAO,SAAS,WAAW;GACzB,iBAAiB;GAEjB,MAAM,kBAAkB,UAA8B;IACpD,IAAI,MAAM,SAAS;IACnB,MAAM,UAAU;IAChB,QAAQ,KAAK;GACf;GACA,MAAM,iBAAiB,WAAoB;IACzC,IAAI,MAAM,SAAS;IACnB,MAAM,UAAU;IAChB,OAAO,MAAM;GACf;GACA,MAAM,YAAY,MAAS;IACzB,IAAI,MAAM,SAAS;IACnB,KAAK,MAAM,MAAM,aACf,IAAI;KACF,GAAG,CAAC;IACN,QAAQ,CAER;GAEJ;GAEA,SAAS,gBAAgB,eAAe,UAAU,KAAK,MAAM;EAC/D,CAAC;EAtCM,gBAAA,MAAA,UAAA,KAAA,CAAA;EAEQ,gBAAA,MAAA,SAAA,KAAA,CAAA;EACA,gBAAA,MAAA,gBAAA,KAAA,CAAA;EACA,gBAAA,MAAA,UAAA,KAAA,CAAA;EACA,gBAAA,MAAA,mBAAA,KAAA,CAAA;EAmCf,KAAK,QAAQ;EACb,KAAK,SAAS,KAAK;EACnB,KAAK,eAAe;EACpB,KAAK,SAAS;EACd,KAAK,kBAAkB;CACzB;;;;;;;;;;CAWA,MAAM,QAAwB;EAC5B,IAAI,KAAK,OAAO,SAAS;EACzB,IAAI,KAAK,MAAM,OAAO,SAAS;EAE/B,MAAM,MAAM,kBAAkB,aAAa,SAAS,IAAI,WAAW,MAAM;EAKzE,KAAK,OAAO,UAAU;EACtB,KAAK,MAAM,MAAM,GAAG;EACpB,KAAK,gBAAgB,GAAG;CAC1B;;;;CAKA,WAAW,IAAgC;EACzC,KAAK,aAAa,IAAI,EAAE;EACxB,aAAa;GACX,KAAK,aAAa,OAAO,EAAE;EAC7B;CACF;;;;CAKA,OAAO,aAAgB,OAAgD;EACrE,OAAO,IAAI,kBAAqB,YAAY,QAAQ,KAAK,CAAC;CAC5D;;;;CAKA,OAAO,aAAwB,QAAsC;EACnE,OAAO,IAAI,kBAAqB,UAAU,WAAW,OAAO,MAAM,CAAC;CACrE;;;;;;;;;;;;;CAcA,OAAO,IACL,IACwB;EACxB,OAAO,IAAI,kBAAwB,SAAS,QAAQ,UAAU,WAAW;GACvE,GAAG,QAAQ,QAAQ,CAAC,CAAC,KAAK,SAAS,MAAM;EAC3C,CAAC;CACH;AACF;;;ACjIA,SAAgB,sBAAsB,MAA+C;CACnF,OAAO;EACL,YAAY;GACV,OAAO,KAAK,WAAW;GACvB,kBAAkB,KAAK,WAAW;EACpC;EACA,aAAa,EAAE,GAAG,KAAK,YAAY;EACnC,QAAQ;GACN,UAAU,KAAK,OAAO;GACtB,SAAS,CAAC,GAAG,KAAK,OAAO,OAAO;GAChC,GAAI,KAAK,OAAO,WAAW,EAAE,UAAU,KAAK,OAAO,SAAS,IAAI,CAAC;EACnE;CACF;AACF;AAEA,SAAgB,wBAAwB,MAA2D;CACjG,IAAI,KAAK,uBAAuB,MAAM,OAAO;CAC7C,OAAO;EACL,OAAO;EACP,MAAM,KAAK;EACX,YAAY,KAAK;EACjB,UAAU,KAAK;EACf,yBAAyB,KAAK;CAChC;AACF;;;;;;;;;;AAWA,SAAgB,2BACd,MACA,SAC0B;CAC1B,MAAM,OAAO,wBAAwB,IAAI;CACzC,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EACL,GAAG;EACH,OAAO;EACP,UAAU,oBAAoB,OAAO;CACvC;AACF;;;;;;;AAQA,SAAgB,oBAAoB,GAAmC;CACrE,OAAO;EACL,UAAU,EAAE;EACZ,cAAc,EAAE,SAAS,EAAE;EAC3B,SAAS,EAAE;EACX,aAAa,EAAE;EACf,cAAc,EAAE,QAAQ,EAAE;EAC1B,gBAAgB,EAAE,QAAQ,EAAE;EAC5B,gBAAgB,EAAE;EAClB,aAAa,EAAE;CACjB;AACF;AAEA,SAAgB,uBACd,MACA,OAA2D,CAAC,GACrC;CACvB,MAAM,aAAa,wBAAwB,IAAI;CAC/C,MAAM,UAAkC,CAAC;CACzC,IAAI,KAAK,+BAA+B,QAAQ,CAAC,YAAY,QAAQ,KAAK,UAAU;CACpF,IAAI,KAAK,aAAa,QAAQ,KAAK,KAAK;CACxC,IAAI,KAAK,oBAAoB,WAAW,QAAQ,KAAK,qBAAqB;CAE1E,OAAO;EACL,YAAY;GACV,OAAO,KAAK;GACZ,kBAAkB,KAAK;EACzB;EACA,aAAa;GACX,OAAO,YAAY,SAAS;GAC5B,MAAM,YAAY,QAAQ;GAC1B,YAAY,YAAY,cAAc;GACtC,UAAU,YAAY,YAAY;GAClC,yBAAyB,YAAY,2BAA2B;GAChE,mBAAmB,KAAK,oBAAoB,eAAe,KAAK,gBAAgB;EAClF;EACA,QAAQ;GACN,UAAU,QAAQ,SAAS;GAC3B;GACA,GAAI,QAAQ,SAAS,KAAK,KAAK,iBAAiB,EAAE,UAAU,KAAK,eAAe,IAAI,CAAC;EACvF;CACF;AACF;;;AC7DA,MAAa,2BAA+C,EAAE,MAAM,aAAa;;;;;;;;;;;;;;;;AA6BjF,SAAgB,qBACd,QACA,UACA,MACoB;CACpB,IAAI,OAAO,SAAS,cAAc,OAAO;CACzC,IAAI,OAAO,SAAS,OAAO,WAAW,GACpC,MAAM,IAAI,YAAY,gBAAgB,YAAY,yCAAyC;CAE7F,MAAM,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;CAE/D,IAAI;CACJ,IAAI,SAAS,SAAS,SACpB,YAAY,SAAS;MAChB;EACL,MAAM,YAAY,MAAM;EACxB,IAAI,cAAc,KAAA,KAAa,aAAa,GAC1C,MAAM,IAAI,YACR,gBAAgB,YAChB,sEACF;EAEF,aAAa,SAAS,SAAS,KAAK;CACtC;CAGA,OAAO;EAAE,MAAM;EAAS,OADR,OAAO,MAAM,UAAU,SAAS,SAAS,KAAK,OAAO,OAAO,SAAS;CAC9C;AACzC;;;;;;;;;AAUA,SAAgB,oBAAoB,QAA4B,OAAuB;CACrF,IAAI,OAAO,SAAS,gBAAgB,OAAO,gBAAgB,KAAA,GAAW,OAAO;CAC7E,IAAI,OAAO,YAAY,OAAO,WAAW,GACvC,MAAM,IAAI,YACR,gBAAgB,YAChB,qDACF;CAEF,MAAM,SAAS,CAAC,GAAG,OAAO,YAAY,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;CAClE,OAAO,OAAO,MAAM,MAAM,KAAK,KAAK,KAAK,OAAO,OAAO,SAAS;AAClE;;;;;;;;;;;AAYA,SAAgB,cAAc,QAA4B,OAAuB;CAC/E,IAAI,OAAO,SAAS,gBAAgB,OAAO,UAAU,KAAA,GAAW,OAAO;CACvE,IAAI,OAAO,MAAM,OAAO,WAAW,GACjC,MAAM,IAAI,YACR,gBAAgB,YAChB,+CACF;CAEF,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;CAC5D,OAAO,OAAO,MAAM,MAAM,KAAK,KAAK,KAAK,OAAO,OAAO,SAAS;AAClE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtFA,SAAgB,wBAAwB,OAA8C;CACpF,IAAI,MAAM,WAAW,UAAU,QAC7B,OAAO,EAAE,OAAO,OAAO;CAGzB,IAAI,CAAC,MAAM,YAAY,OACrB,OAAO;EAAE,OAAO;EAAY,MAAM;CAAK;CAGzC,IAAI,MAAM,WAAW,oBAAoB,MAAM,YAAY,aAAa,QACtE,OAAO;EAAE,OAAO;EAAY,MAAM;CAAO;CAG3C,IAAI,MAAM,YAAY,aAAa,SACjC,OAAO,EAAE,OAAO,OAAO;CAGzB,IAAI,MAAM,YAAY,mBACpB,OAAO;EAAE,OAAO;EAAY,MAAM;CAAQ;CAG5C,OAAO,EAAE,OAAO,OAAO;AACzB;;;;;;;;ACnCA,MAAa,iBAA0C,OAAO,OAAO,CAAC,CAAC;;;;;;;;;;;;;;;AAgBvE,SAAgB,SACd,SACA,WAAoC,gBACvB;CACb,OAAO;EAAE;EAAS;CAAS;AAC7B"}
+{"version":3,"file":"runtime.js","names":[],"sources":["../src/events/DocumentEventStream.ts","../src/events/EventHub.ts","../src/events/changeEvents.ts","../src/engine/document-security-state.ts","../src/scheduling/place.ts","../src/engine/passwordPrompt.ts","../src/wire/WirePack.ts"],"sourcesContent":["import type { DocumentEvent, DocumentEventOf, DocumentEventType } from './DocumentEvent';\n\n/**\n * The subscription surface on `DocumentHandle.events`: every event with\n * `subscribe`, one type with `on`. No replay-from-id: plugins build their\n * own filter wrappers (per-page, …) on top.\n *\n * Delivery is synchronous fan-out with error isolation: a throwing\n * listener never blocks other listeners, and never fails the mutation\n * whose confirmation produced the event.\n */\nexport interface DocumentEventStream {\n  /** Subscribe to every event for this document. Returns the unsubscriber. */\n  subscribe(listener: (event: DocumentEvent) => void): () => void;\n  /** Subscribe to one type of event, typed by it. Returns the unsubscriber. */\n  on<T extends DocumentEventType>(\n    type: T,\n    listener: (event: DocumentEventOf<T>) => void,\n  ): () => void;\n  /**\n   * Highest `origin.serverId` observed so far — the reconnect/backfill\n   * cursor for the remote channel. `null` until a remote-identified event\n   * has been seen (always `null` on purely-local engines).\n   */\n  lastServerId(): number | null;\n}\n\n/**\n * `on(type, listener)` built on a stream's `subscribe`, so both engines\n * filter the same way and a type listener counts as a subscriber (the cloud\n * opens its live stream for the first one).\n */\nexport function subscribeToType<T extends DocumentEventType>(\n  subscribe: DocumentEventStream['subscribe'],\n  type: T,\n  listener: (event: DocumentEventOf<T>) => void,\n): () => void {\n  return subscribe((event) => {\n    if (event.type === type) listener(event as DocumentEventOf<T>);\n  });\n}\n","import type {\n  DocumentEvent,\n  DocumentEventInit,\n  DocumentEventOf,\n  DocumentEventType,\n} from './DocumentEvent';\nimport { subscribeToType, type DocumentEventStream } from './DocumentEventStream';\n\n/**\n * The in-process implementation of `DocumentEventStream`, shared by both\n * engine shells (one hub per open `DocumentHandle`). The engine that\n * performs a mutation publishes here at confirmation time; the cloud\n * engine's remote channel will also publish here for other sessions'\n * mutations — listeners never learn which transport delivered an event.\n *\n * Delivery contract:\n *   - synchronous fan-out in subscription order;\n *   - error isolation: a throwing listener is re-thrown on a microtask\n *     (so it surfaces to the host's unhandled-error reporting) without\n *     blocking other listeners or failing the mutation path;\n *   - `lastServerId` tracks the highest remote cursor seen, for the\n *     remote channel's reconnect/backfill.\n */\nexport class EventHub implements DocumentEventStream {\n  private readonly listeners = new Set<(event: DocumentEvent) => void>();\n  private serverId: number | null = null;\n\n  constructor(\n    /** Where a throwing listener's error goes. Defaults to an async\n     *  rethrow so it reaches the host's unhandled-error reporting. */\n    private readonly onListenerError: (err: unknown) => void = (err) => {\n      queueMicrotask(() => {\n        throw err;\n      });\n    },\n  ) {}\n\n  subscribe(listener: (event: DocumentEvent) => void): () => void {\n    this.listeners.add(listener);\n    return () => {\n      this.listeners.delete(listener);\n    };\n  }\n\n  on<T extends DocumentEventType>(\n    type: T,\n    listener: (event: DocumentEventOf<T>) => void,\n  ): () => void {\n    return subscribeToType((all) => this.subscribe(all), type, listener);\n  }\n\n  publish(event: DocumentEvent): void {\n    // Transport notices (`stream.desynced`) carry no origin; only mutation\n    // events advance the server cursor.\n    if ('origin' in event) {\n      const { serverId } = event.origin;\n      if (serverId !== null) {\n        this.serverId = this.serverId === null ? serverId : Math.max(this.serverId, serverId);\n      }\n    }\n    // Snapshot so a listener that (un)subscribes mid-fan-out cannot skew\n    // delivery for this event.\n    for (const listener of [...this.listeners]) {\n      try {\n        listener(event);\n      } catch (err) {\n        this.onListenerError(err);\n      }\n    }\n  }\n\n  lastServerId(): number | null {\n    return this.serverId;\n  }\n\n  /** Drop every listener (handle close). Idempotent. */\n  clear(): void {\n    this.listeners.clear();\n  }\n}\n\n/**\n * Stamps provenance onto events a mutation path produces. One per open\n * handle: the engine shell constructs it with the instance's `sessionId`\n * (and, on cloud, the authenticated `sub` when known) and hands it to the\n * mutation services — they publish results, never build origins.\n */\nexport class SessionEventPublisher {\n  constructor(\n    private readonly hub: EventHub,\n    private readonly sessionId: string,\n    private readonly sub: string | null = null,\n  ) {}\n\n  /**\n   * Publish what one write of this session just committed: one\n   * event per fact, in order, all carrying the write's `opId` as\n   * `origin.tx`.\n   */\n  publishWrite(opId: string, ...events: DocumentEventInit[]): void {\n    this.publishChange(opId, events);\n  }\n\n  /**\n   * Publish what one change committed: its events as {@link publishWrite}\n   * does, and for an undo, the `opId` of the change it undid.\n   */\n  publishChange(opId: string, events: readonly DocumentEventInit[], undoOf?: string): void {\n    const ts = Date.now();\n    events.forEach((event, index) => {\n      this.hub.publish({\n        ...event,\n        origin: {\n          kind: 'local',\n          sessionId: this.sessionId,\n          sub: this.sub,\n          ts,\n          serverId: null,\n          tx: { id: opId, index, count: events.length },\n          ...(undoOf !== undefined ? { undoOf } : {}),\n        },\n      } as DocumentEvent);\n    });\n  }\n}\n","import type { DocumentEventInit } from './DocumentEvent';\nimport { deletedAnnotationsOf } from '../mutation/AnnotationMutationResults';\nimport { isSkippedItem, type ChangeItem, type ChangeResult } from '../mutation/Change';\nimport { deletedFieldOf, formResetFacts } from '../mutation/FormMutationResults';\nimport { annotationImportFacts } from '../transfer/annotationImport';\nimport { formImportFacts, formValuesImportFacts } from '../transfer/formImport';\n\n/**\n * The events a change publishes: each op's events as its single verb\n * publishes them, in op order. An op an undo left alone entirely publishes\n * nothing. The publisher stamps them all with the change's `opId`.\n */\nexport function changeEvents(result: ChangeResult): DocumentEventInit[] {\n  return result.items.flatMap(itemEvents);\n}\n\nfunction itemEvents(item: ChangeItem): DocumentEventInit[] {\n  if (isSkippedItem(item)) return [];\n  switch (item.type) {\n    case 'annotations.create': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'annotations.created', ...result }];\n    }\n    case 'annotations.update': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return [{ type: 'annotations.updated', ...result }];\n    }\n    case 'annotations.delete': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'annotations.deleted', deleted: deletedAnnotationsOf(result), ...result }];\n    }\n    case 'annotations.reorder': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'annotations.reordered', ...result }];\n    }\n    case 'annotations.restore': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'annotations.restored', ...result }];\n    }\n    case 'annotations.import': {\n      const { type: _type, ...result } = item;\n      return annotationImportFacts(result).map((fact) => ({\n        type: 'annotations.created' as const,\n        ...fact,\n      }));\n    }\n    case 'forms.import': {\n      const { type: _type, ...result } = item;\n      return formImportFacts(result).map((fact) => ({ type: 'forms.created' as const, ...fact }));\n    }\n    case 'forms.importValues': {\n      const { type: _type, ...result } = item;\n      return formValuesImportFacts(result).map((fact) => ({\n        type: 'forms.valueSet' as const,\n        ...fact,\n      }));\n    }\n    case 'forms.setValue': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.valueSet', ...result }];\n    }\n    case 'forms.reset': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return formResetFacts(result).map((fact) => ({ type: 'forms.valueSet' as const, ...fact }));\n    }\n    case 'forms.setDisplay':\n    case 'forms.setAppearanceText':\n    case 'forms.setSignatureAppearance': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.updated', ...result }];\n    }\n    case 'forms.update': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return [{ type: 'forms.updated', ...result }];\n    }\n    case 'forms.create': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.created', ...result }];\n    }\n    case 'forms.delete': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.deleted', deleted: deletedFieldOf(result), ...result }];\n    }\n    case 'forms.restore': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.restored', ...result }];\n    }\n    case 'forms.addWidget': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.widgetAdded', ...result }];\n    }\n    case 'forms.removeWidget': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.widgetRemoved', ...result }];\n    }\n    case 'forms.deleteWidget': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.widgetDeleted', ...result }];\n    }\n    case 'forms.restoreWidget': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.widgetRestored', ...result }];\n    }\n    case 'forms.reorderWidgets': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.widgetsReordered', ...result }];\n    }\n    case 'forms.reorderCalculations': {\n      const { type: _type, ...result } = item;\n      return [{ type: 'forms.calculationsReordered', ...result }];\n    }\n    case 'forms.updateWidget': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return [{ type: 'forms.widgetUpdated', ...result }];\n    }\n    case 'metadata.update': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return [{ type: 'metadata.updated', ...result }];\n    }\n    case 'metadata.updateCustom': {\n      const { type: _type, skipped: _skipped, ...result } = item;\n      return [{ type: 'metadata.customUpdated', ...result }];\n    }\n  }\n}\n","import type {\n  DocumentAccessReason,\n  DocumentSecurityState,\n  PdfPermissionAdvisory,\n  PdfPermissionInfo,\n} from './DocumentSecurityService';\nimport { materializePdfPermissions, type PdfBits } from '../auth/scope';\nimport type { DocumentSecurityProbeInfo } from '../wire/worker-protocol';\n\nexport interface DocumentHeadLike {\n  encryption: {\n    state: DocumentSecurityState['encryption']['state'];\n    requiresPassword: boolean | null;\n  };\n  permissions: DocumentSecurityState['permissions'];\n  access: DocumentSecurityState['access'];\n}\n\nexport function securityStateFromHead(head: DocumentHeadLike): DocumentSecurityState {\n  return {\n    encryption: {\n      state: head.encryption.state,\n      requiresPassword: head.encryption.requiresPassword,\n    },\n    permissions: { ...head.permissions },\n    access: {\n      required: head.access.required,\n      reasons: [...head.access.reasons],\n      ...(head.access.endpoint ? { endpoint: head.access.endpoint } : {}),\n    },\n  };\n}\n\nexport function permissionInfoFromProbe(info: DocumentSecurityProbeInfo): PdfPermissionInfo | null {\n  if (info.pdfPermissionsBits === null) return null;\n  return {\n    known: true,\n    bits: info.pdfPermissionsBits,\n    allAllowed: info.pdfPermissionsAllAllowed,\n    openedAs: info.pdfOpenedAs,\n    securityHandlerRevision: info.securityHandlerRevision,\n  };\n}\n\n/**\n * Same as {@link permissionInfoFromProbe} but additionally populates\n * `flags` (typed PdfBits view) and `advisory` (capability-shaped\n * booleans for UI badges). Used by routes that have a decoded `PdfBits`\n * in hand — notably `/access`, which always does.\n *\n * Returns `null` for the same reason as the base function — when the\n * PDF hasn't been probed yet so bits are unknown.\n */\nexport function permissionInfoWithAdvisory(\n  info: DocumentSecurityProbeInfo,\n  pdfBits: PdfBits,\n): PdfPermissionInfo | null {\n  const base = permissionInfoFromProbe(info);\n  if (!base) return null;\n  return {\n    ...base,\n    flags: pdfBits,\n    advisory: advisoryFromPdfBits(pdfBits),\n  };\n}\n\n/**\n * Translate a {@link PdfBits} view into the capability-shaped\n * {@link PdfPermissionAdvisory}: what `pdf.permissions` grants on a file\n * with these bits.\n */\nexport function advisoryFromPdfBits(b: PdfBits): PdfPermissionAdvisory {\n  const granted = new Set(materializePdfPermissions(b));\n  return {\n    canPrint: granted.has('doc.print'),\n    canPrintHigh: granted.has('doc.print.high'),\n    canCopy: granted.has('doc.text.copy'),\n    canAnnotate: granted.has('doc.annotate.modify'),\n    canFillForms: granted.has('doc.forms.fill'),\n    canModifyForms: granted.has('doc.forms.modify'),\n    canModifyPages: granted.has('doc.pages.modify'),\n    canAssemble: granted.has('doc.pages.assemble'),\n  };\n}\n\nexport function securityStateFromProbe(\n  info: DocumentSecurityProbeInfo,\n  opts: { accessEndpoint?: string; cdnRequired?: boolean } = {},\n): DocumentSecurityState {\n  const permission = permissionInfoFromProbe(info);\n  const reasons: DocumentAccessReason[] = [];\n  if (info.encryptionRequiresPassword === true && !permission) reasons.push('password');\n  if (opts.cdnRequired) reasons.push('cdn');\n  if (info.encryptionState === 'unknown') reasons.push('permissions-unknown');\n\n  return {\n    encryption: {\n      state: info.encryptionState,\n      requiresPassword: info.encryptionRequiresPassword,\n    },\n    permissions: {\n      known: permission?.known ?? false,\n      bits: permission?.bits ?? null,\n      allAllowed: permission?.allAllowed ?? null,\n      openedAs: permission?.openedAs ?? null,\n      securityHandlerRevision: permission?.securityHandlerRevision ?? null,\n      canUpgradeToOwner: info.encryptionState === 'encrypted' && info.pdfOpenedAs !== 'owner',\n    },\n    access: {\n      required: reasons.length > 0,\n      reasons,\n      ...(reasons.length > 0 && opts.accessEndpoint ? { endpoint: opts.accessEndpoint } : {}),\n    },\n  };\n}\n","/**\n * Where a job is on screen, and how soon it runs: the pure half of the\n * engine's scheduling. The views say what they show (`WorkingSetPage`); a\n * job's place follows from its page, the part of the page it's about, and the\n * view it serves. Nothing here names a request kind or a plugin.\n */\nimport type { CallPriority, WorkingSetPage } from './facts';\nimport type { PageBox } from '../geometry/pageSpace';\nimport type { PageRef } from '../identity/PageRef';\n\n/** Where a job's page is: on screen, placed just off it, or in no view. */\nexport type Place = 'visible' | 'near' | 'elsewhere';\n\n/** A job's place, and the device pixels of its page on screen there. */\nexport interface Placed {\n  readonly place: Place;\n  readonly pixels: number;\n}\n\n/** What a job is about, for its place: its page, the part of it, and the view it serves. */\nexport interface JobTarget {\n  /** Absent: the job is about the whole document. */\n  readonly page?: PageRef;\n  /** The part of the page, in page space (a tile). Absent: the whole page. */\n  readonly region?: PageBox;\n  readonly view?: string;\n}\n\n/** One document's working sets: per view, the pages it shows by object number. */\nexport type ViewSets = ReadonlyMap<string, ReadonlyMap<number, WorkingSetPage>>;\n\nconst PLACE_ORDER: Record<Place, number> = { elsewhere: 0, near: 1, visible: 2 };\n\n/** More device pixels than any screen shows, so pixels never outweigh the rest of a rank. */\nconst PIXEL_SPAN = 2 ** 40;\n\n/** What {@link rank} needs to know about a job besides its place. */\nexport interface RankedJob {\n  readonly priority: CallPriority;\n  /** Present for a job about part of a page (a tile). */\n  readonly region?: PageBox;\n}\n\nconst ELSEWHERE: Placed = { place: 'elsewhere', pixels: 0 };\nconst ON_SCREEN: Placed = { place: 'visible', pixels: 0 };\n\n/** Whether `a` is the better place: on screen before near before elsewhere, then more pixels. */\nexport function placedBefore(a: Placed, b: Placed): boolean {\n  const order = PLACE_ORDER[a.place] - PLACE_ORDER[b.place];\n  return order !== 0 ? order > 0 : a.pixels > b.pixels;\n}\n\n/**\n * A job's place in one view: its page's role there, except that a part of a\n * visible page that's off screen (a tile of the ring around what shows) is\n * `near`.\n */\nexport function placeIn(entry: WorkingSetPage | undefined, job: JobTarget): Placed {\n  if (!entry) return ELSEWHERE;\n  if (entry.role === 'near') return { place: 'near', pixels: 0 };\n  if (job.region && entry.visible && !overlaps(job.region, entry.visible)) {\n    return { place: 'near', pixels: 0 };\n  }\n  return { place: 'visible', pixels: entry.pixels };\n}\n\n/**\n * A job's place among a document's views: in the view it serves, or, when it\n * serves none (or one that said nothing), the best place its page has in any\n * view. A job about the whole document serves what's shown, so it counts as\n * on screen. While no view says anything, every job is on screen alike, and\n * jobs run in the order they were asked.\n */\nexport function placeFor(job: JobTarget, views: ViewSets): Placed {\n  if (views.size === 0 || !job.page) return ON_SCREEN;\n  const objectNumber = job.page.objectNumber;\n  const served = job.view === undefined ? undefined : views.get(job.view);\n  if (served) return placeIn(served.get(objectNumber), job);\n  let best = ELSEWHERE;\n  for (const pages of views.values()) {\n    const placed = placeIn(pages.get(objectNumber), job);\n    if (placedBefore(placed, best)) best = placed;\n  }\n  return best;\n}\n\n/**\n * How soon a job runs among those that may run: higher first. It compares, in\n * turn:\n * 1. background last: a `low` call is about nothing the views show;\n * 2. where its page is: on screen, then just off it, then elsewhere;\n * 3. its priority: `high` (the picture of the page itself) before `auto`;\n * 4. a whole page before a part of one: a tile is only of use once its page\n *    is there;\n * 5. the device pixels its page shows.\n * Equal ranks run in the order they were asked, so a caller sequences its own work.\n */\nexport function rank(job: RankedJob, placed: Placed): number {\n  let level = job.priority === 'low' ? 0 : 1;\n  level = level * 3 + PLACE_ORDER[placed.place];\n  level = level * 2 + (job.priority === 'high' ? 1 : 0);\n  level = level * 2 + (job.region ? 0 : 1);\n  return level * PIXEL_SPAN + Math.min(PIXEL_SPAN - 1, Math.round(placed.pixels));\n}\n\n/**\n * Whether rank `a` beats rank `b` on more than pixels (any of the first four\n * steps of {@link rank}). A running job gives way only to a job that clearly\n * outranks it, so two pages on screen never stop each other's work, and jobs\n * don't flip back and forth while the camera moves.\n */\nexport function clearlyOutranks(a: number, b: number): boolean {\n  return Math.floor(a / PIXEL_SPAN) > Math.floor(b / PIXEL_SPAN);\n}\n\nfunction overlaps(a: PageBox, b: PageBox): boolean {\n  return a.x < b.x + b.width && b.x < a.x + a.width && a.y < b.y + b.height && b.y < a.y + a.height;\n}\n","/**\n * Unified \"should I ask the user for a password?\" shape.\n *\n * A PDF has two distinct password moments:\n *   1. **Required** — the document is encrypted and we couldn't read\n *      anything anonymously. The dev must gather a password and call\n *      `unlock()` before any other operation succeeds.\n *   2. **Optional** — the document is open and readable, but more\n *      permissions become available with the owner password. The dev\n *      may surface an \"unlock for full access\" affordance.\n *\n * Plus the trivial third state: **none** — nothing to do.\n *\n * The discriminated union encodes the invariants:\n *   - `required` and `optional` cannot both be true (a doc you can't\n *     read can't be \"upgraded\" — you have to read first).\n *   - `hint` is only present when meaningful (no hint in the `none` arm,\n *     mandatory `owner` hint in `optional` since that's the only thing\n *     an upgrade asks for).\n *\n * Computed identically on local + cloud via\n * {@link passwordPromptFromState} so the dev's UI gating code is\n * engine-agnostic.\n */\nimport type { DocumentSecurityState } from './DocumentSecurityService';\n\nexport type PasswordPrompt =\n  | { readonly state: 'none' }\n  | {\n      readonly state: 'required';\n      readonly hint: 'user' | 'owner' | null;\n      /**\n       * The last password tried (at `open()` or `unlock()`) was wrong, so a\n       * prompt can say so. A wrong password opens the document locked, as no\n       * password does: one path for \"this file needs a password\".\n       */\n      readonly incorrect: boolean;\n    }\n  | { readonly state: 'optional'; readonly hint: 'owner' };\n\n/**\n * Derive the high-level password prompt from the raw security state.\n *\n * The function is pure and total — every `DocumentSecurityState`\n * maps to exactly one `PasswordPrompt`. Use this as the single source\n * of truth wherever the SDK exposes a \"do you need a password?\" flag:\n * both `LocalDocumentSecurityService` and `CloudDocumentSecurityService`\n * call it, so the contract can never drift.\n *\n * Mapping rules (top to bottom; first match wins):\n *\n *   1. encryption.state === 'none'\n *      → { state: 'none' }              the document isn't encrypted\n *\n *   2. !permissions.known\n *      → { state: 'required', hint: null }   we haven't probed yet; can't\n *                                            tell user-vs-owner; show\n *                                            generic prompt\n *\n *   3. requiresPassword && openedAs === 'none'\n *      → { state: 'required', hint: 'user' }   encrypted, anonymous open\n *                                              failed → user pwd needed\n *\n *   4. openedAs === 'owner'\n *      → { state: 'none' }              already at the top — nothing more\n *                                       to unlock\n *\n *   5. permissions.canUpgradeToOwner === true\n *      → { state: 'optional', hint: 'owner' }   open as user (or as none\n *                                               for owner-pwd-only docs)\n *                                               but more is available\n *\n *   6. fallthrough → { state: 'none' }   open and nothing more available\n */\nexport function passwordPromptFromState(\n  state: DocumentSecurityState,\n  incorrect = false,\n): PasswordPrompt {\n  if (state.encryption.state === 'none') {\n    return { state: 'none' };\n  }\n\n  if (!state.permissions.known) {\n    return { state: 'required', hint: null, incorrect };\n  }\n\n  if (state.encryption.requiresPassword && state.permissions.openedAs === 'none') {\n    return { state: 'required', hint: 'user', incorrect };\n  }\n\n  if (state.permissions.openedAs === 'owner') {\n    return { state: 'none' };\n  }\n\n  if (state.permissions.canUpgradeToOwner) {\n    return { state: 'optional', hint: 'owner' };\n  }\n\n  return { state: 'none' };\n}\n","/**\n * Wire-level packaging for messages crossing a Web Worker / Node\n * `worker_thread` boundary.\n *\n * `WirePack<P>` is the typed pair every producer hands to a transport:\n * the structured payload (validated against the wire schema) and an\n * explicit, ordered list of `Transferable` objects that the producer\n * intends to move (zero-copy) to the receiver.\n *\n * Why this is a first-class type and not a transport-side argument:\n *\n *   - **Producer is the only one who knows.** Whether a particular\n *     `ArrayBuffer` should be moved (zero-copy, sender's reference\n *     detached) or copied (structured-cloned, both sides retain\n *     access) is a semantic decision belonging to the code that\n *     produced the buffer. Inferring it later — by walking the\n *     payload looking for `ArrayBuffer` instances and assuming they\n *     should all be transferred — detaches buffers the producer\n *     meant to keep.\n *\n *   - **Type-checked at the boundary.** A handler returning\n *     `WirePack<RenderResult>` cannot forget to declare its\n *     transfer list; the producer literally writes\n *     `wirePack({ ..., pixels }, [pixels.buffer])` in a single\n *     return statement. Forgetting yields a structurally identical\n *     copy (slow but correct), never a silent leak.\n *\n *   - **Symmetric across the boundary.** Same `WirePack<P>` on the\n *     request path (main → worker) and the response path (worker →\n *     main). Inline transports treat `transfer` as a no-op since\n *     there's no thread boundary to cross.\n *\n *   - **Schema-orthogonal.** Zod schemas validate `payload` and\n *     nothing else. `transfer` is not data; it's a memory-ownership\n *     manifest, and the design keeps those concerns separate.\n *\n * The receiver of a `postMessage(payload, { transfer })` call gets\n * the payload back **with the listed buffers already moved into it**\n * — there's no second argument on the receiving end. So `WirePack`\n * only ever travels the producer-to-transport leg of the trip; the\n * consumer side just sees the unwrapped `payload`.\n */\nexport interface WirePack<P> {\n  readonly payload: P;\n  readonly transfer: readonly Transferable[];\n}\n\n/**\n * Singleton empty transfer list. Frozen so accidental in-place\n * mutation throws in strict mode rather than silently mutating the\n * default for future calls.\n */\nexport const EMPTY_TRANSFER: readonly Transferable[] = Object.freeze([]);\n\n/**\n * Producer-side helper: pair a typed payload with its transfer list.\n *\n * The `transfer` argument is optional; omitting it (or passing `[]`)\n * is the explicit, type-checked way to say \"I declare this message\n * carries no transferables.\" The declaration is made at construction\n * time, in the producer's own code, where the knowledge actually lives.\n *\n *   wirePack({ kind: 'metadata.read', jobId, docId })\n *   wirePack({ kind: 'open.fatMem', jobId, docId, bytes }, [bytes])\n *   wirePack({ tag: 'page.render', pixels }, [pixels.buffer])\n */\nexport function wirePack<P>(\n  payload: P,\n  transfer: readonly Transferable[] = EMPTY_TRANSFER,\n): WirePack<P> {\n  return { payload, transfer };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,gBACd,WACA,MACA,UACY;CACZ,OAAO,WAAW,UAAU;EAC1B,IAAI,MAAM,SAAS,MAAM,SAAS,KAA2B;CAC/D,CAAC;AACH;;;;;;;;;;;;;;;;;;ACjBA,IAAa,WAAb,MAAqD;CAInD,YAGE,mBAA4D,QAAQ;EAClE,qBAAqB;GACnB,MAAM;EACR,CAAC;CACH,GACA;EALiB,KAAA,kBAAA;EANF,gBAAA,MAAA,6BAAY,IAAI,IAAoC,CAAA;EAC7D,gBAAA,MAAA,YAA0B,IAAA;CAU/B;CAEH,UAAU,UAAsD;EAC9D,KAAK,UAAU,IAAI,QAAQ;EAC3B,aAAa;GACX,KAAK,UAAU,OAAO,QAAQ;EAChC;CACF;CAEA,GACE,MACA,UACY;EACZ,OAAO,iBAAiB,QAAQ,KAAK,UAAU,GAAG,GAAG,MAAM,QAAQ;CACrE;CAEA,QAAQ,OAA4B;EAGlC,IAAI,YAAY,OAAO;GACrB,MAAM,EAAE,aAAa,MAAM;GAC3B,IAAI,aAAa,MACf,KAAK,WAAW,KAAK,aAAa,OAAO,WAAW,KAAK,IAAI,KAAK,UAAU,QAAQ;EAExF;EAGA,KAAK,MAAM,YAAY,CAAC,GAAG,KAAK,SAAS,GACvC,IAAI;GACF,SAAS,KAAK;EAChB,SAAS,KAAK;GACZ,KAAK,gBAAgB,GAAG;EAC1B;CAEJ;CAEA,eAA8B;EAC5B,OAAO,KAAK;CACd;;CAGA,QAAc;EACZ,KAAK,UAAU,MAAM;CACvB;AACF;;;;;;;AAQA,IAAa,wBAAb,MAAmC;CACjC,YACE,KACA,WACA,MAAsC,MACtC;EAHiB,KAAA,MAAA;EACA,KAAA,YAAA;EACA,KAAA,MAAA;CAChB;;;;;;CAOH,aAAa,MAAc,GAAG,QAAmC;EAC/D,KAAK,cAAc,MAAM,MAAM;CACjC;;;;;CAMA,cAAc,MAAc,QAAsC,QAAuB;EACvF,MAAM,KAAK,KAAK,IAAI;EACpB,OAAO,SAAS,OAAO,UAAU;GAC/B,KAAK,IAAI,QAAQ;IACf,GAAG;IACH,QAAQ;KACN,MAAM;KACN,WAAW,KAAK;KAChB,KAAK,KAAK;KACV;KACA,UAAU;KACV,IAAI;MAAE,IAAI;MAAM;MAAO,OAAO,OAAO;KAAO;KAC5C,GAAI,WAAW,KAAA,IAAY,EAAE,OAAO,IAAI,CAAC;IAC3C;GACF,CAAkB;EACpB,CAAC;CACH;AACF;;;;;;;;AChHA,SAAgB,aAAa,QAA2C;CACtE,OAAO,OAAO,MAAM,QAAQ,UAAU;AACxC;AAEA,SAAS,WAAW,MAAuC;CACzD,IAAI,cAAc,IAAI,GAAG,OAAO,CAAC;CACjC,QAAQ,KAAK,MAAb;EACE,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAuB,GAAG;GAAO,CAAC;EACpD;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,CAAC;IAAE,MAAM;IAAuB,GAAG;GAAO,CAAC;EACpD;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAuB,SAAS,qBAAqB,MAAM;IAAG,GAAG;GAAO,CAAC;EAC3F;EACA,KAAK,uBAAuB;GAC1B,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAyB,GAAG;GAAO,CAAC;EACtD;EACA,KAAK,uBAAuB;GAC1B,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAwB,GAAG;GAAO,CAAC;EACrD;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,sBAAsB,MAAM,CAAC,CAAC,KAAK,UAAU;IAClD,MAAM;IACN,GAAG;GACL,EAAE;EACJ;EACA,KAAK,gBAAgB;GACnB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,gBAAgB,MAAM,CAAC,CAAC,KAAK,UAAU;IAAE,MAAM;IAA0B,GAAG;GAAK,EAAE;EAC5F;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,sBAAsB,MAAM,CAAC,CAAC,KAAK,UAAU;IAClD,MAAM;IACN,GAAG;GACL,EAAE;EACJ;EACA,KAAK,kBAAkB;GACrB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAkB,GAAG;GAAO,CAAC;EAC/C;EACA,KAAK,eAAe;GAClB,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,eAAe,MAAM,CAAC,CAAC,KAAK,UAAU;IAAE,MAAM;IAA2B,GAAG;GAAK,EAAE;EAC5F;EACA,KAAK;EACL,KAAK;EACL,KAAK,gCAAgC;GACnC,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAiB,GAAG;GAAO,CAAC;EAC9C;EACA,KAAK,gBAAgB;GACnB,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,CAAC;IAAE,MAAM;IAAiB,GAAG;GAAO,CAAC;EAC9C;EACA,KAAK,gBAAgB;GACnB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAiB,GAAG;GAAO,CAAC;EAC9C;EACA,KAAK,gBAAgB;GACnB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAiB,SAAS,eAAe,MAAM;IAAG,GAAG;GAAO,CAAC;EAC/E;EACA,KAAK,iBAAiB;GACpB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAkB,GAAG;GAAO,CAAC;EAC/C;EACA,KAAK,mBAAmB;GACtB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAqB,GAAG;GAAO,CAAC;EAClD;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAuB,GAAG;GAAO,CAAC;EACpD;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAuB,GAAG;GAAO,CAAC;EACpD;EACA,KAAK,uBAAuB;GAC1B,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAAwB,GAAG;GAAO,CAAC;EACrD;EACA,KAAK,wBAAwB;GAC3B,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAA0B,GAAG;GAAO,CAAC;EACvD;EACA,KAAK,6BAA6B;GAChC,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW;GACnC,OAAO,CAAC;IAAE,MAAM;IAA+B,GAAG;GAAO,CAAC;EAC5D;EACA,KAAK,sBAAsB;GACzB,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,CAAC;IAAE,MAAM;IAAuB,GAAG;GAAO,CAAC;EACpD;EACA,KAAK,mBAAmB;GACtB,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,CAAC;IAAE,MAAM;IAAoB,GAAG;GAAO,CAAC;EACjD;EACA,KAAK,yBAAyB;GAC5B,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,GAAG,WAAW;GACtD,OAAO,CAAC;IAAE,MAAM;IAA0B,GAAG;GAAO,CAAC;EACvD;CACF;AACF;;;AC1GA,SAAgB,sBAAsB,MAA+C;CACnF,OAAO;EACL,YAAY;GACV,OAAO,KAAK,WAAW;GACvB,kBAAkB,KAAK,WAAW;EACpC;EACA,aAAa,EAAE,GAAG,KAAK,YAAY;EACnC,QAAQ;GACN,UAAU,KAAK,OAAO;GACtB,SAAS,CAAC,GAAG,KAAK,OAAO,OAAO;GAChC,GAAI,KAAK,OAAO,WAAW,EAAE,UAAU,KAAK,OAAO,SAAS,IAAI,CAAC;EACnE;CACF;AACF;AAEA,SAAgB,wBAAwB,MAA2D;CACjG,IAAI,KAAK,uBAAuB,MAAM,OAAO;CAC7C,OAAO;EACL,OAAO;EACP,MAAM,KAAK;EACX,YAAY,KAAK;EACjB,UAAU,KAAK;EACf,yBAAyB,KAAK;CAChC;AACF;;;;;;;;;;AAWA,SAAgB,2BACd,MACA,SAC0B;CAC1B,MAAM,OAAO,wBAAwB,IAAI;CACzC,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EACL,GAAG;EACH,OAAO;EACP,UAAU,oBAAoB,OAAO;CACvC;AACF;;;;;;AAOA,SAAgB,oBAAoB,GAAmC;CACrE,MAAM,UAAU,IAAI,IAAI,0BAA0B,CAAC,CAAC;CACpD,OAAO;EACL,UAAU,QAAQ,IAAI,WAAW;EACjC,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,SAAS,QAAQ,IAAI,eAAe;EACpC,aAAa,QAAQ,IAAI,qBAAqB;EAC9C,cAAc,QAAQ,IAAI,gBAAgB;EAC1C,gBAAgB,QAAQ,IAAI,kBAAkB;EAC9C,gBAAgB,QAAQ,IAAI,kBAAkB;EAC9C,aAAa,QAAQ,IAAI,oBAAoB;CAC/C;AACF;AAEA,SAAgB,uBACd,MACA,OAA2D,CAAC,GACrC;CACvB,MAAM,aAAa,wBAAwB,IAAI;CAC/C,MAAM,UAAkC,CAAC;CACzC,IAAI,KAAK,+BAA+B,QAAQ,CAAC,YAAY,QAAQ,KAAK,UAAU;CACpF,IAAI,KAAK,aAAa,QAAQ,KAAK,KAAK;CACxC,IAAI,KAAK,oBAAoB,WAAW,QAAQ,KAAK,qBAAqB;CAE1E,OAAO;EACL,YAAY;GACV,OAAO,KAAK;GACZ,kBAAkB,KAAK;EACzB;EACA,aAAa;GACX,OAAO,YAAY,SAAS;GAC5B,MAAM,YAAY,QAAQ;GAC1B,YAAY,YAAY,cAAc;GACtC,UAAU,YAAY,YAAY;GAClC,yBAAyB,YAAY,2BAA2B;GAChE,mBAAmB,KAAK,oBAAoB,eAAe,KAAK,gBAAgB;EAClF;EACA,QAAQ;GACN,UAAU,QAAQ,SAAS;GAC3B;GACA,GAAI,QAAQ,SAAS,KAAK,KAAK,iBAAiB,EAAE,UAAU,KAAK,eAAe,IAAI,CAAC;EACvF;CACF;AACF;;;ACnFA,MAAM,cAAqC;CAAE,WAAW;CAAG,MAAM;CAAG,SAAS;AAAE;;AAG/E,MAAM,aAAa,KAAK;AASxB,MAAM,YAAoB;CAAE,OAAO;CAAa,QAAQ;AAAE;AAC1D,MAAM,YAAoB;CAAE,OAAO;CAAW,QAAQ;AAAE;;AAGxD,SAAgB,aAAa,GAAW,GAAoB;CAC1D,MAAM,QAAQ,YAAY,EAAE,SAAS,YAAY,EAAE;CACnD,OAAO,UAAU,IAAI,QAAQ,IAAI,EAAE,SAAS,EAAE;AAChD;;;;;;AAOA,SAAgB,QAAQ,OAAmC,KAAwB;CACjF,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,MAAM,SAAS,QAAQ,OAAO;EAAE,OAAO;EAAQ,QAAQ;CAAE;CAC7D,IAAI,IAAI,UAAU,MAAM,WAAW,CAAC,SAAS,IAAI,QAAQ,MAAM,OAAO,GACpE,OAAO;EAAE,OAAO;EAAQ,QAAQ;CAAE;CAEpC,OAAO;EAAE,OAAO;EAAW,QAAQ,MAAM;CAAO;AAClD;;;;;;;;AASA,SAAgB,SAAS,KAAgB,OAAyB;CAChE,IAAI,MAAM,SAAS,KAAK,CAAC,IAAI,MAAM,OAAO;CAC1C,MAAM,eAAe,IAAI,KAAK;CAC9B,MAAM,SAAS,IAAI,SAAS,KAAA,IAAY,KAAA,IAAY,MAAM,IAAI,IAAI,IAAI;CACtE,IAAI,QAAQ,OAAO,QAAQ,OAAO,IAAI,YAAY,GAAG,GAAG;CACxD,IAAI,OAAO;CACX,KAAK,MAAM,SAAS,MAAM,OAAO,GAAG;EAClC,MAAM,SAAS,QAAQ,MAAM,IAAI,YAAY,GAAG,GAAG;EACnD,IAAI,aAAa,QAAQ,IAAI,GAAG,OAAO;CACzC;CACA,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,KAAK,KAAgB,QAAwB;CAC3D,IAAI,QAAQ,IAAI,aAAa,QAAQ,IAAI;CACzC,QAAQ,QAAQ,IAAI,YAAY,OAAO;CACvC,QAAQ,QAAQ,KAAK,IAAI,aAAa,SAAS,IAAI;CACnD,QAAQ,QAAQ,KAAK,IAAI,SAAS,IAAI;CACtC,OAAO,QAAQ,aAAa,KAAK,IAAI,aAAa,GAAG,KAAK,MAAM,OAAO,MAAM,CAAC;AAChF;;;;;;;AAQA,SAAgB,gBAAgB,GAAW,GAAoB;CAC7D,OAAO,KAAK,MAAM,IAAI,UAAU,IAAI,KAAK,MAAM,IAAI,UAAU;AAC/D;AAEA,SAAS,SAAS,GAAY,GAAqB;CACjD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;AAC7F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3CA,SAAgB,wBACd,OACA,YAAY,OACI;CAChB,IAAI,MAAM,WAAW,UAAU,QAC7B,OAAO,EAAE,OAAO,OAAO;CAGzB,IAAI,CAAC,MAAM,YAAY,OACrB,OAAO;EAAE,OAAO;EAAY,MAAM;EAAM;CAAU;CAGpD,IAAI,MAAM,WAAW,oBAAoB,MAAM,YAAY,aAAa,QACtE,OAAO;EAAE,OAAO;EAAY,MAAM;EAAQ;CAAU;CAGtD,IAAI,MAAM,YAAY,aAAa,SACjC,OAAO,EAAE,OAAO,OAAO;CAGzB,IAAI,MAAM,YAAY,mBACpB,OAAO;EAAE,OAAO;EAAY,MAAM;CAAQ;CAG5C,OAAO,EAAE,OAAO,OAAO;AACzB;;;;;;;;AC/CA,MAAa,iBAA0C,OAAO,OAAO,CAAC,CAAC;;;;;;;;;;;;;AAcvE,SAAgB,SACd,SACA,WAAoC,gBACvB;CACb,OAAO;EAAE;EAAS;CAAS;AAC7B"}