@filelayer/core 0.3.0

package/dist/delivery.js

@@ -0,0 +1,519 @@
+/**
+ * BYTE DELIVERY -- the library owns the response, not the developer.
+ *
+ * A security review found three live defects here and correctly identified their
+ * common root cause: `read()` and `redeem()` handed back a `Uint8Array` and
+ * left everything that happens to those bytes on the way to a browser as the
+ * application's problem. Three of the four security-sensitive decisions the
+ * library was still leaving to the developer lived in that gap:
+ *
+ *   - no `X-Content-Type-Options: nosniff` / `Content-Disposition` on the
+ *     authenticated read  -> a user-uploaded .html or .svg executes in OUR OWN
+ *     origin. Stored XSS with full session access, cross-tenant reach.
+ *   - no `Cache-Control: no-store` on the share download -> a revoked link is
+ *     replayable from disk cache or an intermediary. This one is worse than it
+ *     sounds: immediate revocation is the product's headline property, and a
+ *     cache replay partially defeats it.
+ *   - the share password in the query string -> the secret AND the password
+ *     land in access logs, proxy logs, browser history, and the `Referer`
+ *     header of any outbound link inside the delivered document.
+ *
+ * The fix is not "document the headers". A decision the developer can forget is
+ * a decision they will eventually forget, which is the entire premise of this
+ * design. So:
+ *
+ *   1. `read()` and `redeem()` now return a DELIVERY DESCRIPTOR -- bytes plus
+ *      the exact headers required to serve them safely. The headers are
+ *      computed by the library from the file record; there is no argument that
+ *      turns them off.
+ *   2. Framework-agnostic writers are provided (`toResponse` for anything with
+ *      a WHATWG `Response`, `sendNodeResponse` for `node:http`), so the
+ *      developer writes one line and cannot write the wrong headers.
+ *   3. For the share path the library owns the ROUTE, not just the response,
+ *      because the password-in-the-URL defect is a routing decision rather than
+ *      a response decision. `shareDownloadRoute()` reads the password from the
+ *      request body and REFUSES, loudly, with 400, if a credential appears in
+ *      the query string. A silent decision has been converted into a noisy one,
+ *      which by our own definition means it stops being a security-sensitive
+ *      decision at all.
+ *
+ * Residual, stated plainly: `delivery.body` is still a public field, so a
+ * developer who ignores the helpers and hand-writes `res.end(d.body)` gets the
+ * old behaviour. This is "hard to get wrong", not "impossible to get wrong".
+ * Making it impossible would mean never exposing the bytes, which would break
+ * every non-HTTP consumer (a queue worker, a virus scanner, a thumbnailer).
+ * We chose the weaker guarantee deliberately and state it rather than hide it.
+ */
+import { FilelayerError } from "./errors.js";
+/**
+ * The literal a developer must type to enable redirect delivery.
+ *
+ * A boolean would be typed once and forgotten. A sentence has to be read to be
+ * copied, it appears verbatim in the diff, and it shows up in a grep of the
+ * codebase when someone asks "do we ever hand out URLs that outlive a
+ * revocation?" -- which is the question this whole mode exists to make
+ * answerable.
+ */
+export const REDIRECT_ACKNOWLEDGEMENT = 'I accept a revocation window of up to ttlSeconds on redirected deliveries';
+/**
+ * Our ceiling, not the object store's. Five minutes is long enough for a client
+ * to follow a redirect on a bad mobile connection and short enough that the
+ * residual window is something you can put in a compliance document without
+ * flinching.
+ */
+export const MAX_REDIRECT_TTL_SECONDS = 300;
+export const DEFAULT_REDIRECT_TTL_SECONDS = 60;
+export function resolveRedirectConfig(cfg) {
+    if (cfg.acknowledgeRevocationWindow !== REDIRECT_ACKNOWLEDGEMENT) {
+        throw new FilelayerError(500, 'redirect_not_acknowledged', 'redirect delivery requires the verbatim REDIRECT_ACKNOWLEDGEMENT string');
+    }
+    const requested = cfg.ttlSeconds ?? DEFAULT_REDIRECT_TTL_SECONDS;
+    if (!Number.isFinite(requested) || requested < 1) {
+        throw new FilelayerError(500, 'redirect_bad_ttl', 'ttlSeconds must be >= 1');
+    }
+    return {
+        // Clamped, not rejected: a config that asks for a day gets five minutes and
+        // keeps working. Rejecting would tempt someone to "fix" it by removing the
+        // bound.
+        ttlSeconds: Math.min(Math.floor(requested), MAX_REDIRECT_TTL_SECONDS),
+        scope: cfg.scope ?? 'anonymous-grants-only',
+    };
+}
+/**
+ * Content types that execute, or can be made to execute, in the origin that
+ * serves them. Served inline, any of these is stored XSS against your own
+ * application. `Content-Disposition: attachment` already defeats this in every
+ * current browser, so this list is the second layer: when a caller explicitly
+ * asks for `inline` (PDF preview, image thumbnails -- both legitimate), an
+ * active type is downgraded to `application/octet-stream` and the disposition
+ * is forced back to `attachment`.
+ *
+ * The predicate is deliberately broader than the list: anything whose type or
+ * subtype mentions html, xml, svg or script is treated as active, because the
+ * failure mode of being too strict is "the PDF downloads instead of previewing"
+ * and the failure mode of being too lax is session theft.
+ */
+const ACTIVE_TYPE_RE = /(html|xml|svg|script|xsl|ecmascript)/i;
+export function isActiveContentType(contentType) {
+    return ACTIVE_TYPE_RE.test(contentType.split(';')[0] ?? '');
+}
+/**
+ * A content type we are willing to put on a response.
+ *
+ * A `content-type` is attacker-controlled: it is whatever the uploader sent.
+ * Anything with a CR, an LF or a NUL is a header-injection attempt and is not
+ * negotiable; anything that is not a plausible media type is served as bytes.
+ */
+export function safeContentType(contentType, disposition) {
+    const raw = contentType.trim();
+    if (!/^[a-zA-Z0-9!#$&^_.+-]{1,127}\/[a-zA-Z0-9!#$&^_.+-]{1,127}$/.test(raw)) {
+        return 'application/octet-stream';
+    }
+    if (disposition === 'inline' && isActiveContentType(raw))
+        return 'application/octet-stream';
+    return raw;
+}
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/g;
+/**
+ * RFC 6266 `Content-Disposition`, with the filename encoded rather than
+ * interpolated.
+ *
+ * NEW FINDING, found while doing this work: the example app wrote
+ * `filename="${file.name}"` directly. `file.name` is whatever the uploader
+ * sent. A name containing a double quote truncates the header; a name
+ * containing CR/LF injects an arbitrary header, including a second
+ * `Content-Type` or a `Set-Cookie`. That is a response-splitting bug in the
+ * shipped example, and it is not one the comparable integrations have, because
+ * none of them interpolate the name unescaped. It is fixed here, once, for
+ * every caller.
+ */
+export function contentDisposition(name, disposition) {
+    // ASCII fallback: printable ASCII only, no quote, no backslash, no path
+    // separators, no control characters. Never empty.
+    // Control characters (CR/LF are the header-injection vector) are dropped
+    // outright; quote, backslash and path separators become underscores; anything
+    // outside printable ASCII is replaced, because the extended form below is
+    // what actually carries a non-ASCII name.
+    const stripped = name.replace(CONTROL_CHARS, '');
+    const ascii = stripped
+        .replace(/[\\"/]/g, '_')
+        .replace(/[^\x20-\x7e]/g, '_')
+        .trim()
+        .slice(0, 120) || 'download';
+    // RFC 5987 extended form, which carries the real (possibly non-ASCII) name.
+    const utf8 = encodeURIComponent(stripped.slice(0, 200)).replace(/['()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+    return `${disposition}; filename="${ascii}"; filename*=UTF-8''${utf8}`;
+}
+/**
+ * The headers every Filelayer byte response carries. There is no option to
+ * omit any of them.
+ *
+ *  nosniff            - stops content-type sniffing turning a .txt into HTML.
+ *  Content-Disposition- attachment by default; the browser never renders it.
+ *  Cache-Control      - `private, no-store` + `no-cache` + `must-revalidate`.
+ *                       This is the one that matters most: it is what makes
+ *                       "revocation is immediate" true at the browser and at
+ *                       every intermediary, not just at our origin.
+ *  Pragma / Expires   - the HTTP/1.0 spelling of the same thing, because
+ *                       corporate proxies are real.
+ *  Referrer-Policy    - `no-referrer`. A share link's secret is in the URL. Any
+ *                       outbound link inside a delivered document would leak it
+ *                       in the Referer header. This closes the third vector of
+ *                       the credential-in-the-URL defect, the one that survives
+ *                       moving the password out of the query string.
+ *  CSP sandbox        - defence in depth for the inline case and for any future
+ *                       caller that overrides disposition.
+ *  X-Frame-Options    - the delivered bytes cannot be framed by a third party.
+ */
+export function deliveryHeaders(file, opts = {}) {
+    const requested = opts.disposition ?? 'attachment';
+    // An active type is never served inline, whatever was asked for.
+    const disposition = requested === 'inline' && isActiveContentType(file.contentType) ? 'attachment' : requested;
+    const headers = {
+        // Found by test/tiers.test.ts: `disposition` here has ALREADY been
+        // flipped to 'attachment' for an active type, so passing it to
+        // `safeContentType` meant the `disposition === 'inline' && isActive`
+        // branch could never fire and the type neutralisation was dead code. It
+        // must be evaluated against what the CALLER ASKED FOR, not against the
+        // value we corrected it to. Belt and braces are both wanted here: the
+        // disposition defeats current browsers, the neutralised type defeats a
+        // future one (and any non-browser client that ignores disposition).
+        'content-type': safeContentType(file.contentType, requested),
+        'content-disposition': contentDisposition(file.name, disposition),
+        'x-content-type-options': 'nosniff',
+        'cache-control': 'private, no-store, no-cache, must-revalidate, max-age=0',
+        pragma: 'no-cache',
+        expires: '0',
+        'referrer-policy': 'no-referrer',
+        'content-security-policy': "default-src 'none'; sandbox",
+        'x-frame-options': 'DENY',
+    };
+    if (file.sizeBytes != null)
+        headers['content-length'] = String(file.sizeBytes);
+    return headers;
+}
+/** The same headers, minus the body ones, for a JSON error on a delivery path. */
+export function errorHeaders() {
+    return {
+        'content-type': 'application/json',
+        'cache-control': 'private, no-store, no-cache, must-revalidate, max-age=0',
+        pragma: 'no-cache',
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+    };
+}
+/**
+ * The headers on a 302 to a presigned URL.
+ *
+ * `cacheable` is true for an ANONYMOUS grant and only for an anonymous grant.
+ * That is the "public/anonymous grants should be able to use a cacheable path"
+ * requirement, and the negative half of it is the important half: nothing that
+ * was not already public becomes cacheable by a shared cache, ever.
+ *
+ * The cache lifetime is HALF the presigned URL's TTL. A cached 302 hands a
+ * client a URL that is already partly used up, so caching for the full TTL
+ * would let a client receive a redirect with milliseconds of life left and see
+ * a spurious 403. Half guarantees at least half the TTL remains.
+ *
+ * The 302 itself carries no bytes, so it carries no content-type protections;
+ * those are pinned INTO the presigned URL by the caller (see
+ * `Filelayer.readStream`), which is what stops a redirect from being a way to
+ * lose them.
+ */
+export function redirectHeaders(url, opts) {
+    return {
+        location: url,
+        'cache-control': opts.cacheable
+            ? `public, max-age=${Math.max(1, Math.floor(opts.ttlSeconds / 2))}`
+            : 'private, no-store, no-cache, must-revalidate, max-age=0',
+        // The presigned URL is a credential. It is in `Location`, so it will be in
+        // the browser's address bar and therefore in `Referer` on any onward
+        // navigation unless we say otherwise.
+        'referrer-policy': 'no-referrer',
+        'x-content-type-options': 'nosniff',
+        ...(opts.cacheable ? {} : { pragma: 'no-cache', expires: '0' }),
+    };
+}
+// -----------------------------------------------------------------------------
+// Writers
+// -----------------------------------------------------------------------------
+/** WHATWG `Response` -- Workers, Deno, Bun, Next.js route handlers, Hono. */
+export function toResponse(delivery, status = 200) {
+    return new Response(delivery.body, {
+        status,
+        headers: delivery.headers,
+    });
+}
+/**
+ * 206 when the body is a byte range, 200 when it is the whole object.
+ *
+ * `readStream()` and `redeemStream()` accept a byte range, and when the store
+ * serves one they attach `Content-Range`. A partial body sent under a 200 is
+ * silent data corruption: every HTTP client on earth treats 200 as "this is the
+ * complete representation", so it stores, caches, hashes and hands on a
+ * truncated file without a single error anywhere. The one thing that makes it
+ * a range is the status code.
+ *
+ * So the status is DERIVED from the headers rather than left to the caller.
+ * There is no value a caller could pass that this does not already know, and
+ * every value they could pass by mistake is wrong.
+ */
+function proxyStatus(delivery) {
+    return delivery.headers['content-range'] ? 206 : 200;
+}
+/**
+ * The streaming/redirect equivalent. One function for both modes, because the
+ * developer must not have to branch on the mode -- branching is where the
+ * `Cache-Control` gets copied from the wrong arm.
+ */
+export function toStreamResponse(delivery) {
+    if (delivery.mode === 'redirect') {
+        return new Response(null, { status: delivery.status, headers: delivery.headers });
+    }
+    return new Response(delivery.body, {
+        status: proxyStatus(delivery),
+        headers: delivery.headers,
+    });
+}
+/** `node:http` / Express. */
+export function sendNodeResponse(res, delivery, status = 200) {
+    // content-length is recomputed from the actual buffer rather than trusted
+    // from the record: a size column that disagrees with the object would
+    // otherwise truncate or hang the response.
+    const headers = { ...delivery.headers, 'content-length': String(delivery.body.byteLength) };
+    res.writeHead(status, headers);
+    res.end(delivery.body);
+}
+/**
+ * `node:http`, streaming. Nothing is buffered: the object's bytes go from the
+ * store's socket to the client's socket a chunk at a time.
+ *
+ * The `content-length` from the record is dropped unless the STORE reported one
+ * for this response, for the same reason `sendNodeResponse` recomputes it: a
+ * `size_bytes` that disagrees with the object truncates or hangs the response,
+ * and on a streamed response the hang is the one you notice in production
+ * rather than in a test.
+ */
+export async function sendNodeStream(res, delivery) {
+    if (delivery.mode === 'redirect') {
+        res.writeHead(delivery.status, delivery.headers);
+        res.end();
+        return;
+    }
+    const headers = { ...delivery.headers };
+    if (delivery.bytes === null)
+        delete headers['content-length'];
+    else
+        headers['content-length'] = String(delivery.bytes);
+    // 206 if this is a byte range. See `proxyStatus` -- a partial body under a
+    // 200 is a truncated file that no client can detect.
+    res.writeHead(proxyStatus(delivery), headers);
+    const reader = delivery.body.getReader();
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            if (!res.write(value)) {
+                await new Promise((resolve) => res.once('drain', resolve));
+            }
+        }
+        res.end();
+    }
+    catch (err) {
+        // Headers are already sent, so there is no way to turn this into a status
+        // code. Destroying the socket is the only honest signal that the body is
+        // incomplete; ending it normally would deliver a truncated file that looks
+        // like a successful download.
+        res.destroy(err instanceof Error ? err : new Error(String(err)));
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function sendNodeError(res, err) {
+    const e = err instanceof FilelayerError ? err : new FilelayerError(500, 'internal');
+    res.writeHead(e.status, errorHeaders());
+    res.end(JSON.stringify({ error: e.code }));
+}
+// -----------------------------------------------------------------------------
+// Routes the library owns
+// -----------------------------------------------------------------------------
+/**
+ * Credential names that must never appear in a URL. `secret` is not listed:
+ * the share secret IS the path segment, which is the standard design and is
+ * what `Referrer-Policy: no-referrer` above is for.
+ */
+const FORBIDDEN_QUERY_KEYS = ['password', 'pw', 'pass', 'passwd', 'token', 'secret', 'key'];
+async function readBody(req, limit = 64 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const c of req) {
+        size += c.byteLength;
+        if (size > limit)
+            throw new FilelayerError(413, 'payload_too_large');
+        chunks.push(c);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+/** JSON or form-urlencoded, whichever the client sent. Never the query string. */
+function extractPassword(raw, contentType) {
+    if (raw.length === 0)
+        return undefined;
+    if (/application\/x-www-form-urlencoded/i.test(contentType)) {
+        const v = new URLSearchParams(raw).get('password');
+        return v === null ? undefined : v;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const v = parsed['password'];
+        return typeof v === 'string' ? v : undefined;
+    }
+    catch {
+        throw new FilelayerError(400, 'bad_request');
+    }
+}
+/**
+ * `GET|POST <prefix>/:secret` -- the entire public share-link download path.
+ *
+ * The application supplies nothing. Identity is the secret itself, the password
+ * is read from the body, the counter is consumed by `redeem()`, and the
+ * response headers come from `deliveryHeaders()`. There is no parameter here
+ * whose wrong value leaks data.
+ *
+ * Returns true if it handled the request, so it can be dropped into any router.
+ */
+export function shareDownloadRoute(fl, opts = {}) {
+    const prefix = (opts.prefix ?? '/d').replace(/\/+$/, '');
+    return async (req, res) => {
+        const url = new URL(req.url ?? '/', 'http://filelayer.invalid');
+        const segments = url.pathname.split('/').filter(Boolean);
+        const prefixSegments = prefix.split('/').filter(Boolean);
+        if (segments.length !== prefixSegments.length + 1)
+            return false;
+        if (prefixSegments.some((s, i) => segments[i] !== s))
+            return false;
+        if (req.method !== 'GET' && req.method !== 'POST')
+            return false;
+        const secret = decodeURIComponent(segments[prefixSegments.length]);
+        try {
+            // THE FIX FOR THE CREDENTIAL-IN-THE-URL DEFECT, and the reason this
+            // route exists.
+            // A password (or any other credential) in the query string ends up in
+            // access logs, proxy logs and browser history. The old example accepted
+            // one. We refuse -- loudly, before doing any work, and without consuming
+            // a download -- so the mistake cannot be made silently.
+            for (const k of FORBIDDEN_QUERY_KEYS) {
+                if (url.searchParams.has(k)) {
+                    throw new FilelayerError(400, 'credential_in_query', `query_param:${k}`);
+                }
+            }
+            let password;
+            if (req.method === 'POST') {
+                password = extractPassword(await readBody(req), String(req.headers['content-type'] ?? ''));
+            }
+            // STREAMED, not buffered. This route is the one every share link goes
+            // through, so buffering here was the whole-file-in-memory tax on the
+            // busiest path in the product.
+            const delivery = await fl.redeemStream(secret, {
+                ...(password !== undefined ? { password } : {}),
+                ...(req.socket.remoteAddress ? { ip: req.socket.remoteAddress } : {}),
+                ...(req.headers['user-agent'] ? { userAgent: String(req.headers['user-agent']) } : {}),
+                ...(opts.disposition ? { disposition: opts.disposition } : {}),
+                ...(opts.mode ? { mode: opts.mode } : {}),
+            });
+            await sendNodeStream(res, {
+                ...delivery,
+                headers: {
+                    ...delivery.headers,
+                    // Useful to the recipient and safe to expose: they already hold the
+                    // credential this counts against.
+                    'x-downloads-remaining': String(delivery.remainingDownloads ?? ''),
+                    'x-filelayer-delivery': delivery.mode,
+                },
+            });
+            return true;
+        }
+        catch (err) {
+            // 401 means "this link has a password". The client must re-issue as a
+            // POST with the password in the body; there is no supported way to put it
+            // in the URL.
+            if (err instanceof FilelayerError && err.status === 401) {
+                res.writeHead(401, { ...errorHeaders(), 'www-authenticate': 'FilelayerShare' });
+                res.end(JSON.stringify({ error: err.code, retry: { method: 'POST', field: 'password' } }));
+                return true;
+            }
+            sendNodeError(res, err);
+            return true;
+        }
+    };
+}
+/**
+ * `GET <prefix>/:fileId` -- the authenticated read path, headers included.
+ *
+ * The one thing the application must supply is who the caller is, because that
+ * is the one thing Filelayer cannot know. Everything downstream of that -- the
+ * decision, the audit event, the status code, and every response header -- is
+ * the library's.
+ */
+export function fileDownloadRoute(fl, opts) {
+    const prefix = (opts.prefix ?? '/files').replace(/\/+$/, '');
+    return async (req, res) => {
+        const url = new URL(req.url ?? '/', 'http://filelayer.invalid');
+        const segments = url.pathname.split('/').filter(Boolean);
+        const prefixSegments = prefix.split('/').filter(Boolean);
+        if (req.method !== 'GET')
+            return false;
+        if (segments.length !== prefixSegments.length + 1)
+            return false;
+        if (prefixSegments.some((s, i) => segments[i] !== s))
+            return false;
+        try {
+            const delivery = await fl.readStream(await opts.principal(req), segments[prefixSegments.length], {
+                ...(opts.disposition ? { disposition: opts.disposition } : {}),
+                ...(opts.mode ? { mode: opts.mode } : {}),
+            });
+            await sendNodeStream(res, {
+                ...delivery,
+                headers: { ...delivery.headers, 'x-filelayer-delivery': delivery.mode },
+            });
+        }
+        catch (err) {
+            sendNodeError(res, err);
+        }
+        return true;
+    };
+}
+/**
+ * The whole byte-delivery surface as one `node:http` request listener.
+ *
+ * `createServer(deliveryHandler(fl))` is a complete, correct file server: both
+ * delivery paths, every security header, the query-string credential refusal,
+ * and a 404 for everything else. The developer writes no header and no status
+ * code, which means there is no header or status code for them to get wrong.
+ */
+export function deliveryHandler(fl, opts = {}) {
+    const files = fileDownloadRoute(fl, {
+        prefix: opts.filePrefix ?? '/f',
+        principal: opts.principal ?? (() => ({ actorId: null })),
+        ...(opts.disposition ? { disposition: opts.disposition } : {}),
+        ...(opts.mode ? { mode: opts.mode } : {}),
+    });
+    const shares = shareDownloadRoute(fl, {
+        prefix: opts.sharePrefix ?? '/d',
+        ...(opts.disposition ? { disposition: opts.disposition } : {}),
+        ...(opts.mode ? { mode: opts.mode } : {}),
+    });
+    return async (req, res) => {
+        if (await files(req, res))
+            return;
+        if (await shares(req, res))
+            return;
+        res.writeHead(404, errorHeaders());
+        res.end(JSON.stringify({ error: 'not_found' }));
+    };
+}
+//# sourceMappingURL=delivery.js.map

package/dist/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAsE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,2EAA2E,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAC5C,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAyB/C,MAAM,UAAU,qBAAqB,CAAC,GAA2B;IAC/D,IAAI,GAAG,CAAC,2BAA2B,KAAK,wBAAwB,EAAE,CAAC;QACjE,MAAM,IAAI,cAAc,CACtB,GAAG,EACH,2BAA2B,EAC3B,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,4BAA4B,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,yBAAyB,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO;QACL,4EAA4E;QAC5E,2EAA2E;QAC3E,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;QACrE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,uBAAuB;KAC5C,CAAC;AACJ,CAAC;AA+BD;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAE/D,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,WAAwB;IAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,4DAA4D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,WAAW,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4CAA4C;AAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,WAAwB;IACvE,wEAAwE;IACxE,kDAAkD;IAClD,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GACT,QAAQ;SACL,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC;IACjC,4EAA4E;IAC5E,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAC7D,SAAS,EACT,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CACxD,CAAC;IACF,OAAO,GAAG,WAAW,eAAe,KAAK,uBAAuB,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAqB,EACrB,OAAsC,EAAE;IAExC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACnD,iEAAiE;IACjE,MAAM,WAAW,GACf,SAAS,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE7F,MAAM,OAAO,GAA2B;QACtC,mEAAmE;QACnE,+DAA+D;QAC/D,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,cAAc,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;QAC5D,qBAAqB,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QACjE,wBAAwB,EAAE,SAAS;QACnC,eAAe,EAAE,yDAAyD;QAC1E,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,GAAG;QACZ,iBAAiB,EAAE,aAAa;QAChC,yBAAyB,EAAE,6BAA6B;QACxD,iBAAiB,EAAE,MAAM;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,cAAc,EAAE,kBAAkB;QAClC,eAAe,EAAE,yDAAyD;QAC1E,MAAM,EAAE,UAAU;QAClB,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAgD;IAEhD,OAAO;QACL,QAAQ,EAAE,GAAG;QACb,eAAe,EAAE,IAAI,CAAC,SAAS;YAC7B,CAAC,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;YACnE,CAAC,CAAC,yDAAyD;QAC7D,2EAA2E;QAC3E,qEAAqE;QACrE,sCAAsC;QACtC,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,QAAsB,EAAE,MAAM,GAAG,GAAG;IAC7D,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAA2B,EAAE;QACxD,MAAM;QACN,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAAC,QAAuB;IAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0B;IACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAA2B,EAAE;QACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,gBAAgB,CAC9B,GAAmB,EACnB,QAAsB,EACtB,MAAM,GAAG,GAAG;IAEZ,0EAA0E;IAC1E,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5F,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAmB,EACnB,QAA0B;IAE1B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxC,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;;QACzD,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,2EAA2E;IAC3E,qDAAqD;IACrD,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,8BAA8B;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,GAAY;IACtD,MAAM,CAAC,GACL,GAAG,YAAY,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5E,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAE5F,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QAC1B,IAAI,IAAK,CAAY,CAAC,UAAU,CAAC;QACjC,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,GAAW,EAAE,WAAmB;IACvD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,qCAAqC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAmBD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAa,EACb,OAA0B,EAAE;IAE5B,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEzD,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAE,CAAC,CAAC;QAEpE,IAAI,CAAC;YACH,oEAAoE;YACpE,gBAAgB;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,wDAAwD;YACxD,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;gBACrC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;YAED,IAAI,QAA4B,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,QAAQ,GAAG,eAAe,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7F,CAAC;YAED,sEAAsE;YACtE,qEAAqE;YACrE,+BAA+B;YAC/B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE;gBAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;YAEH,MAAM,cAAc,CAAC,GAAG,EAAE;gBACxB,GAAG,QAAQ;gBACX,OAAO,EAAE;oBACP,GAAG,QAAQ,CAAC,OAAO;oBACnB,oEAAoE;oBACpE,kCAAkC;oBAClC,uBAAuB,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBAClE,sBAAsB,EAAE,QAAQ,CAAC,IAAI;iBACtC;aACkB,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,0EAA0E;YAC1E,cAAc;YACd,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC3F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,EAAa,EACb,IAAsB;IAEtB,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7D,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAClC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EACzB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAE,EAChC;gBACE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CACF,CAAC;YACF,MAAM,cAAc,CAAC,GAAG,EAAE;gBACxB,GAAG,QAAQ;gBACX,OAAO,EAAE,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAa,EACb,OAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,EAAE;QAClC,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,EAAE;QACpC,MAAM,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QAChC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QAClC,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO;QACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The one error type the library throws.
+ *
+ * It lives in its own module so that the delivery layer (which must classify
+ * errors in order to write a correct HTTP response) does not have to import the
+ * whole `Filelayer` class, which imports the delivery layer.
+ */
+import type { DenyReason } from './authz.ts';
+export declare class FilelayerError extends Error {
+    readonly status: number;
+    readonly code: string;
+    /** Internal deny reason. Logged, never serialized to an untrusted caller. */
+    readonly reason: DenyReason | string | undefined;
+    constructor(status: number, code: string, reason?: DenyReason | string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;gBAErC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM;CAOvE"}

package/dist/errors.js

@@ -0,0 +1,21 @@
+/**
+ * The one error type the library throws.
+ *
+ * It lives in its own module so that the delivery layer (which must classify
+ * errors in order to write a correct HTTP response) does not have to import the
+ * whole `Filelayer` class, which imports the delivery layer.
+ */
+export class FilelayerError extends Error {
+    status;
+    code;
+    /** Internal deny reason. Logged, never serialized to an untrusted caller. */
+    reason;
+    constructor(status, code, reason) {
+        super(code);
+        this.name = 'FilelayerError';
+        this.status = status;
+        this.code = code;
+        this.reason = reason;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,6EAA6E;IACpE,MAAM,CAAkC;IAEjD,YAAY,MAAc,EAAE,IAAY,EAAE,MAA4B;QACpE,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}