@interop/was-client 0.34.0 → 0.35.1

package/README.md

@@ -20,6 +20,7 @@
   - [Revoking a capability](#revoking-a-capability)
   - [Public sharing and access-control policies](#public-sharing-and-access-control-policies)
   - [Resource metadata](#resource-metadata)
+  - [Collection metadata](#collection-metadata)
   - [Conditional writes (optimistic concurrency)](#conditional-writes-optimistic-concurrency)
   - [Storage introspection: backends and quotas](#storage-introspection-backends-and-quotas)
   - [Registering a Bring-Your-Own-Storage backend](#registering-a-bring-your-own-storage-backend)
@@ -243,6 +244,11 @@ await collection.delete() // deletes the whole collection; idempotent
 To delete a single resource instead of the whole collection, use
 `collection.resource(id).delete()`.
 
+The Description's `name` is server-visible plaintext. An encrypted collection
+leaves it unpopulated by convention and carries its name and tags on the
+[Collection metadata](#collection-metadata) surface instead, where they are
+encrypted.
+
 An application that provisions a collection can record who it was provisioned
 for, with the optional `generator` (the application's DID) and `generatorOrigin`
 (the Web origin that DID was bound to) description fields. Both are accepted at
@@ -462,6 +468,39 @@ await resource.setTags({ status: 'verified' }) // keeps existing name
 The `custom.name` is the same value surfaced as a resource's `name` in
 collection listings; updating one updates the other.
 
+### Collection metadata
+
+A Collection has the same metadata surface at its own reserved `/meta` path:
+server-managed properties (`createdAt` / `updatedAt` / `createdBy`) plus a
+user-writable `custom` object (`name` and `tags`). A server without the endpoint
+surfaces its 501 as `NotImplementedError`.
+
+```ts
+const meta = await collection.meta() // CollectionMetadata | null (null on a miss)
+
+// setMeta() is a full replacement of `custom`; omitted properties are cleared.
+await collection.setMeta({ custom: { name: 'Vault', tags: { app: 'wallet' } } })
+
+// setName() / setTags() are read-modify-write sugar that preserve the other.
+await collection.setName('Renamed vault') // keeps existing tags
+await collection.setTags({ app: 'wallet' }) // keeps existing name
+
+// Conditional metadata write, against a `conditional-writes` backend.
+await collection.setMeta({ custom: { name: 'Vault' } }, { ifMatch: meta?.etag })
+// ...or write only if no metadata is set yet:
+await collection.setMeta({ custom: { name: 'Vault' } }, { ifNoneMatch: true })
+```
+
+A failed precondition throws `PreconditionFailedError` (412). This `/meta` ETag
+(`metaVersion`) is versioned independently of the Collection Description's ETag
+and of every Resource's versions: writing one never bumps the other.
+
+On an encrypted collection `custom` is encrypted into an envelope before it is
+sent, so `name` / `tags` are never stored as server-visible plaintext, and
+`meta()` decrypts them back for a keyed reader. This is the encrypted
+collection's name/tags surface: by convention the plaintext Description `name`
+is left unpopulated there.
+
 ### Conditional writes (optimistic concurrency)
 
 Against a backend that advertises the `conditional-writes` feature (see below),
@@ -678,11 +717,84 @@ scope for now):
   encrypted into an envelope before it is sent, so the server never sees the
   plaintext, and `meta()` decrypts it back for a keyed reader. The `/meta`
   endpoint has its own ETag (`metaVersion`), independent of the content ETag.
+  The same pair at Collection level (`collection.setName()` / `setTags()` /
+  `setMeta()` / `meta()`) is where an encrypted collection carries its own name
+  and tags, since the Description's plaintext `name` is left unpopulated; the
+  collection-level envelope binds no resource id, and a resource-bound envelope
+  served into that slot is refused.
 - **Binary.** A small `Blob`/`Uint8Array` is encrypted as a single document;
   larger binaries are rejected until chunked encrypted blobs land.
 - **Raw reads.** `get()` decrypts; the `getText()` / `getBytes()` escape hatches
   do not (they return the stored representation).
 
+#### Searching an encrypted collection
+
+An encrypted collection can be searched by attribute without the server ever
+learning the attribute names or their values: the client blinds both into HMAC
+tokens (equal plaintext blinds to equal tokens, and nothing else), stores them
+alongside the ciphertext, and blinds the query the same way. The server compares
+opaque strings.
+
+The blinding key is installed with the collection's first key epoch or never --
+retro-fitting one would leave every already-written document unindexed -- so ask
+for it at provisioning time:
+
+```ts
+await ensureFirstEpoch({
+  collection: declared,
+  recipients: [ownerRecipient({ keyAgreementKey })],
+  blindedIndex: true // searchable: a property fixed at birth
+})
+```
+
+Then declare what is searchable and search it:
+
+```ts
+const vault = was.space(spaceId).collection('vault')
+await vault.declareIndex({ attribute: 'content.type' })
+
+await vault.add({ type: 'note', title: 'alpha' })
+
+const page = await vault.find({ equals: { 'content.type': 'note' } })
+// { items: [{ id, data: { type: 'note', title: 'alpha' } }], hasMore: false }
+
+const { count } = await vault.find({
+  equals: { 'content.type': 'note' },
+  count: true
+})
+```
+
+Attribute names are dotted paths rooted at `content` or `meta` (the document's
+own `meta`, which carries the content type and encoding -- not the WAS `/meta`
+name/tags, which live in a separate envelope and are deliberately not indexed).
+Pass an array of names for a compound index, searchable by a leading prefix of
+its attributes; `unique: true` makes the server answer a colliding write with
+`409`. Give `find()` either `equals` (an array of objects is an OR of
+alternatives) or `has` (attribute names a document must carry); page with
+`limit` and the returned `cursor`.
+
+Two properties are worth planning around:
+
+- **Declarations are collection state, not app state.** The schema is persisted
+  inside the collection's encrypted metadata envelope, so any recipient
+  discovers it -- read it with `collection.indexes()`. That is what lets an app
+  granted access to an existing collection learn what is queryable; the stored
+  tokens cannot teach it, being blinded. Concurrent declarations reconcile
+  through the metadata ETag rather than overwriting each other.
+- **Declarations are prospective.** A document written before an attribute was
+  declared carries no token for it and does not match until it is rewritten
+  (each entry's `addedIn` revision records when it became searchable). Searching
+  an attribute the schema does not declare throws `ValidationError` rather than
+  silently matching nothing.
+
+Requires the collection's backend to advertise `blinded-index-query`; a backend
+without it answers `501` (`NotImplementedError`). `find()` / `declareIndex()` on
+a plaintext collection throw -- there is no client-side index there.
+
+Note that `collection.setMeta({ custom })` replaces the whole `custom` object,
+schema included; the `setName()` / `setTags()` sugar merges instead and leaves
+it intact.
+
 ### Cross-replica sync
 
 The opt-in `@interop/was-client/sync` subpath supplies everything a wallet needs

package/dist/Collection.d.ts

@@ -1,7 +1,8 @@
 import type { ClientContext } from './internal/request.js';
+import type { IndexDeclaration, IndexSchema } from './codec.js';
 import { Resource } from './Resource.js';
 import type { ChangesCheckpoint, ChangesPage } from '@interop/storage-core';
-import type { AddResult, BackendDescriptor, BackendUsage, CollectionDescription, CollectionWritableFields, EncryptionOverride, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, Json, ResourceData, LinkSet, PolicyDocument, CollectionResourcesList, ResourceSummary } from './types.js';
+import type { AddResult, BackendDescriptor, BackendUsage, CollectionDescription, CollectionMetadata, CollectionWritableFields, EncryptionOverride, FindPage, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, Json, ResourceData, LinkSet, PolicyDocument, CollectionResourcesList, ResourceMetadataCustom, ResourceSummary } from './types.js';
 export declare class Collection {
     #private;
     readonly spaceId: string;
@@ -105,6 +106,176 @@ export declare class Collection {
      * @returns {Promise<void>}
      */
     delete(): Promise<void>;
+    /**
+     * Reads the Collection's metadata object (server-managed timestamps,
+     * `createdBy` and the encrypted-`custom` key `epoch`, plus the user-writable
+     * `custom` object). Returns `null` if the collection is missing or not
+     * visible to you (404 conflation caveat). A server without Collection
+     * metadata support surfaces its 501 as `NotImplementedError`.
+     *
+     * On an encrypted collection the stored `custom` is an opaque envelope; this
+     * decodes it (decrypts, via the codec) so a caller always sees plaintext
+     * `{ name, tags }`. A collection with no user metadata reports `custom` as
+     * `{}`.
+     *
+     * Against a backend with the `conditional-writes` feature the result also
+     * carries the metadata's current `etag` (the `/meta` `metaVersion`
+     * validator) -- pass it as `setMeta(meta, { ifMatch })` for a
+     * lost-update-safe metadata update. That validator is independent of the
+     * Collection Description's ETag ({@link describeWithEtag}) and of every
+     * Resource's versions: writing one never bumps the other.
+     *
+     * @returns {Promise<(CollectionMetadata & { etag?: string }) | null>}
+     */
+    meta(): Promise<(CollectionMetadata & {
+        etag?: string;
+    }) | null>;
+    /**
+     * Replaces the Collection's user-writable metadata (`custom`). This is a full
+     * replacement: any property omitted from `custom` is cleared, and an omitted
+     * `custom` clears them all. Does not create the collection -- a `PUT` to the
+     * metadata of a nonexistent collection throws `NotFoundError`. Servers
+     * without Collection metadata support surface their 501 as
+     * `NotImplementedError`.
+     *
+     * On an encrypted collection `custom` is encrypted into an opaque envelope by
+     * the codec before it is sent, so `name` / `tags` are never stored as
+     * server-visible plaintext -- transparently, the same call works on plaintext
+     * and encrypted collections alike.
+     *
+     * Conditional metadata writes (the backend's `conditional-writes` feature):
+     * pass `ifMatch` (the `etag` from a prior `meta()`) for an
+     * update-if-unchanged, or `ifNoneMatch: true` for a
+     * write-only-if-no-metadata. A failed precondition throws
+     * `PreconditionFailedError` (412). The `/meta` ETag (`metaVersion`) is
+     * independent of the Collection Description's ETag. Returns the new `etag`.
+     *
+     * @param meta {object}
+     * @param [meta.custom] {ResourceMetadataCustom}   the user-writable properties
+     * @param options {object}
+     * @param [options.ifMatch] {string}       update only if the `/meta` ETag matches
+     * @param [options.ifNoneMatch] {boolean}  write only if no metadata is set
+     * @returns {Promise<{ etag?: string }>}   the metadata's new ETag
+     */
+    setMeta(meta?: {
+        custom?: ResourceMetadataCustom;
+    }, options?: {
+        ifMatch?: string;
+        ifNoneMatch?: boolean;
+    }): Promise<{
+        etag?: string;
+    }>;
+    /**
+     * Sets the Collection's metadata-level human-readable `name`, preserving any
+     * existing `tags`. Convenience over `setMeta()`. The write is pinned to the
+     * `etag` the `meta()` read returned (when the backend supports
+     * `conditional-writes`), so a concurrent metadata write surfaces as
+     * `PreconditionFailedError` instead of being silently erased by this
+     * full-replacement write.
+     *
+     * On an encrypted collection this is the collection's client-encrypted name
+     * surface: the codec seals it into the `custom` envelope, and by convention
+     * the plaintext Description `name` is left unpopulated. On a plaintext
+     * collection the two are separate labels -- space-level listings surface the
+     * Description's `name` (set via `configure({ name })`), while this one is
+     * metadata-level.
+     *
+     * @param name {string}
+     * @returns {Promise<void>}
+     */
+    setName(name: string): Promise<void>;
+    /**
+     * Sets the Collection's `tags`, preserving any existing `name`. Convenience
+     * over `setMeta()`. Pinned to the `meta()` read's `etag` like
+     * {@link setName}.
+     *
+     * @param tags {Record<string, string>}
+     * @returns {Promise<void>}
+     */
+    setTags(tags: Record<string, string>): Promise<void>;
+    /**
+     * Reads the Collection's persisted index schema: which attributes its
+     * documents are searchable by, whether each index is unique, and the schema
+     * revision each was added in. Any recipient that can decrypt the collection
+     * can read it, which is the point of persisting it -- an app granted access
+     * to an existing collection learns what is queryable with no out-of-band
+     * coordination (the stored index tokens cannot teach it, being blinded).
+     *
+     * `addedIn` is the partial-coverage marker: documents written before an
+     * attribute was declared carry no token for it, so they do not match a search
+     * on it until they are rewritten.
+     *
+     * @returns {Promise<IndexDeclaration[]>}
+     */
+    indexes(): Promise<IndexDeclaration[]>;
+    /**
+     * Declares an attribute searchable, persisting it in the Collection's
+     * encrypted index schema and installing it on this handle's codec.
+     * Idempotent: re-declaring an attribute already in the schema on the same
+     * terms is a no-op write.
+     *
+     * Declarations are collection state, not app state: they are stored inside
+     * the encrypted `/meta` envelope, so every recipient discovers them (see
+     * {@link indexes}). Concurrent declarations from two clients are reconciled
+     * with a compare-and-swap against the metadata's own `metaVersion` ETag and a
+     * bounded retry, so neither is silently erased.
+     *
+     * A declaration is prospective: documents already written carry no token for
+     * the new attribute and do not match a search on it until they are rewritten
+     * (the backfill is a re-encrypt sweep of the collection).
+     *
+     * Pass an array of attribute names for a compound index. A compound index can
+     * be searched by a leading prefix of its attributes; `unique` is enforced
+     * only when a document carries the whole combination.
+     *
+     * @param options {object}
+     * @param options.attribute {string | string[]}   a dotted attribute path
+     *   rooted at `content` or `meta` (e.g. `content.type`), or an array of them
+     *   for a compound index
+     * @param [options.unique] {boolean}   reject a second document that carries
+     *   the same value (the server answers a colliding write with `409`)
+     * @returns {Promise<IndexSchema>}   the schema now in force
+     */
+    declareIndex({ attribute, unique }: {
+        attribute: string | string[];
+        unique?: boolean;
+    }): Promise<IndexSchema>;
+    /**
+     * Searches the collection's encrypted documents by indexed attribute. The
+     * terms are blinded client-side before they are sent, so the server matches
+     * opaque tokens and learns neither the attribute names nor the values; the
+     * documents it returns are decrypted here, exactly as `get()` decrypts one.
+     *
+     * Give either `equals` (attribute/value pairs a document must match -- an
+     * array of objects is an OR of alternatives) or `has` (attribute names a
+     * document must carry), not both. Every attribute named must already be in
+     * the collection's schema ({@link declareIndex}); an undeclared one is
+     * refused with `ValidationError` rather than silently matching nothing.
+     *
+     * Pass `count: true` for just the number of matches. Otherwise the result is
+     * one page: `limit` caps its size (the server clamps its own maximum), and a
+     * `hasMore` page carries the `cursor` to pass back for the next one.
+     *
+     * Requires the collection's backend to advertise the `blinded-index-query`
+     * feature; a backend without it answers `501` (`NotImplementedError`).
+     *
+     * @param options {object}
+     * @param [options.equals] {object | object[]}   attribute/value pairs to match
+     * @param [options.has] {string | string[]}   attribute names to require
+     * @param [options.count] {boolean}   return `{ count }` instead of documents
+     * @param [options.limit] {number}   maximum documents in the page
+     * @param [options.cursor] {string}   continue from a previous page
+     * @returns {Promise<FindPage | { count: number }>}
+     */
+    find(options: {
+        equals?: Record<string, unknown> | Array<Record<string, unknown>>;
+        has?: string | string[];
+        count?: boolean;
+        limit?: number;
+        cursor?: string;
+    }): Promise<FindPage | {
+        count: number;
+    }>;
     /**
      * Returns a lazy handle to a resource by id. No I/O.
      *

package/dist/Collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AA8B1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,qBAAa,UAAU;;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAYnB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IA2DD;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAQvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACnD,OAAO,CAAC,qBAAqB,CAAC;IAiEjC;;;;;;;;;OASG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,qBAAqB,CAAA;QAClC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAkBT;;;;;;;;;;;;;;;;;;OAkBG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC;QAAE,WAAW,EAAE,qBAAqB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8BjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAqBnE;;;;;;;;;OASG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAwDrB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,OAAO,CACX,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/D,OAAO,CAAC,WAAW,CAAC;IAmBvB;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAOlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAM5C"}
+{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAwC1D,OAAO,KAAK,EAEV,gBAAgB,EAChB,WAAW,EAEZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,eAAe,EAChB,MAAM,YAAY,CAAA;AAEnB,qBAAa,UAAU;;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAYnB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IA2DD;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAQvD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACnD,OAAO,CAAC,qBAAqB,CAAC;IAiEjC;;;;;;;;;OASG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,qBAAqB,CAAA;QAClC,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAkBT;;;;;;;;;;;;;;;;;;OAkBG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC;QAAE,WAAW,EAAE,qBAAqB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8BjE;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA2CtE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,OAAO,CACX,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,sBAAsB,CAAA;KAAO,EAC9C,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8C7B;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B1D;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,EACjB,SAAS,EACT,MAAM,EACP,EAAE;QACD,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC;IAgExB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACvB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAqBnE;;;;;;;;;OASG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAwDrB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,OAAO,CACX,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/D,OAAO,CAAC,WAAW,CAAC;IAmBvB;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAOlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAM5C"}