@keyneom/sync-kit 0.2.0-rc.1 → 0.2.0-rc.11

package/README.md

@@ -121,6 +121,8 @@ Available exports:
 - `/sharing/controller` — headless multi-dataset orchestration, owner pinning,
   serialized writes, exchange processing, roles, revocation, Drive permission
   reconciliation, and optional IndexedDB registry persistence
+- `/sharing/control` — encrypted, signed coordination ledgers for Picker
+  enrollment, participant provenance, and hard-cutover migration acknowledgements
 - `/sharing/web-passkey` — passkey-encrypted sharing identities with
   non-extractable runtime keys and optional IndexedDB ciphertext storage
 - `/sharing/account-binding` — backendless Google ID-token and WebAuthn
@@ -209,9 +211,11 @@ frontend can execute the protocol directly against Google Drive; an
 application-owned server is neither a trust root nor a deployment requirement.
 
 Shared files use normal Google Drive storage with the per-file `drive.file`
-scope. A recipient can select the shared app folder once through Google Picker,
-after which the app reuses its ID for app-created children; broad access to
-Drive is not required. `appDataFolder` files cannot be shared.
+scope. A recipient must select every required shared data/control file through
+Google Picker; selecting the parent folder does not grant recursive child-file
+access. The app persists the folder ID for profile routing and compares Picker
+results to the signed expected file IDs; broad access to Drive is not required.
+`appDataFolder` files cannot be shared.
 
 New integrations can use `GoogleDriveFileSnapshotStore`, which defaults to an
 app-owned top-level folder:
@@ -235,6 +239,7 @@ sharing or limited-access subfolders.
 See the [protocol and threat model](docs/shared-backups.md),
 [authoritative implementation handoff](docs/sharing-implementation-handoff.md),
 [consumer responsibilities](docs/consumer-responsibilities.md), and
+[control dataset and topology migration guide](docs/sharing-control-datasets.md),
 [background notifications](docs/background-notifications.md). The phased gates
 remain in the [sharing execution plan](docs/sharing-execution-plan.md). The crypto and
 per-file transport, Picker, protected identity, account binding, signed

package/dist/sharing/appdata-identity-store.d.ts

@@ -0,0 +1,36 @@
+import type { Authorization } from "../core/types.js";
+import { GoogleDriveAppDataStore } from "../stores/google-drive/index.js";
+import { type ProtectedSharingIdentityStore, type ProtectedSharingIdentityV1 } from "./web-passkey.js";
+export type DriveAppDataProtectedSharingIdentityStoreOptions = {
+    /**
+     * Supplies a Drive authorization scoped to `drive.appdata`. The same Google
+     * account on any device returns the same private app-data folder, which is
+     * how a single sharing identity follows the user across devices.
+     */
+    authorization(): Promise<Authorization>;
+    /** Overrides the app-data filename derived from the app id. */
+    filename?(appId: string): string;
+    drive?: GoogleDriveAppDataStore;
+};
+/**
+ * Hosts the passkey-wrapped sharing identity in the signed-in Google account's
+ * private `drive.appdata` folder instead of device-local storage. Because the
+ * record is already AES-GCM-encrypted with the passkey PRF secret, app-data is
+ * a plaintext-safe transport: Drive only ever sees an opaque JSON blob whose
+ * `encryptedPrivateKeys` field it cannot read.
+ *
+ * The single-user, multi-device continuity this restores is deliberately
+ * distinct from the sharing (multi-user) protocol: the identity here is one
+ * account's own key, replicated to its own devices, never granted to another
+ * participant.
+ */
+export declare class DriveAppDataProtectedSharingIdentityStore implements ProtectedSharingIdentityStore {
+    private readonly options;
+    private readonly drive;
+    constructor(options: DriveAppDataProtectedSharingIdentityStoreOptions);
+    load(appId: string): Promise<ProtectedSharingIdentityV1 | null>;
+    save(record: ProtectedSharingIdentityV1): Promise<void>;
+    delete(appId: string): Promise<void>;
+    private filename;
+}
+//# sourceMappingURL=appdata-identity-store.d.ts.map

package/dist/sharing/appdata-identity-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appdata-identity-store.d.ts","sourceRoot":"","sources":["../../src/sharing/appdata-identity-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,EAChC,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,gDAAgD,GAAG;IAC7D;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC,+DAA+D;IAC/D,QAAQ,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,qBAAa,yCACX,YAAW,6BAA6B;IAKtC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0B;gBAG7B,OAAO,EAAE,gDAAgD;IAKtE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAQ/D,IAAI,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM1C,OAAO,CAAC,QAAQ;CAKjB"}

package/dist/sharing/appdata-identity-store.js

@@ -0,0 +1,49 @@
+import { GoogleDriveAppDataStore } from "../stores/google-drive/index.js";
+import { parseProtectedSharingIdentityV1, } from "./web-passkey.js";
+/**
+ * Hosts the passkey-wrapped sharing identity in the signed-in Google account's
+ * private `drive.appdata` folder instead of device-local storage. Because the
+ * record is already AES-GCM-encrypted with the passkey PRF secret, app-data is
+ * a plaintext-safe transport: Drive only ever sees an opaque JSON blob whose
+ * `encryptedPrivateKeys` field it cannot read.
+ *
+ * The single-user, multi-device continuity this restores is deliberately
+ * distinct from the sharing (multi-user) protocol: the identity here is one
+ * account's own key, replicated to its own devices, never granted to another
+ * participant.
+ */
+export class DriveAppDataProtectedSharingIdentityStore {
+    options;
+    drive;
+    constructor(options) {
+        this.options = options;
+        this.drive = options.drive ?? new GoogleDriveAppDataStore();
+    }
+    async load(appId) {
+        const authorization = await this.options.authorization();
+        const found = await this.drive.find(this.filename(appId), authorization);
+        if (!found)
+            return null;
+        const text = await this.drive.readText(found.fileId, authorization);
+        return parseProtectedSharingIdentityV1(text);
+    }
+    async save(record) {
+        const authorization = await this.options.authorization();
+        const name = this.filename(record.appId);
+        const found = await this.drive.find(name, authorization);
+        await this.drive.write(name, JSON.stringify(record), authorization, {
+            ...(found ? { existingId: found.fileId } : {}),
+            contentType: "application/json",
+        });
+    }
+    async delete(appId) {
+        const authorization = await this.options.authorization();
+        const found = await this.drive.find(this.filename(appId), authorization);
+        if (found)
+            await this.drive.delete(found.fileId, authorization);
+    }
+    filename(appId) {
+        return (this.options.filename?.(appId) ?? `sync-kit-sharing-identity-${appId}.json`);
+    }
+}
+//# sourceMappingURL=appdata-identity-store.js.map

package/dist/sharing/appdata-identity-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appdata-identity-store.js","sourceRoot":"","sources":["../../src/sharing/appdata-identity-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EACL,+BAA+B,GAGhC,MAAM,kBAAkB,CAAC;AAc1B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,yCAAyC;IAMjC;IAHF,KAAK,CAA0B;IAEhD,YACmB,OAAyD;QAAzD,YAAO,GAAP,OAAO,CAAkD;QAE1E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,uBAAuB,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACpE,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAkC;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE;YAClE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;QACzE,IAAI,KAAK;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClE,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,6BAA6B,KAAK,OAAO,CAC5E,CAAC;IACJ,CAAC;CACF"}

package/dist/sharing/control.d.ts

@@ -0,0 +1,136 @@
+import type { SharingPublicKeyV1 } from "./index.js";
+import { type WebCryptoSharingIdentity } from "./web-crypto.js";
+import type { SharedBackupController, SharedBackupControllerCodec, SharedDatasetResult } from "./controller.js";
+/**
+ * An encrypted, merge-safe coordination dataset. It is intentionally separate
+ * from application data so every profile participant may acknowledge a
+ * migration without being allowed to modify the data being migrated.
+ */
+export declare const SHARING_CONTROL_KIND: "sync-kit-sharing-control";
+export declare const SHARING_CONTROL_EVENT_KIND: "sync-kit-sharing-control-event";
+export type SharingControlMemberV1 = {
+    publicKey: SharingPublicKeyV1;
+    email?: string;
+    googleSubject?: string;
+    drivePermissionId?: string;
+};
+export type SharingControlMigrationTargetV1 = {
+    datasetId: string;
+    fileId: string;
+    revisionId?: string;
+};
+export type SharingControlMigrationRequirementV1 = {
+    keyId: string;
+    targetFileIds: string[];
+};
+export type SharingControlMigrationV1 = {
+    migrationId: string;
+    sourceDatasetIds: string[];
+    targets: SharingControlMigrationTargetV1[];
+    requiredAcks: SharingControlMigrationRequirementV1[];
+    mode: "hard-cutover";
+};
+type SharingControlEventBaseV1 = {
+    schemaVersion: 1;
+    kind: typeof SHARING_CONTROL_EVENT_KIND;
+    eventId: string;
+    profileId: string;
+    actorKeyId: string;
+    sequence: number;
+    createdAt: string;
+    signature: string;
+};
+export type SharingControlMemberUpsertEventV1 = SharingControlEventBaseV1 & {
+    type: "member-upsert";
+    member: SharingControlMemberV1;
+};
+export type SharingControlMigrationAnnouncedEventV1 = SharingControlEventBaseV1 & {
+    type: "migration-announced";
+    migration: SharingControlMigrationV1;
+};
+export type SharingControlMigrationAcknowledgedEventV1 = SharingControlEventBaseV1 & {
+    type: "migration-acknowledged";
+    migrationId: string;
+    openedFileIds: string[];
+};
+export type SharingControlMigrationClosedEventV1 = SharingControlEventBaseV1 & {
+    type: "migration-closed";
+    migrationId: string;
+    forced?: boolean;
+};
+export type SharingControlEventV1 = SharingControlMemberUpsertEventV1 | SharingControlMigrationAnnouncedEventV1 | SharingControlMigrationAcknowledgedEventV1 | SharingControlMigrationClosedEventV1;
+export type SharingControlStateV1 = {
+    schemaVersion: 1;
+    kind: typeof SHARING_CONTROL_KIND;
+    profileId: string;
+    events: SharingControlEventV1[];
+};
+export type VerifiedSharingControlStateV1 = {
+    state: SharingControlStateV1;
+    ownerKeyId: string;
+    members: Map<string, SharingControlMemberV1>;
+    migrations: Map<string, SharingControlMigrationV1>;
+    acknowledgements: Map<string, Map<string, SharingControlMigrationAcknowledgedEventV1>>;
+    closedMigrations: Set<string>;
+};
+export type SharingControlMigrationStatusV1 = {
+    migration: SharingControlMigrationV1;
+    acknowledgedKeyIds: string[];
+    pendingKeyIds: string[];
+    closed: boolean;
+};
+export type SharingControlDatasetOptions = {
+    controller: SharedBackupController<SharingControlStateV1>;
+    datasetId: string;
+    profileId: string;
+    identity(): Promise<WebCryptoSharingIdentity>;
+    crypto?: Crypto;
+    now?: () => Date;
+    randomUUID?: () => string;
+    maxPublishAttempts?: number;
+};
+/**
+ * Creates a codec whose merge is an event-id union. Signature and authority
+ * validation is intentionally asynchronous and is performed by
+ * `verifySharingControlStateV1` before callers act on the state.
+ */
+export declare function createSharingControlCodec(): SharedBackupControllerCodec<SharingControlStateV1>;
+export declare function parseSharingControlStateV1(value: unknown): SharingControlStateV1;
+export declare function parseSharingControlEventV1(value: unknown): SharingControlEventV1;
+export declare function mergeSharingControlStates(local: SharingControlStateV1, remote: SharingControlStateV1): SharingControlStateV1;
+export declare function verifySharingControlStateV1(input: SharingControlStateV1, cryptoImplementation?: Crypto, options?: {
+    trustedOwnerKeyId?: string;
+}): Promise<VerifiedSharingControlStateV1>;
+export declare function missingSharingControlPickerFiles(requirement: SharingControlMigrationRequirementV1, openedFileIds: readonly string[]): string[];
+export declare class SharingControlDataset {
+    private readonly options;
+    constructor(options: SharingControlDatasetOptions);
+    create(owner?: Omit<SharingControlMemberV1, "publicKey">): Promise<SharedDatasetResult<SharingControlStateV1>>;
+    read(): Promise<VerifiedSharingControlStateV1>;
+    addMember(member: SharingControlMemberV1): Promise<SharedDatasetResult<SharingControlStateV1>>;
+    /**
+     * Mirrors cryptographically accepted control-file participants into the
+     * signed directory. Call this after accepting a join response; `metadata`
+     * supplies the application-visible email/Drive details that envelopes do
+     * not contain.
+     */
+    synchronizeMembers(metadata?: Record<string, Omit<SharingControlMemberV1, "publicKey">>): Promise<SharedDatasetResult<SharingControlStateV1> | null>;
+    announceMigration(migration: SharingControlMigrationV1): Promise<SharedDatasetResult<SharingControlStateV1>>;
+    acknowledgeMigration(input: {
+        migrationId: string;
+        openedFileIds: string[];
+    }): Promise<SharedDatasetResult<SharingControlStateV1>>;
+    closeMigration(input: {
+        migrationId: string;
+        force?: boolean;
+    }): Promise<SharedDatasetResult<SharingControlStateV1>>;
+    migrationStatus(migrationId: string): Promise<SharingControlMigrationStatusV1>;
+    private publish;
+    private sign;
+    private now;
+    private randomUUID;
+    private crypto;
+}
+export declare function createSharingControlDataset(options: SharingControlDatasetOptions): SharingControlDataset;
+export {};
+//# sourceMappingURL=control.d.ts.map

package/dist/sharing/control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control.d.ts","sourceRoot":"","sources":["../../src/sharing/control.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AACxE,eAAO,MAAM,0BAA0B,EAAG,gCAAyC,CAAC;AAEpF,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAC3C,YAAY,EAAE,oCAAoC,EAAE,CAAC;IACrD,IAAI,EAAE,cAAc,CAAC;CACtB,CAAC;AAEF,KAAK,yBAAyB,GAAG;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,0BAA0B,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,yBAAyB,GAAG;IAC1E,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,uCAAuC,GACjD,yBAAyB,GAAG;IAC1B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,yBAAyB,CAAC;CACtC,CAAC;AAEJ,MAAM,MAAM,0CAA0C,GACpD,yBAAyB,GAAG;IAC1B,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB,CAAC;AAEJ,MAAM,MAAM,oCAAoC,GAAG,yBAAyB,GAAG;IAC7E,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B,iCAAiC,GACjC,uCAAuC,GACvC,0CAA0C,GAC1C,oCAAoC,CAAC;AAQzC,MAAM,MAAM,qBAAqB,GAAG;IAClC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,OAAO,oBAAoB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,EAAE,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC7C,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;IACnD,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC,CAAC;IACvF,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,SAAS,EAAE,yBAAyB,CAAC;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,UAAU,EAAE,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,2BAA2B,CAAC,qBAAqB,CAAC,CAO9F;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAoBhF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAgDhF;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,qBAAqB,EAC5B,MAAM,EAAE,qBAAqB,GAC5B,qBAAqB,CAevB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,qBAAqB,EAC5B,oBAAoB,GAAE,MAA0B,EAChD,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CAoFxC;AAED,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,oCAAoC,EACjD,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,MAAM,EAAE,CAGV;AAED,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,4BAA4B;IAK5D,MAAM,CAAC,KAAK,GAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAclH,IAAI,IAAI,OAAO,CAAC,6BAA6B,CAAC;IAMpD,SAAS,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAI9F;;;;;OAKG;IACG,kBAAkB,CACtB,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAM,GACvE,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC;IA0B7D,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAI5G,oBAAoB,CAAC,KAAK,EAAE;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,EAAE,CAAC;KACzB,GAAG,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAyBvD,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;IAmBjD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC;YAiBtE,OAAO;YA2BP,IAAI;IAyBlB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,MAAM;CAKf;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,4BAA4B,GAAG,qBAAqB,CAExG"}