@nestm/storage 0.1.0-alpha.4 → 0.1.0-alpha.5

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # @nestm/storage
 
+## 0.1.0-alpha.5
+
+### Minor Changes
+
+- 227df5b: Add byte-compatible encrypted artifact storage through the
+  `@nestm/storage/artifacts` and `@nestm/storage/artifacts/nest` entry points.
+
+  The framework-neutral facade stores self-contained CAE1 AES-256-GCM envelopes,
+  binds ciphertext to its tenant, artifact, version, and path context, supports
+  local and AWS KMS key providers, and preserves authenticated content types,
+  bounded reads, versioned bundles, legacy migration reads, and encrypted generic
+  objects. The Nest entry point composes artifact and object adapters over two
+  named storage clients and clears cached data keys on shutdown.
+
+  The public protocol keeps the deployed filesystem and object-provider layouts,
+  reserves configurable ObjectStore namespaces from artifact ids, validates all
+  artifact/version paths, and bounds ZIP entry count and expansion before any
+  write. CAE1 now rejects unauthenticated empty content types and writer-side
+  oversized headers, KMS verifies the stored key id, DEK cache lifetimes are
+  capped at five minutes, filesystem `.ct` collisions are rejected, and sweepers
+  skip objects without trustworthy timestamps.
+
 ## 0.1.0-alpha.4
 
 ### Minor Changes

package/README.md

@@ -43,6 +43,9 @@ Install only the native SDKs required by the chosen provider. For example:
 pnpm add @aws-sdk/client-s3 @aws-sdk/s3-presigned-post \
   @aws-sdk/s3-request-presigner @aws-sdk/lib-storage
 
+# Encrypted artifact storage with AWS KMS
+pnpm add @aws-sdk/client-kms
+
 # Google Cloud Storage
 pnpm add @google-cloud/storage google-auth-library
 
@@ -88,6 +91,117 @@ storage errors and operation types, and `StorageUploadControl`. It has no NestJS
 runtime or declaration imports. Provider adapters remain available through
 `@nestm/storage/files-sdk`.
 
+## Encrypted artifact storage
+
+The optional `@nestm/storage/artifacts` entry point adds a framework-neutral
+artifact facade over the same provider drivers. Every write is a self-contained
+CAE1 AES-256-GCM envelope; plaintext mode does not exist. The authenticated
+context binds each object to its tenant scope, artifact id, version, path, and
+content type so moving ciphertext to another address fails closed.
+
+Install `@aws-sdk/client-kms` in every artifact-storage consumer. It is an
+optional peer so core-only applications do not download AWS KMS, while artifact
+applications can choose either the local key provider or KMS at runtime.
+
+Set `ARTIFACT_KEY_PROVIDER=local` with a base64-encoded 32-byte `ARTIFACT_KEK`
+(`ARTIFACT_KEK_NAME` is optional), or set `ARTIFACT_KEY_PROVIDER=kms` with
+`ARTIFACT_KMS_KEY_ID` (`ARTIFACT_KMS_REGION` is optional). Invalid or missing
+key configuration aborts startup. `ARTIFACT_ENCRYPTION_READ_LEGACY=true` is a
+temporary, explicit plaintext-read migration flag and never enables plaintext
+writes.
+
+```ts
+import {
+  artifactScope,
+  artifactStorageConfigFromEnv,
+  createArtifactStorage,
+  storageCryptoFromEnv,
+} from '@nestm/storage/artifacts';
+
+const storage = await createArtifactStorage(
+  artifactStorageConfigFromEnv(process.env),
+  storageCryptoFromEnv(process.env),
+);
+
+const ref = artifactScope({
+  organizationId: 'org-1',
+  ownerUserId: 'user-1',
+});
+
+await storage.writeHtml('artifact-1', Buffer.from('<h1>Encrypted</h1>'), {
+  scope: ref,
+});
+
+const html = await storage.read('artifact-1', 'index.html', {
+  scope: ref,
+});
+```
+
+`writeBundle()` expands a zip into separately authenticated objects, skips
+traversal and reserved-namespace entries, and rejects case-folded duplicate
+paths, more than 1,000 entries, entries larger than 64 MiB, or more than 256 MiB
+total expanded data. Callers may lower those limits per write. `read()` and
+`readWithInfo()` support directory-to-`index.html` resolution, optional
+plaintext-size limits, and version-bound paths.
+
+`ObjectStore` exposes the same encryption guarantees for non-artifact objects
+such as upload staging and organization media. Keys must begin with a configured
+top-level namespace; the defaults are `_staging` and `org-logos`. Those names
+are reserved as artifact ids, case-insensitively, so artifact and object
+operations cannot address one another even when an object-store provider uses a
+shared bucket root. Override the top-level
+`ArtifactStorageConfig.objectNamespaces` field when an application owns
+different object families.
+
+Keep `objectNamespaces` identical across every reader and writer for a deployed
+store; changing the set is a storage-protocol migration, not a per-process
+preference. On case-insensitive filesystems, use case-stable artifact ids,
+version ids, and object keys (Concepta's lowercase UUID ids satisfy this).
+
+The CAE1 framing and its `{ scope, artifactId, version, path }` context are a
+compatibility contract. Existing envelopes remain readable. Filesystems retain
+the layouts `<root>/<artifactId>/<path>` and `<root>/_objects/<key>`; S3 and
+other object-store providers retain their deployed unprefixed object keys, so a
+rolling upgrade does not split old and new writers across keyspaces. Artifact
+and version ids must each be one safe storage segment. Legacy plaintext reads
+are available only through the explicit
+`ARTIFACT_ENCRYPTION_READ_LEGACY=true` migration flag; writes are always
+encrypted.
+
+The convenience `createArtifactStorage()` and `createObjectStore()` factories
+are ideal for scripts. Long-running framework-neutral processes that need an
+explicit shutdown path should create the raw clients with
+`createArtifactStorageClient()` / `createObjectStorageClient()`, compose them
+with the corresponding `create*WithClient()` function, call each client's
+`onApplicationShutdown()`, and finally call `crypto.keyProvider.clear()`. The
+Nest module owns that lifecycle automatically.
+
+Nest applications can register both adapters with one dynamic module:
+
+```ts
+import { Module } from '@nestjs/common';
+import {
+  artifactStorageConfigFromEnv,
+  storageCryptoFromEnv,
+} from '@nestm/storage/artifacts';
+import { ArtifactStorageModule } from '@nestm/storage/artifacts/nest';
+
+@Module({
+  imports: [
+    ArtifactStorageModule.forRoot({
+      config: artifactStorageConfigFromEnv(process.env),
+      crypto: storageCryptoFromEnv(process.env),
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+Inject `ArtifactStorage` with `@InjectArtifactStorage()` and `ObjectStore` with
+`@InjectObjectStore()`. The module owns named raw clients (`artifacts` and
+`objects`) and clears cached data keys during application shutdown. Set
+`isGlobal: true` only when both adapters are intentionally application-wide.
+
 ## Configure named stores
 
 Use the package-owned S3 factory when applicable. For other providers, create a

package/dist/artifacts/artifact-storage.d.ts

@@ -0,0 +1,161 @@
+import { type StorageClient } from '../core/index.js';
+import { SCOPE_FROM_HEADER, type StorageCrypto } from './crypto/index.js';
+import { type ArtifactStorageConfig } from './storage-driver.js';
+export { assertStorageProvider, defaultFsRoot, type ArtifactStorageConfig, } from './storage-driver.js';
+/**
+ * Storage for uploaded artifact files, keyed `<artifactId>/<path>` (e.g. `<id>/index.html`,
+ * `<id>/assets/app.js`). The api writes; the sandbox reads. The `fs` provider keeps both pointed
+ * at one directory (fine for a single host / shared volume); any object-store provider — S3, GCS,
+ * Azure, R2, and the rest — lets the two services share storage without a shared volume, which is
+ * what running them on separate hosts (as on ECS) requires.
+ *
+ * Every object is stored as a CAE1 encryption envelope (ADR-0001, SEC-03): callers must say who
+ * owns what they write (`ScopeRef`) and what they expect to read (`ReadRef`) — the codec binds
+ * ciphertext to `{scope, artifactId, version, path}` so a swapped or replayed object fails closed.
+ */
+export interface ArtifactStorage {
+    /** Single self-contained HTML artifact → `<id>/index.html`. */
+    writeHtml(artifactId: string, buffer: Buffer, ref: ScopeRef): Promise<void>;
+    /**
+     * Pre-built SPA bundle (a zip whose root contains index.html). Encrypted per extracted entry.
+     * With `opts.versionId` (VER-03), entries land under `v/<versionId>/…` and are sealed with
+     * `ctx.version = versionId` (the caller's `ref.version` is overridden to match — the path⇔version
+     * biconditional is derived, never trusted). Reserved-namespace screening applies to the zip
+     * ENTRY name in both modes: a bundle shipping `v/…` or `__…` files has those skipped, not nested.
+     */
+    writeBundle(artifactId: string, zipBuffer: Buffer, ref: ScopeRef, opts?: WriteBundleOptions): Promise<void>;
+    /**
+     * Write an arbitrary file within the artifact (e.g. `__vendor/<hash>.js`, `__meta.json`).
+     * Rejects any `relPath` escaping the artifact directory. `contentType` rides the envelope
+     * header (authenticated) on both backends.
+     */
+    writeFile(artifactId: string, relPath: string, buffer: Buffer, ref: ScopeRef, contentType?: string): Promise<void>;
+    /** Server-rendered PNG preview → reserved key `<id>/__thumb.png`. */
+    writeThumbnail(artifactId: string, pngBuffer: Buffer, ref: ScopeRef): Promise<void>;
+    /** Delete every file under the artifact (includes the thumbnail). */
+    remove(artifactId: string): Promise<void>;
+    /**
+     * Read a file within the artifact; `relPath === ""` resolves to index.html. `null` if absent.
+     * Throws `EnvelopeError` on any decrypt failure — a corrupt or swapped object must never be
+     * mistaken for a missing one (no SPA fallback over tampering).
+     */
+    read(artifactId: string, relPath: string, ref: ReadRef, options?: ArtifactReadOptions): Promise<Buffer | null>;
+    /**
+     * Like `read`, but also returns the envelope's AUTHENTICATED content type (VER-03). This is the
+     * read primitive for publish/CoW copy loops: a decrypt→re-encrypt copy must re-seal with the
+     * same `ct` it opened (the type is AAD-bound and steers serving), and `read()` discards it.
+     * `contentType` is undefined only for legacy plaintext pass-throughs (nothing was verified).
+     */
+    readWithInfo(artifactId: string, relPath: string, ref: ReadRef, options?: ArtifactReadOptions): Promise<StoredObject | null>;
+    /**
+     * Delete specific files under the artifact (VER-03: publish prunes root paths removed by the
+     * newly-materialized version). Paths escaping the artifact directory and missing paths are
+     * ignored (idempotent — publish repair re-runs the same prune).
+     */
+    deleteFiles(artifactId: string, relPaths: string[]): Promise<void>;
+    /**
+     * List stored objects under the artifact (optionally under `subPrefix`, e.g. `v/<versionId>/`).
+     * Returns artifact-relative forward-slash paths + last-modified stamps, sorted by path. Reads
+     * no object bodies and needs no crypto — it serves the sweepers/invariants (version-prefix
+     * existence, orphan-prefix age, canonical bundle enumeration), never the serving plane.
+     */
+    listFiles(artifactId: string, subPrefix?: string): Promise<StoredFileInfo[]>;
+}
+/** One listed storage object (metadata only — the body stays sealed). */
+export interface StoredFileInfo {
+    /** Artifact-relative path, forward slashes (e.g. `index.html`, `v/<vid>/index.html`). */
+    path: string;
+    lastModified: Date;
+}
+/** A decrypted object plus the authenticated content type it was sealed with (see readWithInfo). */
+export interface StoredObject {
+    plain: Buffer;
+    /** From the envelope header (`ct`, AAD-bound); undefined for legacy plaintext pass-throughs. */
+    contentType?: string;
+}
+/** Bounds decrypted data while also bounding the opaque envelope downloaded before decryption. */
+export interface ArtifactReadOptions {
+    readonly maxPlainBytes?: number;
+}
+/** Permanent, address-independent read rejection safe for callers to map to a bounded 4xx. */
+export declare class ArtifactReadLimitError extends Error {
+    readonly maxPlainBytes: number;
+    constructor(maxPlainBytes: number);
+}
+/** Permanent rejection for a ZIP whose declared expansion exceeds the public protocol limits. */
+export declare class ArtifactBundleLimitError extends Error {
+    readonly reason: 'entries' | 'entry-bytes' | 'total-bytes';
+    constructor(reason: 'entries' | 'entry-bytes' | 'total-bytes');
+}
+export declare const ARTIFACT_BUNDLE_MAX_ENTRIES = 1000;
+export declare const ARTIFACT_BUNDLE_MAX_ENTRY_BYTES: number;
+export declare const ARTIFACT_BUNDLE_MAX_TOTAL_BYTES: number;
+/** Reserved storage path for the generated PNG preview, served by the sandbox as `<id>/__thumb.png`. */
+export declare const THUMBNAIL_KEY = "__thumb.png";
+/** Options for writeBundle (VER-03 versioned bundle writes). */
+export interface WriteBundleOptions {
+    /** Write entries under `v/<versionId>/…` with `ctx.version = versionId` instead of the root. */
+    versionId?: string;
+    /** Optional stricter limits; values may lower, but never raise, the protocol hard limits. */
+    limits?: {
+        maxEntries?: number;
+        maxEntryBytes?: number;
+        maxTotalBytes?: number;
+    };
+}
+/** Who owns an object being written; `version` stays null until VER-02 introduces versions. */
+export interface ScopeRef {
+    /** `org:<organizationId>` | `user:<ownerUserId>` | `upload:<uploadId>` — see artifactScope(). */
+    scope: string;
+    version?: string | null;
+}
+/**
+ * What the reader independently knows. The api asserts the scope it fetched from the DB; the
+ * sandbox — which only knows the artifactId — passes SCOPE_FROM_HEADER and relies on the wrap
+ * layer to enforce scope cryptographically (see crypto/context.ts).
+ */
+export interface ReadRef {
+    scope: string | typeof SCOPE_FROM_HEADER;
+    version?: string | null;
+}
+export declare function createArtifactStorage(cfg: ArtifactStorageConfig, crypto: StorageCrypto): Promise<ArtifactStorage>;
+/** Framework-neutral domain adapter used by both direct consumers and the Nest composition entry. */
+export declare function createArtifactStorageWithClient(cfg: ArtifactStorageConfig, crypto: StorageCrypto, client: StorageClient): ArtifactStorage;
+/**
+ * Storage path prefix for a version's objects (AP-002): `""` for a backfilled `canonical_v1`
+ * version (its bytes ARE the canonical root objects) and `v/<versionId>/` for a `versioned` one.
+ */
+export declare function versionPrefix(layout: 'canonical_v1' | 'versioned', versionId: string): string;
+/**
+ * Envelope `ctx.version` for a version's objects (AP-002): `null` for `canonical_v1` (root AAD —
+ * the serving plane is version-free forever) and the version UUID, byte-identical to the path
+ * segment, for `versioned`.
+ */
+export declare function versionAad(layout: 'canonical_v1' | 'versioned', versionId: string): string | null;
+/** Artifact ids are one storage segment; `_objects` is the filesystem object-store namespace. */
+export declare function assertArtifactId(artifactId: string): void;
+/** Version ids are one storage segment because they are interpolated under `v/<id>/`. */
+export declare function assertVersionId(versionId: string): void;
+/**
+ * Is this artifact-relative path inside the namespaces VER-02 reserves for the platform — the
+ * `v/` version prefix and the `__`-internal families (meta/thumb/source/snapshot/overflow) —
+ * with the one serving exemption, top-level single-segment `__vendor/<name>` pool assets?
+ * User-supplied bundle entries matching this are SKIPPED at write time (writeBundle), exactly
+ * like zip-slip entries: the sandbox deny-guard will never serve them, and letting them through
+ * to the seal chokepoint would turn a hostile/quirky zip into a mid-write throw.
+ */
+export declare function isReservedArtifactPath(relPath: string): boolean;
+/**
+ * AP-002 storage rule 2: `path.startsWith("v/" + version + "/") ⇔ version !== null`. Root objects
+ * never live under the reserved `v/` namespace and versioned objects never live anywhere else —
+ * asserted at the single ctx chokepoint (covers reads and writes, both backends), so a
+ * mis-addressed artifact object is impossible rather than unlikely. Throws (fail-closed): this is
+ * a programming error, never user input — every USER-named path (zip entries) is screened by
+ * `isReservedArtifactPath` before it can reach this assertion.
+ */
+export declare function assertVersionPath(path: string, version: string | null): void;
+/** Structured, greppable trace of a legacy plaintext pass-through (SEC-04 migration window). */
+export declare function warnLegacyRead(where: string, key: string): void;
+/** content-type for an artifact file path, falling back to octet-stream. */
+export declare function contentTypeFor(path: string): string;
+//# sourceMappingURL=artifact-storage.d.ts.map

package/dist/artifacts/artifact-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-storage.d.ts","sourceRoot":"","sources":["../../src/artifacts/artifact-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAIL,iBAAiB,EAEjB,KAAK,aAAa,EACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E;;;;;;OAMG;IACH,WAAW,CACT,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,QAAQ,EACb,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;OAIG;IACH,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,qEAAqE;IACrE,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C;;;;OAIG;IACH,IAAI,CACF,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CACV,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CAC9E;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,IAAI,CAAC;CACpB;AAED,oGAAoG;AACpG,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,8FAA8F;AAC9F,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM;IAA1C,YAAqB,aAAa,EAAE,MAAM,EAGzC;CACF;AAED,iGAAiG;AACjG,qBAAa,wBAAyB,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,aAAa;IAAtE,YAAqB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,aAAa,EAGrE;CACF;AAED,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AACjD,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAChE,eAAO,MAAM,+BAA+B,QAAoB,CAAC;AAEjE,wGAAwG;AACxG,eAAO,MAAM,aAAa,gBAAgB,CAAC;AAE3C,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACvB,iGAAiG;IACjG,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,OAAO;IAItB,KAAK,EAAE,MAAM,GAAG,OAAO,iBAAiB,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CAM1B;AAED,qGAAqG;AACrG,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,eAAe,CAOjB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,cAAc,GAAG,WAAW,EACpC,SAAS,EAAE,MAAM,GAChB,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,cAAc,GAAG,WAAW,EACpC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAGf;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKzD;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAEvD;AAoCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgB/D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAgB5E;AA8GD,gGAAgG;AAChG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAO/D;AAyVD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD"}