@rocicorp/zero 0.26.1 → 0.26.2-canary.1

package/out/zero-cache/src/workers/syncer.js

@@ -1,209 +1,155 @@
-import { resolver } from "@rocicorp/resolver";
-import { pid } from "node:process";
-import { WebSocketServer } from "ws";
 import { promiseVoid } from "../../../shared/src/resolved-promises.js";
-import "../../../zero-protocol/src/error.js";
-import { tokenConfigOptions, verifyToken } from "../auth/jwt.js";
 import "../config/zero-config.js";
-import { setActiveClientGroupsGetter, recordConnectionAttempted, recordConnectionSuccess } from "../server/anonymous-otel-start.js";
-import { ServiceRunner } from "../services/runner.js";
-import { DrainCoordinator } from "../services/view-syncer/drain-coordinator.js";
 import { installWebSocketReceiver } from "../types/websocket-handoff.js";
-import { sendError, Connection } from "./connection.js";
 import { createNotifierFrom, subscribeTo } from "./replicator.js";
+import { recordConnectionAttempted, recordConnectionSuccess, setActiveClientGroupsGetter } from "../server/anonymous-otel-start.js";
+import "../auth/auth.js";
+import { tokenConfigOptions, verifyToken } from "../auth/jwt.js";
+import { ServiceRunner } from "../services/runner.js";
+import { DrainCoordinator } from "../services/view-syncer/drain-coordinator.js";
+import { Connection, sendError } from "./connection.js";
 import { SyncerWsMessageHandler } from "./syncer-ws-message-handler.js";
+import { resolver } from "@rocicorp/resolver";
+import { pid } from "node:process";
+import { WebSocketServer } from "ws";
+//#region ../zero-cache/src/workers/syncer.ts
 function getWebSocketServerOptions(config) {
-  const options = {
-    noServer: true,
-    maxPayload: config.websocketMaxPayloadBytes
-  };
-  if (config.websocketCompression) {
-    options.perMessageDeflate = true;
-    if (config.websocketCompressionOptions) {
-      try {
-        const compressionOptions = JSON.parse(
-          config.websocketCompressionOptions
-        );
-        options.perMessageDeflate = compressionOptions;
-      } catch (e) {
-        throw new Error(
-          `Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`
-        );
-      }
-    }
-  }
-  return options;
-}
-class Syncer {
-  id = `syncer-${pid}`;
-  #lc;
-  #viewSyncers;
-  #mutagens;
-  #pushers;
-  #connections = /* @__PURE__ */ new Map();
-  #drainCoordinator = new DrainCoordinator();
-  #parent;
-  #wss;
-  #stopped = resolver();
-  #config;
-  constructor(lc, config, viewSyncerFactory, mutagenFactory, pusherFactory, parent) {
-    this.#config = config;
-    const notifier = createNotifierFrom(lc, parent);
-    subscribeTo(lc, parent);
-    this.#lc = lc;
-    this.#viewSyncers = new ServiceRunner(
-      lc,
-      (id) => viewSyncerFactory(
-        id,
-        notifier.subscribe(),
-        this.#drainCoordinator,
-        this.#validateLegacyJWT()
-      ),
-      (v) => v.keepalive()
-    );
-    this.#mutagens = new ServiceRunner(lc, mutagenFactory, (m) => m.hasRefs());
-    if (pusherFactory) {
-      this.#pushers = new ServiceRunner(lc, pusherFactory, (p) => p.hasRefs());
-    }
-    this.#parent = parent;
-    this.#wss = new WebSocketServer(getWebSocketServerOptions(config));
-    installWebSocketReceiver(
-      lc,
-      this.#wss,
-      this.#createConnection,
-      this.#parent
-    );
-    setActiveClientGroupsGetter(() => this.#viewSyncers.size);
-  }
-  #createConnection = async (ws, params) => {
-    this.#lc.debug?.(
-      "creating connection",
-      params.clientGroupID,
-      params.clientID
-    );
-    recordConnectionAttempted();
-    const { clientID, clientGroupID, auth, userID } = params;
-    const hasProvidedAuth = auth !== void 0 && auth !== "";
-    if (hasProvidedAuth) {
-      const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});
-      const hasPushOrMutate = this.#config?.push?.url !== void 0 || this.#config?.mutate?.url !== void 0;
-      const hasQueries = this.#config?.query?.url !== void 0 || this.#config?.getQueries?.url !== void 0;
-      const hasExactlyOneTokenOption = tokenOptions.length === 1;
-      const hasCustomEndpoints = hasPushOrMutate && hasQueries;
-      if (!hasExactlyOneTokenOption && !hasCustomEndpoints) {
-        throw new Error(
-          "Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: " + JSON.stringify(tokenOptions) + ". You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options."
-        );
-      }
-    }
-    const viewSyncer = this.#viewSyncers.getService(clientGroupID);
-    const authResult = await viewSyncer.initAuthSession(userID, auth);
-    if (!authResult.ok) {
-      sendError(this.#lc, ws, authResult.error);
-      ws.close(3e3, authResult.error.message);
-      return;
-    }
-    const existing = this.#connections.get(clientID);
-    if (existing) {
-      this.#lc.debug?.(
-        `client ${clientID} already connected, closing existing connection`
-      );
-      existing.close(`replaced by ${params.wsID}`);
-    }
-    const mutagen = this.#mutagens.getService(clientGroupID);
-    const pusher = this.#pushers?.getService(clientGroupID);
-    mutagen.ref();
-    pusher?.ref();
-    let connection;
-    try {
-      connection = new Connection(
-        this.#lc,
-        params,
-        ws,
-        new SyncerWsMessageHandler(
-          this.#lc,
-          params,
-          viewSyncer,
-          mutagen,
-          pusher
-        ),
-        () => {
-          if (this.#connections.get(clientID) === connection) {
-            this.#connections.delete(clientID);
-          }
-          mutagen.unref();
-          pusher?.unref();
-        }
-      );
-    } catch (e) {
-      mutagen.unref();
-      pusher?.unref();
-      throw e;
-    }
-    this.#connections.set(clientID, connection);
-    connection.init() && recordConnectionSuccess();
-    if (params.initConnectionMsg) {
-      this.#lc.debug?.(
-        "handling init connection message from sec header",
-        params.clientGroupID,
-        params.clientID
-      );
-      await connection.handleInitConnection(
-        JSON.stringify(params.initConnectionMsg)
-      );
-    }
-  };
-  run() {
-    return this.#stopped.promise;
-  }
-  /**
-   * Graceful shutdown involves shutting down view syncers one at a time, pausing
-   * for the duration of view syncer's hydration between each one. This paces the
-   * disconnects to avoid creating a backlog of hydrations in the receiving server
-   * when the clients reconnect.
-   */
-  async drain() {
-    const start = Date.now();
-    this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);
-    this.#drainCoordinator.drainNextIn(0);
-    while (this.#viewSyncers.size) {
-      await this.#drainCoordinator.forceDrainTimeout;
-      for (const vs of this.#viewSyncers.getServices()) {
-        this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);
-        void vs.stop();
-        break;
-      }
-    }
-    this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);
-  }
-  stop() {
-    this.#wss.close();
-    this.#stopped.resolve();
-    return promiseVoid;
-  }
-  /** @deprecated used in JWT validation */
-  #validateLegacyJWT() {
-    const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});
-    if (tokenOptions.length !== 1) {
-      return void 0;
-    }
-    return async (token, { userID }) => {
-      const decoded = await verifyToken(this.#config.auth, token, {
-        subject: userID,
-        ...this.#config.auth?.issuer && { issuer: this.#config.auth.issuer },
-        ...this.#config.auth?.audience && {
-          audience: this.#config.auth.audience
-        }
-      });
-      return {
-        type: "jwt",
-        raw: token,
-        decoded
-      };
-    };
-  }
+	const options = {
+		noServer: true,
+		maxPayload: config.websocketMaxPayloadBytes
+	};
+	if (config.websocketCompression) {
+		options.perMessageDeflate = true;
+		if (config.websocketCompressionOptions) try {
+			options.perMessageDeflate = JSON.parse(config.websocketCompressionOptions);
+		} catch (e) {
+			throw new Error(`Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`);
+		}
+	}
+	return options;
 }
-export {
-  Syncer
+/**
+* The Syncer worker receives websocket handoffs for "/sync" connections
+* from the Dispatcher in the main thread, and creates websocket
+* {@link Connection}s with a corresponding {@link ViewSyncer}, {@link Mutagen},
+* and {@link Subscription} to version notifications from the Replicator
+* worker.
+*/
+var Syncer = class {
+	id = `syncer-${pid}`;
+	#lc;
+	#viewSyncers;
+	#mutagens;
+	#pushers;
+	#connections = /* @__PURE__ */ new Map();
+	#drainCoordinator = new DrainCoordinator();
+	#parent;
+	#wss;
+	#stopped = resolver();
+	#config;
+	constructor(lc, config, viewSyncerFactory, mutagenFactory, pusherFactory, parent) {
+		this.#config = config;
+		const notifier = createNotifierFrom(lc, parent);
+		subscribeTo(lc, parent);
+		this.#lc = lc;
+		this.#viewSyncers = new ServiceRunner(lc, (id) => viewSyncerFactory(id, notifier.subscribe(), this.#drainCoordinator, this.#validateLegacyJWT()), (v) => v.keepalive());
+		this.#mutagens = new ServiceRunner(lc, mutagenFactory, (m) => m.hasRefs());
+		if (pusherFactory) this.#pushers = new ServiceRunner(lc, pusherFactory, (p) => p.hasRefs());
+		this.#parent = parent;
+		this.#wss = new WebSocketServer(getWebSocketServerOptions(config));
+		installWebSocketReceiver(lc, this.#wss, this.#createConnection, this.#parent);
+		setActiveClientGroupsGetter(() => this.#viewSyncers.size);
+	}
+	#createConnection = async (ws, params) => {
+		this.#lc.debug?.("creating connection", params.clientGroupID, params.clientID);
+		recordConnectionAttempted();
+		const { clientID, clientGroupID, auth, userID } = params;
+		if (auth !== void 0 && auth !== "") {
+			const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});
+			const hasPushOrMutate = this.#config?.push?.url !== void 0 || this.#config?.mutate?.url !== void 0;
+			const hasQueries = this.#config?.query?.url !== void 0 || this.#config?.getQueries?.url !== void 0;
+			if (!(tokenOptions.length === 1) && !(hasPushOrMutate && hasQueries)) throw new Error("Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: " + JSON.stringify(tokenOptions) + ". You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.");
+		}
+		const viewSyncer = this.#viewSyncers.getService(clientGroupID);
+		const authResult = await viewSyncer.initAuthSession(userID, auth);
+		if (!authResult.ok) {
+			sendError(this.#lc, ws, authResult.error);
+			ws.close(3e3, authResult.error.message);
+			return;
+		}
+		const existing = this.#connections.get(clientID);
+		if (existing) {
+			this.#lc.debug?.(`client ${clientID} already connected, closing existing connection`);
+			existing.close(`replaced by ${params.wsID}`);
+		}
+		const mutagen = this.#mutagens.getService(clientGroupID);
+		const pusher = this.#pushers?.getService(clientGroupID);
+		mutagen.ref();
+		pusher?.ref();
+		let connection;
+		try {
+			connection = new Connection(this.#lc, params, ws, new SyncerWsMessageHandler(this.#lc, params, viewSyncer, mutagen, pusher), () => {
+				if (this.#connections.get(clientID) === connection) this.#connections.delete(clientID);
+				mutagen.unref();
+				pusher?.unref();
+			});
+		} catch (e) {
+			mutagen.unref();
+			pusher?.unref();
+			throw e;
+		}
+		this.#connections.set(clientID, connection);
+		connection.init() && recordConnectionSuccess();
+		if (params.initConnectionMsg) {
+			this.#lc.debug?.("handling init connection message from sec header", params.clientGroupID, params.clientID);
+			await connection.handleInitConnection(JSON.stringify(params.initConnectionMsg));
+		}
+	};
+	run() {
+		return this.#stopped.promise;
+	}
+	/**
+	* Graceful shutdown involves shutting down view syncers one at a time, pausing
+	* for the duration of view syncer's hydration between each one. This paces the
+	* disconnects to avoid creating a backlog of hydrations in the receiving server
+	* when the clients reconnect.
+	*/
+	async drain() {
+		const start = Date.now();
+		this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);
+		this.#drainCoordinator.drainNextIn(0);
+		while (this.#viewSyncers.size) {
+			await this.#drainCoordinator.forceDrainTimeout;
+			for (const vs of this.#viewSyncers.getServices()) {
+				this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);
+				vs.stop();
+				break;
+			}
+		}
+		this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);
+	}
+	stop() {
+		this.#wss.close();
+		this.#stopped.resolve();
+		return promiseVoid;
+	}
+	/** @deprecated used in JWT validation */
+	#validateLegacyJWT() {
+		if (tokenConfigOptions(this.#config.auth ?? {}).length !== 1) return;
+		return async (token, { userID }) => {
+			return {
+				type: "jwt",
+				raw: token,
+				decoded: await verifyToken(this.#config.auth, token, {
+					subject: userID,
+					...this.#config.auth?.issuer && { issuer: this.#config.auth.issuer },
+					...this.#config.auth?.audience && { audience: this.#config.auth.audience }
+				})
+			};
+		};
+	}
 };
-//# sourceMappingURL=syncer.js.map
+//#endregion
+export { Syncer };
+
+//# sourceMappingURL=syncer.js.map

package/out/zero-cache/src/workers/syncer.js.map

@@ -1 +1 @@
-{"version":3,"file":"syncer.js","sources":["../../../../../zero-cache/src/workers/syncer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {resolver} from '@rocicorp/resolver';\nimport {pid} from 'node:process';\nimport type {MessagePort} from 'node:worker_threads';\nimport {WebSocketServer, type ServerOptions, type WebSocket} from 'ws';\nimport {promiseVoid} from '../../../shared/src/resolved-promises.ts';\nimport {type ValidateLegacyJWT} from '../auth/auth.ts';\nimport {tokenConfigOptions, verifyToken} from '../auth/jwt.ts';\nimport {type ZeroConfig} from '../config/zero-config.ts';\nimport {\n  recordConnectionAttempted,\n  recordConnectionSuccess,\n  setActiveClientGroupsGetter,\n} from '../server/anonymous-otel-start.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport type {ReplicaState} from '../services/replicator/replicator.ts';\nimport {ServiceRunner} from '../services/runner.ts';\nimport type {\n  ActivityBasedService,\n  Service,\n  SingletonService,\n} from '../services/service.ts';\nimport {DrainCoordinator} from '../services/view-syncer/drain-coordinator.ts';\nimport type {ViewSyncer} from '../services/view-syncer/view-syncer.ts';\nimport type {Worker} from '../types/processes.ts';\nimport type {Subscription} from '../types/subscription.ts';\nimport {installWebSocketReceiver} from '../types/websocket-handoff.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport {Connection, sendError} from './connection.ts';\nimport {createNotifierFrom, subscribeTo} from './replicator.ts';\nimport {SyncerWsMessageHandler} from './syncer-ws-message-handler.ts';\n\nexport type SyncerWorkerData = {\n  replicatorPort: MessagePort;\n};\n\nfunction getWebSocketServerOptions(config: ZeroConfig): ServerOptions {\n  const options: ServerOptions = {\n    noServer: true,\n    maxPayload: config.websocketMaxPayloadBytes,\n  };\n\n  if (config.websocketCompression) {\n    options.perMessageDeflate = true;\n\n    if (config.websocketCompressionOptions) {\n      try {\n        const compressionOptions = JSON.parse(\n          config.websocketCompressionOptions,\n        );\n        options.perMessageDeflate = compressionOptions;\n      } catch (e) {\n        throw new Error(\n          `Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`,\n        );\n      }\n    }\n  }\n\n  return options;\n}\n\n/**\n * The Syncer worker receives websocket handoffs for \"/sync\" connections\n * from the Dispatcher in the main thread, and creates websocket\n * {@link Connection}s with a corresponding {@link ViewSyncer}, {@link Mutagen},\n * and {@link Subscription} to version notifications from the Replicator\n * worker.\n */\nexport class Syncer implements SingletonService {\n  readonly id = `syncer-${pid}`;\n  readonly #lc: LogContext;\n  readonly #viewSyncers: ServiceRunner<ViewSyncer & ActivityBasedService>;\n  readonly #mutagens: ServiceRunner<Mutagen & Service>;\n  readonly #pushers: ServiceRunner<Pusher & Service> | undefined;\n  readonly #connections = new Map<string, Connection>();\n  readonly #drainCoordinator = new DrainCoordinator();\n  readonly #parent: Worker;\n  readonly #wss: WebSocketServer;\n  readonly #stopped = resolver();\n  readonly #config: ZeroConfig;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    viewSyncerFactory: (\n      id: string,\n      sub: Subscription<ReplicaState>,\n      drainCoordinator: DrainCoordinator,\n      validateLegacyJWT: ValidateLegacyJWT | undefined,\n    ) => ViewSyncer & ActivityBasedService,\n    mutagenFactory: (id: string) => Mutagen & Service,\n    pusherFactory: ((id: string) => Pusher & Service) | undefined,\n    parent: Worker,\n  ) {\n    this.#config = config;\n    // Relays notifications from the parent thread subscription\n    // to ViewSyncers within this thread.\n    const notifier = createNotifierFrom(lc, parent);\n    subscribeTo(lc, parent);\n\n    this.#lc = lc;\n    this.#viewSyncers = new ServiceRunner(\n      lc,\n      id =>\n        viewSyncerFactory(\n          id,\n          notifier.subscribe(),\n          this.#drainCoordinator,\n          this.#validateLegacyJWT(),\n        ),\n      v => v.keepalive(),\n    );\n    this.#mutagens = new ServiceRunner(lc, mutagenFactory, m => m.hasRefs());\n    if (pusherFactory) {\n      this.#pushers = new ServiceRunner(lc, pusherFactory, p => p.hasRefs());\n    }\n    this.#parent = parent;\n    this.#wss = new WebSocketServer(getWebSocketServerOptions(config));\n\n    installWebSocketReceiver(\n      lc,\n      this.#wss,\n      this.#createConnection,\n      this.#parent,\n    );\n\n    setActiveClientGroupsGetter(() => this.#viewSyncers.size);\n  }\n\n  readonly #createConnection = async (ws: WebSocket, params: ConnectParams) => {\n    this.#lc.debug?.(\n      'creating connection',\n      params.clientGroupID,\n      params.clientID,\n    );\n    recordConnectionAttempted();\n    const {clientID, clientGroupID, auth, userID} = params;\n    const hasProvidedAuth = auth !== undefined && auth !== '';\n\n    if (hasProvidedAuth) {\n      const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n\n      const hasPushOrMutate =\n        this.#config?.push?.url !== undefined ||\n        this.#config?.mutate?.url !== undefined;\n      const hasQueries =\n        this.#config?.query?.url !== undefined ||\n        this.#config?.getQueries?.url !== undefined;\n\n      // must either have one of the token options set or have custom mutations & queries enabled\n      const hasExactlyOneTokenOption = tokenOptions.length === 1;\n      const hasCustomEndpoints = hasPushOrMutate && hasQueries;\n      if (!hasExactlyOneTokenOption && !hasCustomEndpoints) {\n        throw new Error(\n          'Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: ' +\n            JSON.stringify(tokenOptions) +\n            '. You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.',\n        );\n      }\n    }\n\n    const viewSyncer = this.#viewSyncers.getService(clientGroupID);\n\n    // Verify JWT BEFORE touching existing connections - prevents unauthenticated\n    // attackers from force-disconnecting legitimate users via DoS\n    const authResult = await viewSyncer.initAuthSession(userID, auth);\n    if (!authResult.ok) {\n      sendError(this.#lc, ws, authResult.error);\n      ws.close(3000, authResult.error.message);\n      return;\n    }\n\n    // Only check for and close existing connections AFTER auth is validated\n    const existing = this.#connections.get(clientID);\n    if (existing) {\n      this.#lc.debug?.(\n        `client ${clientID} already connected, closing existing connection`,\n      );\n      existing.close(`replaced by ${params.wsID}`);\n    }\n\n    const mutagen = this.#mutagens.getService(clientGroupID);\n    const pusher = this.#pushers?.getService(clientGroupID);\n    // a new connection is using the mutagen and pusher. Bump their ref counts.\n    mutagen.ref();\n    pusher?.ref();\n\n    let connection: Connection;\n    try {\n      connection = new Connection(\n        this.#lc,\n        params,\n        ws,\n        new SyncerWsMessageHandler(\n          this.#lc,\n          params,\n          viewSyncer,\n          mutagen,\n          pusher,\n        ),\n        () => {\n          if (this.#connections.get(clientID) === connection) {\n            this.#connections.delete(clientID);\n          }\n          // Connection is closed. We can unref the mutagen and pusher.\n          // If their ref counts are zero, they will stop themselves and set themselves invalid.\n          mutagen.unref();\n          pusher?.unref();\n        },\n      );\n    } catch (e) {\n      mutagen.unref();\n      pusher?.unref();\n      throw e;\n    }\n\n    this.#connections.set(clientID, connection);\n\n    connection.init() && recordConnectionSuccess();\n\n    if (params.initConnectionMsg) {\n      this.#lc.debug?.(\n        'handling init connection message from sec header',\n        params.clientGroupID,\n        params.clientID,\n      );\n      await connection.handleInitConnection(\n        JSON.stringify(params.initConnectionMsg),\n      );\n    }\n  };\n\n  run() {\n    return this.#stopped.promise;\n  }\n\n  /**\n   * Graceful shutdown involves shutting down view syncers one at a time, pausing\n   * for the duration of view syncer's hydration between each one. This paces the\n   * disconnects to avoid creating a backlog of hydrations in the receiving server\n   * when the clients reconnect.\n   */\n  async drain() {\n    const start = Date.now();\n    this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);\n\n    this.#drainCoordinator.drainNextIn(0);\n\n    while (this.#viewSyncers.size) {\n      await this.#drainCoordinator.forceDrainTimeout;\n\n      // Pick an arbitrary view syncer to force drain.\n      for (const vs of this.#viewSyncers.getServices()) {\n        this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);\n        // When this drain or an elective drain completes, the forceDrainTimeout will\n        // resolve after the next drain interval.\n        void vs.stop();\n        break;\n      }\n    }\n    this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);\n  }\n\n  stop() {\n    this.#wss.close();\n    this.#stopped.resolve();\n    return promiseVoid;\n  }\n\n  /** @deprecated used in JWT validation */\n  #validateLegacyJWT(): ValidateLegacyJWT | undefined {\n    const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n    if (tokenOptions.length !== 1) {\n      return undefined;\n    }\n\n    return async (token, {userID}) => {\n      const decoded = await verifyToken(this.#config.auth, token, {\n        subject: userID,\n        ...(this.#config.auth?.issuer && {issuer: this.#config.auth.issuer}),\n        ...(this.#config.auth?.audience && {\n          audience: this.#config.auth.audience,\n        }),\n      });\n      return {\n        type: 'jwt',\n        raw: token,\n        decoded,\n      };\n    };\n  }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAqCA,SAAS,0BAA0B,QAAmC;AACpE,QAAM,UAAyB;AAAA,IAC7B,UAAU;AAAA,IACV,YAAY,OAAO;AAAA,EAAA;AAGrB,MAAI,OAAO,sBAAsB;AAC/B,YAAQ,oBAAoB;AAE5B,QAAI,OAAO,6BAA6B;AACtC,UAAI;AACF,cAAM,qBAAqB,KAAK;AAAA,UAC9B,OAAO;AAAA,QAAA;AAET,gBAAQ,oBAAoB;AAAA,MAC9B,SAAS,GAAG;AACV,cAAM,IAAI;AAAA,UACR,uDAAuD,OAAO,CAAC,CAAC;AAAA,QAAA;AAAA,MAEpE;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASO,MAAM,OAAmC;AAAA,EACrC,KAAK,UAAU,GAAG;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,mCAAmB,IAAA;AAAA,EACnB,oBAAoB,IAAI,iBAAA;AAAA,EACxB;AAAA,EACA;AAAA,EACA,WAAW,SAAA;AAAA,EACX;AAAA,EAET,YACE,IACA,QACA,mBAMA,gBACA,eACA,QACA;AACA,SAAK,UAAU;AAGf,UAAM,WAAW,mBAAmB,IAAI,MAAM;AAC9C,gBAAY,IAAI,MAAM;AAEtB,SAAK,MAAM;AACX,SAAK,eAAe,IAAI;AAAA,MACtB;AAAA,MACA,CAAA,OACE;AAAA,QACE;AAAA,QACA,SAAS,UAAA;AAAA,QACT,KAAK;AAAA,QACL,KAAK,mBAAA;AAAA,MAAmB;AAAA,MAE5B,CAAA,MAAK,EAAE,UAAA;AAAA,IAAU;AAEnB,SAAK,YAAY,IAAI,cAAc,IAAI,gBAAgB,CAAA,MAAK,EAAE,SAAS;AACvE,QAAI,eAAe;AACjB,WAAK,WAAW,IAAI,cAAc,IAAI,eAAe,CAAA,MAAK,EAAE,SAAS;AAAA,IACvE;AACA,SAAK,UAAU;AACf,SAAK,OAAO,IAAI,gBAAgB,0BAA0B,MAAM,CAAC;AAEjE;AAAA,MACE;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGP,gCAA4B,MAAM,KAAK,aAAa,IAAI;AAAA,EAC1D;AAAA,EAES,oBAAoB,OAAO,IAAe,WAA0B;AAC3E,SAAK,IAAI;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,OAAO;AAAA,IAAA;AAET,8BAAA;AACA,UAAM,EAAC,UAAU,eAAe,MAAM,WAAU;AAChD,UAAM,kBAAkB,SAAS,UAAa,SAAS;AAEvD,QAAI,iBAAiB;AACnB,YAAM,eAAe,mBAAmB,KAAK,QAAQ,QAAQ,CAAA,CAAE;AAE/D,YAAM,kBACJ,KAAK,SAAS,MAAM,QAAQ,UAC5B,KAAK,SAAS,QAAQ,QAAQ;AAChC,YAAM,aACJ,KAAK,SAAS,OAAO,QAAQ,UAC7B,KAAK,SAAS,YAAY,QAAQ;AAGpC,YAAM,2BAA2B,aAAa,WAAW;AACzD,YAAM,qBAAqB,mBAAmB;AAC9C,UAAI,CAAC,4BAA4B,CAAC,oBAAoB;AACpD,cAAM,IAAI;AAAA,UACR,uHACE,KAAK,UAAU,YAAY,IAC3B;AAAA,QAAA;AAAA,MAEN;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,aAAa,WAAW,aAAa;AAI7D,UAAM,aAAa,MAAM,WAAW,gBAAgB,QAAQ,IAAI;AAChE,QAAI,CAAC,WAAW,IAAI;AAClB,gBAAU,KAAK,KAAK,IAAI,WAAW,KAAK;AACxC,SAAG,MAAM,KAAM,WAAW,MAAM,OAAO;AACvC;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,aAAa,IAAI,QAAQ;AAC/C,QAAI,UAAU;AACZ,WAAK,IAAI;AAAA,QACP,UAAU,QAAQ;AAAA,MAAA;AAEpB,eAAS,MAAM,eAAe,OAAO,IAAI,EAAE;AAAA,IAC7C;AAEA,UAAM,UAAU,KAAK,UAAU,WAAW,aAAa;AACvD,UAAM,SAAS,KAAK,UAAU,WAAW,aAAa;AAEtD,YAAQ,IAAA;AACR,YAAQ,IAAA;AAER,QAAI;AACJ,QAAI;AACF,mBAAa,IAAI;AAAA,QACf,KAAK;AAAA,QACL;AAAA,QACA;AAAA,QACA,IAAI;AAAA,UACF,KAAK;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAAA,QAEF,MAAM;AACJ,cAAI,KAAK,aAAa,IAAI,QAAQ,MAAM,YAAY;AAClD,iBAAK,aAAa,OAAO,QAAQ;AAAA,UACnC;AAGA,kBAAQ,MAAA;AACR,kBAAQ,MAAA;AAAA,QACV;AAAA,MAAA;AAAA,IAEJ,SAAS,GAAG;AACV,cAAQ,MAAA;AACR,cAAQ,MAAA;AACR,YAAM;AAAA,IACR;AAEA,SAAK,aAAa,IAAI,UAAU,UAAU;AAE1C,eAAW,KAAA,KAAU,wBAAA;AAErB,QAAI,OAAO,mBAAmB;AAC5B,WAAK,IAAI;AAAA,QACP;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,MAAA;AAET,YAAM,WAAW;AAAA,QACf,KAAK,UAAU,OAAO,iBAAiB;AAAA,MAAA;AAAA,IAE3C;AAAA,EACF;AAAA,EAEA,MAAM;AACJ,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,QAAQ;AACZ,UAAM,QAAQ,KAAK,IAAA;AACnB,SAAK,IAAI,OAAO,YAAY,KAAK,aAAa,IAAI,eAAe;AAEjE,SAAK,kBAAkB,YAAY,CAAC;AAEpC,WAAO,KAAK,aAAa,MAAM;AAC7B,YAAM,KAAK,kBAAkB;AAG7B,iBAAW,MAAM,KAAK,aAAa,YAAA,GAAe;AAChD,aAAK,IAAI,QAAQ,wBAAwB,GAAG,EAAE,WAAW;AAGzD,aAAK,GAAG,KAAA;AACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,IAAI,OAAO,sBAAsB,KAAK,IAAA,IAAQ,KAAK,MAAM;AAAA,EAChE;AAAA,EAEA,OAAO;AACL,SAAK,KAAK,MAAA;AACV,SAAK,SAAS,QAAA;AACd,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,qBAAoD;AAClD,UAAM,eAAe,mBAAmB,KAAK,QAAQ,QAAQ,CAAA,CAAE;AAC/D,QAAI,aAAa,WAAW,GAAG;AAC7B,aAAO;AAAA,IACT;AAEA,WAAO,OAAO,OAAO,EAAC,aAAY;AAChC,YAAM,UAAU,MAAM,YAAY,KAAK,QAAQ,MAAM,OAAO;AAAA,QAC1D,SAAS;AAAA,QACT,GAAI,KAAK,QAAQ,MAAM,UAAU,EAAC,QAAQ,KAAK,QAAQ,KAAK,OAAA;AAAA,QAC5D,GAAI,KAAK,QAAQ,MAAM,YAAY;AAAA,UACjC,UAAU,KAAK,QAAQ,KAAK;AAAA,QAAA;AAAA,MAC9B,CACD;AACD,aAAO;AAAA,QACL,MAAM;AAAA,QACN,KAAK;AAAA,QACL;AAAA,MAAA;AAAA,IAEJ;AAAA,EACF;AACF;"}
+{"version":3,"file":"syncer.js","names":["#lc","#viewSyncers","#mutagens","#pushers","#connections","#drainCoordinator","#parent","#wss","#stopped","#config","#validateLegacyJWT","#createConnection"],"sources":["../../../../../zero-cache/src/workers/syncer.ts"],"sourcesContent":["import type {LogContext} from '@rocicorp/logger';\nimport {resolver} from '@rocicorp/resolver';\nimport {pid} from 'node:process';\nimport type {MessagePort} from 'node:worker_threads';\nimport {WebSocketServer, type ServerOptions, type WebSocket} from 'ws';\nimport {promiseVoid} from '../../../shared/src/resolved-promises.ts';\nimport {type ValidateLegacyJWT} from '../auth/auth.ts';\nimport {tokenConfigOptions, verifyToken} from '../auth/jwt.ts';\nimport {type ZeroConfig} from '../config/zero-config.ts';\nimport {\n  recordConnectionAttempted,\n  recordConnectionSuccess,\n  setActiveClientGroupsGetter,\n} from '../server/anonymous-otel-start.ts';\nimport type {Mutagen} from '../services/mutagen/mutagen.ts';\nimport type {Pusher} from '../services/mutagen/pusher.ts';\nimport type {ReplicaState} from '../services/replicator/replicator.ts';\nimport {ServiceRunner} from '../services/runner.ts';\nimport type {\n  ActivityBasedService,\n  Service,\n  SingletonService,\n} from '../services/service.ts';\nimport {DrainCoordinator} from '../services/view-syncer/drain-coordinator.ts';\nimport type {ViewSyncer} from '../services/view-syncer/view-syncer.ts';\nimport type {Worker} from '../types/processes.ts';\nimport type {Subscription} from '../types/subscription.ts';\nimport {installWebSocketReceiver} from '../types/websocket-handoff.ts';\nimport type {ConnectParams} from './connect-params.ts';\nimport {Connection, sendError} from './connection.ts';\nimport {createNotifierFrom, subscribeTo} from './replicator.ts';\nimport {SyncerWsMessageHandler} from './syncer-ws-message-handler.ts';\n\nexport type SyncerWorkerData = {\n  replicatorPort: MessagePort;\n};\n\nfunction getWebSocketServerOptions(config: ZeroConfig): ServerOptions {\n  const options: ServerOptions = {\n    noServer: true,\n    maxPayload: config.websocketMaxPayloadBytes,\n  };\n\n  if (config.websocketCompression) {\n    options.perMessageDeflate = true;\n\n    if (config.websocketCompressionOptions) {\n      try {\n        const compressionOptions = JSON.parse(\n          config.websocketCompressionOptions,\n        );\n        options.perMessageDeflate = compressionOptions;\n      } catch (e) {\n        throw new Error(\n          `Failed to parse ZERO_WEBSOCKET_COMPRESSION_OPTIONS: ${String(e)}. Expected valid JSON.`,\n        );\n      }\n    }\n  }\n\n  return options;\n}\n\n/**\n * The Syncer worker receives websocket handoffs for \"/sync\" connections\n * from the Dispatcher in the main thread, and creates websocket\n * {@link Connection}s with a corresponding {@link ViewSyncer}, {@link Mutagen},\n * and {@link Subscription} to version notifications from the Replicator\n * worker.\n */\nexport class Syncer implements SingletonService {\n  readonly id = `syncer-${pid}`;\n  readonly #lc: LogContext;\n  readonly #viewSyncers: ServiceRunner<ViewSyncer & ActivityBasedService>;\n  readonly #mutagens: ServiceRunner<Mutagen & Service>;\n  readonly #pushers: ServiceRunner<Pusher & Service> | undefined;\n  readonly #connections = new Map<string, Connection>();\n  readonly #drainCoordinator = new DrainCoordinator();\n  readonly #parent: Worker;\n  readonly #wss: WebSocketServer;\n  readonly #stopped = resolver();\n  readonly #config: ZeroConfig;\n\n  constructor(\n    lc: LogContext,\n    config: ZeroConfig,\n    viewSyncerFactory: (\n      id: string,\n      sub: Subscription<ReplicaState>,\n      drainCoordinator: DrainCoordinator,\n      validateLegacyJWT: ValidateLegacyJWT | undefined,\n    ) => ViewSyncer & ActivityBasedService,\n    mutagenFactory: (id: string) => Mutagen & Service,\n    pusherFactory: ((id: string) => Pusher & Service) | undefined,\n    parent: Worker,\n  ) {\n    this.#config = config;\n    // Relays notifications from the parent thread subscription\n    // to ViewSyncers within this thread.\n    const notifier = createNotifierFrom(lc, parent);\n    subscribeTo(lc, parent);\n\n    this.#lc = lc;\n    this.#viewSyncers = new ServiceRunner(\n      lc,\n      id =>\n        viewSyncerFactory(\n          id,\n          notifier.subscribe(),\n          this.#drainCoordinator,\n          this.#validateLegacyJWT(),\n        ),\n      v => v.keepalive(),\n    );\n    this.#mutagens = new ServiceRunner(lc, mutagenFactory, m => m.hasRefs());\n    if (pusherFactory) {\n      this.#pushers = new ServiceRunner(lc, pusherFactory, p => p.hasRefs());\n    }\n    this.#parent = parent;\n    this.#wss = new WebSocketServer(getWebSocketServerOptions(config));\n\n    installWebSocketReceiver(\n      lc,\n      this.#wss,\n      this.#createConnection,\n      this.#parent,\n    );\n\n    setActiveClientGroupsGetter(() => this.#viewSyncers.size);\n  }\n\n  readonly #createConnection = async (ws: WebSocket, params: ConnectParams) => {\n    this.#lc.debug?.(\n      'creating connection',\n      params.clientGroupID,\n      params.clientID,\n    );\n    recordConnectionAttempted();\n    const {clientID, clientGroupID, auth, userID} = params;\n    const hasProvidedAuth = auth !== undefined && auth !== '';\n\n    if (hasProvidedAuth) {\n      const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n\n      const hasPushOrMutate =\n        this.#config?.push?.url !== undefined ||\n        this.#config?.mutate?.url !== undefined;\n      const hasQueries =\n        this.#config?.query?.url !== undefined ||\n        this.#config?.getQueries?.url !== undefined;\n\n      // must either have one of the token options set or have custom mutations & queries enabled\n      const hasExactlyOneTokenOption = tokenOptions.length === 1;\n      const hasCustomEndpoints = hasPushOrMutate && hasQueries;\n      if (!hasExactlyOneTokenOption && !hasCustomEndpoints) {\n        throw new Error(\n          'Exactly one of jwk, secret, or jwksUrl must be set in order to verify tokens but actually the following were set: ' +\n            JSON.stringify(tokenOptions) +\n            '. You may also set both ZERO_MUTATE_URL and ZERO_QUERY_URL to enable custom mutations and queries without passing token verification options.',\n        );\n      }\n    }\n\n    const viewSyncer = this.#viewSyncers.getService(clientGroupID);\n\n    // Verify JWT BEFORE touching existing connections - prevents unauthenticated\n    // attackers from force-disconnecting legitimate users via DoS\n    const authResult = await viewSyncer.initAuthSession(userID, auth);\n    if (!authResult.ok) {\n      sendError(this.#lc, ws, authResult.error);\n      ws.close(3000, authResult.error.message);\n      return;\n    }\n\n    // Only check for and close existing connections AFTER auth is validated\n    const existing = this.#connections.get(clientID);\n    if (existing) {\n      this.#lc.debug?.(\n        `client ${clientID} already connected, closing existing connection`,\n      );\n      existing.close(`replaced by ${params.wsID}`);\n    }\n\n    const mutagen = this.#mutagens.getService(clientGroupID);\n    const pusher = this.#pushers?.getService(clientGroupID);\n    // a new connection is using the mutagen and pusher. Bump their ref counts.\n    mutagen.ref();\n    pusher?.ref();\n\n    let connection: Connection;\n    try {\n      connection = new Connection(\n        this.#lc,\n        params,\n        ws,\n        new SyncerWsMessageHandler(\n          this.#lc,\n          params,\n          viewSyncer,\n          mutagen,\n          pusher,\n        ),\n        () => {\n          if (this.#connections.get(clientID) === connection) {\n            this.#connections.delete(clientID);\n          }\n          // Connection is closed. We can unref the mutagen and pusher.\n          // If their ref counts are zero, they will stop themselves and set themselves invalid.\n          mutagen.unref();\n          pusher?.unref();\n        },\n      );\n    } catch (e) {\n      mutagen.unref();\n      pusher?.unref();\n      throw e;\n    }\n\n    this.#connections.set(clientID, connection);\n\n    connection.init() && recordConnectionSuccess();\n\n    if (params.initConnectionMsg) {\n      this.#lc.debug?.(\n        'handling init connection message from sec header',\n        params.clientGroupID,\n        params.clientID,\n      );\n      await connection.handleInitConnection(\n        JSON.stringify(params.initConnectionMsg),\n      );\n    }\n  };\n\n  run() {\n    return this.#stopped.promise;\n  }\n\n  /**\n   * Graceful shutdown involves shutting down view syncers one at a time, pausing\n   * for the duration of view syncer's hydration between each one. This paces the\n   * disconnects to avoid creating a backlog of hydrations in the receiving server\n   * when the clients reconnect.\n   */\n  async drain() {\n    const start = Date.now();\n    this.#lc.info?.(`draining ${this.#viewSyncers.size} view-syncers`);\n\n    this.#drainCoordinator.drainNextIn(0);\n\n    while (this.#viewSyncers.size) {\n      await this.#drainCoordinator.forceDrainTimeout;\n\n      // Pick an arbitrary view syncer to force drain.\n      for (const vs of this.#viewSyncers.getServices()) {\n        this.#lc.debug?.(`draining view-syncer ${vs.id} (forced)`);\n        // When this drain or an elective drain completes, the forceDrainTimeout will\n        // resolve after the next drain interval.\n        void vs.stop();\n        break;\n      }\n    }\n    this.#lc.info?.(`finished draining (${Date.now() - start} ms)`);\n  }\n\n  stop() {\n    this.#wss.close();\n    this.#stopped.resolve();\n    return promiseVoid;\n  }\n\n  /** @deprecated used in JWT validation */\n  #validateLegacyJWT(): ValidateLegacyJWT | undefined {\n    const tokenOptions = tokenConfigOptions(this.#config.auth ?? {});\n    if (tokenOptions.length !== 1) {\n      return undefined;\n    }\n\n    return async (token, {userID}) => {\n      const decoded = await verifyToken(this.#config.auth, token, {\n        subject: userID,\n        ...(this.#config.auth?.issuer && {issuer: this.#config.auth.issuer}),\n        ...(this.#config.auth?.audience && {\n          audience: this.#config.auth.audience,\n        }),\n      });\n      return {\n        type: 'jwt',\n        raw: token,\n        decoded,\n      };\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAqCA,SAAS,0BAA0B,QAAmC;CACpE,MAAM,UAAyB;EAC7B,UAAU;EACV,YAAY,OAAO;EACpB;AAED,KAAI,OAAO,sBAAsB;AAC/B,UAAQ,oBAAoB;AAE5B,MAAI,OAAO,4BACT,KAAI;AAIF,WAAQ,oBAHmB,KAAK,MAC9B,OAAO,4BACR;WAEM,GAAG;AACV,SAAM,IAAI,MACR,uDAAuD,OAAO,EAAE,CAAC,wBAClE;;;AAKP,QAAO;;;;;;;;;AAUT,IAAa,SAAb,MAAgD;CAC9C,KAAc,UAAU;CACxB;CACA;CACA;CACA;CACA,+BAAwB,IAAI,KAAyB;CACrD,oBAA6B,IAAI,kBAAkB;CACnD;CACA;CACA,WAAoB,UAAU;CAC9B;CAEA,YACE,IACA,QACA,mBAMA,gBACA,eACA,QACA;AACA,QAAA,SAAe;EAGf,MAAM,WAAW,mBAAmB,IAAI,OAAO;AAC/C,cAAY,IAAI,OAAO;AAEvB,QAAA,KAAW;AACX,QAAA,cAAoB,IAAI,cACtB,KACA,OACE,kBACE,IACA,SAAS,WAAW,EACpB,MAAA,kBACA,MAAA,mBAAyB,CAC1B,GACH,MAAK,EAAE,WAAW,CACnB;AACD,QAAA,WAAiB,IAAI,cAAc,IAAI,iBAAgB,MAAK,EAAE,SAAS,CAAC;AACxE,MAAI,cACF,OAAA,UAAgB,IAAI,cAAc,IAAI,gBAAe,MAAK,EAAE,SAAS,CAAC;AAExE,QAAA,SAAe;AACf,QAAA,MAAY,IAAI,gBAAgB,0BAA0B,OAAO,CAAC;AAElE,2BACE,IACA,MAAA,KACA,MAAA,kBACA,MAAA,OACD;AAED,oCAAkC,MAAA,YAAkB,KAAK;;CAG3D,oBAA6B,OAAO,IAAe,WAA0B;AAC3E,QAAA,GAAS,QACP,uBACA,OAAO,eACP,OAAO,SACR;AACD,6BAA2B;EAC3B,MAAM,EAAC,UAAU,eAAe,MAAM,WAAU;AAGhD,MAFwB,SAAS,KAAA,KAAa,SAAS,IAElC;GACnB,MAAM,eAAe,mBAAmB,MAAA,OAAa,QAAQ,EAAE,CAAC;GAEhE,MAAM,kBACJ,MAAA,QAAc,MAAM,QAAQ,KAAA,KAC5B,MAAA,QAAc,QAAQ,QAAQ,KAAA;GAChC,MAAM,aACJ,MAAA,QAAc,OAAO,QAAQ,KAAA,KAC7B,MAAA,QAAc,YAAY,QAAQ,KAAA;AAKpC,OAAI,EAF6B,aAAa,WAAW,MAExB,EADN,mBAAmB,YAE5C,OAAM,IAAI,MACR,uHACE,KAAK,UAAU,aAAa,GAC5B,gJACH;;EAIL,MAAM,aAAa,MAAA,YAAkB,WAAW,cAAc;EAI9D,MAAM,aAAa,MAAM,WAAW,gBAAgB,QAAQ,KAAK;AACjE,MAAI,CAAC,WAAW,IAAI;AAClB,aAAU,MAAA,IAAU,IAAI,WAAW,MAAM;AACzC,MAAG,MAAM,KAAM,WAAW,MAAM,QAAQ;AACxC;;EAIF,MAAM,WAAW,MAAA,YAAkB,IAAI,SAAS;AAChD,MAAI,UAAU;AACZ,SAAA,GAAS,QACP,UAAU,SAAS,iDACpB;AACD,YAAS,MAAM,eAAe,OAAO,OAAO;;EAG9C,MAAM,UAAU,MAAA,SAAe,WAAW,cAAc;EACxD,MAAM,SAAS,MAAA,SAAe,WAAW,cAAc;AAEvD,UAAQ,KAAK;AACb,UAAQ,KAAK;EAEb,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,WACf,MAAA,IACA,QACA,IACA,IAAI,uBACF,MAAA,IACA,QACA,YACA,SACA,OACD,QACK;AACJ,QAAI,MAAA,YAAkB,IAAI,SAAS,KAAK,WACtC,OAAA,YAAkB,OAAO,SAAS;AAIpC,YAAQ,OAAO;AACf,YAAQ,OAAO;KAElB;WACM,GAAG;AACV,WAAQ,OAAO;AACf,WAAQ,OAAO;AACf,SAAM;;AAGR,QAAA,YAAkB,IAAI,UAAU,WAAW;AAE3C,aAAW,MAAM,IAAI,yBAAyB;AAE9C,MAAI,OAAO,mBAAmB;AAC5B,SAAA,GAAS,QACP,oDACA,OAAO,eACP,OAAO,SACR;AACD,SAAM,WAAW,qBACf,KAAK,UAAU,OAAO,kBAAkB,CACzC;;;CAIL,MAAM;AACJ,SAAO,MAAA,QAAc;;;;;;;;CASvB,MAAM,QAAQ;EACZ,MAAM,QAAQ,KAAK,KAAK;AACxB,QAAA,GAAS,OAAO,YAAY,MAAA,YAAkB,KAAK,eAAe;AAElE,QAAA,iBAAuB,YAAY,EAAE;AAErC,SAAO,MAAA,YAAkB,MAAM;AAC7B,SAAM,MAAA,iBAAuB;AAG7B,QAAK,MAAM,MAAM,MAAA,YAAkB,aAAa,EAAE;AAChD,UAAA,GAAS,QAAQ,wBAAwB,GAAG,GAAG,WAAW;AAGrD,OAAG,MAAM;AACd;;;AAGJ,QAAA,GAAS,OAAO,sBAAsB,KAAK,KAAK,GAAG,MAAM,MAAM;;CAGjE,OAAO;AACL,QAAA,IAAU,OAAO;AACjB,QAAA,QAAc,SAAS;AACvB,SAAO;;;CAIT,qBAAoD;AAElD,MADqB,mBAAmB,MAAA,OAAa,QAAQ,EAAE,CAAC,CAC/C,WAAW,EAC1B;AAGF,SAAO,OAAO,OAAO,EAAC,aAAY;AAQhC,UAAO;IACL,MAAM;IACN,KAAK;IACL,SAVc,MAAM,YAAY,MAAA,OAAa,MAAM,OAAO;KAC1D,SAAS;KACT,GAAI,MAAA,OAAa,MAAM,UAAU,EAAC,QAAQ,MAAA,OAAa,KAAK,QAAO;KACnE,GAAI,MAAA,OAAa,MAAM,YAAY,EACjC,UAAU,MAAA,OAAa,KAAK,UAC7B;KACF,CAAC;IAKD"}