@substrat-run/control-plane-api 0.177.0 → 0.179.0

package/dist/r2-backups.js

@@ -9,7 +9,7 @@
  * One bucket, held by the PLATFORM, not by the tenant. A tenant-held bucket would be
  * deleted by the very teardown these copies exist to survive.
  */
-import { directoryDump, scopeDump, scopeDumpChange, scopeDumpPageTable, z, } from '@substrat-run/contracts';
+import { directoryDump, mergeDumpPages, scopeDump, scopeDumpChange, scopeDumpPageTable, scopeDumpTable, z, } from '@substrat-run/contracts';
 /**
  * A backup is `scopes/<tenantId>/<scopeId>/<capturedAt>.json`, so a scope's copies are one
  * prefix list and a tenant's are one level up. The scheme is private to this module —
@@ -33,16 +33,30 @@ function entryKey(tenantId, scopeId, capturedAt, stageId, seq) {
 function scopePrefix(tenantId, scopeId) {
     return `scopes/${tenantId}/${scopeId}/`;
 }
-/** A backup's manifest: the dump without its tables, and where its entries are. */
+/**
+ * A backup's manifest: the dump without its tables, where its entries are, and where each store's
+ * pages are (D-69). `storeEntries` defaults to none, so a manifest written before it (#2839) reads as
+ * before, its stores inline in `stores`.
+ */
 const backupManifest = scopeDump.omit({ tables: true }).extend({
     format: z.literal('paged'),
     stageId: z.string().min(1),
     entries: z.number().int().positive(),
     tables: z.number().int().nonnegative(),
+    storeEntries: z
+        .array(z.object({
+        binding: z.string().min(1),
+        driver: z.string().min(1),
+        stageId: z.string().min(1),
+        entries: z.number().int().positive(),
+        revision: z.string().min(1),
+    }))
+        .default([]),
 });
 const backupEntry = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('page'), tables: z.array(scopeDumpPageTable) }),
     z.object({ kind: z.literal('changes'), tables: z.array(scopeDumpChange) }),
+    z.object({ kind: z.literal('store-page'), tables: z.array(scopeDumpPageTable) }),
 ]);
 /** Byte length, not string length: a size is the stored object's, and non-ASCII would under-report. */
 const byteLength = (body) => new TextEncoder().encode(body).length;
@@ -69,14 +83,18 @@ export function createR2BackupStore(bucket) {
                     written.delete(stageId);
                     await Promise.all(sizes.map((_, seq) => r2.delete(entryKey(tenantId, scopeId, capturedAt, stageId, seq)).catch(() => undefined)));
                 },
-                async commit({ stageId, entries, tables }) {
-                    const sizes = written.get(stageId) ?? [];
-                    for (let seq = 0; seq < entries; seq++) {
-                        if (sizes[seq] === undefined)
-                            throw new Error(`backup entry ${seq} of ${entries} was never written`);
+                async commit({ stageId, entries, tables, storeEntries }) {
+                    let size = 0;
+                    for (const part of [{ stageId, entries }, ...storeEntries]) {
+                        const sizes = written.get(part.stageId) ?? [];
+                        for (let seq = 0; seq < part.entries; seq++) {
+                            if (sizes[seq] === undefined)
+                                throw new Error(`backup entry ${seq} of ${part.entries} under ${part.stageId} was never written`);
+                            size += sizes[seq];
+                        }
                     }
-                    const body = JSON.stringify({ ...header, format: 'paged', stageId, entries, tables });
-                    const size = byteLength(body) + sizes.slice(0, entries).reduce((a, b) => a + b, 0);
+                    const body = JSON.stringify({ ...header, format: 'paged', stageId, entries, tables, storeEntries });
+                    size += byteLength(body);
                     const backup = { tenantId, scopeId, vertical, capturedAt, size, tables };
                     await r2.put(backupKey(tenantId, scopeId, capturedAt), body, {
                         httpMetadata: { contentType: 'application/json' },
@@ -145,17 +163,35 @@ export function createR2BackupStore(bucket) {
                             throw new Error(`backup ${capturedAt} of scope ${scopeId} has one entry`);
                         return { kind: 'page', tables };
                     },
+                    storeEntries: [],
+                    storePage: async () => {
+                        throw new Error(`backup ${capturedAt} of scope ${scopeId} holds its stores inline`);
+                    },
                 };
             }
-            const { format: _, stageId, entries, tables: __, ...header } = backupManifest.parse(raw);
+            const { format: _, stageId, entries, tables: __, storeEntries, ...header } = backupManifest.parse(raw);
+            const read = async (at, index) => {
+                const part = await r2.get(entryKey(tenantId, scopeId, capturedAt, at, index));
+                if (!part)
+                    throw new Error(`backup ${capturedAt} of scope ${scopeId} is missing entry ${index} of ${at}`);
+                return backupEntry.parse(JSON.parse(await part.text()));
+            };
             return {
                 header,
                 entries,
+                // A store's page and a scope's share a shape, so the kind is what says which this is.
                 entry: async (index) => {
-                    const part = await r2.get(entryKey(tenantId, scopeId, capturedAt, stageId, index));
-                    if (!part)
-                        throw new Error(`backup ${capturedAt} of scope ${scopeId} is missing entry ${index}`);
-                    return backupEntry.parse(JSON.parse(await part.text()));
+                    const entry = await read(stageId, index);
+                    if (entry.kind === 'store-page')
+                        throw new Error(`backup ${capturedAt} of scope ${scopeId} holds a store page where its entry ${index} belongs`);
+                    return entry;
+                },
+                storeEntries,
+                storePage: async (store, seq) => {
+                    const entry = await read(store.stageId, seq);
+                    if (entry.kind !== 'store-page')
+                        throw new Error(`backup ${capturedAt} of scope ${scopeId} holds a '${entry.kind}' entry where a store page belongs`);
+                    return entry.tables;
                 },
             };
         },
@@ -166,11 +202,61 @@ export function createR2BackupStore(bucket) {
  * directory per deployment and `capturedAt` is a copy's whole address. Sharing a bucket
  * with the scope backups above is safe by construction: `scopes/` and `directory/` cannot
  * collide, and neither prefix is ever built by a caller.
+ *
+ * That object is the copy's MANIFEST (#2868), as a scope backup's is (#2839): its capture time
+ * and how many pages hold its tables, each page its own object at
+ * `directory/<capturedAt>/<stageId>/<seq>.json`. The manifest is written last, so a copy that did
+ * not finish has none and is never listed or read. A copy written before #2868 is one whole dump
+ * at the manifest's key, and still reads.
  */
 function directoryKey(capturedAt) {
     return `directory/${capturedAt}.json`;
 }
+function directoryPageKey(capturedAt, stageId, seq) {
+    return `directory/${capturedAt}/${stageId}/${seq}.json`;
+}
 const DIRECTORY_PREFIX = 'directory/';
+/**
+ * How old a copy's pages must be, with no manifest, before a commit sweeps them (#2868). A copy cut
+ * off mid-write (its invocation's limits, an eviction) never reaches `discard`, and a pageful
+ * of the directory each time would otherwise stay forever. A day, so a copy still being written
+ * beside this one, the manual "back up now" racing the cron, is never one of them.
+ */
+const ABANDONED_PAGES_MS = 24 * 3_600_000;
+/** Outside `directory/`, so it is never listed as a copy: the newest started copy (#2868). */
+const DIRECTORY_ATTEMPT_KEY = 'directory-attempt.json';
+const directoryManifest = z.object({
+    capturedAt: z.string().min(1),
+    format: z.literal('paged'),
+    stageId: z.string().min(1),
+    entries: z.number().int().positive(),
+    tables: z.number().int().nonnegative(),
+});
+const directoryPage = z.object({ tables: z.array(scopeDumpTable) });
+/**
+ * Delete the pages of every copy captured before `before` that has no manifest: copies cut off
+ * before their commit (#2868). Read with no delimiter, so every key under `directory/` is seen:
+ * thirty copies of a few dozen pages each is a list call or two, once a day.
+ */
+async function sweepAbandonedPages(r2, before) {
+    const manifests = new Set();
+    const pages = [];
+    let cursor;
+    do {
+        const page = await r2.list({ prefix: DIRECTORY_PREFIX, ...(cursor ? { cursor } : {}) });
+        for (const { key } of page.objects) {
+            const rest = key.slice(DIRECTORY_PREFIX.length);
+            const slash = rest.indexOf('/');
+            if (slash < 0)
+                manifests.add(rest.replace(/\.json$/, ''));
+            else
+                pages.push({ key, capturedAt: rest.slice(0, slash) });
+        }
+        cursor = page.truncated ? page.cursor : undefined;
+    } while (cursor);
+    const abandoned = pages.filter((p) => p.capturedAt < before && !manifests.has(p.capturedAt));
+    await Promise.all(abandoned.map((p) => r2.delete(p.key).catch(() => undefined)));
+}
 /**
  * The Cloudflare R2 implementation of `DirectoryBackupStore` (#40).
  *
@@ -183,32 +269,53 @@ const DIRECTORY_PREFIX = 'directory/';
 export function createR2DirectoryBackupStore(bucket) {
     const r2 = bucket;
     return {
-        async put({ dump }) {
-            const body = JSON.stringify(dump);
-            // Byte length, not string length — the size is the stored object's.
-            const size = new TextEncoder().encode(body).length;
-            const backup = {
-                capturedAt: dump.capturedAt,
-                size,
-                tables: dump.tables.length,
-            };
-            await r2.put(directoryKey(dump.capturedAt), body, {
-                httpMetadata: { contentType: 'application/json' },
-                // Mirrored into custom metadata so `list` answers without fetching every dump —
-                // a directory copy is megabytes, its listing is a table row.
-                customMetadata: {
-                    capturedAt: backup.capturedAt,
-                    tables: String(backup.tables),
+        begin({ capturedAt }) {
+            const stageId = crypto.randomUUID();
+            const sizes = [];
+            return {
+                async put(seq, tables) {
+                    const body = JSON.stringify({ tables });
+                    await r2.put(directoryPageKey(capturedAt, stageId, seq), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                    });
+                    sizes[seq] = byteLength(body);
                 },
-            });
-            return backup;
+                async discard() {
+                    await Promise.all(sizes.map((_, seq) => r2.delete(directoryPageKey(capturedAt, stageId, seq)).catch(() => undefined)));
+                },
+                async commit({ entries, tables }) {
+                    for (let seq = 0; seq < entries; seq++) {
+                        if (sizes[seq] === undefined)
+                            throw new Error(`directory backup page ${seq} of ${entries} was never written`);
+                    }
+                    const body = JSON.stringify({ capturedAt, format: 'paged', stageId, entries, tables });
+                    const size = byteLength(body) + sizes.slice(0, entries).reduce((a, b) => a + b, 0);
+                    await r2.put(directoryKey(capturedAt), body, {
+                        httpMetadata: { contentType: 'application/json' },
+                        // Mirrored into custom metadata so `list` answers without fetching every manifest.
+                        // `size` too: the manifest is the smallest part of the copy.
+                        customMetadata: { capturedAt, tables: String(tables), size: String(size) },
+                    });
+                    // Best-effort, and after the manifest: the copy is committed now, and a failed sweep
+                    // must not reject the commit, or the caller's `discard` would delete a listed copy's pages.
+                    try {
+                        await sweepAbandonedPages(r2, new Date(Date.parse(capturedAt) - ABANDONED_PAGES_MS).toISOString());
+                    }
+                    catch (err) {
+                        console.error('directory-backup: sweeping abandoned pages failed; the next commit tries again', err instanceof Error ? err.message : String(err));
+                    }
+                    return { capturedAt, size, tables };
+                },
+            };
         },
         async list() {
             const out = [];
             let cursor;
             do {
+                // One level: a copy's pages sit under a directory of their own, and are not copies.
                 const page = await r2.list({
                     prefix: DIRECTORY_PREFIX,
+                    delimiter: '/',
                     include: ['customMetadata'],
                     ...(cursor ? { cursor } : {}),
                 });
@@ -219,7 +326,7 @@ export function createR2DirectoryBackupStore(bucket) {
                     const capturedAt = meta.capturedAt ?? o.key.slice(DIRECTORY_PREFIX.length).replace(/\.json$/, '');
                     out.push({
                         capturedAt,
-                        size: o.size,
+                        size: meta.size ? Number(meta.size) : o.size,
                         tables: meta.tables ? Number(meta.tables) : 0,
                     });
                 }
@@ -235,10 +342,42 @@ export function createR2DirectoryBackupStore(bucket) {
                 return null;
             // Parsed through the contract on the way out, so a corrupted object fails HERE
             // rather than half-way through the restore that trusted it.
-            return directoryDump.parse(JSON.parse(await obj.text()));
+            const raw = JSON.parse(await obj.text());
+            if (raw?.format !== 'paged')
+                return directoryDump.parse(raw);
+            const manifest = directoryManifest.parse(raw);
+            const pages = [];
+            for (let seq = 0; seq < manifest.entries; seq++) {
+                const part = await r2.get(directoryPageKey(capturedAt, manifest.stageId, seq));
+                if (!part)
+                    throw new Error(`directory backup ${capturedAt} is missing page ${seq}`);
+                pages.push(directoryPage.parse(JSON.parse(await part.text())).tables);
+            }
+            // `restoreDirectory` takes one dump, so the pages are joined here (a paged restore is #2868's follow-up).
+            return { capturedAt, tables: mergeDumpPages(pages) };
         },
         async delete({ capturedAt }) {
+            // The manifest first: once it is gone the copy is no longer listed, whatever of its pages remain.
             await r2.delete(directoryKey(capturedAt));
+            const prefix = `${DIRECTORY_PREFIX}${capturedAt}/`;
+            let cursor;
+            do {
+                const page = await r2.list({ prefix, ...(cursor ? { cursor } : {}) });
+                await Promise.all(page.objects.map((o) => r2.delete(o.key)));
+                cursor = page.truncated ? page.cursor : undefined;
+            } while (cursor);
+        },
+        async markAttempt({ attemptedAt }) {
+            await r2.put(DIRECTORY_ATTEMPT_KEY, JSON.stringify({ attemptedAt }), {
+                httpMetadata: { contentType: 'application/json' },
+            });
+        },
+        async lastAttempt() {
+            const obj = await r2.get(DIRECTORY_ATTEMPT_KEY);
+            if (!obj)
+                return null;
+            const parsed = z.object({ attemptedAt: z.string().min(1) }).safeParse(JSON.parse(await obj.text()));
+            return parsed.success ? parsed.data.attemptedAt : null;
         },
     };
 }

package/dist/r2-backups.js.map

@@ -1 +1 @@
-{"version":3,"file":"r2-backups.js","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,aAAa,EACb,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,CAAC,GAIF,MAAM,yBAAyB,CAAC;AA4BjC;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAkB;IACtE,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAI,UAAU,OAAO,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAkB,EAAE,OAAe,EAAE,GAAW;IACnG,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAI,UAAU,IAAI,OAAO,IAAI,GAAG,OAAO,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,OAAO,UAAU,QAAQ,IAAI,OAAO,GAAG,CAAC;AAC1C,CAAC;AAED,mFAAmF;AACnF,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH,uGAAuG;AACvG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAEnF,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,EAAE,GAAG,MAAsB,CAAC;IAElC,OAAO;QACL,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC5C,OAAO;gBACL,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK;oBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBACnC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;wBACxE,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;wBACjD,sEAAsE;wBACtE,cAAc,EAAE,EAAE,UAAU,EAAE;qBAC/B,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACzC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBAED,KAAK,CAAC,OAAO,CAAC,OAAO;oBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACxB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAC/G,CAAC;gBACJ,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE;oBACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACzC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;wBACvC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC;oBACvG,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBACtF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACnF,MAAM,MAAM,GAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;oBACtF,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE;wBAC3D,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;wBACjD,4EAA4E;wBAC5E,uEAAuE;wBACvE,cAAc,EAAE;4BACd,QAAQ;4BACR,OAAO;4BACP,UAAU;4BACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;4BACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;4BAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAClC;qBACF,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAkB,EAAE,CAAC;YAC9B,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,yFAAyF;gBACzF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM;oBACN,SAAS,EAAE,GAAG;oBACd,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,yEAAyE;oBACzE,qEAAqE;oBACrE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,IAAI,CAAC;wBACP,QAAQ;wBACR,OAAO;wBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;wBAC/B,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,+EAA+E;YAC/E,0BAA0B;YAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,gFAAgF;YAChF,sFAAsF;YACtF,yEAAyE;YACzE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,IAAK,GAAmC,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO;oBACL,MAAM;oBACN,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrB,IAAI,KAAK,KAAK,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,gBAAgB,CAAC,CAAC;wBAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAClC,CAAC;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzF,OAAO;gBACL,MAAM;gBACN,OAAO;gBACP,KAAK,EAAE,KAAK,EAAE,KAAK,EAA6B,EAAE;oBAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;oBACnF,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,qBAAqB,KAAK,EAAE,CAAC,CAAC;oBACjG,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC1D,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,aAAa,UAAU,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,oEAAoE;YACpE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACnD,MAAM,MAAM,GAAoB;gBAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;aAC3B,CAAC;YACF,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;gBAChD,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBACjD,gFAAgF;gBAChF,6DAA6D;gBAC7D,cAAc,EAAE;oBACd,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;iBAC9B;aACF,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAsB,EAAE,CAAC;YAClC,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,4EAA4E;oBAC5E,iEAAiE;oBACjE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACjF,GAAG,CAAC,IAAI,CAAC;wBACP,UAAU;wBACV,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,gFAAgF;YAChF,mEAAmE;YACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,+EAA+E;YAC/E,4DAA4D;YAC5D,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAkB,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,OAAO,cAAc,OAAO,IAAI,MAAM,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,OAAe;IAClF,OAAO,iBAAiB,QAAQ,UAAU,OAAO,QAAQ,GAAG,IAAI,OAAO,SAAS,CAAC;AACnF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,0EAA0E;gBAC1E,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;oBACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACnE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE;oBACtB,YAAY,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;oBACrD,cAAc,EAAE;wBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;qBAC3B;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,4EAA4E;YAC5E,+CAA+C;YAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,iFAAiF;gBACjF,sEAAsE;gBACtE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACrE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE;gBACtB,8EAA8E;gBAC9E,sEAAsE;gBACtE,YAAY,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;gBACrD,cAAc,EAAE;oBACd,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC5B,4EAA4E;oBAC5E,oCAAoC;oBACpC,IAAI,EAAE,KAAK,CAAC,EAAE;oBACd,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,iEAAiE;YACjE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AA4BD,kFAAkF;AAClF,KAAK,UAAU,OAAO,CACpB,EAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAA+D,EAAE,CAAC;IAC3E,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YACzB,MAAM;YACN,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAe,EAAE,OAAqB;IAC5E,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAC1F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GACd,CAAC,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,MAAM;YAAE,SAAS;QAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,+FAA+F;AAC/F,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAe,EACf,OAAqB;IAErB,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAC1F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,kFAAkF;YAClF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM;YAAE,SAAS;QAClD,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"r2-backups.js","sourceRoot":"","sources":["../src/r2-backups.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,aAAa,EACb,cAAc,EACd,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,CAAC,GAKF,MAAM,yBAAyB,CAAC;AA4BjC;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAkB;IACtE,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAI,UAAU,OAAO,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAkB,EAAE,OAAe,EAAE,GAAW;IACnG,OAAO,UAAU,QAAQ,IAAI,OAAO,IAAI,UAAU,IAAI,OAAO,IAAI,GAAG,OAAO,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,OAAO,UAAU,QAAQ,IAAI,OAAO,GAAG,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACtC,YAAY,EAAE,CAAC;SACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;CACjF,CAAC,CAAC;AAEH,uGAAuG;AACvG,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAEnF,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,EAAE,GAAG,MAAsB,CAAC;IAElC,OAAO;QACL,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;YACxB,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC5C,OAAO;gBACL,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK;oBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;oBACnC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;wBACxE,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;wBACjD,sEAAsE;wBACtE,cAAc,EAAE,EAAE,UAAU,EAAE;qBAC/B,CAAC,CAAC;oBACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACzC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9B,CAAC;gBAED,KAAK,CAAC,OAAO,CAAC,OAAO;oBACnB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACzC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACxB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAC/G,CAAC;gBACJ,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE;oBACrD,IAAI,IAAI,GAAG,CAAC,CAAC;oBACb,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;wBAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;wBAC9C,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;4BAC5C,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gCAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,OAAO,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,oBAAoB,CAAC,CAAC;4BAChI,IAAI,IAAI,KAAK,CAAC,GAAG,CAAE,CAAC;wBACtB,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;oBACpG,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;oBACzB,MAAM,MAAM,GAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;oBACtF,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE;wBAC3D,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;wBACjD,4EAA4E;wBAC5E,uEAAuE;wBACvE,cAAc,EAAE;4BACd,QAAQ;4BACR,OAAO;4BACP,UAAU;4BACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;4BACtB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;4BAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAClC;qBACF,CAAC,CAAC;oBACH,OAAO,MAAM,CAAC;gBAChB,CAAC;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAkB,EAAE,CAAC;YAC9B,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,yFAAyF;gBACzF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM;oBACN,SAAS,EAAE,GAAG;oBACd,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,yEAAyE;oBACzE,qEAAqE;oBACrE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,IAAI,CAAC;wBACP,QAAQ;wBACR,OAAO;wBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;wBAC/B,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,+EAA+E;YAC/E,0BAA0B;YAC1B,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,gFAAgF;YAChF,sFAAsF;YACtF,yEAAyE;YACzE,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,IAAK,GAAmC,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO;oBACL,MAAM;oBACN,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;wBACrB,IAAI,KAAK,KAAK,CAAC;4BAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,gBAAgB,CAAC,CAAC;wBAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAClC,CAAC;oBACD,YAAY,EAAE,EAAE;oBAChB,SAAS,EAAE,KAAK,IAAI,EAAE;wBACpB,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,0BAA0B,CAAC,CAAC;oBACtF,CAAC;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvG,MAAM,IAAI,GAAG,KAAK,EAAE,EAAU,EAAE,KAAa,EAA6B,EAAE;gBAC1E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9E,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,qBAAqB,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1G,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC;YACF,OAAO;gBACL,MAAM;gBACN,OAAO;gBACP,sFAAsF;gBACtF,KAAK,EAAE,KAAK,EAAE,KAAK,EAAkC,EAAE;oBACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBACzC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;wBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,uCAAuC,KAAK,UAAU,CAAC,CAAC;oBACjJ,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,YAAY;gBACZ,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;wBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,aAAa,OAAO,aAAa,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;oBACtJ,OAAO,KAAK,CAAC,MAAM,CAAC;gBACtB,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,OAAO,aAAa,UAAU,OAAO,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,OAAe,EAAE,GAAW;IACxE,OAAO,aAAa,UAAU,IAAI,OAAO,IAAI,GAAG,OAAO,CAAC;AAC1D,CAAC;AAED,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,SAAS,CAAC;AAE1C,8FAA8F;AAC9F,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAEpE;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,EAAgB,EAAE,MAAc;IACjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,KAAK,GAA0C,EAAE,CAAC;IACxD,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxF,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;;gBACrD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC,QAAQ,MAAM,EAAE;IACjB,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,EAAE,UAAU,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM;oBACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;oBACxC,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE;wBAC7D,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;qBAClD,CAAC,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAED,KAAK,CAAC,OAAO;oBACX,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CACpG,CAAC;gBACJ,CAAC;gBAED,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE;oBAC9B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;wBACvC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC;oBAChH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBACvF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACnF,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE;wBAC3C,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;wBACjD,mFAAmF;wBACnF,6DAA6D;wBAC7D,cAAc,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;qBAC3E,CAAC,CAAC;oBACH,qFAAqF;oBACrF,4FAA4F;oBAC5F,IAAI,CAAC;wBACH,MAAM,mBAAmB,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;oBACrG,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,gFAAgF,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBACpJ,CAAC;oBACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACtC,CAAC;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAsB,EAAE,CAAC;YAClC,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,oFAAoF;gBACpF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;oBACzB,MAAM,EAAE,gBAAgB;oBACxB,SAAS,EAAE,GAAG;oBACd,OAAO,EAAE,CAAC,gBAAgB,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;oBACpC,4EAA4E;oBAC5E,iEAAiE;oBACjE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;oBACjF,GAAG,CAAC,IAAI,CAAC;wBACP,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;YACjB,gFAAgF;YAChF,mEAAmE;YACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE;YACtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,+EAA+E;YAC/E,4DAA4D;YAC5D,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,IAAK,GAAmC,EAAE,MAAM,KAAK,OAAO;gBAAE,OAAO,aAAa,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAC/G,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAuB,EAAE,CAAC;YACrC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;gBAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,oBAAoB,GAAG,EAAE,CAAC,CAAC;gBACpF,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxE,CAAC;YACD,0GAA0G;YAC1G,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;YACzB,kGAAkG;YAClG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,gBAAgB,GAAG,UAAU,GAAG,CAAC;YACnD,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtE,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7D,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACpD,CAAC,QAAQ,MAAM,EAAE;QACnB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE;YAC/B,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;gBACnE,YAAY,EAAE,EAAE,WAAW,EAAE,kBAAkB,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW;YACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpG,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,OAAO,cAAc,OAAO,IAAI,MAAM,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe,EAAE,GAAW,EAAE,OAAe;IAClF,OAAO,iBAAiB,QAAQ,UAAU,OAAO,QAAQ,GAAG,IAAI,OAAO,SAAS,CAAC;AACnF,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAe;IAC/C,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,0EAA0E;gBAC1E,4EAA4E;gBAC5E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,6EAA6E;YAC7E,4EAA4E;YAC5E,4EAA4E;YAC5E,uEAAuE;YACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;YAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;oBACpB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,CAAC;YAED,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrE,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBACnE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE;oBACtB,YAAY,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;oBACrD,cAAc,EAAE;wBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;qBAC3B;iBACF,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;YACD,4EAA4E;YAC5E,+CAA+C;YAC/C,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,iFAAiF;gBACjF,sEAAsE;gBACtE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACrE,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE;gBACtB,8EAA8E;gBAC9E,sEAAsE;gBACtE,YAAY,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE;gBACrD,cAAc,EAAE;oBACd,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC5B,4EAA4E;oBAC5E,oCAAoC;oBACpC,IAAI,EAAE,KAAK,CAAC,EAAE;oBACd,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ;aACF,CAAC,CAAC;YACH,8EAA8E;YAC9E,iEAAiE;YACjE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AA4BD,kFAAkF;AAClF,KAAK,UAAU,OAAO,CACpB,EAAgB,EAChB,MAAc;IAEd,MAAM,GAAG,GAA+D,EAAE,CAAC;IAC3E,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;YACzB,MAAM;YACN,OAAO,EAAE,CAAC,gBAAgB,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAe,EAAE,OAAqB;IAC5E,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAC1F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,UAAU,GACd,CAAC,CAAC,cAAc,EAAE,UAAU,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACrF,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,MAAM;YAAE,SAAS;QAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,+FAA+F;AAC/F,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACvB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAe,EACf,OAAqB;IAErB,MAAM,EAAE,GAAG,MAAsB,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAC1F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACnD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,kFAAkF;YAClF,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM;YAAE,SAAS;QAClD,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/store-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-entry.d.ts","sourceRoot":"","sources":["../src/store-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAqBlD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAKD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAuC/D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC,CAAC,EAChF,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,CAqC1C;AAED,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;CACtF;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CA4BrH;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAsBxH"}
+{"version":3,"file":"store-entry.d.ts","sourceRoot":"","sources":["../src/store-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAqBlD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,kCAAkC,EAClC,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,+BAA+B,EAC/B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAKD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAuC/D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC,GACjD,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,UAAU,GAAG,oBAAoB,CAAC,CAAC,EAChF,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,CAAC,CAqC1C;AAED,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;CACtF;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CAC/C;AAED;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,6BAA6B,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,CA6BrH;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAsBxH"}

package/dist/store-entry.generated.d.ts

@@ -6,11 +6,6 @@
  */
 /** The `caller` audience's public keys: raw Ed25519, base64url, comma-separated. */
 export declare const STORE_CALLER_KEYS_VAR = "SUBSTRAT_STORE_CALLER_KEYS";
-/**
- * The most request-body bytes the Python entry reads (#2811). A call declaring more is answered
- * 413 before its body is read, so the stateless entry is never the thing that runs out of memory.
- */
-export declare const STORE_CALL_MAX_BODY_BYTES = 4194304;
 /** The class name the uploader replaces, inside a property access on the driver module. */
 export declare const STORE_CLASS_PLACEHOLDER = "__SUBSTRAT_STORE_CLASS__";
 /** The import specifier the uploader replaces with `./<the driver module>`. */
@@ -49,7 +44,7 @@ export declare const STORE_SCRIPT_VAR = "SUBSTRAT_STORE_SCRIPT";
  * it, so both entries run one verifier. Reserved.
  */
 export declare const STORE_VERIFIER_MODULE = "substrat-store-verify.js";
-/** The entry itself — 11446 bytes of ESM. */
+/** The entry itself — 13911 bytes of ESM. */
 export declare const STORE_ENTRY_SOURCE: string;
 /**
  * The Python entry (#2290), uploaded as `substrat_store_entry.py`. The driver module's
@@ -59,7 +54,7 @@ export declare const STORE_ENTRY_SOURCE: string;
 export declare const STORE_ENTRY_PYTHON_SOURCE: string;
 /**
  * The verifier the Python entry imports, uploaded beside it as `substrat-store-verify.js`
- * (an ES module). It is `packages/control-plane-api/store-entry/verify.ts`, the check the JavaScript entry runs — 9216 bytes.
+ * (an ES module). It is `packages/control-plane-api/store-entry/verify.ts`, the check the JavaScript entry runs — 11756 bytes.
  */
 export declare const STORE_ENTRY_PYTHON_VERIFIER_SOURCE: string;
 //# sourceMappingURL=store-entry.generated.d.ts.map

package/dist/store-entry.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-entry.generated.d.ts","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,eAAe,CAAC;AAE5D,6GAA6G;AAC7G,eAAO,MAAM,gCAAgC,UAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAE9D,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAmF,CAAC;AAEvH,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,EAAE,MAAgrX,CAAC;AAEltX;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAu6M,CAAC;AAEh9M;;;GAGG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAg7S,CAAC"}
+{"version":3,"file":"store-entry.generated.d.ts","sourceRoot":"","sources":["../src/store-entry.generated.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAElE,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAElE,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,4GAA4G;AAC5G,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AAExD,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,iCAAiC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,eAAe,CAAC;AAE5D,6GAA6G;AAC7G,eAAO,MAAM,gCAAgC,UAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAE9D,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAmF,CAAC;AAEvH,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,6CAA6C;AAC7C,eAAO,MAAM,kBAAkB,EAAE,MAAgqc,CAAC;AAElsc;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAs1M,CAAC;AAE/3M;;;GAGG;AACH,eAAO,MAAM,kCAAkC,EAAE,MAAg/X,CAAC"}

package/dist/store-entry.generated.js

@@ -8,11 +8,6 @@
  */
 /** The `caller` audience's public keys: raw Ed25519, base64url, comma-separated. */
 export const STORE_CALLER_KEYS_VAR = "SUBSTRAT_STORE_CALLER_KEYS";
-/**
- * The most request-body bytes the Python entry reads (#2811). A call declaring more is answered
- * 413 before its body is read, so the stateless entry is never the thing that runs out of memory.
- */
-export const STORE_CALL_MAX_BODY_BYTES = 4194304;
 /** The class name the uploader replaces, inside a property access on the driver module. */
 export const STORE_CLASS_PLACEHOLDER = "__SUBSTRAT_STORE_CLASS__";
 /** The import specifier the uploader replaces with `./<the driver module>`. */
@@ -51,17 +46,17 @@ export const STORE_SCRIPT_VAR = "SUBSTRAT_STORE_SCRIPT";
  * it, so both entries run one verifier. Reserved.
  */
 export const STORE_VERIFIER_MODULE = "substrat-store-verify.js";
-/** The entry itself — 11446 bytes of ESM. */
-export const STORE_ENTRY_SOURCE = "// packages/control-plane-api/store-entry/entry.ts\nimport { DurableObject } from \"cloudflare:workers\";\nimport * as driverModule from \"__SUBSTRAT_STORE_DRIVER__\";\n\n// packages/control-plane-api/store-entry/names.ts\nvar STORE_OBJECT_BINDING = \"SUBSTRAT_STORE\";\nvar STORE_SCRIPT_VAR = \"SUBSTRAT_STORE_SCRIPT\";\nvar STORE_CALLER_KEYS_VAR = \"SUBSTRAT_STORE_CALLER_KEYS\";\nvar STORE_PLATFORM_KEYS_VAR = \"SUBSTRAT_STORE_PLATFORM_KEYS\";\nvar STORE_RESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\";\nvar STORE_CALL_MAX_BODY_BYTES = 4 * 1024 * 1024;\n\n// packages/contracts/dist/scope-store-envelope.js\nvar SCOPE_STORE_ENVELOPE_WINDOW_SECONDS = 60;\nvar SCOPE_STORE_ENVELOPE_HEADER = \"x-substrat-store-envelope\";\nvar SCOPE_STORE_SIGNATURE_HEADER = \"x-substrat-store-signature\";\nvar RESERVED_STORE_OPERATIONS = [\n  \"substrat.export\",\n  \"substrat.import\",\n  \"substrat.size\",\n  \"substrat.wipe\",\n  \"substrat.erase\"\n];\nvar ADMITTED = {\n  \"1\": {\n    platform: (op) => RESERVED_STORE_OPERATIONS.includes(op),\n    caller: (op) => !op.startsWith(\"substrat.\")\n  }\n};\nfunction scopeStoreEnvelopeAdmits(v, aud, op) {\n  const byAudience = Object.hasOwn(ADMITTED, String(v)) ? ADMITTED[String(v)] : void 0;\n  if (!byAudience || !Object.hasOwn(byAudience, aud))\n    return false;\n  return byAudience[aud](op);\n}\nfunction bytesToBase64Url(bytes) {\n  let binary = \"\";\n  for (const byte of bytes)\n    binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\nfunction base64UrlToBytes(value) {\n  if (!/^[A-Za-z0-9_-]+$/.test(value))\n    return void 0;\n  const padded = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++)\n      bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return void 0;\n  }\n}\nfunction copyBytes(bytes) {\n  const copy = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(copy).set(bytes);\n  return copy;\n}\nfunction isCanonicalBase64Url(text2, length) {\n  const bytes = base64UrlToBytes(text2);\n  return bytes?.length === length && bytesToBase64Url(bytes) === text2;\n}\nvar NONCE = /^[A-Za-z0-9_-]{22}$/;\nvar KID = /^[A-Za-z0-9_-]{11}$/;\nvar DIGEST = /^[0-9a-f]{64}$/;\nvar IAT = /^(0|[1-9]\\d{0,14})$/;\nfunction parseScopeStoreEnvelope(canonical) {\n  const lines = canonical.split(\"\\n\");\n  if (lines.length !== 9)\n    return void 0;\n  const [version, aud, kid, script, name, op, digest, iatText, nonce] = lines;\n  if (version !== \"1\" || aud !== \"caller\" && aud !== \"platform\")\n    return void 0;\n  if (!script || !name || !op)\n    return void 0;\n  if (!KID.test(kid) || !DIGEST.test(digest) || !IAT.test(iatText) || !NONCE.test(nonce))\n    return void 0;\n  if (!isCanonicalBase64Url(kid, 8) || !isCanonicalBase64Url(nonce, 16))\n    return void 0;\n  return { v: 1, aud, kid, script, name, op, digest, iat: Number(iatText), nonce };\n}\nasync function scopeStoreBodyDigest(body) {\n  const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(body));\n  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction scopeStoreEnvelopeFresh(iat, nowSeconds, windowSeconds = SCOPE_STORE_ENVELOPE_WINDOW_SECONDS) {\n  return Math.abs(nowSeconds - iat) <= windowSeconds;\n}\nvar SMALL_ORDER_KEYS = [\n  \"0000000000000000000000000000000000000000000000000000000000000000\",\n  // y = 0, order 4\n  \"0100000000000000000000000000000000000000000000000000000000000000\",\n  // the identity, order 1\n  \"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05\",\n  // order 8\n  \"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a\",\n  // order 8\n  \"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p - 1, order 2\n  \"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p, a non-canonical 0\n  \"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\"\n  // y = p + 1, a non-canonical identity\n];\nfunction isSmallOrderKey(bytes) {\n  const unsigned = Uint8Array.from(bytes);\n  unsigned[31] = unsigned[31] & 127;\n  const hex = [...unsigned].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return SMALL_ORDER_KEYS.includes(hex);\n}\nasync function scopeStoreKeyId(publicKey) {\n  const bytes = base64UrlToBytes(publicKey);\n  if (!bytes || bytes.length !== 32)\n    throw new Error(\"a store public key is not 32 bytes of base64url\");\n  if (isSmallOrderKey(bytes))\n    throw new Error(\"a store public key is a small-order point\");\n  const hash = await crypto.subtle.digest(\"SHA-256\", copyBytes(bytes));\n  return bytesToBase64Url(new Uint8Array(hash).slice(0, 8));\n}\nfunction scopeStorePublicKeyProblem(key) {\n  if (key.length === 0)\n    return \"empty\";\n  const bytes = base64UrlToBytes(key);\n  if (bytes?.length !== 32)\n    return \"length\";\n  if (isSmallOrderKey(bytes))\n    return \"small-order\";\n  if (bytesToBase64Url(bytes) !== key)\n    return \"non-canonical\";\n  return void 0;\n}\nvar PUBLIC_KEY_PROBLEM = {\n  empty: \"a store public key list is empty or has an empty entry\",\n  length: \"a store public key is not 32 bytes of base64url\",\n  \"small-order\": \"a store public key is a small-order point\",\n  \"non-canonical\": \"a store public key is not canonical base64url\"\n};\nfunction parseScopeStorePublicKeys(text2) {\n  const keys = text2.split(\",\").map((key) => key.trim());\n  if (keys.some((key) => key.length === 0))\n    throw new Error(PUBLIC_KEY_PROBLEM.empty);\n  const seen = /* @__PURE__ */ new Set();\n  for (const key of keys) {\n    const problem = scopeStorePublicKeyProblem(key);\n    if (problem)\n      throw new Error(PUBLIC_KEY_PROBLEM[problem]);\n    if (seen.has(key))\n      throw new Error(\"a store public key is listed twice\");\n    seen.add(key);\n  }\n  return keys;\n}\nfunction scopeStorePublicKeysFrom(config) {\n  const caller = parseScopeStorePublicKeys(config.caller);\n  const platform = parseScopeStorePublicKeys(config.platform);\n  if (caller.some((key) => platform.includes(key))) {\n    throw new Error(\"a store public key is listed for both audiences\");\n  }\n  return { caller, platform };\n}\nasync function verifyScopeStoreEnvelope(publicKey, canonical, signature) {\n  const keyBytes = base64UrlToBytes(publicKey);\n  const sigBytes = base64UrlToBytes(signature);\n  if (!keyBytes || !sigBytes || sigBytes.length !== 64)\n    return false;\n  try {\n    const key = await crypto.subtle.importKey(\"raw\", copyBytes(keyBytes), { name: \"Ed25519\" }, false, [\"verify\"]);\n    return await crypto.subtle.verify(\"Ed25519\", key, copyBytes(sigBytes), new TextEncoder().encode(canonical));\n  } catch {\n    return false;\n  }\n}\nasync function verifyScopeStoreCall(input) {\n  const refuse = (refusal) => ({ ok: false, refusal });\n  if (!input.envelope || !input.signature)\n    return refuse(\"missing\");\n  const bytes = base64UrlToBytes(input.envelope);\n  if (!bytes)\n    return refuse(\"malformed\");\n  let canonical;\n  try {\n    canonical = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n  } catch {\n    return refuse(\"malformed\");\n  }\n  const envelope = parseScopeStoreEnvelope(canonical);\n  if (!envelope)\n    return refuse(\"malformed\");\n  if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op))\n    return refuse(\"audience\");\n  const kidsOf = async (keys) => {\n    const kids = /* @__PURE__ */ new Map();\n    for (const key of keys) {\n      try {\n        kids.set(await scopeStoreKeyId(key), key);\n      } catch {\n      }\n    }\n    return kids;\n  };\n  const own = await kidsOf(input.keys[envelope.aud]);\n  const other = await kidsOf(input.keys[envelope.aud === \"caller\" ? \"platform\" : \"caller\"]);\n  if ([...own.keys()].some((kid) => other.has(kid)))\n    return refuse(\"keys\");\n  const publicKey = own.get(envelope.kid);\n  if (!publicKey)\n    return refuse(\"kid\");\n  if (!await verifyScopeStoreEnvelope(publicKey, canonical, input.signature))\n    return refuse(\"signature\");\n  if (envelope.digest !== await scopeStoreBodyDigest(input.body))\n    return refuse(\"digest\");\n  if (!scopeStoreEnvelopeFresh(envelope.iat, input.nowSeconds, input.windowSeconds))\n    return refuse(\"stale\");\n  if (envelope.script !== input.script)\n    return refuse(\"script\");\n  let parsed;\n  try {\n    parsed = JSON.parse(input.body);\n  } catch {\n    return refuse(\"body\");\n  }\n  const field = (key) => typeof parsed === \"object\" && parsed !== null ? Reflect.get(parsed, key) : void 0;\n  if (field(\"operation\") !== envelope.op || field(\"objectName\") !== envelope.name)\n    return refuse(\"body\");\n  return { ok: true, envelope };\n}\n\n// packages/control-plane-api/store-entry/verify.ts\nasync function storeCallVerdict(headers, body, env) {\n  const script = env[STORE_SCRIPT_VAR];\n  let keys;\n  try {\n    if (typeof script !== \"string\" || script.length === 0) throw new Error(\"no script name\");\n    keys = scopeStorePublicKeysFrom({\n      caller: String(env[STORE_CALLER_KEYS_VAR] ?? \"\"),\n      platform: String(env[STORE_PLATFORM_KEYS_VAR] ?? \"\")\n    });\n  } catch {\n    return { ok: false, status: 503, message: \"this store script is not configured\" };\n  }\n  const verdict = await verifyScopeStoreCall({\n    envelope: headers.get(SCOPE_STORE_ENVELOPE_HEADER),\n    signature: headers.get(SCOPE_STORE_SIGNATURE_HEADER),\n    body,\n    keys,\n    script,\n    nowSeconds: Math.floor(Date.now() / 1e3)\n  });\n  return verdict.ok ? verdict : { ok: false, status: 401, message: `unauthorized: ${verdict.refusal}` };\n}\n\n// packages/control-plane-api/store-entry/entry.ts\nvar Driver = driverModule[\"__SUBSTRAT_STORE_CLASS__\"];\nvar text = (status, message) => new Response(message, { status });\nfunction driverEnvOf(env) {\n  return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith(STORE_RESERVED_BINDING_PREFIX)));\n}\nasync function verified(request, body, env) {\n  const verdict = await storeCallVerdict(request.headers, body, env);\n  return verdict.ok ? verdict.envelope : text(verdict.status, verdict.message);\n}\nvar SubstratStoreObject = class extends DurableObject {\n  #driver;\n  /** Constructed once per object instance, on first use, so the driver keeps its in-memory state. */\n  #driverObject() {\n    this.#driver ??= new Driver(this.ctx, driverEnvOf(this.env));\n    return this.#driver;\n  }\n  async fetch(request) {\n    const body = await request.text();\n    const envelope = await verified(request, body, this.env);\n    if (envelope instanceof Response) return envelope;\n    const ns = this.env[STORE_OBJECT_BINDING];\n    if (!this.ctx.id.equals(ns.idFromName(envelope.name))) return text(401, \"unauthorized: object\");\n    return this.#driverObject().fetch(\n      new Request(request.url, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body })\n    );\n  }\n  /** An alarm is the object's own timer, which only the driver sets. It goes to the driver. */\n  async alarm(alarmInfo) {\n    const driver = this.#driverObject();\n    if (typeof driver.alarm === \"function\") await driver.alarm(alarmInfo);\n  }\n};\nvar entry_default = {\n  async fetch(request, env) {\n    const body = await request.text();\n    const envelope = await verified(request, body, env);\n    if (envelope instanceof Response) return envelope;\n    const ns = env[STORE_OBJECT_BINDING];\n    return ns.get(ns.idFromName(envelope.name)).fetch(\n      new Request(request.url, { method: \"POST\", headers: request.headers, body })\n    );\n  }\n};\nexport {\n  SubstratStoreObject,\n  entry_default as default\n};\n";
+/** The entry itself — 13911 bytes of ESM. */
+export const STORE_ENTRY_SOURCE = "// packages/control-plane-api/store-entry/entry.ts\nimport { DurableObject } from \"cloudflare:workers\";\nimport * as driverModule from \"__SUBSTRAT_STORE_DRIVER__\";\n\n// packages/control-plane-api/store-entry/names.ts\nvar STORE_OBJECT_BINDING = \"SUBSTRAT_STORE\";\nvar STORE_SCRIPT_VAR = \"SUBSTRAT_STORE_SCRIPT\";\nvar STORE_CALLER_KEYS_VAR = \"SUBSTRAT_STORE_CALLER_KEYS\";\nvar STORE_PLATFORM_KEYS_VAR = \"SUBSTRAT_STORE_PLATFORM_KEYS\";\nvar STORE_RESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\";\n\n// packages/contracts/dist/scope-store-envelope.js\nvar SCOPE_STORE_ENVELOPE_WINDOW_SECONDS = 60;\nvar SCOPE_STORE_ENVELOPE_HEADER = \"x-substrat-store-envelope\";\nvar SCOPE_STORE_SIGNATURE_HEADER = \"x-substrat-store-signature\";\nvar RESERVED_STORE_OPERATIONS = [\n  \"substrat.export-page\",\n  \"substrat.stage-page\",\n  \"substrat.commit-stage\",\n  \"substrat.discard-stage\",\n  \"substrat.size\",\n  \"substrat.wipe\",\n  \"substrat.erase\",\n  \"substrat.selfcheck\"\n];\nvar STORE_STAGE_MAX_AGE_MS = 6 * 36e5 + 3 * 30 * 6e4;\nvar STORE_CALL_MAX_BYTES = 4 * 1024 * 1024;\nvar STORE_DUMP_PAGE_MAX_BYTES = 3 * 1024 * 1024;\nvar ADMITTED = {\n  \"1\": {\n    platform: (op) => RESERVED_STORE_OPERATIONS.includes(op),\n    caller: (op) => !op.startsWith(\"substrat.\")\n  }\n};\nfunction scopeStoreEnvelopeAdmits(v, aud, op) {\n  const byAudience = Object.hasOwn(ADMITTED, String(v)) ? ADMITTED[String(v)] : void 0;\n  if (!byAudience || !Object.hasOwn(byAudience, aud))\n    return false;\n  return byAudience[aud](op);\n}\nfunction bytesToBase64Url(bytes) {\n  let binary = \"\";\n  for (const byte of bytes)\n    binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\nfunction base64UrlToBytes(value) {\n  if (!/^[A-Za-z0-9_-]+$/.test(value))\n    return void 0;\n  const padded = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++)\n      bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return void 0;\n  }\n}\nfunction copyBytes(bytes) {\n  const copy = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(copy).set(bytes);\n  return copy;\n}\nfunction isCanonicalBase64Url(text, length) {\n  const bytes = base64UrlToBytes(text);\n  return bytes?.length === length && bytesToBase64Url(bytes) === text;\n}\nvar NONCE = /^[A-Za-z0-9_-]{22}$/;\nvar KID = /^[A-Za-z0-9_-]{11}$/;\nvar DIGEST = /^[0-9a-f]{64}$/;\nvar IAT = /^(0|[1-9]\\d{0,14})$/;\nfunction parseScopeStoreEnvelope(canonical) {\n  const lines = canonical.split(\"\\n\");\n  if (lines.length !== 9)\n    return void 0;\n  const [version, aud, kid, script, name, op, digest, iatText, nonce] = lines;\n  if (version !== \"1\" || aud !== \"caller\" && aud !== \"platform\")\n    return void 0;\n  if (!script || !name || !op)\n    return void 0;\n  if (!KID.test(kid) || !DIGEST.test(digest) || !IAT.test(iatText) || !NONCE.test(nonce))\n    return void 0;\n  if (!isCanonicalBase64Url(kid, 8) || !isCanonicalBase64Url(nonce, 16))\n    return void 0;\n  return { v: 1, aud, kid, script, name, op, digest, iat: Number(iatText), nonce };\n}\nasync function scopeStoreBodyDigest(body) {\n  const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(body));\n  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction scopeStoreEnvelopeFresh(iat, nowSeconds, windowSeconds = SCOPE_STORE_ENVELOPE_WINDOW_SECONDS) {\n  return Math.abs(nowSeconds - iat) <= windowSeconds;\n}\nvar SMALL_ORDER_KEYS = [\n  \"0000000000000000000000000000000000000000000000000000000000000000\",\n  // y = 0, order 4\n  \"0100000000000000000000000000000000000000000000000000000000000000\",\n  // the identity, order 1\n  \"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05\",\n  // order 8\n  \"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a\",\n  // order 8\n  \"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p - 1, order 2\n  \"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p, a non-canonical 0\n  \"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\"\n  // y = p + 1, a non-canonical identity\n];\nfunction isSmallOrderKey(bytes) {\n  const unsigned = Uint8Array.from(bytes);\n  unsigned[31] = unsigned[31] & 127;\n  const hex = [...unsigned].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return SMALL_ORDER_KEYS.includes(hex);\n}\nasync function scopeStoreKeyId(publicKey) {\n  const bytes = base64UrlToBytes(publicKey);\n  if (!bytes || bytes.length !== 32)\n    throw new Error(\"a store public key is not 32 bytes of base64url\");\n  if (isSmallOrderKey(bytes))\n    throw new Error(\"a store public key is a small-order point\");\n  const hash = await crypto.subtle.digest(\"SHA-256\", copyBytes(bytes));\n  return bytesToBase64Url(new Uint8Array(hash).slice(0, 8));\n}\nfunction scopeStorePublicKeyProblem(key) {\n  if (key.length === 0)\n    return \"empty\";\n  const bytes = base64UrlToBytes(key);\n  if (bytes?.length !== 32)\n    return \"length\";\n  if (isSmallOrderKey(bytes))\n    return \"small-order\";\n  if (bytesToBase64Url(bytes) !== key)\n    return \"non-canonical\";\n  return void 0;\n}\nvar PUBLIC_KEY_PROBLEM = {\n  empty: \"a store public key list is empty or has an empty entry\",\n  length: \"a store public key is not 32 bytes of base64url\",\n  \"small-order\": \"a store public key is a small-order point\",\n  \"non-canonical\": \"a store public key is not canonical base64url\"\n};\nfunction parseScopeStorePublicKeys(text) {\n  const keys = text.split(\",\").map((key) => key.trim());\n  if (keys.some((key) => key.length === 0))\n    throw new Error(PUBLIC_KEY_PROBLEM.empty);\n  const seen = /* @__PURE__ */ new Set();\n  for (const key of keys) {\n    const problem = scopeStorePublicKeyProblem(key);\n    if (problem)\n      throw new Error(PUBLIC_KEY_PROBLEM[problem]);\n    if (seen.has(key))\n      throw new Error(\"a store public key is listed twice\");\n    seen.add(key);\n  }\n  return keys;\n}\nfunction scopeStorePublicKeysFrom(config) {\n  const caller = parseScopeStorePublicKeys(config.caller);\n  const platform = parseScopeStorePublicKeys(config.platform);\n  if (caller.some((key) => platform.includes(key))) {\n    throw new Error(\"a store public key is listed for both audiences\");\n  }\n  return { caller, platform };\n}\nasync function verifyScopeStoreEnvelope(publicKey, canonical, signature) {\n  const keyBytes = base64UrlToBytes(publicKey);\n  const sigBytes = base64UrlToBytes(signature);\n  if (!keyBytes || !sigBytes || sigBytes.length !== 64)\n    return false;\n  try {\n    const key = await crypto.subtle.importKey(\"raw\", copyBytes(keyBytes), { name: \"Ed25519\" }, false, [\"verify\"]);\n    return await crypto.subtle.verify(\"Ed25519\", key, copyBytes(sigBytes), new TextEncoder().encode(canonical));\n  } catch {\n    return false;\n  }\n}\nasync function verifyScopeStoreCall(input) {\n  const refuse = (refusal2) => ({ ok: false, refusal: refusal2 });\n  if (!input.envelope || !input.signature)\n    return refuse(\"missing\");\n  const bytes = base64UrlToBytes(input.envelope);\n  if (!bytes)\n    return refuse(\"malformed\");\n  let canonical;\n  try {\n    canonical = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n  } catch {\n    return refuse(\"malformed\");\n  }\n  const envelope = parseScopeStoreEnvelope(canonical);\n  if (!envelope)\n    return refuse(\"malformed\");\n  if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op))\n    return refuse(\"audience\");\n  const kidsOf = async (keys) => {\n    const kids = /* @__PURE__ */ new Map();\n    for (const key of keys) {\n      try {\n        kids.set(await scopeStoreKeyId(key), key);\n      } catch {\n      }\n    }\n    return kids;\n  };\n  const own = await kidsOf(input.keys[envelope.aud]);\n  const other = await kidsOf(input.keys[envelope.aud === \"caller\" ? \"platform\" : \"caller\"]);\n  if ([...own.keys()].some((kid) => other.has(kid)))\n    return refuse(\"keys\");\n  const publicKey = own.get(envelope.kid);\n  if (!publicKey)\n    return refuse(\"kid\");\n  if (!await verifyScopeStoreEnvelope(publicKey, canonical, input.signature))\n    return refuse(\"signature\");\n  if (envelope.digest !== await scopeStoreBodyDigest(input.body))\n    return refuse(\"digest\");\n  if (!scopeStoreEnvelopeFresh(envelope.iat, input.nowSeconds, input.windowSeconds))\n    return refuse(\"stale\");\n  if (envelope.script !== input.script)\n    return refuse(\"script\");\n  let parsed;\n  try {\n    parsed = JSON.parse(input.body);\n  } catch {\n    return refuse(\"body\");\n  }\n  const field = (key) => typeof parsed === \"object\" && parsed !== null ? Reflect.get(parsed, key) : void 0;\n  if (field(\"operation\") !== envelope.op || field(\"objectName\") !== envelope.name)\n    return refuse(\"body\");\n  return { ok: true, envelope };\n}\n\n// packages/control-plane-api/store-entry/verify.ts\nvar tooLarge = { ok: false, status: 413, message: `payload too large: at most ${STORE_CALL_MAX_BYTES} bytes` };\nfunction storeCallDeclaredRefusal(headers) {\n  const declared = headers.get(\"content-length\");\n  return declared !== null && /^\\d+$/.test(declared.trim()) && Number(declared) > STORE_CALL_MAX_BYTES ? tooLarge : void 0;\n}\nasync function boundedBody(body) {\n  if (!body) return new Uint8Array(0);\n  const reader = body.getReader();\n  const chunks = [];\n  let total = 0;\n  for (; ; ) {\n    const { done, value } = await reader.read();\n    if (done || !value) break;\n    total += value.byteLength;\n    if (total > STORE_CALL_MAX_BYTES) {\n      await reader.cancel().catch(() => void 0);\n      return tooLarge;\n    }\n    chunks.push(value);\n  }\n  const bytes = new Uint8Array(total);\n  let at = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, at);\n    at += chunk.byteLength;\n  }\n  return bytes;\n}\nasync function verifiedStoreCall(request, env) {\n  const declared = storeCallDeclaredRefusal(request.headers);\n  if (declared) return declared;\n  const bytes = await boundedBody(request.body);\n  if (!(bytes instanceof Uint8Array)) return bytes;\n  let text;\n  try {\n    text = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(bytes);\n  } catch {\n    return { ok: false, status: 401, message: \"unauthorized: digest\" };\n  }\n  const verdict = await storeCallVerdict(request.headers, text, env);\n  return verdict.ok ? { ok: true, envelope: verdict.envelope, body: bytes.buffer } : verdict;\n}\nvar STORE_NONCE_KEY_PREFIX = \"substrat.store-nonce/\";\nvar STORE_NONCE_PRUNE_BATCH = 64;\nvar nonceKey = (iat) => `${STORE_NONCE_KEY_PREFIX}${String(iat).padStart(15, \"0\")}/`;\nfunction spendStoreNonce(storage, envelope, nowSeconds) {\n  const { kv } = storage;\n  const expired = nonceKey(nowSeconds - SCOPE_STORE_ENVELOPE_WINDOW_SECONDS);\n  for (const [key2] of kv.list({ prefix: STORE_NONCE_KEY_PREFIX, end: expired, limit: STORE_NONCE_PRUNE_BATCH })) kv.delete(key2);\n  if (!scopeStoreEnvelopeFresh(envelope.iat, nowSeconds)) return false;\n  const key = `${nonceKey(envelope.iat)}${envelope.nonce}`;\n  if (kv.get(key) !== void 0) return false;\n  kv.put(key, 1);\n  return true;\n}\nvar spentNonce = { ok: false, status: 401, message: \"unauthorized: nonce\" };\nasync function storeCallVerdict(headers, body, env) {\n  const script = env[STORE_SCRIPT_VAR];\n  let keys;\n  try {\n    if (typeof script !== \"string\" || script.length === 0) throw new Error(\"no script name\");\n    keys = scopeStorePublicKeysFrom({\n      caller: String(env[STORE_CALLER_KEYS_VAR] ?? \"\"),\n      platform: String(env[STORE_PLATFORM_KEYS_VAR] ?? \"\")\n    });\n  } catch {\n    return { ok: false, status: 503, message: \"this store script is not configured\" };\n  }\n  const verdict = await verifyScopeStoreCall({\n    envelope: headers.get(SCOPE_STORE_ENVELOPE_HEADER),\n    signature: headers.get(SCOPE_STORE_SIGNATURE_HEADER),\n    body,\n    keys,\n    script,\n    nowSeconds: Math.floor(Date.now() / 1e3)\n  });\n  return verdict.ok ? verdict : { ok: false, status: 401, message: `unauthorized: ${verdict.refusal}` };\n}\n\n// packages/control-plane-api/store-entry/entry.ts\nvar Driver = driverModule[\"__SUBSTRAT_STORE_CLASS__\"];\nvar refusal = ({ status, message }) => new Response(message, { status });\nfunction driverEnvOf(env) {\n  return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith(STORE_RESERVED_BINDING_PREFIX)));\n}\nasync function verified(request, env) {\n  const call = await verifiedStoreCall(request, env);\n  return call.ok ? call : refusal(call);\n}\nvar SubstratStoreObject = class extends DurableObject {\n  #driver;\n  /** Constructed once per object instance, on first use, so the driver keeps its in-memory state. */\n  #driverObject() {\n    this.#driver ??= new Driver(this.ctx, driverEnvOf(this.env));\n    return this.#driver;\n  }\n  async fetch(request) {\n    const call = await verified(request, this.env);\n    if (call instanceof Response) return call;\n    const ns = this.env[STORE_OBJECT_BINDING];\n    if (!this.ctx.id.equals(ns.idFromName(call.envelope.name))) return new Response(\"unauthorized: object\", { status: 401 });\n    if (!spendStoreNonce(this.ctx.storage, call.envelope, Math.floor(Date.now() / 1e3))) return refusal(spentNonce);\n    return this.#driverObject().fetch(\n      new Request(request.url, { method: \"POST\", headers: { \"content-type\": \"application/json\" }, body: call.body })\n    );\n  }\n  /** An alarm is the object's own timer, which only the driver sets. It goes to the driver. */\n  async alarm(alarmInfo) {\n    const driver = this.#driverObject();\n    if (typeof driver.alarm === \"function\") await driver.alarm(alarmInfo);\n  }\n};\nvar entry_default = {\n  async fetch(request, env) {\n    const call = await verified(request, env);\n    if (call instanceof Response) return call;\n    const ns = env[STORE_OBJECT_BINDING];\n    return ns.get(ns.idFromName(call.envelope.name)).fetch(\n      new Request(request.url, { method: \"POST\", headers: request.headers, body: call.body })\n    );\n  }\n};\nexport {\n  SubstratStoreObject,\n  entry_default as default\n};\n";
 /**
  * The Python entry (#2290), uploaded as `substrat_store_entry.py`. The driver module's
  * name (a Python module name, no `.py`) replaces `__SUBSTRAT_STORE_DRIVER__` and its class
  * name replaces `__SUBSTRAT_STORE_CLASS__`, as in the JavaScript entry.
  */
-export const STORE_ENTRY_PYTHON_SOURCE = "\"\"\"The platform's Python store entry (#2290), the twin of store-entry/entry.ts.\n\nUploaded as the store script's main module when the driver is Python. The driver's class is\nimported through the two placeholders below, which the upload replaces with the driver's module\nname and class name, as it does for the JavaScript entry. The driver is reached only through\nthis module, after the call is verified.\n\nThere is one verifier. Every call is checked by store-entry/verify.ts, bundled as an ES module\nthe upload ships beside this one and imported through the runtime's JavaScript bridge. It runs\ncontracts' verifyScopeStoreCall (RFC scope-stores section 10.3, checks 1-4) against the script\nname and both audiences' public keys this upload was given. This module parses no envelope, so\nit cannot disagree with the JavaScript entry about one. The default entrypoint addresses\nSubstratStoreObject by idFromName of the signed name. The object checks the call again, and\nrefuses unless its own id is the id of that name (check 5), before the driver is constructed: an\nobject is bound to one name by construction, with nothing stored that the driver could rewrite.\n\nA body with no usable Content-Length is refused with 411, and one over MAX_BODY_BYTES with 413, before it is read: the\nstateless entry holds the body in memory more than once, and a larger one ran it out of memory\n(#2811) before the object was reached. The body is read once, verified as that string, and that\nsame string is what the driver receives.\nThe driver is constructed once per object instance with the object's ctx and an env with none of\nthe entry's SUBSTRAT_STORE* bindings. The upload sets disallow_importable_env and\ndisable_ctx_exports, and both apply to a Python script: `from workers import env` then reads an\nempty env, and ctx.exports is absent.\n\nWhat this is not: a boundary against a hostile driver, and it is weaker here than in JavaScript.\nPython has no private fields. The driver's module is imported by this one, before this module's\nbody has finished, and runs in the same interpreter: it can reach this module through\nsys.modules and replace its functions, and it can reach the entry's object, its full env and the\nstore namespace in it, through the garbage collector. The env strip and the cached driver keep a\ncareless driver away from the entry's bindings, not a hostile one. A driver written to interfere is\nstopped by the review of its release (D-63), not by this module.\n\"\"\"\n\nfrom workers import DurableObject, Request, Response, WorkerEntrypoint, import_from_javascript\nfrom js import Object\n\nfrom __SUBSTRAT_STORE_DRIVER__ import __SUBSTRAT_STORE_CLASS__ as StoreDriver\n\n# Each of these is a name in store-entry/names.ts; test/python-entry.test.ts holds them equal.\nVERIFIER_MODULE = \"./substrat-store-verify.js\"\nOBJECT_BINDING = \"SUBSTRAT_STORE\"\nRESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\"\nMAX_BODY_BYTES = 4194304\n\n\ndef _too_large(request):\n    \"\"\"The refusal for a body with no usable Content-Length (411) or one over the limit (413), or None.\n\n    Asked before the body is read. Every caller sends a sized body, so a length that is missing or\n    malformed (a chunked request) is refused rather than read without a bound.\n    \"\"\"\n    declared = request.js_object.headers.get(\"content-length\")\n    declared = None if declared is None else str(declared)\n    if declared is None or not (declared.isascii() and declared.isdigit()):\n        return Response(\"length required: send a Content-Length\", status=411)\n    if int(declared) > MAX_BODY_BYTES:\n        return Response(f\"payload too large: at most {MAX_BODY_BYTES} bytes\", status=413)\n    return None\n\n\ndef _raw_env(env):\n    \"\"\"The JavaScript env the runtime handed over. The SDK wraps it, and has no public unwrap.\"\"\"\n    return env._env\n\n\ndef _driver_env(env):\n    \"\"\"The env the driver is constructed with: everything but the entry's own bindings.\"\"\"\n    entries = [entry for entry in Object.entries(_raw_env(env)) if not str(entry[0]).startswith(RESERVED_BINDING_PREFIX)]\n    return Object.fromEntries(entries)\n\n\nasync def _verified(request, body, env):\n    \"\"\"The verified envelope's object name, or the response that refuses the call.\"\"\"\n    verifier = import_from_javascript(VERIFIER_MODULE)\n    verdict = await verifier.storeCallVerdict(request.js_object.headers, body, _raw_env(env))\n    if not verdict.ok:\n        return Response(verdict.message, status=verdict.status)\n    return verdict.envelope.name\n\n\ndef _driver_request(url, body):\n    return Request(url, method=\"POST\", headers={\"content-type\": \"application/json\"}, body=body)\n\n\nclass SubstratStoreObject(DurableObject):\n    def __init__(self, ctx, env):\n        super().__init__(ctx, env)\n        self._driver = None\n\n    def _driver_object(self):\n        \"\"\"Constructed once per object instance, on first use, so the driver keeps its in-memory state.\"\"\"\n        if self._driver is None:\n            self._driver = StoreDriver(self.ctx, _driver_env(self.env))\n        return self._driver\n\n    async def fetch(self, request):\n        refused = _too_large(request)\n        if refused is not None:\n            return refused\n        body = await request.text()\n        name = await _verified(request, body, self.env)\n        if isinstance(name, Response):\n            return name\n        namespace = getattr(self.env, OBJECT_BINDING)\n        if not self.ctx.id.equals(namespace.idFromName(name)):\n            return Response(\"unauthorized: object\", status=401)\n        return await self._driver_object().fetch(_driver_request(request.url, body))\n\n    async def alarm(self, alarm_info=None):\n        \"\"\"An alarm is the object's own timer, which only the driver sets. It goes to the driver.\"\"\"\n        driver = self._driver_object()\n        if hasattr(driver, \"alarm\"):\n            await driver.alarm(alarm_info)\n\n\nclass Default(WorkerEntrypoint):\n    async def fetch(self, request):\n        refused = _too_large(request)\n        if refused is not None:\n            return refused\n        body = await request.text()\n        name = await _verified(request, body, self.env)\n        if isinstance(name, Response):\n            return name\n        namespace = getattr(self.env, OBJECT_BINDING)\n        stub = namespace.get(namespace.idFromName(name))\n        return await stub.fetch(request.url, method=\"POST\", headers=request.js_object.headers, body=body)\n";
+export const STORE_ENTRY_PYTHON_SOURCE = "\"\"\"The platform's Python store entry (#2290), the twin of store-entry/entry.ts.\n\nUploaded as the store script's main module when the driver is Python. The driver's class is\nimported through the two placeholders below, which the upload replaces with the driver's module\nname and class name, as it does for the JavaScript entry. The driver is reached only through\nthis module, after the call is verified.\n\nThere is one verifier. Every call is checked by store-entry/verify.ts, bundled as an ES module\nthe upload ships beside this one and imported through the runtime's JavaScript bridge. It runs\ncontracts' verifyScopeStoreCall (RFC scope-stores section 10.3, checks 1-4) against the script\nname and both audiences' public keys this upload was given. This module parses no envelope, so\nit cannot disagree with the JavaScript entry about one. The default entrypoint addresses\nSubstratStoreObject by idFromName of the signed name. The object checks the call again, and\nrefuses unless its own id is the id of that name (check 5), before the driver is constructed: an\nobject is bound to one name by construction, with nothing stored that the driver could rewrite. It\nthen spends the envelope's nonce through the verifier's spendStoreNonce (K-59), so one envelope is\nadmitted once.\n\nThe body stays in JavaScript (#2811). The verifier module reads it once, bounded by STORE_CALL_MAX_BYTES\n(a declared Content-Length over the limit is refused with 413 before the body is read, and a stream\nthat goes past it is refused at the limit), verifies it as the text those bytes decode to, and hands\nback the bytes as an ArrayBuffer. That buffer is what the default entrypoint forwards to the object\nand what the driver's Request is built over, so this module makes no Python string of the body: the\ndriver reads it as text only if it asks for text. The body used to be read twice and copied to Python\neach time, which failed with exceededMemory from about 6 MB.\nThe driver is constructed once per object instance with the object's ctx and an env with none of\nthe entry's SUBSTRAT_STORE* bindings. The upload sets disallow_importable_env and\ndisable_ctx_exports, and both apply to a Python script: `from workers import env` then reads an\nempty env, and ctx.exports is absent.\n\nWhat this is not: a boundary against a hostile driver, and it is weaker here than in JavaScript.\nPython has no private fields. The driver's module is imported by this one, before this module's\nbody has finished, and runs in the same interpreter: it can reach this module through\nsys.modules and replace its functions, and it can reach the entry's object, its full env and the\nstore namespace in it, through the garbage collector. The env strip and the cached driver keep a\ncareless driver away from the entry's bindings, not a hostile one. A driver written to interfere is\nstopped by the review of its release (D-63), not by this module.\n\"\"\"\n\nfrom workers import DurableObject, Request, Response, WorkerEntrypoint, import_from_javascript\nfrom js import Date, Object\n\nfrom __SUBSTRAT_STORE_DRIVER__ import __SUBSTRAT_STORE_CLASS__ as StoreDriver\n\n# Each of these is a name in store-entry/names.ts; test/python-entry.test.ts holds them equal.\nVERIFIER_MODULE = \"./substrat-store-verify.js\"\nOBJECT_BINDING = \"SUBSTRAT_STORE\"\nRESERVED_BINDING_PREFIX = \"SUBSTRAT_STORE\"\n\n\ndef _raw_env(env):\n    \"\"\"The JavaScript env the runtime handed over. The SDK wraps it, and has no public unwrap.\"\"\"\n    return env._env\n\n\ndef _raw_storage(ctx):\n    \"\"\"The object's JavaScript storage. The SDK wraps ctx and its storage, and has no public unwrap.\"\"\"\n    return ctx._ctx.storage\n\n\ndef _driver_env(env):\n    \"\"\"The env the driver is constructed with: everything but the entry's own bindings.\"\"\"\n    entries = [entry for entry in Object.entries(_raw_env(env)) if not str(entry[0]).startswith(RESERVED_BINDING_PREFIX)]\n    return Object.fromEntries(entries)\n\n\ndef _refusal(verified):\n    \"\"\"The response for a refused call: its status and its plain-text message.\"\"\"\n    return Response(verified.message, status=verified.status)\n\n\nasync def _verified(request, env):\n    \"\"\"The call read once and verified (its envelope and its body as a JavaScript ArrayBuffer), or the refusal.\"\"\"\n    verifier = import_from_javascript(VERIFIER_MODULE)\n    verified = await verifier.verifiedStoreCall(request.js_object, _raw_env(env))\n    return verified if verified.ok else _refusal(verified)\n\n\ndef _driver_request(url, body):\n    return Request(url, method=\"POST\", headers={\"content-type\": \"application/json\"}, body=body)\n\n\nclass SubstratStoreObject(DurableObject):\n    def __init__(self, ctx, env):\n        super().__init__(ctx, env)\n        self._driver = None\n\n    def _driver_object(self):\n        \"\"\"Constructed once per object instance, on first use, so the driver keeps its in-memory state.\"\"\"\n        if self._driver is None:\n            self._driver = StoreDriver(self.ctx, _driver_env(self.env))\n        return self._driver\n\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        if not self.ctx.id.equals(namespace.idFromName(call.envelope.name)):\n            return Response(\"unauthorized: object\", status=401)\n        verifier = import_from_javascript(VERIFIER_MODULE)\n        if not verifier.spendStoreNonce(_raw_storage(self.ctx), call.envelope, int(Date.now() // 1000)):\n            return _refusal(verifier.spentNonce)\n        return await self._driver_object().fetch(_driver_request(request.url, call.body))\n\n    async def alarm(self, alarm_info=None):\n        \"\"\"An alarm is the object's own timer, which only the driver sets. It goes to the driver.\"\"\"\n        driver = self._driver_object()\n        if hasattr(driver, \"alarm\"):\n            await driver.alarm(alarm_info)\n\n\nclass Default(WorkerEntrypoint):\n    async def fetch(self, request):\n        call = await _verified(request, self.env)\n        if isinstance(call, Response):\n            return call\n        namespace = getattr(self.env, OBJECT_BINDING)\n        stub = namespace.get(namespace.idFromName(call.envelope.name))\n        return await stub.fetch(request.url, method=\"POST\", headers=request.js_object.headers, body=call.body)\n";
 /**
  * The verifier the Python entry imports, uploaded beside it as `substrat-store-verify.js`
- * (an ES module). It is `packages/control-plane-api/store-entry/verify.ts`, the check the JavaScript entry runs — 9216 bytes.
+ * (an ES module). It is `packages/control-plane-api/store-entry/verify.ts`, the check the JavaScript entry runs — 11756 bytes.
  */
-export const STORE_ENTRY_PYTHON_VERIFIER_SOURCE = "// packages/contracts/dist/scope-store-envelope.js\nvar SCOPE_STORE_ENVELOPE_WINDOW_SECONDS = 60;\nvar SCOPE_STORE_ENVELOPE_HEADER = \"x-substrat-store-envelope\";\nvar SCOPE_STORE_SIGNATURE_HEADER = \"x-substrat-store-signature\";\nvar RESERVED_STORE_OPERATIONS = [\n  \"substrat.export\",\n  \"substrat.import\",\n  \"substrat.size\",\n  \"substrat.wipe\",\n  \"substrat.erase\"\n];\nvar ADMITTED = {\n  \"1\": {\n    platform: (op) => RESERVED_STORE_OPERATIONS.includes(op),\n    caller: (op) => !op.startsWith(\"substrat.\")\n  }\n};\nfunction scopeStoreEnvelopeAdmits(v, aud, op) {\n  const byAudience = Object.hasOwn(ADMITTED, String(v)) ? ADMITTED[String(v)] : void 0;\n  if (!byAudience || !Object.hasOwn(byAudience, aud))\n    return false;\n  return byAudience[aud](op);\n}\nfunction bytesToBase64Url(bytes) {\n  let binary = \"\";\n  for (const byte of bytes)\n    binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\nfunction base64UrlToBytes(value) {\n  if (!/^[A-Za-z0-9_-]+$/.test(value))\n    return void 0;\n  const padded = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++)\n      bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return void 0;\n  }\n}\nfunction copyBytes(bytes) {\n  const copy = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(copy).set(bytes);\n  return copy;\n}\nfunction isCanonicalBase64Url(text, length) {\n  const bytes = base64UrlToBytes(text);\n  return bytes?.length === length && bytesToBase64Url(bytes) === text;\n}\nvar NONCE = /^[A-Za-z0-9_-]{22}$/;\nvar KID = /^[A-Za-z0-9_-]{11}$/;\nvar DIGEST = /^[0-9a-f]{64}$/;\nvar IAT = /^(0|[1-9]\\d{0,14})$/;\nfunction parseScopeStoreEnvelope(canonical) {\n  const lines = canonical.split(\"\\n\");\n  if (lines.length !== 9)\n    return void 0;\n  const [version, aud, kid, script, name, op, digest, iatText, nonce] = lines;\n  if (version !== \"1\" || aud !== \"caller\" && aud !== \"platform\")\n    return void 0;\n  if (!script || !name || !op)\n    return void 0;\n  if (!KID.test(kid) || !DIGEST.test(digest) || !IAT.test(iatText) || !NONCE.test(nonce))\n    return void 0;\n  if (!isCanonicalBase64Url(kid, 8) || !isCanonicalBase64Url(nonce, 16))\n    return void 0;\n  return { v: 1, aud, kid, script, name, op, digest, iat: Number(iatText), nonce };\n}\nasync function scopeStoreBodyDigest(body) {\n  const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(body));\n  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction scopeStoreEnvelopeFresh(iat, nowSeconds, windowSeconds = SCOPE_STORE_ENVELOPE_WINDOW_SECONDS) {\n  return Math.abs(nowSeconds - iat) <= windowSeconds;\n}\nvar SMALL_ORDER_KEYS = [\n  \"0000000000000000000000000000000000000000000000000000000000000000\",\n  // y = 0, order 4\n  \"0100000000000000000000000000000000000000000000000000000000000000\",\n  // the identity, order 1\n  \"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05\",\n  // order 8\n  \"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a\",\n  // order 8\n  \"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p - 1, order 2\n  \"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p, a non-canonical 0\n  \"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\"\n  // y = p + 1, a non-canonical identity\n];\nfunction isSmallOrderKey(bytes) {\n  const unsigned = Uint8Array.from(bytes);\n  unsigned[31] = unsigned[31] & 127;\n  const hex = [...unsigned].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return SMALL_ORDER_KEYS.includes(hex);\n}\nasync function scopeStoreKeyId(publicKey) {\n  const bytes = base64UrlToBytes(publicKey);\n  if (!bytes || bytes.length !== 32)\n    throw new Error(\"a store public key is not 32 bytes of base64url\");\n  if (isSmallOrderKey(bytes))\n    throw new Error(\"a store public key is a small-order point\");\n  const hash = await crypto.subtle.digest(\"SHA-256\", copyBytes(bytes));\n  return bytesToBase64Url(new Uint8Array(hash).slice(0, 8));\n}\nfunction scopeStorePublicKeyProblem(key) {\n  if (key.length === 0)\n    return \"empty\";\n  const bytes = base64UrlToBytes(key);\n  if (bytes?.length !== 32)\n    return \"length\";\n  if (isSmallOrderKey(bytes))\n    return \"small-order\";\n  if (bytesToBase64Url(bytes) !== key)\n    return \"non-canonical\";\n  return void 0;\n}\nvar PUBLIC_KEY_PROBLEM = {\n  empty: \"a store public key list is empty or has an empty entry\",\n  length: \"a store public key is not 32 bytes of base64url\",\n  \"small-order\": \"a store public key is a small-order point\",\n  \"non-canonical\": \"a store public key is not canonical base64url\"\n};\nfunction parseScopeStorePublicKeys(text) {\n  const keys = text.split(\",\").map((key) => key.trim());\n  if (keys.some((key) => key.length === 0))\n    throw new Error(PUBLIC_KEY_PROBLEM.empty);\n  const seen = /* @__PURE__ */ new Set();\n  for (const key of keys) {\n    const problem = scopeStorePublicKeyProblem(key);\n    if (problem)\n      throw new Error(PUBLIC_KEY_PROBLEM[problem]);\n    if (seen.has(key))\n      throw new Error(\"a store public key is listed twice\");\n    seen.add(key);\n  }\n  return keys;\n}\nfunction scopeStorePublicKeysFrom(config) {\n  const caller = parseScopeStorePublicKeys(config.caller);\n  const platform = parseScopeStorePublicKeys(config.platform);\n  if (caller.some((key) => platform.includes(key))) {\n    throw new Error(\"a store public key is listed for both audiences\");\n  }\n  return { caller, platform };\n}\nasync function verifyScopeStoreEnvelope(publicKey, canonical, signature) {\n  const keyBytes = base64UrlToBytes(publicKey);\n  const sigBytes = base64UrlToBytes(signature);\n  if (!keyBytes || !sigBytes || sigBytes.length !== 64)\n    return false;\n  try {\n    const key = await crypto.subtle.importKey(\"raw\", copyBytes(keyBytes), { name: \"Ed25519\" }, false, [\"verify\"]);\n    return await crypto.subtle.verify(\"Ed25519\", key, copyBytes(sigBytes), new TextEncoder().encode(canonical));\n  } catch {\n    return false;\n  }\n}\nasync function verifyScopeStoreCall(input) {\n  const refuse = (refusal) => ({ ok: false, refusal });\n  if (!input.envelope || !input.signature)\n    return refuse(\"missing\");\n  const bytes = base64UrlToBytes(input.envelope);\n  if (!bytes)\n    return refuse(\"malformed\");\n  let canonical;\n  try {\n    canonical = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n  } catch {\n    return refuse(\"malformed\");\n  }\n  const envelope = parseScopeStoreEnvelope(canonical);\n  if (!envelope)\n    return refuse(\"malformed\");\n  if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op))\n    return refuse(\"audience\");\n  const kidsOf = async (keys) => {\n    const kids = /* @__PURE__ */ new Map();\n    for (const key of keys) {\n      try {\n        kids.set(await scopeStoreKeyId(key), key);\n      } catch {\n      }\n    }\n    return kids;\n  };\n  const own = await kidsOf(input.keys[envelope.aud]);\n  const other = await kidsOf(input.keys[envelope.aud === \"caller\" ? \"platform\" : \"caller\"]);\n  if ([...own.keys()].some((kid) => other.has(kid)))\n    return refuse(\"keys\");\n  const publicKey = own.get(envelope.kid);\n  if (!publicKey)\n    return refuse(\"kid\");\n  if (!await verifyScopeStoreEnvelope(publicKey, canonical, input.signature))\n    return refuse(\"signature\");\n  if (envelope.digest !== await scopeStoreBodyDigest(input.body))\n    return refuse(\"digest\");\n  if (!scopeStoreEnvelopeFresh(envelope.iat, input.nowSeconds, input.windowSeconds))\n    return refuse(\"stale\");\n  if (envelope.script !== input.script)\n    return refuse(\"script\");\n  let parsed;\n  try {\n    parsed = JSON.parse(input.body);\n  } catch {\n    return refuse(\"body\");\n  }\n  const field = (key) => typeof parsed === \"object\" && parsed !== null ? Reflect.get(parsed, key) : void 0;\n  if (field(\"operation\") !== envelope.op || field(\"objectName\") !== envelope.name)\n    return refuse(\"body\");\n  return { ok: true, envelope };\n}\n\n// packages/control-plane-api/store-entry/names.ts\nvar STORE_SCRIPT_VAR = \"SUBSTRAT_STORE_SCRIPT\";\nvar STORE_CALLER_KEYS_VAR = \"SUBSTRAT_STORE_CALLER_KEYS\";\nvar STORE_PLATFORM_KEYS_VAR = \"SUBSTRAT_STORE_PLATFORM_KEYS\";\nvar STORE_CALL_MAX_BODY_BYTES = 4 * 1024 * 1024;\n\n// packages/control-plane-api/store-entry/verify.ts\nasync function storeCallVerdict(headers, body, env) {\n  const script = env[STORE_SCRIPT_VAR];\n  let keys;\n  try {\n    if (typeof script !== \"string\" || script.length === 0) throw new Error(\"no script name\");\n    keys = scopeStorePublicKeysFrom({\n      caller: String(env[STORE_CALLER_KEYS_VAR] ?? \"\"),\n      platform: String(env[STORE_PLATFORM_KEYS_VAR] ?? \"\")\n    });\n  } catch {\n    return { ok: false, status: 503, message: \"this store script is not configured\" };\n  }\n  const verdict = await verifyScopeStoreCall({\n    envelope: headers.get(SCOPE_STORE_ENVELOPE_HEADER),\n    signature: headers.get(SCOPE_STORE_SIGNATURE_HEADER),\n    body,\n    keys,\n    script,\n    nowSeconds: Math.floor(Date.now() / 1e3)\n  });\n  return verdict.ok ? verdict : { ok: false, status: 401, message: `unauthorized: ${verdict.refusal}` };\n}\nexport {\n  storeCallVerdict\n};\n";
+export const STORE_ENTRY_PYTHON_VERIFIER_SOURCE = "// packages/contracts/dist/scope-store-envelope.js\nvar SCOPE_STORE_ENVELOPE_WINDOW_SECONDS = 60;\nvar SCOPE_STORE_ENVELOPE_HEADER = \"x-substrat-store-envelope\";\nvar SCOPE_STORE_SIGNATURE_HEADER = \"x-substrat-store-signature\";\nvar RESERVED_STORE_OPERATIONS = [\n  \"substrat.export-page\",\n  \"substrat.stage-page\",\n  \"substrat.commit-stage\",\n  \"substrat.discard-stage\",\n  \"substrat.size\",\n  \"substrat.wipe\",\n  \"substrat.erase\",\n  \"substrat.selfcheck\"\n];\nvar STORE_STAGE_MAX_AGE_MS = 6 * 36e5 + 3 * 30 * 6e4;\nvar STORE_CALL_MAX_BYTES = 4 * 1024 * 1024;\nvar STORE_DUMP_PAGE_MAX_BYTES = 3 * 1024 * 1024;\nvar ADMITTED = {\n  \"1\": {\n    platform: (op) => RESERVED_STORE_OPERATIONS.includes(op),\n    caller: (op) => !op.startsWith(\"substrat.\")\n  }\n};\nfunction scopeStoreEnvelopeAdmits(v, aud, op) {\n  const byAudience = Object.hasOwn(ADMITTED, String(v)) ? ADMITTED[String(v)] : void 0;\n  if (!byAudience || !Object.hasOwn(byAudience, aud))\n    return false;\n  return byAudience[aud](op);\n}\nfunction bytesToBase64Url(bytes) {\n  let binary = \"\";\n  for (const byte of bytes)\n    binary += String.fromCharCode(byte);\n  return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replaceAll(\"=\", \"\");\n}\nfunction base64UrlToBytes(value) {\n  if (!/^[A-Za-z0-9_-]+$/.test(value))\n    return void 0;\n  const padded = value.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\") + \"=\".repeat((4 - value.length % 4) % 4);\n  try {\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++)\n      bytes[i] = binary.charCodeAt(i);\n    return bytes;\n  } catch {\n    return void 0;\n  }\n}\nfunction copyBytes(bytes) {\n  const copy = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(copy).set(bytes);\n  return copy;\n}\nfunction isCanonicalBase64Url(text, length) {\n  const bytes = base64UrlToBytes(text);\n  return bytes?.length === length && bytesToBase64Url(bytes) === text;\n}\nvar NONCE = /^[A-Za-z0-9_-]{22}$/;\nvar KID = /^[A-Za-z0-9_-]{11}$/;\nvar DIGEST = /^[0-9a-f]{64}$/;\nvar IAT = /^(0|[1-9]\\d{0,14})$/;\nfunction parseScopeStoreEnvelope(canonical) {\n  const lines = canonical.split(\"\\n\");\n  if (lines.length !== 9)\n    return void 0;\n  const [version, aud, kid, script, name, op, digest, iatText, nonce] = lines;\n  if (version !== \"1\" || aud !== \"caller\" && aud !== \"platform\")\n    return void 0;\n  if (!script || !name || !op)\n    return void 0;\n  if (!KID.test(kid) || !DIGEST.test(digest) || !IAT.test(iatText) || !NONCE.test(nonce))\n    return void 0;\n  if (!isCanonicalBase64Url(kid, 8) || !isCanonicalBase64Url(nonce, 16))\n    return void 0;\n  return { v: 1, aud, kid, script, name, op, digest, iat: Number(iatText), nonce };\n}\nasync function scopeStoreBodyDigest(body) {\n  const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(body));\n  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\nfunction scopeStoreEnvelopeFresh(iat, nowSeconds, windowSeconds = SCOPE_STORE_ENVELOPE_WINDOW_SECONDS) {\n  return Math.abs(nowSeconds - iat) <= windowSeconds;\n}\nvar SMALL_ORDER_KEYS = [\n  \"0000000000000000000000000000000000000000000000000000000000000000\",\n  // y = 0, order 4\n  \"0100000000000000000000000000000000000000000000000000000000000000\",\n  // the identity, order 1\n  \"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05\",\n  // order 8\n  \"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a\",\n  // order 8\n  \"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p - 1, order 2\n  \"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\",\n  // y = p, a non-canonical 0\n  \"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f\"\n  // y = p + 1, a non-canonical identity\n];\nfunction isSmallOrderKey(bytes) {\n  const unsigned = Uint8Array.from(bytes);\n  unsigned[31] = unsigned[31] & 127;\n  const hex = [...unsigned].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return SMALL_ORDER_KEYS.includes(hex);\n}\nasync function scopeStoreKeyId(publicKey) {\n  const bytes = base64UrlToBytes(publicKey);\n  if (!bytes || bytes.length !== 32)\n    throw new Error(\"a store public key is not 32 bytes of base64url\");\n  if (isSmallOrderKey(bytes))\n    throw new Error(\"a store public key is a small-order point\");\n  const hash = await crypto.subtle.digest(\"SHA-256\", copyBytes(bytes));\n  return bytesToBase64Url(new Uint8Array(hash).slice(0, 8));\n}\nfunction scopeStorePublicKeyProblem(key) {\n  if (key.length === 0)\n    return \"empty\";\n  const bytes = base64UrlToBytes(key);\n  if (bytes?.length !== 32)\n    return \"length\";\n  if (isSmallOrderKey(bytes))\n    return \"small-order\";\n  if (bytesToBase64Url(bytes) !== key)\n    return \"non-canonical\";\n  return void 0;\n}\nvar PUBLIC_KEY_PROBLEM = {\n  empty: \"a store public key list is empty or has an empty entry\",\n  length: \"a store public key is not 32 bytes of base64url\",\n  \"small-order\": \"a store public key is a small-order point\",\n  \"non-canonical\": \"a store public key is not canonical base64url\"\n};\nfunction parseScopeStorePublicKeys(text) {\n  const keys = text.split(\",\").map((key) => key.trim());\n  if (keys.some((key) => key.length === 0))\n    throw new Error(PUBLIC_KEY_PROBLEM.empty);\n  const seen = /* @__PURE__ */ new Set();\n  for (const key of keys) {\n    const problem = scopeStorePublicKeyProblem(key);\n    if (problem)\n      throw new Error(PUBLIC_KEY_PROBLEM[problem]);\n    if (seen.has(key))\n      throw new Error(\"a store public key is listed twice\");\n    seen.add(key);\n  }\n  return keys;\n}\nfunction scopeStorePublicKeysFrom(config) {\n  const caller = parseScopeStorePublicKeys(config.caller);\n  const platform = parseScopeStorePublicKeys(config.platform);\n  if (caller.some((key) => platform.includes(key))) {\n    throw new Error(\"a store public key is listed for both audiences\");\n  }\n  return { caller, platform };\n}\nasync function verifyScopeStoreEnvelope(publicKey, canonical, signature) {\n  const keyBytes = base64UrlToBytes(publicKey);\n  const sigBytes = base64UrlToBytes(signature);\n  if (!keyBytes || !sigBytes || sigBytes.length !== 64)\n    return false;\n  try {\n    const key = await crypto.subtle.importKey(\"raw\", copyBytes(keyBytes), { name: \"Ed25519\" }, false, [\"verify\"]);\n    return await crypto.subtle.verify(\"Ed25519\", key, copyBytes(sigBytes), new TextEncoder().encode(canonical));\n  } catch {\n    return false;\n  }\n}\nasync function verifyScopeStoreCall(input) {\n  const refuse = (refusal) => ({ ok: false, refusal });\n  if (!input.envelope || !input.signature)\n    return refuse(\"missing\");\n  const bytes = base64UrlToBytes(input.envelope);\n  if (!bytes)\n    return refuse(\"malformed\");\n  let canonical;\n  try {\n    canonical = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n  } catch {\n    return refuse(\"malformed\");\n  }\n  const envelope = parseScopeStoreEnvelope(canonical);\n  if (!envelope)\n    return refuse(\"malformed\");\n  if (!scopeStoreEnvelopeAdmits(envelope.v, envelope.aud, envelope.op))\n    return refuse(\"audience\");\n  const kidsOf = async (keys) => {\n    const kids = /* @__PURE__ */ new Map();\n    for (const key of keys) {\n      try {\n        kids.set(await scopeStoreKeyId(key), key);\n      } catch {\n      }\n    }\n    return kids;\n  };\n  const own = await kidsOf(input.keys[envelope.aud]);\n  const other = await kidsOf(input.keys[envelope.aud === \"caller\" ? \"platform\" : \"caller\"]);\n  if ([...own.keys()].some((kid) => other.has(kid)))\n    return refuse(\"keys\");\n  const publicKey = own.get(envelope.kid);\n  if (!publicKey)\n    return refuse(\"kid\");\n  if (!await verifyScopeStoreEnvelope(publicKey, canonical, input.signature))\n    return refuse(\"signature\");\n  if (envelope.digest !== await scopeStoreBodyDigest(input.body))\n    return refuse(\"digest\");\n  if (!scopeStoreEnvelopeFresh(envelope.iat, input.nowSeconds, input.windowSeconds))\n    return refuse(\"stale\");\n  if (envelope.script !== input.script)\n    return refuse(\"script\");\n  let parsed;\n  try {\n    parsed = JSON.parse(input.body);\n  } catch {\n    return refuse(\"body\");\n  }\n  const field = (key) => typeof parsed === \"object\" && parsed !== null ? Reflect.get(parsed, key) : void 0;\n  if (field(\"operation\") !== envelope.op || field(\"objectName\") !== envelope.name)\n    return refuse(\"body\");\n  return { ok: true, envelope };\n}\n\n// packages/control-plane-api/store-entry/names.ts\nvar STORE_SCRIPT_VAR = \"SUBSTRAT_STORE_SCRIPT\";\nvar STORE_CALLER_KEYS_VAR = \"SUBSTRAT_STORE_CALLER_KEYS\";\nvar STORE_PLATFORM_KEYS_VAR = \"SUBSTRAT_STORE_PLATFORM_KEYS\";\n\n// packages/control-plane-api/store-entry/verify.ts\nvar tooLarge = { ok: false, status: 413, message: `payload too large: at most ${STORE_CALL_MAX_BYTES} bytes` };\nfunction storeCallDeclaredRefusal(headers) {\n  const declared = headers.get(\"content-length\");\n  return declared !== null && /^\\d+$/.test(declared.trim()) && Number(declared) > STORE_CALL_MAX_BYTES ? tooLarge : void 0;\n}\nasync function boundedBody(body) {\n  if (!body) return new Uint8Array(0);\n  const reader = body.getReader();\n  const chunks = [];\n  let total = 0;\n  for (; ; ) {\n    const { done, value } = await reader.read();\n    if (done || !value) break;\n    total += value.byteLength;\n    if (total > STORE_CALL_MAX_BYTES) {\n      await reader.cancel().catch(() => void 0);\n      return tooLarge;\n    }\n    chunks.push(value);\n  }\n  const bytes = new Uint8Array(total);\n  let at = 0;\n  for (const chunk of chunks) {\n    bytes.set(chunk, at);\n    at += chunk.byteLength;\n  }\n  return bytes;\n}\nasync function verifiedStoreCall(request, env) {\n  const declared = storeCallDeclaredRefusal(request.headers);\n  if (declared) return declared;\n  const bytes = await boundedBody(request.body);\n  if (!(bytes instanceof Uint8Array)) return bytes;\n  let text;\n  try {\n    text = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true }).decode(bytes);\n  } catch {\n    return { ok: false, status: 401, message: \"unauthorized: digest\" };\n  }\n  const verdict = await storeCallVerdict(request.headers, text, env);\n  return verdict.ok ? { ok: true, envelope: verdict.envelope, body: bytes.buffer } : verdict;\n}\nvar STORE_NONCE_KEY_PREFIX = \"substrat.store-nonce/\";\nvar STORE_NONCE_PRUNE_BATCH = 64;\nvar nonceKey = (iat) => `${STORE_NONCE_KEY_PREFIX}${String(iat).padStart(15, \"0\")}/`;\nfunction spendStoreNonce(storage, envelope, nowSeconds) {\n  const { kv } = storage;\n  const expired = nonceKey(nowSeconds - SCOPE_STORE_ENVELOPE_WINDOW_SECONDS);\n  for (const [key2] of kv.list({ prefix: STORE_NONCE_KEY_PREFIX, end: expired, limit: STORE_NONCE_PRUNE_BATCH })) kv.delete(key2);\n  if (!scopeStoreEnvelopeFresh(envelope.iat, nowSeconds)) return false;\n  const key = `${nonceKey(envelope.iat)}${envelope.nonce}`;\n  if (kv.get(key) !== void 0) return false;\n  kv.put(key, 1);\n  return true;\n}\nvar spentNonce = { ok: false, status: 401, message: \"unauthorized: nonce\" };\nasync function storeCallVerdict(headers, body, env) {\n  const script = env[STORE_SCRIPT_VAR];\n  let keys;\n  try {\n    if (typeof script !== \"string\" || script.length === 0) throw new Error(\"no script name\");\n    keys = scopeStorePublicKeysFrom({\n      caller: String(env[STORE_CALLER_KEYS_VAR] ?? \"\"),\n      platform: String(env[STORE_PLATFORM_KEYS_VAR] ?? \"\")\n    });\n  } catch {\n    return { ok: false, status: 503, message: \"this store script is not configured\" };\n  }\n  const verdict = await verifyScopeStoreCall({\n    envelope: headers.get(SCOPE_STORE_ENVELOPE_HEADER),\n    signature: headers.get(SCOPE_STORE_SIGNATURE_HEADER),\n    body,\n    keys,\n    script,\n    nowSeconds: Math.floor(Date.now() / 1e3)\n  });\n  return verdict.ok ? verdict : { ok: false, status: 401, message: `unauthorized: ${verdict.refusal}` };\n}\nexport {\n  spendStoreNonce,\n  spentNonce,\n  storeCallDeclaredRefusal,\n  storeCallVerdict,\n  verifiedStoreCall\n};\n";
 //# sourceMappingURL=store-entry.generated.js.map