@tensorix/metahub 0.3.2 → 0.4.0

package/dist/core/sync/storage-s3-bun.d.ts

@@ -1,33 +1,10 @@
 import { type S3Config } from "./storage.ts";
-/** SigV4 presigned GET cap: 7 days (604800s) is the protocol maximum. */
-export declare const MAX_PRESIGN_SECONDS = 604800;
-/**
- * Build a presigned GET URL for one object (used by the object-storage share
- * path — the recipient fetches the ciphertext directly from the bucket, no
- * credential in the link). Addressing mirrors corsEndpoint (virtual-hosted vs
- * path-style). `expiresSec` is clamped to the 7-day SigV4 maximum.
- */
-export declare function presignGet(config: S3Config, key: string, expiresSec: number): Promise<string>;
-/** Read the bucket's current CORS config (raw XML), or null if none is set. */
-export declare function getBucketCors(config: S3Config): Promise<string | null>;
-/**
- * Build the PutBucketCors XML body from the bucket's current config. PutBucketCors
- * replaces the whole config, so we keep every rule that isn't ours and re-emit our
- * managed rule (id=metahub-pwa). `merge` decides our rule's origins:
- *  - false (CLI `peer cors`): SET — exactly `origins` (lets the user shrink/reset).
- *  - true  (auto-open on bucket-attach): UNION with the managed rule's existing
- *    origins, so attaching the same bucket from a second shell/origin (a homelab
- *    server origin alongside the official PWA shell) adds to the allow-list
- *    instead of clobbering it.
- * A wildcard `*` collapses the set. Pure (no I/O) so it's unit-testable.
- */
-export declare function buildCorsXml(existing: string | null, origins: string[], merge: boolean): string;
 /**
  * Allow a browser shell served from `origins` to talk to the bucket directly
  * (GET/PUT/HEAD/DELETE) via GET-merge-PUT (see buildCorsXml). `opts.merge` unions
  * with existing managed origins instead of replacing them — used when a second
  * origin attaches the same bucket. Content-MD5 is required by the CORS API
- * (S3 and COS both).
+ * (S3 and COS both) — the reason this one operation is Bun-only.
  */
 export declare function putBucketCors(config: S3Config, origins: string[], opts?: {
     merge?: boolean;

package/dist/core/sync/storage-s3-bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage-s3-bun.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage-s3-bun.ts"],"names":[],"mappings":"AAUA,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AAiHtB,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAanG;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAoB/F;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"storage-s3-bun.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage-s3-bun.ts"],"names":[],"mappings":"AAgBA,OAAO,EAOL,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AA8FtB;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7B,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/core/sync/storage-s3-sign.d.ts

@@ -0,0 +1,43 @@
+import { AwsClient } from "aws4fetch";
+import { type S3Config } from "./storage.ts";
+/** THE aws4fetch signer for this config — one construction shared by the CAS
+ *  put, the CORS bootstrap and presignGet, so a signer-config fix can't land in
+ *  one call site and 403 the others. */
+export declare function awsSigner(config: S3Config): AwsClient;
+/** Bucket-level base URL: virtual-hosted has the bucket in the host already
+ *  (COS), path-style puts it in the path (R2/MinIO/S3). */
+export declare function bucketBase(config: S3Config): string;
+/** Object URL for one key. Each segment is encoded but the slashes are kept;
+ *  aws4fetch decodes then canonically re-encodes for the signature, so a valid
+ *  URL round-trips. One definition, so the signed URL and the fetched URL can't
+ *  drift apart across runtimes. */
+export declare function objectUrlOf(config: S3Config, key: string): string;
+export declare const MANAGED_CORS_RULE_ID = "metahub-pwa";
+export declare function corsEndpoint(config: S3Config): {
+    aws: AwsClient;
+    url: string;
+};
+/** SigV4 presigned GET cap: 7 days (604800s) is the protocol maximum. */
+export declare const MAX_PRESIGN_SECONDS = 604800;
+/**
+ * Build a presigned GET URL for one object (used by the object-storage share
+ * path — the recipient fetches the ciphertext directly from the bucket, no
+ * credential in the link). Addressing mirrors corsEndpoint (virtual-hosted vs
+ * path-style). `expiresSec` is clamped to the 7-day SigV4 maximum.
+ */
+export declare function presignGet(config: S3Config, key: string, expiresSec: number): Promise<string>;
+/** Read the bucket's current CORS config (raw XML), or null if none is set. */
+export declare function getBucketCors(config: S3Config): Promise<string | null>;
+/**
+ * Build the PutBucketCors XML body from the bucket's current config. PutBucketCors
+ * replaces the whole config, so we keep every rule that isn't ours and re-emit our
+ * managed rule (id=metahub-pwa). `merge` decides our rule's origins:
+ *  - false (CLI `peer cors`): SET — exactly `origins` (lets the user shrink/reset).
+ *  - true  (auto-open on bucket-attach): UNION with the managed rule's existing
+ *    origins, so attaching the same bucket from a second shell/origin (a homelab
+ *    server origin alongside the official PWA shell) adds to the allow-list
+ *    instead of clobbering it.
+ * A wildcard `*` collapses the set. Pure (no I/O) so it's unit-testable.
+ */
+export declare function buildCorsXml(existing: string | null, origins: string[], merge: boolean): string;
+//# sourceMappingURL=storage-s3-sign.d.ts.map

package/dist/core/sync/storage-s3-sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-s3-sign.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage-s3-sign.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEnE;;wCAEwC;AACxC,wBAAgB,SAAS,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAOrD;AAED;2DAC2D;AAC3D,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,MAAM,CAGnD;AAED;;;mCAGmC;AACnC,wBAAgB,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjE;AAWD,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,GAAG;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAE9E;AA6BD,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMnG;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAoB/F"}

package/dist/core/sync/storage.d.ts

@@ -1,5 +1,6 @@
 import type { DbDriver } from "../driver.ts";
 import type { SyncResult } from "./client.ts";
+import { type KeyEnvelope } from "./e2ee.ts";
 /** An 's3' peer's bucket settings, stored as JSON in peers.config (local-only). */
 export interface S3Config {
     endpoint: string;
@@ -48,6 +49,12 @@ export interface StoragePutOpts {
      *  compare-and-set so two devices initializing the same empty bucket can't
      *  clobber each other's master key. */
     ifNoneMatch?: boolean;
+    /** Conditional overwrite (S3 `If-Match: <etag>`): fail with MhError("conflict")
+     *  if the object's current ETag differs from this one — a compare-and-set for
+     *  read-modify-write updates (drop-key rotation) so a concurrent writer can't
+     *  silently clobber the loser's freshly-appended key. Both real clients honor
+     *  it; a mock that ignores it simply performs an unconditional put. */
+    ifMatch?: string;
 }
 /** The minimal object-store surface storage-sync needs. Implemented per runtime:
  *  Bun.S3Client on the CLI/desktop (storage-s3-bun.ts), aws4fetch SigV4 + fetch
@@ -67,6 +74,26 @@ type StorageClientFactory = (config: S3Config) => StorageClient;
 /** Register this runtime's S3 client builder (see the per-runtime impls). */
 export declare function setStorageClientFactory(f: StorageClientFactory): void;
 export declare function storageClientFor(config: S3Config): StorageClient;
+/** Open a bucket's CORS for browser origins (PutBucketCors). Same runtime-adapter
+ *  shape as the client factory, but unlike list/get/put/del this one has NO
+ *  browser implementation and never will: PutBucketCors needs a Content-MD5 that
+ *  WebCrypto can't produce, and the call would itself be a cross-origin request
+ *  the bucket hasn't whitelisted yet. So a device holding the credentials opens
+ *  CORS on the browser's behalf (see storage-s3-bun.ts). */
+export type BucketCorsAdmin = (config: S3Config, origins: string[], opts?: {
+    merge?: boolean;
+}) => Promise<void>;
+export declare function setBucketCorsAdmin(f: BucketCorsAdmin): void;
+/** null on runtimes that structurally can't do this (the browser replica) —
+ *  callers report that honestly instead of pretending CORS was opened. */
+export declare function bucketCorsAdmin(): BucketCorsAdmin | null;
+/** The bucket's normalized namespace root for a configured prefix — exported so
+ *  sibling namespaces (drop keys, publisher lease) key off the same layout. */
+export declare function storageBasePrefix(prefix: string): string;
+/** Object key of the write-inbox recipient keyring (drop-keys.ts): the wrapped
+ *  P-256 private keys live next to keys/main.json, bucket-authoritative so any
+ *  elected device can decrypt inbox envelopes. */
+export declare function dropKeysObjectKey(prefix: string): string;
 /** Upload a blob's bytes to the bucket (idempotent via If-None-Match). Returns
  *  true when actually written, false when the object already existed. */
 export declare function putBucketBlob(config: S3Config, hash: string, bytes: Uint8Array): Promise<boolean>;
@@ -78,6 +105,12 @@ export declare function putBucketBlob(config: S3Config, hash: string, bytes: Uin
 export declare function listBucketBlobHashes(config: S3Config): Promise<Set<string>>;
 /** Fetch a blob's bytes from the bucket, or null if absent. */
 export declare function getBucketBlob(config: S3Config, hash: string): Promise<Uint8Array | null>;
+/** Discover the node prefixes under oplog/. Asks for a delimited (one-level)
+ *  listing so a backend that honors it returns just the "<node>/" folders
+ *  instead of every segment; nodesFromKeys derives the same node set whether the
+ *  backend collapsed them or returned full keys. Exported for the device roster
+ *  (sync/devices.ts refreshBucketPresence). */
+export declare function listRemoteNodes(client: StorageClient, base: string): Promise<string[]>;
 /**
  * Resolve the master key for a bucket at setup: read keys/main.json and unwrap
  * with the passphrase, or — when absent — generate a key, wrap it, and upload
@@ -86,6 +119,32 @@ export declare function getBucketBlob(config: S3Config, hash: string): Promise<U
  * Wrong passphrase throws `auth` (from unwrapMasterKey).
  */
 export declare function provisionMasterKey(client: StorageClient, config: S3Config, passphrase: string): Promise<string | null>;
+/** Current ETag of one object via a targeted list, or null when absent / the
+ *  client doesn't surface etags (callers then forgo CAS). */
+export declare function objectEtag(client: StorageClient, key: string): Promise<string | null>;
+/** The bucket's wrapped-master-key envelope, or null when absent. Read-only —
+ *  unlike provisionMasterKey this never creates one (rotate flows must not
+ *  mint a fresh K that mismatches existing ciphertext). */
+export declare function readMasterKeyEnvelope(client: StorageClient, config: S3Config): Promise<KeyEnvelope | null>;
+/**
+ * Prove `rawKey` is THIS bucket's master key by decrypting a small existing
+ * ciphertext object (a snapshot's .vc sidecar, else any segment, else a
+ * snapshot body) — the GCM tag makes success a cryptographic verdict. Returns
+ * "no_ciphertext" for a bucket holding no encrypted objects yet (fresh/empty);
+ * callers proceed with a warning. Throws MhError("auth") on a mismatch — the
+ * guard that keeps a *valid key for the wrong bucket* (recovery-code mixups)
+ * from rewrapping this bucket's envelope and bricking future joins.
+ */
+export declare function verifyMasterKey(client: StorageClient, config: S3Config, rawKey: Uint8Array): Promise<"verified" | "no_ciphertext">;
+/**
+ * Rewrap keys/main.json under a NEW passphrase, keeping K unchanged — all
+ * ciphertext and every device's cached K stay valid; only devices joining
+ * later need the new passphrase. Compare-and-set: If-Match on the current
+ * envelope's ETag (If-None-Match create when absent — which also restores a
+ * deleted envelope). Throws "conflict" when a concurrent rewrap won; callers
+ * retry against the winner (idempotent — same K).
+ */
+export declare function rewrapMasterKey(client: StorageClient, config: S3Config, rawKey: Uint8Array, newPassphrase: string): Promise<void>;
 /**
  * Publish a winners-only snapshot and truncate this node's own segments. Every
  * op we've uploaded so far is in the local oplog now, so the snapshot (winners

package/dist/core/sync/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAc9C,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;oEAEoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAO9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2CAGuC;IACvC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;gEAEgE;AAChE,MAAM,WAAW,aAAa;IAC5B;;;;wBAIoB;IACpB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,aAAa,CAAC;AAGhE,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAErE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAIhE;AAmGD;yEACyE;AACzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;6BAI6B;AAC7B,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAUjF;AAED,+DAA+D;AAC/D,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM9F;AA8ID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,cAAc,GAAE,MAAgC,GAC/C,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkDlD;AAID,MAAM,WAAW,eAAe;IAC9B;;+EAE2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;yBAGqB;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;+EAU2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;wEAIoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;8FAC0F;IAC1F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;yEACqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAwBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAiIrB"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/core/sync/storage.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAK7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAQnB,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;oEAEoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAO9D;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;2CAGuC;IACvC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;2EAIuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;gEAEgE;AAChE,MAAM,WAAW,aAAa;IAC5B;;;;wBAIoB;IACpB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,aAAa,CAAC;AAGhE,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAErE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAIhE;AAED;;;;;4DAK4D;AAC5D,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,KACvB,OAAO,CAAC,IAAI,CAAC,CAAC;AAGnB,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,eAAe,GAAG,IAAI,CAE3D;AAED;0EAC0E;AAC1E,wBAAgB,eAAe,IAAI,eAAe,GAAG,IAAI,CAExD;AAwCD;+EAC+E;AAC/E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;kDAEkD;AAClD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AA6DD;yEACyE;AACzE,wBAAsB,aAAa,CACjC,MAAM,EAAE,QAAQ,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;6BAI6B;AAC7B,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAUjF;AAED,+DAA+D;AAC/D,wBAAsB,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAM9F;AAoID;;;;+CAI+C;AAC/C,wBAAsB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG5F;AAID;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAED;6DAC6D;AAC7D,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG3F;AAED;;2DAE2D;AAC3D,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,GACf,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAQ7B;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,GAAG,eAAe,CAAC,CAuBvC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAWf;AAID;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,cAAc,GAAE,MAAgC,GAC/C,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAoDlD;AAID,MAAM,WAAW,eAAe;IAC9B;;+EAE2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;yBAGqB;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;mEAC+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;+EAC2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;+EAU2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;wEAIoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;8FAC0F;IAC1F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;yEACqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAwBD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,QAAQ,EAChB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,UAAU,CAAC,CAkIrB"}