@weaveprotocol/core 0.1.0

package/dist/privacy/key-distribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-distribution.js","sourceRoot":"","sources":["../../src/privacy/key-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAoBxE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAmB,EACnB,kBAA6B,EAC7B,YAAoB;IAEpB,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAC9D,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,IAAI,EACJ,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAC5C,aAAa,CAAC,UAAU,EACxB,GAAG,CACJ,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,YAAY,EACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC7D,KAAK,EACL,QAAQ,EACR,GAAG,EACH,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAE9F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,kBAAkB,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QACjE,cAAc,EAAE,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAmB,EACnB,mBAA8B;IAE9B,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACjE,KAAK,EACL,YAA4B,EAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EACrC,IAAI,EACJ,EAAE,CACH,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5D,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAC5C,mBAAmB,EACnB,GAAG,CACJ,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,YAAY,EACZ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE/D,OAAO,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,cAA8B,EAC9B,GAAG,EACH,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAmB,EACnB,gBAAgD;IAEhD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAC7C,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CACrD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/privacy/privacy-guard.d.ts

@@ -0,0 +1,24 @@
+import type { Expression, Space } from '../types.js';
+import { type SpaceKey, type EncryptedExpression } from './space-encryption.js';
+import { type WrappedKey } from './key-distribution.js';
+/**
+ * Orchestrator for transparent encryption and decryption of expressions within spaces.
+ */
+export interface PrivacyGuard {
+    addSpace(space: Space, spaceKey?: SpaceKey): void;
+    isPrivateSpace(spaceId: string): boolean;
+    encryptForSpace(spaceId: string, expression: Expression): Promise<EncryptedExpression | Expression>;
+    decryptFromSpace(spaceId: string, encrypted: EncryptedExpression | Expression): Promise<Expression>;
+    setSpaceKey(spaceId: string, key: SpaceKey): void;
+    rotateSpaceKey(spaceId: string): Promise<SpaceKey>;
+    getSpaceKey(spaceId: string): SpaceKey | undefined;
+    wrapKeyForMember(spaceId: string, memberPublicKey: CryptoKey, memberDid: string): Promise<WrappedKey>;
+    unwrapKeyFromMember(wrapped: WrappedKey, privateKey: CryptoKey): Promise<SpaceKey>;
+}
+/**
+ * Creates a new PrivacyGuard orchestrator.
+ *
+ * @returns {PrivacyGuard} A new PrivacyGuard instance.
+ */
+export declare function createPrivacyGuard(): PrivacyGuard;
+//# sourceMappingURL=privacy-guard.d.ts.map

package/dist/privacy/privacy-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-guard.d.ts","sourceRoot":"","sources":["../../src/privacy/privacy-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAIzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,UAAU,EAGhB,MAAM,uBAAuB,CAAC;AAI/B;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC;IAClD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,GAAG,UAAU,CAAC,CAAC;IACpG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IAClD,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnD,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtG,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACpF;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CA0FjD"}

package/dist/privacy/privacy-guard.js

@@ -0,0 +1,87 @@
+import { generateSpaceKey, encryptExpression, decryptExpression } from './space-encryption.js';
+import { wrapSpaceKey, unwrapSpaceKey } from './key-distribution.js';
+import { base64UrlEncode } from '../utils/encoding.js';
+import { sha256 } from '../utils/hash.js';
+/**
+ * Creates a new PrivacyGuard orchestrator.
+ *
+ * @returns {PrivacyGuard} A new PrivacyGuard instance.
+ */
+export function createPrivacyGuard() {
+    const spaces = new Map();
+    return {
+        addSpace(space, spaceKey) {
+            spaces.set(space.id, { space, spaceKey });
+        },
+        isPrivateSpace(spaceId) {
+            const entry = spaces.get(spaceId);
+            return entry !== undefined && entry.space.encryptionKeyId !== undefined;
+        },
+        async encryptForSpace(spaceId, expression) {
+            const entry = spaces.get(spaceId);
+            if (!entry)
+                throw new Error(`Space ${spaceId} not found`);
+            if (!this.isPrivateSpace(spaceId)) {
+                return expression;
+            }
+            if (!entry.spaceKey) {
+                throw new Error(`Space key not available for space ${spaceId}`);
+            }
+            return encryptExpression(expression, entry.spaceKey);
+        },
+        async decryptFromSpace(spaceId, encrypted) {
+            const entry = spaces.get(spaceId);
+            if (!entry)
+                throw new Error(`Space ${spaceId} not found`);
+            if (!this.isPrivateSpace(spaceId) || !('ciphertext' in encrypted.body)) {
+                return encrypted;
+            }
+            if (!entry.spaceKey) {
+                throw new Error(`Space key not available for space ${spaceId}`);
+            }
+            return decryptExpression(encrypted, entry.spaceKey);
+        },
+        setSpaceKey(spaceId, key) {
+            const entry = spaces.get(spaceId);
+            if (!entry)
+                throw new Error(`Space ${spaceId} not found`);
+            entry.spaceKey = key;
+        },
+        async rotateSpaceKey(spaceId) {
+            const entry = spaces.get(spaceId);
+            if (!entry)
+                throw new Error(`Space ${spaceId} not found`);
+            const newKey = await generateSpaceKey();
+            const version = (entry.spaceKey?.version ?? 0) + 1;
+            const rotatedKey = Object.freeze({
+                ...newKey,
+                version
+            });
+            entry.spaceKey = rotatedKey;
+            return rotatedKey;
+        },
+        getSpaceKey(spaceId) {
+            return spaces.get(spaceId)?.spaceKey;
+        },
+        async wrapKeyForMember(spaceId, memberPublicKey, memberDid) {
+            const spaceKey = this.getSpaceKey(spaceId);
+            if (!spaceKey) {
+                throw new Error(`Space key not found for space ${spaceId}`);
+            }
+            return wrapSpaceKey(spaceKey.key, memberPublicKey, memberDid);
+        },
+        async unwrapKeyFromMember(wrapped, privateKey) {
+            const unwrappedCryptoKey = await unwrapSpaceKey(wrapped, privateKey);
+            // Derive a consistent ID based on the raw key data
+            const raw = await globalThis.crypto.subtle.exportKey('raw', unwrappedCryptoKey);
+            const id = base64UrlEncode(new Uint8Array(await sha256(new Uint8Array(raw))));
+            return Object.freeze({
+                id,
+                key: unwrappedCryptoKey,
+                createdAt: new Date().toISOString(),
+                version: 1 // Defaulting to 1 as versioning would normally be distributed alongside the wrapped key
+            });
+        }
+    };
+}
+//# sourceMappingURL=privacy-guard.js.map

package/dist/privacy/privacy-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-guard.js","sourceRoot":"","sources":["../../src/privacy/privacy-guard.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,YAAY,EACZ,cAAc,EACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAsB1C;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE7C,OAAO;QACL,QAAQ,CAAC,KAAY,EAAE,QAAmB;YACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,cAAc,CAAC,OAAe;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,UAAsB;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAE1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;YACpB,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,SAA2C;YACjF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAE1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,IAAK,SAAS,CAAC,IAAY,CAAC,EAAE,CAAC;gBAChF,OAAO,SAAuB,CAAC;YACjC,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,iBAAiB,CAAC,SAAgC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7E,CAAC;QAED,WAAW,CAAC,OAAe,EAAE,GAAa;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAC1D,KAAK,CAAC,QAAQ,GAAG,GAAG,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,OAAe;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,OAAO,YAAY,CAAC,CAAC;YAE1D,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC/B,GAAG,MAAM;gBACT,OAAO;aACR,CAAC,CAAC;YACH,KAAK,CAAC,QAAQ,GAAG,UAAU,CAAC;YAC5B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,WAAW,CAAC,OAAe;YACzB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,eAA0B,EAAE,SAAiB;YACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,OAAmB,EAAE,UAAqB;YAClE,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAErE,mDAAmD;YACnD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAChF,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAE9E,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,EAAE;gBACF,GAAG,EAAE,kBAAkB;gBACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,OAAO,EAAE,CAAC,CAAC,wFAAwF;aACpG,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/privacy/space-encryption.d.ts

@@ -0,0 +1,48 @@
+import type { Expression } from '../types.js';
+/**
+ * Represents a key used to encrypt a Space.
+ */
+export interface SpaceKey {
+    readonly id: string;
+    readonly key: CryptoKey;
+    readonly createdAt: string;
+    readonly version: number;
+}
+/**
+ * The body of an expression after it has been encrypted.
+ */
+export interface EncryptedExpressionBody {
+    readonly ciphertext: string;
+    readonly iv: string;
+    readonly keyId: string;
+}
+/**
+ * An expression whose body has been encrypted.
+ */
+export type EncryptedExpression = Omit<Expression, 'body'> & {
+    readonly body: EncryptedExpressionBody;
+};
+/**
+ * Generates a new random AES-GCM-256 key for a Space.
+ *
+ * @returns {Promise<SpaceKey>} A promise resolving to a new SpaceKey.
+ */
+export declare function generateSpaceKey(): Promise<SpaceKey>;
+/**
+ * Encrypts an expression's body using AES-GCM.
+ *
+ * @param {Expression} expression - The expression to encrypt.
+ * @param {SpaceKey} spaceKey - The key to use for encryption.
+ * @returns {Promise<EncryptedExpression>} A promise resolving to the encrypted expression.
+ */
+export declare function encryptExpression(expression: Expression, spaceKey: SpaceKey): Promise<EncryptedExpression>;
+/**
+ * Decrypts an encrypted expression's body using AES-GCM.
+ *
+ * @param {EncryptedExpression} encrypted - The encrypted expression.
+ * @param {SpaceKey} spaceKey - The key to use for decryption.
+ * @returns {Promise<Expression>} A promise resolving to the decrypted expression.
+ * @throws {Error} If the key ID doesn't match the space key's ID.
+ */
+export declare function decryptExpression(encrypted: EncryptedExpression, spaceKey: SpaceKey): Promise<Expression>;
+//# sourceMappingURL=space-encryption.d.ts.map

package/dist/privacy/space-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-encryption.d.ts","sourceRoot":"","sources":["../../src/privacy/space-encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI9C;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG;IAC3D,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;CACxC,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,QAAQ,CAAC,CAe1D;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBhH;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAoB/G"}

package/dist/privacy/space-encryption.js

@@ -0,0 +1,61 @@
+import { base64UrlEncode, base64UrlDecode, utf8Encode, utf8Decode } from '../utils/encoding.js';
+import { sha256 } from '../utils/hash.js';
+/**
+ * Generates a new random AES-GCM-256 key for a Space.
+ *
+ * @returns {Promise<SpaceKey>} A promise resolving to a new SpaceKey.
+ */
+export async function generateSpaceKey() {
+    const key = await globalThis.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const raw = await globalThis.crypto.subtle.exportKey('raw', key);
+    const id = base64UrlEncode(new Uint8Array(await sha256(new Uint8Array(raw))));
+    return Object.freeze({
+        id,
+        key,
+        createdAt: new Date().toISOString(),
+        version: 1
+    });
+}
+/**
+ * Encrypts an expression's body using AES-GCM.
+ *
+ * @param {Expression} expression - The expression to encrypt.
+ * @param {SpaceKey} spaceKey - The key to use for encryption.
+ * @returns {Promise<EncryptedExpression>} A promise resolving to the encrypted expression.
+ */
+export async function encryptExpression(expression, spaceKey) {
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const encodedBody = utf8Encode(JSON.stringify(expression.body));
+    const ciphertextBuffer = await globalThis.crypto.subtle.encrypt({ name: 'AES-GCM', iv }, spaceKey.key, encodedBody);
+    const ciphertext = base64UrlEncode(new Uint8Array(ciphertextBuffer));
+    return Object.freeze({
+        ...expression,
+        body: Object.freeze({
+            ciphertext,
+            iv: base64UrlEncode(iv),
+            keyId: spaceKey.id
+        })
+    });
+}
+/**
+ * Decrypts an encrypted expression's body using AES-GCM.
+ *
+ * @param {EncryptedExpression} encrypted - The encrypted expression.
+ * @param {SpaceKey} spaceKey - The key to use for decryption.
+ * @returns {Promise<Expression>} A promise resolving to the decrypted expression.
+ * @throws {Error} If the key ID doesn't match the space key's ID.
+ */
+export async function decryptExpression(encrypted, spaceKey) {
+    if (encrypted.body.keyId !== spaceKey.id) {
+        throw new Error('Key ID mismatch');
+    }
+    const iv = base64UrlDecode(encrypted.body.iv);
+    const ciphertext = base64UrlDecode(encrypted.body.ciphertext);
+    const decryptedBuffer = await globalThis.crypto.subtle.decrypt({ name: 'AES-GCM', iv: iv.buffer }, spaceKey.key, ciphertext);
+    const body = JSON.parse(utf8Decode(new Uint8Array(decryptedBuffer)));
+    return Object.freeze({
+        ...encrypted,
+        body
+    });
+}
+//# sourceMappingURL=space-encryption.js.map

package/dist/privacy/space-encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-encryption.js","sourceRoot":"","sources":["../../src/privacy/space-encryption.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA4B1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CACpD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE9E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE;QACF,GAAG;QACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,CAAC;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAsB,EAAE,QAAkB;IAChF,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,MAAM,gBAAgB,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC7D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,QAAQ,CAAC,GAAG,EACZ,WAA2B,CAC5B,CAAC;IAEF,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAErE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,UAAU;QACb,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,UAAU;YACV,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,QAAQ,CAAC,EAAE;SACnB,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAA8B,EAAE,QAAkB;IACxF,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9D,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,MAAqB,EAAE,EACjD,QAAQ,CAAC,GAAG,EACZ,UAA0B,CAC3B,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAErE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,SAAS;QACZ,IAAI;KACL,CAAC,CAAC;AACL,CAAC"}

package/dist/query/engine.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @module query/engine
+ * Runs a query: narrow by collection, filter, sort, page, then follow links.
+ *
+ * Deliberately no planner. A browser holds a replica, not a warehouse; at that
+ * scale an optimiser would be more code than it saves. Filtering happens after
+ * records are opened, so in a private space it sees decrypted bodies — and a
+ * record this device cannot open is left out, here and in every `include`.
+ */
+import type { NodeRecord } from '../node/types.js';
+import { type Query, type QueryResult } from './types.js';
+/** What the engine needs from a space: its current records, one by key, and what links where. */
+export interface QuerySource {
+    /** Current, not deleted */
+    list(collection: string): Promise<ReadonlyArray<NodeRecord>>;
+    get(key: string): Promise<NodeRecord | null>;
+    linked(key: string, options: {
+        rel?: string;
+        collection?: string;
+    }): Promise<ReadonlyArray<NodeRecord>>;
+}
+/**
+ * Runs a query against a space.
+ * @throws When the query is malformed — with a message saying what to fix
+ */
+export declare function runQuery<T = unknown>(source: QuerySource, given: Query): Promise<QueryResult<T>>;
+//# sourceMappingURL=engine.d.ts.map

package/dist/query/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/query/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAA4B,KAAK,KAAK,EAAoB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAEtG,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;CACzG;AAsDD;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAoBtG"}

package/dist/query/engine.js

@@ -0,0 +1,84 @@
+import { checkQuery, fieldValue, matches } from './filter.js';
+import { plainQuery } from './types.js';
+/** Orders two values of a field: missing sorts first, then numbers and strings by value. */
+function compareValues(a, b) {
+    if (a === b)
+        return 0;
+    if (a === undefined || a === null)
+        return -1;
+    if (b === undefined || b === null)
+        return 1;
+    if (typeof a === 'number' && typeof b === 'number')
+        return a - b;
+    if (typeof a === 'boolean' && typeof b === 'boolean')
+        return Number(a) - Number(b);
+    return String(a) < String(b) ? -1 : String(a) > String(b) ? 1 : 0;
+}
+/**
+ * A total order. Ties always break on the key — stable on every node,
+ * so paging neither skips nor repeats between peers holding the same data.
+ */
+function sortRecords(records, sort) {
+    const fields = Object.entries(sort ?? { '@createdAt': 'asc' });
+    return records.sort((a, b) => {
+        for (const [field, direction] of fields) {
+            const order = compareValues(fieldValue(a, field), fieldValue(b, field));
+            if (order !== 0)
+                return direction === 'desc' ? -order : order;
+        }
+        return a.key < b.key ? -1 : a.key > b.key ? 1 : 0;
+    });
+}
+/** Only records whose body this device could open */
+const readable = (r) => r !== null && r.body !== null;
+async function expand(source, record, includes) {
+    if (!includes)
+        return { ...record, included: {} };
+    const included = {};
+    for (const [name, include] of Object.entries(includes)) {
+        let related;
+        if (include.direction === 'out') {
+            const targets = await Promise.all(record.links.filter((l) => l.rel === include.rel).map((l) => source.get(l.to)));
+            // A link to a record not held here is normal; it simply finds nothing.
+            related = targets.filter((r) => readable(r) && (!include.from || r.collection === include.from));
+        }
+        else {
+            const from = include.from; // names only, after plainQuery
+            related = (await source.linked(record.key, { rel: include.rel, ...(from ? { collection: from } : {}) })).filter(readable);
+        }
+        if (include.where)
+            related = related.filter((r) => matches(r, include.where));
+        if (include.count) {
+            included[name] = related.length;
+            continue;
+        }
+        const page = include.limit === undefined ? related : related.slice(0, include.limit);
+        included[name] = await Promise.all(page.map((r) => expand(source, r, include.include)));
+    }
+    return { ...record, included };
+}
+/**
+ * Runs a query against a space.
+ * @throws When the query is malformed — with a message saying what to fix
+ */
+export async function runQuery(source, given) {
+    const query = plainQuery(given);
+    const problem = checkQuery(query);
+    if (problem)
+        throw new Error(`Invalid query: ${problem}`);
+    const candidates = (await source.list(query.collection)).filter(readable);
+    const filtered = query.where ? candidates.filter((r) => matches(r, query.where)) : candidates;
+    const sorted = sortRecords(filtered, query.sort);
+    // The cursor is the key of the last record of the previous page. If that
+    // record has since gone, start from where it would have been.
+    let start = 0;
+    if (query.cursor) {
+        const at = sorted.findIndex((r) => r.key === query.cursor);
+        start = at >= 0 ? at + 1 : 0;
+    }
+    const page = query.limit === undefined ? sorted.slice(start) : sorted.slice(start, start + query.limit);
+    const records = await Promise.all(page.map((r) => expand(source, r, query.include)));
+    const more = start + page.length < sorted.length && page.length > 0;
+    return { records: records, cursor: more ? page[page.length - 1].key : null };
+}
+//# sourceMappingURL=engine.js.map

package/dist/query/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/query/engine.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAgE,MAAM,YAAY,CAAC;AAUtG,4FAA4F;AAC5F,SAAS,aAAa,CAAC,CAAU,EAAE,CAAU;IAC3C,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAuB,OAAY,EAAE,IAAmB;IAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACxE,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qDAAqD;AACrD,MAAM,QAAQ,GAAG,CAAC,CAAoB,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;AAE1F,KAAK,UAAU,MAAM,CAAC,MAAmB,EAAE,MAAkB,EAAE,QAA0B;IACvF,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAwD,EAAE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAA6B,EAAE,CAAC;QACnF,IAAI,OAAqB,CAAC;QAC1B,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAClH,uEAAuE;YACvE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAA0B,CAAC,CAAC,+BAA+B;YAChF,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5H,CAAC;QACD,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,KAAM,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,MAAmB,EAAE,KAAY;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;IAE1D,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjD,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,OAAwC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjH,CAAC"}

package/dist/query/filter.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @module query/filter
+ * The filter operators, as pure functions over opened records.
+ */
+import type { NodeRecord } from '../node/types.js';
+import type { Filter } from './types.js';
+/** Nested `include` beyond this is refused rather than quietly slow. */
+export declare const MAX_INCLUDE_DEPTH = 3;
+/** A field of a record: `@…` for the record itself, a dotted path into its body otherwise. */
+export declare function fieldValue(record: NodeRecord, path: string): unknown;
+/** Whether a record matches a filter. */
+export declare function matches(record: NodeRecord, filter: Filter): boolean;
+/** Why a query cannot run, or null when it can. Queries are data; functions and unknown operators are refused. */
+export declare function checkQuery(query: unknown): string | null;
+//# sourceMappingURL=filter.d.ts.map

package/dist/query/filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../src/query/filter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAEzD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAenC,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAYpE;AAmED,yCAAyC;AACzC,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAOnE;AAsDD,kHAAkH;AAClH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAsBxD"}

package/dist/query/filter.js

@@ -0,0 +1,207 @@
+/** Nested `include` beyond this is refused rather than quietly slow. */
+export const MAX_INCLUDE_DEPTH = 3;
+const META = {
+    '@key': (r) => r.key,
+    '@author': (r) => r.author,
+    '@root': (r) => r.root,
+    '@createdBy': (r) => r.createdBy,
+    '@createdAt': (r) => r.createdAt,
+    '@updatedAt': (r) => r.updatedAt,
+    '@seq': (r) => r.seq,
+    '@collection': (r) => r.collection,
+};
+const OPERATORS = new Set(['$eq', '$ne', '$gt', '$gte', '$lt', '$lte', '$in', '$nin', '$exists', '$contains']);
+/** A field of a record: `@…` for the record itself, a dotted path into its body otherwise. */
+export function fieldValue(record, path) {
+    if (path.startsWith('@')) {
+        const read = META[path];
+        if (!read)
+            throw new Error(`Unknown record field "${path}" — use one of ${Object.keys(META).join(', ')}`);
+        return read(record);
+    }
+    let value = record.body;
+    for (const part of path.split('.')) {
+        if (value === null || typeof value !== 'object')
+            return undefined;
+        value = value[part];
+    }
+    return value;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function equal(a, b) {
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b || a === null || b === null || typeof a !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    return ak.length === bk.length && ak.every((k) => equal(a[k], b[k]));
+}
+/** Ordered comparison, only between two numbers or two strings. */
+function compare(a, b) {
+    if (typeof a === 'number' && typeof b === 'number')
+        return a - b;
+    if (typeof a === 'string' && typeof b === 'string')
+        return a < b ? -1 : a > b ? 1 : 0;
+    return null;
+}
+function operatorHolds(op, value, operand) {
+    switch (op) {
+        case '$eq':
+            return equal(value, operand);
+        case '$ne':
+            return !equal(value, operand);
+        case '$gt': {
+            const c = compare(value, operand);
+            return c !== null && c > 0;
+        }
+        case '$gte': {
+            const c = compare(value, operand);
+            return c !== null && c >= 0;
+        }
+        case '$lt': {
+            const c = compare(value, operand);
+            return c !== null && c < 0;
+        }
+        case '$lte': {
+            const c = compare(value, operand);
+            return c !== null && c <= 0;
+        }
+        case '$in':
+            return Array.isArray(operand) && operand.some((o) => equal(value, o));
+        case '$nin':
+            return Array.isArray(operand) && !operand.some((o) => equal(value, o));
+        case '$exists':
+            return (value !== undefined) === operand;
+        case '$contains':
+            if (typeof value === 'string' && typeof operand === 'string')
+                return value.toLowerCase().includes(operand.toLowerCase());
+            if (Array.isArray(value))
+                return value.some((item) => equal(item, operand));
+            return false;
+        default:
+            throw new Error(`Unknown operator ${op}`);
+    }
+}
+/** Whether one field satisfies a condition: an operator object, or a value to equal. */
+function conditionHolds(value, condition) {
+    if (isPlainObject(condition) && Object.keys(condition).length > 0 && Object.keys(condition).every((k) => k.startsWith('$'))) {
+        return Object.entries(condition).every(([op, operand]) => operatorHolds(op, value, operand));
+    }
+    return equal(value, condition);
+}
+/** Whether a record matches a filter. */
+export function matches(record, filter) {
+    return Object.entries(filter).every(([field, condition]) => {
+        if (field === '$and')
+            return condition.every((f) => matches(record, f));
+        if (field === '$or')
+            return condition.some((f) => matches(record, f));
+        if (field === '$not')
+            return !matches(record, condition);
+        return conditionHolds(fieldValue(record, field), condition);
+    });
+}
+// ─── Checking a query before running it ─────────────────────────────
+function checkFilter(filter, at) {
+    if (!isPlainObject(filter))
+        return `${at} must be an object`;
+    for (const [field, condition] of Object.entries(filter)) {
+        if (field === '$and' || field === '$or') {
+            if (!Array.isArray(condition))
+                return `${at}.${field} must be a list of filters`;
+            for (const [i, sub] of condition.entries()) {
+                const problem = checkFilter(sub, `${at}.${field}[${i}]`);
+                if (problem)
+                    return problem;
+            }
+            continue;
+        }
+        if (field === '$not') {
+            const problem = checkFilter(condition, `${at}.$not`);
+            if (problem)
+                return problem;
+            continue;
+        }
+        if (field.startsWith('$'))
+            return `${at}: "${field}" is not a field or a logical operator ($and, $or, $not)`;
+        if (field.startsWith('@') && !META[field])
+            return `${at}: unknown record field "${field}" — use one of ${Object.keys(META).join(', ')}`;
+        if (isPlainObject(condition) && Object.keys(condition).some((k) => k.startsWith('$'))) {
+            for (const op of Object.keys(condition)) {
+                if (!OPERATORS.has(op))
+                    return `${at}.${field}: unknown operator "${op}" — use one of ${[...OPERATORS].join(', ')}`;
+            }
+        }
+    }
+    return null;
+}
+function checkIncludes(includes, at, depth) {
+    if (!isPlainObject(includes))
+        return `${at} must be an object of named includes`;
+    if (depth > MAX_INCLUDE_DEPTH)
+        return `${at}: includes nest at most ${MAX_INCLUDE_DEPTH} deep`;
+    for (const [name, spec] of Object.entries(includes)) {
+        const inc = spec;
+        const here = `${at}.${name}`;
+        if (!isPlainObject(inc))
+            return `${here} must be an object`;
+        if (typeof inc.rel !== 'string')
+            return `${here}.rel is required: the link role to follow, e.g. "about"`;
+        if (inc.from !== undefined && typeof inc.from !== 'string')
+            return `${here}.from must be a collection name`;
+        if (inc.direction !== undefined && inc.direction !== 'in' && inc.direction !== 'out')
+            return `${here}.direction must be "in" or "out"`;
+        if (inc.limit !== undefined && (!Number.isInteger(inc.limit) || inc.limit < 0))
+            return `${here}.limit must be a whole number`;
+        if (inc.where !== undefined) {
+            const problem = checkFilter(inc.where, `${here}.where`);
+            if (problem)
+                return problem;
+        }
+        if (inc.include !== undefined) {
+            const problem = checkIncludes(inc.include, `${here}.include`, depth + 1);
+            if (problem)
+                return problem;
+        }
+    }
+    return null;
+}
+/** Why a query cannot run, or null when it can. Queries are data; functions and unknown operators are refused. */
+export function checkQuery(query) {
+    const q = query;
+    if (!isPlainObject(q))
+        return 'A query must be an object';
+    if (typeof q.collection !== 'string' || !q.collection)
+        return 'A query needs a "collection"';
+    if (q.where !== undefined) {
+        const problem = checkFilter(q.where, 'where');
+        if (problem)
+            return problem;
+    }
+    if (q.include !== undefined) {
+        const problem = checkIncludes(q.include, 'include', 1);
+        if (problem)
+            return problem;
+    }
+    if (q.sort !== undefined) {
+        if (!isPlainObject(q.sort))
+            return 'sort must be an object: { field: "asc" | "desc" }';
+        for (const [field, direction] of Object.entries(q.sort)) {
+            if (direction !== 'asc' && direction !== 'desc')
+                return `sort.${field} must be "asc" or "desc"`;
+            if (field.startsWith('@') && !META[field])
+                return `sort: unknown record field "${field}"`;
+        }
+    }
+    if (q.limit !== undefined && (!Number.isInteger(q.limit) || q.limit < 0))
+        return 'limit must be a whole number';
+    if (q.cursor !== undefined && typeof q.cursor !== 'string')
+        return 'cursor must be the string a previous page returned';
+    return null;
+}
+//# sourceMappingURL=filter.js.map

package/dist/query/filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../src/query/filter.ts"],"names":[],"mappings":"AAOA,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,MAAM,IAAI,GAA+C;IACvD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;IACpB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM;IAC1B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;IACtB,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAChC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAChC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAChC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG;IACpB,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU;CACnC,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAE/G,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAY;IACzD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,GAAY,MAAM,CAAC,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClE,KAAK,GAAI,KAAiC,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,KAAK,CAAC,CAAU,EAAE,CAAU;IACnC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAG,CAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjI,CAAC;AAED,mEAAmE;AACnE,SAAS,OAAO,CAAC,CAAU,EAAE,CAAU;IACrC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,EAAU,EAAE,KAAc,EAAE,OAAgB;IACjE,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,KAAK;YACR,OAAO,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,KAAK;YACR,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,KAAK;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,SAAS;YACZ,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,OAAO,CAAC;QAC3C,KAAK,WAAW;YACd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YACzH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC;QACf;YACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,KAAc,EAAE,SAAkB;IACxD,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5H,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,MAAc;IACxD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE;QACzD,IAAI,KAAK,KAAK,MAAM;YAAE,OAAQ,SAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,KAAK,KAAK,KAAK;YAAE,OAAQ,SAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK,KAAK,MAAM;YAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,SAAmB,CAAC,CAAC;QACnE,OAAO,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AAEvE,SAAS,WAAW,CAAC,MAAe,EAAE,EAAU;IAC9C,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,EAAE,oBAAoB,CAAC;IAC7D,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO,GAAG,EAAE,IAAI,KAAK,4BAA4B,CAAC;YACjF,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzD,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,EAAE,MAAM,KAAK,0DAA0D,CAAC;QAC7G,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,EAAE,2BAA2B,KAAK,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxI,IAAI,aAAa,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,OAAO,GAAG,EAAE,IAAI,KAAK,uBAAuB,EAAE,kBAAkB,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,QAAiB,EAAE,EAAU,EAAE,KAAa;IACjE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,EAAE,sCAAsC,CAAC;IACjF,IAAI,KAAK,GAAG,iBAAiB;QAAE,OAAO,GAAG,EAAE,2BAA2B,iBAAiB,OAAO,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,IAAI,oBAAoB,CAAC;QAC5D,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,yDAAyD,CAAC;QACzG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,IAAI,iCAAiC,CAAC;QAC5G,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK;YAAE,OAAO,GAAG,IAAI,kCAAkC,CAAC;QACvI,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,OAAO,GAAG,IAAI,+BAA+B,CAAC;QAC9H,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAC;YACxD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACzE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,CAAC,GAAG,KAA8B,CAAC;IACzC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC1D,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,OAAO,8BAA8B,CAAC;IAC7F,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,mDAAmD,CAAC;QACvF,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM;gBAAE,OAAO,QAAQ,KAAK,0BAA0B,CAAC;YAChG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,+BAA+B,KAAK,GAAG,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAChH,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,oDAAoD,CAAC;IACxH,OAAO,IAAI,CAAC;AACd,CAAC"}