cursedbelt 2.8.0 → 3.0.0

package/dist/server/private-media/crypto.js

@@ -1,112 +0,0 @@
-import { createCipheriv, randomBytes } from 'node:crypto';
-import { decryptSecret, deriveKey, encryptSecret } from 'cwip/node';
-/** A random per-user salt (non-secret, stored plaintext, stable once created). Domain-separates
- * a user's password-derived keys so the same password yields different keys across users. */
-export const generateUserSalt = () => randomBytes(16).toString('base64url');
-/** Zero-knowledge set key: scrypt(password, per-user salt). The server never stores this (or a
- * hash of it); it exists only transiently after an unlock. Different passwords → disjoint sets. */
-export const derivePasswordSetKey = (password, userSalt) => deriveKey(password, `pmedia:${userSalt}`);
-/** Recoverable set key: scrypt(serverSecret, userId). The server can always derive it, so
- * `standard`-mode media is decryptable once private is unlocked (session-gated) — protects a
- * stolen disk / Finder / backups, but a compromised running server can decrypt. */
-export const deriveServerSetKey = (serverSecret, userId) => deriveKey(serverSecret, `pmedia-srv:${userId}`);
-// ── Sealed metadata envelope (title / thumbnail key / notes / tags) ──────────────
-// Encrypted under the set key; NEVER stored in the plaintext index. A successful decrypt is
-// also the deniable MEMBERSHIP TEST — trying a password reveals only the items it opens.
-export const sealMeta = (setKey, meta) => encryptSecret(JSON.stringify(meta), setKey);
-/** Open a sealed envelope, or null if this key doesn't own it (wrong password / mode key).
- * The null return IS the membership signal — no stored set identifier is needed. */
-export function openMeta(setKey, sealed) {
-    try {
-        return JSON.parse(decryptSecret(sealed, setKey));
-    }
-    catch {
-        return null;
-    }
-}
-export const generateContentKey = () => ({
-    key: randomBytes(16), // AES-128
-    iv: randomBytes(16),
-});
-export const wrapContentKey = (setKey, content) => encryptSecret(`${content.key.toString('base64')}.${content.iv.toString('base64')}`, setKey);
-/** Unwrap a content key, or null if the set key can't open it (wrong password / mode key). */
-export function unwrapContentKey(setKey, wrapped) {
-    try {
-        const [k, iv] = decryptSecret(wrapped, setKey).split('.');
-        if (!k || !iv)
-            return null;
-        return { key: Buffer.from(k, 'base64'), iv: Buffer.from(iv, 'base64') };
-    }
-    catch {
-        return null;
-    }
-}
-// ── Whole-file blob cipher (non-video private files: photos, docs) ────────────────
-// AES-128-CTR under the item's content key — the same key/IV material the HLS path wraps, so
-// wrap/unwrap is shared. CTR is length-preserving and streaming (no padding, no buffering), and
-// encrypt/decrypt are the same operation. Tamper-evidence comes from the GCM-sealed descriptor +
-// the gated serve route (parity with the encrypted-HLS segments, which are CBC-without-MAC too).
-/** Pipe a byte stream through the item's AES-128-CTR keystream. Symmetric: pass ciphertext to
- * decrypt, plaintext to encrypt. */
-/** Big-endian increment of a 16-byte CTR IV by `blocks` — the counter arithmetic that lets a
- * decryptor start mid-stream (genapp-100: Range/seek on private blobs). */
-export function incrementIv(iv, blocks) {
-    const out = Buffer.from(iv);
-    let carry = BigInt(blocks);
-    for (let i = out.length - 1; i >= 0 && carry > 0n; i--) {
-        const sum = BigInt(out[i]) + (carry & 0xffn);
-        out[i] = Number(sum & 0xffn);
-        carry = (carry >> 8n) + (sum >> 8n);
-    }
-    return out;
-}
-/**
- * Decrypt a CTR ciphertext stream that starts at the BLOCK-ALIGNED offset covering plaintext
- * byte `startOffset`, dropping the intra-block lead-in — the seek half of {@link cryptBlobStream}.
- * CTR is length-preserving and positionally keyed, so byte N of plaintext only needs ciphertext
- * from block ⌊N/16⌋ onward with the IV counter advanced by that many blocks (genapp-100: this is
- * what makes big private videos scrub on a remote-store host with no local derivatives).
- */
-export function cryptBlobRangeStream(content, stream, startOffset) {
-    const BLOCK = 16;
-    const blocks = Math.floor(startOffset / BLOCK);
-    let drop = startOffset % BLOCK;
-    const cipher = createCipheriv('aes-128-ctr', content.key, incrementIv(content.iv, blocks));
-    return stream.pipeThrough(new TransformStream({
-        transform(chunk, controller) {
-            let out = cipher.update(chunk);
-            if (drop > 0) {
-                const skip = Math.min(drop, out.byteLength);
-                out = out.subarray(skip);
-                drop -= skip;
-            }
-            if (out.byteLength > 0) {
-                controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-            }
-        },
-        flush(controller) {
-            const out = cipher.final(); // empty for CTR — kept for cipher-contract completeness
-            if (out.byteLength > 0) {
-                controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-            }
-        },
-    }));
-}
-export function cryptBlobStream(content, stream) {
-    const cipher = createCipheriv('aes-128-ctr', content.key, content.iv);
-    return stream.pipeThrough(new TransformStream({
-        transform(chunk, controller) {
-            const out = cipher.update(chunk);
-            if (out.byteLength > 0) {
-                controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-            }
-        },
-        flush(controller) {
-            const out = cipher.final(); // empty for CTR — kept for cipher-contract completeness
-            if (out.byteLength > 0) {
-                controller.enqueue(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
-            }
-        },
-    }));
-}
-//# sourceMappingURL=crypto.js.map

package/dist/server/private-media/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/server/private-media/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAcpE;6FAC6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEpF;mGACmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAE,QAAgB,EAAU,EAAE,CACjF,SAAS,CAAC,QAAQ,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;AAE5C;;mFAEmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAoB,EAAE,MAAc,EAAU,EAAE,CACjF,SAAS,CAAC,YAAY,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC;AAElD,oFAAoF;AACpF,4FAA4F;AAC5F,yFAAyF;AAEzF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAa,EAAU,EAAE,CAChE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAE9C;oFACoF;AACpF,MAAM,UAAU,QAAQ,CAAc,MAAc,EAAE,MAAc;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAe,EAAE,CAAC,CAAC;IACnD,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,UAAU;IAChC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAmB,EAAU,EAAE,CAC5E,aAAa,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAE9F,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAe;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,6FAA6F;AAC7F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AAEjG;oCACoC;AACpC;2EAC2E;AAC3E,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QAC7B,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAmB,EACnB,MAAkC,EAClC,WAAmB;IAEnB,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,GAAG,WAAW,GAAG,KAAK,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,eAAe,CAAyB;QAC1C,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC5C,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzB,IAAI,IAAI,IAAI,CAAC;YACf,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,wDAAwD;YACpF,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAmB,EACnB,MAAkC;IAElC,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,eAAe,CAAyB;QAC1C,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,wDAAwD;YACpF,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACvB,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/server/private-media/index-store.d.ts

@@ -1,32 +0,0 @@
-import type { ProcessingStatus } from '../../core/media';
-import type { KeyMode } from './crypto';
-export type PrivateItem = {
-    id: string;
-    owner: string;
-    sizeBytes: number;
-    createdAt: number;
-    status: ProcessingStatus;
-    keyMode: KeyMode;
-    /** AES-128 content key + IV, wrapped under the item's set key. */
-    wrappedContentKey: string;
-    /** AES-GCM envelope of { title, notes, tags, durationSeconds, … } under the item's set key. */
-    sealedMeta: string;
-};
-/** What the index endpoint exposes — clear, non-sensitive facts only. No title/thumb/notes/tags,
- * no key mode, no wrapped key. */
-export type PrivateIndexRow = {
-    id: string;
-    sizeBytes: number;
-    createdAt: number;
-    status: ProcessingStatus;
-};
-export declare const toPublic: (item: PrivateItem) => PrivateIndexRow;
-export interface PrivateIndex {
-    add(item: PrivateItem): Promise<void>;
-    get(owner: string, id: string): Promise<PrivateItem | null>;
-    list(owner: string): Promise<PrivateItem[]>;
-    update(owner: string, id: string, patch: Partial<Omit<PrivateItem, 'id' | 'owner'>>): Promise<void>;
-    remove(owner: string, id: string): Promise<void>;
-}
-export declare function createMemoryPrivateIndex(): PrivateIndex;
-//# sourceMappingURL=index-store.d.ts.map

package/dist/server/private-media/index-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-store.d.ts","sourceRoot":"","sources":["../../../src/server/private-media/index-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAYxC,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;kCACkC;AAClC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,MAAM,WAAW,KAAG,eAK3C,CAAC;AAEH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,OAAO,CAAC,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,wBAAwB,IAAI,YAAY,CA4BvD"}

package/dist/server/private-media/index-store.js

@@ -1,37 +0,0 @@
-export const toPublic = (item) => ({
-    id: item.id,
-    sizeBytes: item.sizeBytes,
-    createdAt: item.createdAt,
-    status: item.status,
-});
-export function createMemoryPrivateIndex() {
-    const byOwner = new Map();
-    const bucket = (owner) => {
-        let m = byOwner.get(owner);
-        if (!m) {
-            m = new Map();
-            byOwner.set(owner, m);
-        }
-        return m;
-    };
-    return {
-        async add(item) {
-            bucket(item.owner).set(item.id, item);
-        },
-        async get(owner, id) {
-            return bucket(owner).get(id) ?? null;
-        },
-        async list(owner) {
-            return [...bucket(owner).values()].sort((a, b) => b.createdAt - a.createdAt);
-        },
-        async update(owner, id, patch) {
-            const item = bucket(owner).get(id);
-            if (item)
-                bucket(owner).set(id, { ...item, ...patch });
-        },
-        async remove(owner, id) {
-            bucket(owner).delete(id);
-        },
-    };
-}
-//# sourceMappingURL=index-store.js.map

package/dist/server/private-media/index-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-store.js","sourceRoot":"","sources":["../../../src/server/private-media/index-store.ts"],"names":[],"mappings":"AAmCA,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAiB,EAAmB,EAAE,CAAC,CAAC;IAC/D,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,SAAS,EAAE,IAAI,CAAC,SAAS;IACzB,MAAM,EAAE,IAAI,CAAC,MAAM;CACpB,CAAC,CAAC;AAcH,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;QAC/B,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE;YACjB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/private-media/mountPrivateRoutes.d.ts

@@ -1,27 +0,0 @@
-import type { Context, Hono } from 'hono';
-import { type MediaStore } from '../storage/types';
-import type { PrivateIndex } from './index-store';
-import type { UnlockPasswordPolicy, UnlockService } from './unlock';
-/** Access-Control-Allow-Origin resolver for split-origin private streaming (media on another
- * origin than the SPA). Same shape as the storage layer's. */
-export type CorsResolver = string | string[] | ((requestOrigin: string | undefined) => string | null | undefined);
-export type MountPrivateOptions = {
-    store: MediaStore;
-    index: PrivateIndex;
-    unlock: UnlockService;
-    /** Path prefix (default '/_private'). */
-    basePath?: string;
-    /** App session auth → the caller's id + their per-user salt (created lazily, stable). Return
-     * null to reject. Gates unlock/index/reveal (the byte routes use the path token instead). */
-    authorize: (c: Context) => Promise<{
-        userId: string;
-        userSalt: string;
-    } | null>;
-    /** What a supplied password means (default: derive — deniable sets). `gate` verifies it
-     * against the app's accounts and mints the recoverable server-key grant instead. */
-    passwordPolicy?: UnlockPasswordPolicy;
-    /** Cross-origin access for split-origin deploys. */
-    cors?: CorsResolver;
-};
-export declare function mountPrivateRoutes(app: Hono, opts: MountPrivateOptions): void;
-//# sourceMappingURL=mountPrivateRoutes.d.ts.map

package/dist/server/private-media/mountPrivateRoutes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mountPrivateRoutes.d.ts","sourceRoot":"","sources":["../../../src/server/private-media/mountPrivateRoutes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,KAAK,UAAU,EAAuC,MAAM,kBAAkB,CAAC;AAExF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQpE;8DAC8D;AAC9D,MAAM,MAAM,YAAY,GACpB,MAAM,GACN,MAAM,EAAE,GACR,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AASvE,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,aAAa,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;iGAC6F;IAC7F,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAChF;wFACoF;IACpF,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,oDAAoD;IACpD,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CA4N7E"}

package/dist/server/private-media/mountPrivateRoutes.js

@@ -1,220 +0,0 @@
-import { decodeRange, serveRange } from '../storage/streamRange';
-import { privateHlsFileKey, privateSourceKey } from '../storage/types';
-import { cryptBlobRangeStream, cryptBlobStream, openMeta, unwrapContentKey } from './crypto';
-import { toPublic } from './index-store';
-function resolveAcao(cors, reqOrigin) {
-    if (!cors)
-        return null;
-    if (typeof cors === 'string')
-        return cors;
-    if (Array.isArray(cors))
-        return reqOrigin && cors.includes(reqOrigin) ? reqOrigin : null;
-    return cors(reqOrigin) ?? null;
-}
-export function mountPrivateRoutes(app, opts) {
-    const base = opts.basePath ?? '/_private';
-    const { store, index, unlock } = opts;
-    const cors = (c, res) => {
-        const acao = resolveAcao(opts.cors, c.req.header('origin'));
-        if (acao) {
-            res.headers.set('Access-Control-Allow-Origin', acao);
-            res.headers.set('Access-Control-Expose-Headers', 'Content-Range, Content-Length, Accept-Ranges');
-            res.headers.append('Vary', 'Origin');
-        }
-        return res;
-    };
-    const policy = opts.passwordPolicy ?? { mode: 'derive' };
-    /** Resolve what the supplied password contributes under the active policy:
-     * derive ⇒ it feeds key derivation (may be undefined ⇒ standard set);
-     * gate ⇒ it must be present AND verify against the app's accounts, then the
-     * set key is the recoverable server one (password never feeds derivation).
-     * Returns an error Response to short-circuit with, or the derivation input. */
-    const resolvePassword = async (c, who, password) => {
-        if (policy.mode === 'derive')
-            return { derivePassword: password };
-        if (!password)
-            return { error: c.json({ error: 'password required' }, 401) };
-        if (!(await policy.verifyPassword(who, password))) {
-            return { error: c.json({ error: 'invalid password' }, 401) };
-        }
-        return {}; // verified — standard (server-key) set
-    };
-    // POST /unlock { password? } → a token sealing the set key (deniable w/ password, else
-    // standard; under the gate policy the password is verified and the set is always standard).
-    app.post(`${base}/unlock`, async (c) => {
-        const who = await opts.authorize(c);
-        if (!who)
-            return c.json({ error: 'unauthorized' }, 401);
-        const body = (await c.req.json().catch(() => ({})));
-        const resolved = await resolvePassword(c, who, body.password || undefined);
-        if ('error' in resolved)
-            return resolved.error;
-        const { token, mode } = await unlock.unlock({
-            userId: who.userId,
-            userSalt: who.userSalt,
-            password: resolved.derivePassword,
-        });
-        return c.json({ token, mode });
-    });
-    // GET /index → clear, non-sensitive rows only (size + createdAt + status). Never title/thumb/mode.
-    app.get(`${base}/index`, async (c) => {
-        const who = await opts.authorize(c);
-        if (!who)
-            return c.json({ error: 'unauthorized' }, 401);
-        return c.json({ items: (await index.list(who.userId)).map(toPublic) });
-    });
-    // Decrypt every descriptor a set key opens, silently skipping the rest (decrypt-success IS the
-    // membership test — deniability). Shared by the password and token reveal routes.
-    const revealWithKey = async (userId, setKey) => {
-        const revealed = [];
-        for (const item of await index.list(userId)) {
-            const meta = openMeta(setKey, item.sealedMeta);
-            if (meta !== null)
-                revealed.push({ id: item.id, meta });
-        }
-        return revealed;
-    };
-    // POST /reveal { password } → which items that password unlocks (GCM decrypt-success), with
-    // their now-decrypted metadata. Others stay opaque. This is the "try a password" cleanup UX.
-    // Under the gate policy the password must verify first and the standard set is revealed.
-    app.post(`${base}/reveal`, async (c) => {
-        const who = await opts.authorize(c);
-        if (!who)
-            return c.json({ error: 'unauthorized' }, 401);
-        const body = (await c.req.json().catch(() => ({})));
-        const resolved = await resolvePassword(c, who, body.password || undefined);
-        if ('error' in resolved)
-            return resolved.error;
-        const setKey = unlock.deriveSetKey({
-            userId: who.userId,
-            userSalt: who.userSalt,
-            password: resolved.derivePassword,
-        });
-        return c.json({ items: await revealWithKey(who.userId, setKey) });
-    });
-    // POST /reveal-unlocked { token } → the same reveal, keyed by an UNLOCK TOKEN instead of the
-    // password (the token seals the set key — same mechanism the content-key route uses). Lets an
-    // already-unlocked session list its items without re-typing the password. The token must belong
-    // to the session caller.
-    app.post(`${base}/reveal-unlocked`, async (c) => {
-        const who = await opts.authorize(c);
-        if (!who)
-            return c.json({ error: 'unauthorized' }, 401);
-        const body = (await c.req.json().catch(() => ({})));
-        if (!body.token)
-            return c.json({ error: 'token required' }, 400);
-        const grant = await unlock.verify(body.token);
-        if (!grant || grant.userId !== who.userId)
-            return c.json({ error: 'invalid token' }, 401);
-        return c.json({ items: await revealWithKey(who.userId, grant.setKey) });
-    });
-    // GET /u/:token/hls/:source/:video/* → the encrypted HLS tree. The `enc.key` sub-path returns
-    // the unwrapped AES-128 content key (gated, no-store); every other path serves the encrypted
-    // segment/playlist (edge-cacheable — hls.js decrypts with the key).
-    app.get(`${base}/u/:token/hls/:source/:video/*`, async (c) => {
-        const raw = c.req.param('token');
-        if (!raw)
-            return c.body(null, 401);
-        const grant = await unlock.verify(raw);
-        if (!grant)
-            return c.body(null, 401);
-        const video = c.req.param('video');
-        const prefix = `${base}/u/${raw}/hls/${c.req.param('source')}/${video}/`;
-        const rel = c.req.path.slice(prefix.length);
-        if (!rel || rel.includes('..'))
-            return c.body(null, 400);
-        if (rel.endsWith('enc.key')) {
-            const item = await index.get(grant.userId, video);
-            if (!item)
-                return c.body(null, 404);
-            const content = unwrapContentKey(grant.setKey, item.wrappedContentKey);
-            // null ⇒ this token's set key doesn't own the item (wrong password / wrong mode).
-            if (!content)
-                return c.body(null, 403);
-            // A fresh, tightly-sized ArrayBuffer copy of the 16-byte key — an unambiguous BodyInit
-            // (wrapping the Node Buffer directly can mis-size the response).
-            const keyBytes = Uint8Array.from(content.key);
-            return cors(c, new Response(keyBytes.buffer, {
-                status: 200,
-                headers: { 'Content-Type': 'application/octet-stream', 'Cache-Control': 'no-store' },
-            }));
-        }
-        const mime = rel.endsWith('.m3u8') ? 'application/vnd.apple.mpegurl' : 'video/mp2t';
-        return cors(c, await serveRange(store, privateHlsFileKey(grant.userId, video, rel), mime, c.req.header('range')));
-    });
-    // GET /u/:token/file/:id → a private file stored as one AES-128-CTR ciphertext blob at
-    // privateSourceKey. Decrypted server-side per request under the token's set key; the mime
-    // comes from the sealed descriptor, so a token whose set key can't open the item (wrong
-    // password / wrong mode) gets a 403 and never any bytes.
-    //
-    // RANGE SUPPORT (genapp-100): CTR is positionally keyed, so a byte range decrypts from the
-    // block-aligned ciphertext offset with the IV counter advanced (`cryptBlobRangeStream`). This
-    // is what makes a big private VIDEO scrub on a remote-store host, where no local ffmpeg means
-    // no HLS derivatives and the blob route is the only byte path. Plaintext is never stored.
-    app.get(`${base}/u/:token/file/:id`, async (c) => {
-        const raw = c.req.param('token');
-        if (!raw)
-            return c.body(null, 401);
-        const grant = await unlock.verify(raw);
-        if (!grant)
-            return c.body(null, 401);
-        const id = c.req.param('id');
-        const item = await index.get(grant.userId, id);
-        if (!item)
-            return c.body(null, 404);
-        const content = unwrapContentKey(grant.setKey, item.wrappedContentKey);
-        if (!content)
-            return c.body(null, 403);
-        const meta = openMeta(grant.setKey, item.sealedMeta);
-        const baseHeaders = {
-            'Content-Type': meta?.mime || 'application/octet-stream',
-            'Cache-Control': 'no-store',
-            'Accept-Ranges': 'bytes',
-        };
-        const key = privateSourceKey(grant.userId, id);
-        const range = item.sizeBytes > 0 ? decodeRange(c.req.header('range'), item.sizeBytes) : { kind: 'full' };
-        if (range.kind === 'unsatisfiable') {
-            return cors(c, new Response(null, { status: 416, headers: { 'Content-Range': `bytes */${item.sizeBytes}` } }));
-        }
-        if (range.kind === 'partial') {
-            // Fetch ciphertext from the BLOCK-ALIGNED start (CTR block = 16 bytes); the range
-            // stream drops the intra-block lead-in so the client sees exactly [start, end].
-            const alignedStart = range.start - (range.start % 16);
-            const stored = await store.getRange(key, { start: alignedStart, end: range.end });
-            if (!stored)
-                return c.body(null, 404);
-            return cors(c, new Response(cryptBlobRangeStream(content, stored.stream, range.start), {
-                status: 206,
-                headers: {
-                    ...baseHeaders,
-                    'Content-Range': `bytes ${range.start}-${range.end}/${item.sizeBytes}`,
-                    'Content-Length': String(range.end - range.start + 1),
-                },
-            }));
-        }
-        const stored = await store.getRange(key);
-        if (!stored)
-            return c.body(null, 404);
-        const headers = { ...baseHeaders };
-        if (item.sizeBytes > 0)
-            headers['Content-Length'] = String(item.sizeBytes);
-        return cors(c, new Response(cryptBlobStream(content, stored.stream), { status: 200, headers }));
-    });
-    // Preflight for the cross-origin byte routes.
-    if (opts.cors) {
-        app.options(`${base}/u/*`, (c) => {
-            const acao = resolveAcao(opts.cors, c.req.header('origin'));
-            const headers = {
-                'Access-Control-Allow-Methods': 'GET, OPTIONS',
-                'Access-Control-Allow-Headers': 'Range',
-                'Access-Control-Max-Age': '86400',
-            };
-            if (acao) {
-                headers['Access-Control-Allow-Origin'] = acao;
-                headers.Vary = 'Origin';
-            }
-            return c.body(null, 204, headers);
-        });
-    }
-}
-//# sourceMappingURL=mountPrivateRoutes.js.map

package/dist/server/private-media/mountPrivateRoutes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mountPrivateRoutes.js","sourceRoot":"","sources":["../../../src/server/private-media/mountPrivateRoutes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAmB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE7F,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAgBzC,SAAS,WAAW,CAAC,IAA8B,EAAE,SAA6B;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAkBD,MAAM,UAAU,kBAAkB,CAAC,GAAS,EAAE,IAAyB;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC1C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,GAAa,EAAY,EAAE;QACnD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CACb,+BAA+B,EAC/B,8CAA8C,CAC/C,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;IAElE;;;;mFAI+E;IAC/E,MAAM,eAAe,GAAG,KAAK,EAC3B,CAAU,EACV,GAAyC,EACzC,QAA4B,EACgC,EAAE;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,CAAC,CAAC,uCAAuC;IACpD,CAAC,CAAC;IAEF,uFAAuF;IACvF,4FAA4F;IAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0B,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;QAC3E,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,QAAQ,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,mGAAmG;IACnG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,+FAA+F;IAC/F,kFAAkF;IAClF,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAyC,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0B,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC;QAC3E,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;YACjC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,QAAQ,CAAC,cAAc;SAClC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,6FAA6F;IAC7F,8FAA8F;IAC9F,gGAAgG;IAChG,yBAAyB;IACzB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,6FAA6F;IAC7F,oEAAoE;IACpE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC;QACzE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACvE,kFAAkF;YAClF,IAAI,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvC,uFAAuF;YACvF,iEAAiE;YACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,IAAI,CACT,CAAC,EACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;gBAC5B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE;aACrF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,YAAY,CAAC;QACpF,OAAO,IAAI,CACT,CAAC,EACD,MAAM,UAAU,CACd,KAAK,EACL,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,EAC3C,IAAI,EACJ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CACtB,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uFAAuF;IACvF,0FAA0F;IAC1F,wFAAwF;IACxF,yDAAyD;IACzD,EAAE;IACF,2FAA2F;IAC3F,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAoB,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,MAAM,WAAW,GAA2B;YAC1C,cAAc,EAAE,IAAI,EAAE,IAAI,IAAI,0BAA0B;YACxD,eAAe,EAAE,UAAU;YAC3B,eAAe,EAAE,OAAO;SACzB,CAAC;QAEF,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;QAClH,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,OAAO,IAAI,CACT,CAAC,EACD,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,WAAW,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,kFAAkF;YAClF,gFAAgF;YAChF,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO,IAAI,CACT,CAAC,EACD,IAAI,QAAQ,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBACtE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,GAAG,WAAW;oBACd,eAAe,EAAE,SAAS,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE;oBACtE,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;iBACtD;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,QAAQ,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5D,MAAM,OAAO,GAA2B;gBACtC,8BAA8B,EAAE,cAAc;gBAC9C,8BAA8B,EAAE,OAAO;gBACvC,wBAAwB,EAAE,OAAO;aAClC,CAAC;YACF,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC;gBAC9C,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC1B,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/server/private-media/pipeline.d.ts

@@ -1,38 +0,0 @@
-import type { ProcessingStatus } from '../../core/media';
-import { type MediaStore } from '../storage/types';
-export type PrivateProcessResult = {
-    status: ProcessingStatus;
-    durationSeconds: number;
-    hasHls: boolean;
-    /** The AES-128 content key + IV, wrapped under the caller's set key. Null if processing failed. */
-    wrappedContentKey: string | null;
-};
-export type PrivateProcessOptions = {
-    store: MediaStore;
-    /** Scratch dir for ffmpeg I/O + the transient key file (cleaned up afterwards). */
-    workDir: string;
-    owner: string;
-    id: string;
-    /** Local PLAINTEXT source, staged by the caller; never persisted (deleted with the job dir). */
-    sourcePath: string;
-    /** The mode key (server-held or password-derived) the content key is wrapped under. */
-    setKey: Buffer;
-    ladderHeights?: number[];
-    onProgress?: (status: ProcessingStatus, pct: number) => void;
-};
-export declare function processPrivateVideo(opts: PrivateProcessOptions): Promise<PrivateProcessResult>;
-export type PrivateBlobResult = {
-    status: ProcessingStatus;
-    sizeBytes: number;
-    /** The content key + IV, wrapped under the caller's set key. Null if processing failed. */
-    wrappedContentKey: string | null;
-};
-export declare function processPrivateBlob(opts: {
-    store: MediaStore;
-    owner: string;
-    id: string;
-    /** Local PLAINTEXT source, staged by the caller; never persisted (caller deletes it). */
-    sourcePath: string;
-    setKey: Buffer;
-}): Promise<PrivateBlobResult>;
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/server/private-media/pipeline.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../../src/server/private-media/pipeline.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AASzD,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,kBAAkB,CAAC;AAa1B,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,mGAAmG;IACnG,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,gGAAgG;IAChG,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D,CAAC;AAqBF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA4D/B;AAQD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAe7B"}

package/dist/server/private-media/pipeline.js

@@ -1,98 +0,0 @@
-import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
-import path from 'node:path';
-import { hlsLadderArgs, isFfmpegAvailable, LIBRARY_CRF, probeVideoStream, resolveLadder, runFfmpegProgress, } from '../media-bun';
-import { privateHlsFileKey, privateHlsMasterKey, privateSourceKey, } from '../storage/types';
-import { cryptBlobStream, generateContentKey, wrapContentKey } from './crypto';
-// ── Encrypted-HLS pipeline (private media) ──────────────────────────────────────
-// Transcodes a private upload into an AES-128-encrypted HLS ladder: ffmpeg encrypts every
-// segment with a per-item content key (via a key-info file), so the segments are ciphertext at
-// rest (Spotlight-safe, opaque names) AND safe to edge-cache — the player fetches the content
-// key from the gated key route and decrypts client-side (fast). The plaintext source is staged
-// only in the work dir and never persisted; only the encrypted segments + playlists are stored.
-// The content key is returned WRAPPED under the caller's set key (server-held or password-derived).
-const KEY_URI = 'enc.key'; // relative in the playlist → the gated key route serves it per-video
-async function uploadTree(store, dir, owner, id) {
-    const walk = async (rel) => {
-        const entries = await readdir(path.join(dir, rel), { withFileTypes: true });
-        for (const e of entries) {
-            const childRel = rel ? path.join(rel, e.name) : e.name;
-            if (e.isDirectory()) {
-                await walk(childRel);
-            }
-            else {
-                const mime = e.name.endsWith('.m3u8') ? 'application/vnd.apple.mpegurl' : 'video/mp2t';
-                const file = Bun.file(path.join(dir, childRel));
-                await store.putStream(privateHlsFileKey(owner, id, childRel), file.stream(), mime, {
-                    contentLength: file.size,
-                });
-            }
-        }
-    };
-    await walk('');
-}
-export async function processPrivateVideo(opts) {
-    const { store, workDir, owner, id, sourcePath, setKey, onProgress } = opts;
-    const report = (s, p) => onProgress?.(s, p);
-    const failed = {
-        status: 'failed',
-        durationSeconds: 0,
-        hasHls: false,
-        wrappedContentKey: null,
-    };
-    // Private media MUST be encrypted — unlike public it can't degrade to a plaintext fallback.
-    if (!(await isFfmpegAvailable()))
-        return failed;
-    const jobDir = path.join(workDir, owner, id);
-    await mkdir(jobDir, { recursive: true });
-    try {
-        report('processing', 1);
-        const probe = await probeVideoStream(sourcePath);
-        // Mint the AES-128 content key + write the ffmpeg key-info file (key URI / key file / IV).
-        const content = generateContentKey();
-        const keyFile = path.join(jobDir, 'enc.key.bin');
-        await writeFile(keyFile, content.key);
-        const keyInfoFile = path.join(jobDir, 'enc.keyinfo');
-        await writeFile(keyInfoFile, `${KEY_URI}\n${keyFile}\n${content.iv.toString('hex')}\n`);
-        const heights = resolveLadder(opts.ladderHeights ?? [480, 720, 1080], probe.height);
-        const hlsDir = path.join(jobDir, 'hls');
-        await mkdir(hlsDir, { recursive: true });
-        const ok = await runFfmpegProgress(hlsLadderArgs(sourcePath, hlsDir, {
-            heights,
-            crf: Number(LIBRARY_CRF),
-            hasAudio: probe.hasAudio,
-            keyInfoFile,
-        }), probe.duration, (pct) => report('processing', Math.max(1, Math.min(98, pct))));
-        if (!ok)
-            return failed;
-        // Upload ONLY the encrypted segments + playlists — never the key file (served via the route).
-        await uploadTree(store, hlsDir, owner, id);
-        report('ready', 100);
-        return {
-            status: 'ready',
-            durationSeconds: probe.duration,
-            hasHls: (await store.stat(privateHlsMasterKey(owner, id))) !== null,
-            wrappedContentKey: wrapContentKey(setKey, content),
-        };
-    }
-    catch {
-        report('failed', 0);
-        return failed;
-    }
-    finally {
-        // Wipe the job dir — the plaintext source, the raw key file, and the outputs all vanish.
-        await rm(jobDir, { recursive: true, force: true }).catch(() => { });
-    }
-}
-export async function processPrivateBlob(opts) {
-    try {
-        const file = Bun.file(opts.sourcePath);
-        const sizeBytes = file.size; // CTR is length-preserving, so plaintext size == stored size
-        const content = generateContentKey();
-        await opts.store.putStream(privateSourceKey(opts.owner, opts.id), cryptBlobStream(content, file.stream()), 'application/octet-stream', { contentLength: sizeBytes });
-        return { status: 'ready', sizeBytes, wrappedContentKey: wrapContentKey(opts.setKey, content) };
-    }
-    catch {
-        return { status: 'failed', sizeBytes: 0, wrappedContentKey: null };
-    }
-}
-//# sourceMappingURL=pipeline.js.map

package/dist/server/private-media/pipeline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../../src/server/private-media/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/E,mFAAmF;AACnF,0FAA0F;AAC1F,+FAA+F;AAC/F,8FAA8F;AAC9F,+FAA+F;AAC/F,gGAAgG;AAChG,oGAAoG;AAEpG,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,qEAAqE;AAwBhG,KAAK,UAAU,UAAU,CAAC,KAAiB,EAAE,GAAW,EAAE,KAAa,EAAE,EAAU;IACjF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,YAAY,CAAC;gBACvF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChD,MAAM,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE;oBACjF,aAAa,EAAE,IAAI,CAAC,IAAI;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA2B;IAE3B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3E,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,CAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAyB;QACnC,MAAM,EAAE,QAAQ;QAChB,eAAe,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK;QACb,iBAAiB,EAAE,IAAI;KACxB,CAAC;IAEF,4FAA4F;IAC5F,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEjD,2FAA2F;QAC3F,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,OAAO,KAAK,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAChC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE;YAChC,OAAO;YACP,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;SACZ,CAAC,EACF,KAAK,CAAC,QAAQ,EACd,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAEvB,8FAA8F;QAC9F,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAE3C,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,eAAe,EAAE,KAAK,CAAC,QAAQ;YAC/B,MAAM,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;YACnE,iBAAiB,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC;SACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpB,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,yFAAyF;QACzF,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAOxC;IACC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,6DAA6D;QAC1F,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CACxB,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,EACrC,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EACvC,0BAA0B,EAC1B,EAAE,aAAa,EAAE,SAAS,EAAE,CAC7B,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;AACH,CAAC"}