emdash 1.2.0 → 1.3.0

package/dist/adapters-B4-nbElt.d.mts

@@ -1,173 +0,0 @@
-//#region src/db/adapters.d.ts
-/**
- * Database Adapter Functions
- *
- * These run at config time (astro.config.mjs) and return serializable descriptors.
- * The actual dialect is created at runtime by loading the entrypoint.
- *
- * @example
- * ```ts
- * // astro.config.mjs
- * import emdash from "emdash/astro";
- * import { sqlite } from "emdash/db";
- *
- * export default defineConfig({
- *   integrations: [
- *     emdash({
- *       database: sqlite({ url: "file:./data.db" }),
- *     }),
- *   ],
- * });
- * ```
- */
-/**
- * Dialect family identifier.
- * Used at runtime to select dialect-specific SQL fragments.
- */
-type DatabaseDialectType = "sqlite" | "postgres";
-type CollectionDeletionGuardInput = {
-  action: "fence";
-  collectionId: string;
-  collectionSlug: string;
-  leaseToken: string;
-  forceDelete: boolean;
-} | {
-  action: "drop";
-  collectionId: string;
-  collectionSlug: string;
-  leaseToken: string;
-};
-type CollectionDeletionGuardResult = {
-  outcome: "fenced";
-} | {
-  outcome: "has_content";
-} | {
-  outcome: "stale";
-} | {
-  outcome: "dropped";
-};
-type ExecuteCollectionDeletionGuard = (config: unknown, input: CollectionDeletionGuardInput) => Promise<CollectionDeletionGuardResult>;
-/**
- * Database descriptor - serializable config for virtual modules
- */
-interface DatabaseDescriptor {
-  entrypoint: string;
-  config: unknown;
-  type: DatabaseDialectType;
-  /** Deployment migration capability with configuration safe for a build artifact. */
-  migrations?: {
-    entrypoint: string;
-    manifestConfig: unknown;
-  };
-  /**
-   * When true, the adapter's runtime entrypoint MUST export a named
-   * `createRequestScopedDb` function matching the signature declared in
-   * `virtual:emdash/dialect`. The virtual-module generator re-exports it
-   * by name, so a missing export becomes a build-time bundler error.
-   *
-   * The function is called once per request and decides — based on its own
-   * runtime config (e.g. whether the user opted into D1 sessions) — whether
-   * to return a per-request Kysely or null. Use this for features like D1
-   * read-replica sessions, bookmark cookies, or any per-request DB handle.
-   * The handle must address the configured database: core shares values it
-   * caches from one handle, such as the preview secret, with later requests.
-   *
-   * When false or absent, the generator emits a stub that returns null and
-   * the middleware takes its default (singleton) path.
-   */
-  supportsRequestScope?: boolean;
-  /**
-   * When true, request middleware resolves the last content-namespace
-   * invalidation timestamp and passes it to `createRequestScopedDb`.
-   *
-   * Keep this unset unless request routing depends on that timestamp: reading
-   * it may require an object-cache backend round trip.
-   */
-  needsLastContentWriteAt?: boolean;
-  /**
-   * When true, the adapter's runtime entrypoint MUST export a named
-   * `createCoalescingDialect` function. The runtime uses this fresh dialect
-   * only for its cold-start read batch.
-   *
-   * When false or absent, the virtual module exports `undefined` without
-   * inspecting an optional entrypoint export.
-   */
-  supportsCoalescing?: boolean;
-  /** The runtime entrypoint exports the deletion-specific atomic guard. */
-  supportsCollectionDeletionGuard?: boolean;
-}
-interface SqliteConfig {
-  /**
-   * Database URL (e.g., "file:./data.db")
-   */
-  url: string;
-}
-interface LibsqlConfig {
-  /**
-   * Database URL (e.g., "file:./data.db" or "libsql://...")
-   */
-  url: string;
-  /**
-   * Auth token for remote libSQL
-   */
-  authToken?: string;
-  migrationAuthTokenEnv?: string;
-}
-/**
- * SQLite database adapter (node:sqlite)
- *
- * For local development and Node.js deployments. Requires Node.js 22.16 or later.
- *
- * @example
- * ```ts
- * database: sqlite({ url: "file:./data.db" })
- * ```
- */
-declare function sqlite(config: SqliteConfig): DatabaseDescriptor;
-/**
- * libSQL database adapter (Turso)
- *
- * For Turso hosted databases or local libSQL.
- *
- * @example
- * ```ts
- * database: libsql({
- *   url: "libsql://my-db.turso.io",
- *   authToken: process.env.TURSO_AUTH_TOKEN,
- * })
- * ```
- */
-declare function libsql(config: LibsqlConfig): DatabaseDescriptor;
-/**
- * PostgreSQL connection configuration
- */
-interface PostgresConfig {
-  connectionString?: string;
-  host?: string;
-  port?: number;
-  database?: string;
-  user?: string;
-  password?: string;
-  ssl?: boolean;
-  pool?: {
-    min?: number;
-    max?: number; /** Maximum time to wait for a connection, in milliseconds. Uses the pg default when omitted. */
-    connectionTimeoutMillis?: number; /** Time before an idle client is closed, in milliseconds. Uses the pg default when omitted. */
-    idleTimeoutMillis?: number;
-  };
-  migrationConnectionStringEnv?: string;
-}
-/**
- * PostgreSQL database adapter
- *
- * For PostgreSQL deployments with connection pooling.
- *
- * @example
- * ```ts
- * database: postgres({ connectionString: process.env.DATABASE_URL })
- * ```
- */
-declare function postgres(config: PostgresConfig): DatabaseDescriptor;
-//#endregion
-export { ExecuteCollectionDeletionGuard as a, SqliteConfig as c, sqlite as d, DatabaseDialectType as i, libsql as l, CollectionDeletionGuardResult as n, LibsqlConfig as o, DatabaseDescriptor as r, PostgresConfig as s, CollectionDeletionGuardInput as t, postgres as u };
-//# sourceMappingURL=adapters-B4-nbElt.d.mts.map

package/dist/adapters-B4-nbElt.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapters-B4-nbElt.d.mts","names":[],"sources":["../src/db/adapters.ts"],"mappings":";;AA0BA;;;;;AAEA;;;;;;;;;;;;;;;AAeA;;;;AAAA,KAjBY,mBAAA;AAAA,KAEA,4BAAA;EAET,MAAA;EACA,YAAA;EACA,cAAA;EACA,UAAA;EACA,WAAA;AAAA;EAGA,MAAA;EACA,YAAA;EACA,cAAA;EACA,UAAA;AAAA;AAAA,KAGS,6BAAA;EACP,OAAA;AAAA;EACA,OAAA;AAAA;EACA,OAAA;AAAA;EACA,OAAA;AAAA;AAAA,KAEO,8BAAA,IACX,MAAA,WACA,KAAA,EAAO,4BAAA,KACH,OAAA,CAAQ,6BAAA;;;;UAmBI,kBAAA;EAChB,UAAA;EACA,MAAA;EACA,IAAA,EAAM,mBAAA;EAGL;EADD,UAAA;IACC,UAAA;IACA,cAAA;EAAA;EAqCD;;;AAGD;;;;;AAOA;;;;;;;;EA7BC,oBAAA;EAmDe;;;;;;;EA3Cf,uBAAA;EA2C+D;AAyBhE;;;;;;;EA3DC,kBAAA;EA2D+D;EAzD/D,+BAAA;AAAA;AAAA,UAGgB,YAAA;EA6Ec;;;EAzE9B,GAAA;AAAA;AAAA,UAGgB,YAAA;EA4EhB;;;EAxEA,GAAA;EA4EC;;;EAxED,SAAA;EACA,qBAAA;AAAA;AA0FD;;;;;;;;;;AAAA,iBA7EgB,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;;;;;;;;;;;iBAyB9B,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;UAuB7B,cAAA;EAChB,gBAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,GAAA;EACA,IAAA;IACC,GAAA;IACA,GAAA;IAEA,uBAAA;IAEA,iBAAA;EAAA;EAED,4BAAA;AAAA;;;;;;;;;;;iBAae,QAAA,CAAS,MAAA,EAAQ,cAAA,GAAiB,kBAAA"}

package/dist/allowed-origins-CLpHGGlc.mjs

@@ -1,116 +0,0 @@
-import { n as getEnvAllowedOrigins } from "./public-url-uT1Ok2Tu.mjs";
-
-//#region src/auth/allowed-origins.ts
-/**
-* Resolution and validation of multi-origin passkey verification.
-*
-* `allowedOrigins` lets one EmDash deployment accept passkey assertions from
-* several hostnames sharing the same `rpId` (e.g. apex + preview/staging
-* subdomains under one registrable parent). Origins come from two sources:
-*
-*   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)
-*   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)
-*
-* Sources are merged (union of permissions, deduplicated). Each entry is
-* validated against `siteUrl` to fail loud on dead config the browser would
-* never honor.
-*/
-/**
-* Collect raw allowedOrigins from config and env, source-tagged.
-*
-* Returns raw values — the caller is expected to pass the result through
-* `validateAllowedOrigins()` before use in passkey verification.
-*/
-function getConfiguredAllowedOrigins(config) {
-	const tagged = [];
-	if (config?.allowedOrigins) {
-		for (const origin of config.allowedOrigins) if (origin) tagged.push({
-			origin,
-			source: "config.allowedOrigins"
-		});
-	}
-	for (const origin of getEnvAllowedOrigins()) tagged.push({
-		origin,
-		source: "EMDASH_ALLOWED_ORIGINS"
-	});
-	return tagged;
-}
-/**
-* Validate per-entry shape rules (no `siteUrl` needed):
-*   - parses as `URL`
-*   - protocol is `http:` or `https:`
-*   - hostname has no trailing dot (`example.com.` rejected)
-*   - hostname has no empty labels (`foo..example.com` rejected)
-*
-* Returns the deduplicated, normalized origin form (`URL.origin`) of every
-* input, in input order. Throws on the first violation with a source-tagged
-* error message.
-*/
-function validateOriginShape(tagged) {
-	const normalized = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const { origin, source } of tagged) {
-		let parsed;
-		try {
-			parsed = new URL(origin);
-		} catch (e) {
-			throw configError(source, `invalid URL: "${origin}"`, e);
-		}
-		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw configError(source, `origin must be http or https: "${origin}" (got ${parsed.protocol})`);
-		if (parsed.hostname.endsWith(".")) throw configError(source, `hostname has a trailing dot: "${origin}". Remove the trailing dot — assertion origins from the browser do not include it.`);
-		if (parsed.hostname.split(".").includes("")) throw configError(source, `hostname has empty labels: "${origin}"`);
-		if (!seen.has(parsed.origin)) {
-			seen.add(parsed.origin);
-			normalized.push(parsed.origin);
-		}
-	}
-	return normalized;
-}
-/**
-* Validate the effective merged allowedOrigins set against `siteUrl`.
-*
-* Performs `validateOriginShape()` plus the siteUrl-dependent rules:
-*   - Rule A: non-empty origins ⇒ `siteUrl` is set
-*   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)
-*   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)
-*   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain
-*
-* Throws on first violation. Returns the deduplicated normalized origins.
-*
-* Use this at the runtime chokepoint (where config + env are merged into the
-* effective set). At Astro integration init, prefer `validateOriginShape()`
-* for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be
-* supplied at runtime via `EMDASH_SITE_URL`.
-*/
-function validateAllowedOrigins(siteUrl, tagged) {
-	const normalized = validateOriginShape(tagged);
-	if (normalized.length === 0) return normalized;
-	if (!siteUrl) throw new Error(`EmDash config error: allowedOrigins is set (${normalized.length} ${normalized.length === 1 ? "entry" : "entries"}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`);
-	let siteHost;
-	try {
-		siteHost = new URL(siteUrl).hostname;
-	} catch (e) {
-		throw new Error(`EmDash config error: siteUrl is not a valid URL: "${siteUrl}"`, { cause: e });
-	}
-	if (siteHost.endsWith(".")) throw new Error(`EmDash config error: siteUrl "${siteUrl}" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`);
-	if (isIPLiteralHostname(siteHost)) throw new Error(`EmDash config error: siteUrl "${siteUrl}" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`);
-	for (const { origin, source } of tagged) {
-		const h = new URL(origin).hostname;
-		if (h !== siteHost && !h.endsWith("." + siteHost)) throw configError(source, `"${origin}" is not a subdomain of siteUrl "${siteUrl}". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`);
-	}
-	return normalized;
-}
-function configError(source, detail, cause) {
-	const err = /* @__PURE__ */ new Error(`EmDash config error in ${source}: ${detail}`);
-	if (cause !== void 0) err.cause = cause;
-	return err;
-}
-const IPV4_DOTTED_DECIMAL_RE = /^\d+(\.\d+){3}$/;
-function isIPLiteralHostname(h) {
-	if (h.startsWith("[")) return true;
-	return IPV4_DOTTED_DECIMAL_RE.test(h);
-}
-
-//#endregion
-export { validateAllowedOrigins as n, validateOriginShape as r, getConfiguredAllowedOrigins as t };
-//# sourceMappingURL=allowed-origins-CLpHGGlc.mjs.map

package/dist/allowed-origins-CLpHGGlc.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowed-origins-CLpHGGlc.mjs","names":[],"sources":["../src/auth/allowed-origins.ts"],"sourcesContent":["/**\n * Resolution and validation of multi-origin passkey verification.\n *\n * `allowedOrigins` lets one EmDash deployment accept passkey assertions from\n * several hostnames sharing the same `rpId` (e.g. apex + preview/staging\n * subdomains under one registrable parent). Origins come from two sources:\n *\n *   - `EmDashConfig.allowedOrigins` (declared in `astro.config.mjs`)\n *   - `EMDASH_ALLOWED_ORIGINS` (comma-separated runtime env var)\n *\n * Sources are merged (union of permissions, deduplicated). Each entry is\n * validated against `siteUrl` to fail loud on dead config the browser would\n * never honor.\n */\n\nimport { getEnvAllowedOrigins } from \"../api/public-url.js\";\nimport type { EmDashConfig } from \"../astro/integration/runtime.js\";\n\nexport type AllowedOriginSource = \"config.allowedOrigins\" | \"EMDASH_ALLOWED_ORIGINS\";\n\nexport interface TaggedOrigin {\n\t/** Raw entry as declared by the operator. */\n\torigin: string;\n\t/** Where the entry came from (used for source-attributed errors). */\n\tsource: AllowedOriginSource;\n}\n\n/**\n * Collect raw allowedOrigins from config and env, source-tagged.\n *\n * Returns raw values — the caller is expected to pass the result through\n * `validateAllowedOrigins()` before use in passkey verification.\n */\nexport function getConfiguredAllowedOrigins(config?: EmDashConfig): TaggedOrigin[] {\n\tconst tagged: TaggedOrigin[] = [];\n\tif (config?.allowedOrigins) {\n\t\tfor (const origin of config.allowedOrigins) {\n\t\t\tif (origin) tagged.push({ origin, source: \"config.allowedOrigins\" });\n\t\t}\n\t}\n\tfor (const origin of getEnvAllowedOrigins()) {\n\t\ttagged.push({ origin, source: \"EMDASH_ALLOWED_ORIGINS\" });\n\t}\n\treturn tagged;\n}\n\n/**\n * Validate per-entry shape rules (no `siteUrl` needed):\n *   - parses as `URL`\n *   - protocol is `http:` or `https:`\n *   - hostname has no trailing dot (`example.com.` rejected)\n *   - hostname has no empty labels (`foo..example.com` rejected)\n *\n * Returns the deduplicated, normalized origin form (`URL.origin`) of every\n * input, in input order. Throws on the first violation with a source-tagged\n * error message.\n */\nexport function validateOriginShape(tagged: TaggedOrigin[]): string[] {\n\tconst normalized: string[] = [];\n\tconst seen = new Set<string>();\n\tfor (const { origin, source } of tagged) {\n\t\tlet parsed: URL;\n\t\ttry {\n\t\t\tparsed = new URL(origin);\n\t\t} catch (e) {\n\t\t\tthrow configError(source, `invalid URL: \"${origin}\"`, e);\n\t\t}\n\t\tif (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`origin must be http or https: \"${origin}\" (got ${parsed.protocol})`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.endsWith(\".\")) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`hostname has a trailing dot: \"${origin}\". Remove the trailing dot — assertion origins from the browser do not include it.`,\n\t\t\t);\n\t\t}\n\t\tif (parsed.hostname.split(\".\").includes(\"\")) {\n\t\t\tthrow configError(source, `hostname has empty labels: \"${origin}\"`);\n\t\t}\n\t\tif (!seen.has(parsed.origin)) {\n\t\t\tseen.add(parsed.origin);\n\t\t\tnormalized.push(parsed.origin);\n\t\t}\n\t}\n\treturn normalized;\n}\n\n/**\n * Validate the effective merged allowedOrigins set against `siteUrl`.\n *\n * Performs `validateOriginShape()` plus the siteUrl-dependent rules:\n *   - Rule A: non-empty origins ⇒ `siteUrl` is set\n *   - `siteUrl` hostname is not an IP literal (multi-origin requires a domain)\n *   - `siteUrl` hostname has no trailing dot (cannot match assertion origins)\n *   - Rule B: each origin's hostname is `siteHost` exactly or a subdomain\n *\n * Throws on first violation. Returns the deduplicated normalized origins.\n *\n * Use this at the runtime chokepoint (where config + env are merged into the\n * effective set). At Astro integration init, prefer `validateOriginShape()`\n * for shape-only checks on `config.allowedOrigins`, since `siteUrl` may be\n * supplied at runtime via `EMDASH_SITE_URL`.\n */\nexport function validateAllowedOrigins(\n\tsiteUrl: string | undefined,\n\ttagged: TaggedOrigin[],\n): string[] {\n\tconst normalized = validateOriginShape(tagged);\n\tif (normalized.length === 0) return normalized;\n\n\tif (!siteUrl) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: allowedOrigins is set (${normalized.length} ${\n\t\t\t\tnormalized.length === 1 ? \"entry\" : \"entries\"\n\t\t\t}) but siteUrl is not. Without a canonical siteUrl, rpId is derived from the request hostname, defeating multi-origin passkeys. Set siteUrl in astro.config.mjs or via EMDASH_SITE_URL.`,\n\t\t);\n\t}\n\n\tlet siteHost: string;\n\ttry {\n\t\tsiteHost = new URL(siteUrl).hostname;\n\t} catch (e) {\n\t\tthrow new Error(`EmDash config error: siteUrl is not a valid URL: \"${siteUrl}\"`, {\n\t\t\tcause: e,\n\t\t});\n\t}\n\n\tif (siteHost.endsWith(\".\")) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" has a trailing-dot hostname, which cannot match assertion origins. Remove the trailing dot when using allowedOrigins.`,\n\t\t);\n\t}\n\tif (isIPLiteralHostname(siteHost)) {\n\t\tthrow new Error(\n\t\t\t`EmDash config error: siteUrl \"${siteUrl}\" uses an IP-literal hostname. Multi-origin passkeys require a domain-based siteUrl — IP addresses cannot have valid subdomains for WebAuthn rpId.`,\n\t\t);\n\t}\n\n\tfor (const { origin, source } of tagged) {\n\t\tconst h = new URL(origin).hostname;\n\t\tif (h !== siteHost && !h.endsWith(\".\" + siteHost)) {\n\t\t\tthrow configError(\n\t\t\t\tsource,\n\t\t\t\t`\"${origin}\" is not a subdomain of siteUrl \"${siteUrl}\". Allowed origins must be the same hostname as siteUrl or a subdomain of it.`,\n\t\t\t);\n\t\t}\n\t}\n\n\treturn normalized;\n}\n\nfunction configError(source: AllowedOriginSource, detail: string, cause?: unknown): Error {\n\tconst err = new Error(`EmDash config error in ${source}: ${detail}`);\n\tif (cause !== undefined) (err as Error & { cause?: unknown }).cause = cause;\n\treturn err;\n}\n\nconst IPV4_DOTTED_DECIMAL_RE = /^\\d+(\\.\\d+){3}$/;\n\nfunction isIPLiteralHostname(h: string): boolean {\n\t// IPv6 hostnames are bracketed by URL.hostname, e.g. \"[::1]\"\n\tif (h.startsWith(\"[\")) return true;\n\t// IPv4 dotted-decimal\n\treturn IPV4_DOTTED_DECIMAL_RE.test(h);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCA,SAAgB,4BAA4B,QAAuC;CAClF,MAAM,SAAyB,EAAE;AACjC,KAAI,QAAQ,gBACX;OAAK,MAAM,UAAU,OAAO,eAC3B,KAAI,OAAQ,QAAO,KAAK;GAAE;GAAQ,QAAQ;GAAyB,CAAC;;AAGtE,MAAK,MAAM,UAAU,sBAAsB,CAC1C,QAAO,KAAK;EAAE;EAAQ,QAAQ;EAA0B,CAAC;AAE1D,QAAO;;;;;;;;;;;;;AAcR,SAAgB,oBAAoB,QAAkC;CACrE,MAAM,aAAuB,EAAE;CAC/B,MAAM,uBAAO,IAAI,KAAa;AAC9B,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,IAAI;AACJ,MAAI;AACH,YAAS,IAAI,IAAI,OAAO;WAChB,GAAG;AACX,SAAM,YAAY,QAAQ,iBAAiB,OAAO,IAAI,EAAE;;AAEzD,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,SACtD,OAAM,YACL,QACA,kCAAkC,OAAO,SAAS,OAAO,SAAS,GAClE;AAEF,MAAI,OAAO,SAAS,SAAS,IAAI,CAChC,OAAM,YACL,QACA,iCAAiC,OAAO,oFACxC;AAEF,MAAI,OAAO,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,CAC1C,OAAM,YAAY,QAAQ,+BAA+B,OAAO,GAAG;AAEpE,MAAI,CAAC,KAAK,IAAI,OAAO,OAAO,EAAE;AAC7B,QAAK,IAAI,OAAO,OAAO;AACvB,cAAW,KAAK,OAAO,OAAO;;;AAGhC,QAAO;;;;;;;;;;;;;;;;;;AAmBR,SAAgB,uBACf,SACA,QACW;CACX,MAAM,aAAa,oBAAoB,OAAO;AAC9C,KAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,KAAI,CAAC,QACJ,OAAM,IAAI,MACT,+CAA+C,WAAW,OAAO,GAChE,WAAW,WAAW,IAAI,UAAU,UACpC,wLACD;CAGF,IAAI;AACJ,KAAI;AACH,aAAW,IAAI,IAAI,QAAQ,CAAC;UACpB,GAAG;AACX,QAAM,IAAI,MAAM,qDAAqD,QAAQ,IAAI,EAChF,OAAO,GACP,CAAC;;AAGH,KAAI,SAAS,SAAS,IAAI,CACzB,OAAM,IAAI,MACT,iCAAiC,QAAQ,yHACzC;AAEF,KAAI,oBAAoB,SAAS,CAChC,OAAM,IAAI,MACT,iCAAiC,QAAQ,oJACzC;AAGF,MAAK,MAAM,EAAE,QAAQ,YAAY,QAAQ;EACxC,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC;AAC1B,MAAI,MAAM,YAAY,CAAC,EAAE,SAAS,MAAM,SAAS,CAChD,OAAM,YACL,QACA,IAAI,OAAO,mCAAmC,QAAQ,+EACtD;;AAIH,QAAO;;AAGR,SAAS,YAAY,QAA6B,QAAgB,OAAwB;CACzF,MAAM,sBAAM,IAAI,MAAM,0BAA0B,OAAO,IAAI,SAAS;AACpE,KAAI,UAAU,OAAW,CAAC,IAAoC,QAAQ;AACtE,QAAO;;AAGR,MAAM,yBAAyB;AAE/B,SAAS,oBAAoB,GAAoB;AAEhD,KAAI,EAAE,WAAW,IAAI,CAAE,QAAO;AAE9B,QAAO,uBAAuB,KAAK,EAAE"}