framefields 2.12.0 → 2.13.0

package/dist/dist-CiTgmfUw.mjs

@@ -0,0 +1,502 @@
+import { createReadStream, createWriteStream, existsSync } from "node:fs";
+import { dirname, join, relative, sep } from "node:path";
+import { mkdir, open, readFile, rename, rm } from "node:fs/promises";
+import { createHash, randomBytes } from "node:crypto";
+import { AwsClient } from "aws4fetch";
+import { Readable, Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+
+//#region ../storage/dist/index.mjs
+/**
+* Hashing and verified downloads: every byte an asset contributes is checked
+* against the sha256 its manifest entry pins.
+*/
+var AssetError = class extends Error {
+	name = "AssetError";
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+	}
+};
+async function hashFile(path$1) {
+	const hash = createHash("sha256");
+	let size = 0;
+	for await (const chunk of createReadStream(path$1)) {
+		hash.update(chunk);
+		size += chunk.length;
+	}
+	return {
+		sha256: hash.digest("hex"),
+		size
+	};
+}
+/**
+* Downloads `url` to `dest` through a temporary file, and only renames it
+* into place once its size and sha256 match `expected`.
+*/
+async function downloadVerified(url, dest, expected, options = {}) {
+	const attempts = options.attempts ?? 3;
+	for (let attempt = 1;; attempt++) try {
+		await downloadOnce(url, dest, expected, options);
+		return;
+	} catch (err) {
+		if (!(err instanceof AssetError ? err.code === "ASSET_DOWNLOAD_FAILED" : !options.signal?.aborted) || attempt >= attempts) throw err;
+		await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));
+	}
+}
+async function downloadOnce(url, dest, expected, options) {
+	const shown = redactQuery(url);
+	const res = await (options.fetch ?? fetch)(url, { signal: options.signal });
+	if (!res.ok || !res.body) {
+		await res.body?.cancel();
+		if (res.status === 404) throw new AssetError("ASSET_NOT_FOUND", `${shown} returned 404`);
+		if (res.status === 401 || res.status === 403) throw new AssetError("ASSET_FORBIDDEN", `${shown} returned ${res.status}: the bucket isn't public there, or the signed URL expired`);
+		throw new AssetError("ASSET_DOWNLOAD_FAILED", `${shown} returned ${res.status}`);
+	}
+	await mkdir(dirname(dest), { recursive: true });
+	const temp = `${dest}.${randomBytes(4).toString("hex")}.part`;
+	const hash = createHash("sha256");
+	let size = 0;
+	const tap = new Transform({ transform(chunk, _encoding, done) {
+		size += chunk.length;
+		if (size > expected.size) return done(new AssetError("ASSET_HASH_MISMATCH", `${shown} is larger than the ${expected.size} bytes framefields.json pins`));
+		hash.update(chunk);
+		done(null, chunk);
+	} });
+	try {
+		await pipeline(Readable.fromWeb(res.body), tap, createWriteStream(temp), { signal: options.signal }).catch((err) => {
+			if (err instanceof AssetError || options.signal?.aborted) throw err;
+			throw new AssetError("ASSET_DOWNLOAD_FAILED", `${shown}: ${err.message}`, { cause: err });
+		});
+		const sha256 = hash.digest("hex");
+		if (size !== expected.size || sha256 !== expected.sha256) throw new AssetError("ASSET_HASH_MISMATCH", `${shown} is not the file framefields.json pins (got ${size} bytes, sha256 ${sha256.slice(0, 12)}…; expected ${expected.size} bytes, ${expected.sha256.slice(0, 12)}…)`);
+		await rename(temp, dest);
+	} finally {
+		await rm(temp, { force: true });
+	}
+}
+/** Signed URLs carry credentials in the query: never print them. */
+function redactQuery(url) {
+	const q = url.indexOf("?");
+	return q < 0 ? url : `${url.slice(0, q)}?…`;
+}
+const TYPES = {
+	mp4: "video/mp4",
+	m4v: "video/mp4",
+	mov: "video/quicktime",
+	webm: "video/webm",
+	mkv: "video/x-matroska",
+	mp3: "audio/mpeg",
+	m4a: "audio/mp4",
+	aac: "audio/aac",
+	wav: "audio/wav",
+	flac: "audio/flac",
+	ogg: "audio/ogg",
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	webp: "image/webp",
+	avif: "image/avif",
+	gif: "image/gif",
+	svg: "image/svg+xml",
+	json: "application/json",
+	lottie: "application/zip",
+	glb: "model/gltf-binary",
+	gltf: "model/gltf+json",
+	ttf: "font/ttf",
+	otf: "font/otf",
+	woff2: "font/woff2",
+	cube: "text/plain",
+	srt: "text/plain",
+	vtt: "text/vtt"
+};
+/** The Content-Type a CDN serves the file with. */
+function contentType(path$1) {
+	return TYPES[path$1.slice(path$1.lastIndexOf(".") + 1).toLowerCase()] ?? "application/octet-stream";
+}
+const REMOTE_NAME = /^[A-Za-z0-9][\w-]{0,63}$/;
+const SHA256 = /^[0-9a-f]{64}$/;
+const FILE$1 = "framefields.json";
+var ManifestError = class extends Error {
+	name = "ManifestError";
+};
+/** Validates `storage`; errors name the remote and field at fault. */
+function parseStorage(value) {
+	if (!isRecord(value) || !isRecord(value.remotes)) throw new ManifestError(`${FILE$1}: "storage" needs "remotes", e.g. { "remotes": { "media": { "endpoint": "https://<account>.r2.cloudflarestorage.com", "bucket": "films" } } }`);
+	const remotes = {};
+	for (const [name, spec] of Object.entries(value.remotes)) remotes[name] = parseRemote(name, spec);
+	const names = Object.keys(remotes);
+	if (names.length === 0) throw new ManifestError(`${FILE$1}: "storage.remotes" is empty`);
+	if (value.default !== void 0 && !names.includes(value.default)) throw new ManifestError(`${FILE$1}: "storage.default" must name a remote (${names.join(", ")})`);
+	return {
+		...typeof value.default === "string" && { default: value.default },
+		remotes
+	};
+}
+function parseRemote(name, spec) {
+	const fail = (message) => {
+		throw new ManifestError(`${FILE$1}: storage.remotes.${name} ${message}`);
+	};
+	if (!REMOTE_NAME.test(name)) fail("has an invalid name: use letters, digits, - and _ (at most 64)");
+	if (!isRecord(spec)) fail("must be an object with an endpoint and a bucket");
+	const s = spec;
+	if (!isHttpUrl(s.endpoint)) fail("needs \"endpoint\": the S3 API URL, e.g. \"https://<account>.r2.cloudflarestorage.com\"");
+	if (typeof s.bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,62}$/.test(s.bucket)) fail("needs \"bucket\": the bucket name");
+	if (s.region !== void 0 && typeof s.region !== "string") fail("\"region\" must be a string");
+	if (s.prefix !== void 0 && (typeof s.prefix !== "string" || s.prefix.startsWith("/") || s.prefix.split("/").includes(".."))) fail("\"prefix\" must be a key prefix such as \"films/launch/\"");
+	if (s.publicUrl !== void 0 && !isHttpUrl(s.publicUrl)) fail("\"publicUrl\" must be an http(s) URL, e.g. \"https://media.example.com\"");
+	return {
+		endpoint: s.endpoint,
+		bucket: s.bucket,
+		...s.region !== void 0 && { region: s.region },
+		...typeof s.prefix === "string" && s.prefix && { prefix: normalizePrefix(s.prefix) },
+		...s.publicUrl !== void 0 && { publicUrl: s.publicUrl }
+	};
+}
+/** Validates `assets`; errors name the path and field at fault. */
+function parseAssets(value, storage) {
+	if (!isRecord(value)) throw new ManifestError(`${FILE$1}: "assets" must map project paths to { "sha256", "size" }`);
+	const out = {};
+	for (const [path$1, entry] of Object.entries(value)) {
+		const fail = (message) => {
+			throw new ManifestError(`${FILE$1}: assets["${path$1}"] ${message}`);
+		};
+		if (!isAssetPath(path$1)) fail("must be a path inside the project, e.g. assets/footage/intro.mp4");
+		if (!isRecord(entry)) fail("must be { \"sha256\", \"size\" }");
+		const e = entry;
+		if (typeof e.sha256 !== "string" || !SHA256.test(e.sha256)) fail("needs \"sha256\": 64 lowercase hex digits");
+		if (typeof e.size !== "number" || !Number.isSafeInteger(e.size) || e.size < 0) fail("needs \"size\" in bytes");
+		if (e.url !== void 0 && !isHttpUrl(e.url)) fail("\"url\" must be an http(s) URL");
+		if (e.remote !== void 0) {
+			if (typeof e.remote !== "string" || !storage?.remotes[e.remote]) fail(`"remote" must name a remote in "storage.remotes"`);
+		} else if (e.url === void 0 && !storage) fail("needs a \"url\", or a \"storage\" section with a remote to hold it");
+		out[path$1] = {
+			sha256: e.sha256,
+			size: e.size,
+			...e.remote !== void 0 && { remote: e.remote },
+			...e.url !== void 0 && { url: e.url }
+		};
+	}
+	return out;
+}
+/** The remote an asset (or a new one, without `name`) belongs to. */
+function pickRemote(storage, name) {
+	const names = Object.keys(storage?.remotes ?? {});
+	const chosen = name ?? storage?.default ?? (names.length === 1 ? names[0] : void 0);
+	if (!storage || names.length === 0) throw new ManifestError(`${FILE$1} has no "storage" remotes: add one (an R2 or S3 bucket) first`);
+	if (!chosen) throw new ManifestError(`${FILE$1}: name the remote (${names.join(", ")}), or set "storage.default"`);
+	const remote = storage.remotes[chosen];
+	if (!remote) throw new ManifestError(`${FILE$1}: no remote named "${chosen}" (${names.join(", ")})`);
+	return {
+		name: chosen,
+		remote
+	};
+}
+/** The object key holding `sha256`: `<prefix>sha256/ab/<hash>`. */
+function objectKey(sha256, prefix = "") {
+	return `${prefix}sha256/${sha256.slice(0, 2)}/${sha256}`;
+}
+/** The asset's URL on the remote's public domain, if it has one. */
+function publicUrl(remote, sha256) {
+	if (!remote.publicUrl) return void 0;
+	return `${remote.publicUrl.replace(/\/+$/, "")}/${objectKey(sha256, remote.prefix)}`;
+}
+/**
+* Where to download an asset without credentials: a signed URL handed in
+* (`signed`, by sha256), its own `url`, or its remote's public domain.
+* Undefined means the asset is on a private remote and needs a signature.
+*/
+function readUrl(entry, storage, signed) {
+	const given = signed?.[entry.sha256];
+	if (given) return given;
+	if (entry.url) return entry.url;
+	if (!storage) return void 0;
+	return publicUrl(pickRemote(storage, entry.remote).remote, entry.sha256);
+}
+function isAssetPath(path$1) {
+	return path$1.length > 0 && path$1.length <= 1024 && !path$1.startsWith("/") && !path$1.includes("\\") && !path$1.split("/").some((part) => part === "" || part === "." || part === "..");
+}
+function normalizePrefix(prefix) {
+	return prefix.endsWith("/") ? prefix : `${prefix}/`;
+}
+function isHttpUrl(value) {
+	if (typeof value !== "string") return false;
+	try {
+		const { protocol } = new URL(value);
+		return protocol === "https:" || protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The few S3 calls asset storage needs (HEAD, PUT, multipart upload,
+* presigned GET), signed with SigV4 by aws4fetch. Works with any
+* S3-compatible service; R2 is the one to pick, since it charges no egress.
+*/
+/**
+* Keys for `remote` from the environment:
+* `FRAMEFIELDS_STORAGE_<REMOTE>_ACCESS_KEY_ID` / `…_SECRET_ACCESS_KEY`
+* (the remote's name upper-cased, `-` as `_`), else the standard
+* `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`.
+*/
+function credentialsFromEnv(remote, env = process.env) {
+	const scope = `FRAMEFIELDS_STORAGE_${remote.toUpperCase().replace(/-/g, "_")}`;
+	const own = env[`${scope}_ACCESS_KEY_ID`];
+	const ownSecret = env[`${scope}_SECRET_ACCESS_KEY`];
+	if (own && ownSecret) return {
+		accessKeyId: own,
+		secretAccessKey: ownSecret
+	};
+	const id = env.AWS_ACCESS_KEY_ID;
+	const secret = env.AWS_SECRET_ACCESS_KEY;
+	if (!id || !secret) return void 0;
+	return {
+		accessKeyId: id,
+		secretAccessKey: secret,
+		...env.AWS_SESSION_TOKEN && { sessionToken: env.AWS_SESSION_TOKEN }
+	};
+}
+/** The env vars `credentialsFromEnv` reads for `remote`, for messages. */
+function credentialEnvNames(remote) {
+	const scope = `FRAMEFIELDS_STORAGE_${remote.toUpperCase().replace(/-/g, "_")}`;
+	return [`${scope}_ACCESS_KEY_ID`, `${scope}_SECRET_ACCESS_KEY`];
+}
+var StorageError = class extends Error {
+	name = "StorageError";
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+const MiB = 1024 * 1024;
+/**
+* Content-addressed objects never change: CDNs and browsers may keep them
+* forever, which is what makes a custom domain in front of the bucket cheap.
+*/
+const IMMUTABLE = "public, max-age=31536000, immutable";
+/** One remote's bucket, signed with `credentials`. */
+var Bucket = class {
+	aws;
+	fetch;
+	constructor(remote, credentials, options = {}) {
+		this.remote = remote;
+		this.options = options;
+		this.aws = new AwsClient({
+			...credentials,
+			service: "s3",
+			region: remote.region ?? "auto",
+			retries: 3
+		});
+		this.fetch = options.fetch ?? fetch;
+	}
+	keyFor(sha256) {
+		return objectKey(sha256, this.remote.prefix);
+	}
+	/** Whether the bucket holds `sha256` at the expected size. */
+	async has(sha256, size) {
+		const res = await this.send(this.keyFor(sha256), { method: "HEAD" });
+		if (res.status === 404) return false;
+		if (!res.ok) throw await this.failure("HEAD", res);
+		return Number(res.headers.get("content-length")) === size;
+	}
+	/**
+	* Uploads `file` (already hashed) under its content key. The bucket
+	* checks every byte against the sha256 sent with it.
+	*/
+	async upload(file, digest, onProgress) {
+		const key = this.keyFor(digest.sha256);
+		const headers = {
+			"content-type": contentType(file),
+			"cache-control": IMMUTABLE
+		};
+		const threshold = this.options.multipartThreshold ?? 64 * MiB;
+		if (digest.size <= threshold) {
+			const handle = await open(file);
+			try {
+				const body = await handle.readFile();
+				await this.put(key, body, digest.sha256, headers);
+			} finally {
+				await handle.close();
+			}
+			onProgress?.({
+				sent: digest.size,
+				total: digest.size
+			});
+			return;
+		}
+		await this.uploadParts(file, key, digest.size, headers, onProgress);
+	}
+	/** A GET URL anyone can use until it expires (at most 7 days). */
+	async presign(sha256, expiresSec = 86400) {
+		const url = new URL(this.url(this.keyFor(sha256)));
+		url.searchParams.set("X-Amz-Expires", String(Math.min(expiresSec, 604800)));
+		return (await this.aws.sign(url, {
+			method: "GET",
+			aws: { signQuery: true }
+		})).url;
+	}
+	async put(key, body, sha256, headers, query = "") {
+		const res = await this.send(key, {
+			method: "PUT",
+			body,
+			headers: {
+				...headers,
+				"x-amz-content-sha256": sha256
+			},
+			query
+		});
+		if (!res.ok) throw await this.failure("PUT", res);
+		return res;
+	}
+	async uploadParts(file, key, size, headers, onProgress) {
+		const partSize = Math.max(this.options.partSize ?? 16 * MiB, Math.ceil(size / 1e4), 5 * MiB);
+		const created = await this.send(key, {
+			method: "POST",
+			query: "uploads=",
+			headers
+		});
+		if (!created.ok) throw await this.failure("CreateMultipartUpload", created);
+		const uploadId = /<UploadId>([^<]+)<\/UploadId>/.exec(await created.text())?.[1];
+		if (!uploadId) throw new StorageError("CreateMultipartUpload returned no UploadId");
+		const id = encodeURIComponent(uploadId);
+		const count = Math.ceil(size / partSize);
+		const etags = new Array(count);
+		const handle = await open(file);
+		let next = 0;
+		let sent = 0;
+		const worker = async () => {
+			while (next < count) {
+				const index = next++;
+				const length = Math.min(partSize, size - index * partSize);
+				const chunk = Buffer.alloc(length);
+				await handle.read(chunk, 0, length, index * partSize);
+				const sha = createHash("sha256").update(chunk).digest("hex");
+				etags[index] = (await this.put(key, chunk, sha, {}, `partNumber=${index + 1}&uploadId=${id}`)).headers.get("etag") ?? "";
+				sent += length;
+				onProgress?.({
+					sent,
+					total: size
+				});
+			}
+		};
+		try {
+			await Promise.all(Array.from({ length: Math.min(this.options.concurrency ?? 4, count) }, worker));
+			const body = `<CompleteMultipartUpload>${etags.map((etag, i) => `<Part><PartNumber>${i + 1}</PartNumber><ETag>${escapeXml(etag)}</ETag></Part>`).join("")}</CompleteMultipartUpload>`;
+			const done = await this.send(key, {
+				method: "POST",
+				query: `uploadId=${id}`,
+				body,
+				headers: { "content-type": "application/xml" }
+			});
+			const text = await done.text();
+			if (!done.ok || text.includes("<Error>")) throw new StorageError(`CompleteMultipartUpload failed (${done.status}): ${errorCode(text)}`, done.status);
+		} catch (err) {
+			await this.send(key, {
+				method: "DELETE",
+				query: `uploadId=${id}`
+			}).catch(() => void 0);
+			throw err;
+		} finally {
+			await handle.close();
+		}
+	}
+	url(key, query = "") {
+		const base = this.remote.endpoint.replace(/\/+$/, "");
+		const path$1 = key.split("/").map(encodeURIComponent).join("/");
+		return `${base}/${this.remote.bucket}/${path$1}${query ? `?${query}` : ""}`;
+	}
+	async send(key, init) {
+		const signed = await this.aws.sign(this.url(key, init.query), {
+			method: init.method,
+			headers: init.headers,
+			body: init.body
+		});
+		return this.fetch(signed);
+	}
+	async failure(what, res) {
+		const text = await res.text().catch(() => "");
+		const hint = res.status === 403 ? ": check the remote's keys and that they may write to the bucket" : res.status === 404 ? ": check the remote's endpoint and bucket" : "";
+		return new StorageError(`${what} ${this.remote.bucket} failed (${res.status} ${errorCode(text)})${hint}`, res.status);
+	}
+};
+function errorCode(xml) {
+	return /<Code>([^<]+)<\/Code>/.exec(xml)?.[1] ?? "no error code";
+}
+function escapeXml(text) {
+	return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/"/g, "&quot;");
+}
+/**
+* Finding a project's pinned assets from file paths: what a preview or an
+* engine asks for is an absolute path, and a pinned file that isn't on disk
+* is read from its bucket instead.
+*/
+const FILE = "framefields.json";
+/** The nearest folder at or above `dir` holding a framefields.json. */
+function findProjectDir(dir) {
+	for (let at = dir;; at = dirname(at)) {
+		if (existsSync(join(at, FILE))) return at;
+		if (dirname(at) === at) return void 0;
+	}
+}
+/** The `storage` and `assets` of the project at `dir`; undefined without assets. */
+async function readProjectManifest(dir) {
+	const file = join(dir, FILE);
+	if (!existsSync(file)) return void 0;
+	let raw;
+	try {
+		raw = JSON.parse(await readFile(file, "utf8"));
+	} catch (err) {
+		throw new ManifestError(`${FILE} is not valid JSON: ${err.message}`);
+	}
+	if (raw.assets === void 0) return void 0;
+	const storage = raw.storage === void 0 ? void 0 : parseStorage(raw.storage);
+	return {
+		storage,
+		assets: parseAssets(raw.assets, storage)
+	};
+}
+/** Signatures last 6 h and are reused for 5, so long sessions keep working. */
+const SIGNED_SEC = 6 * 3600;
+const REUSE_MS = 5 * 3600 * 1e3;
+/**
+* Pinned-asset lookup for the project at or above `dir`, or undefined when
+* it pins none.
+*/
+async function openAssetLocator(dir, options = {}) {
+	const root = findProjectDir(dir);
+	const manifest = root && await readProjectManifest(root);
+	if (!root || !manifest) return void 0;
+	const signed = /* @__PURE__ */ new Map();
+	const entry = (file) => {
+		const rel = relative(root, file).split(sep).join("/");
+		return rel.startsWith("../") ? void 0 : manifest.assets[rel];
+	};
+	return {
+		root,
+		entry,
+		async url(file) {
+			const pinned = entry(file);
+			if (!pinned) return void 0;
+			const open$1 = readUrl(pinned, manifest.storage);
+			if (open$1) return open$1;
+			const cached = signed.get(pinned.sha256);
+			if (cached && Date.now() - cached.at < REUSE_MS) return cached.url;
+			const { name, remote } = pickRemote(manifest.storage, pinned.remote);
+			const keys = credentialsFromEnv(name, options.env);
+			if (!keys) return void 0;
+			const url = await new Bucket(remote, keys, { fetch: options.fetch }).presign(pinned.sha256, SIGNED_SEC);
+			signed.set(pinned.sha256, {
+				url,
+				at: Date.now()
+			});
+			return url;
+		}
+	};
+}
+
+//#endregion
+export { redactQuery as S, parseStorage as _, SHA256 as a, readProjectManifest as b, credentialEnvNames as c, findProjectDir as d, hashFile as f, parseAssets as g, openAssetLocator as h, REMOTE_NAME as i, credentialsFromEnv as l, objectKey as m, Bucket as n, StorageError as o, isAssetPath as p, ManifestError as r, contentType as s, AssetError as t, downloadVerified as u, pickRemote as v, readUrl as x, publicUrl as y };
+//# sourceMappingURL=dist-CiTgmfUw.mjs.map

package/dist/dist-CiTgmfUw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dist-CiTgmfUw.mjs","names":["path"],"sources":["../../storage/dist/index.mjs"],"sourcesContent":["import { createHash, randomBytes } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { AwsClient } from \"aws4fetch\";\nimport { createReadStream, createWriteStream, existsSync } from \"node:fs\";\nimport { dirname, join, relative, sep } from \"node:path\";\nimport { Readable, Transform } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\n\n//#region src/files.ts\n/**\n* Hashing and verified downloads: every byte an asset contributes is checked\n* against the sha256 its manifest entry pins.\n*/\nvar AssetError = class extends Error {\n\tname = \"AssetError\";\n\tconstructor(code, message, options) {\n\t\tsuper(message, options);\n\t\tthis.code = code;\n\t}\n};\nasync function hashFile(path) {\n\tconst hash = createHash(\"sha256\");\n\tlet size = 0;\n\tfor await (const chunk of createReadStream(path)) {\n\t\thash.update(chunk);\n\t\tsize += chunk.length;\n\t}\n\treturn {\n\t\tsha256: hash.digest(\"hex\"),\n\t\tsize\n\t};\n}\n/**\n* Downloads `url` to `dest` through a temporary file, and only renames it\n* into place once its size and sha256 match `expected`.\n*/\nasync function downloadVerified(url, dest, expected, options = {}) {\n\tconst attempts = options.attempts ?? 3;\n\tfor (let attempt = 1;; attempt++) try {\n\t\tawait downloadOnce(url, dest, expected, options);\n\t\treturn;\n\t} catch (err) {\n\t\tif (!(err instanceof AssetError ? err.code === \"ASSET_DOWNLOAD_FAILED\" : !options.signal?.aborted) || attempt >= attempts) throw err;\n\t\tawait new Promise((r) => setTimeout(r, 500 * 2 ** attempt));\n\t}\n}\nasync function downloadOnce(url, dest, expected, options) {\n\tconst shown = redactQuery(url);\n\tconst res = await (options.fetch ?? fetch)(url, { signal: options.signal });\n\tif (!res.ok || !res.body) {\n\t\tawait res.body?.cancel();\n\t\tif (res.status === 404) throw new AssetError(\"ASSET_NOT_FOUND\", `${shown} returned 404`);\n\t\tif (res.status === 401 || res.status === 403) throw new AssetError(\"ASSET_FORBIDDEN\", `${shown} returned ${res.status}: the bucket isn't public there, or the signed URL expired`);\n\t\tthrow new AssetError(\"ASSET_DOWNLOAD_FAILED\", `${shown} returned ${res.status}`);\n\t}\n\tawait mkdir(dirname(dest), { recursive: true });\n\tconst temp = `${dest}.${randomBytes(4).toString(\"hex\")}.part`;\n\tconst hash = createHash(\"sha256\");\n\tlet size = 0;\n\tconst tap = new Transform({ transform(chunk, _encoding, done) {\n\t\tsize += chunk.length;\n\t\tif (size > expected.size) return done(new AssetError(\"ASSET_HASH_MISMATCH\", `${shown} is larger than the ${expected.size} bytes framefields.json pins`));\n\t\thash.update(chunk);\n\t\tdone(null, chunk);\n\t} });\n\ttry {\n\t\tawait pipeline(Readable.fromWeb(res.body), tap, createWriteStream(temp), { signal: options.signal }).catch((err) => {\n\t\t\tif (err instanceof AssetError || options.signal?.aborted) throw err;\n\t\t\tthrow new AssetError(\"ASSET_DOWNLOAD_FAILED\", `${shown}: ${err.message}`, { cause: err });\n\t\t});\n\t\tconst sha256 = hash.digest(\"hex\");\n\t\tif (size !== expected.size || sha256 !== expected.sha256) throw new AssetError(\"ASSET_HASH_MISMATCH\", `${shown} is not the file framefields.json pins (got ${size} bytes, sha256 ${sha256.slice(0, 12)}…; expected ${expected.size} bytes, ${expected.sha256.slice(0, 12)}…)`);\n\t\tawait rename(temp, dest);\n\t} finally {\n\t\tawait rm(temp, { force: true });\n\t}\n}\n/** Signed URLs carry credentials in the query: never print them. */\nfunction redactQuery(url) {\n\tconst q = url.indexOf(\"?\");\n\treturn q < 0 ? url : `${url.slice(0, q)}?…`;\n}\nconst TYPES = {\n\tmp4: \"video/mp4\",\n\tm4v: \"video/mp4\",\n\tmov: \"video/quicktime\",\n\twebm: \"video/webm\",\n\tmkv: \"video/x-matroska\",\n\tmp3: \"audio/mpeg\",\n\tm4a: \"audio/mp4\",\n\taac: \"audio/aac\",\n\twav: \"audio/wav\",\n\tflac: \"audio/flac\",\n\togg: \"audio/ogg\",\n\tpng: \"image/png\",\n\tjpg: \"image/jpeg\",\n\tjpeg: \"image/jpeg\",\n\twebp: \"image/webp\",\n\tavif: \"image/avif\",\n\tgif: \"image/gif\",\n\tsvg: \"image/svg+xml\",\n\tjson: \"application/json\",\n\tlottie: \"application/zip\",\n\tglb: \"model/gltf-binary\",\n\tgltf: \"model/gltf+json\",\n\tttf: \"font/ttf\",\n\totf: \"font/otf\",\n\twoff2: \"font/woff2\",\n\tcube: \"text/plain\",\n\tsrt: \"text/plain\",\n\tvtt: \"text/vtt\"\n};\n/** The Content-Type a CDN serves the file with. */\nfunction contentType(path) {\n\treturn TYPES[path.slice(path.lastIndexOf(\".\") + 1).toLowerCase()] ?? \"application/octet-stream\";\n}\n\n//#endregion\n//#region src/manifest.ts\nconst REMOTE_NAME = /^[A-Za-z0-9][\\w-]{0,63}$/;\nconst SHA256 = /^[0-9a-f]{64}$/;\nconst FILE$1 = \"framefields.json\";\nvar ManifestError = class extends Error {\n\tname = \"ManifestError\";\n};\n/** Validates `storage`; errors name the remote and field at fault. */\nfunction parseStorage(value) {\n\tif (!isRecord(value) || !isRecord(value.remotes)) throw new ManifestError(`${FILE$1}: \"storage\" needs \"remotes\", e.g. { \"remotes\": { \"media\": { \"endpoint\": \"https://<account>.r2.cloudflarestorage.com\", \"bucket\": \"films\" } } }`);\n\tconst remotes = {};\n\tfor (const [name, spec] of Object.entries(value.remotes)) remotes[name] = parseRemote(name, spec);\n\tconst names = Object.keys(remotes);\n\tif (names.length === 0) throw new ManifestError(`${FILE$1}: \"storage.remotes\" is empty`);\n\tif (value.default !== void 0 && !names.includes(value.default)) throw new ManifestError(`${FILE$1}: \"storage.default\" must name a remote (${names.join(\", \")})`);\n\treturn {\n\t\t...typeof value.default === \"string\" && { default: value.default },\n\t\tremotes\n\t};\n}\nfunction parseRemote(name, spec) {\n\tconst fail = (message) => {\n\t\tthrow new ManifestError(`${FILE$1}: storage.remotes.${name} ${message}`);\n\t};\n\tif (!REMOTE_NAME.test(name)) fail(\"has an invalid name: use letters, digits, - and _ (at most 64)\");\n\tif (!isRecord(spec)) fail(\"must be an object with an endpoint and a bucket\");\n\tconst s = spec;\n\tif (!isHttpUrl(s.endpoint)) fail(\"needs \\\"endpoint\\\": the S3 API URL, e.g. \\\"https://<account>.r2.cloudflarestorage.com\\\"\");\n\tif (typeof s.bucket !== \"string\" || !/^[a-z0-9][a-z0-9.-]{1,62}$/.test(s.bucket)) fail(\"needs \\\"bucket\\\": the bucket name\");\n\tif (s.region !== void 0 && typeof s.region !== \"string\") fail(\"\\\"region\\\" must be a string\");\n\tif (s.prefix !== void 0 && (typeof s.prefix !== \"string\" || s.prefix.startsWith(\"/\") || s.prefix.split(\"/\").includes(\"..\"))) fail(\"\\\"prefix\\\" must be a key prefix such as \\\"films/launch/\\\"\");\n\tif (s.publicUrl !== void 0 && !isHttpUrl(s.publicUrl)) fail(\"\\\"publicUrl\\\" must be an http(s) URL, e.g. \\\"https://media.example.com\\\"\");\n\treturn {\n\t\tendpoint: s.endpoint,\n\t\tbucket: s.bucket,\n\t\t...s.region !== void 0 && { region: s.region },\n\t\t...typeof s.prefix === \"string\" && s.prefix && { prefix: normalizePrefix(s.prefix) },\n\t\t...s.publicUrl !== void 0 && { publicUrl: s.publicUrl }\n\t};\n}\n/** Validates `assets`; errors name the path and field at fault. */\nfunction parseAssets(value, storage) {\n\tif (!isRecord(value)) throw new ManifestError(`${FILE$1}: \"assets\" must map project paths to { \"sha256\", \"size\" }`);\n\tconst out = {};\n\tfor (const [path, entry] of Object.entries(value)) {\n\t\tconst fail = (message) => {\n\t\t\tthrow new ManifestError(`${FILE$1}: assets[\"${path}\"] ${message}`);\n\t\t};\n\t\tif (!isAssetPath(path)) fail(\"must be a path inside the project, e.g. assets/footage/intro.mp4\");\n\t\tif (!isRecord(entry)) fail(\"must be { \\\"sha256\\\", \\\"size\\\" }\");\n\t\tconst e = entry;\n\t\tif (typeof e.sha256 !== \"string\" || !SHA256.test(e.sha256)) fail(\"needs \\\"sha256\\\": 64 lowercase hex digits\");\n\t\tif (typeof e.size !== \"number\" || !Number.isSafeInteger(e.size) || e.size < 0) fail(\"needs \\\"size\\\" in bytes\");\n\t\tif (e.url !== void 0 && !isHttpUrl(e.url)) fail(\"\\\"url\\\" must be an http(s) URL\");\n\t\tif (e.remote !== void 0) {\n\t\t\tif (typeof e.remote !== \"string\" || !storage?.remotes[e.remote]) fail(`\"remote\" must name a remote in \"storage.remotes\"`);\n\t\t} else if (e.url === void 0 && !storage) fail(\"needs a \\\"url\\\", or a \\\"storage\\\" section with a remote to hold it\");\n\t\tout[path] = {\n\t\t\tsha256: e.sha256,\n\t\t\tsize: e.size,\n\t\t\t...e.remote !== void 0 && { remote: e.remote },\n\t\t\t...e.url !== void 0 && { url: e.url }\n\t\t};\n\t}\n\treturn out;\n}\n/** The remote an asset (or a new one, without `name`) belongs to. */\nfunction pickRemote(storage, name) {\n\tconst names = Object.keys(storage?.remotes ?? {});\n\tconst chosen = name ?? storage?.default ?? (names.length === 1 ? names[0] : void 0);\n\tif (!storage || names.length === 0) throw new ManifestError(`${FILE$1} has no \"storage\" remotes: add one (an R2 or S3 bucket) first`);\n\tif (!chosen) throw new ManifestError(`${FILE$1}: name the remote (${names.join(\", \")}), or set \"storage.default\"`);\n\tconst remote = storage.remotes[chosen];\n\tif (!remote) throw new ManifestError(`${FILE$1}: no remote named \"${chosen}\" (${names.join(\", \")})`);\n\treturn {\n\t\tname: chosen,\n\t\tremote\n\t};\n}\n/** The object key holding `sha256`: `<prefix>sha256/ab/<hash>`. */\nfunction objectKey(sha256, prefix = \"\") {\n\treturn `${prefix}sha256/${sha256.slice(0, 2)}/${sha256}`;\n}\n/** The asset's URL on the remote's public domain, if it has one. */\nfunction publicUrl(remote, sha256) {\n\tif (!remote.publicUrl) return void 0;\n\treturn `${remote.publicUrl.replace(/\\/+$/, \"\")}/${objectKey(sha256, remote.prefix)}`;\n}\n/**\n* Where to download an asset without credentials: a signed URL handed in\n* (`signed`, by sha256), its own `url`, or its remote's public domain.\n* Undefined means the asset is on a private remote and needs a signature.\n*/\nfunction readUrl(entry, storage, signed) {\n\tconst given = signed?.[entry.sha256];\n\tif (given) return given;\n\tif (entry.url) return entry.url;\n\tif (!storage) return void 0;\n\treturn publicUrl(pickRemote(storage, entry.remote).remote, entry.sha256);\n}\nfunction isAssetPath(path) {\n\treturn path.length > 0 && path.length <= 1024 && !path.startsWith(\"/\") && !path.includes(\"\\\\\") && !path.split(\"/\").some((part) => part === \"\" || part === \".\" || part === \"..\");\n}\nfunction normalizePrefix(prefix) {\n\treturn prefix.endsWith(\"/\") ? prefix : `${prefix}/`;\n}\nfunction isHttpUrl(value) {\n\tif (typeof value !== \"string\") return false;\n\ttry {\n\t\tconst { protocol } = new URL(value);\n\t\treturn protocol === \"https:\" || protocol === \"http:\";\n\t} catch {\n\t\treturn false;\n\t}\n}\nfunction isRecord(value) {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n//#endregion\n//#region src/bucket.ts\n/**\n* The few S3 calls asset storage needs (HEAD, PUT, multipart upload,\n* presigned GET), signed with SigV4 by aws4fetch. Works with any\n* S3-compatible service; R2 is the one to pick, since it charges no egress.\n*/\n/**\n* Keys for `remote` from the environment:\n* `FRAMEFIELDS_STORAGE_<REMOTE>_ACCESS_KEY_ID` / `…_SECRET_ACCESS_KEY`\n* (the remote's name upper-cased, `-` as `_`), else the standard\n* `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`.\n*/\nfunction credentialsFromEnv(remote, env = process.env) {\n\tconst scope = `FRAMEFIELDS_STORAGE_${remote.toUpperCase().replace(/-/g, \"_\")}`;\n\tconst own = env[`${scope}_ACCESS_KEY_ID`];\n\tconst ownSecret = env[`${scope}_SECRET_ACCESS_KEY`];\n\tif (own && ownSecret) return {\n\t\taccessKeyId: own,\n\t\tsecretAccessKey: ownSecret\n\t};\n\tconst id = env.AWS_ACCESS_KEY_ID;\n\tconst secret = env.AWS_SECRET_ACCESS_KEY;\n\tif (!id || !secret) return void 0;\n\treturn {\n\t\taccessKeyId: id,\n\t\tsecretAccessKey: secret,\n\t\t...env.AWS_SESSION_TOKEN && { sessionToken: env.AWS_SESSION_TOKEN }\n\t};\n}\n/** The env vars `credentialsFromEnv` reads for `remote`, for messages. */\nfunction credentialEnvNames(remote) {\n\tconst scope = `FRAMEFIELDS_STORAGE_${remote.toUpperCase().replace(/-/g, \"_\")}`;\n\treturn [`${scope}_ACCESS_KEY_ID`, `${scope}_SECRET_ACCESS_KEY`];\n}\nvar StorageError = class extends Error {\n\tname = \"StorageError\";\n\tconstructor(message, status) {\n\t\tsuper(message);\n\t\tthis.status = status;\n\t}\n};\nconst MiB = 1024 * 1024;\n/**\n* Content-addressed objects never change: CDNs and browsers may keep them\n* forever, which is what makes a custom domain in front of the bucket cheap.\n*/\nconst IMMUTABLE = \"public, max-age=31536000, immutable\";\n/** One remote's bucket, signed with `credentials`. */\nvar Bucket = class {\n\taws;\n\tfetch;\n\tconstructor(remote, credentials, options = {}) {\n\t\tthis.remote = remote;\n\t\tthis.options = options;\n\t\tthis.aws = new AwsClient({\n\t\t\t...credentials,\n\t\t\tservice: \"s3\",\n\t\t\tregion: remote.region ?? \"auto\",\n\t\t\tretries: 3\n\t\t});\n\t\tthis.fetch = options.fetch ?? fetch;\n\t}\n\tkeyFor(sha256) {\n\t\treturn objectKey(sha256, this.remote.prefix);\n\t}\n\t/** Whether the bucket holds `sha256` at the expected size. */\n\tasync has(sha256, size) {\n\t\tconst res = await this.send(this.keyFor(sha256), { method: \"HEAD\" });\n\t\tif (res.status === 404) return false;\n\t\tif (!res.ok) throw await this.failure(\"HEAD\", res);\n\t\treturn Number(res.headers.get(\"content-length\")) === size;\n\t}\n\t/**\n\t* Uploads `file` (already hashed) under its content key. The bucket\n\t* checks every byte against the sha256 sent with it.\n\t*/\n\tasync upload(file, digest, onProgress) {\n\t\tconst key = this.keyFor(digest.sha256);\n\t\tconst headers = {\n\t\t\t\"content-type\": contentType(file),\n\t\t\t\"cache-control\": IMMUTABLE\n\t\t};\n\t\tconst threshold = this.options.multipartThreshold ?? 64 * MiB;\n\t\tif (digest.size <= threshold) {\n\t\t\tconst handle = await open(file);\n\t\t\ttry {\n\t\t\t\tconst body = await handle.readFile();\n\t\t\t\tawait this.put(key, body, digest.sha256, headers);\n\t\t\t} finally {\n\t\t\t\tawait handle.close();\n\t\t\t}\n\t\t\tonProgress?.({\n\t\t\t\tsent: digest.size,\n\t\t\t\ttotal: digest.size\n\t\t\t});\n\t\t\treturn;\n\t\t}\n\t\tawait this.uploadParts(file, key, digest.size, headers, onProgress);\n\t}\n\t/** A GET URL anyone can use until it expires (at most 7 days). */\n\tasync presign(sha256, expiresSec = 86400) {\n\t\tconst url = new URL(this.url(this.keyFor(sha256)));\n\t\turl.searchParams.set(\"X-Amz-Expires\", String(Math.min(expiresSec, 604800)));\n\t\treturn (await this.aws.sign(url, {\n\t\t\tmethod: \"GET\",\n\t\t\taws: { signQuery: true }\n\t\t})).url;\n\t}\n\tasync put(key, body, sha256, headers, query = \"\") {\n\t\tconst res = await this.send(key, {\n\t\t\tmethod: \"PUT\",\n\t\t\tbody,\n\t\t\theaders: {\n\t\t\t\t...headers,\n\t\t\t\t\"x-amz-content-sha256\": sha256\n\t\t\t},\n\t\t\tquery\n\t\t});\n\t\tif (!res.ok) throw await this.failure(\"PUT\", res);\n\t\treturn res;\n\t}\n\tasync uploadParts(file, key, size, headers, onProgress) {\n\t\tconst partSize = Math.max(this.options.partSize ?? 16 * MiB, Math.ceil(size / 1e4), 5 * MiB);\n\t\tconst created = await this.send(key, {\n\t\t\tmethod: \"POST\",\n\t\t\tquery: \"uploads=\",\n\t\t\theaders\n\t\t});\n\t\tif (!created.ok) throw await this.failure(\"CreateMultipartUpload\", created);\n\t\tconst uploadId = /<UploadId>([^<]+)<\\/UploadId>/.exec(await created.text())?.[1];\n\t\tif (!uploadId) throw new StorageError(\"CreateMultipartUpload returned no UploadId\");\n\t\tconst id = encodeURIComponent(uploadId);\n\t\tconst count = Math.ceil(size / partSize);\n\t\tconst etags = new Array(count);\n\t\tconst handle = await open(file);\n\t\tlet next = 0;\n\t\tlet sent = 0;\n\t\tconst worker = async () => {\n\t\t\twhile (next < count) {\n\t\t\t\tconst index = next++;\n\t\t\t\tconst length = Math.min(partSize, size - index * partSize);\n\t\t\t\tconst chunk = Buffer.alloc(length);\n\t\t\t\tawait handle.read(chunk, 0, length, index * partSize);\n\t\t\t\tconst sha = createHash(\"sha256\").update(chunk).digest(\"hex\");\n\t\t\t\tetags[index] = (await this.put(key, chunk, sha, {}, `partNumber=${index + 1}&uploadId=${id}`)).headers.get(\"etag\") ?? \"\";\n\t\t\t\tsent += length;\n\t\t\t\tonProgress?.({\n\t\t\t\t\tsent,\n\t\t\t\t\ttotal: size\n\t\t\t\t});\n\t\t\t}\n\t\t};\n\t\ttry {\n\t\t\tawait Promise.all(Array.from({ length: Math.min(this.options.concurrency ?? 4, count) }, worker));\n\t\t\tconst body = `<CompleteMultipartUpload>${etags.map((etag, i) => `<Part><PartNumber>${i + 1}</PartNumber><ETag>${escapeXml(etag)}</ETag></Part>`).join(\"\")}</CompleteMultipartUpload>`;\n\t\t\tconst done = await this.send(key, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\tquery: `uploadId=${id}`,\n\t\t\t\tbody,\n\t\t\t\theaders: { \"content-type\": \"application/xml\" }\n\t\t\t});\n\t\t\tconst text = await done.text();\n\t\t\tif (!done.ok || text.includes(\"<Error>\")) throw new StorageError(`CompleteMultipartUpload failed (${done.status}): ${errorCode(text)}`, done.status);\n\t\t} catch (err) {\n\t\t\tawait this.send(key, {\n\t\t\t\tmethod: \"DELETE\",\n\t\t\t\tquery: `uploadId=${id}`\n\t\t\t}).catch(() => void 0);\n\t\t\tthrow err;\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n\turl(key, query = \"\") {\n\t\tconst base = this.remote.endpoint.replace(/\\/+$/, \"\");\n\t\tconst path = key.split(\"/\").map(encodeURIComponent).join(\"/\");\n\t\treturn `${base}/${this.remote.bucket}/${path}${query ? `?${query}` : \"\"}`;\n\t}\n\tasync send(key, init) {\n\t\tconst signed = await this.aws.sign(this.url(key, init.query), {\n\t\t\tmethod: init.method,\n\t\t\theaders: init.headers,\n\t\t\tbody: init.body\n\t\t});\n\t\treturn this.fetch(signed);\n\t}\n\tasync failure(what, res) {\n\t\tconst text = await res.text().catch(() => \"\");\n\t\tconst hint = res.status === 403 ? \": check the remote's keys and that they may write to the bucket\" : res.status === 404 ? \": check the remote's endpoint and bucket\" : \"\";\n\t\treturn new StorageError(`${what} ${this.remote.bucket} failed (${res.status} ${errorCode(text)})${hint}`, res.status);\n\t}\n};\nfunction errorCode(xml) {\n\treturn /<Code>([^<]+)<\\/Code>/.exec(xml)?.[1] ?? \"no error code\";\n}\nfunction escapeXml(text) {\n\treturn text.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/\"/g, \"&quot;\");\n}\n\n//#endregion\n//#region src/locate.ts\n/**\n* Finding a project's pinned assets from file paths: what a preview or an\n* engine asks for is an absolute path, and a pinned file that isn't on disk\n* is read from its bucket instead.\n*/\nconst FILE = \"framefields.json\";\n/** The nearest folder at or above `dir` holding a framefields.json. */\nfunction findProjectDir(dir) {\n\tfor (let at = dir;; at = dirname(at)) {\n\t\tif (existsSync(join(at, FILE))) return at;\n\t\tif (dirname(at) === at) return void 0;\n\t}\n}\n/** The `storage` and `assets` of the project at `dir`; undefined without assets. */\nasync function readProjectManifest(dir) {\n\tconst file = join(dir, FILE);\n\tif (!existsSync(file)) return void 0;\n\tlet raw;\n\ttry {\n\t\traw = JSON.parse(await readFile(file, \"utf8\"));\n\t} catch (err) {\n\t\tthrow new ManifestError(`${FILE} is not valid JSON: ${err.message}`);\n\t}\n\tif (raw.assets === void 0) return void 0;\n\tconst storage = raw.storage === void 0 ? void 0 : parseStorage(raw.storage);\n\treturn {\n\t\tstorage,\n\t\tassets: parseAssets(raw.assets, storage)\n\t};\n}\n/** Signatures last 6 h and are reused for 5, so long sessions keep working. */\nconst SIGNED_SEC = 6 * 3600;\nconst REUSE_MS = 5 * 3600 * 1e3;\n/**\n* Pinned-asset lookup for the project at or above `dir`, or undefined when\n* it pins none.\n*/\nasync function openAssetLocator(dir, options = {}) {\n\tconst root = findProjectDir(dir);\n\tconst manifest = root && await readProjectManifest(root);\n\tif (!root || !manifest) return void 0;\n\tconst signed = /* @__PURE__ */ new Map();\n\tconst entry = (file) => {\n\t\tconst rel = relative(root, file).split(sep).join(\"/\");\n\t\treturn rel.startsWith(\"../\") ? void 0 : manifest.assets[rel];\n\t};\n\treturn {\n\t\troot,\n\t\tentry,\n\t\tasync url(file) {\n\t\t\tconst pinned = entry(file);\n\t\t\tif (!pinned) return void 0;\n\t\t\tconst open$1 = readUrl(pinned, manifest.storage);\n\t\t\tif (open$1) return open$1;\n\t\t\tconst cached = signed.get(pinned.sha256);\n\t\t\tif (cached && Date.now() - cached.at < REUSE_MS) return cached.url;\n\t\t\tconst { name, remote } = pickRemote(manifest.storage, pinned.remote);\n\t\t\tconst keys = credentialsFromEnv(name, options.env);\n\t\t\tif (!keys) return void 0;\n\t\t\tconst url = await new Bucket(remote, keys, { fetch: options.fetch }).presign(pinned.sha256, SIGNED_SEC);\n\t\t\tsigned.set(pinned.sha256, {\n\t\t\t\turl,\n\t\t\t\tat: Date.now()\n\t\t\t});\n\t\t\treturn url;\n\t\t}\n\t};\n}\n\n//#endregion\nexport { AssetError, Bucket, ManifestError, REMOTE_NAME, SHA256, StorageError, contentType, credentialEnvNames, credentialsFromEnv, downloadVerified, findProjectDir, hashFile, isAssetPath, objectKey, openAssetLocator, parseAssets, parseStorage, pickRemote, publicUrl, readProjectManifest, readUrl, redactQuery };\n//# sourceMappingURL=index.mjs.map"],"mappings":";;;;;;;;;;;;;AAaA,IAAI,aAAa,cAAc,MAAM;CACpC,OAAO;CACP,YAAY,MAAM,SAAS,SAAS;AACnC,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO;;;AAGd,eAAe,SAAS,QAAM;CAC7B,MAAM,OAAO,WAAW,SAAS;CACjC,IAAI,OAAO;AACX,YAAW,MAAM,SAAS,iBAAiBA,OAAK,EAAE;AACjD,OAAK,OAAO,MAAM;AAClB,UAAQ,MAAM;;AAEf,QAAO;EACN,QAAQ,KAAK,OAAO,MAAM;EAC1B;EACA;;;;;;AAMF,eAAe,iBAAiB,KAAK,MAAM,UAAU,UAAU,EAAE,EAAE;CAClE,MAAM,WAAW,QAAQ,YAAY;AACrC,MAAK,IAAI,UAAU,IAAI,UAAW,KAAI;AACrC,QAAM,aAAa,KAAK,MAAM,UAAU,QAAQ;AAChD;UACQ,KAAK;AACb,MAAI,EAAE,eAAe,aAAa,IAAI,SAAS,0BAA0B,CAAC,QAAQ,QAAQ,YAAY,WAAW,SAAU,OAAM;AACjI,QAAM,IAAI,SAAS,MAAM,WAAW,GAAG,MAAM,KAAK,QAAQ,CAAC;;;AAG7D,eAAe,aAAa,KAAK,MAAM,UAAU,SAAS;CACzD,MAAM,QAAQ,YAAY,IAAI;CAC9B,MAAM,MAAM,OAAO,QAAQ,SAAS,OAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,CAAC;AAC3E,KAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM;AACzB,QAAM,IAAI,MAAM,QAAQ;AACxB,MAAI,IAAI,WAAW,IAAK,OAAM,IAAI,WAAW,mBAAmB,GAAG,MAAM,eAAe;AACxF,MAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,OAAM,IAAI,WAAW,mBAAmB,GAAG,MAAM,YAAY,IAAI,OAAO,4DAA4D;AAClL,QAAM,IAAI,WAAW,yBAAyB,GAAG,MAAM,YAAY,IAAI,SAAS;;AAEjF,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;CAC/C,MAAM,OAAO,GAAG,KAAK,GAAG,YAAY,EAAE,CAAC,SAAS,MAAM,CAAC;CACvD,MAAM,OAAO,WAAW,SAAS;CACjC,IAAI,OAAO;CACX,MAAM,MAAM,IAAI,UAAU,EAAE,UAAU,OAAO,WAAW,MAAM;AAC7D,UAAQ,MAAM;AACd,MAAI,OAAO,SAAS,KAAM,QAAO,KAAK,IAAI,WAAW,uBAAuB,GAAG,MAAM,sBAAsB,SAAS,KAAK,8BAA8B,CAAC;AACxJ,OAAK,OAAO,MAAM;AAClB,OAAK,MAAM,MAAM;IACf,CAAC;AACJ,KAAI;AACH,QAAM,SAAS,SAAS,QAAQ,IAAI,KAAK,EAAE,KAAK,kBAAkB,KAAK,EAAE,EAAE,QAAQ,QAAQ,QAAQ,CAAC,CAAC,OAAO,QAAQ;AACnH,OAAI,eAAe,cAAc,QAAQ,QAAQ,QAAS,OAAM;AAChE,SAAM,IAAI,WAAW,yBAAyB,GAAG,MAAM,IAAI,IAAI,WAAW,EAAE,OAAO,KAAK,CAAC;IACxF;EACF,MAAM,SAAS,KAAK,OAAO,MAAM;AACjC,MAAI,SAAS,SAAS,QAAQ,WAAW,SAAS,OAAQ,OAAM,IAAI,WAAW,uBAAuB,GAAG,MAAM,8CAA8C,KAAK,iBAAiB,OAAO,MAAM,GAAG,GAAG,CAAC,cAAc,SAAS,KAAK,UAAU,SAAS,OAAO,MAAM,GAAG,GAAG,CAAC,IAAI;AAC9Q,QAAM,OAAO,MAAM,KAAK;WACf;AACT,QAAM,GAAG,MAAM,EAAE,OAAO,MAAM,CAAC;;;;AAIjC,SAAS,YAAY,KAAK;CACzB,MAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,QAAO,IAAI,IAAI,MAAM,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC;;AAEzC,MAAM,QAAQ;CACb,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAM;CACN,MAAM;CACN,MAAM;CACN,KAAK;CACL,KAAK;CACL,MAAM;CACN,QAAQ;CACR,KAAK;CACL,MAAM;CACN,KAAK;CACL,KAAK;CACL,OAAO;CACP,MAAM;CACN,KAAK;CACL,KAAK;CACL;;AAED,SAAS,YAAY,QAAM;AAC1B,QAAO,MAAMA,OAAK,MAAMA,OAAK,YAAY,IAAI,GAAG,EAAE,CAAC,aAAa,KAAK;;AAKtE,MAAM,cAAc;AACpB,MAAM,SAAS;AACf,MAAM,SAAS;AACf,IAAI,gBAAgB,cAAc,MAAM;CACvC,OAAO;;;AAGR,SAAS,aAAa,OAAO;AAC5B,KAAI,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,QAAQ,CAAE,OAAM,IAAI,cAAc,GAAG,OAAO,+IAA+I;CACnO,MAAM,UAAU,EAAE;AAClB,MAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,MAAM,QAAQ,CAAE,SAAQ,QAAQ,YAAY,MAAM,KAAK;CACjG,MAAM,QAAQ,OAAO,KAAK,QAAQ;AAClC,KAAI,MAAM,WAAW,EAAG,OAAM,IAAI,cAAc,GAAG,OAAO,8BAA8B;AACxF,KAAI,MAAM,YAAY,KAAK,KAAK,CAAC,MAAM,SAAS,MAAM,QAAQ,CAAE,OAAM,IAAI,cAAc,GAAG,OAAO,0CAA0C,MAAM,KAAK,KAAK,CAAC,GAAG;AAChK,QAAO;EACN,GAAG,OAAO,MAAM,YAAY,YAAY,EAAE,SAAS,MAAM,SAAS;EAClE;EACA;;AAEF,SAAS,YAAY,MAAM,MAAM;CAChC,MAAM,QAAQ,YAAY;AACzB,QAAM,IAAI,cAAc,GAAG,OAAO,oBAAoB,KAAK,GAAG,UAAU;;AAEzE,KAAI,CAAC,YAAY,KAAK,KAAK,CAAE,MAAK,iEAAiE;AACnG,KAAI,CAAC,SAAS,KAAK,CAAE,MAAK,kDAAkD;CAC5E,MAAM,IAAI;AACV,KAAI,CAAC,UAAU,EAAE,SAAS,CAAE,MAAK,0FAA0F;AAC3H,KAAI,OAAO,EAAE,WAAW,YAAY,CAAC,6BAA6B,KAAK,EAAE,OAAO,CAAE,MAAK,oCAAoC;AAC3H,KAAI,EAAE,WAAW,KAAK,KAAK,OAAO,EAAE,WAAW,SAAU,MAAK,8BAA8B;AAC5F,KAAI,EAAE,WAAW,KAAK,MAAM,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,WAAW,IAAI,IAAI,EAAE,OAAO,MAAM,IAAI,CAAC,SAAS,KAAK,EAAG,MAAK,4DAA4D;AAC9L,KAAI,EAAE,cAAc,KAAK,KAAK,CAAC,UAAU,EAAE,UAAU,CAAE,MAAK,2EAA2E;AACvI,QAAO;EACN,UAAU,EAAE;EACZ,QAAQ,EAAE;EACV,GAAG,EAAE,WAAW,KAAK,KAAK,EAAE,QAAQ,EAAE,QAAQ;EAC9C,GAAG,OAAO,EAAE,WAAW,YAAY,EAAE,UAAU,EAAE,QAAQ,gBAAgB,EAAE,OAAO,EAAE;EACpF,GAAG,EAAE,cAAc,KAAK,KAAK,EAAE,WAAW,EAAE,WAAW;EACvD;;;AAGF,SAAS,YAAY,OAAO,SAAS;AACpC,KAAI,CAAC,SAAS,MAAM,CAAE,OAAM,IAAI,cAAc,GAAG,OAAO,2DAA2D;CACnH,MAAM,MAAM,EAAE;AACd,MAAK,MAAM,CAACA,QAAM,UAAU,OAAO,QAAQ,MAAM,EAAE;EAClD,MAAM,QAAQ,YAAY;AACzB,SAAM,IAAI,cAAc,GAAG,OAAO,YAAYA,OAAK,KAAK,UAAU;;AAEnE,MAAI,CAAC,YAAYA,OAAK,CAAE,MAAK,mEAAmE;AAChG,MAAI,CAAC,SAAS,MAAM,CAAE,MAAK,mCAAmC;EAC9D,MAAM,IAAI;AACV,MAAI,OAAO,EAAE,WAAW,YAAY,CAAC,OAAO,KAAK,EAAE,OAAO,CAAE,MAAK,4CAA4C;AAC7G,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,OAAO,cAAc,EAAE,KAAK,IAAI,EAAE,OAAO,EAAG,MAAK,0BAA0B;AAC9G,MAAI,EAAE,QAAQ,KAAK,KAAK,CAAC,UAAU,EAAE,IAAI,CAAE,MAAK,iCAAiC;AACjF,MAAI,EAAE,WAAW,KAAK,GACrB;OAAI,OAAO,EAAE,WAAW,YAAY,CAAC,SAAS,QAAQ,EAAE,QAAS,MAAK,mDAAmD;aAC/G,EAAE,QAAQ,KAAK,KAAK,CAAC,QAAS,MAAK,qEAAqE;AACnH,MAAIA,UAAQ;GACX,QAAQ,EAAE;GACV,MAAM,EAAE;GACR,GAAG,EAAE,WAAW,KAAK,KAAK,EAAE,QAAQ,EAAE,QAAQ;GAC9C,GAAG,EAAE,QAAQ,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK;GACrC;;AAEF,QAAO;;;AAGR,SAAS,WAAW,SAAS,MAAM;CAClC,MAAM,QAAQ,OAAO,KAAK,SAAS,WAAW,EAAE,CAAC;CACjD,MAAM,SAAS,QAAQ,SAAS,YAAY,MAAM,WAAW,IAAI,MAAM,KAAK,KAAK;AACjF,KAAI,CAAC,WAAW,MAAM,WAAW,EAAG,OAAM,IAAI,cAAc,GAAG,OAAO,+DAA+D;AACrI,KAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,GAAG,OAAO,qBAAqB,MAAM,KAAK,KAAK,CAAC,6BAA6B;CAClH,MAAM,SAAS,QAAQ,QAAQ;AAC/B,KAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,GAAG,OAAO,qBAAqB,OAAO,KAAK,MAAM,KAAK,KAAK,CAAC,GAAG;AACpG,QAAO;EACN,MAAM;EACN;EACA;;;AAGF,SAAS,UAAU,QAAQ,SAAS,IAAI;AACvC,QAAO,GAAG,OAAO,SAAS,OAAO,MAAM,GAAG,EAAE,CAAC,GAAG;;;AAGjD,SAAS,UAAU,QAAQ,QAAQ;AAClC,KAAI,CAAC,OAAO,UAAW,QAAO,KAAK;AACnC,QAAO,GAAG,OAAO,UAAU,QAAQ,QAAQ,GAAG,CAAC,GAAG,UAAU,QAAQ,OAAO,OAAO;;;;;;;AAOnF,SAAS,QAAQ,OAAO,SAAS,QAAQ;CACxC,MAAM,QAAQ,SAAS,MAAM;AAC7B,KAAI,MAAO,QAAO;AAClB,KAAI,MAAM,IAAK,QAAO,MAAM;AAC5B,KAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAO,UAAU,WAAW,SAAS,MAAM,OAAO,CAAC,QAAQ,MAAM,OAAO;;AAEzE,SAAS,YAAY,QAAM;AAC1B,QAAOA,OAAK,SAAS,KAAKA,OAAK,UAAU,QAAQ,CAACA,OAAK,WAAW,IAAI,IAAI,CAACA,OAAK,SAAS,KAAK,IAAI,CAACA,OAAK,MAAM,IAAI,CAAC,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,KAAK;;AAEhL,SAAS,gBAAgB,QAAQ;AAChC,QAAO,OAAO,SAAS,IAAI,GAAG,SAAS,GAAG,OAAO;;AAElD,SAAS,UAAU,OAAO;AACzB,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI;EACH,MAAM,EAAE,aAAa,IAAI,IAAI,MAAM;AACnC,SAAO,aAAa,YAAY,aAAa;SACtC;AACP,SAAO;;;AAGT,SAAS,SAAS,OAAO;AACxB,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;;;;;;;AAgB5E,SAAS,mBAAmB,QAAQ,MAAM,QAAQ,KAAK;CACtD,MAAM,QAAQ,uBAAuB,OAAO,aAAa,CAAC,QAAQ,MAAM,IAAI;CAC5E,MAAM,MAAM,IAAI,GAAG,MAAM;CACzB,MAAM,YAAY,IAAI,GAAG,MAAM;AAC/B,KAAI,OAAO,UAAW,QAAO;EAC5B,aAAa;EACb,iBAAiB;EACjB;CACD,MAAM,KAAK,IAAI;CACf,MAAM,SAAS,IAAI;AACnB,KAAI,CAAC,MAAM,CAAC,OAAQ,QAAO,KAAK;AAChC,QAAO;EACN,aAAa;EACb,iBAAiB;EACjB,GAAG,IAAI,qBAAqB,EAAE,cAAc,IAAI,mBAAmB;EACnE;;;AAGF,SAAS,mBAAmB,QAAQ;CACnC,MAAM,QAAQ,uBAAuB,OAAO,aAAa,CAAC,QAAQ,MAAM,IAAI;AAC5E,QAAO,CAAC,GAAG,MAAM,iBAAiB,GAAG,MAAM,oBAAoB;;AAEhE,IAAI,eAAe,cAAc,MAAM;CACtC,OAAO;CACP,YAAY,SAAS,QAAQ;AAC5B,QAAM,QAAQ;AACd,OAAK,SAAS;;;AAGhB,MAAM,MAAM,OAAO;;;;;AAKnB,MAAM,YAAY;;AAElB,IAAI,SAAS,MAAM;CAClB;CACA;CACA,YAAY,QAAQ,aAAa,UAAU,EAAE,EAAE;AAC9C,OAAK,SAAS;AACd,OAAK,UAAU;AACf,OAAK,MAAM,IAAI,UAAU;GACxB,GAAG;GACH,SAAS;GACT,QAAQ,OAAO,UAAU;GACzB,SAAS;GACT,CAAC;AACF,OAAK,QAAQ,QAAQ,SAAS;;CAE/B,OAAO,QAAQ;AACd,SAAO,UAAU,QAAQ,KAAK,OAAO,OAAO;;;CAG7C,MAAM,IAAI,QAAQ,MAAM;EACvB,MAAM,MAAM,MAAM,KAAK,KAAK,KAAK,OAAO,OAAO,EAAE,EAAE,QAAQ,QAAQ,CAAC;AACpE,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,QAAQ,IAAI;AAClD,SAAO,OAAO,IAAI,QAAQ,IAAI,iBAAiB,CAAC,KAAK;;;;;;CAMtD,MAAM,OAAO,MAAM,QAAQ,YAAY;EACtC,MAAM,MAAM,KAAK,OAAO,OAAO,OAAO;EACtC,MAAM,UAAU;GACf,gBAAgB,YAAY,KAAK;GACjC,iBAAiB;GACjB;EACD,MAAM,YAAY,KAAK,QAAQ,sBAAsB,KAAK;AAC1D,MAAI,OAAO,QAAQ,WAAW;GAC7B,MAAM,SAAS,MAAM,KAAK,KAAK;AAC/B,OAAI;IACH,MAAM,OAAO,MAAM,OAAO,UAAU;AACpC,UAAM,KAAK,IAAI,KAAK,MAAM,OAAO,QAAQ,QAAQ;aACxC;AACT,UAAM,OAAO,OAAO;;AAErB,gBAAa;IACZ,MAAM,OAAO;IACb,OAAO,OAAO;IACd,CAAC;AACF;;AAED,QAAM,KAAK,YAAY,MAAM,KAAK,OAAO,MAAM,SAAS,WAAW;;;CAGpE,MAAM,QAAQ,QAAQ,aAAa,OAAO;EACzC,MAAM,MAAM,IAAI,IAAI,KAAK,IAAI,KAAK,OAAO,OAAO,CAAC,CAAC;AAClD,MAAI,aAAa,IAAI,iBAAiB,OAAO,KAAK,IAAI,YAAY,OAAO,CAAC,CAAC;AAC3E,UAAQ,MAAM,KAAK,IAAI,KAAK,KAAK;GAChC,QAAQ;GACR,KAAK,EAAE,WAAW,MAAM;GACxB,CAAC,EAAE;;CAEL,MAAM,IAAI,KAAK,MAAM,QAAQ,SAAS,QAAQ,IAAI;EACjD,MAAM,MAAM,MAAM,KAAK,KAAK,KAAK;GAChC,QAAQ;GACR;GACA,SAAS;IACR,GAAG;IACH,wBAAwB;IACxB;GACD;GACA,CAAC;AACF,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,KAAK,QAAQ,OAAO,IAAI;AACjD,SAAO;;CAER,MAAM,YAAY,MAAM,KAAK,MAAM,SAAS,YAAY;EACvD,MAAM,WAAW,KAAK,IAAI,KAAK,QAAQ,YAAY,KAAK,KAAK,KAAK,KAAK,OAAO,IAAI,EAAE,IAAI,IAAI;EAC5F,MAAM,UAAU,MAAM,KAAK,KAAK,KAAK;GACpC,QAAQ;GACR,OAAO;GACP;GACA,CAAC;AACF,MAAI,CAAC,QAAQ,GAAI,OAAM,MAAM,KAAK,QAAQ,yBAAyB,QAAQ;EAC3E,MAAM,WAAW,gCAAgC,KAAK,MAAM,QAAQ,MAAM,CAAC,GAAG;AAC9E,MAAI,CAAC,SAAU,OAAM,IAAI,aAAa,6CAA6C;EACnF,MAAM,KAAK,mBAAmB,SAAS;EACvC,MAAM,QAAQ,KAAK,KAAK,OAAO,SAAS;EACxC,MAAM,QAAQ,IAAI,MAAM,MAAM;EAC9B,MAAM,SAAS,MAAM,KAAK,KAAK;EAC/B,IAAI,OAAO;EACX,IAAI,OAAO;EACX,MAAM,SAAS,YAAY;AAC1B,UAAO,OAAO,OAAO;IACpB,MAAM,QAAQ;IACd,MAAM,SAAS,KAAK,IAAI,UAAU,OAAO,QAAQ,SAAS;IAC1D,MAAM,QAAQ,OAAO,MAAM,OAAO;AAClC,UAAM,OAAO,KAAK,OAAO,GAAG,QAAQ,QAAQ,SAAS;IACrD,MAAM,MAAM,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;AAC5D,UAAM,UAAU,MAAM,KAAK,IAAI,KAAK,OAAO,KAAK,EAAE,EAAE,cAAc,QAAQ,EAAE,YAAY,KAAK,EAAE,QAAQ,IAAI,OAAO,IAAI;AACtH,YAAQ;AACR,iBAAa;KACZ;KACA,OAAO;KACP,CAAC;;;AAGJ,MAAI;AACH,SAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,KAAK,QAAQ,eAAe,GAAG,MAAM,EAAE,EAAE,OAAO,CAAC;GACjG,MAAM,OAAO,4BAA4B,MAAM,KAAK,MAAM,MAAM,qBAAqB,IAAI,EAAE,qBAAqB,UAAU,KAAK,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;GAC1J,MAAM,OAAO,MAAM,KAAK,KAAK,KAAK;IACjC,QAAQ;IACR,OAAO,YAAY;IACnB;IACA,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,CAAC;GACF,MAAM,OAAO,MAAM,KAAK,MAAM;AAC9B,OAAI,CAAC,KAAK,MAAM,KAAK,SAAS,UAAU,CAAE,OAAM,IAAI,aAAa,mCAAmC,KAAK,OAAO,KAAK,UAAU,KAAK,IAAI,KAAK,OAAO;WAC5I,KAAK;AACb,SAAM,KAAK,KAAK,KAAK;IACpB,QAAQ;IACR,OAAO,YAAY;IACnB,CAAC,CAAC,YAAY,KAAK,EAAE;AACtB,SAAM;YACG;AACT,SAAM,OAAO,OAAO;;;CAGtB,IAAI,KAAK,QAAQ,IAAI;EACpB,MAAM,OAAO,KAAK,OAAO,SAAS,QAAQ,QAAQ,GAAG;EACrD,MAAMA,SAAO,IAAI,MAAM,IAAI,CAAC,IAAI,mBAAmB,CAAC,KAAK,IAAI;AAC7D,SAAO,GAAG,KAAK,GAAG,KAAK,OAAO,OAAO,GAAGA,SAAO,QAAQ,IAAI,UAAU;;CAEtE,MAAM,KAAK,KAAK,MAAM;EACrB,MAAM,SAAS,MAAM,KAAK,IAAI,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE;GAC7D,QAAQ,KAAK;GACb,SAAS,KAAK;GACd,MAAM,KAAK;GACX,CAAC;AACF,SAAO,KAAK,MAAM,OAAO;;CAE1B,MAAM,QAAQ,MAAM,KAAK;EACxB,MAAM,OAAO,MAAM,IAAI,MAAM,CAAC,YAAY,GAAG;EAC7C,MAAM,OAAO,IAAI,WAAW,MAAM,oEAAoE,IAAI,WAAW,MAAM,6CAA6C;AACxK,SAAO,IAAI,aAAa,GAAG,KAAK,GAAG,KAAK,OAAO,OAAO,WAAW,IAAI,OAAO,GAAG,UAAU,KAAK,CAAC,GAAG,QAAQ,IAAI,OAAO;;;AAGvH,SAAS,UAAU,KAAK;AACvB,QAAO,wBAAwB,KAAK,IAAI,GAAG,MAAM;;AAElD,SAAS,UAAU,MAAM;AACxB,QAAO,KAAK,QAAQ,MAAM,QAAQ,CAAC,QAAQ,MAAM,OAAO,CAAC,QAAQ,MAAM,SAAS;;;;;;;AAUjF,MAAM,OAAO;;AAEb,SAAS,eAAe,KAAK;AAC5B,MAAK,IAAI,KAAK,MAAM,KAAK,QAAQ,GAAG,EAAE;AACrC,MAAI,WAAW,KAAK,IAAI,KAAK,CAAC,CAAE,QAAO;AACvC,MAAI,QAAQ,GAAG,KAAK,GAAI,QAAO,KAAK;;;;AAItC,eAAe,oBAAoB,KAAK;CACvC,MAAM,OAAO,KAAK,KAAK,KAAK;AAC5B,KAAI,CAAC,WAAW,KAAK,CAAE,QAAO,KAAK;CACnC,IAAI;AACJ,KAAI;AACH,QAAM,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC;UACtC,KAAK;AACb,QAAM,IAAI,cAAc,GAAG,KAAK,sBAAsB,IAAI,UAAU;;AAErE,KAAI,IAAI,WAAW,KAAK,EAAG,QAAO,KAAK;CACvC,MAAM,UAAU,IAAI,YAAY,KAAK,IAAI,KAAK,IAAI,aAAa,IAAI,QAAQ;AAC3E,QAAO;EACN;EACA,QAAQ,YAAY,IAAI,QAAQ,QAAQ;EACxC;;;AAGF,MAAM,aAAa,IAAI;AACvB,MAAM,WAAW,IAAI,OAAO;;;;;AAK5B,eAAe,iBAAiB,KAAK,UAAU,EAAE,EAAE;CAClD,MAAM,OAAO,eAAe,IAAI;CAChC,MAAM,WAAW,QAAQ,MAAM,oBAAoB,KAAK;AACxD,KAAI,CAAC,QAAQ,CAAC,SAAU,QAAO,KAAK;CACpC,MAAM,yBAAyB,IAAI,KAAK;CACxC,MAAM,SAAS,SAAS;EACvB,MAAM,MAAM,SAAS,MAAM,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI;AACrD,SAAO,IAAI,WAAW,MAAM,GAAG,KAAK,IAAI,SAAS,OAAO;;AAEzD,QAAO;EACN;EACA;EACA,MAAM,IAAI,MAAM;GACf,MAAM,SAAS,MAAM,KAAK;AAC1B,OAAI,CAAC,OAAQ,QAAO,KAAK;GACzB,MAAM,SAAS,QAAQ,QAAQ,SAAS,QAAQ;AAChD,OAAI,OAAQ,QAAO;GACnB,MAAM,SAAS,OAAO,IAAI,OAAO,OAAO;AACxC,OAAI,UAAU,KAAK,KAAK,GAAG,OAAO,KAAK,SAAU,QAAO,OAAO;GAC/D,MAAM,EAAE,MAAM,WAAW,WAAW,SAAS,SAAS,OAAO,OAAO;GACpE,MAAM,OAAO,mBAAmB,MAAM,QAAQ,IAAI;AAClD,OAAI,CAAC,KAAM,QAAO,KAAK;GACvB,MAAM,MAAM,MAAM,IAAI,OAAO,QAAQ,MAAM,EAAE,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,OAAO,QAAQ,WAAW;AACvG,UAAO,IAAI,OAAO,QAAQ;IACzB;IACA,IAAI,KAAK,KAAK;IACd,CAAC;AACF,UAAO;;EAER"}