mindoodb 0.0.19 → 0.0.21

package/dist/core/keys/KeyBag.d.ts

@@ -2,32 +2,222 @@ import { EncryptedPrivateKey } from "../types";
 import { type KeyType } from "./KeyContext";
 import { CryptoAdapter } from "../crypto/CryptoAdapter";
 import { Logger } from "../logging";
+/**
+ * Opaque cursor into the {@link KeyBag} local changes feed.
+ *
+ * `changeSeq` is a monotonic in-memory sequence number assigned to each
+ * doc-key mutation by {@link KeyBag.recordKeyChange}. The sequence is
+ * local to a single `KeyBag` instance and resets when the bag is
+ * recreated; cursors must therefore not be persisted across process
+ * restarts.
+ */
+export interface KeyBagChangeCursor {
+    changeSeq: number;
+}
+/**
+ * High-level intent of a doc-key mutation event emitted by the {@link KeyBag}
+ * local changes feed. The action describes what the caller did to the bag,
+ * not whether a key remains afterwards (see {@link KeyBagChangeEvent.hasKey}).
+ */
+export type KeyBagChangeAction = "add" | "remove";
+/**
+ * One event in the local {@link KeyBag} changes feed.
+ *
+ * Events are emitted by {@link KeyBag.set}, {@link KeyBag.createDocKey},
+ * {@link KeyBag.createTenantKey}, {@link KeyBag.decryptAndImportKey},
+ * {@link KeyBag.deleteKey}, and {@link KeyBag.deleteKeyVersion} whenever the
+ * set of available doc-key versions for a scoped key id actually changes.
+ *
+ * Events intentionally never carry raw key bytes: they are designed to be
+ * safe to pass through telemetry, listeners, and tests without expanding the
+ * exposure surface of secret material.
+ */
+export interface KeyBagChangeEvent {
+    /** Monotonic local sequence number assigned at emit time. */
+    changeSeq: number;
+    /** Scoped key type (currently always `"doc"`). */
+    type: KeyType;
+    /** Tenant the affected key belongs to. */
+    tenantId: string;
+    /** Key identifier within the tenant (e.g. `"default"`, `"$publicinfos"`, or a named key id). */
+    keyId: string;
+    /** Whether the caller added a key version or removed one. */
+    action: KeyBagChangeAction;
+    /** Number of remaining stored versions for this scoped key id after the mutation. */
+    versionsRemaining: number;
+    /** Convenience flag equal to `versionsRemaining > 0`. */
+    hasKey: boolean;
+}
+/**
+ * Listener callback registered through {@link KeyBag.onChanges}.
+ *
+ * Listener invocations happen synchronously from the mutating call site
+ * after the underlying key store has been updated. Listeners must be
+ * short-lived; long-running work should be deferred (`void`-prefixed
+ * promises or microtask scheduling are recommended).
+ */
+export type KeyBagChangeListener = (event: KeyBagChangeEvent) => void;
 export interface KeyDetail {
     scopedKeyId: string;
     createdAt?: number;
     keyLengthBits: number;
     versionIndex: number;
 }
+/**
+ * Options accepted by {@link KeyBag.constructor} when constructing a KeyBag from
+ * an already-derived AES-GCM wrapping {@link CryptoKey}.
+ *
+ * Prefer this form over the legacy password-taking constructor: the wrapping
+ * key can be derived once during user login (via {@link KeyBag.deriveWrappingKey})
+ * and held as a non-extractable {@link CryptoKey} for the lifetime of the
+ * session, so {@link KeyBag.save} and {@link KeyBag.load} no longer need to
+ * re-run PBKDF2 or hold the plaintext password in memory.
+ */
+export interface KeyBagWrappingKeyOptions {
+    /**
+     * The AES-GCM {@link CryptoKey} used to encrypt/decrypt the persisted KeyBag
+     * blob. Must have `usages` including `["encrypt", "decrypt"]`. Typically
+     * imported with `extractable: false` to avoid the raw bytes leaking into
+     * the JS heap.
+     */
+    wrappingKey: CryptoKey;
+    /** Crypto adapter to use for encryption and decryption. */
+    cryptoAdapter: CryptoAdapter;
+    /** Optional logger instance. */
+    logger?: Logger;
+}
 /**
  * The KeyBag is used to store encryption keys that the current user has access to
  * in order to decrypt document changes stored in the AppendOnlyStore.
  * Supports key rotation by storing multiple versions per keyId (newest first).
+ *
+ * Two construction modes are supported:
+ *  - Legacy: pass `(userEncryptionKey, password, cryptoAdapter, ...)`. Each
+ *    {@link save} / {@link load} call re-derives the AES-GCM wrapping key from
+ *    `password` via PBKDF2. Required `password` is held by the instance for
+ *    its lifetime.
+ *  - Preferred: pass `({ wrappingKey, cryptoAdapter, ... })`. The caller has
+ *    already derived the wrapping key (e.g. via {@link deriveWrappingKey})
+ *    and the bag never sees the password. PBKDF2 runs zero times in this
+ *    mode, and the bag is safe to persist/restore from storage repeatedly
+ *    without password-handling overhead.
  */
 export declare class KeyBag {
     private userEncryptionKey;
     private userEncryptionKeyPassword;
+    private wrappingKey;
     private keys;
+    /**
+     * In-memory append-only log of doc-key mutations applied to this bag.
+     *
+     * Used by {@link iterateChangesSince} and {@link getLatestChangeCursor}
+     * so consumers (notably {@link BaseMindooTenant}) can reconcile state
+     * from a cursor even if they missed live listener notifications.
+     *
+     * Bound by the number of doc-key mutations per session, which in
+     * practice is small (one entry per add/remove/version change).
+     */
+    private keyChanges;
+    private nextKeyChangeSeq;
+    private changeListeners;
     private cryptoAdapter;
     private logger;
     /**
-     * Creates a new KeyBag instance.
+     * Creates a KeyBag from a user encryption key + password (legacy form).
      *
-     * @param userEncryptionKey The encrypted user encryption key
-     * @param userEncryptionKeyPassword The password to decrypt the user encryption key
-     * @param cryptoAdapter The crypto adapter to use for encryption and decryption
-     * @param logger Optional logger instance
+     * @deprecated Prefer the wrapping-key constructor overload. The password
+     *   form holds the plaintext password for the lifetime of the bag and
+     *   re-runs PBKDF2 on every {@link save}/{@link load} call.
+     *
+     * @param userEncryptionKey The encrypted user encryption key (provides
+     *   the salt used for KeyBag wrapping-key derivation).
+     * @param userEncryptionKeyPassword The password to derive the KeyBag
+     *   wrapping key.
+     * @param cryptoAdapter The crypto adapter to use for encryption and
+     *   decryption.
+     * @param logger Optional logger instance.
      */
     constructor(userEncryptionKey: EncryptedPrivateKey, userEncryptionKeyPassword: string, cryptoAdapter: CryptoAdapter, logger?: Logger);
+    /**
+     * Creates a KeyBag from a pre-derived AES-GCM wrapping {@link CryptoKey}.
+     *
+     * Recommended for production use: derive `wrappingKey` once at login via
+     * {@link KeyBag.deriveWrappingKey} and reuse it across {@link save}/{@link load}.
+     * No plaintext password is retained by the bag in this mode.
+     */
+    constructor(options: KeyBagWrappingKeyOptions);
+    /**
+     * Derives the AES-GCM wrapping {@link CryptoKey} that {@link KeyBag.save}
+     * and {@link KeyBag.load} use to encrypt/decrypt the persisted bag blob.
+     *
+     * This runs PBKDF2 once with the same parameters the legacy constructor
+     * uses internally (combined salt = `userEncryptionKey.salt` +
+     * `"key-bag-encryption"`, iterations from
+     * {@link resolvePbkdf2Iterations}), so a key derived here is fully
+     * interchangeable with the password-derived key for both new and existing
+     * persisted bags.
+     *
+     * Callers that want to eliminate plaintext-password retention should
+     * derive the wrapping key once at login and pass it to the
+     * {@link KeyBagWrappingKeyOptions} constructor overload.
+     *
+     * @param userEncryptionKey The user's encrypted encryption key (provides
+     *   the salt). Only `userEncryptionKey.salt` is read; the encrypted
+     *   bytes are not touched.
+     * @param password The user's password.
+     * @param cryptoAdapter Crypto adapter to use for the derivation.
+     * @param options.extractable Whether the returned key should be
+     *   extractable. Defaults to `false` so the raw bytes never appear in
+     *   the JS heap.
+     */
+    static deriveWrappingKey(userEncryptionKey: EncryptedPrivateKey, password: string, cryptoAdapter: CryptoAdapter, options?: {
+        extractable?: boolean;
+    }): Promise<CryptoKey>;
+    private static isWrappingKeyOptions;
+    private static staticBase64ToUint8Array;
+    /**
+     * Subscribe to live doc-key mutation events.
+     *
+     * Listeners receive a shallow copy of the same {@link KeyBagChangeEvent}
+     * record that gets appended to the internal feed, so reads via
+     * {@link iterateChangesSince} stay consistent with what listeners see.
+     * Listener exceptions are caught and logged so they cannot break the
+     * mutating call site.
+     *
+     * Live notifications are a convenience: callers that need to be robust
+     * against missed events should also persist a cursor and replay through
+     * {@link iterateChangesSince}.
+     *
+     * @returns A disposer that removes the listener.
+     */
+    onChanges(listener: KeyBagChangeListener): () => void;
+    /**
+     * Snapshot the current head of the local changes feed.
+     *
+     * Returns `null` when no doc-key mutations have ever been observed by
+     * this bag instance. Useful as a starting cursor when a consumer wants
+     * to react only to *future* changes.
+     */
+    getLatestChangeCursor(): KeyBagChangeCursor | null;
+    /**
+     * Iterate doc-key mutation events strictly after the given cursor.
+     *
+     * Pass `null` to consume all events since the bag was created. Yielded
+     * events are independent copies, so consumers may mutate them freely
+     * without affecting other listeners. Events are emitted in the order
+     * the underlying mutations occurred, which is also the order of their
+     * `changeSeq` values.
+     */
+    iterateChangesSince(cursor: KeyBagChangeCursor | null): AsyncGenerator<KeyBagChangeEvent, void, unknown>;
+    /**
+     * Append a doc-key mutation event to the local feed and notify
+     * subscribed listeners.
+     *
+     * Called from every mutation site after the underlying `keys` map has
+     * been updated. Never includes raw key bytes in the recorded event so
+     * the feed is safe to expose to telemetry or external consumers.
+     */
+    private recordKeyChange;
     /**
      * Reads a key from the key bag.
      * Returns the newest key (based on createdAt) or the first key if no timestamps are available.
@@ -110,6 +300,29 @@ export declare class KeyBag {
      * @return A promise that resolves to an array of key IDs
      */
     listKeys(): Promise<string[]>;
+    /**
+     * Build a stable fingerprint of the doc-type keys available for a given
+     * tenant.
+     *
+     * The fingerprint changes whenever the *set* of scoped key ids the bag
+     * holds for `doc:tenantId:*` gains or loses an entry, but does not
+     * depend on key version counts or key material. It is used by
+     * {@link BaseMindooDB} to short-circuit visibility reconciliation on
+     * warm starts when the bag composition has not changed since the last
+     * cache flush, avoiding an otherwise unconditional full metadata scan
+     * against the underlying store (potentially several REST round-trips
+     * against a remote store).
+     *
+     * Implementation notes:
+     * - Scoped key ids are not secret (only key bytes are), so we use the
+     *   sorted ids directly rather than hashing them. This keeps the
+     *   fingerprint debuggable and avoids dragging crypto into a hot
+     *   startup path.
+     * - The leading `v1:` tag is a format version so future iterations can
+     *   extend the fingerprint without colliding with old persisted
+     *   values.
+     */
+    getDocKeyFingerprint(tenantId: string): Promise<string>;
     /**
      * Lists all stored key versions with metadata, newest first within each scoped key.
      */
@@ -117,21 +330,45 @@ export declare class KeyBag {
     /**
      * Creates an in-memory clone of this KeyBag.
      * The clone contains deep-copied key material and independent key maps.
+     *
+     * The clone follows the same construction mode as this instance:
+     *  - bags built with the wrapping-key constructor are cloned with the
+     *    same {@link CryptoKey} reference (the underlying key handle is safe
+     *    to share across instances - it is treated as immutable),
+     *  - bags built with the legacy password constructor are cloned with the
+     *    same encrypted user key + plaintext password.
      */
     clone(): KeyBag;
     /**
-     * Save the key bag to a binary data blob, encrypted with the user encryption key.
+     * Save the key bag to a binary data blob, encrypted with the wrapping key
+     * (either the {@link CryptoKey} provided to the constructor or one derived
+     * on demand from the legacy password).
      *
      * @return A promise that resolves to the encrypted binary data (Uint8Array)
      */
     save(): Promise<Uint8Array>;
     /**
-     * Load the key bag from a binary data blob, decrypted with the user encryption key.
+     * Load the key bag from a binary data blob, decrypted with the wrapping key
+     * (either the {@link CryptoKey} provided to the constructor or one derived
+     * on demand from the legacy password).
      *
      * @param encryptedData The encrypted binary data to load (Uint8Array)
      * @return A promise that resolves when the keys are loaded
      */
     load(encryptedData: Uint8Array): Promise<void>;
+    /**
+     * Returns the AES-GCM wrapping key used for {@link save}/{@link load}.
+     *
+     * - If this bag was constructed with a pre-derived `wrappingKey`, returns
+     *   that key directly. The caller-supplied key already supports both
+     *   `encrypt` and `decrypt`, so no per-usage derivation is needed.
+     * - Otherwise (legacy password constructor), derives a wrapping key from
+     *   the stored password + user encryption salt via PBKDF2 with the
+     *   requested usage. The derived key is intentionally not cached on the
+     *   instance: the password constructor is the slow path and exists for
+     *   backward compatibility only.
+     */
+    private resolveWrappingKey;
     /**
      * Internal method to decrypt a private key using password-based key derivation.
      *

package/dist/core/keys/KeyBag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KeyBag.d.ts","sourceRoot":"","sources":["../../../src/core/keys/KeyBag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EAAE,KAAK,OAAO,EAA4C,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAUtE,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,iBAAiB,CAAsB;IAC/C,OAAO,CAAC,yBAAyB,CAAS;IAC1C,OAAO,CAAC,IAAI,CAAsC;IAClD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;;;OAOG;gBACS,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM;IASpI;;;;;;OAMG;IACG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAkBlF;;;;;;OAMG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAkBpF;;;;;;;OAOG;IACG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1G;;;OAGG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF;;;;;;;;;OASG;IACG,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjI;;;;;;;;OAQG;IACG,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA2C7H;;;;OAIG;IACG,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAiC1J;;;;;;OAMG;IACG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3E;;;;OAIG;IACG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBxG;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAInC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAgB5C;;;OAGG;IACH,KAAK,IAAI,MAAM;IAsBf;;;;OAIG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IAgGjC;;;;;OAKG;IACG,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA8FpD;;;;;;;OAOG;YACW,iBAAiB;IA+D/B;;OAEG;YACW,0BAA0B;IAyBxC,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,0BAA0B;IAelC;;;;;;;;OAQG;YACW,iBAAiB;IAmF/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAO3B"}
+{"version":3,"file":"KeyBag.d.ts","sourceRoot":"","sources":["../../../src/core/keys/KeyBag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EAAE,KAAK,OAAO,EAA4C,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAUtE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,IAAI,EAAE,OAAO,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,gGAAgG;IAChG,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,MAAM,EAAE,kBAAkB,CAAC;IAC3B,qFAAqF;IACrF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAEtE,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,WAAW,EAAE,SAAS,CAAC;IACvB,2DAA2D;IAC3D,aAAa,EAAE,aAAa,CAAC;IAC7B,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,yBAAyB,CAAgB;IACjD,OAAO,CAAC,WAAW,CAAmB;IACtC,OAAO,CAAC,IAAI,CAAsC;IAClD;;;;;;;;;OASG;IACH,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,eAAe,CAAwC;IAC/D,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,MAAM,CAAS;IAEvB;;;;;;;;;;;;;;OAcG;gBACS,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,MAAM;IACpI;;;;;;OAMG;gBACS,OAAO,EAAE,wBAAwB;IA8B7C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;WACU,iBAAiB,CAC5B,iBAAiB,EAAE,mBAAmB,EACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,aAAa,EAC5B,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAClC,OAAO,CAAC,SAAS,CAAC;IAqCrB,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAOnC,OAAO,CAAC,MAAM,CAAC,wBAAwB;IASvC;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAOrD;;;;;;OAMG;IACH,qBAAqB,IAAI,kBAAkB,GAAG,IAAI;IAKlD;;;;;;;;OAQG;IACI,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAAG,cAAc,CAAC,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC;IAS/G;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IA6BvB;;;;;;OAMG;IACG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAkBlF;;;;;;OAMG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAkBpF;;;;;;;OAOG;IACG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1G;;;OAGG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1E;;;OAGG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF;;;;;;;;;OASG;IACG,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjI;;;;;;;;OAQG;IACG,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA2C7H;;;;OAIG;IACG,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAiC1J;;;;;;OAMG;IACG,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW3E;;;;OAIG;IACG,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxG;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAInC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAY7D;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAgB5C;;;;;;;;;;OAUG;IACH,KAAK,IAAI,MAAM;IAkCf;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;IAgDjC;;;;;;;OAOG;IACG,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDpD;;;;;;;;;;;OAWG;YACW,kBAAkB;IAiDhC;;;;;;;OAOG;YACW,iBAAiB;IA+D/B;;OAEG;YACW,0BAA0B;IAyBxC,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,0BAA0B;IAelC;;;;;;;;OAQG;YACW,iBAAiB;IAmF/B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAO3B"}