mindoodb 0.0.2 → 0.0.4

package/dist/node/server/types.d.ts

@@ -0,0 +1,162 @@
+import type { MindooDBServerInfo } from "../../core/types";
+/**
+ * Types for the MindooDB Example Server
+ */
+/**
+ * Store type for content-addressed stores.
+ */
+export type StoreType = "inmemory" | "file";
+/**
+ * Configuration for a user registered in the tenant.
+ * Users can be human clients or other servers (for server-to-server sync).
+ */
+export interface UserConfig {
+    /** Username identifier (e.g., "alice" or "server-eu-west") */
+    username: string;
+    /** Ed25519 public key in PEM format for signature verification */
+    signingPublicKey: string;
+    /** RSA-OAEP public key in PEM format for encryption */
+    encryptionPublicKey: string;
+}
+/**
+ * A remote server trusted for server-to-server sync.
+ * Stored globally in <dataDir>/trusted-servers.json.
+ */
+export interface TrustedServer extends MindooDBServerInfo {
+}
+/**
+ * Configuration for a remote server to sync with (per-tenant).
+ * The server authenticates using its global identity (from server.identity.json).
+ * The remote server's public keys are looked up from trusted-servers.json.
+ */
+export interface RemoteServerConfig {
+    /** Base URL of the remote server (e.g., "https://eu-west.example.com") */
+    url: string;
+    /** Optional: automatic sync interval in milliseconds */
+    syncIntervalMs?: number;
+    /** Optional: specific databases to sync (default: all) */
+    databases?: string[];
+}
+/**
+ * RemoteServerConfig with a required name, used when managing sync servers
+ * via the admin API. The name identifies the server for updates and deletes.
+ */
+export interface NamedRemoteServerConfig extends RemoteServerConfig {
+    /** Server name matching the trusted-servers identity (e.g., "CN=server2") */
+    name: string;
+}
+/**
+ * Per-database store configuration.
+ */
+export interface DatabaseStoreConfig {
+    storeType: StoreType;
+}
+/**
+ * Tenant configuration stored in <dataDir>/<tenantId>/config.json
+ *
+ * The tenantId is NOT stored here - it's derived from the directory name.
+ */
+export interface TenantConfig {
+    /** Admin username used for bootstrap authentication (e.g., "cn=admin/o=acme") */
+    adminUsername?: string;
+    /** Ed25519 public key in PEM format for verifying admin signatures */
+    adminSigningPublicKey: string;
+    /** RSA-OAEP public key in PEM format for encrypting admin-only data */
+    adminEncryptionPublicKey: string;
+    /** Base64-encoded $publicinfos AES-256 symmetric key for reading the directory DB */
+    publicInfosKey?: string;
+    /** Default store type for new databases (default: "file") */
+    defaultStoreType?: StoreType;
+    /** Per-database store configuration overrides */
+    databaseStores?: Record<string, DatabaseStoreConfig>;
+    /** Registered users (clients and other servers) — bootstrap/test fallback, ignored when publicInfosKey is present */
+    users?: UserConfig[];
+    /** Remote servers to sync with (for server-to-server sync) */
+    remoteServers?: RemoteServerConfig[];
+}
+/**
+ * Request body for POST /admin/register-tenant
+ */
+export interface RegisterTenantRequest {
+    /** Tenant identifier (lowercase, becomes directory name) */
+    tenantId: string;
+    /** Admin username used for bootstrap authentication */
+    adminUsername?: string;
+    /** Ed25519 public key in PEM format */
+    adminSigningPublicKey: string;
+    /** RSA-OAEP public key in PEM format */
+    adminEncryptionPublicKey: string;
+    /** Base64-encoded $publicinfos AES-256 symmetric key for reading the directory DB */
+    publicInfosKey?: string;
+    /** Default store type (default: "file") */
+    defaultStoreType?: StoreType;
+    /** Initial users to register (for testing/bootstrapping only, ignored when publicInfosKey is present) */
+    users?: UserConfig[];
+}
+/**
+ * Response body for POST /admin/register-tenant
+ */
+export interface RegisterTenantResponse {
+    success: boolean;
+    tenantId: string;
+    message?: string;
+}
+/**
+ * Response body for GET /admin/tenants
+ */
+export interface ListTenantsResponse {
+    tenants: string[];
+}
+/**
+ * Loaded tenant context used internally by the server.
+ */
+export interface TenantContext {
+    /** Tenant identifier (lowercase) */
+    tenantId: string;
+    /** Loaded tenant configuration */
+    config: TenantConfig;
+}
+/**
+ * A principal entry in a capability rule.
+ * Identifies a system admin by both username and public signing key.
+ *
+ * The special wildcard principal `{ username: "*", publicsignkey: "*" }`
+ * is reserved for demo tenant-creation rules and is rejected for all other
+ * system endpoints.
+ */
+export interface SystemAdminPrincipal {
+    username: string;
+    publicsignkey: string;
+}
+/**
+ * Server-level configuration loaded from config.json.
+ *
+ * The `capabilities` map controls which system admins can call which
+ * endpoints. Keys are `METHOD:PATHPATTERN` rules (e.g. `ALL:/system/*`,
+ * `POST:/system/tenants/company-*`). Values are arrays of principals
+ * allowed to call matching routes.
+ */
+export interface ServerConfig {
+    capabilities: Record<string, SystemAdminPrincipal[]>;
+}
+/**
+ * Environment variables used by the server.
+ */
+export declare const ENV_VARS: {
+    /** Password to decrypt server identity private keys and per-tenant keybags */
+    readonly SERVER_PASSWORD: "MINDOODB_SERVER_PASSWORD";
+    /**
+     * Path to a file whose contents are the server password (trimmed). If set, used
+     * instead of {@link ENV_VARS.SERVER_PASSWORD}. Prefer in Docker so the secret is
+     * not stored in the container environment block.
+     */
+    readonly SERVER_PASSWORD_FILE: "MINDOODB_SERVER_PASSWORD_FILE";
+    /**
+     * Optional comma-separated allowlist for /system/* (system admin HTTP surface).
+     * If unset or `*`, any client IP may call /system/* (JWT + capabilities still required).
+     * Supports exact IPv4/IPv6 addresses plus IPv4/IPv6 CIDRs.
+     * Example: `127.0.0.1,::1,10.0.0.0/8,2001:db8::/32`
+     */
+    readonly ADMIN_ALLOWED_IPS: "MINDOODB_ADMIN_ALLOWED_IPS";
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/node/server/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/node/server/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;GAEG;AAEH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;CAAG;AAE5D;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,wBAAwB,EAAE,MAAM,CAAC;IAEjC,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErD,qHAAqH;IACrH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IAErB,8DAA8D;IAC9D,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uCAAuC;IACvC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wCAAwC;IACxC,wBAAwB,EAAE,MAAM,CAAC;IACjC,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAC7B,yGAAyG;IACzG,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,MAAM,EAAE,YAAY,CAAC;CACtB;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,eAAO,MAAM,QAAQ;IACnB,8EAA8E;;IAE9E;;;;OAIG;;IAEH;;;;;OAKG;;CAEK,CAAC"}

package/dist/node/server/types.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENV_VARS = void 0;
+/**
+ * Environment variables used by the server.
+ */
+exports.ENV_VARS = {
+    /** Password to decrypt server identity private keys and per-tenant keybags */
+    SERVER_PASSWORD: "MINDOODB_SERVER_PASSWORD",
+    /**
+     * Path to a file whose contents are the server password (trimmed). If set, used
+     * instead of {@link ENV_VARS.SERVER_PASSWORD}. Prefer in Docker so the secret is
+     * not stored in the container environment block.
+     */
+    SERVER_PASSWORD_FILE: "MINDOODB_SERVER_PASSWORD_FILE",
+    /**
+     * Optional comma-separated allowlist for /system/* (system admin HTTP surface).
+     * If unset or `*`, any client IP may call /system/* (JWT + capabilities still required).
+     * Supports exact IPv4/IPv6 addresses plus IPv4/IPv6 CIDRs.
+     * Example: `127.0.0.1,::1,10.0.0.0/8,2001:db8::/32`
+     */
+    ADMIN_ALLOWED_IPS: "MINDOODB_ADMIN_ALLOWED_IPS",
+};
+//# sourceMappingURL=types.js.map

package/dist/node/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/node/server/types.ts"],"names":[],"mappings":";;;AAmKA;;GAEG;AACU,QAAA,QAAQ,GAAG;IACtB,8EAA8E;IAC9E,eAAe,EAAE,0BAA0B;IAC3C;;;;OAIG;IACH,oBAAoB,EAAE,+BAA+B;IACrD;;;;;OAKG;IACH,iBAAiB,EAAE,4BAA4B;CACvC,CAAC"}

package/dist/node/server/validation.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Input validation utilities for the MindooDB Example Server.
+ *
+ * Prevents path traversal, injection, and resource exhaustion attacks
+ * by enforcing strict rules on all user-supplied identifiers and arrays.
+ */
+/**
+ * Validates an identifier (tenantId, dbId, serverName, etc.).
+ * Must be 1-64 chars, lowercase alphanumeric + hyphens, start with alphanumeric.
+ * Rejects path separators, "..", leading dots, and special characters.
+ */
+export declare function validateIdentifier(value: unknown, fieldName: string): string;
+/**
+ * Validates a username (more permissive than identifier -- allows "CN=xxx/O=yyy" format).
+ * Max 256 chars, printable ASCII, no path separators or null bytes.
+ */
+export declare function validateUsername(value: unknown): string;
+/**
+ * Validates that an array does not exceed a maximum number of elements.
+ */
+export declare function validateArraySize(value: unknown, maxSize: number, fieldName: string): void;
+/**
+ * Validates that a string does not exceed a maximum length.
+ */
+export declare function validateStringLength(value: unknown, maxLength: number, fieldName: string): void;
+/**
+ * Tenant IDs that are reserved because they collide with server route prefixes.
+ */
+export declare const RESERVED_TENANT_NAMES: Set<string>;
+/**
+ * Validates tenant ID syntax without checking reserved route names.
+ */
+export declare function validateTenantIdFormat(value: unknown): string;
+/**
+ * Validates a tenant ID: must pass tenant ID syntax rules and must not be reserved.
+ */
+export declare function validateTenantId(value: unknown): string;
+export declare class ValidationError extends Error {
+    constructor(message: string);
+}
+export declare const MAX_HAVE_IDS = 100000;
+export declare const MAX_ENTRY_IDS = 100000;
+export declare const MAX_PUT_ENTRIES = 10000;
+export declare const MAX_PEM_KEY_LENGTH = 8192;
+export declare const MAX_SIGNATURE_LENGTH = 4096;
+export declare const MAX_CHALLENGE_LENGTH = 4096;
+//# sourceMappingURL=validation.d.ts.map

package/dist/node/server/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/node/server/validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgB5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAcvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU1F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAU/F;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAoD,CAAC;AAEvF;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgB7D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQvD;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAGD,eAAO,MAAM,YAAY,SAAU,CAAC;AACpC,eAAO,MAAM,aAAa,SAAU,CAAC;AACrC,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AACxC,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAC1C,eAAO,MAAM,oBAAoB,OAAQ,CAAC"}

package/dist/node/server/validation.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * Input validation utilities for the MindooDB Example Server.
+ *
+ * Prevents path traversal, injection, and resource exhaustion attacks
+ * by enforcing strict rules on all user-supplied identifiers and arrays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CHALLENGE_LENGTH = exports.MAX_SIGNATURE_LENGTH = exports.MAX_PEM_KEY_LENGTH = exports.MAX_PUT_ENTRIES = exports.MAX_ENTRY_IDS = exports.MAX_HAVE_IDS = exports.ValidationError = exports.RESERVED_TENANT_NAMES = void 0;
+exports.validateIdentifier = validateIdentifier;
+exports.validateUsername = validateUsername;
+exports.validateArraySize = validateArraySize;
+exports.validateStringLength = validateStringLength;
+exports.validateTenantIdFormat = validateTenantIdFormat;
+exports.validateTenantId = validateTenantId;
+/**
+ * Validates an identifier (tenantId, dbId, serverName, etc.).
+ * Must be 1-64 chars, lowercase alphanumeric + hyphens, start with alphanumeric.
+ * Rejects path separators, "..", leading dots, and special characters.
+ */
+function validateIdentifier(value, fieldName) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ValidationError(`${fieldName} is required and must be a non-empty string`);
+    }
+    if (value.length > 64) {
+        throw new ValidationError(`${fieldName} must be at most 64 characters`);
+    }
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+        throw new ValidationError(`${fieldName} must start with a letter or digit and contain only lowercase letters, digits, and hyphens`);
+    }
+    return value;
+}
+/**
+ * Validates a username (more permissive than identifier -- allows "CN=xxx/O=yyy" format).
+ * Max 256 chars, printable ASCII, no path separators or null bytes.
+ */
+function validateUsername(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ValidationError("username is required and must be a non-empty string");
+    }
+    if (value.length > 256) {
+        throw new ValidationError("username must be at most 256 characters");
+    }
+    if (/[\x00-\x1f\x7f]/.test(value)) {
+        throw new ValidationError("username must not contain control characters");
+    }
+    return value;
+}
+/**
+ * Validates that an array does not exceed a maximum number of elements.
+ */
+function validateArraySize(value, maxSize, fieldName) {
+    if (!Array.isArray(value)) {
+        return;
+    }
+    if (value.length > maxSize) {
+        throw new ValidationError(`${fieldName} must contain at most ${maxSize} elements (received ${value.length})`);
+    }
+}
+/**
+ * Validates that a string does not exceed a maximum length.
+ */
+function validateStringLength(value, maxLength, fieldName) {
+    if (typeof value !== "string") {
+        return;
+    }
+    if (value.length > maxLength) {
+        throw new ValidationError(`${fieldName} must be at most ${maxLength} characters`);
+    }
+}
+/**
+ * Tenant IDs that are reserved because they collide with server route prefixes.
+ */
+exports.RESERVED_TENANT_NAMES = new Set(["admin", "system", "health", "statics"]);
+/**
+ * Validates tenant ID syntax without checking reserved route names.
+ */
+function validateTenantIdFormat(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new ValidationError("tenantId is required and must be a non-empty string");
+    }
+    if (value.length > 64) {
+        throw new ValidationError("tenantId must be at most 64 characters");
+    }
+    if (!/^[a-z0-9][a-z0-9_-]*$/.test(value)) {
+        throw new ValidationError("tenantId must start with a letter or digit and contain only lowercase letters, digits, hyphens, and underscores");
+    }
+    return value;
+}
+/**
+ * Validates a tenant ID: must pass tenant ID syntax rules and must not be reserved.
+ */
+function validateTenantId(value) {
+    const id = validateTenantIdFormat(value);
+    if (exports.RESERVED_TENANT_NAMES.has(id)) {
+        throw new ValidationError(`tenantId "${id}" is reserved and cannot be used`);
+    }
+    return id;
+}
+class ValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ValidationError";
+    }
+}
+exports.ValidationError = ValidationError;
+// Limits
+exports.MAX_HAVE_IDS = 100000;
+exports.MAX_ENTRY_IDS = 100000;
+exports.MAX_PUT_ENTRIES = 10000;
+exports.MAX_PEM_KEY_LENGTH = 8192;
+exports.MAX_SIGNATURE_LENGTH = 4096;
+exports.MAX_CHALLENGE_LENGTH = 4096;
+//# sourceMappingURL=validation.js.map

package/dist/node/server/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/node/server/validation.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAOH,gDAgBC;AAMD,4CAcC;AAKD,8CAUC;AAKD,oDAUC;AAUD,wDAgBC;AAKD,4CAQC;AA9GD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,KAAc,EAAE,SAAiB;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,6CAA6C,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,GAAG,SAAS,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,4FAA4F,CACzG,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,8CAA8C,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,KAAc,EAAE,OAAe,EAAE,SAAiB;IAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,yBAAyB,OAAO,uBAAuB,KAAK,CAAC,MAAM,GAAG,CACnF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,oBAAoB,CAAC,KAAc,EAAE,SAAiB,EAAE,SAAiB;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CACvB,GAAG,SAAS,oBAAoB,SAAS,aAAa,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACU,QAAA,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvF;;GAEG;AACH,SAAgB,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,qDAAqD,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,eAAe,CACvB,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,6BAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CACvB,aAAa,EAAE,kCAAkC,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED,SAAS;AACI,QAAA,YAAY,GAAG,MAAO,CAAC;AACvB,QAAA,aAAa,GAAG,MAAO,CAAC;AACxB,QAAA,eAAe,GAAG,KAAM,CAAC;AACzB,QAAA,kBAAkB,GAAG,IAAK,CAAC;AAC3B,QAAA,oBAAoB,GAAG,IAAK,CAAC;AAC7B,QAAA,oBAAoB,GAAG,IAAK,CAAC"}

package/dist/reactnative/cache/MMKVLocalCacheStore.d.ts

@@ -0,0 +1,48 @@
+import type { LocalCacheStore } from "../../core/cache/LocalCacheStore";
+/**
+ * Minimal MMKV interface (subset of react-native-mmkv).
+ * Allows consumers to pass their own MMKV instance without
+ * us importing the native module at the library level.
+ */
+export interface MMKVInterface {
+    set(key: string, value: ArrayBuffer | boolean | string | number): void;
+    getBuffer(key: string): ArrayBuffer | undefined;
+    delete(key: string): void;
+    getAllKeys(): string[];
+    clearAll(): void;
+}
+/**
+ * Minimal AsyncStorage interface (subset of @react-native-async-storage/async-storage).
+ */
+export interface AsyncStorageInterface {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+    getAllKeys(): Promise<readonly string[]>;
+    clear(): Promise<void>;
+}
+/**
+ * React Native {@link LocalCacheStore} backed by MMKV (synchronous, fast, binary-safe)
+ * with an AsyncStorage fallback for environments where MMKV is unavailable.
+ */
+export declare class MMKVLocalCacheStore implements LocalCacheStore {
+    private mmkv;
+    private asyncStorage;
+    private readonly keyPrefix;
+    /**
+     * @param mmkv          An MMKV instance (from react-native-mmkv)
+     * @param asyncStorage  Fallback AsyncStorage instance (used when mmkv is null)
+     * @param keyPrefix     Optional prefix to namespace all keys (default: "mindoodb-cache:")
+     */
+    constructor(mmkv: MMKVInterface | null, asyncStorage?: AsyncStorageInterface | null, keyPrefix?: string);
+    private toKey;
+    private fromKey;
+    private static toBase64;
+    private static fromBase64;
+    get(type: string, id: string): Promise<Uint8Array | null>;
+    put(type: string, id: string, value: Uint8Array): Promise<void>;
+    delete(type: string, id: string): Promise<void>;
+    list(type: string): Promise<string[]>;
+    clear(): Promise<void>;
+}
+//# sourceMappingURL=MMKVLocalCacheStore.d.ts.map

package/dist/reactnative/cache/MMKVLocalCacheStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MMKVLocalCacheStore.d.ts","sourceRoot":"","sources":["../../../src/reactnative/cache/MMKVLocalCacheStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,IAAI,MAAM,EAAE,CAAC;IACvB,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,UAAU,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC;;;;OAIG;gBAED,IAAI,EAAE,aAAa,GAAG,IAAI,EAC1B,YAAY,CAAC,EAAE,qBAAqB,GAAG,IAAI,EAC3C,SAAS,GAAE,MAA0B;IAWvC,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,MAAM,CAAC,QAAQ;IAQvB,OAAO,CAAC,MAAM,CAAC,UAAU;IAWnB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAczD,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW/C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB7B"}

package/dist/reactnative/cache/MMKVLocalCacheStore.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MMKVLocalCacheStore = void 0;
+/**
+ * React Native {@link LocalCacheStore} backed by MMKV (synchronous, fast, binary-safe)
+ * with an AsyncStorage fallback for environments where MMKV is unavailable.
+ */
+class MMKVLocalCacheStore {
+    /**
+     * @param mmkv          An MMKV instance (from react-native-mmkv)
+     * @param asyncStorage  Fallback AsyncStorage instance (used when mmkv is null)
+     * @param keyPrefix     Optional prefix to namespace all keys (default: "mindoodb-cache:")
+     */
+    constructor(mmkv, asyncStorage, keyPrefix = "mindoodb-cache:") {
+        this.mmkv = mmkv;
+        this.asyncStorage = asyncStorage ?? null;
+        this.keyPrefix = keyPrefix;
+        if (!this.mmkv && !this.asyncStorage) {
+            throw new Error("MMKVLocalCacheStore requires either an MMKV instance or AsyncStorage fallback");
+        }
+    }
+    toKey(type, id) {
+        return `${this.keyPrefix}${type}\0${id}`;
+    }
+    fromKey(raw) {
+        if (!raw.startsWith(this.keyPrefix))
+            return null;
+        const rest = raw.slice(this.keyPrefix.length);
+        const sep = rest.indexOf("\0");
+        if (sep === -1)
+            return null;
+        return { type: rest.slice(0, sep), id: rest.slice(sep + 1) };
+    }
+    // ---- Uint8Array <-> base64 for AsyncStorage (which only stores strings) ----
+    static toBase64(data) {
+        let binary = "";
+        for (let i = 0; i < data.length; i++) {
+            binary += String.fromCharCode(data[i]);
+        }
+        return btoa(binary);
+    }
+    static fromBase64(b64) {
+        const binary = atob(b64);
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    // ---- LocalCacheStore ----
+    async get(type, id) {
+        const key = this.toKey(type, id);
+        if (this.mmkv) {
+            const buf = this.mmkv.getBuffer(key);
+            if (buf === undefined)
+                return null;
+            return new Uint8Array(buf);
+        }
+        const str = await this.asyncStorage.getItem(key);
+        if (str === null)
+            return null;
+        return MMKVLocalCacheStore.fromBase64(str);
+    }
+    async put(type, id, value) {
+        const key = this.toKey(type, id);
+        if (this.mmkv) {
+            const buf = value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength);
+            this.mmkv.set(key, buf);
+            return;
+        }
+        await this.asyncStorage.setItem(key, MMKVLocalCacheStore.toBase64(value));
+    }
+    async delete(type, id) {
+        const key = this.toKey(type, id);
+        if (this.mmkv) {
+            this.mmkv.delete(key);
+            return;
+        }
+        await this.asyncStorage.removeItem(key);
+    }
+    async list(type) {
+        const prefix = `${this.keyPrefix}${type}\0`;
+        if (this.mmkv) {
+            return this.mmkv
+                .getAllKeys()
+                .filter(k => k.startsWith(prefix))
+                .map(k => k.slice(prefix.length));
+        }
+        const allKeys = await this.asyncStorage.getAllKeys();
+        return Array.from(allKeys)
+            .filter(k => k.startsWith(prefix))
+            .map(k => k.slice(prefix.length));
+    }
+    async clear() {
+        if (this.mmkv) {
+            const allKeys = this.mmkv.getAllKeys();
+            for (const key of allKeys) {
+                if (key.startsWith(this.keyPrefix)) {
+                    this.mmkv.delete(key);
+                }
+            }
+            return;
+        }
+        const allKeys = await this.asyncStorage.getAllKeys();
+        for (const key of allKeys) {
+            if (key.startsWith(this.keyPrefix)) {
+                await this.asyncStorage.removeItem(key);
+            }
+        }
+    }
+}
+exports.MMKVLocalCacheStore = MMKVLocalCacheStore;
+//# sourceMappingURL=MMKVLocalCacheStore.js.map

package/dist/reactnative/cache/MMKVLocalCacheStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MMKVLocalCacheStore.js","sourceRoot":"","sources":["../../../src/reactnative/cache/MMKVLocalCacheStore.ts"],"names":[],"mappings":";;;AA0BA;;;GAGG;AACH,MAAa,mBAAmB;IAK9B;;;;OAIG;IACH,YACE,IAA0B,EAC1B,YAA2C,EAC3C,YAAoB,iBAAiB;QAErC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAE3B,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAY,EAAE,EAAU;QACpC,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC;IAC3C,CAAC;IAEO,OAAO,CAAC,GAAW;QACzB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,+EAA+E;IAEvE,MAAM,CAAC,QAAQ,CAAC,IAAgB;QACtC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,GAAW;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,EAAU;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,KAAiB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAgB,CAAC;YACrG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAa,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,EAAU;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,YAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC;QAE5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI;iBACb,UAAU,EAAE;iBACZ,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAa,CAAC,UAAU,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAa,CAAC,UAAU,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAa,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAhID,kDAgIC"}

package/dist/reactnative/crypto/AESAdapter.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AES-GCM Adapter
+ * Implements AES-GCM encryption/decryption using node-forge
+ */
+export interface AESGCMParams {
+    name: "AES-GCM";
+    iv: BufferSource;
+    tagLength?: number;
+}
+/**
+ * Encrypt data with AES-GCM
+ */
+export declare function aesGcmEncrypt(params: AESGCMParams, key: CryptoKey | ArrayBuffer, data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+/**
+ * Decrypt data with AES-GCM
+ */
+export declare function aesGcmDecrypt(params: AESGCMParams, key: CryptoKey | ArrayBuffer, data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer>;
+//# sourceMappingURL=AESAdapter.d.ts.map

package/dist/reactnative/crypto/AESAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AESAdapter.d.ts","sourceRoot":"","sources":["../../../src/reactnative/crypto/AESAdapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,YAAY,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,SAAS,GAAG,WAAW,EAC5B,IAAI,EAAE,WAAW,GAAG,UAAU,GAC7B,OAAO,CAAC,WAAW,CAAC,CAqDtB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,SAAS,GAAG,WAAW,EAC5B,IAAI,EAAE,WAAW,GAAG,UAAU,GAC7B,OAAO,CAAC,WAAW,CAAC,CA8CtB"}