mindoodb 0.0.23 → 0.0.32

package/dist/core/BaseMindooTenant.d.ts

@@ -1,4 +1,4 @@
-import { MindooTenant, EncryptedPrivateKey, MindooDB, ContentAddressedStore, ContentAddressedStoreFactory, StoreKind, OpenDBOptions, MindooTenantFactory, MindooTenantDirectory, SigningKeyPair, JoinRequest, JoinResponse, ApproveJoinRequestOptions, PublishToServerOptions } from "./types";
+import { MindooTenant, EncryptedPrivateKey, MindooDB, ContentAddressedStore, ContentAddressedStoreFactory, StoreKind, OpenDBOptions, MindooTenantFactory, MindooTenantDirectory, StoreEntryMetadata, SigningKeyPair, JoinRequest, JoinResponse, ApproveJoinRequestOptions, PublishToServerOptions } from "./types";
 import { PrivateUserId, PublicUserId } from "./userid";
 import { CryptoAdapter } from "./crypto/CryptoAdapter";
 import { KeyBag } from "./keys/KeyBag";
@@ -54,7 +54,23 @@ export declare class BaseMindooTenant implements MindooTenant {
     private decryptedTenantKeyCache?;
     private decryptedUserSigningKeyCache?;
     private decryptedUserEncryptionKeyCache?;
+    /**
+     * Cache of imported AES-GCM `CryptoKey`s, keyed by usage + raw key bytes
+     * (hex). `subtle.importKey` costs a WebCrypto round trip per call, which
+     * adds up on bulk writes/reads (one import per store entry). Because the
+     * cache is content-addressed by the key bytes, rotated key versions miss
+     * the cache naturally — no explicit invalidation is needed.
+     */
+    private readonly importedAesKeyCache;
+    /**
+     * Cache of imported Ed25519 verify `CryptoKey`s, keyed by the PEM public
+     * key. Signature verification runs once per entry when materializing
+     * documents, so the per-call SPKI import is on the hot read path.
+     */
+    private readonly importedVerifyKeyCache;
+    private static readonly MAX_IMPORTED_KEY_CACHE_ENTRIES;
     private logger;
+    private reconcileInFlight;
     private cacheManager;
     /**
      * Optional map of additional trusted signing public keys.
@@ -114,11 +130,42 @@ export declare class BaseMindooTenant implements MindooTenant {
      * @return The administration encryption public key (RSA-OAEP, PEM format)
      */
     getAdministrationEncryptionPublicKey(): string;
+    /**
+     * Import an AES-GCM key for `usage`, memoized on the raw key bytes. See
+     * {@link importedAesKeyCache}. On overflow the cache is simply cleared —
+     * refilling it costs one import per active key, which is negligible.
+     */
+    private importAesKeyCached;
     encryptPayload(payload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
     decryptPayload(encryptedPayload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+    /**
+     * Return every stored version of the symmetric key for `decryptionKeyId`,
+     * newest first, mapping the `"default"` alias to the tenant default key id.
+     * Used by the decryption paths to support key rotation (a payload may have
+     * been encrypted under an older version than the current newest one).
+     *
+     * As a side effect, refreshes {@link decryptedTenantKeyCache} to the newest
+     * tenant-default version so encryption keeps using the latest key.
+     */
+    private getDecryptionKeyCandidates;
     signPayload(payload: Uint8Array): Promise<Uint8Array>;
     signPayloadWithKey(payload: Uint8Array, signingKeyPair: SigningKeyPair, password: string): Promise<Uint8Array>;
     verifySignature(payload: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
+    /**
+     * Import an Ed25519 verify key from its PEM SPKI form, memoized per PEM
+     * string. See {@link importedVerifyKeyCache}.
+     */
+    private importVerifyKeyCached;
+    verifyEntrySignature(entry: StoreEntryMetadata, encryptedData: Uint8Array): Promise<boolean>;
+    /**
+     * Whether the storage-format floor (`requireMetadataSignatureSince`) requires
+     * `entry` to carry the v2 metadata-binding signature, based on the entry's
+     * trusted time. Returns false when no floor is configured, when the directory
+     * implementation predates the policy, or on any resolution error (fail-open
+     * here is safe: the legacy signature is still cryptographically verified — the
+     * floor only refuses the *weaker* fallback for new entries).
+     */
+    private requiresMetadataSignature;
     getCurrentUserId(): Promise<PublicUserId>;
     /**
      * Get the additional trusted signing keys map, if configured.
@@ -126,6 +173,37 @@ export declare class BaseMindooTenant implements MindooTenant {
      */
     getAdditionalTrustedKeys(): ReadonlyMap<string, boolean> | undefined;
     openDirectory(): Promise<MindooTenantDirectory>;
+    /**
+     * Check whether an admin has requested a remote wipe of THIS device and, if
+     * so, delete the entire local tenant (docs/accesscontrol.md §6.5).
+     *
+     * The directive lives in the current user's admin-signed `grantaccess`
+     * document as `wipeRequestedForSigningKeys`. Because the directory database is
+     * admin-only, any grant document that materializes there is already verified
+     * as admin-signed — so finding this device's signing key in that list is a
+     * genuine, admin-issued directive (the server, which may be hostile, cannot
+     * forge it). Sync the directory before calling this so the latest directive is
+     * visible.
+     *
+     * @returns true if a wipe was applied (the tenant is now gone locally), false
+     *   if this device is not targeted.
+     */
+    checkAndApplyRemoteWipe(): Promise<boolean>;
+    /**
+     * Delete all local data for this tenant from the device (docs/accesscontrol.md
+     * §6.5): every local database (the directory database plus all known data
+     * databases), this tenant's keys in the (multi-tenant) KeyBag, and all
+     * in-memory caches. Other tenants on the same device are untouched.
+     *
+     * Idempotent and best-effort: once the local tenant is gone there is nothing
+     * left to delete. Pass extra database ids for databases that exist locally but
+     * have not been opened in this session.
+     *
+     * @param additionalDbIds Optional extra local database ids to wipe.
+     */
+    wipeLocalTenant(additionalDbIds?: string[]): Promise<void>;
+    /** Clear the document and attachment stores for one local database. */
+    private clearLocalStoresForDb;
     private assertCurrentUserCanOpenDB;
     openDB(id: string, options?: OpenDBOptions): Promise<MindooDB>;
     /**
@@ -185,6 +263,22 @@ export declare class BaseMindooTenant implements MindooTenant {
      * Used by connectToServer() to create the network store.
      */
     private getDecryptedEncryptionKey;
+    /**
+     * Inject an already-unlocked RSA-OAEP encryption private key for the current
+     * user, priming the same cache {@link getDecryptedEncryptionKey} uses. Hosts
+     * that create the tenant password-less (e.g. Haven, which holds the unlocked
+     * key in its session rather than a password) call this so SDK-driven KeyBag
+     * reconcile can unwrap pushed key versions (docs/accesscontrol.md §13).
+     */
+    setSessionEncryptionKey(cryptoKey: CryptoKey): void;
+    /**
+     * The RSA-OAEP encryption private key used by KeyBag reconcile to unwrap
+     * pushed key versions. Returns the injected/cached session key when present,
+     * else derives it from the current user password. Returns `null` when neither
+     * is available (a locked, password-less host) so reconcile can skip its import
+     * pass without throwing — the revoke pass needs no key and still runs.
+     */
+    getEncryptionPrivateKeyForReconcile(): Promise<CryptoKey | null>;
     /**
      * Internal method to decrypt a private key using password-based key derivation.
      * Protected so that BaseMindooTenantDirectory can access it.
@@ -235,6 +329,103 @@ export declare class BaseMindooTenant implements MindooTenant {
      * KeyBag composition has not changed.
      */
     getDocKeyFingerprint(): Promise<string>;
+    /**
+     * Remove a **named** document key from the local KeyBag. Refuses to delete the
+     * shared tenant default key (`"default"` / {@link DEFAULT_TENANT_KEY_ID}),
+     * which is required for the tenant to function. Returns true if a key was
+     * removed.
+     */
+    removeNamedDecryptionKey(decryptionKeyId: string): Promise<boolean>;
+    /**
+     * Reconcile the local KeyBag against the directory head for the current user
+     * (docs/accesscontrol.md §13). SDK-driven so standalone apps using the
+     * `mindoodb` package get key distribution/revocation automatically after a
+     * directory sync — not just the Haven UI. Two independent passes:
+     *
+     *  - **Revoke (no key required):** bulk-remove every revoked key id (from the
+     *    directory head cache) from the bag. Idempotent and a no-op when the bag
+     *    does not hold the key, so it also re-cleans a restored older KeyBag
+     *    backup on every run. The `deleteKey` mutation drives visibility
+     *    reconciliation (forgetting now-inaccessible docs) and emits
+     *    `keyBag.onChanges` so the host can persist the cleaned bag.
+     *  - **Import (needs the encryption private key):** unwrap and merge the key
+     *    versions pushed to this user. Skipped with a debug log when the host is
+     *    locked (no session key / password); the revoke pass still ran.
+     *
+     * Best-effort and idempotent; safe to call on every directory bring-up / pull.
+     * Returns the key ids imported and removed.
+     */
+    reconcileKeyDistributionsForCurrentUser(): Promise<{
+        imported: string[];
+        removed: string[];
+    }>;
+    /**
+     * Single-flight, best-effort wrapper around
+     * {@link reconcileKeyDistributionsForCurrentUser} for the run-always trigger
+     * (docs/accesscontrol.md §13). Fired on directory bring-up and after every
+     * directory pull. Never throws and never blocks sync: a reconcile error is
+     * logged and swallowed. The in-flight guard prevents the driver's own
+     * directory access from re-triggering it.
+     */
+    reconcileKeyDistributionsForCurrentUserSafe(): Promise<void>;
+    /**
+     * Export **all** stored versions of a document key for an admin-blind key
+     * delivery (read-side key push). A rotated key keeps multiple versions in the
+     * KeyBag and decryption tries them all, so a delivery must carry every version
+     * - otherwise the recipient could not read documents encrypted under an
+     * earlier version. Each entry pairs the raw key bytes with the version's
+     * `createdAt` (used as `keyVersionCreatedAt`); versions are newest-first.
+     * Returns null when the caller's KeyBag lacks the key. Only a key-holder can
+     * run this — never the admin who later publishes the wrapped bytes.
+     */
+    exportDecryptionKeyForDelivery(decryptionKeyId: string): Promise<Array<{
+        bytes: Uint8Array;
+        keyVersionCreatedAt: number;
+    }> | null>;
+    /**
+     * Import a delivered document key into the local KeyBag (read-side key push,
+     * recipient side). Writing the key triggers the existing KeyBag change
+     * listener -> {@link reconcileKeyBagChanges} -> per-database reveal-on-add, so
+     * documents encrypted with it surface automatically. Idempotent: a key
+     * version with the same `keyVersionCreatedAt` is not duplicated.
+     */
+    importDeliveredDecryptionKey(keyId: string, bytes: Uint8Array, keyVersionCreatedAt: number): Promise<void>;
+    /**
+     * Import several delivered versions of one document key at once (read-side key
+     * push, recipient side). Each version absent from the KeyBag (matched by
+     * `keyVersionCreatedAt`) is added; already-present versions are skipped so the
+     * call is idempotent. Caches are invalidated and reveal-on-add reconciliation
+     * runs once, after all new versions are written. Returns the number of
+     * versions actually imported.
+     */
+    importDeliveredDecryptionKeyVersions(keyId: string, versions: Array<{
+        bytes: Uint8Array;
+        keyVersionCreatedAt: number;
+    }>): Promise<number>;
+    /** SHA-256 hex of raw key bytes — the stable version fingerprint used by key distribution. */
+    fingerprintKeyBytes(bytes: Uint8Array): Promise<string>;
+    /**
+     * All stored versions of a document key with their raw bytes, `createdAt`, and
+     * SHA-256 fingerprint (newest first). The source of truth for a key
+     * distribution's `keyVersions` manifest and per-device wrapping. Empty when the
+     * caller's KeyBag lacks the key.
+     */
+    fingerprintKeyVersions(keyId: string): Promise<Array<{
+        bytes: Uint8Array;
+        createdAt: number;
+        fingerprint: string;
+    }>>;
+    /**
+     * Remove exactly the key versions of `keyId` whose raw-bytes fingerprint is in
+     * `fingerprints` (version-scoped `pullfrom` revocation). Versions obtained
+     * elsewhere — i.e. not in the distribution manifest — survive. Refuses the
+     * protected tenant default / `$publicinfos` keys. The KeyBag change feed
+     * triggers visibility reconciliation (scope purge when nothing remains).
+     * Returns the number of versions removed.
+     */
+    removeDecryptionKeyVersionsByFingerprint(keyId: string, fingerprints: string[]): Promise<number>;
+    /** Clear in-memory decrypted-key caches after a KeyBag mutation. */
+    private invalidateDecryptedKeyCaches;
     /**
      * Get the symmetric key for a given key ID.
      * This is a protected helper method that can be used by subclasses.

package/dist/core/BaseMindooTenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EAEzB,sBAAsB,EAEvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D,OAAO,EAAE,MAAM,EAAoC,MAAM,WAAW,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAA8B;IAG5D,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;KAChC;IAwEH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAIxC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyHjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA4D1F,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBrD,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAoChB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwChG,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;YAQvC,0BAA0B;IA4BlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8EpE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmD7C,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAsC9C,OAAO,CAAC,4BAA4B;IA0BpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IAqEtH;;;;;;OAMG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoGzF;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAkEjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA2BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CAiDvB"}
+{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EAEzB,sBAAsB,EAEvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAKhE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAE/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;OAIG;IACH,OAAO,CAAC,sBAAsB,CAA8B;IAG5D,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,iBAAiB,CAAS;IAGlC,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;KAChC;IAwEH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAa1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA6B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAwGjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAoDhG;;;;;;;;OAQG;YACW,0BAA0B;IASlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBrD,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAoChB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IA6DlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8EpE;;;;;;;;;;;;;;;;;;;OAmBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmD7C,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAsC9C,OAAO,CAAC,4BAA4B;IA0BpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IA6EtH;;;;;;OAMG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoGzF;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,GACpC,OAAO,CAAC,qBAAqB,CAAC;IAkEjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IA0BvB;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IA4CF;;;;;;;OAOG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAclE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;OAOG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAIpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}