mindoodb 0.0.4 → 0.0.6

package/README-server.md

@@ -16,7 +16,7 @@ A Node.js/Express server implementing the MindooDB sync API with:
 
 ## Quick Start
 
-The fastest way to get a server running is the interactive setup script. It prompts for a server name, password, data directory, and bind address, then builds the Docker image and initialises the server identity (including optional system admin creation):
+The fastest way to get a server running is the interactive setup script. It prompts for the data directory first, detects whether this is a fresh setup or an existing deployment, and then asks only for the values needed for the chosen path (for example server name and password for fresh setup, or just bind settings for safe update). It then builds the Docker image and initialises the server identity when needed (including optional system admin creation):
 
 ```bash
 # 1. Clone and enter the repo
@@ -38,6 +38,18 @@ The setup script:
 - initialises the server identity and optionally creates a system admin keypair interactively
 - writes a `docker-compose.override.yml` with your current host uid/gid, bind mounts, and one or more published port bindings based on your chosen bind address
 
+For an existing deployment, use one of these update paths instead of reinitialising blindly:
+
+```bash
+# Safe interactive update for an existing server
+bash serversetup.sh --update
+
+# Or rebuild the image and restart without touching setup files
+docker compose up -d --build
+```
+
+`bash serversetup.sh --update` preserves the existing `server.identity.json`, `server.keybag`, `config.json`, tenant data, `trusted-servers.json`, and `.server_unlock`, while still rebuilding the Docker image and regenerating `docker-compose.override.yml`. Before the override is rewritten, the script now saves the previous file as `docker-compose.override.<timestamp>.yml`.
+
 After setup, manage the server with:
 
 ```bash
@@ -47,6 +59,14 @@ docker compose logs -f       # follow logs
 docker compose up -d --build # rebuild image and restart
 ```
 
+When rerunning `bash serversetup.sh` without `--update`, the script now detects an existing `server.identity.json` and offers three choices:
+
+- safe update (preserve identity, keybag, config, tenant data, and password file)
+- overwrite identity (destructive re-init)
+- abort
+
+Only choose overwrite if you intentionally want to replace the server identity and reinitialise the deployment.
+
 For identity utilities on a Docker-deployed server, use the wrapper script from the repository root:
 
 ```bash
@@ -626,7 +646,7 @@ Generated by `npm run server:init`. Contains a `PrivateUserId` with encrypted pr
 | `MINDOODB_SERVER_PASSWORD` | If `server.identity.json` exists and `MINDOODB_SERVER_PASSWORD_FILE` is unset | Password to decrypt server identity and per-tenant keybags |
 | `MINDOODB_SERVER_PASSWORD_FILE` | No | Path to a file whose contents are the server password (trimmed). If set, **used instead of** `MINDOODB_SERVER_PASSWORD`. Prefer for Docker: env only holds the path, not the secret. |
 | `MINDOODB_SYSTEM_ADMIN_PASSWORD` | No | For `server:add-to-network`: password for `--identity` (if not using `--password-file` or interactive prompt). May be visible in `ps` on shared hosts. |
-| `MINDOODB_CORS_ORIGIN` | No | Allowed CORS origin (e.g., `https://app.example.com`). If not set, CORS is disabled. |
+| `MINDOODB_CORS_ORIGIN` | No | Allowed CORS origin or comma-separated allowlist (e.g., `https://app.example.com` or `http://localhost:4174,https://otherserver.com`). If not set, CORS is disabled. |
 | `MINDOODB_ADMIN_ALLOWED_IPS` | No | Optional comma-separated client IPs/CIDRs allowed to call **`/system/*`** (all system admin routes, including `/system/auth/*`). If unset or `*`, any source IP may reach `/system/*` (JWT + `config.json` capabilities still apply). Example: `127.0.0.1,::1,172.23.248.0/24,2001:db8::/32`. Behind a reverse proxy, configure Express `trust proxy` so `req.ip` is the real client. |
 
 > **Note:** The old `MINDOODB_ADMIN_API_KEY` variable has been removed. System admin **authorization** is enforced by `config.json` capabilities and JWTs. **`MINDOODB_ADMIN_ALLOWED_IPS`** is an optional **network** layer for `/system/*` only. See [Server Security](docs/server-security.md).
@@ -771,10 +791,12 @@ The **`curl`** examples in this document use **`$SYSTEM_ADMIN_JWT`** as a placeh
 | `POST` | `/:tenantId/sync/findNewEntries` | Find entries we don't have |
 | `POST` | `/:tenantId/sync/findNewEntriesForDoc` | Find entries for specific document |
 | `POST` | `/:tenantId/sync/getEntries` | Get specific entries |
+| `POST` | `/:tenantId/sync/getEntryMetadata` | Get metadata for a single entry |
 | `POST` | `/:tenantId/sync/putEntries` | Push entries to server |
 | `POST` | `/:tenantId/sync/hasEntries` | Check which entry IDs exist |
 | `GET` | `/:tenantId/sync/getAllIds` | Get all entry IDs |
 | `POST` | `/:tenantId/sync/resolveDependencies` | Resolve dependency chain |
+| `POST` | `/:tenantId/sync/planAttachmentReadByWalkingMetadata` | Build an attachment read plan on the server |
 | `POST` | `/:tenantId/sync/findEntries` | Find entries by type/date |
 | `POST` | `/:tenantId/sync/scanEntriesSince` | Cursor-based entry scanning |
 | `POST` | `/:tenantId/sync/getIdBloomSummary` | Get Bloom filter summary |
@@ -794,7 +816,7 @@ The server includes the following hardening measures:
 - **Input validation** -- all identifiers (tenantId, dbId, serverName) are validated to prevent path traversal. Only lowercase alphanumeric characters and hyphens are allowed, max 64 characters. Tenant IDs that collide with server route prefixes (`admin`, `health`, `statics`) are rejected as reserved names.
 - **Rate limiting** -- tiered per-IP rate limits: auth endpoints (20/min), admin endpoints (30/min), sync endpoints (200/min), global fallback (500/min). Returns `429 Too Many Requests` when exceeded.
 - **Security headers** -- `helmet` middleware sets X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, and others.
-- **CORS** -- disabled by default. Set `MINDOODB_CORS_ORIGIN` to allow a specific origin.
+- **CORS** -- disabled by default. Set `MINDOODB_CORS_ORIGIN` to allow one specific origin or a comma-separated allowlist of origins.
 - **Constant-time key comparison** -- tenant creation API keys are compared using `crypto.timingSafeEqual()` where applicable.
 - **Error sanitization** -- internal errors never leak file paths or stack traces to clients. Only known auth/validation errors return specific messages.
 - **Request size limits** -- JSON body limited to 5MB. Array sizes capped (100k IDs, 10k entries for putEntries).
@@ -902,7 +924,7 @@ Available DNS plugins include Cloudflare, Route53, Google Cloud DNS, DigitalOcea
 
 The server ships with a multi-stage `Dockerfile` under `src/node/server/` that produces a minimal Alpine-based image. The build context must be the **repository root** so the library and server compile together.
 
-**Recommended:** use `bash serversetup.sh` (see [Quick Start](#quick-start)) to build, initialise, and configure everything interactively. The rest of this section covers manual Docker commands for advanced use cases.
+**Recommended:** use `bash serversetup.sh` for first-time setup, and `bash serversetup.sh --update` for safe interactive updates to an existing deployment. The rest of this section covers manual Docker commands for advanced use cases.
 
 ### docker-compose.yml
 
@@ -913,6 +935,8 @@ The generated override also contains the published port bindings. This supports
 - bind a single specific IP (for example a VPN address)
 - bind both `127.0.0.1` and one specific extra IP
 
+If you only changed application code and do not need to adjust ports or bind addresses, `docker compose up -d --build` is usually enough.
+
 ### Manual Docker commands (without serversetup.sh)
 
 If you prefer not to use the setup script, here are the individual steps:
@@ -947,10 +971,12 @@ On SELinux hosts, append `:Z` to the `/data` bind mount and `,Z` to the read-onl
 
 ### Bind to a specific IP
 
-To restrict the server to a specific network interface (e.g. a VPN), rerun `bash serversetup.sh` and provide the bind address when prompted.
+To restrict the server to a specific network interface (e.g. a VPN), rerun `bash serversetup.sh --update` and provide the bind address when prompted. Update mode preserves the existing server identity, keybag, config, tenant data, and password file while regenerating `docker-compose.override.yml`.
 
 If you also want local checks from the same host, answer `y` when asked whether to also bind `127.0.0.1`. The generated `docker-compose.override.yml` will then contain both mappings.
 
+Avoid the overwrite path unless you intentionally want to replace `server.identity.json`. Replacing the server identity breaks the relationship to server-owned encrypted state such as `server.keybag`, so it should be treated as a destructive reinitialization step, not a normal upgrade.
+
 ### Additional flags
 
 Environment variables and CLI flags can be added to `docker-compose.override.yml`:
@@ -959,12 +985,15 @@ Environment variables and CLI flags can be added to `docker-compose.override.yml
 services:
   mindoodb:
     environment:
+      MINDOODB_CORS_ORIGIN: "http://localhost:4174,https://otherserver.com"
       MINDOODB_ADMIN_ALLOWED_IPS: "127.0.0.1,10.0.0.0/8"
     command: ["--port", "8443", "--auto-sync"]
     ports:
       - "0.0.0.0:8443:8443"
 ```
 
+If `serversetup.sh` needs to regenerate the override later, it first creates a timestamped backup such as `docker-compose.override.20260407-103000.yml` and tells you where to find it so custom settings can be merged forward if needed.
+
 ### Password handling
 
 Prefer **`MINDOODB_SERVER_PASSWORD_FILE`** over **`MINDOODB_SERVER_PASSWORD`** so the plaintext secret is not stored in the process environment block (visible via `docker inspect`, `/proc/<pid>/environ`). The setup script and `docker-compose.yml` use file-based passwords by default. See [Server Security](docs/server-security.md) for details on Docker secrets.

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts

@@ -1,6 +1,6 @@
 import type { ContentAddressedStore } from "../../core/types";
 import type { StoreEntry, StoreEntryMetadata, StoreEntryType, StoreScanCursor, StoreScanFilters, StoreScanResult, StoreIdBloomSummary, StoreCompactionStatus } from "../../core/types";
-import type { DocumentMaterializationBatchPlan, DocumentMaterializationPlan, MaterializationPlanOptions } from "../../core/appendonlystores/types";
+import type { AttachmentReadPlan, AttachmentReadPlanOptions, DocumentMaterializationBatchPlan, DocumentMaterializationPlan, MaterializationPlanOptions } from "../../core/appendonlystores/types";
 import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
 import type { NetworkTransport } from "../../core/appendonlystores/network/NetworkTransport";
 import type { NetworkSyncCapabilities } from "../../core/appendonlystores/network/types";
@@ -29,6 +29,7 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
     private cryptoAdapter;
     private accessToken;
     private tokenExpiry;
+    private authenticationPromise;
     private logger;
     private capabilitiesCache;
     private syncAuthOverride;
@@ -58,6 +59,8 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
      * @returns The entries with decrypted payloads
      */
     getEntries(ids: string[]): Promise<StoreEntry[]>;
+    getEntryMetadata(id: string): Promise<StoreEntryMetadata | null>;
+    planAttachmentReadByWalkingMetadata(lastChunkId: string, attachmentSize: number, options: AttachmentReadPlanOptions): Promise<AttachmentReadPlan>;
     /**
      * Check which IDs exist in the remote store.
      *
@@ -80,6 +83,7 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
      * Find entries by type and creation date range from the remote store.
      */
     findEntries(type: StoreEntryType, creationDateFrom: number | null, creationDateUntil: number | null): Promise<StoreEntryMetadata[]>;
+    private supportsReceiptOrderCursorProtocol;
     /**
      * Get all entry IDs from the remote store.
      * Used for synchronization to identify which entries the remote has.
@@ -115,6 +119,7 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
      * Ensure we have a valid access token, authenticating if necessary.
      */
     private ensureAuthenticated;
+    private performAuthentication;
     /**
      * Sign a challenge with the user's private signing key.
      */
@@ -130,6 +135,9 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
      * Call this if you need to force re-authentication.
      */
     clearAuthCache(): void;
+    private refreshAuthentication;
+    private isInvalidTokenError;
+    private withTransparentReauth;
     /**
      * Set or clear a temporary per-sync authentication override.
      * Intended for bootstrap scenarios (for example authenticating as admin).

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientNetworkContentAddressedStore.d.ts","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAmC,YAAW,qBAAqB;IAC9E,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,gBAAgB,CAIR;IAEhB;;;;;;;;;;OAUG;gBAED,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,EACrB,oBAAoB,EAAE,SAAS,GAAG,MAAM,EACxC,MAAM,CAAC,EAAE,MAAM;IAejB,KAAK,IAAI,MAAM;IAIf,gBAAgB,IAAI,MAAM;IAK1B;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAatD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmBtD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAclD;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAWvE;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAU5F;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAehC;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpC;;;OAGG;IACG,gBAAgB,CACpB,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,GAAE,MAAgC,EACvC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC;IA6CrB,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAYjD,eAAe,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAoBnD,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAsBrD,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC;IASjC,gCAAgC,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC;IAS5C;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;OAEG;YACW,mBAAmB;IA+CjC;;OAEG;YACW,aAAa;YAIb,oBAAoB;IAalC;;;OAGG;YACW,qBAAqB;IAoCnC;;;OAGG;IACH,cAAc,IAAI,IAAI;IAMtB;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,SAAS,CAAC;QACtB,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3C,GAAG,IAAI,GACP,IAAI;IAMP,qBAAqB,IAAI,IAAI;IAO7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,6BAA6B;CAGtC"}
+{"version":3,"file":"ClientNetworkContentAddressedStore.d.ts","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAEV,uBAAuB,EACxB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAG9E;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAmC,YAAW,qBAAqB;IAC9E,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,qBAAqB,CAAgC;IAC7D,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,gBAAgB,CAIR;IAEhB;;;;;;;;;;OAUG;gBAED,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,EACrB,oBAAoB,EAAE,SAAS,GAAG,MAAM,EACxC,MAAM,CAAC,EAAE,MAAM;IAejB,KAAK,IAAI,MAAM;IAIf,gBAAgB,IAAI,MAAM;IAK1B;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAatD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmBhD,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQhE,mCAAmC,CACvC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAW9B;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAclD;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAYvE;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW5F;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAgBhC,OAAO,CAAC,kCAAkC;IAQ1C;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAWpC;;;OAGG;IACG,gBAAgB,CACpB,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,GAAE,MAAgC,EACvC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC;IA4DrB,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAcjD,eAAe,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAuBnD,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAwBrD,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC;IAWjC,gCAAgC,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC;IAW5C;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpB;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;OAEG;YACW,mBAAmB;YAsBnB,qBAAqB;IAyCnC;;OAEG;YACW,aAAa;YAIb,oBAAoB;IAalC;;;OAGG;YACW,qBAAqB;IAoCnC;;;OAGG;IACH,cAAc,IAAI,IAAI;YAMR,qBAAqB;IAKnC,OAAO,CAAC,mBAAmB;YAIb,qBAAqB;IAiBnC;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,SAAS,CAAC;QACtB,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3C,GAAG,IAAI,GACP,IAAI;IAMP,qBAAqB,IAAI,IAAI;IAO7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,6BAA6B;CAGtC"}