mindoodb 0.0.50 → 0.0.53

package/dist/core/tenantSetup.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Tenant setup document helpers.
+ *
+ * The singleton directory document `tenantsetup` is encrypted under
+ * `$publicinfos` so it syncs to every member (and to the sync server). The
+ * human-readable tenant label itself is field-encrypted under the tenant
+ * `default` key (`label_encrypted` / `label_encrypted_key`) so the server
+ * cannot read the display name — same pattern as `user_details_encrypted`
+ * on grant documents.
+ *
+ * The document also records the tenant's administrators. An admin holds no
+ * `grantaccess` document of its own, so without this list a member can only
+ * name the administration key by its fingerprint. Each entry carries the
+ * admin's name field-encrypted under `default` plus its device key pairs in
+ * the very same `userKeyPairs` shape a grant uses (docs/accesscontrol.md
+ * §6.5), so the same helpers read and write both, and additional admins or
+ * admin devices can be appended later.
+ */
+import { GrantKeyPair, MindooDB, MindooTenant, TENANT_SETUP_DOC_ID, SigningKeyPair } from "./types";
+export { TENANT_SETUP_DOC_ID };
+/**
+ * One administrator as stored on the `tenantsetup` document. The name is
+ * field-encrypted under `default`; the device keys use the canonical
+ * `userKeyPairs` list of a grant document so both can be parsed by
+ * {@link extractKeyPairs}.
+ */
+export interface TenantAdministratorData {
+    /** Base64 AES-GCM ciphertext of the canonical username under `default`. */
+    username_encrypted?: string;
+    /** Key id used for `username_encrypted`; always `"default"`. */
+    username_encrypted_key?: string;
+    /** This admin's device key pairs, same shape as a grant's `userKeyPairs`. */
+    userKeyPairs?: unknown;
+    /** Trusted time (ms since Unix epoch) at which the entry was first written. */
+    addedAt?: number;
+}
+export interface TenantSetupData {
+    /**
+     * @deprecated Legacy plaintext label. New writes use `label_encrypted`.
+     * Still read for older tenants until the next admin write migrates them.
+     */
+    label?: string;
+    /** Base64 AES-GCM ciphertext of the UTF-8 label under `default`. */
+    label_encrypted?: string;
+    /** Key id used for `label_encrypted`; always `"default"`. */
+    label_encrypted_key?: string;
+    /** The tenant's administrators, oldest first. */
+    administrators?: TenantAdministratorData[];
+}
+/** An administrator entry with its name decrypted, as read by callers. */
+export interface TenantAdministrator {
+    /**
+     * Canonical username. Absent when the reader has no `default` key (e.g. a
+     * device that joined but has not imported the tenant key yet).
+     */
+    username?: string;
+    /** The admin's device key pairs (§6.5), active ones first. */
+    keyPairs: GrantKeyPair[];
+    addedAt?: number;
+}
+/**
+ * Read the tenant label from the directory database's `tenantsetup` document.
+ * Requires the tenant `default` key to decrypt `label_encrypted`. Returns
+ * `undefined` when the document is missing, the key is absent, or there is no
+ * label. Legacy plaintext `label` is still accepted for older tenants.
+ */
+export declare function readTenantSetupLabel(directoryDb: MindooDB, tenant: MindooTenant): Promise<string | undefined>;
+/**
+ * Create or update the `tenantsetup` document with the given label.
+ * Must be signed with the tenant admin signing key. Stores the label as
+ * `label_encrypted` under the tenant `default` key and clears any legacy
+ * plaintext `label` field.
+ */
+export declare function writeTenantSetupLabel(directoryDb: MindooDB, label: string, adminSigningKeyPair: SigningKeyPair, adminSigningKeyPassword: string, tenant: MindooTenant): Promise<void>;
+/**
+ * The tenant's administrators from the `tenantsetup` document, oldest first.
+ * Names need the tenant `default` key; entries whose name cannot be decrypted
+ * are still returned (with their key pairs) so callers can at least match a
+ * signing key. Returns an empty list for tenants created before this field.
+ */
+export declare function readTenantSetupAdministrators(directoryDb: MindooDB, tenant: MindooTenant): Promise<TenantAdministrator[]>;
+/**
+ * Record an administrator on the `tenantsetup` document: its name
+ * field-encrypted under `default` plus its device key pairs. Must be signed
+ * with the tenant admin signing key.
+ *
+ * An entry for the same admin — matched by name, or by sharing a signing key
+ * when the name is unreadable — is updated in place and has its key pairs
+ * merged, so passing only a new pair enrolls another device of an admin that is
+ * already listed. Otherwise a new entry is appended. Idempotent when called
+ * again with the same name and keys.
+ */
+export declare function writeTenantSetupAdministrator(directoryDb: MindooDB, administrator: {
+    username: string;
+    keyPairs: GrantKeyPair[];
+}, adminSigningKeyPair: SigningKeyPair, adminSigningKeyPassword: string, tenant: MindooTenant): Promise<void>;
+/**
+ * Record an administrator only when it is missing from `tenantsetup`, and
+ * report whether a write happened. Tenants created before the
+ * `administrators` field have no entry at all, and a grant is a natural moment
+ * to heal that: the admin proves its identity and its keys there anyway. The
+ * check keeps repeated grants from appending a no-op revision to the
+ * append-only store.
+ */
+export declare function ensureTenantSetupAdministrator(directoryDb: MindooDB, administrator: {
+    username: string;
+    keyPairs: GrantKeyPair[];
+}, adminSigningKeyPair: SigningKeyPair, adminSigningKeyPassword: string, tenant: MindooTenant): Promise<boolean>;
+//# sourceMappingURL=tenantSetup.d.ts.map

package/dist/core/tenantSetup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantSetup.d.ts","sourceRoot":"","sources":["../../src/core/tenantSetup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEL,YAAY,EACZ,QAAQ,EACR,YAAY,EAEZ,mBAAmB,EACnB,cAAc,EACf,MAAM,SAAS,CAAC;AAOjB,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iDAAiD;IACjD,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAC5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAsDD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,QAAQ,EACrB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoB7B;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,QAAQ,EACrB,KAAK,EAAE,MAAM,EACb,mBAAmB,EAAE,cAAc,EACnC,uBAAuB,EAAE,MAAM,EAC/B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAaf;AAsCD;;;;;GAKG;AACH,wBAAsB,6BAA6B,CACjD,WAAW,EAAE,QAAQ,EACrB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAwBhC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,WAAW,EAAE,QAAQ,EACrB,aAAa,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,EAC7D,mBAAmB,EAAE,cAAc,EACnC,uBAAuB,EAAE,MAAM,EAC/B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,QAAQ,EACrB,aAAa,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,EAC7D,mBAAmB,EAAE,cAAc,EACnC,uBAAuB,EAAE,MAAM,EAC/B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,OAAO,CAAC,CA2BlB"}

package/dist/core/tenantSetup.js

@@ -0,0 +1,250 @@
+"use strict";
+/**
+ * Tenant setup document helpers.
+ *
+ * The singleton directory document `tenantsetup` is encrypted under
+ * `$publicinfos` so it syncs to every member (and to the sync server). The
+ * human-readable tenant label itself is field-encrypted under the tenant
+ * `default` key (`label_encrypted` / `label_encrypted_key`) so the server
+ * cannot read the display name — same pattern as `user_details_encrypted`
+ * on grant documents.
+ *
+ * The document also records the tenant's administrators. An admin holds no
+ * `grantaccess` document of its own, so without this list a member can only
+ * name the administration key by its fingerprint. Each entry carries the
+ * admin's name field-encrypted under `default` plus its device key pairs in
+ * the very same `userKeyPairs` shape a grant uses (docs/accesscontrol.md
+ * §6.5), so the same helpers read and write both, and additional admins or
+ * admin devices can be appended later.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANT_SETUP_DOC_ID = void 0;
+exports.readTenantSetupLabel = readTenantSetupLabel;
+exports.writeTenantSetupLabel = writeTenantSetupLabel;
+exports.readTenantSetupAdministrators = readTenantSetupAdministrators;
+exports.writeTenantSetupAdministrator = writeTenantSetupAdministrator;
+exports.ensureTenantSetupAdministrator = ensureTenantSetupAdministrator;
+const types_1 = require("./types");
+Object.defineProperty(exports, "TENANT_SETUP_DOC_ID", { enumerable: true, get: function () { return types_1.TENANT_SETUP_DOC_ID; } });
+const encryptedFields_1 = require("./crypto/encryptedFields");
+const grantKeys_1 = require("./accesscontrol/grantKeys");
+const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
+const canonicalUsername_1 = require("./userid/canonicalUsername");
+const timeSource_1 = require("./utils/timeSource");
+function uint8ArrayToBase64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+/** Field-encrypt a string under the tenant `default` key. */
+async function encryptUnderDefaultKey(tenant, value) {
+    const encrypted = await tenant.encryptPayload(new TextEncoder().encode(value), types_1.DEFAULT_TENANT_KEY_ID);
+    return uint8ArrayToBase64(encrypted);
+}
+/**
+ * Apply a mutation to the `tenantsetup` document, creating it (under
+ * `$publicinfos`) when it does not exist yet. Must be signed with the tenant
+ * admin signing key.
+ */
+async function changeTenantSetup(directoryDb, adminSigningKeyPair, adminSigningKeyPassword, mutate) {
+    let doc;
+    try {
+        doc = await directoryDb.getDocument(types_1.TENANT_SETUP_DOC_ID);
+    }
+    catch {
+        doc = await directoryDb.createDocument({
+            id: types_1.TENANT_SETUP_DOC_ID,
+            signingKeyPair: adminSigningKeyPair,
+            signingKeyPassword: adminSigningKeyPassword,
+            decryptionKeyId: types_1.PUBLIC_INFOS_KEY_ID,
+        });
+    }
+    await directoryDb.changeDoc(doc, (d) => {
+        mutate(d.getData());
+    }, {
+        signingKeyPair: adminSigningKeyPair,
+        signingKeyPassword: adminSigningKeyPassword,
+    });
+}
+/**
+ * Read the tenant label from the directory database's `tenantsetup` document.
+ * Requires the tenant `default` key to decrypt `label_encrypted`. Returns
+ * `undefined` when the document is missing, the key is absent, or there is no
+ * label. Legacy plaintext `label` is still accepted for older tenants.
+ */
+async function readTenantSetupLabel(directoryDb, tenant) {
+    try {
+        const doc = await directoryDb.getDocument(types_1.TENANT_SETUP_DOC_ID);
+        const data = doc.getData();
+        const decrypted = await (0, encryptedFields_1.decryptEncryptedField)(tenant, data, "label_encrypted");
+        if (typeof decrypted === "string") {
+            const trimmed = decrypted.trim();
+            if (trimmed.length > 0)
+                return trimmed;
+        }
+        // Legacy: plaintext label written before field encryption.
+        if (typeof data.label === "string") {
+            const trimmed = data.label.trim();
+            return trimmed.length > 0 ? trimmed : undefined;
+        }
+    }
+    catch {
+        // Document missing or unreadable.
+    }
+    return undefined;
+}
+/**
+ * Create or update the `tenantsetup` document with the given label.
+ * Must be signed with the tenant admin signing key. Stores the label as
+ * `label_encrypted` under the tenant `default` key and clears any legacy
+ * plaintext `label` field.
+ */
+async function writeTenantSetupLabel(directoryDb, label, adminSigningKeyPair, adminSigningKeyPassword, tenant) {
+    const trimmed = label.trim();
+    if (!trimmed) {
+        throw new Error("Tenant label must be a non-empty string");
+    }
+    const labelEncrypted = await encryptUnderDefaultKey(tenant, trimmed);
+    await changeTenantSetup(directoryDb, adminSigningKeyPair, adminSigningKeyPassword, (data) => {
+        data.label_encrypted = labelEncrypted;
+        data.label_encrypted_key = types_1.DEFAULT_TENANT_KEY_ID;
+        delete data.label;
+    });
+}
+/** Normalize a stored administrator entry into a plain, writable object. */
+function normalizeAdministratorEntry(entry) {
+    if (!entry || typeof entry !== "object")
+        return null;
+    const record = entry;
+    const pairs = (0, grantKeys_1.extractKeyPairs)(record);
+    if (pairs.length === 0)
+        return null;
+    const normalized = { userKeyPairs: pairs.map(toStoredKeyPair) };
+    if (typeof record.username_encrypted === "string" && record.username_encrypted) {
+        normalized.username_encrypted = record.username_encrypted;
+        normalized.username_encrypted_key =
+            typeof record.username_encrypted_key === "string" && record.username_encrypted_key
+                ? record.username_encrypted_key
+                : types_1.DEFAULT_TENANT_KEY_ID;
+    }
+    if (typeof record.addedAt === "number")
+        normalized.addedAt = record.addedAt;
+    return normalized;
+}
+/** A {@link GrantKeyPair} reduced to the fields stored on the document. */
+function toStoredKeyPair(pair) {
+    const stored = {
+        signingPublicKey: pair.signingPublicKey,
+        encryptionPublicKey: pair.encryptionPublicKey,
+    };
+    if (pair.label)
+        stored.label = pair.label;
+    if (typeof pair.addedAt === "number")
+        stored.addedAt = pair.addedAt;
+    return stored;
+}
+function administratorEntries(data) {
+    if (!Array.isArray(data.administrators))
+        return [];
+    return data.administrators
+        .map(normalizeAdministratorEntry)
+        .filter((entry) => entry !== null);
+}
+/**
+ * The tenant's administrators from the `tenantsetup` document, oldest first.
+ * Names need the tenant `default` key; entries whose name cannot be decrypted
+ * are still returned (with their key pairs) so callers can at least match a
+ * signing key. Returns an empty list for tenants created before this field.
+ */
+async function readTenantSetupAdministrators(directoryDb, tenant) {
+    let entries = [];
+    try {
+        const doc = await directoryDb.getDocument(types_1.TENANT_SETUP_DOC_ID);
+        entries = administratorEntries(doc.getData());
+    }
+    catch {
+        return [];
+    }
+    const administrators = [];
+    for (const entry of entries) {
+        const decrypted = await (0, encryptedFields_1.decryptEncryptedField)(tenant, entry, "username_encrypted");
+        const username = typeof decrypted === "string" ? decrypted.trim() : "";
+        administrators.push({
+            ...(username ? { username } : {}),
+            keyPairs: (0, grantKeys_1.extractKeyPairs)(entry),
+            ...(typeof entry.addedAt === "number" ? { addedAt: entry.addedAt } : {}),
+        });
+    }
+    return administrators;
+}
+/**
+ * Record an administrator on the `tenantsetup` document: its name
+ * field-encrypted under `default` plus its device key pairs. Must be signed
+ * with the tenant admin signing key.
+ *
+ * An entry for the same admin — matched by name, or by sharing a signing key
+ * when the name is unreadable — is updated in place and has its key pairs
+ * merged, so passing only a new pair enrolls another device of an admin that is
+ * already listed. Otherwise a new entry is appended. Idempotent when called
+ * again with the same name and keys.
+ */
+async function writeTenantSetupAdministrator(directoryDb, administrator, adminSigningKeyPair, adminSigningKeyPassword, tenant) {
+    const username = administrator.username.trim();
+    if (!username) {
+        throw new Error("Administrator username must be a non-empty string");
+    }
+    const incoming = administrator.keyPairs.filter((pair) => pair.signingPublicKey.trim().length > 0);
+    if (incoming.length === 0) {
+        throw new Error("Administrator must have at least one signing key");
+    }
+    const usernameEncrypted = await encryptUnderDefaultKey(tenant, username);
+    const now = (0, timeSource_1.semanticNow)();
+    // Names are only comparable after decryption, which cannot happen inside the
+    // synchronous document mutation below.
+    const existingIndex = (await readTenantSetupAdministrators(directoryDb, tenant)).findIndex((entry) => entry.username
+        ? (0, canonicalUsername_1.usernamesEqual)(entry.username, username)
+        : entry.keyPairs.some((pair) => incoming.some((candidate) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, candidate.signingPublicKey))));
+    await changeTenantSetup(directoryDb, adminSigningKeyPair, adminSigningKeyPassword, (data) => {
+        const entries = administratorEntries(data);
+        const target = existingIndex >= 0 ? entries[existingIndex] ?? { addedAt: now } : { addedAt: now };
+        const merged = (0, grantKeys_1.mergeKeyPairs)((0, grantKeys_1.extractKeyPairs)(target), incoming.map((pair) => ({ ...pair, addedAt: pair.addedAt ?? now })));
+        const next = {
+            username_encrypted: usernameEncrypted,
+            username_encrypted_key: types_1.DEFAULT_TENANT_KEY_ID,
+            userKeyPairs: merged.map(toStoredKeyPair),
+            addedAt: typeof target.addedAt === "number" ? target.addedAt : now,
+        };
+        if (existingIndex >= 0 && existingIndex < entries.length) {
+            entries[existingIndex] = next;
+        }
+        else {
+            entries.push(next);
+        }
+        data.administrators = entries;
+    });
+}
+/**
+ * Record an administrator only when it is missing from `tenantsetup`, and
+ * report whether a write happened. Tenants created before the
+ * `administrators` field have no entry at all, and a grant is a natural moment
+ * to heal that: the admin proves its identity and its keys there anyway. The
+ * check keeps repeated grants from appending a no-op revision to the
+ * append-only store.
+ */
+async function ensureTenantSetupAdministrator(directoryDb, administrator, adminSigningKeyPair, adminSigningKeyPassword, tenant) {
+    const username = administrator.username.trim();
+    if (!username) {
+        throw new Error("Administrator username must be a non-empty string");
+    }
+    const recorded = await readTenantSetupAdministrators(directoryDb, tenant);
+    const isComplete = recorded.some((entry) => entry.username !== undefined &&
+        (0, canonicalUsername_1.usernamesEqual)(entry.username, username) &&
+        administrator.keyPairs.every((candidate) => entry.keyPairs.some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, candidate.signingPublicKey))));
+    if (isComplete)
+        return false;
+    await writeTenantSetupAdministrator(directoryDb, administrator, adminSigningKeyPair, adminSigningKeyPassword, tenant);
+    return true;
+}
+//# sourceMappingURL=tenantSetup.js.map

package/dist/core/tenantSetup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantSetup.js","sourceRoot":"","sources":["../../src/core/tenantSetup.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAwHH,oDAuBC;AAQD,sDAmBC;AA4CD,sEA2BC;AAaD,sEAwDC;AAUD,wEAiCC;AA/VD,mCAQiB;AAOR,oGATP,2BAAmB,OASO;AAN5B,8DAAiE;AACjE,yDAA2E;AAC3E,2EAAsE;AACtE,kEAA4D;AAC5D,mDAAiD;AA+CjD,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,sBAAsB,CAAC,MAAoB,EAAE,KAAa;IACvE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,cAAc,CAC3C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,6BAAqB,CACtB,CAAC;IACF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAqB,EACrB,mBAAmC,EACnC,uBAA+B,EAC/B,MAAuC;IAEvC,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,2BAAmB,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,MAAM,WAAW,CAAC,cAAc,CAAC;YACrC,EAAE,EAAE,2BAAmB;YACvB,cAAc,EAAE,mBAAmB;YACnC,kBAAkB,EAAE,uBAAuB;YAC3C,eAAe,EAAE,2BAAmB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,CAAC,SAAS,CACzB,GAAG,EACH,CAAC,CAAC,EAAE,EAAE;QACJ,MAAM,CAAC,CAAC,CAAC,OAAO,EAAqB,CAAC,CAAC;IACzC,CAAC,EACD;QACE,cAAc,EAAE,mBAAmB;QACnC,kBAAkB,EAAE,uBAAuB;KAC5C,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,oBAAoB,CACxC,WAAqB,EACrB,MAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,2BAAmB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAA+C,CAAC;QAExE,MAAM,SAAS,GAAG,MAAM,IAAA,uCAAqB,EAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC/E,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,OAAO,CAAC;QACzC,CAAC;QAED,2DAA2D;QAC3D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACzC,WAAqB,EACrB,KAAa,EACb,mBAAmC,EACnC,uBAA+B,EAC/B,MAAoB;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErE,MAAM,iBAAiB,CAAC,WAAW,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1F,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,mBAAmB,GAAG,6BAAqB,CAAC;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,2BAA2B,CAAC,KAAc;IACjD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,UAAU,GAA4B,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;IACzF,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/E,UAAU,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC1D,UAAU,CAAC,sBAAsB;YAC/B,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,IAAI,MAAM,CAAC,sBAAsB;gBAChF,CAAC,CAAC,MAAM,CAAC,sBAAsB;gBAC/B,CAAC,CAAC,6BAAqB,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAAE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC5E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,IAAkB;IACzC,MAAM,MAAM,GAA4B;QACtC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAqB;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,cAAc;SACvB,GAAG,CAAC,2BAA2B,CAAC;SAChC,MAAM,CAAC,CAAC,KAAK,EAAoC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,6BAA6B,CACjD,WAAqB,EACrB,MAAoB;IAEpB,IAAI,OAAO,GAA8B,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,2BAAmB,CAAC,CAAC;QAC/D,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAqB,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAA0B,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,MAAM,IAAA,uCAAqB,EAC3C,MAAM,EACN,KAA2C,EAC3C,oBAAoB,CACrB,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,cAAc,CAAC,IAAI,CAAC;YAClB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,QAAQ,EAAE,IAAA,2BAAe,EAAC,KAA2C,CAAC;YACtE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,6BAA6B,CACjD,WAAqB,EACrB,aAA6D,EAC7D,mBAAmC,EACnC,uBAA+B,EAC/B,MAAoB;IAEpB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAClD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAA,wBAAW,GAAE,CAAC;IAC1B,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,aAAa,GAAG,CAAC,MAAM,6BAA6B,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CACxF,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ;QACZ,CAAC,CAAC,IAAA,kCAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC1B,IAAA,qCAAgB,EAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CACpE,CACF,CACR,CAAC;IAEF,MAAM,iBAAiB,CAAC,WAAW,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1F,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GACV,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,IAAA,yBAAa,EAC1B,IAAA,2BAAe,EAAC,MAA4C,CAAC,EAC7D,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CACpE,CAAC;QAEF,MAAM,IAAI,GAA4B;YACpC,kBAAkB,EAAE,iBAAiB;YACrC,sBAAsB,EAAE,6BAAqB;YAC7C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;YACzC,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;SACnE,CAAC;QAEF,IAAI,aAAa,IAAI,CAAC,IAAI,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,8BAA8B,CAClD,WAAqB,EACrB,aAA6D,EAC7D,mBAAmC,EACnC,uBAA+B,EAC/B,MAAoB;IAEpB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,IAAA,kCAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACxC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CACzC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3B,IAAA,qCAAgB,EAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CACpE,CACF,CACJ,CAAC;IACF,IAAI,UAAU;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,6BAA6B,CACjC,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,MAAM,CACP,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}