was-teaching-server 0.9.1

package/dist/lib/revocations.js

@@ -0,0 +1,86 @@
+/**
+ * The zcap revocation chain-inspection hook. Wired into every keystore-rooted
+ * and Space-rooted
+ * verification as the zcap library's `inspectCapabilityChain` extension
+ * point, it fails a verification whose dereferenced chain contains any
+ * capability with a stored revocation. Both route families share this hook;
+ * they differ only in the scope the storage lookup is keyed on (a keystore or
+ * a Space). Also home to the revocation-record file-name codec shared by the
+ * filesystem store and both backends' Space exports.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * The file name a revocation record is stored (and archived) under:
+ * the `(delegator, capabilityId)` unique key folded into a SHA-256 digest,
+ * plus `.json`. Both parts are arbitrary-length URIs, so hashing (rather than
+ * encoding) keeps the name fixed-width and filesystem-safe. Shared by the
+ * filesystem store and both backends' `exportSpace`, so the same record
+ * always lands under the same name.
+ * @param options {object}
+ * @param options.delegator {string}   the revoked capability's delegator
+ * @param options.capabilityId {string}   the revoked capability's id
+ * @returns {string}
+ */
+export function revocationFileName({ delegator, capabilityId }) {
+    const digest = createHash('sha256')
+        .update(`${delegator}\n${capabilityId}`)
+        .digest('hex');
+    return `${digest}.json`;
+}
+/**
+ * Extracts the `(capabilityId, delegator)` lookup pairs from a verified,
+ * dereferenced capability chain. The root capability is skipped -- root zcaps
+ * cannot be revoked -- and so is any link whose verify result carries no
+ * delegator (nothing to key a revocation record on).
+ *
+ * @param options {object}
+ * @param options.capabilityChain {object[]}   the dereferenced chain (root to
+ *   tail)
+ * @param options.capabilityChainMeta {object[]}   the per-capability verify
+ *   results (the root's entry has a `null` `verifyResult`)
+ * @returns {CapabilitySummary[]}
+ */
+export function capabilitySummaries({ capabilityChain, capabilityChainMeta }) {
+    const summaries = [];
+    for (const [index, capability] of capabilityChain.entries()) {
+        // skip the root zcap; it cannot be revoked
+        if (index === 0) {
+            continue;
+        }
+        const verifyResult = capabilityChainMeta[index]?.verifyResult;
+        const delegator = verifyResult?.results?.[0]?.purposeResult?.delegator?.id;
+        if (delegator) {
+            summaries.push({ capabilityId: capability.id, delegator });
+        }
+    }
+    return summaries;
+}
+/**
+ * Builds the `inspectCapabilityChain` hook for one scope: valid when no
+ * delegated capability in the chain has a stored revocation under that
+ * keystore or Space (a chain of just the root has nothing to check, so a bare
+ * root invocation never reaches the store).
+ *
+ * @param options {object}
+ * @param options.storage {StorageBackend}   supplies the revocation store
+ * @param options.scope {RevocationScope}   the keystore or Space the lookup is
+ *   keyed on
+ * @returns {InspectCapabilityChain}
+ */
+export function revocationChainInspector({ storage, scope }) {
+    return async (details) => {
+        const capabilities = capabilitySummaries(details);
+        if (capabilities.length === 0) {
+            return { valid: true };
+        }
+        const revoked = await storage.isRevoked({ scope, capabilities });
+        if (revoked) {
+            return {
+                valid: false,
+                error: new Error('One or more capabilities in the chain have been revoked.')
+            };
+        }
+        return { valid: true };
+    };
+}
+//# sourceMappingURL=revocations.js.map

package/dist/lib/revocations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocations.js","sourceRoot":"","sources":["../../src/lib/revocations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAWxC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,YAAY,EAIb;IACC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,GAAG,SAAS,KAAK,YAAY,EAAE,CAAC;SACvC,MAAM,CAAC,KAAK,CAAC,CAAA;IAChB,OAAO,GAAG,MAAM,OAAO,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,eAAe,EACf,mBAAmB,EACI;IACvB,MAAM,SAAS,GAAwB,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,2CAA2C;QAC3C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,SAAQ;QACV,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,EAAE,YAEzC,CAAA;QACR,MAAM,SAAS,GAAG,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAA;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,OAAO,EACP,KAAK,EAIN;IACC,OAAO,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;QACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QAChE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,IAAI,KAAK,CACd,0DAA0D,CAC3D;aACF,CAAA;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC,CAAA;AACH,CAAC"}

package/dist/lib/validateDid.d.ts

@@ -0,0 +1,19 @@
+import type { IDID } from '../types.js';
+/**
+ * Returns true when `value` is a syntactically valid Ed25519 `did:key` DID.
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+export declare function isValidController(value: unknown): value is IDID;
+/**
+ * Asserts that `controller` is a valid Ed25519 `did:key`, throwing
+ * InvalidControllerError (400) otherwise.
+ * @param controller {unknown}   the `controller` value from the request body
+ * @param options {object}
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export declare function assertValidController(controller: unknown, { requestName }?: {
+    requestName?: string;
+}): void;
+//# sourceMappingURL=validateDid.d.ts.map

package/dist/lib/validateDid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateDid.d.ts","sourceRoot":"","sources":["../../src/lib/validateDid.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAMvC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,OAAO,EACnB,EAAE,WAAW,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,IAAI,CAIN"}

package/dist/lib/validateDid.js

@@ -0,0 +1,35 @@
+/**
+ * Validation for the `controller` DID supplied in Space Description request
+ * bodies. The server's only DID method is `did:key` with Ed25519 keys, whose
+ * multibase encoding always begins `z6Mk` (the `0xed01` Ed25519-pub multicodec
+ * prefix) followed by base58btc characters. This asserts that shape at the
+ * request layer so a malformed or non-`did:key` controller is rejected on the
+ * way in, rather than being stored and only failing later at
+ * capability-verification time.
+ */
+import { InvalidControllerError } from '../errors.js';
+// An Ed25519 `did:key` is `did:key:` + `z6Mk` + a base58btc payload. The
+// base58btc (Bitcoin) alphabet omits `0`, `O`, `I`, and `l`.
+const DID_KEY_ED25519_PATTERN = /^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+$/;
+/**
+ * Returns true when `value` is a syntactically valid Ed25519 `did:key` DID.
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+export function isValidController(value) {
+    return typeof value === 'string' && DID_KEY_ED25519_PATTERN.test(value);
+}
+/**
+ * Asserts that `controller` is a valid Ed25519 `did:key`, throwing
+ * InvalidControllerError (400) otherwise.
+ * @param controller {unknown}   the `controller` value from the request body
+ * @param options {object}
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export function assertValidController(controller, { requestName } = {}) {
+    if (!isValidController(controller)) {
+        throw new InvalidControllerError({ requestName });
+    }
+}
+//# sourceMappingURL=validateDid.js.map

package/dist/lib/validateDid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateDid.js","sourceRoot":"","sources":["../../src/lib/validateDid.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAGrD,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAmB,EACnB,EAAE,WAAW,KAA+B,EAAE;IAE9C,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC"}

package/dist/lib/validateId.d.ts

@@ -0,0 +1,66 @@
+/** Which kind of id is being validated (selects the thrown error class). */
+export type IdKind = 'space' | 'collection' | 'resource';
+/**
+ * Whether `id` is a single, URL-safe path segment: non-empty, not `.` / `..`,
+ * free of path separators, and made only of the RFC 3986 "unreserved" charset
+ * ({@link ID_PATTERN}). The shared safety predicate behind `assertValidId` (and
+ * `assertValidBackendId` in `lib/backends.ts`); does **not** check the reserved
+ * path-segment registry, which is id-kind specific.
+ * @param id {string}
+ * @returns {boolean}
+ */
+export declare function isUrlSafeSegment(id: string): boolean;
+/**
+ * Reserved path segments from the spec's Reserved Path Segment Registry (plus
+ * the server's own non-spec `import` endpoint). A client-chosen Collection or
+ * Resource id matching one of these would shadow the reserved route at that
+ * position (e.g. a Collection named `export` would shadow
+ * `/space/{id}/export`), so the spec requires rejecting it with 409
+ * `reserved-id`. Space ids have no reserved siblings (`/space/{id}` has no
+ * static neighbors), so no set exists for the `space` kind.
+ *
+ * Exported as the server's authoritative per-kind sets so a client can mirror
+ * them rather than hand-maintaining a copy (client #13). NOTE the one known
+ * divergence from the pure spec registry: `import` is this server's non-spec
+ * tar-import endpoint, so a client mirroring the *spec* registry should omit
+ * it. Kept byte-identical to `@interop/storage-core`'s exported registry
+ * (locked by a drift-guard test); the local definition keeps the id-safety
+ * logic self-contained.
+ */
+export declare const RESERVED_COLLECTION_IDS: Set<string>;
+export declare const RESERVED_RESOURCE_IDS: Set<string>;
+/**
+ * Asserts that an id is a single, URL-safe path segment that does not collide
+ * with a reserved path segment -- throwing the typed 400 `invalid-id` error
+ * matching `kind` for an unsafe id, or the 409 `reserved-id` error for a
+ * reserved-segment collision.
+ * @param id {string}   the id parsed from a URL param, body, or tar entry
+ * @param options {object}
+ * @param options.kind {IdKind}   which id is being validated
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export declare function assertValidId(id: string, { kind, requestName }: {
+    kind: IdKind;
+    requestName?: string;
+}): void;
+/**
+ * Convenience wrapper that validates whichever of `spaceId` / `collectionId` /
+ * `resourceId` are present on a request's params object. Call at the top of a
+ * handler, before any storage access.
+ * @param ids {object}
+ * @param [ids.spaceId] {string}
+ * @param [ids.collectionId] {string}
+ * @param [ids.resourceId] {string}
+ * @param options {object}
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export declare function assertValidIds(ids: {
+    spaceId?: string;
+    collectionId?: string;
+    resourceId?: string;
+}, { requestName }?: {
+    requestName?: string;
+}): void;
+//# sourceMappingURL=validateId.d.ts.map

package/dist/lib/validateId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateId.d.ts","sourceRoot":"","sources":["../../src/lib/validateId.ts"],"names":[],"mappings":"AAiBA,4EAA4E;AAC5E,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,CAAA;AAUxD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAUpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,aASlC,CAAA;AACF,eAAO,MAAM,qBAAqB,aAMhC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,IAAI,CAsBN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EACrE,EAAE,WAAW,EAAE,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,IAAI,CAUN"}

package/dist/lib/validateId.js

@@ -0,0 +1,126 @@
+/**
+ * Id sanitization for path-traversal defense. `spaceId` / `collectionId` /
+ * `resourceId` values arrive from URL params, request bodies, and tar-entry
+ * names, then flow into filesystem paths (and glob patterns). This validator
+ * rejects anything that is not a single, URL-safe path segment -- empty, `.`,
+ * `..`, a value containing `/` or `\`, or any character outside the RFC 3986
+ * "unreserved" set -- so a malicious id can never escape its parent directory.
+ * It also rejects Collection / Resource ids that collide with the spec's
+ * Reserved Path Segment Registry (`reserved-id`, 409).
+ */
+import { InvalidSpaceIdError, InvalidCollectionIdError, InvalidResourceIdError, ReservedIdError } from '../errors.js';
+/**
+ * URL-safe id charset: the RFC 3986 "unreserved" characters
+ * (ALPHA / DIGIT / `-` / `.` / `_` / `~`). This excludes path separators
+ * (`/`, `\`) and every glob metacharacter, so a validated id is safe to use
+ * both as a single path segment and inside a glob pattern.
+ */
+const ID_PATTERN = /^[A-Za-z0-9._~-]+$/;
+/**
+ * Whether `id` is a single, URL-safe path segment: non-empty, not `.` / `..`,
+ * free of path separators, and made only of the RFC 3986 "unreserved" charset
+ * ({@link ID_PATTERN}). The shared safety predicate behind `assertValidId` (and
+ * `assertValidBackendId` in `lib/backends.ts`); does **not** check the reserved
+ * path-segment registry, which is id-kind specific.
+ * @param id {string}
+ * @returns {boolean}
+ */
+export function isUrlSafeSegment(id) {
+    return (typeof id === 'string' &&
+        id.length > 0 &&
+        id !== '.' &&
+        id !== '..' &&
+        !id.includes('/') &&
+        !id.includes('\\') &&
+        ID_PATTERN.test(id));
+}
+/**
+ * Reserved path segments from the spec's Reserved Path Segment Registry (plus
+ * the server's own non-spec `import` endpoint). A client-chosen Collection or
+ * Resource id matching one of these would shadow the reserved route at that
+ * position (e.g. a Collection named `export` would shadow
+ * `/space/{id}/export`), so the spec requires rejecting it with 409
+ * `reserved-id`. Space ids have no reserved siblings (`/space/{id}` has no
+ * static neighbors), so no set exists for the `space` kind.
+ *
+ * Exported as the server's authoritative per-kind sets so a client can mirror
+ * them rather than hand-maintaining a copy (client #13). NOTE the one known
+ * divergence from the pure spec registry: `import` is this server's non-spec
+ * tar-import endpoint, so a client mirroring the *spec* registry should omit
+ * it. Kept byte-identical to `@interop/storage-core`'s exported registry
+ * (locked by a drift-guard test); the local definition keeps the id-safety
+ * logic self-contained.
+ */
+export const RESERVED_COLLECTION_IDS = new Set([
+    'backends',
+    'collections',
+    'export',
+    'import', // non-spec: this server's tar-import endpoint
+    'linkset',
+    'policy',
+    'query',
+    'quotas'
+]);
+export const RESERVED_RESOURCE_IDS = new Set([
+    'backend',
+    'linkset',
+    'policy',
+    'query',
+    'quota'
+]);
+/**
+ * Asserts that an id is a single, URL-safe path segment that does not collide
+ * with a reserved path segment -- throwing the typed 400 `invalid-id` error
+ * matching `kind` for an unsafe id, or the 409 `reserved-id` error for a
+ * reserved-segment collision.
+ * @param id {string}   the id parsed from a URL param, body, or tar entry
+ * @param options {object}
+ * @param options.kind {IdKind}   which id is being validated
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export function assertValidId(id, { kind, requestName }) {
+    if (!isUrlSafeSegment(id)) {
+        switch (kind) {
+            case 'collection':
+                throw new InvalidCollectionIdError({ requestName });
+            case 'resource':
+                throw new InvalidResourceIdError({ requestName });
+            default:
+                throw new InvalidSpaceIdError({ requestName });
+        }
+    }
+    // Collections and Resources may not take a reserved path-segment name.
+    const reserved = kind === 'collection'
+        ? RESERVED_COLLECTION_IDS
+        : kind === 'resource'
+            ? RESERVED_RESOURCE_IDS
+            : undefined;
+    if (reserved?.has(id)) {
+        throw new ReservedIdError({ kind, id });
+    }
+}
+/**
+ * Convenience wrapper that validates whichever of `spaceId` / `collectionId` /
+ * `resourceId` are present on a request's params object. Call at the top of a
+ * handler, before any storage access.
+ * @param ids {object}
+ * @param [ids.spaceId] {string}
+ * @param [ids.collectionId] {string}
+ * @param [ids.resourceId] {string}
+ * @param options {object}
+ * @param [options.requestName] {string}   request name used in the error title
+ * @returns {void}
+ */
+export function assertValidIds(ids, { requestName } = {}) {
+    if (ids.spaceId !== undefined) {
+        assertValidId(ids.spaceId, { kind: 'space', requestName });
+    }
+    if (ids.collectionId !== undefined) {
+        assertValidId(ids.collectionId, { kind: 'collection', requestName });
+    }
+    if (ids.resourceId !== undefined) {
+        assertValidId(ids.resourceId, { kind: 'resource', requestName });
+    }
+}
+//# sourceMappingURL=validateId.js.map

package/dist/lib/validateId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateId.js","sourceRoot":"","sources":["../../src/lib/validateId.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EAChB,MAAM,cAAc,CAAA;AAKrB;;;;;GAKG;AACH,MAAM,UAAU,GAAG,oBAAoB,CAAA;AAEvC;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,CACL,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,CAAC,MAAM,GAAG,CAAC;QACb,EAAE,KAAK,GAAG;QACV,EAAE,KAAK,IAAI;QACX,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACpB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IAC7C,UAAU;IACV,aAAa;IACb,QAAQ;IACR,QAAQ,EAAE,8CAA8C;IACxD,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;CACT,CAAC,CAAA;AACF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC3C,SAAS;IACT,SAAS;IACT,QAAQ;IACR,OAAO;IACP,OAAO;CACR,CAAC,CAAA;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,EAAE,IAAI,EAAE,WAAW,EAA0C;IAE7D,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY;gBACf,MAAM,IAAI,wBAAwB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;YACrD,KAAK,UAAU;gBACb,MAAM,IAAI,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;YACnD;gBACE,MAAM,IAAI,mBAAmB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GACZ,IAAI,KAAK,YAAY;QACnB,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,IAAI,KAAK,UAAU;YACnB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAqE,EACrE,EAAE,WAAW,KAA+B,EAAE;IAE9C,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The WAS protocol surface as a registerable Fastify plugin (`fastifyWas`):
+ * the storage/config decorations, CORS, multipart and content-type parsers,
+ * and the route groups (the four WAS groups plus the WebKMS `/kms` facet) --
+ * everything from routes.ts down, including the auth/digest hook chains and
+ * the error handler those groups install.
+ *
+ * The community `createApp()` (server.ts) registers this plugin with defaults;
+ * a hardened downstream composition registers the same plugin (with its own
+ * backend and policy plugins around it) and inherits the identical wire
+ * behavior. Wrapped with `fastify-plugin`, so the decorations and parsers land
+ * on the root instance -- while each route group still creates its own
+ * encapsulated context for its hooks.
+ */
+import type { FastifyInstance } from 'fastify';
+import type { StorageBackend, BackendProviderRegistry, KmsRecordKekRegistry, AuthorizeProvisioning } from './types.js';
+export interface FastifyWasOptions {
+    /**
+     * This server's base URL; used to build and match ZCap invocationTarget URLs
+     * (host and port must match exactly). When provided, it must be an absolute
+     * `http:`/`https:` URL with no path, query, or fragment (validated at
+     * registration -- sub-path deployment is not supported).
+     */
+    serverUrl?: string;
+    /**
+     * Persistence backend to use; defaults to a filesystem backend rooted at the
+     * project `data/` directory. Tests inject their own (e.g. a
+     * FileSystemBackend over a temp dir).
+     */
+    backend?: StorageBackend;
+    /**
+     * Per-Space storage limit in bytes (spec "Quotas"); applied only to the
+     * default backend (an injected `backend` carries its own `capacityBytes`).
+     * `undefined` means unlimited; `Infinity` (an explicit `unlimited`) is
+     * normalized by the backend to the same no-limit behavior.
+     */
+    storageLimitPerSpace?: number;
+    /**
+     * Per-upload size cap in bytes (spec "Quotas", `maxUploadBytes`); applied
+     * only to the default backend (an injected `backend` carries its own).
+     * `undefined` applies the backend's default-on cap
+     * ({@link DEFAULT_MAX_UPLOAD_BYTES}); `Infinity` (an explicit `unlimited`)
+     * disables the cap.
+     */
+    maxUploadBytes?: number;
+    /**
+     * Max Spaces a single controller may create (spec "Quotas", a default-on
+     * count quota); applied only to the default backend (an injected `backend`
+     * carries its own). `undefined` applies the backend's default
+     * ({@link DEFAULT_MAX_SPACES_PER_CONTROLLER}); `Infinity` (an explicit
+     * `unlimited`) disables the cap.
+     */
+    maxSpacesPerController?: number;
+    /**
+     * Max Collections a single Space may hold (spec "Quotas", a default-on count
+     * quota); applied only to the default backend (an injected `backend` carries
+     * its own). `undefined` applies the backend's default
+     * ({@link DEFAULT_MAX_COLLECTIONS_PER_SPACE}); `Infinity` (an explicit
+     * `unlimited`) disables the cap.
+     */
+    maxCollectionsPerSpace?: number;
+    /**
+     * Max live Resources a single Space may hold across all its Collections (spec
+     * "Quotas", a default-on count quota); applied only to the default backend
+     * (an injected `backend` carries its own). `undefined` applies the backend's
+     * default ({@link DEFAULT_MAX_RESOURCES_PER_SPACE}); `Infinity` (an explicit
+     * `unlimited`) disables the cap.
+     */
+    maxResourcesPerSpace?: number;
+    /**
+     * The provider-adapter registry the resolver uses to build a Collection's
+     * selected external backend; defaults to an empty map (no external backend
+     * is operable).
+     */
+    providers?: BackendProviderRegistry;
+    /**
+     * The registration allowlist of backend `provider` names; `undefined` means
+     * permissive.
+     */
+    enabledBackendProviders?: string[];
+    /**
+     * The at-rest WebKMS key-record encryption registry (config `KMS_RECORD_KEK` /
+     * `KMS_RECORD_KEKS` / `KMS_RECORD_CURRENT_KEK`); `undefined` (or
+     * `currentKekId: null`) disables encryption -- key records are written
+     * plaintext (the teaching default).
+     */
+    kmsRecordKek?: KmsRecordKekRegistry;
+    /**
+     * Custom provisioning gate for `POST /spaces/` and `POST /kms/keystores`;
+     * receives `{ request }` and returns `'verify'` (normal zcap path), `'grant'`
+     * (authorized by the callback -- skip zcap verification), or `'deny'` (403).
+     * `undefined` means allow (the teaching default). Mutually exclusive with
+     * `onboardingToken`.
+     */
+    authorizeProvisioning?: AuthorizeProvisioning;
+    /**
+     * Shared-secret gate for `POST /spaces/` and `POST /kms/keystores` (config
+     * `WAS_ONBOARDING_TOKEN`); when set, those two endpoints require an
+     * `Authorization: Bearer <token>` header, which then substitutes for zcap
+     * verification on that request. `undefined` means disabled (the teaching
+     * default). Mutually exclusive with `authorizeProvisioning`.
+     */
+    onboardingToken?: string;
+}
+/**
+ * Decorates the instance with the WAS storage/config surface, registers the
+ * protocol-level plugins and content-type parsers, and mounts the route groups.
+ * @param fastify {import('fastify').FastifyInstance}
+ * @param options {FastifyWasOptions}
+ * @returns {Promise<void>}
+ */
+declare function wasPlugin(fastify: FastifyInstance, options: FastifyWasOptions): Promise<void>;
+export declare const fastifyWas: typeof wasPlugin;
+export {};
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAe9C,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAEnB,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,uBAAuB,CAAA;IACnC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAA;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAA;IACnC;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;GAMG;AACH,iBAAe,SAAS,CACtB,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CAmJf;AAED,eAAO,MAAM,UAAU,kBAGrB,CAAA"}

package/dist/plugin.js

@@ -0,0 +1,134 @@
+import fp from 'fastify-plugin';
+import cors from '@fastify/cors';
+import Multipart from '@fastify/multipart';
+import { initCollectionRoutes, initKmsRoutes, initResourceRoutes, initSpaceRoutes, initSpacesRepositoryRoutes } from './routes.js';
+import { assertValidServerUrl } from './config.default.js';
+import { defaultBackend } from './storage.js';
+import { onboardingTokenAuthorizer } from './provisioning.js';
+/**
+ * Decorates the instance with the WAS storage/config surface, registers the
+ * protocol-level plugins and content-type parsers, and mounts the route groups.
+ * @param fastify {import('fastify').FastifyInstance}
+ * @param options {FastifyWasOptions}
+ * @returns {Promise<void>}
+ */
+async function wasPlugin(fastify, options) {
+    const { serverUrl, backend, storageLimitPerSpace, maxUploadBytes, maxSpacesPerController, maxCollectionsPerSpace, maxResourcesPerSpace, providers, enabledBackendProviders, kmsRecordKek, authorizeProvisioning, onboardingToken } = options;
+    // Fail fast on a malformed base URL: a serverUrl carrying a path, query, or
+    // fragment silently breaks every ZCap invocationTarget match and Location
+    // header (URL-joins drop the base path), so it is rejected at registration.
+    if (serverUrl !== undefined) {
+        assertValidServerUrl(serverUrl);
+    }
+    // The two provisioning gates are alternative ways to configure the same seam.
+    if (authorizeProvisioning && onboardingToken) {
+        throw new Error('authorizeProvisioning and onboardingToken are mutually exclusive.');
+    }
+    fastify.decorate('serverUrl', serverUrl);
+    // Route the backend's diagnostics through the Fastify pino logger (the backend
+    // defaults to a silent logger until wired here).
+    const storage = backend ??
+        defaultBackend({
+            capacityBytes: storageLimitPerSpace,
+            maxUploadBytes,
+            maxSpacesPerController,
+            maxCollectionsPerSpace,
+            maxResourcesPerSpace
+        });
+    storage.logger = fastify.log;
+    fastify.decorate('storage', storage);
+    // Backend lifecycle: run the optional startup hook (e.g. Postgres connect +
+    // migrations) during registration, before the server starts listening, and
+    // wire the optional shutdown hook (pool drain) to Fastify's close.
+    if (storage.init) {
+        await storage.init();
+    }
+    if (storage.close) {
+        fastify.addHook('onClose', async () => {
+            await storage.close();
+        });
+    }
+    // The provider-adapter registry the resolver (lib/backendRegistry.ts) consults
+    // to build a Collection's selected external backend. Injected (rather than a
+    // module-global mutable registry) so parallel test suites stay isolated -- the
+    // same rationale as the injected `storage`. Empty in production this stage.
+    fastify.decorate('backendProviders', providers ?? new Map());
+    // The optional registration allowlist (config `WAS_ENABLED_BACKENDS`);
+    // `undefined` = permissive (any provider may be registered).
+    fastify.decorate('enabledBackendProviders', enabledBackendProviders);
+    // The at-rest key-record encryption registry (config `KMS_RECORD_KEK`);
+    // `undefined` = disabled (records written plaintext). Read at the KMS
+    // orchestration seam (KeyRequest), never inside a backend.
+    fastify.decorate('kmsRecordKek', kmsRecordKek);
+    // The provisioning gate for `POST /spaces/` and `POST /kms/keystores`: a
+    // custom callback, or the stock onboarding-token check when a token is set,
+    // or `undefined` = allow (the teaching default). Read by the `provisioningGate`
+    // onRequest hook installed by those two route groups.
+    fastify.decorate('authorizeProvisioning', authorizeProvisioning ??
+        (onboardingToken ? onboardingTokenAuthorizer(onboardingToken) : undefined));
+    // Disable CORS
+    fastify.register(cors, {
+        origin: '*',
+        methods: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']
+    });
+    // Multipart file uploading. The cap is `files: 2`, not `1`: a write MUST carry
+    // exactly one file part, and `resolveResourceInput` enforces that by iterating
+    // the parts and rejecting a second one with `invalid-request-body` (400). With
+    // a `files: 1` limit busboy would instead silently drop the second part and
+    // raise its own `FST_FILES_LIMIT` (413), so the second part must be allowed
+    // through to the iterator to be caught and rejected with the correct error.
+    //
+    // `fileSize` bounds the in-memory buffer of the single permitted part to the
+    // backend's per-upload cap (`throwFileSizeLimit` makes `toBuffer()` throw at
+    // the boundary, which the request layer maps to `payload-too-large` (413)) --
+    // so an oversize multipart upload is rejected before it is fully buffered.
+    // The cap is default-on (the backend applies `DEFAULT_MAX_UPLOAD_BYTES` when
+    // none is configured), so `storage.maxUploadBytes` is `undefined` here only
+    // when the operator explicitly opted out (`MAX_UPLOAD_BYTES=unlimited`); the
+    // conditional spread then leaves multipart uncapped. Large binaries should
+    // use the streaming raw-body path, not multipart.
+    fastify.register(Multipart, {
+        throwFileSizeLimit: true,
+        limits: {
+            files: 2,
+            ...(storage.maxUploadBytes !== undefined && {
+                fileSize: storage.maxUploadBytes
+            })
+        }
+    });
+    // Parse `application/<suffix>+json` bodies (e.g. `application/jose+json` for
+    // EDV-over-WAS encrypted documents, `application/ld+json`, etc.) as JSON, the
+    // same as plain `application/json`. Fastify's built-in JSON parser only
+    // matches `application/json` exactly, so structured-suffix JSON media types
+    // would otherwise be rejected with a 415. The regex deliberately requires a
+    // non-`+` suffix before `+json`, so it never shadows the built-in parser for
+    // plain `application/json`. Registered on the root instance so every route
+    // group inherits it; `isJson()` already treats `+json` as JSON downstream
+    // (digest capture, resource-input resolution).
+    fastify.addContentTypeParser(/^application\/[^+]+\+json/, { parseAs: 'string' }, fastify.getDefaultJsonParser('error', 'error'));
+    // Catch-all parser for arbitrary binary representations. The spec ("Content
+    // Types and Representations") lets a Resource be any media type, so a raw
+    // (non-multipart) blob PUT/POST -- `application/octet-stream`,
+    // `application/jsonl`, images, etc. -- must reach the handler as a byte
+    // stream. Fastify only ships parsers for `application/json` and `text/plain`
+    // and would otherwise reject every other media type with a 415 before the
+    // route runs. This bare pass-through leaves `request.body` as the raw stream,
+    // which `resolveResourceInput` normalizes to a `kind: 'binary'` input that the
+    // backend streams straight to storage. More specific parsers still win over
+    // this fallback: the built-in JSON/text parsers, the `+json` regex above,
+    // `@fastify/multipart`'s `multipart/*`, and the `application/x-tar` import
+    // parser are all matched ahead of it.
+    fastify.addContentTypeParser('*', function (_request, payload, done) {
+        done(null, payload);
+    });
+    fastify.register(initSpacesRepositoryRoutes);
+    fastify.register(initSpaceRoutes);
+    fastify.register(initCollectionRoutes);
+    fastify.register(initResourceRoutes);
+    fastify.register(initKmsRoutes);
+}
+export const fastifyWas = fp(wasPlugin, {
+    fastify: '5.x',
+    name: 'fastify-was'
+});
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC/B,OAAO,IAAI,MAAM,eAAe,CAAA;AAChC,OAAO,SAAS,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,0BAA0B,EAC3B,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAiG7D;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CACtB,OAAwB,EACxB,OAA0B;IAE1B,MAAM,EACJ,SAAS,EACT,OAAO,EACP,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,uBAAuB,EACvB,YAAY,EACZ,qBAAqB,EACrB,eAAe,EAChB,GAAG,OAAO,CAAA;IAEX,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED,8EAA8E;IAC9E,IAAI,qBAAqB,IAAI,eAAe,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAA;IACH,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAmB,CAAC,CAAA;IAClD,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,OAAO,GACX,OAAO;QACP,cAAc,CAAC;YACb,aAAa,EAAE,oBAAoB;YACnC,cAAc;YACd,sBAAsB;YACtB,sBAAsB;YACtB,oBAAoB;SACrB,CAAC,CAAA;IACJ,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAA;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAEpC,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,OAAO,CAAC,KAAM,EAAE,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;IAC5D,uEAAuE;IACvE,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAA;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAA;IAC9C,yEAAyE;IACzE,4EAA4E;IAC5E,gFAAgF;IAChF,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CACd,uBAAuB,EACvB,qBAAqB;QACnB,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAC7E,CAAA;IAED,eAAe;IACf,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;KACtE,CAAC,CAAA;IAEF,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;QAC1B,kBAAkB,EAAE,IAAI;QACxB,MAAM,EAAE;YACN,KAAK,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI;gBAC1C,QAAQ,EAAE,OAAO,CAAC,cAAc;aACjC,CAAC;SACH;KACF,CAAC,CAAA;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,CAAC,oBAAoB,CAC1B,2BAA2B,EAC3B,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAC/C,CAAA;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,wEAAwE;IACxE,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,sCAAsC;IACtC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,QAAQ,EAAE,OAAO,EAAE,IAAI;QACjE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAA;IAC5C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC,SAAS,EAAE;IACtC,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,aAAa;CACpB,CAAC,CAAA"}