@astram/guard 0.13.0 → 0.15.0

package/dist/boot/migration-ledger-check.d.ts

@@ -0,0 +1,94 @@
+import type { OnApplicationBootstrap } from '@nestjs/common';
+import { type FrameworkSchemas, type MigrationLedgerLocation } from '@astram/core';
+/** Runs one SELECT on the runtime pool (a mariadb `Pool.query` fits). */
+export type LedgerQuery = (sql: string) => Promise<unknown>;
+/** Where the boot check looks for warnings. */
+export interface LedgerCheckLogger {
+    warn(message: string): void;
+}
+export type { MigrationLedgerLocation };
+export interface FrameworkMigrationsCheckOptions extends MigrationLedgerLocation {
+    /**
+     * Further ledger locations, tried in order after `database`/`table` (G-007 QA P1). Empty or
+     * absent ⇒ `database`/`table` is read directly. Otherwise each location is probed
+     * (information_schema) and the first whose table exists is read; none ⇒ fail closed.
+     */
+    readonly alternatives?: readonly MigrationLedgerLocation[];
+    readonly query: LedgerQuery;
+    /**
+     * Directory (or directories) of shipped `.cjs` migrations (`guardMigrationsDir`,
+     * `identityMigrationsDir`); ids of several directories are checked as one set.
+     */
+    readonly migrationsDir: string | readonly string[];
+    /** The raw `NODE_ENV`; only `development` and `test` downgrade a failure to a warning. */
+    readonly nodeEnv: string | undefined;
+    readonly logger: LedgerCheckLogger;
+}
+export interface FrameworkMigrationsCheckResult {
+    /** `true` when every shipped id is in the ledger. */
+    readonly ok: boolean;
+    /** Shipped ids absent from the ledger (all of them when the ledger is missing or unreadable). */
+    readonly missing: readonly string[];
+}
+/** The migration ids shipped in `dir` (`.cjs` files only), ascending. */
+export declare function frameworkMigrationIds(dir: string): string[];
+/**
+ * The migrate CLI's ledger location rule (core `resolveMigrationLedgerLocation`: `<ns>_app` when
+ * namespaced, else `DDL_DB_NAME ?? <default app>`). The boot check itself uses
+ * {@link resolveMigrationLedgerCheck}, which also tries the runtime `APP_DB_NAME`.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+export declare function resolveMigrationLedger(env: NodeJS.ProcessEnv, schemas: FrameworkSchemas): MigrationLedgerLocation;
+/** Where the boot check looks: the first candidate plus the ones tried after it. */
+export interface MigrationLedgerCheckLocation extends MigrationLedgerLocation {
+    readonly alternatives: readonly MigrationLedgerLocation[];
+}
+/**
+ * The boot check's ledger locations for this process's env (G-007 QA P1): core
+ * `migrationLedgerCandidates`, split into the first location and its `alternatives`. Namespace
+ * set ⇒ `<ns>_app` only; default ⇒ `DDL_DB_NAME`, the runtime `APP_DB_NAME`, `shield_app`.
+ * Spread it into {@link FrameworkMigrationsCheckOptions}.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+export declare function resolveMigrationLedgerCheck(env: NodeJS.ProcessEnv, schemas: FrameworkSchemas): MigrationLedgerCheckLocation;
+/**
+ * Compare the shipped migration ids in `migrationsDir` with the ledger; throw (production) or
+ * warn (development/test) when any is missing or the ledger cannot be read.
+ * @throws Error naming the database and up to 10 missing ids, outside development/test; and in
+ *   every environment for an invalid ledger database or table name (checked before any query).
+ */
+export declare function assertFrameworkMigrationsApplied(options: FrameworkMigrationsCheckOptions): Promise<FrameworkMigrationsCheckResult>;
+/** DI token of the per-app {@link MigrationLedgerRegistry} (provided by `ShieldModule`). */
+export declare const SHIELD_MIGRATION_LEDGER_REGISTRY: unique symbol;
+/** DI token of guard's own check (`AuthModule`); identity provides its check under its own token. */
+export declare const SHIELD_GUARD_MIGRATION_LEDGER_CHECK: unique symbol;
+/**
+ * Merges the ledger checks of one application (guard's `AuthModule` and identity) so each ledger
+ * location is read once. Hooks {@link register} at construction (all providers exist before any
+ * bootstrap hook runs); the first {@link run} for a location checks the union of every registered
+ * directory and caches that promise, so later hooks share the result, rejection included.
+ */
+export declare class MigrationLedgerRegistry {
+    private readonly entries;
+    /** The whole candidate list: hooks with the same list share one probe + read. */
+    private static key;
+    /** Add `options.migrationsDir` to the check of `options`' ledger location. */
+    register(options: FrameworkMigrationsCheckOptions): void;
+    /** The (shared) check of `location`'s ledger over every registered directory. */
+    run(location: MigrationLedgerLocation & {
+        alternatives?: readonly MigrationLedgerLocation[];
+    }): Promise<FrameworkMigrationsCheckResult>;
+}
+/**
+ * The boot hook: runs {@link assertFrameworkMigrationsApplied} once, when Nest bootstraps the
+ * application (after module init, before the HTTP server listens). Never on a request. With a
+ * {@link MigrationLedgerRegistry}, it shares one read per ledger location with the app's other
+ * hooks; without one (`null`/absent), it checks alone.
+ */
+export declare class FrameworkMigrationLedgerCheck implements OnApplicationBootstrap {
+    private readonly options;
+    private readonly registry;
+    constructor(options: FrameworkMigrationsCheckOptions, registry?: MigrationLedgerRegistry | null);
+    onApplicationBootstrap(): Promise<void>;
+}
+//# sourceMappingURL=migration-ledger-check.d.ts.map

package/dist/boot/migration-ledger-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-ledger-check.d.ts","sourceRoot":"","sources":["../../src/boot/migration-ledger-check.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC7B,MAAM,cAAc,CAAC;AAGtB,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5D,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,MAAM,WAAW,+BAAgC,SAAQ,uBAAuB;IAC9E;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnD,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,8BAA8B;IAC7C,qDAAqD;IACrD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAgBD,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAO3D;AAWD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,gBAAgB,GACxB,uBAAuB,CAEzB;AAED,oFAAoF;AACpF,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,gBAAgB,GACxB,4BAA4B,CAG9B;AA+CD;;;;;GAKG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAyFzC;AAED,4FAA4F;AAC5F,eAAO,MAAM,gCAAgC,eAA6C,CAAC;AAE3F,qGAAqG;AACrG,eAAO,MAAM,mCAAmC,eAAgD,CAAC;AAEjG;;;;;GAKG;AACH,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAOpB;IAEJ,iFAAiF;IACjF,OAAO,CAAC,MAAM,CAAC,GAAG;IAQlB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,+BAA+B,GAAG,IAAI;IAexD,iFAAiF;IACjF,GAAG,CACD,QAAQ,EAAE,uBAAuB,GAAG;QAAE,YAAY,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAA;KAAE,GACxF,OAAO,CAAC,8BAA8B,CAAC;CAY3C;AAED;;;;;GAKG;AACH,qBAAa,6BAA8B,YAAW,sBAAsB;IAExE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,OAAO,EAAE,+BAA+B,EACxC,QAAQ,GAAE,uBAAuB,GAAG,IAAW;IAK5D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAI9C"}

package/dist/boot/migration-ledger-check.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FrameworkMigrationLedgerCheck = exports.MigrationLedgerRegistry = exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = exports.SHIELD_MIGRATION_LEDGER_REGISTRY = void 0;
+exports.frameworkMigrationIds = frameworkMigrationIds;
+exports.resolveMigrationLedger = resolveMigrationLedger;
+exports.resolveMigrationLedgerCheck = resolveMigrationLedgerCheck;
+exports.assertFrameworkMigrationsApplied = assertFrameworkMigrationsApplied;
+/**
+ * Boot check: every framework migration a package ships is recorded in the `@astram/migrate`
+ * ledger (configurable-framework-db spec 5.D, §13).
+ *
+ * The ledger lives where `astram-migrate` writes it (spec 5.G): `<ns>_app` when
+ * `SHIELD_DB_NAMESPACE` is set, else `DDL_DB_NAME ?? APP_DB_NAME ?? <default app database>` of
+ * the migrate job's env; the table is `APP_MIGRATION_TABLE ?? 'schema_migrations'`. With the
+ * namespace set the check reads `<ns>_app` directly. In default mode it cannot know the migrate
+ * job's env, so it probes core `migrationLedgerCandidates` in order (`DDL_DB_NAME`, the runtime
+ * `APP_DB_NAME`, `shield_app`; one information_schema probe each, at bootstrap only) and reads the
+ * first ledger table that exists (G-007 QA P1). That ledger must hold every id; none found fails
+ * closed naming every location tried.
+ *
+ * Missing ids, no ledger table, or an unreadable ledger:
+ * - outside `NODE_ENV` development/test (unset included) ⇒ throws, boot fails (Shield #1);
+ * - in development/test ⇒ one warning, boot continues.
+ * An unreadable ledger is never treated as "all applied". Messages carry the database name, the
+ * table name, migration ids and a driver error code only: never a user, host, password or the
+ * driver's message text (core 70-secrets).
+ *
+ * Runs once, at application bootstrap, never per request (Shield #12). Who checks what:
+ * - `AuthModule` (`auth: true`) checks `guardMigrationsDir` over its runtime pool;
+ * - `@astram/identity` checks `guardMigrationsDir` AND `identityMigrationsDir` over its own pool
+ *   (identity reads guard's authz tables; guard never imports identity, ADR-0003);
+ * - an enforcement-only app (no `auth`, no identity) opens no DB pool and reads no framework
+ *   table, so it checks nothing.
+ * When both run in one app, the per-app {@link MigrationLedgerRegistry} (provided by
+ * `ShieldModule`) merges them: every hook registers its directories when constructed, and the
+ * first hook to bootstrap runs ONE SELECT per ledger location over the union; the others await
+ * that same result (a failure fails every one of them). Without the registry each hook runs alone.
+ */
+const node_fs_1 = require("node:fs");
+const core_1 = require("@astram/core");
+const app_config_js_1 = require("../config/app-config.js");
+/** At most this many ids are listed in the message (spec §13). */
+const MAX_LISTED_IDS = 10;
+/** Same id rule as `@astram/migrate`'s loader, restricted to the shipped `.cjs` files. */
+const MIGRATION_FILE = /^(\d+)-.+\.cjs$/;
+/** MariaDB "table doesn't exist". */
+const ER_NO_SUCH_TABLE = 1146;
+/** `1`, `01` and `001` are the same migration id (migrate orders ids numerically). */
+function idKey(id) {
+    return id.replace(/^0+(?=\d)/, '');
+}
+/** The migration ids shipped in `dir` (`.cjs` files only), ascending. */
+function frameworkMigrationIds(dir) {
+    const ids = [];
+    for (const file of (0, node_fs_1.readdirSync)(dir)) {
+        const m = MIGRATION_FILE.exec(file);
+        if (m)
+            ids.push(m[1]);
+    }
+    return sortIds(ids);
+}
+/** Ascending numeric order over decimal id strings. */
+function sortIds(ids) {
+    return ids.sort((a, b) => {
+        const ka = idKey(a);
+        const kb = idKey(b);
+        return ka.length - kb.length || (ka < kb ? -1 : ka > kb ? 1 : 0);
+    });
+}
+/**
+ * The migrate CLI's ledger location rule (core `resolveMigrationLedgerLocation`: `<ns>_app` when
+ * namespaced, else `DDL_DB_NAME ?? <default app>`). The boot check itself uses
+ * {@link resolveMigrationLedgerCheck}, which also tries the runtime `APP_DB_NAME`.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedger(env, schemas) {
+    return (0, core_1.resolveMigrationLedgerLocation)(schemas, env);
+}
+/**
+ * The boot check's ledger locations for this process's env (G-007 QA P1): core
+ * `migrationLedgerCandidates`, split into the first location and its `alternatives`. Namespace
+ * set ⇒ `<ns>_app` only; default ⇒ `DDL_DB_NAME`, the runtime `APP_DB_NAME`, `shield_app`.
+ * Spread it into {@link FrameworkMigrationsCheckOptions}.
+ * @throws FrameworkSchemaConfigError on a conflicting `DDL_DB_NAME` or invalid names.
+ */
+function resolveMigrationLedgerCheck(env, schemas) {
+    const [first, ...alternatives] = (0, core_1.migrationLedgerCandidates)(schemas, env);
+    return { database: first.database, table: first.table, alternatives };
+}
+/** The driver error code only (never its message: it can carry user@host). */
+function errorCode(err) {
+    if (typeof err === 'object' && err !== null) {
+        const { code, errno } = err;
+        if (typeof code === 'string' && /^[A-Z0-9_]{1,64}$/.test(code))
+            return code;
+        if (typeof errno === 'number')
+            return `errno ${errno}`;
+    }
+    return 'unknown error';
+}
+function isNoSuchTable(err) {
+    if (typeof err !== 'object' || err === null)
+        return false;
+    const { code, errno } = err;
+    return code === 'ER_NO_SUCH_TABLE' || errno === ER_NO_SUCH_TABLE;
+}
+/** No candidate holds a ledger table: name every location, tell the operator what to set. */
+function notFoundMessage(tried, unverified) {
+    const where = tried.map((l) => `${l.database}.${l.table}`).join(', ');
+    return (`Shield migration ledger not found (tried, in order: ${where}); ` +
+        `${unverified} framework migrations are unverified. Set DDL_DB_NAME to the ledger database, ` +
+        'the same value for `astram-migrate` and the server, and run `astram-migrate migrate` ' +
+        'with the deploy account before starting the server.');
+}
+/** One information_schema probe: does `l.database` hold the table `l.table`? Names validated. */
+function probeSql(l) {
+    return ('SELECT 1 AS present FROM information_schema.TABLES ' +
+        `WHERE TABLE_SCHEMA = '${l.database}' AND TABLE_NAME = '${l.table}' LIMIT 1`);
+}
+function missingMessage(database, missing) {
+    const listed = missing.slice(0, MAX_LISTED_IDS);
+    const more = missing.length - listed.length;
+    const ids = more > 0 ? `${listed.join(', ')}, … ${more} more` : listed.join(', ');
+    return (`Shield database ${database} is missing ${missing.length} framework migrations (${ids}). ` +
+        'Run `astram-migrate migrate` with the deploy account before starting the server.');
+}
+/**
+ * Compare the shipped migration ids in `migrationsDir` with the ledger; throw (production) or
+ * warn (development/test) when any is missing or the ledger cannot be read.
+ * @throws Error naming the database and up to 10 missing ids, outside development/test; and in
+ *   every environment for an invalid ledger database or table name (checked before any query).
+ */
+async function assertFrameworkMigrationsApplied(options) {
+    // Every location is validated before any query (operator names: any plain MariaDB identifier).
+    const locations = [
+        { database: options.database, table: options.table },
+        ...(options.alternatives ?? []),
+    ].map((l) => {
+        const database = (0, core_1.assertLedgerDatabaseName)(l.database, 'migration ledger database');
+        if (typeof l.table !== 'string' || !core_1.MIGRATION_LEDGER_TABLE_PATTERN.test(l.table)) {
+            throw new Error(`APP_MIGRATION_TABLE is not a valid table name; expected ${core_1.MIGRATION_LEDGER_TABLE_PATTERN.source}`);
+        }
+        return { database, table: l.table };
+    });
+    let { database, table } = locations[0];
+    const devOrTest = (0, app_config_js_1.isDevOrTestNodeEnv)(options.nodeEnv);
+    const fail = (message, missing) => {
+        if (!devOrTest)
+            throw new Error(message);
+        options.logger.warn(`${message} (NODE_ENV=${options.nodeEnv}: continuing)`);
+        return { ok: false, missing };
+    };
+    let shipped;
+    try {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        shipped = sortIds([...new Set(dirs.flatMap((d) => frameworkMigrationIds(d)))]);
+    }
+    catch (err) {
+        return fail(`Shield database ${database}: cannot read the framework migrations directory ` +
+            `(${errorCode(err)}); the package install is incomplete.`, []);
+    }
+    if (shipped.length === 0)
+        return { ok: true, missing: [] };
+    // Several candidates (default namespace): use the first whose ledger table exists. A probe
+    // error is never "not here" or "all applied": it fails like an unreadable ledger.
+    if (locations.length > 1) {
+        let found;
+        for (const l of locations) {
+            let rows;
+            try {
+                rows = await options.query(probeSql(l));
+            }
+            catch (err) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (${errorCode(err)}); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (!Array.isArray(rows)) {
+                return fail(`Shield database ${l.database}: cannot look for the migration ledger ` +
+                    `${l.database}.${l.table} (UNEXPECTED_RESULT); ${shipped.length} framework ` +
+                    'migrations are unverified.', shipped);
+            }
+            if (rows.length > 0) {
+                found = l;
+                break;
+            }
+        }
+        if (found === undefined)
+            return fail(notFoundMessage(locations, shipped.length), shipped);
+        ({ database, table } = found);
+    }
+    let applied;
+    try {
+        const rows = await options.query(`SELECT id FROM \`${database}\`.\`${table}\``);
+        if (!Array.isArray(rows))
+            throw Object.assign(new Error(), { code: 'UNEXPECTED_RESULT' });
+        applied = new Set(rows.map((r) => idKey(String(r?.id ?? ''))));
+    }
+    catch (err) {
+        // No ledger table: nothing was ever migrated here, so every shipped id is missing.
+        if (isNoSuchTable(err))
+            return fail(missingMessage(database, shipped), shipped);
+        return fail(`Shield database ${database}: cannot read the migration ledger ${database}.${table} ` +
+            `(${errorCode(err)}); ${shipped.length} framework migrations are unverified.`, shipped);
+    }
+    const missing = shipped.filter((id) => !applied.has(idKey(id)));
+    if (missing.length === 0)
+        return { ok: true, missing: [] };
+    return fail(missingMessage(database, missing), missing);
+}
+/** DI token of the per-app {@link MigrationLedgerRegistry} (provided by `ShieldModule`). */
+exports.SHIELD_MIGRATION_LEDGER_REGISTRY = Symbol('SHIELD_MIGRATION_LEDGER_REGISTRY');
+/** DI token of guard's own check (`AuthModule`); identity provides its check under its own token. */
+exports.SHIELD_GUARD_MIGRATION_LEDGER_CHECK = Symbol('SHIELD_GUARD_MIGRATION_LEDGER_CHECK');
+/**
+ * Merges the ledger checks of one application (guard's `AuthModule` and identity) so each ledger
+ * location is read once. Hooks {@link register} at construction (all providers exist before any
+ * bootstrap hook runs); the first {@link run} for a location checks the union of every registered
+ * directory and caches that promise, so later hooks share the result, rejection included.
+ */
+class MigrationLedgerRegistry {
+    entries = new Map();
+    /** The whole candidate list: hooks with the same list share one probe + read. */
+    static key(l) {
+        return [l, ...(l.alternatives ?? [])]
+            .map((x) => `${x.database}\u0000${x.table}`)
+            .join('\u0001');
+    }
+    /** Add `options.migrationsDir` to the check of `options`' ledger location. */
+    register(options) {
+        const dirs = typeof options.migrationsDir === 'string' ? [options.migrationsDir] : options.migrationsDir;
+        const key = MigrationLedgerRegistry.key(options);
+        const entry = this.entries.get(key);
+        if (entry === undefined) {
+            this.entries.set(key, { options, dirs: new Set(dirs) });
+            return;
+        }
+        if (entry.result !== undefined) {
+            throw new Error('MigrationLedgerRegistry: a check registered after the ledger was read.');
+        }
+        for (const d of dirs)
+            entry.dirs.add(d);
+    }
+    /** The (shared) check of `location`'s ledger over every registered directory. */
+    run(location) {
+        const entry = this.entries.get(MigrationLedgerRegistry.key(location));
+        // Never registered: nothing to share, nothing claims "checked" (fail closed).
+        if (entry === undefined) {
+            return Promise.reject(new Error('MigrationLedgerRegistry: ledger location not registered.'));
+        }
+        entry.result ??= assertFrameworkMigrationsApplied({
+            ...entry.options,
+            migrationsDir: [...entry.dirs],
+        });
+        return entry.result;
+    }
+}
+exports.MigrationLedgerRegistry = MigrationLedgerRegistry;
+/**
+ * The boot hook: runs {@link assertFrameworkMigrationsApplied} once, when Nest bootstraps the
+ * application (after module init, before the HTTP server listens). Never on a request. With a
+ * {@link MigrationLedgerRegistry}, it shares one read per ledger location with the app's other
+ * hooks; without one (`null`/absent), it checks alone.
+ */
+class FrameworkMigrationLedgerCheck {
+    options;
+    registry;
+    constructor(options, registry = null) {
+        this.options = options;
+        this.registry = registry;
+        registry?.register(options);
+    }
+    async onApplicationBootstrap() {
+        if (this.registry)
+            await this.registry.run(this.options);
+        else
+            await assertFrameworkMigrationsApplied(this.options);
+    }
+}
+exports.FrameworkMigrationLedgerCheck = FrameworkMigrationLedgerCheck;

package/dist/config/app-config.d.ts

@@ -23,7 +23,7 @@
  *   8 × (12 + 8 + 1) + 40 = 208 ≤ 250  ✓
  * ─────────────────────────────────────────────────────────────────────────────
  */
-import type { SecretsProvider } from '@astram/core';
+import type { FrameworkSchemas, SecretsProvider } from '@astram/core';
 export interface AppConfig {
     /** HTTP port the Nest app listens on. */
     readonly port: number;
@@ -74,7 +74,20 @@ export interface AppConfig {
      * composition (boot fails loud).
      */
     readonly refreshReplayWindowMs?: number;
+    /**
+     * The four framework database names (configurable-framework-db, ADR-0037), resolved once from
+     * `SHIELD_DB_NAMESPACE` by core `resolveFrameworkSchemas` (unset ⇒ the `shield_*` defaults).
+     * Optional so hand-built configs keep compiling; absent ⇒ {@link frameworkSchemasOf} resolves
+     * from `process.env` once at boot. Provided app-wide under `FRAMEWORK_SCHEMAS`.
+     */
+    readonly schemas?: FrameworkSchemas;
 }
+/**
+ * The resolved framework database names for a config: `config.schemas`, else resolved from
+ * `process.env` (a hand-built config without `schemas`). Call at boot only (Shield #12).
+ * @throws FrameworkSchemaConfigError on an invalid `SHIELD_DB_NAMESPACE` (fail closed).
+ */
+export declare function frameworkSchemasOf(config: Pick<AppConfig, 'schemas'>): FrameworkSchemas;
 /** The per-client-IP login failure limit (failures within `windowMs` that lock the IP). */
 export interface LoginIpLimitConfig {
     readonly maxAttempts: number;
@@ -205,7 +218,11 @@ export declare function isDevOrTestNodeEnv(raw: string | undefined): boolean;
  *   perAccountMax.shield_schema_svc ← POOL_MAX_SCHEMA_SVC
  */
 export declare function loadPoolBudget(env?: NodeJS.ProcessEnv): PoolBudgetConfig;
-/** Documented defaults for the runtime MariaDB descriptor (local docker substrate). */
+/**
+ * Documented defaults for the runtime MariaDB descriptor (local docker substrate), for the
+ * default namespace. Under `SHIELD_DB_NAMESPACE` the user and database follow the namespace
+ * (`<ns>_core`, `<ns>_identity`; see {@link loadDbConfig}).
+ */
 export declare const DEFAULT_DB_CONFIG: Omit<DbConfig, 'password'>;
 /** Documented default Redis url (local docker substrate). */
 export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
@@ -219,8 +236,17 @@ export declare const DEFAULT_REDIS_URL = "redis://localhost:6379";
  * connect time (loud), which is correct for a runtime that needs real creds; the
  * secret is deliberately NOT hard-required at config load (unlike the HMAC key,
  * which is a fail-closed security invariant even for unit tests).
+ *
+ * Namespace (configurable-framework-db, spec 5.C): `APP_DB_USER` unset ⇒ `<ns>_core`;
+ * `APP_DB_NAME` unset ⇒ `<ns>_identity`. A set `APP_DB_NAME` must be one of the four resolved
+ * framework names, else this throws naming the variable (fail closed: an unqualified query must
+ * not reach another environment's database). An invalid `SHIELD_DB_NAMESPACE` throws too.
+ *
+ * `schemas` (optional): names the caller already resolved (e.g. `IdentityFeatureModule.forRoot
+ * ({ schemas })`). When given they replace the env namespace for the defaults and the
+ * `APP_DB_NAME` check, so the runtime database cannot drift from them (G-007 QA P2-5).
  */
-export declare function loadDbConfig(env?: NodeJS.ProcessEnv): DbConfig;
+export declare function loadDbConfig(env?: NodeJS.ProcessEnv, schemas?: FrameworkSchemas): DbConfig;
 /**
  * `APP_DB_TLS` = `off` (default) | `on`; `APP_DB_TLS_CA` = PEM path (only with `on`). Anything
  * else throws at boot: a typo must not silently fall back to plaintext.
@@ -310,6 +336,49 @@ export declare function loadAppConfig(env?: NodeJS.ProcessEnv): AppConfig;
  * The core resolver (`resolveSecretRefs`) does the work; this is the guard-side boot seam.
  */
 export declare function loadAppConfigAsync(provider?: SecretsProvider, env?: NodeJS.ProcessEnv): Promise<AppConfig>;
+/** The S3-compatible object store descriptor read from `OBJECT_STORAGE_*`. */
+export interface ObjectStorageConfig {
+    /** `https:` URL (or `http:` in development/test, or to a loopback host). Never carries userinfo. */
+    readonly endpoint: string;
+    readonly bucket: string;
+    /** `OBJECT_STORAGE_REGION`, default `us-east-1`. */
+    readonly region: string;
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    /** Server-side encryption mode. Only SSE-S3 (`AES256`) is accepted now. */
+    readonly sse: 'AES256';
+    /** `OBJECT_STORAGE_MAX_BYTES` (default 10 MiB), at most `FILE_MAX_BYTES_CEILING` (50 MiB). */
+    readonly maxBytes: number;
+}
+/** Options for {@link loadObjectStorageConfig}. */
+export interface LoadObjectStorageConfigOptions {
+    /**
+     * Provenance check for the two credential variables outside development/test (SPEC §5 F: a
+     * literal credential there is a boot error). Returns `true` when the variable's value was
+     * resolved from a `secret-ref:` at boot (`wasResolvedFromSecretRef`). Omitted outside
+     * development/test: fail closed, every credential is treated as a literal and refused (the
+     * value alone cannot tell a literal from a resolved reference).
+     */
+    readonly resolvedFromSecretRef?: (envKey: string, env: Readonly<Record<string, string | undefined>>) => boolean;
+}
+/** Default per-file cap when `OBJECT_STORAGE_MAX_BYTES` is unset (10 MiB, SPEC §10). */
+export declare const DEFAULT_OBJECT_STORAGE_MAX_BYTES: number;
+/**
+ * Read the object-storage config (FILE_STORAGE SPEC §5 F). Returns `undefined` when
+ * `OBJECT_STORAGE_BUCKET` is unset or blank (storage off). Otherwise every bad value is a boot
+ * error that names the variable and never its value (Shield #1, #10):
+ * - endpoint or either credential missing/blank;
+ * - endpoint not a URL, carrying userinfo, or not `https:` outside development/test unless the
+ *   host is loopback (the raw `NODE_ENV`; unset is not dev);
+ * - a credential still holding an unresolved `secret-ref:` value;
+ * - outside development/test, a credential not resolved from a `secret-ref:` per
+ *   `options.resolvedFromSecretRef` (`ShieldModule.forRoot({ storage: 'env' })` passes
+ *   `wasResolvedFromSecretRef`); without the option every credential there is refused;
+ * - `OBJECT_STORAGE_SSE` other than `AES256`;
+ * - `OBJECT_STORAGE_MAX_BYTES` not a plain positive decimal without leading zeros, or above the
+ *   50 MiB ceiling.
+ */
+export declare function loadObjectStorageConfig(env?: NodeJS.ProcessEnv, options?: LoadObjectStorageConfigOptions): ObjectStorageConfig | undefined;
 /** Result of evaluating a {@link PoolBudgetConfig} against the ADR-0018 budget. */
 export interface PoolBudgetEvaluation {
     /** Σ(per-account runtime pool max) for a single worker. */

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAQD,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAS3E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAa7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAWtE,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;IAC5D,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAGhC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,gBAAgB,CAEvF;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,EAAE,kBAGpC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,8FAA8F;AAC9F,eAAO,MAAM,gCAAgC,OAAO,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,EAAE,gBASjC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAoB1C;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAaD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAuBrF;AAWD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAKxD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAoB1D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,gBAA+C,GACvD,QAAQ,CAiBV;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAGlD,GACA,WAAW,CAUb;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CAiBjF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,wBAAwB,CAa1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAKzF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAIpB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE/E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,SAAS,CAc7E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,CAAC,EAAE,eAAe,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,SAAS,CAAC,CAIpB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAC9C,OAAO,CAAC;CACd;AAED,wFAAwF;AACxF,eAAO,MAAM,gCAAgC,QAAmB,CAAC;AAKjE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,OAAO,GAAE,8BAAmC,GAC3C,mBAAmB,GAAG,SAAS,CA+DjC;AA0BD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB,CAgB9E"}