@mcp-index/sdk 0.18.0 → 0.19.0

package/dist/src/lock/pg.js

@@ -0,0 +1,539 @@
+/**
+ * Postgres LockStore (`@mcp-index/sdk/lock/pg`). `pg` is an optional peer
+ * dependency: pass your own pool, or call createPgPool, which imports `pg` on
+ * first use.
+ *
+ * Tenancy. The tenant comes from an AuthenticatedPrincipal the host passes in
+ * after it has authenticated the caller. It is never read from a header or a
+ * request body. Row-level security on both tables (FORCE, so the table owner
+ * is held to it too) limits every row to one tenant. A superuser bypasses RLS;
+ * do not connect as one. There are two modes, chosen by the `tenancy` option
+ * and by which SQL the database administrator ran:
+ *
+ *   app-scoped (the default; MIGRATION_SQL). Every transaction first sets
+ *   `mcplock.tenant_id` with set_config(..., true), the parameterized form of
+ *   SET LOCAL, from the principal, and the policies compare rows against that
+ *   setting. This protects against query bugs in the store and the host: a
+ *   statement that forgets its tenant filter still sees one tenant. It does
+ *   not protect against a compromised application login. Any session may set
+ *   the setting, so whoever holds a shared mcplock_runtime login can read
+ *   every tenant, and whoever holds a shared mcplock_approver login can append
+ *   to every tenant.
+ *
+ *   role-bound (ROLE_BOUND_SQL after MIGRATION_SQL). The policies read the
+ *   tenant from mcplock.tenant_logins, an admin-owned table keyed by
+ *   session_user, through the SECURITY DEFINER function mcplock.login_tenant().
+ *   The session setting is ignored; the store does not set it. Each tenant
+ *   gets its own login roles (one in mcplock_runtime, one in mcplock_approver),
+ *   and the administrator maps each login to its tenant. session_user cannot
+ *   be changed by SET ROLE, and only a superuser can run SET SESSION
+ *   AUTHORIZATION, so a login reads and writes its own tenant and nothing
+ *   else. The store checks at the start of each transaction that the login is
+ *   mapped to the principal's tenant and fails otherwise. Running
+ *   MIGRATION_SQL again later leaves the role-bound policies in place, since
+ *   it only creates policies that are missing.
+ *
+ * Roles. ROLE_SQL creates two NOLOGIN roles: `mcplock_runtime` may only
+ * SELECT, and is what hosts in lock mode connect as; `mcplock_approver` may
+ * also INSERT records and INSERT or UPDATE the head row, and is a separate
+ * credential held by the approval path. Neither role may UPDATE or DELETE a
+ * record.
+ *
+ * Integrity. Records are append-only and hash-chained: each record_hash is
+ * sha256 over the previous hash and the record's canonical fields, tenant
+ * included. The head row holds the last seq and hash, and an optional
+ * signature from a host-supplied signer. A load recomputes the chain, checks
+ * seq is contiguous from 1, that the head matches the last record, and that
+ * every contract hashes to its digest; any failure is lock-unreadable (or
+ * contract-mismatch, or lock-signature-invalid for the head signature). A load
+ * whose head seq is below one this store instance or its sequence store
+ * already accepted is lock-unreadable, which catches deletes of trailing
+ * records together with the head update. Deleting every row for a tenant
+ * cannot be told apart from a new tenant without that external anchor, so a
+ * store with a headVerifier must also be given a sequenceStore; without one
+ * every load is lock-signature-invalid (section 8.2, draft 1c).
+ * The chain has no key. Without a headVerifier, whoever can write the tables
+ * (the schema owner, a superuser) can rewrite a record and recompute every
+ * hash after it; only a signed head gives tamper evidence against them.
+ *
+ * Use role-bound before sharing one database across tenants that do not
+ * trust each other.
+ *
+ * Staleness (spec section 9.8). Each snapshot carries snapshotId (the head
+ * hash) and loadedAt. Hosts pass maxStalenessMs to the CallGate (LockOptions
+ * in rawList.ts); calls on a decision older than that are refused with
+ * `lock-stale` unless a reload succeeds, and a reload only shrinks the
+ * allow-list.
+ *
+ * SQL is parameterized throughout. A DSN never reaches a log or an error
+ * message unredacted; see redactDsn.
+ */
+import { canonicalize, instructionsDigest, sha256Hex } from "./digest.js";
+import { FrozenMap, LockError, identityKey, validateIdentity } from "./lock.js";
+import { checkApprovalFields, prepareTool, sequenceFloor, snapshotOfError } from "./store.js";
+export const SCHEMA_VERSION = 1;
+export const GENESIS = "sha256:" + "0".repeat(64);
+/** Tables, constraints and RLS policies. Idempotent; run once as the schema owner. */
+export const MIGRATION_SQL = `
+CREATE SCHEMA IF NOT EXISTS mcplock;
+
+CREATE TABLE IF NOT EXISTS mcplock.records (
+  tenant_id    text   NOT NULL,
+  seq          bigint NOT NULL CHECK (seq > 0),
+  op           text   NOT NULL CHECK (op IN ('approve', 'revoke')),
+  identity_key text   NOT NULL,
+  tool_name    text,
+  digest       text   CHECK (digest IS NULL OR digest ~ '^sha256:[0-9a-f]{64}$'),
+  contract     bytea,
+  subject      text   NOT NULL,
+  via          text   NOT NULL CHECK (via IN ('pr', 'runtime', 'api', 'migrated')),
+  ref          text,
+  at           text   NOT NULL,
+  prev_hash    text   NOT NULL,
+  record_hash  text   NOT NULL,
+  PRIMARY KEY (tenant_id, seq)
+);
+
+-- Draft 1c: digest of the approved top-level _meta. Added in place on older schemas.
+ALTER TABLE mcplock.records ADD COLUMN IF NOT EXISTS meta_digest text
+  CHECK (meta_digest IS NULL OR meta_digest ~ '^sha256:[0-9a-f]{64}$');
+
+CREATE TABLE IF NOT EXISTS mcplock.heads (
+  tenant_id  text        PRIMARY KEY,
+  seq        bigint      NOT NULL CHECK (seq >= 0),
+  head_hash  text        NOT NULL,
+  signature  text,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE mcplock.records ENABLE ROW LEVEL SECURITY;
+ALTER TABLE mcplock.records FORCE ROW LEVEL SECURITY;
+ALTER TABLE mcplock.heads ENABLE ROW LEVEL SECURITY;
+ALTER TABLE mcplock.heads FORCE ROW LEVEL SECURITY;
+
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'mcplock' AND tablename = 'records' AND policyname = 'tenant_records') THEN
+    CREATE POLICY tenant_records ON mcplock.records
+      USING (tenant_id = current_setting('mcplock.tenant_id', true))
+      WITH CHECK (tenant_id = current_setting('mcplock.tenant_id', true));
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_policies WHERE schemaname = 'mcplock' AND tablename = 'heads' AND policyname = 'tenant_heads') THEN
+    CREATE POLICY tenant_heads ON mcplock.heads
+      USING (tenant_id = current_setting('mcplock.tenant_id', true))
+      WITH CHECK (tenant_id = current_setting('mcplock.tenant_id', true));
+  END IF;
+END $$;
+`;
+/**
+ * The two roles. Run once by a database administrator, then grant each role
+ * to its own login: hosts get mcplock_runtime, the approval service gets
+ * mcplock_approver. No role gets UPDATE or DELETE on records.
+ */
+export const ROLE_SQL = `
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'mcplock_runtime') THEN
+    CREATE ROLE mcplock_runtime NOLOGIN;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'mcplock_approver') THEN
+    CREATE ROLE mcplock_approver NOLOGIN;
+  END IF;
+END $$;
+GRANT USAGE ON SCHEMA mcplock TO mcplock_runtime, mcplock_approver;
+GRANT SELECT ON mcplock.records, mcplock.heads TO mcplock_runtime;
+GRANT SELECT, INSERT ON mcplock.records TO mcplock_approver;
+GRANT SELECT, INSERT, UPDATE ON mcplock.heads TO mcplock_approver;
+`;
+/**
+ * Role-bound tenancy. Run once by the schema owner after MIGRATION_SQL and
+ * ROLE_SQL, then map each login with
+ *   INSERT INTO mcplock.tenant_logins (login, tenant_id) VALUES ('<login>', '<tenant>');
+ * Neither mcplock role gets any privilege on the mapping table; the policies
+ * read it only through mcplock.login_tenant(). Replacing the policies inside
+ * one transaction leaves no moment with the old ones gone and the new ones
+ * missing, and FORCE RLS with no policy denies every row anyway.
+ */
+export const ROLE_BOUND_SQL = `
+BEGIN;
+CREATE TABLE IF NOT EXISTS mcplock.tenant_logins (
+  login     name PRIMARY KEY,
+  tenant_id text NOT NULL CHECK (tenant_id ~ '^[!-~]{1,128}$')
+);
+REVOKE ALL ON mcplock.tenant_logins FROM PUBLIC;
+
+CREATE OR REPLACE FUNCTION mcplock.login_tenant() RETURNS text
+  LANGUAGE sql STABLE SECURITY DEFINER
+  SET search_path = pg_catalog, pg_temp
+  AS $$ SELECT tenant_id FROM mcplock.tenant_logins WHERE login = session_user $$;
+REVOKE ALL ON FUNCTION mcplock.login_tenant() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION mcplock.login_tenant() TO mcplock_runtime, mcplock_approver;
+
+DROP POLICY IF EXISTS tenant_records ON mcplock.records;
+CREATE POLICY tenant_records ON mcplock.records
+  USING (tenant_id = mcplock.login_tenant())
+  WITH CHECK (tenant_id = mcplock.login_tenant());
+DROP POLICY IF EXISTS tenant_heads ON mcplock.heads;
+CREATE POLICY tenant_heads ON mcplock.heads
+  USING (tenant_id = mcplock.login_tenant())
+  WITH CHECK (tenant_id = mcplock.login_tenant());
+COMMIT;
+`;
+/** Replace any password or userinfo in a connection string before it is shown. */
+export function redactDsn(dsn) {
+    return dsn
+        .replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/?#]*@/i, "$1***@")
+        .replace(/([?&](?:password|sslpassword|passfile|sslkey)=)[^&#]*/gi, "$1***")
+        .replace(/(\bpassword\s*=\s*)('[^']*'|\S+)/gi, "$1***");
+}
+function scrub(message, dsn) {
+    let out = message;
+    if (dsn)
+        out = out.split(dsn).join(redactDsn(dsn));
+    return redactDsn(out);
+}
+/** Build a pg Pool, importing `pg` on first use. Errors never carry the DSN. */
+export async function createPgPool(connectionString, extra = {}) {
+    let mod;
+    try {
+        const name = "pg";
+        mod = (await import(name));
+    }
+    catch {
+        throw new Error("the optional peer dependency `pg` is not installed");
+    }
+    const pg = (mod.default ?? mod);
+    const pool = new pg.Pool({ ...extra, connectionString });
+    // pg emits idle-client errors on the pool; keep the DSN out of them.
+    pool.on?.("error", () => undefined);
+    return pool;
+}
+const TENANT = /^[\x21-\x7e]{1,128}$/;
+function recordHash(tenant, r) {
+    // metaDigest joins the hashed fields only when set, so records written
+    // before draft 1c keep the hash they were written with.
+    const fields = {
+        tenant,
+        seq: r.seq,
+        op: r.op,
+        identityKey: r.identityKey,
+        tool: r.toolName,
+        digest: r.digest,
+        contract: r.contract === null ? null : sha256Hex(r.contract),
+        subject: r.subject,
+        via: r.via,
+        ref: r.ref,
+        at: r.at,
+    };
+    if (r.metaDigest !== null)
+        fields.metaDigest = r.metaDigest;
+    const body = canonicalize(fields);
+    return "sha256:" + sha256Hex(`${r.prevHash}\n${body}`);
+}
+function headPayload(tenant, seq, head) {
+    return Buffer.from(canonicalize({ tenant, seq, head }), "utf8");
+}
+function toRow(raw) {
+    const contract = raw.contract;
+    return {
+        seq: Number(raw.seq),
+        op: raw.op,
+        identityKey: String(raw.identity_key),
+        toolName: raw.tool_name === null ? null : String(raw.tool_name),
+        digest: raw.digest === null ? null : String(raw.digest),
+        contract: contract === null || contract === undefined ? null : Buffer.from(contract),
+        metaDigest: raw.meta_digest === null || raw.meta_digest === undefined ? null : String(raw.meta_digest),
+        subject: String(raw.subject),
+        via: raw.via,
+        ref: raw.ref === null ? null : String(raw.ref),
+        at: String(raw.at),
+        prevHash: String(raw.prev_hash),
+        recordHash: String(raw.record_hash),
+    };
+}
+export class PgLockStore {
+    #pool;
+    #tenant;
+    #subject;
+    #signer;
+    #verifier;
+    #dsn;
+    #now;
+    #tenancy;
+    #sequences;
+    #lastSeq = 0;
+    constructor(options) {
+        const p = options.principal;
+        if (p === null || typeof p !== "object" || typeof p.tenantId !== "string" || !TENANT.test(p.tenantId)) {
+            throw new Error("principal.tenantId must be 1-128 printable ASCII characters");
+        }
+        if (typeof p.subject !== "string" || p.subject.length === 0)
+            throw new Error("principal.subject is required");
+        this.#pool = options.pool;
+        this.#tenant = p.tenantId;
+        this.#subject = p.subject;
+        this.#signer = options.headSigner;
+        this.#verifier = options.headVerifier;
+        this.#dsn = options.dsn;
+        this.#now = options.now ?? Date.now;
+        this.#sequences = options.sequenceStore;
+        const tenancy = options.tenancy ?? "app-scoped";
+        if (tenancy !== "app-scoped" && tenancy !== "role-bound")
+            throw new Error(`unknown tenancy ${String(tenancy)}`);
+        this.#tenancy = tenancy;
+    }
+    async #tx(mode, fn) {
+        let client;
+        try {
+            client = await this.#pool.connect();
+        }
+        catch (exc) {
+            throw new Error(`lock store unreachable: ${scrub(exc.message ?? "", this.#dsn)}`);
+        }
+        try {
+            await client.query(mode === "read" ? "BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY" : "BEGIN ISOLATION LEVEL SERIALIZABLE");
+            if (this.#tenancy === "app-scoped") {
+                await client.query("SELECT set_config('mcplock.tenant_id', $1, true)", [this.#tenant]);
+            }
+            else {
+                const bound = (await client.query("SELECT mcplock.login_tenant() AS tenant")).rows[0]?.tenant;
+                if (bound === null || bound === undefined)
+                    throw new Error("role-bound tenancy: this login is not mapped to a tenant");
+                if (bound !== this.#tenant)
+                    throw new Error("role-bound tenancy: this login is mapped to a different tenant");
+            }
+            const out = await fn(client);
+            await client.query("COMMIT");
+            client.release();
+            return out;
+        }
+        catch (exc) {
+            try {
+                await client.query("ROLLBACK");
+            }
+            catch {
+                // connection may be gone
+            }
+            client.release(true);
+            if (exc instanceof LockError)
+                throw exc;
+            const err = new Error(scrub(exc.message ?? String(exc), this.#dsn));
+            err.code = exc.code;
+            throw err;
+        }
+    }
+    async #readState(c, forUpdate) {
+        const headRes = await c.query(`SELECT seq, head_hash, signature FROM mcplock.heads WHERE tenant_id = $1${forUpdate ? " FOR UPDATE" : ""}`, [this.#tenant]);
+        const h = headRes.rows[0];
+        const head = h === undefined
+            ? null
+            : { seq: Number(h.seq), hash: String(h.head_hash), signature: h.signature === null ? null : String(h.signature) };
+        const recRes = await c.query(`SELECT seq, op, identity_key, tool_name, digest, contract, meta_digest, subject, via, ref, at, prev_hash, record_hash
+         FROM mcplock.records WHERE tenant_id = $1 ORDER BY seq`, [this.#tenant]);
+        return { head, rows: recRes.rows.map(toRow) };
+    }
+    /** Verify the chain and fold it into a Lock. Throws LockError. */
+    async #fold(head, rows) {
+        if (head === null) {
+            if (rows.length > 0)
+                throw new LockError("lock-unreadable", "records without a head row");
+            if (this.#lastSeq > 0)
+                throw new LockError("lock-unreadable", `head missing; last accepted seq ${this.#lastSeq}`);
+            if (this.#verifier !== undefined)
+                throw new LockError("lock-signature-invalid", "no signed head");
+            const empty = Object.freeze({ shards: new FrozenMap([]), aliases: new FrozenMap([]), sequence: 0 });
+            return { lock: empty, snapshotId: GENESIS, seq: 0 };
+        }
+        let prev = GENESIS;
+        const shards = new Map();
+        rows.forEach((r, i) => {
+            if (r.seq !== i + 1)
+                throw new LockError("lock-unreadable", `record seq gap at ${i + 1}`);
+            if (r.prevHash !== prev)
+                throw new LockError("lock-unreadable", `record ${r.seq} does not chain`);
+            const { recordHash: stored, ...rest } = r;
+            if (recordHash(this.#tenant, rest) !== stored)
+                throw new LockError("lock-unreadable", `record ${r.seq} hash mismatch`);
+            prev = stored;
+            let identity;
+            try {
+                identity = validateIdentity(JSON.parse(r.identityKey));
+            }
+            catch (exc) {
+                if (exc instanceof LockError)
+                    throw exc;
+                throw new LockError("lock-unreadable", `record ${r.seq} identity is not JSON`);
+            }
+            if (identityKey(identity) !== r.identityKey)
+                throw new LockError("lock-unreadable", `record ${r.seq} identity key not canonical`);
+            let shard = shards.get(r.identityKey);
+            if (shard === undefined) {
+                shard = { identity, instructions: null, tools: new Map() };
+                shards.set(r.identityKey, shard);
+            }
+            if (r.op === "approve") {
+                if (r.digest === null)
+                    throw new LockError("lock-unreadable", `record ${r.seq} approves without a digest`);
+                if (r.toolName === null) {
+                    shard.instructions = r.digest;
+                    return;
+                }
+                if (r.contract === null || "sha256:" + sha256Hex(r.contract) !== r.digest) {
+                    throw new LockError("contract-mismatch", `record ${r.seq} contract differs from digest`);
+                }
+                const approval = r.ref === null
+                    ? Object.freeze({ subject: r.subject, at: r.at, via: r.via })
+                    : Object.freeze({ subject: r.subject, at: r.at, via: r.via, ref: r.ref });
+                if (r.metaDigest !== null && !/^sha256:[0-9a-f]{64}$/.test(r.metaDigest)) {
+                    throw new LockError("lock-unreadable", `record ${r.seq} metaDigest malformed`);
+                }
+                const contract = `sha256-${r.digest.slice(7)}.json`;
+                shard.tools.set(r.toolName, r.metaDigest === null
+                    ? Object.freeze({ digest: r.digest, contract, approval })
+                    : Object.freeze({ digest: r.digest, contract, metaDigest: r.metaDigest, approval }));
+            }
+            else if (r.toolName === null) {
+                shard.instructions = null;
+            }
+            else {
+                shard.tools.delete(r.toolName);
+            }
+        });
+        const lastSeq = rows.length;
+        if (head.seq !== lastSeq || head.hash !== prev)
+            throw new LockError("lock-unreadable", "head does not match the last record");
+        if (head.seq < this.#lastSeq)
+            throw new LockError("lock-unreadable", `head seq ${head.seq} < last accepted ${this.#lastSeq}`);
+        if (this.#verifier !== undefined) {
+            let ok = false;
+            try {
+                ok = head.signature !== null && (await this.#verifier.verify(headPayload(this.#tenant, head.seq, head.hash), head.signature));
+            }
+            catch {
+                ok = false;
+            }
+            if (!ok)
+                throw new LockError("lock-signature-invalid", "head signature missing or invalid");
+        }
+        const frozen = new Map();
+        for (const [key, s] of shards) {
+            frozen.set(key, Object.freeze({ identity: s.identity, attributes: null, instructions: s.instructions, tools: new FrozenMap(s.tools) }));
+        }
+        const lock = Object.freeze({ shards: new FrozenMap(frozen), aliases: new FrozenMap([]), sequence: head.seq });
+        return { lock, snapshotId: head.hash, seq: head.seq };
+    }
+    async loadSnapshot() {
+        const loadedAt = this.#now();
+        if (this.#verifier !== undefined && this.#sequences === undefined) {
+            return snapshotOfError(new LockError("lock-signature-invalid", "a head verifier is configured but the host config names no sequence store; rollback cannot be refused"), loadedAt);
+        }
+        let stored = null;
+        try {
+            stored = this.#sequences?.read() ?? null;
+        }
+        catch (exc) {
+            return snapshotOfError(new LockError("lock-signature-invalid", exc.message ?? "sequence unreadable"), loadedAt);
+        }
+        this.#lastSeq = sequenceFloor(stored, this.#lastSeq) ?? 0;
+        const state = await this.#tx("read", (c) => this.#readState(c, false));
+        try {
+            const { lock, snapshotId, seq } = await this.#fold(state.head, state.rows);
+            if (seq > this.#lastSeq) {
+                this.#lastSeq = seq;
+                try {
+                    this.#sequences?.write(seq);
+                }
+                catch {
+                    // The in-memory floor still holds; see FileLockStore.loadSnapshot.
+                }
+            }
+            return Object.freeze({ snapshotId, loadedAt, lock });
+        }
+        catch (exc) {
+            if (exc instanceof LockError)
+                return snapshotOfError(exc, loadedAt);
+            throw exc;
+        }
+    }
+    async #append(identity, record, precondition) {
+        const ident = validateIdentity(identity);
+        const key = identityKey(ident);
+        await this.#tx("write", async (c) => {
+            await c.query("INSERT INTO mcplock.heads (tenant_id, seq, head_hash) VALUES ($1, 0, $2) ON CONFLICT (tenant_id) DO NOTHING", [this.#tenant, GENESIS]);
+            const state = await this.#readState(c, true);
+            // Never extend a chain that does not verify. A fresh head row has seq 0
+            // and no records; fold accepts that as empty only without a verifier, so
+            // treat it as empty here directly.
+            const fresh = state.head !== null && state.head.seq === 0 && state.rows.length === 0;
+            const folded = fresh
+                ? { lock: Object.freeze({ shards: new FrozenMap([]), aliases: new FrozenMap([]), sequence: 0 }), seq: 0 }
+                : await this.#fold(state.head, state.rows);
+            precondition(folded.lock);
+            const prevHash = fresh ? GENESIS : state.head.hash;
+            const seq = folded.seq + 1;
+            const row = {
+                seq,
+                op: record.op,
+                identityKey: key,
+                toolName: record.toolName,
+                digest: record.digest,
+                contract: record.contract,
+                metaDigest: record.metaDigest,
+                subject: record.approval.subject,
+                via: record.approval.via,
+                ref: record.approval.ref ?? null,
+                at: record.approval.at,
+                prevHash,
+            };
+            const hash = recordHash(this.#tenant, row);
+            await c.query(`INSERT INTO mcplock.records
+           (tenant_id, seq, op, identity_key, tool_name, digest, contract, meta_digest, subject, via, ref, at, prev_hash, record_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`, [
+                this.#tenant,
+                seq,
+                row.op,
+                key,
+                row.toolName,
+                row.digest,
+                row.contract,
+                row.metaDigest,
+                row.subject,
+                row.via,
+                row.ref,
+                row.at,
+                prevHash,
+                hash,
+            ]);
+            const signature = this.#signer ? await this.#signer.sign(headPayload(this.#tenant, seq, hash)) : null;
+            await c.query("UPDATE mcplock.heads SET seq = $2, head_hash = $3, signature = $4, updated_at = now() WHERE tenant_id = $1", [this.#tenant, seq, hash, signature]);
+        });
+    }
+    async approve(request) {
+        // The subject is the authenticated principal, whatever the request says.
+        const approval = checkApprovalFields(request, this.#subject);
+        if ("tool" in request) {
+            const p = prepareTool(request.tool);
+            await this.#append(request.identity, { op: "approve", toolName: p.name, digest: p.digest, contract: p.body, metaDigest: p.metaDigest, approval }, () => undefined);
+            return;
+        }
+        const digest = instructionsDigest(request.instructions);
+        if (digest === null)
+            throw new Error("instructions have no digest; they cannot be approved");
+        await this.#append(request.identity, { op: "approve", toolName: null, digest, contract: null, metaDigest: null, approval }, () => undefined);
+    }
+    async revoke(request) {
+        const ident = validateIdentity(request.identity);
+        const key = identityKey(ident);
+        const approval = checkApprovalFields({ identity: ident, via: "api" }, this.#subject);
+        const toolName = "tool" in request ? request.tool : null;
+        await this.#append(ident, { op: "revoke", toolName, digest: null, contract: null, metaDigest: null, approval }, (lock) => {
+            const shard = lock.shards.get(key);
+            if (shard === undefined)
+                throw new Error("no approvals for this identity");
+            if (toolName === null ? shard.instructions === null : !shard.tools.has(toolName)) {
+                throw new Error(toolName === null ? "instructions are not approved" : `tool ${JSON.stringify(toolName)} is not approved`);
+            }
+        });
+    }
+}
+//# sourceMappingURL=pg.js.map

package/dist/src/lock/pg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg.js","sourceRoot":"","sources":["../../../src/lock/pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AA+B9F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,CAAC,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAElD,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;CAcvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwB7B,CAAC;AAIF,kFAAkF;AAClF,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG;SACP,OAAO,CAAC,oCAAoC,EAAE,QAAQ,CAAC;SACvD,OAAO,CAAC,yDAAyD,EAAE,OAAO,CAAC;SAC3E,OAAO,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,KAAK,CAAC,OAAe,EAAE,GAAuB;IACrD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,GAAG;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,gBAAwB,EAAE,QAAiC,EAAE;IAC9F,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAkH,CAAC;IACjJ,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzD,qEAAqE;IACrE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAkBtC,SAAS,UAAU,CAAC,MAAc,EAAE,CAAgC;IAClE,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,MAAM,GAA4B;QACtC,MAAM;QACN,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,IAAI,EAAE,CAAC,CAAC,QAAQ;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5D,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,CAAC;IACF,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;QAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW,EAAE,IAAY;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,GAA4B;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QACpB,EAAE,EAAE,GAAG,CAAC,EAAqB;QAC7B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACrC,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/D,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACvD,QAAQ,EAAE,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAsB,CAAC;QAClG,UAAU,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACtG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAC5B,GAAG,EAAE,GAAG,CAAC,GAAU;QACnB,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9C,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACpC,CAAC;AACJ,CAAC;AAgCD,MAAM,OAAO,WAAW;IACb,KAAK,CAAa;IAClB,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,OAAO,CAAyB;IAChC,SAAS,CAA2B;IACpC,IAAI,CAAqB;IACzB,IAAI,CAAe;IACnB,QAAQ,CAAY;IACpB,UAAU,CAA4B;IAC/C,QAAQ,GAAG,CAAC,CAAC;IAEb,YAAY,OAA2B;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9G,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;QAChD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAsB,EAAE,EAAmC;QACtE,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAE,GAAa,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;YAC/H,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;gBAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBACvH,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,GAAG,YAAY,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,GAA0B,CAAC,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,CAAe,EAAE,SAAkB;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,CAC3B,2EAA2E,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAC3G,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;QACF,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GACR,CAAC,KAAK,SAAS;YACb,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACtH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,CAC1B;gEAC0D,EAC1D,CAAC,IAAI,CAAC,OAAO,CAAC,CACf,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;IAChD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,IAAiB;QAC9C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,4BAA4B,CAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,mCAAmC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClH,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;YAClG,MAAM,KAAK,GAAS,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,SAAS,CAAgB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,SAAS,CAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8F,CAAC;QACrH,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACpB,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC;YAClG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC;YACvH,IAAI,GAAG,MAAM,CAAC;YACd,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,SAAS;oBAAE,MAAM,GAAG,CAAC;gBACxC,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW;gBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,6BAA6B,CAAC,CAAC;YAClI,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,KAAK,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;gBAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;oBAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC;gBAC3G,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACxB,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1E,MAAM,IAAI,SAAS,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,GAAG,+BAA+B,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,QAAQ,GACZ,CAAC,CAAC,GAAG,KAAK,IAAI;oBACZ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;oBAC7D,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9E,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC;gBACjF,CAAC;gBACD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;gBACpD,KAAK,CAAC,KAAK,CAAC,GAAG,CACb,CAAC,CAAC,QAAQ,EACV,CAAC,CAAC,UAAU,KAAK,IAAI;oBACnB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBACzD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CACtF,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC/B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAC;QAC9H,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,iBAAiB,EAAE,YAAY,IAAI,CAAC,GAAG,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9H,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,IAAI,CAAC;gBACH,EAAE,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAChI,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,KAAK,CAAC;YACb,CAAC;YACD,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,EAAE,mCAAmC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1I,CAAC;QACD,MAAM,IAAI,GAAS,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,SAAS,CAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACtI,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClE,OAAO,eAAe,CACpB,IAAI,SAAS,CACX,wBAAwB,EACxB,uGAAuG,CACxG,EACD,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,eAAe,CAAC,IAAI,SAAS,CAAC,wBAAwB,EAAG,GAAa,CAAC,OAAO,IAAI,qBAAqB,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;gBACpB,IAAI,CAAC;oBACH,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,mEAAmE;gBACrE,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,SAAS;gBAAE,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAkB,EAClB,MAOC,EACD,YAAkC;QAElC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAClC,MAAM,CAAC,CAAC,KAAK,CACX,6GAA6G,EAC7G,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CACxB,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7C,wEAAwE;YACxE,yEAAyE;YACzE,mCAAmC;YACnC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;YACrF,MAAM,MAAM,GAAG,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,SAAS,CAAgB,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,SAAS,CAAmB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAS,EAAE,GAAG,EAAE,CAAC,EAAE;gBAClJ,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,KAAK,CAAC,IAAa,CAAC,IAAI,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG;gBACV,GAAG;gBACH,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,WAAW,EAAE,GAAG;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;gBAChC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG;gBACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,IAAI;gBAChC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACtB,QAAQ;aACT,CAAC;YACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,CAAC,CAAC,KAAK,CACX;;8EAEsE,EACtE;gBACE,IAAI,CAAC,OAAO;gBACZ,GAAG;gBACH,GAAG,CAAC,EAAE;gBACN,GAAG;gBACH,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,MAAM;gBACV,GAAG,CAAC,QAAQ;gBACZ,GAAG,CAAC,UAAU;gBACd,GAAG,CAAC,OAAO;gBACX,GAAG,CAAC,GAAG;gBACP,GAAG,CAAC,GAAG;gBACP,GAAG,CAAC,EAAE;gBACN,QAAQ;gBACR,IAAI;aACL,CACF,CAAC;YACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtG,MAAM,CAAC,CAAC,KAAK,CACX,4GAA4G,EAC5G,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,yEAAyE;QACzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnK,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/I,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QACjC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;YACvH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC3E,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}