@nacre.work/api 0.0.0

package/dist/__tests__/service-keys.test.js

@@ -0,0 +1,204 @@
+import { createPool } from '@nacre.work/core';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { authenticate } from '../auth.js';
+import { Problem } from '../errors.js';
+import { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from '../service-keys.js';
+/**
+ * Service account keys.
+ *
+ * The one credential meant to outlive a session, and therefore the one whose
+ * failures are worth being paranoid about: a key that survives revocation, a
+ * key that authenticates into the wrong organization, or a key recoverable from
+ * the database are each worse than anything the token path can do, because a
+ * token expires on its own and this does not.
+ */
+const url = process.env.NACRE_PG_URL;
+if (!url && process.env.CI) {
+    throw new Error('NACRE_PG_URL is not set and CI is; the service key path would go untested.');
+}
+const when = url ? describe : describe.skip;
+const ORG = 'cccccccc-cccc-cccc-cccc-cccccccccccc';
+const OTHER = 'dddddddd-dddd-dddd-dddd-dddddddddddd';
+const admin = { orgId: ORG, principal: { type: 'user', id: 'u1' }, role: 'org_admin' };
+let pool;
+let accounts;
+let keys;
+describe('key shape', () => {
+    it('a key is opaque, prefixed, and not a UUID', () => {
+        const key = generateKey();
+        expect(key.startsWith(KEY_PREFIX)).toBe(true);
+        expect(looksLikeServiceKey(key)).toBe(true);
+        // 32 bytes from the CSPRNG. A UUID is 122 bits of which several are fixed,
+        // and it is routinely treated as an identifier rather than a secret.
+        expect(key.length).toBeGreaterThan(KEY_PREFIX.length + 40);
+    });
+    it('two keys never collide', () => {
+        const many = new Set(Array.from({ length: 500 }, () => generateKey()));
+        expect(many.size).toBe(500);
+    });
+    it('the stored prefix is not enough to reconstruct the key', () => {
+        const key = generateKey();
+        expect(prefixOf(key).length).toBe(KEY_PREFIX.length + 8);
+        expect(key.startsWith(prefixOf(key))).toBe(true);
+        expect(prefixOf(key).length).toBeLessThan(key.length / 2);
+    });
+    it('the hash is not the key', () => {
+        const key = generateKey();
+        expect(hashOf(key)).not.toContain(key.slice(KEY_PREFIX.length));
+        expect(hashOf(key)).toBe(hashOf(key));
+        expect(hashOf(key)).not.toBe(hashOf(generateKey()));
+    });
+});
+when('service accounts, against the database', () => {
+    beforeAll(async () => {
+        pool = createPool({ connectionString: url });
+        accounts = new PostgresServiceAccounts(pool, 'nacre_app');
+        keys = new PostgresServiceKeys(pool, 'nacre_app');
+        const c = await pool.connect();
+        try {
+            for (const [id, slug] of [
+                [ORG, 'keysone'],
+                [OTHER, 'keystwo'],
+            ]) {
+                await c.query(
+                // slug is citext and name is text; one parameter cannot feed both.
+                `INSERT INTO organizations (id, slug, name, vector_collection)
+           VALUES ($1,$2,$3,$4) ON CONFLICT DO NOTHING`, [id, slug, slug, `org_${slug}`]);
+            }
+            await c.query(`DELETE FROM service_accounts WHERE org_id IN ($1,$2)`, [ORG, OTHER]);
+        }
+        finally {
+            c.release();
+        }
+    });
+    afterAll(async () => {
+        await pool?.end();
+    });
+    it('a new key authenticates as its own organization, as a member', async () => {
+        const { key, account } = await accounts.create(admin, 'agent');
+        const resolved = await keys.resolve(key);
+        expect(resolved?.orgId).toBe(ORG);
+        expect(resolved?.principal).toEqual({ type: 'service_account', id: account.id });
+        // Never an admin by virtue of being a service account. Everything it can
+        // reach comes from a grant — which is what "permissions are exactly the
+        // service account's" has to mean if it means anything.
+        expect(resolved?.role).toBe('member');
+    });
+    it('the key is never readable again', async () => {
+        const { key, account } = await accounts.create(admin, 'agent-2');
+        const listed = (await accounts.list(admin)).find((a) => a.id === account.id);
+        expect(listed).toBeDefined();
+        expect(JSON.stringify(listed)).not.toContain(key.slice(KEY_PREFIX.length));
+        // The prefix is shown so two keys can be told apart when revoking one.
+        expect(listed?.keyPrefix).toBe(prefixOf(key));
+    });
+    it('a revoked key stops working immediately', async () => {
+        const { key, account } = await accounts.create(admin, 'agent-3');
+        expect(await keys.resolve(key)).toBeDefined();
+        expect(await accounts.revoke(admin, account.id)).toBe(true);
+        // No TTL, no propagation window, nothing to wait for. Unlike a token, this
+        // credential has no expiry of its own, so revocation is the only thing that
+        // ever ends it.
+        expect(await keys.resolve(key)).toBeUndefined();
+    });
+    it('revoking twice is not an error the second time, it is a no', async () => {
+        const { account } = await accounts.create(admin, 'agent-4');
+        expect(await accounts.revoke(admin, account.id)).toBe(true);
+        expect(await accounts.revoke(admin, account.id)).toBe(false);
+    });
+    it('a revoked key is still listed, and says when', async () => {
+        const { account } = await accounts.create(admin, 'agent-5');
+        await accounts.revoke(admin, account.id);
+        const listed = (await accounts.list(admin)).find((a) => a.id === account.id);
+        // A key that vanishes on revocation looks like one that never existed, and
+        // the audit log refers to this id — a row that disappears turns every past
+        // event into an unresolvable reference.
+        expect(listed?.revokedAt).not.toBeNull();
+    });
+    it('another organization cannot revoke this one’s key', async () => {
+        const { key, account } = await accounts.create(admin, 'agent-6');
+        const intruder = { ...admin, orgId: OTHER };
+        expect(await accounts.revoke(intruder, account.id)).toBe(false);
+        expect(await keys.resolve(key), 'the key must still work').toBeDefined();
+    });
+    it('another organization does not see this one’s keys', async () => {
+        await accounts.create(admin, 'agent-7');
+        const theirs = await accounts.list({ ...admin, orgId: OTHER });
+        expect(theirs.every((a) => a.name !== 'agent-7')).toBe(true);
+    });
+    it('a key that does not exist, and a mangled one, resolve to nothing', async () => {
+        const { key } = await accounts.create(admin, 'agent-8');
+        for (const bad of [
+            generateKey(),
+            `${key}x`,
+            key.slice(0, -1),
+            `${prefixOf(key)}${'A'.repeat(43)}`,
+            'nacre_sk_',
+            'not-a-key',
+        ]) {
+            expect(await keys.resolve(bad), bad.slice(0, 20)).toBeUndefined();
+        }
+    });
+    it('a key with the right prefix and the wrong secret is refused', async () => {
+        const { key } = await accounts.create(admin, 'agent-9');
+        // The prefix is the indexed lookup, not the credential. If the hash
+        // comparison were ever dropped, every one of these would authenticate as
+        // the real account — and the prefix is stored in clear and shown in
+        // listings, so it is not a secret to begin with.
+        const forged = `${prefixOf(key)}${'B'.repeat(key.length - prefixOf(key).length)}`;
+        expect(forged.startsWith(prefixOf(key))).toBe(true);
+        expect(await keys.resolve(forged)).toBeUndefined();
+    });
+    it('authenticate() answers a bad key exactly as it answers a bad token', async () => {
+        const verify = {
+            key: new TextEncoder().encode('a'.repeat(32)),
+            issuer: 'https://api.nacre.test',
+            audience: 'nacre',
+            serviceKeys: keys,
+        };
+        const badKey = await authenticate(`Bearer ${generateKey()}`, verify, '/v1/search', 'r1');
+        const badToken = await authenticate('Bearer not-a-token', verify, '/v1/search', 'r1');
+        expect(badKey).toBeInstanceOf(Problem);
+        expect(badToken).toBeInstanceOf(Problem);
+        // "Revoked key", "unknown key" and "expired token" are one answer. Telling
+        // them apart says which guess was closest, and a key is guessable in a way
+        // a signature is not.
+        expect(badKey.toJSON()).toEqual(badToken.toJSON());
+    });
+    it('authenticate() accepts a real key and carries its organization', async () => {
+        const { key, account } = await accounts.create(admin, 'agent-10');
+        const resolved = await authenticate(`Bearer ${key}`, {
+            key: new TextEncoder().encode('a'.repeat(32)),
+            issuer: 'https://api.nacre.test',
+            audience: 'nacre',
+            serviceKeys: keys,
+        }, '/v1/search', 'r1');
+        expect(resolved).not.toBeInstanceOf(Problem);
+        const context = resolved;
+        expect(context.orgId).toBe(ORG);
+        // The account it names, not just some account in the right organization.
+        // Every grant is keyed on this id, so resolving to the wrong one would
+        // hand the caller another service account's permissions.
+        expect(context.principal).toEqual({ type: 'service_account', id: account.id });
+    });
+    it('a surface with no resolver refuses keys rather than ignoring the prefix', async () => {
+        const { key } = await accounts.create(admin, 'agent-11');
+        const result = await authenticate(`Bearer ${key}`, {
+            key: new TextEncoder().encode('a'.repeat(32)),
+            issuer: 'https://api.nacre.test',
+            audience: 'nacre',
+        }, '/v1/search', 'r1');
+        // Falling through to the JWT path would try to verify an opaque string as a
+        // signed token. That fails today, but it fails for the wrong reason, and
+        // "this credential type is not served here" should not depend on that.
+        expect(result).toBeInstanceOf(Problem);
+    });
+    it('using a key records when, without touching the decision', async () => {
+        const { key, account } = await accounts.create(admin, 'agent-12');
+        expect((await accounts.list(admin)).find((a) => a.id === account.id)?.lastUsedAt).toBeNull();
+        expect(await keys.resolve(key)).toBeDefined();
+        await new Promise((r) => setTimeout(r, 50));
+        expect((await accounts.list(admin)).find((a) => a.id === account.id)?.lastUsedAt).not.toBeNull();
+    });
+});
+//# sourceMappingURL=service-keys.test.js.map

package/dist/__tests__/service-keys.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-keys.test.js","sourceRoot":"","sources":["../../src/__tests__/service-keys.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,oBAAoB,CAAA;AAE3B;;;;;;;;GAQG;AAEH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;AACpC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC3B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;AAC/F,CAAC;AACD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;AAE3C,MAAM,GAAG,GAAG,sCAAsC,CAAA;AAClD,MAAM,KAAK,GAAG,sCAAsC,CAAA;AAEpD,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAA;AAExG,IAAI,IAAU,CAAA;AACd,IAAI,QAAiC,CAAA;AACrC,IAAI,IAAyB,CAAA;AAE7B,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;IAClD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,GAAa,EAAE,CAAC,CAAA;QACtD,QAAQ,GAAG,IAAI,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACzD,IAAI,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAEjD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QAC9B,IAAI,CAAC;YACH,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI;gBACvB,CAAC,GAAG,EAAE,SAAS,CAAC;gBAChB,CAAC,KAAK,EAAE,SAAS,CAAC;aACV,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC,KAAK;gBACX,mEAAmE;gBACnE;uDAC6C,EAC7C,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,CAChC,CAAA;YACH,CAAC;YACD,MAAM,CAAC,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QACrF,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,OAAO,EAAE,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,IAAI,EAAE,GAAG,EAAE,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAE9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACxC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAChF,yEAAyE;QACzE,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1E,uEAAuE;QACvE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAE7C,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE3D,2EAA2E;QAC3E,4EAA4E;QAC5E,gBAAgB;QAChB,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC3D,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;QAExC,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAE3C,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEvD,KAAK,MAAM,GAAG,IAAI;YAChB,WAAW,EAAE;YACb,GAAG,GAAG,GAAG;YACT,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChB,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;YACnC,WAAW;YACX,WAAW;SACZ,EAAE,CAAC;YACF,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QACnE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEvD,oEAAoE;QACpE,yEAAyE;QACzE,oEAAoE;QACpE,iDAAiD;QACjD,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAA;QACjF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,GAAG;YACb,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;SAClB,CAAA;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,UAAU,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;QACxF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,oBAAoB,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;QAErF,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QACxC,2EAA2E;QAC3E,2EAA2E;QAC3E,sBAAsB;QACtB,MAAM,CAAE,MAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAE,QAAoB,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,UAAU,GAAG,EAAE,EACf;YACE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;SAClB,EACD,YAAY,EACZ,IAAI,CACL,CAAA;QAED,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,QAAsE,CAAA;QACtF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/B,yEAAyE;QACzE,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,UAAU,GAAG,EAAE,EACf;YACE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,OAAO;SAClB,EACD,YAAY,EACZ,IAAI,CACL,CAAA;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QACjE,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QAE5F,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAE3C,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/adapters.d.ts

@@ -0,0 +1,197 @@
+import { aclTags, buildFilter, VectorStore } from '@nacre.work/core';
+import type { Pool } from 'pg';
+import type { AuditEvent, AuditSink, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, DocumentView, Layers, SearchHit, SearchService } from './server.js';
+import type { AuthContext } from './auth.js';
+/**
+ * The adapters that put the permission model on the request path.
+ *
+ * `NacreSearchService` is the one to read. Every step between a token and a
+ * result is here, in order, and none of them can be skipped by a caller —
+ * there is no method that takes a filter, and no method that takes an
+ * organization.
+ */
+export interface Embedder {
+    embed(texts: readonly string[]): Promise<readonly (readonly number[])[]>;
+}
+export declare class PostgresDocuments implements Documents {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    /**
+     * Undefined for absent, for another organization's, and for one this caller
+     * has no grant reaching — one answer for all three.
+     *
+     * The query is scoped three ways on purpose: `withOrg` sets the row-level
+     * security context, `org_id` is named in the WHERE clause anyway, and the
+     * plan decides whether the layer it landed in is reachable. Any one alone
+     * would do for tenancy; only the third does anything about permissions
+     * inside a tenant, and it is the one that was missing.
+     */
+    read(auth: AuthContext, documentId: string): Promise<DocumentView | undefined>;
+}
+export interface SearchDeps {
+    readonly pool: Pool;
+    readonly vectors: VectorStore;
+    readonly embedder: Embedder;
+    /** Resolved per organization; the collection name is derived from it. */
+    readonly orgSlug: (orgId: string) => Promise<string | undefined>;
+    readonly vectorName: string;
+    readonly role?: string;
+}
+export declare class NacreSearchService implements SearchService {
+    private readonly deps;
+    constructor(deps: SearchDeps);
+    search(auth: AuthContext, query: string, topK: number): Promise<readonly SearchHit[]>;
+    /**
+     * Turn hits into results a caller can read.
+     *
+     * The vector store holds no text — chunks live in Postgres, and the payload
+     * carries only what the filter needs. Returning the payload as the result,
+     * which is what happened before this existed, gave a caller identifiers and a
+     * score and nothing to show a user, and shipped `acl_tags` and `acl_version`
+     * along with it.
+     *
+     * This is a join and not a filter. The permitted set was decided inside the
+     * index traversal and is not narrowed here — with one exception, stated
+     * rather than left implicit: a chunk whose document has since been tombstoned
+     * in Postgres has no row to join to and does not appear. That is invariant I5
+     * enforced a second time on a different store, the same way row-level
+     * security backs up invariant I1, and it can only ever remove a document that
+     * is already meant to be gone.
+     *
+     * The order the index returned is kept. Postgres has no reason to preserve
+     * it, and re-sorting by anything else here would be a reranking step nobody
+     * asked for.
+     */
+    private hydrate;
+    /** Exposed so the filter can be inspected in tests without a vector store. */
+    static filterFor(orgId: string, plan: Parameters<typeof buildFilter>[1]): import("@nacre.work/core").VectorFilter;
+}
+/**
+ * The audit sink.
+ *
+ * Writes with the application role, which has INSERT and SELECT on
+ * `audit_events` and neither UPDATE nor DELETE — revoked at the database level
+ * by migration 0002, so a bug here cannot rewrite history and neither can
+ * anyone holding these credentials.
+ */
+export declare class PostgresAudit implements AuditSink {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    write(event: AuditEvent): Promise<void>;
+}
+/**
+ * An OpenAI-compatible embedding client.
+ *
+ * "Bring your own model" means this has to work against anything speaking that
+ * shape, so the only thing assumed is `POST /embeddings` returning
+ * `{ data: [{ embedding: number[] }] }`.
+ */
+export declare class HttpEmbedder implements Embedder {
+    private readonly endpoint;
+    private readonly model;
+    private readonly dimensions;
+    constructor(endpoint: string, model: string, dimensions: number);
+    embed(texts: readonly string[]): Promise<readonly (readonly number[])[]>;
+}
+export { aclTags };
+/**
+ * Queueing a document, with the write permission checked first.
+ *
+ * `write` is resolved, not `read`. Rule 6 is the whole reason this is a
+ * separate resolve: an ingest-only service account has `write` and no `read`,
+ * and a check that asked for `read` would refuse exactly the caller this
+ * endpoint exists for. Asking for `admin` would refuse them too.
+ */
+export interface IngestDeps {
+    readonly pool: Pool;
+    /**
+     * What takes a document out of results. Narrower than `VectorStore` on
+     * purpose: the delete path has no business searching, and a port that could
+     * would let a later change reach the index without a plan.
+     */
+    readonly tombstone: DocumentTombstone;
+    /** Resolved per organization; the collection name is derived from it. */
+    readonly orgSlug: (orgId: string) => Promise<string | undefined>;
+    readonly role?: string;
+}
+export interface DocumentTombstone {
+    tombstone(orgSlug: string, documentId: string): Promise<void>;
+}
+export declare class NacreIngest implements Ingest {
+    private readonly deps;
+    constructor(deps: IngestDeps);
+    private get pool();
+    private get scope();
+    /** The layers this caller may write to, by slug. */
+    private writableLayer;
+    queue(auth: AuthContext, request: IngestRequest): Promise<IngestOutcome | undefined>;
+    remove(auth: AuthContext, documentId: string): Promise<boolean>;
+}
+/**
+ * Ingest job status.
+ *
+ * The job id is the document id — ingest writes a row and the worker moves its
+ * status, so there is no separate job table to drift out of step with it. That
+ * also means the visibility rule is the document's: absent and another
+ * organization's answer identically.
+ */
+export declare class PostgresJobs implements Jobs {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    read(auth: AuthContext, jobId: string): Promise<Job | undefined>;
+}
+export declare class PostgresLayers implements Layers {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    /**
+     * The layers this caller may read.
+     *
+     * Narrowed by the plan in SQL rather than fetched and filtered afterwards.
+     * This is a listing rather than a search, so a post-filter here would not
+     * break invariant I2 — but writing it the other way keeps one habit for both
+     * and removes the question of which endpoints are allowed to be sloppy.
+     */
+    list(auth: AuthContext): Promise<readonly Layer[]>;
+    create(auth: AuthContext, input: {
+        workspaceId: string;
+        slug: string;
+        name: string;
+    }): Promise<LayerOutcome>;
+}
+export declare class PostgresGrants implements Grants {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    /**
+     * Every grant in the organization, for a caller who may administer it.
+     *
+     * Not narrowed to the caller's own grants. Someone who can issue a grant on a
+     * scope can already see who else holds one there, and a partial list is worse
+     * than none — an administrator who cannot see an existing grant revokes the
+     * wrong thing.
+     */
+    list(auth: AuthContext): Promise<readonly GrantRecord[]>;
+    issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
+    /**
+     * Withdraw a grant.
+     *
+     * A real DELETE, not an effect flip. Setting `effect = 'deny'` would look
+     * equivalent and is not: a deny is a commercial capability this build refuses
+     * to issue, and it beats an allow at any depth — so a "revocation" written
+     * that way would also suppress a grant the principal holds through a group or
+     * a parent scope. Removing the row leaves whatever else they were given.
+     *
+     * Admin on the grant's own scope, resolved from the row rather than from
+     * anything the caller sent. Reading the scope first and checking it after is
+     * the only order that works: the caller names an id, and the permission
+     * question is about what that id points at.
+     */
+    revoke(auth: AuthContext, grantId: string): Promise<boolean>;
+}
+//# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EAOX,WAAW,EAIZ,MAAM,kBAAkB,CAAA;AAGzB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACT,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACd,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAE5C;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;CACzE;AAED,qBAAa,iBAAkB,YAAW,SAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEvE;;;;;;;;;OASG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAwDrF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qBAAa,kBAAmB,YAAW,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAEvC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC;IAoD3F;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,OAAO;IAoDrB,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;CAGxE;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,YAAW,SAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAQ,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAlC,IAAI,EAAE,IAAI,EAAmB,IAAI,CAAC,EAAE,MAAM,YAAA;IAEjE,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAyB9C;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,QAAQ;IAEzC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM;IAG/B,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CAiC/E;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AAGlB;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAA;IACrC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D;AAED,qBAAa,WAAY,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,UAAU;IAE7C,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,KAAK,GAEhB;IAED,oDAAoD;YACtC,aAAa;IA6BrB,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAqDpF,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAoEtE;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,YAAW,IAAI;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;CA2DvE;AAiCD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC;IAkDlD,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GACzD,OAAO,CAAC,YAAY,CAAC;CAmFzB;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC;IA+CxD,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAoDnF;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAuCnE"}