@nacre.work/api 0.0.0

package/dist/server.js

@@ -0,0 +1,543 @@
+import { createServer } from 'node:http';
+import { randomUUID } from 'node:crypto';
+// Imported rather than taken from the global scope: `lib` is ES2023 with no
+// DOM, so the global URL is not typed here.
+import { URL } from 'node:url';
+import { authenticate, rejectTenantOverride } from './auth.js';
+import { badRequest, internal, notFound, Problem } from './errors.js';
+const MAX_BODY_BYTES = 1_000_000;
+const PRINCIPAL_TYPES = ['user', 'group', 'service_account'];
+const PERMISSIONS = ['read', 'write', 'admin'];
+function accountJson(a) {
+    return {
+        id: a.id,
+        name: a.name,
+        // Never the key. It exists in the create response and nowhere else.
+        key_prefix: a.keyPrefix,
+        created_at: a.createdAt,
+        last_used_at: a.lastUsedAt,
+        revoked_at: a.revokedAt,
+    };
+}
+function grantJson(g) {
+    return {
+        id: g.id,
+        principal_type: g.principalType,
+        principal_id: g.principalId,
+        scope_type: g.scopeType,
+        scope_id: g.scopeId,
+        permission: g.permission,
+        effect: g.effect,
+        source: g.source,
+    };
+}
+/**
+ * A grant body, or the reason it is not one.
+ *
+ * Two of the rejections here are the open/commercial boundary rather than
+ * validation. `docs/licensing.md` puts document-level ACLs and deny rules in
+ * the commercial half; the core is workspace- and layer-scoped allow-only RBAC.
+ * The resolver can already represent both — an enterprise resolver registered
+ * through `registerAuthzResolver` produces them — but the core must not issue
+ * what it does not implement the propagation for.
+ *
+ * `400` and not `404`: the caller is an administrator asking for a capability
+ * this build does not have, which is not a question about whether an object
+ * exists, so invariant I4 has no bearing and saying so plainly is right.
+ */
+function parseGrant(body) {
+    const principalType = body.principal_type;
+    const principalId = body.principal_id;
+    const scopeType = body.scope_type;
+    const scopeId = body.scope_id;
+    const permission = body.permission;
+    const effect = body.effect;
+    if (typeof principalId !== 'string' || typeof scopeId !== 'string') {
+        return "'principal_id' and 'scope_id' are required.";
+    }
+    if (typeof principalType !== 'string' || !PRINCIPAL_TYPES.includes(principalType)) {
+        return `'principal_type' must be one of ${PRINCIPAL_TYPES.join(', ')}.`;
+    }
+    if (typeof permission !== 'string' || !PERMISSIONS.includes(permission)) {
+        return `'permission' must be one of ${PERMISSIONS.join(', ')}.`;
+    }
+    if (scopeType === 'document') {
+        return 'Document-level grants are not available in this build. Grant on the layer or the workspace instead.';
+    }
+    if (scopeType !== 'workspace' && scopeType !== 'layer') {
+        return "'scope_type' must be 'workspace' or 'layer'.";
+    }
+    if (effect !== undefined && effect !== 'allow') {
+        return 'Deny rules are not available in this build. Grants are allow-only; remove the grant to revoke it.';
+    }
+    return {
+        principalType: principalType,
+        principalId,
+        scopeType,
+        scopeId,
+        permission: permission,
+    };
+}
+async function readBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY_BYTES)
+            throw new Error('body too large');
+        chunks.push(chunk);
+    }
+    if (chunks.length === 0)
+        return undefined;
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+function send(res, status, body, requestId) {
+    const json = JSON.stringify(body);
+    res.writeHead(status, {
+        'content-type': status >= 400 ? 'application/problem+json' : 'application/json',
+        'x-request-id': requestId,
+    });
+    res.end(json);
+}
+export function createApi(options) {
+    return createServer((req, res) => {
+        void handle(req, res, options).catch(() => {
+            // handle() converts everything it can into a Problem. Reaching here means
+            // the failure was in the error path itself; say nothing about it.
+            if (!res.headersSent)
+                send(res, 500, internal(req.url ?? '/', 'unknown').toJSON(), 'unknown');
+        });
+    });
+}
+async function handle(req, res, options) {
+    const requestId = randomUUID();
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const instance = url.pathname;
+    if (req.method === 'GET' && instance === '/metrics') {
+        // Unauthenticated, like every Prometheus endpoint, and therefore carrying
+        // nothing that is not already a count. No document ids, no query text, no
+        // organization ids — organizations appear by slug, which is in the URL of
+        // every request that tenant makes anyway.
+        if (options.metrics === undefined) {
+            const problem = notFound(instance, requestId);
+            send(res, problem.status, problem.toJSON(), requestId);
+            return;
+        }
+        const body = await options.metrics.render();
+        res.writeHead(200, { 'content-type': 'text/plain; version=0.0.4; charset=utf-8' });
+        res.end(body);
+        return;
+    }
+    if (req.method === 'GET' && instance === '/v1/health') {
+        // Liveness touches no dependency. A health check that calls Postgres turns
+        // one slow database into a cascading restart loop.
+        send(res, 200, { status: 'ok' }, requestId);
+        return;
+    }
+    const auth = await authenticate(req.headers.authorization, options.verify, instance, requestId);
+    if (auth instanceof Problem) {
+        send(res, auth.status, auth.toJSON(), requestId);
+        return;
+    }
+    let body;
+    try {
+        body = await readBody(req);
+    }
+    catch {
+        const problem = badRequest(instance, requestId, 'The request body could not be read.');
+        send(res, problem.status, problem.toJSON(), requestId);
+        return;
+    }
+    // T2. Before routing, before validation: a request that names an organization
+    // is not a malformed request, it is an attempt to act as another tenant.
+    const override = rejectTenantOverride(body, url.searchParams, req.headers, instance, requestId);
+    if (override !== undefined) {
+        await options.audit.write({
+            orgId: auth.orgId,
+            actor: `${auth.principal.type}:${auth.principal.id}`,
+            action: 'tenant_override_attempt',
+            result: 'deny',
+            detail: { path: instance },
+            requestId,
+        });
+        send(res, override.status, override.toJSON(), requestId);
+        return;
+    }
+    try {
+        if (req.method === 'POST' && instance === '/v1/search') {
+            const query = body?.query;
+            const topK = body?.top_k;
+            if (typeof query !== 'string' || query.length === 0) {
+                const problem = badRequest(instance, requestId, "'query' is required.");
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const results = await options.search.search(auth, query, typeof topK === 'number' ? topK : 10);
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'search',
+                result: 'allow',
+                detail: { returned: results.length },
+                requestId,
+            });
+            send(res, 200, { items: results }, requestId);
+            return;
+        }
+        if (req.method === 'POST' && instance === '/v1/documents') {
+            const body_ = (body ?? {});
+            const layer = body_.layer;
+            const externalId = body_.external_id;
+            const content = body_.content;
+            const url_ = body_.url;
+            if (typeof layer !== 'string' || typeof externalId !== 'string') {
+                const problem = badRequest(instance, requestId, "'layer' and 'external_id' are required.");
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            if ((typeof content === 'string') === (typeof url_ === 'string')) {
+                // Accepting both would mean choosing silently, and the choice would
+                // differ from whatever the caller assumed.
+                const problem = badRequest(instance, requestId, "Exactly one of 'content' or 'url' is required.");
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const outcome = await options.ingest.queue(auth, {
+                layer,
+                externalId,
+                ...(typeof body_.title === 'string' ? { title: body_.title } : {}),
+                ...(typeof content === 'string' ? { content } : {}),
+                ...(typeof url_ === 'string' ? { url: url_ } : {}),
+            });
+            if (outcome === undefined) {
+                // Not 403. A caller without write access must not learn which layers
+                // exist by seeing which ones refuse differently from which ones are
+                // absent.
+                await options.audit.write({
+                    orgId: auth.orgId,
+                    actor: `${auth.principal.type}:${auth.principal.id}`,
+                    action: 'ingest',
+                    result: 'deny',
+                    detail: { layer },
+                    requestId,
+                });
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'ingest',
+                result: 'allow',
+                detail: { document_id: outcome.documentId, unchanged: outcome.unchanged },
+                requestId,
+            });
+            // 200 for an idempotent repeat, 202 for work actually queued. The
+            // difference is what lets a client tell "already indexed" from "wait for
+            // the job" without polling to find out.
+            send(res, outcome.unchanged ? 200 : 202, { document_id: outcome.documentId, job_id: outcome.jobId, status: outcome.unchanged ? 'indexed' : 'queued' }, requestId);
+            return;
+        }
+        const documentMatch = /^\/v1\/documents\/([^/]+)$/.exec(instance);
+        if (req.method === 'DELETE' && documentMatch) {
+            const id = decodeURIComponent(documentMatch[1]);
+            const removed = await options.ingest.remove(auth, id);
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'delete_document',
+                result: removed ? 'allow' : 'deny',
+                detail: { document_id: id },
+                requestId,
+            });
+            if (!removed) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            res.writeHead(204, { 'x-request-id': requestId });
+            res.end();
+            return;
+        }
+        if (req.method === 'GET' && documentMatch) {
+            const id = decodeURIComponent(documentMatch[1]);
+            const document = await options.documents.read(auth, id);
+            if (document === undefined) {
+                // T8. The same response for "no such document" and "another
+                // organization's document". Same status, same body, one code path — two
+                // call sites with two messages is how the oracle comes back.
+                await options.audit.write({
+                    orgId: auth.orgId,
+                    actor: `${auth.principal.type}:${auth.principal.id}`,
+                    action: 'get_document',
+                    result: 'deny',
+                    detail: { document_id: id },
+                    requestId,
+                });
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'get_document',
+                result: 'allow',
+                detail: { document_id: id },
+                requestId,
+            });
+            send(res, 200, document, requestId);
+            return;
+        }
+        const jobMatch = /^\/v1\/jobs\/([^/]+)$/.exec(instance);
+        if (req.method === 'GET' && jobMatch && options.jobs !== undefined) {
+            const id = decodeURIComponent(jobMatch[1]);
+            const job = await options.jobs.read(auth, id);
+            if (job === undefined) {
+                // A job names a document, so it is as much of an oracle as the document
+                // is. Absent and another organization's answer identically.
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            send(res, 200, {
+                job_id: job.jobId,
+                document_id: job.documentId,
+                status: job.status,
+                progress: job.progress,
+                ...(job.error === undefined ? {} : { error: job.error }),
+            }, requestId);
+            return;
+        }
+        if (req.method === 'GET' && instance === '/v1/layers' && options.layers !== undefined) {
+            const layers = await options.layers.list(auth);
+            // No audit event: this returns what the caller may already read, and one
+            // event per listing buries the ones that matter.
+            send(res, 200, {
+                items: layers.map((l) => ({
+                    id: l.id,
+                    slug: l.slug,
+                    name: l.name,
+                    workspace_id: l.workspaceId,
+                    description: l.description,
+                    document_count: l.documentCount,
+                })),
+            }, requestId);
+            return;
+        }
+        if (req.method === 'POST' && instance === '/v1/layers' && options.layers !== undefined) {
+            const body_ = (body ?? {});
+            const workspaceId = body_.workspace_id;
+            const slug = body_.slug;
+            const name = body_.name;
+            if (typeof workspaceId !== 'string' || typeof slug !== 'string' || typeof name !== 'string') {
+                const problem = badRequest(instance, requestId, "'workspace_id', 'slug' and 'name' are required.");
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const outcome = await options.layers.create(auth, { workspaceId, slug, name });
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'create_layer',
+                result: outcome.kind === 'created' ? 'allow' : 'deny',
+                detail: { workspace_id: workspaceId, slug, outcome: outcome.kind },
+                requestId,
+            });
+            if (outcome.kind === 'denied') {
+                // 404, not 403. A caller who may not administer a workspace must not be
+                // able to tell it apart from one that does not exist.
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            if (outcome.kind === 'conflict') {
+                const problem = new Problem({
+                    type: 'https://nacre.work/errors/conflict',
+                    title: 'Conflict',
+                    status: 409,
+                    detail: `A layer with the slug '${slug}' already exists in this organization.`,
+                    instance,
+                    requestId,
+                });
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const created = outcome.layer;
+            send(res, 201, {
+                id: created.id,
+                slug: created.slug,
+                name: created.name,
+                workspace_id: created.workspaceId,
+                description: created.description,
+                document_count: created.documentCount,
+            }, requestId);
+            return;
+        }
+        if (req.method === 'GET' && instance === '/v1/grants' && options.grants !== undefined) {
+            const grants = await options.grants.list(auth);
+            send(res, 200, { items: grants.map(grantJson) }, requestId);
+            return;
+        }
+        if (req.method === 'POST' && instance === '/v1/grants' && options.grants !== undefined) {
+            const body_ = (body ?? {});
+            const parsed = parseGrant(body_);
+            if (typeof parsed === 'string') {
+                const problem = badRequest(instance, requestId, parsed);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const issued = await options.grants.issue(auth, parsed);
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'issue_grant',
+                result: issued === undefined ? 'deny' : 'allow',
+                detail: {
+                    principal: `${parsed.principalType}:${parsed.principalId}`,
+                    scope: `${parsed.scopeType}:${parsed.scopeId}`,
+                    permission: parsed.permission,
+                },
+                requestId,
+            });
+            if (issued === undefined) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            send(res, 201, grantJson(issued), requestId);
+            return;
+        }
+        const grantMatch = /^\/v1\/grants\/([^/]+)$/.exec(instance);
+        if (req.method === 'DELETE' && grantMatch && options.grants !== undefined) {
+            const id = decodeURIComponent(grantMatch[1]);
+            const revoked = await options.grants.revoke(auth, id);
+            // Written before the response either way. A revocation nobody can prove
+            // happened is not a revocation an auditor will accept, and a *refused*
+            // one is what an attempt to revoke someone else's grant looks like.
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'revoke_grant',
+                result: revoked ? 'allow' : 'deny',
+                detail: { grant_id: id },
+                requestId,
+            });
+            if (!revoked) {
+                // 404 for absent, for another organization's, and for one whose scope
+                // this caller cannot administer. Distinguishing them would let an
+                // administrator of one layer enumerate grants across the organization.
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            send(res, 204, null, requestId);
+            return;
+        }
+        if (instance === '/v1/service-accounts' && options.serviceAccounts !== undefined) {
+            // org_admin, not "admin on some scope". A service account is a principal
+            // in the organization rather than an object inside a workspace, and there
+            // is no scope to check it against — someone holding admin on one layer
+            // must not be able to mint credentials.
+            if (auth.role !== 'org_admin') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            if (req.method === 'GET') {
+                send(res, 200, { items: (await options.serviceAccounts.list(auth)).map(accountJson) }, requestId);
+                return;
+            }
+            if (req.method === 'POST') {
+                const name = (body ?? {}).name;
+                if (typeof name !== 'string' || name.trim().length === 0) {
+                    const problem = badRequest(instance, requestId, "'name' is required.");
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
+                const { account, key } = await options.serviceAccounts.create(auth, name.trim());
+                await options.audit.write({
+                    orgId: auth.orgId,
+                    actor: `${auth.principal.type}:${auth.principal.id}`,
+                    action: 'create_service_account',
+                    result: 'allow',
+                    // The prefix, never the key. This row is readable by anyone with the
+                    // audit log, and the key is not recoverable from anywhere else by
+                    // design — putting it here would undo that.
+                    detail: { service_account_id: account.id, key_prefix: account.keyPrefix },
+                    requestId,
+                });
+                // The only time the key exists outside the caller's process.
+                send(res, 201, { ...accountJson(account), key }, requestId);
+                return;
+            }
+        }
+        const accountMatch = /^\/v1\/service-accounts\/([^/]+)$/.exec(instance);
+        if (req.method === 'DELETE' && accountMatch && options.serviceAccounts !== undefined) {
+            if (auth.role !== 'org_admin') {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const id = decodeURIComponent(accountMatch[1]);
+            const revoked = await options.serviceAccounts.revoke(auth, id);
+            await options.audit.write({
+                orgId: auth.orgId,
+                actor: `${auth.principal.type}:${auth.principal.id}`,
+                action: 'revoke_service_account',
+                result: revoked ? 'allow' : 'deny',
+                detail: { service_account_id: id },
+                requestId,
+            });
+            if (!revoked) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            send(res, 204, null, requestId);
+            return;
+        }
+        const problem = notFound(instance, requestId);
+        send(res, problem.status, problem.toJSON(), requestId);
+    }
+    catch (error) {
+        // The 500 body says "whatever went wrong is in the journal under this
+        // request_id", and until this line nothing wrote it there: the error was
+        // discarded by a bare `catch`, and the audit row carried an empty detail.
+        // A caller reporting a 500 with a request id had nothing to be joined to.
+        //
+        // The message, not the request. A handler failure can carry a query string
+        // or a document body in its cause, and neither belongs in a log — see the
+        // list in CLAUDE.md. `String(error)` is the class and the message; the
+        // stack goes with it because that is what names the line.
+        console.error(JSON.stringify({
+            msg: 'request failed',
+            request_id: requestId,
+            method: req.method,
+            instance,
+            org_id: auth.orgId,
+            error: String(error).slice(0, 500),
+            stack: error instanceof Error ? error.stack?.split('\n').slice(0, 6).join('\n') : undefined,
+        }));
+        await options.audit
+            .write({
+            orgId: auth.orgId,
+            actor: `${auth.principal.type}:${auth.principal.id}`,
+            action: instance,
+            result: 'error',
+            // The class alone. An audit row is read by more people than a log line
+            // and is retained far longer, so it says what kind of failure it was
+            // and points at the log for the rest.
+            detail: { error: error instanceof Error ? error.name : 'unknown' },
+            requestId,
+        })
+            .catch((cause) => {
+            // Losing the audit row of a failed request is itself worth a line.
+            console.error(JSON.stringify({ msg: 'audit write failed', request_id: requestId, error: String(cause) }));
+        });
+        const problem = internal(instance, requestId);
+        send(res, problem.status, problem.toJSON(), requestId);
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,4EAA4E;AAC5E,4CAA4C;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAE9B,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAwC,MAAM,WAAW,CAAA;AACpG,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAuPrE,MAAM,cAAc,GAAG,SAAS,CAAA;AAEhC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AACrE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAA;AAEvD,SAAS,WAAW,CAAC,CAAqB;IACxC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,oEAAoE;QACpE,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,YAAY,EAAE,CAAC,CAAC,UAAU;QAC1B,UAAU,EAAE,CAAC,CAAC,SAAS;KACxB,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAc;IAC/B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,cAAc,EAAE,CAAC,CAAC,aAAa;QAC/B,YAAY,EAAE,CAAC,CAAC,WAAW;QAC3B,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,QAAQ,EAAE,CAAC,CAAC,OAAO;QACnB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,IAA6B;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAA;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAA;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAA;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAE1B,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,6CAA6C,CAAA;IACtD,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,aAAsB,CAAC,EAAE,CAAC;QAC3F,OAAO,mCAAmC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACzE,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAmB,CAAC,EAAE,CAAC;QACjF,OAAO,+BAA+B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACjE,CAAC;IACD,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO,qGAAqG,CAAA;IAC9G,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,8CAA8C,CAAA;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/C,OAAO,mGAAmG,CAAA;IAC5G,CAAC;IAED,OAAO;QACL,aAAa,EAAE,aAA4C;QAC3D,WAAW;QACX,SAAS;QACT,OAAO;QACP,UAAU,EAAE,UAAsC;KACnD,CAAA;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAoB;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAK,KAAgB,CAAC,MAAM,CAAA;QAChC,IAAI,IAAI,GAAG,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa,EAAE,SAAiB;IACjF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,kBAAkB;QAC/E,cAAc,EAAE,SAAS;KAC1B,CAAC,CAAA;IACF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAmB;IAC3C,OAAO,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACxC,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;QAC/F,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,OAAmB;IAClF,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IAE7B,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QACpD,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;YAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;QAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0CAA0C,EAAE,CAAC,CAAA;QAClF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACb,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACtD,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;QAC3C,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC/F,IAAI,IAAI,YAAY,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,qCAAqC,CAAC,CAAA;QACtF,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;QACtD,OAAM;IACR,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC/F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;YACpD,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,SAAS;SACV,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;QACxD,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACvD,MAAM,KAAK,GAAI,IAAwC,EAAE,KAAK,CAAA;YAC9D,MAAM,IAAI,GAAI,IAAwC,EAAE,KAAK,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAA;gBACvE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC9F,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE;gBACpC,SAAS;aACV,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAA;YAC7C,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;YACzB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAA;YACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAA;YAEtB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAChE,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,yCAAyC,CAAC,CAAA;gBAC1F,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YACD,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACjE,oEAAoE;gBACpE,2CAA2C;gBAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,gDAAgD,CAAC,CAAA;gBACjG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC/C,KAAK;gBACL,UAAU;gBACV,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAA;YAEF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,qEAAqE;gBACrE,oEAAoE;gBACpE,UAAU;gBACV,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;oBACpD,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,EAAE,KAAK,EAAE;oBACjB,SAAS;iBACV,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;gBACzE,SAAS;aACV,CAAC,CAAA;YAEF,kEAAkE;YAClE,yEAAyE;YACzE,wCAAwC;YACxC,IAAI,CACF,GAAG,EACH,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAC7B,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC5G,SAAS,CACV,CAAA;YACD,OAAM;QACR,CAAC;QAED,MAAM,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAW,CAAC,CAAA;YACzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAErD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAClC,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBAC3B,SAAS;aACV,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,aAAa,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAW,CAAC,CAAA;YACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,4DAA4D;gBAC5D,wEAAwE;gBACxE,6DAA6D;gBAC7D,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;oBACpD,MAAM,EAAE,cAAc;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;oBAC3B,SAAS;iBACV,CAAC,CAAA;gBACF,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;gBAC3B,SAAS;aACV,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;YACnC,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAW,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAE7C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,wEAAwE;gBACxE,4DAA4D;gBAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,CACF,GAAG,EACH,GAAG,EACH;gBACE,MAAM,EAAE,GAAG,CAAC,KAAK;gBACjB,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;aACzD,EACD,SAAS,CACV,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,CACF,GAAG,EACH,GAAG,EACH;gBACE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,YAAY,EAAE,CAAC,CAAC,WAAW;oBAC3B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,cAAc,EAAE,CAAC,CAAC,aAAa;iBAChC,CAAC,CAAC;aACJ,EACD,SAAS,CACV,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;YACrD,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAA;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;YAEvB,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5F,MAAM,OAAO,GAAG,UAAU,CACxB,QAAQ,EACR,SAAS,EACT,iDAAiD,CAClD,CAAA;gBACD,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAE9E,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBACrD,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;gBAClE,SAAS;aACV,CAAC,CAAA;YAEF,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,wEAAwE;gBACxE,sDAAsD;gBACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;oBAC1B,IAAI,EAAE,oCAAoC;oBAC1C,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,0BAA0B,IAAI,wCAAwC;oBAC9E,QAAQ;oBACR,SAAS;iBACV,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAA;YAC7B,IAAI,CACF,GAAG,EACH,GAAG,EACH;gBACE,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,aAAa;aACtC,EACD,SAAS,CACV,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC9C,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvF,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAA;YACrD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAEhC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;gBACvD,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAEvD,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;gBAC/C,MAAM,EAAE;oBACN,SAAS,EAAE,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE;oBAC1D,KAAK,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE;oBAC9C,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;gBACD,SAAS;aACV,CAAC,CAAA;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAC5C,OAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3D,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAW,CAAC,CAAA;YACtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAErD,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAClC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACxB,SAAS;aACV,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,sEAAsE;gBACtE,kEAAkE;gBAClE,uEAAuE;gBACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,sBAAsB,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACjF,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,wCAAwC;YACxC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;gBACjG,OAAM;YACR,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAI,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC,IAAI,CAAA;gBAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAA;oBACtE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;oBACtD,OAAM;gBACR,CAAC;gBAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;gBAEhF,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;oBACpD,MAAM,EAAE,wBAAwB;oBAChC,MAAM,EAAE,OAAO;oBACf,qEAAqE;oBACrE,kEAAkE;oBAClE,4CAA4C;oBAC5C,MAAM,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE;oBACzE,SAAS;iBACV,CAAC,CAAA;gBAEF,6DAA6D;gBAC7D,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvE,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,YAAY,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACrF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,MAAM,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAW,CAAC,CAAA;YACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAE9D,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;gBACpD,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBAClC,MAAM,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE;gBAClC,SAAS;aACV,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;gBACtD,OAAM;YACR,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,gBAAgB;YACrB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAClC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC,CACH,CAAA;QAED,MAAM,OAAO,CAAC,KAAK;aAChB,KAAK,CAAC;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;YACpD,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,OAAO;YACf,uEAAuE;YACvE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE;YAClE,SAAS;SACV,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,mEAAmE;YACnE,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC3F,CAAA;QACH,CAAC,CAAC,CAAA;QAEJ,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7C,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;AACH,CAAC"}

package/dist/service-keys.d.ts

@@ -0,0 +1,82 @@
+import type { Pool } from 'pg';
+import type { AuthContext } from './auth.js';
+/**
+ * Service account keys.
+ *
+ * The one credential in the system meant to outlive a session. `init` issues a
+ * token that expires in an hour, which is right for getting through the
+ * quickstart and useless for an agent that runs for a week — until this
+ * existed, `NACRE_SERVICE_KEY` had nothing to put in it.
+ *
+ * The shape is not invented here: migration 0001 gave `service_accounts` a
+ * `key_hash`, a `key_prefix`, and a `revoked_at`, which is an opaque key stored
+ * hashed and looked up by a non-secret prefix. This implements that.
+ *
+ * A key is shown once, at creation, and never again. Storing anything
+ * reversible would make a database backup a set of live credentials, and the
+ * whole point of `key_hash` is that a stolen dump is not one.
+ */
+/** Identifies the credential type on sight, in a log or a pasted variable. */
+export declare const KEY_PREFIX = "nacre_sk_";
+/**
+ * The lookup prefix: the marker plus the first 8 characters of the secret.
+ *
+ * Long enough that the indexed lookup returns one row in practice, short enough
+ * that it is not a meaningful head start — 8 base64url characters is 48 bits,
+ * against a 256-bit secret. It is stored in clear and shown in listings on
+ * purpose: an operator revoking a key needs to tell two apart, and the whole
+ * key is gone.
+ */
+export declare function prefixOf(key: string): string;
+export declare function hashOf(key: string): string;
+/** 32 bytes from the CSPRNG. Not a UUID — those are not secrets. */
+export declare function generateKey(): string;
+export declare const looksLikeServiceKey: (value: string) => boolean;
+export interface ServiceKeyResolver {
+    /** The caller this key belongs to, or undefined for every kind of failure. */
+    resolve(key: string): Promise<AuthContext | undefined>;
+}
+/**
+ * Resolve a key against the database.
+ *
+ * Undefined for unknown, revoked, malformed and wrong alike — the caller turns
+ * all of them into the same 401 a bad JWT gets, so which one it was cannot be
+ * read off the response.
+ */
+export declare class PostgresServiceKeys implements ServiceKeyResolver {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    resolve(key: string): Promise<AuthContext | undefined>;
+}
+export interface ServiceAccount {
+    readonly id: string;
+    readonly name: string;
+    readonly keyPrefix: string;
+    readonly createdAt: string;
+    readonly lastUsedAt: string | null;
+    readonly revokedAt: string | null;
+}
+export interface ServiceAccounts {
+    list(auth: AuthContext): Promise<readonly ServiceAccount[]>;
+    /** The key is in the result and nowhere else, ever again. */
+    create(auth: AuthContext, name: string): Promise<{
+        account: ServiceAccount;
+        key: string;
+    }>;
+    /** False when it does not exist in this organization, or is already revoked. */
+    revoke(auth: AuthContext, id: string): Promise<boolean>;
+}
+export declare class PostgresServiceAccounts implements ServiceAccounts {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    list(auth: AuthContext): Promise<readonly ServiceAccount[]>;
+    create(auth: AuthContext, name: string): Promise<{
+        account: ServiceAccount;
+        key: string;
+    }>;
+    revoke(auth: AuthContext, id: string): Promise<boolean>;
+}
+//# sourceMappingURL=service-keys.d.ts.map