@nacre.work/core 0.0.0

package/dist/authz/resolve.js

@@ -0,0 +1,98 @@
+import { principalRef } from '../types.js';
+import { satisfies } from './permissions.js';
+/**
+ * Turn grants into the set of things the caller may reach.
+ *
+ * Where this differs from `reference.ts`: the reference answers "may they touch
+ * this one scope?", which is the question the rules are written in. A search
+ * needs the inverse — the whole permitted set, up front, so it can go into the
+ * query as a pre-filter. Computing it by asking the reference per document
+ * would be a post-filter with extra steps.
+ *
+ * The property-based test exists because these two are different algorithms
+ * answering the same question, and only one of them is obviously correct.
+ */
+export function resolve(input, permission) {
+    const { orgId, role, principals, grants, tree } = input;
+    // Rule 2, before anything else: platform_admin reads no documents.
+    if (role === 'platform_admin')
+        return { kind: 'none' };
+    // Rule 3, with rule 7 making admin cover read and write.
+    if (role === 'org_admin')
+        return { kind: 'all' };
+    // Rule 1 is a precondition. A grant from another tenant is discarded, not
+    // weighed. Rules 6 and 7 are entirely inside `satisfies`.
+    const applicable = grants.filter((g) => g.orgId === orgId &&
+        principals.has(principalRef(g.principal)) &&
+        satisfies(g.permission, permission));
+    const denied = { workspaces: new Set(), layers: new Set(), docs: new Set() };
+    const allowed = { workspaces: new Set(), layers: new Set(), docs: new Set() };
+    for (const g of applicable) {
+        const side = g.effect === 'deny' ? denied : allowed;
+        switch (g.scope.type) {
+            case 'workspace':
+                side.workspaces.add(g.scope.id);
+                break;
+            case 'layer':
+                side.layers.add(g.scope.id);
+                break;
+            case 'document':
+                side.docs.add(g.scope.id);
+                break;
+        }
+    }
+    // Rule 4 downward: a denied workspace denies each of its layers.
+    const deniedLayers = new Set(denied.layers);
+    for (const workspace of denied.workspaces) {
+        for (const layer of tree.layersOf(workspace))
+            deniedLayers.add(layer);
+    }
+    // Rule 5: subtract, never compare depth. A layer allowed explicitly under a
+    // denied workspace stays denied — "most specific wins" would allow it, and
+    // that is a different model from the one specified.
+    const layers = new Set();
+    for (const workspace of allowed.workspaces) {
+        for (const layer of tree.layersOf(workspace)) {
+            if (!deniedLayers.has(layer))
+                layers.add(layer);
+        }
+    }
+    for (const layer of allowed.layers) {
+        if (!deniedLayers.has(layer))
+            layers.add(layer);
+    }
+    // Document-scoped allows. The pseudocode in the specification subtracts only
+    // document-scoped denies here, which loses the truth-table row where a deny
+    // on the workspace beats an allow on a document beneath it. Ancestors are
+    // checked instead — see the note in docs/authz.md.
+    const extraDocs = new Set();
+    for (const doc of allowed.docs) {
+        if (denied.docs.has(doc))
+            continue;
+        const layer = tree.layerOf(doc);
+        // An unplaceable document cannot be checked against its ancestors, so it
+        // is denied. Rule I3: a permission that cannot be evaluated is refused.
+        if (layer === undefined)
+            continue;
+        if (deniedLayers.has(layer))
+            continue;
+        const workspace = tree.workspaceOf(layer);
+        if (workspace !== undefined && denied.workspaces.has(workspace))
+            continue;
+        if (layers.has(layer))
+            continue; // already covered by the layer grant
+        extraDocs.add(doc);
+    }
+    if (layers.size === 0 && extraDocs.size === 0)
+        return { kind: 'none' };
+    return {
+        kind: 'scoped',
+        layers: [...layers].sort(),
+        extraDocs: [...extraDocs].sort(),
+        // Kept even when the document sits outside every allowed layer: it costs
+        // one clause and it is the difference between "excluded" and "excluded
+        // unless someone later widens the layer set".
+        deniedDocs: [...denied.docs].sort(),
+    };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/authz/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../authz/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAiC5C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,KAAmB,EAAE,UAAsB;IACjE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IAEvD,mEAAmE;IACnE,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACtD,yDAAyD;IACzD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAEhD,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,KAAK,KAAK,KAAK;QACjB,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CACtC,CAAA;IAED,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,IAAI,EAAE,IAAI,GAAG,EAAU,EAAE,CAAA;IACpG,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,IAAI,GAAG,EAAU,EAAE,MAAM,EAAE,IAAI,GAAG,EAAU,EAAE,IAAI,EAAE,IAAI,GAAG,EAAU,EAAE,CAAA;IAErG,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QACnD,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,WAAW;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAK;YACxD,KAAK,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAK;YAChD,KAAK,UAAU;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAK;QACnD,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvE,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjD,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC/B,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAQ;QACzE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ,CAAC,qCAAqC;QACrE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAEtE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAC1B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE;QAChC,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;KACpC,CAAA;AACH,CAAC"}

package/dist/authz/scope-tree.d.ts

@@ -0,0 +1,52 @@
+import type { Scope } from '../types.js';
+/**
+ * A read-only view of the scope tree for one organization: workspace → layer →
+ * document.
+ *
+ * The resolver needs this to apply rules 4 and 5. Inheritance runs downward, so
+ * a grant on a workspace reaches its layers; deny beats allow at any depth, so
+ * an explicit allow on a document has to be checked against denies on its
+ * ancestors. Neither is decidable from the grants alone.
+ *
+ * Only documents named in a grant ever need placing, so `layerOf` is called a
+ * handful of times per query, not once per document in the index. Nothing here
+ * enumerates documents.
+ */
+export interface ScopeTree {
+    /** Layers directly under a workspace. Empty for an unknown workspace. */
+    layersOf(workspaceId: string): readonly string[];
+    /** The workspace a layer belongs to, or undefined if the layer is unknown. */
+    workspaceOf(layerId: string): string | undefined;
+    /** The layer a document belongs to, or undefined if the document is unknown. */
+    layerOf(documentId: string): string | undefined;
+}
+export interface ScopeTreeData {
+    /** workspace id → layer ids */
+    readonly layers: Readonly<Record<string, readonly string[]>>;
+    /** document id → layer id */
+    readonly documents: Readonly<Record<string, string>>;
+}
+/**
+ * In-memory tree, used by tests and by anything holding a small catalog.
+ *
+ * An unknown id resolves to undefined rather than throwing. That is not
+ * laziness: a grant can outlive the layer it referenced, and the resolver's
+ * behaviour for an unplaceable scope has to be *deny*, which reads more clearly
+ * as "we could not place it, so it grants nothing" than as an exception the
+ * caller might catch and continue past.
+ */
+export declare class MemoryScopeTree implements ScopeTree {
+    #private;
+    constructor(data: ScopeTreeData);
+    layersOf(workspaceId: string): readonly string[];
+    workspaceOf(layerId: string): string | undefined;
+    layerOf(documentId: string): string | undefined;
+}
+/**
+ * The chain from a scope up to the organization root, the scope itself first.
+ *
+ * Used to answer "is any ancestor of this denied?", which is what makes deny
+ * absolute rather than nearest-wins.
+ */
+export declare function ancestry(scope: Scope, tree: ScopeTree): readonly Scope[];
+//# sourceMappingURL=scope-tree.d.ts.map

package/dist/authz/scope-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-tree.d.ts","sourceRoot":"","sources":["../../authz/scope-tree.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IAChD,8EAA8E;IAC9E,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAChD,gFAAgF;IAChF,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAC5D,6BAA6B;IAC7B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACrD;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,YAAW,SAAS;;gBAKnC,IAAI,EAAE,aAAa;IAQ/B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE;IAIhD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIhD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAGhD;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,KAAK,EAAE,CAgBxE"}

package/dist/authz/scope-tree.js

@@ -0,0 +1,56 @@
+/**
+ * In-memory tree, used by tests and by anything holding a small catalog.
+ *
+ * An unknown id resolves to undefined rather than throwing. That is not
+ * laziness: a grant can outlive the layer it referenced, and the resolver's
+ * behaviour for an unplaceable scope has to be *deny*, which reads more clearly
+ * as "we could not place it, so it grants nothing" than as an exception the
+ * caller might catch and continue past.
+ */
+export class MemoryScopeTree {
+    #layersByWorkspace;
+    #workspaceByLayer = new Map();
+    #layerByDocument;
+    constructor(data) {
+        this.#layersByWorkspace = new Map(Object.entries(data.layers));
+        for (const [workspace, layers] of this.#layersByWorkspace) {
+            for (const layer of layers)
+                this.#workspaceByLayer.set(layer, workspace);
+        }
+        this.#layerByDocument = new Map(Object.entries(data.documents));
+    }
+    layersOf(workspaceId) {
+        return this.#layersByWorkspace.get(workspaceId) ?? [];
+    }
+    workspaceOf(layerId) {
+        return this.#workspaceByLayer.get(layerId);
+    }
+    layerOf(documentId) {
+        return this.#layerByDocument.get(documentId);
+    }
+}
+/**
+ * The chain from a scope up to the organization root, the scope itself first.
+ *
+ * Used to answer "is any ancestor of this denied?", which is what makes deny
+ * absolute rather than nearest-wins.
+ */
+export function ancestry(scope, tree) {
+    switch (scope.type) {
+        case 'workspace':
+            return [scope];
+        case 'layer': {
+            const workspace = tree.workspaceOf(scope.id);
+            return workspace === undefined
+                ? [scope]
+                : [scope, { type: 'workspace', id: workspace }];
+        }
+        case 'document': {
+            const layer = tree.layerOf(scope.id);
+            if (layer === undefined)
+                return [scope];
+            return [scope, ...ancestry({ type: 'layer', id: layer }, tree)];
+        }
+    }
+}
+//# sourceMappingURL=scope-tree.js.map

package/dist/authz/scope-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-tree.js","sourceRoot":"","sources":["../../authz/scope-tree.ts"],"names":[],"mappings":"AA+BA;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACjB,kBAAkB,CAAgC;IAClD,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,gBAAgB,CAAqB;IAE9C,YAAY,IAAmB;QAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC9D,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1D,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;IACvD,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAY,EAAE,IAAe;IACpD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACd,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC5C,OAAO,SAAS,KAAK,SAAS;gBAC5B,CAAC,CAAC,CAAC,KAAK,CAAC;gBACT,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QACnD,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACpC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACvC,OAAO,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/authz/store.d.ts

@@ -0,0 +1,50 @@
+import type { PoolClient } from 'pg';
+import type { Grant, PrincipalRef } from '../types.js';
+import type { GroupGraph } from './principals.js';
+import { type ScopeTree } from './scope-tree.js';
+/**
+ * Load the grants that could bear on a request.
+ *
+ * Deliberately *not* filtered by permission in SQL. `satisfies` decides which
+ * grants matter, and duplicating rules 6 and 7 into a `WHERE` clause would mean
+ * two places to keep in step — with the SQL one being the copy nobody tests
+ * against the truth table. The row count here is bounded by the caller's
+ * principals, not by the size of the index.
+ *
+ * The connection must already be scoped with `withOrg`, so RLS is a second
+ * bound on top of the explicit `org_id` below.
+ */
+export declare function loadGrants(client: PoolClient, orgId: string, principals: ReadonlySet<PrincipalRef>): Promise<readonly Grant[]>;
+/**
+ * Build the scope tree the resolver needs.
+ *
+ * Only the documents named in the grants are placed — the tree never
+ * enumerates the index. Deleted layers and documents are excluded, so a grant
+ * pointing at one becomes unplaceable and is therefore refused, which is the
+ * behaviour rule I3 asks for.
+ */
+export declare function loadScopeTree(client: PoolClient, orgId: string, documentIds: readonly string[]): Promise<ScopeTree>;
+/**
+ * Group membership, read straight from the join table.
+ *
+ * Nesting is resolved by `effectivePrincipals`, not here, and not in SQL. A
+ * recursive CTE would be faster and would also have to answer what to do about
+ * a cycle — `WITH RECURSIVE` needs a cycle clause or it does not terminate, and
+ * getting that wrong is a hung connection rather than a wrong answer. Keeping
+ * the traversal in one tested place is worth a second round trip.
+ */
+export declare class PostgresGroupGraph implements GroupGraph {
+    #private;
+    private constructor();
+    static load(client: PoolClient, orgId: string): Promise<PostgresGroupGraph>;
+    directGroups(principal: PrincipalRef): readonly string[];
+}
+/**
+ * The organization's current groups_version.
+ *
+ * Read in the same transaction as the grants, so the cache key and the grant
+ * set describe the same instant. Reading it separately would leave a window
+ * where the version says "fresh" about a set loaded before a change.
+ */
+export declare function loadGroupsVersion(client: PoolClient, orgId: string): Promise<number>;
+//# sourceMappingURL=store.d.ts.map

package/dist/authz/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../authz/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAA;AAEpC,OAAO,KAAK,EAAE,KAAK,EAAyB,YAAY,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,GACpC,OAAO,CAAC,SAAS,KAAK,EAAE,CAAC,CAsC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,SAAS,CAAC,CAsBpB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,YAAW,UAAU;;IAGnD,OAAO;WAIM,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAqBjF,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,SAAS,MAAM,EAAE;CAGzD;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY1F"}

package/dist/authz/store.js

@@ -0,0 +1,115 @@
+import { MemoryScopeTree } from './scope-tree.js';
+/**
+ * Load the grants that could bear on a request.
+ *
+ * Deliberately *not* filtered by permission in SQL. `satisfies` decides which
+ * grants matter, and duplicating rules 6 and 7 into a `WHERE` clause would mean
+ * two places to keep in step — with the SQL one being the copy nobody tests
+ * against the truth table. The row count here is bounded by the caller's
+ * principals, not by the size of the index.
+ *
+ * The connection must already be scoped with `withOrg`, so RLS is a second
+ * bound on top of the explicit `org_id` below.
+ */
+export async function loadGrants(client, orgId, principals) {
+    const refs = [...principals];
+    if (refs.length === 0)
+        return [];
+    // Split the `{type}:{id}` refs into parallel arrays so the query stays a
+    // single indexed lookup rather than a string comparison per row.
+    const types = [];
+    const ids = [];
+    for (const ref of refs) {
+        const sep = ref.indexOf(':');
+        types.push(ref.slice(0, sep));
+        ids.push(ref.slice(sep + 1));
+    }
+    const { rows } = await client.query(`SELECT principal_type, principal_id, scope_type, scope_id, permission, effect
+       FROM grants
+      WHERE org_id = $1
+        AND (principal_type, principal_id) IN (
+              SELECT * FROM unnest($2::text[], $3::uuid[])
+            )`, [orgId, types, ids]);
+    return rows.map((r) => ({
+        orgId,
+        principal: { type: r.principal_type, id: r.principal_id },
+        scope: { type: r.scope_type, id: r.scope_id },
+        permission: r.permission,
+        effect: r.effect,
+    }));
+}
+/**
+ * Build the scope tree the resolver needs.
+ *
+ * Only the documents named in the grants are placed — the tree never
+ * enumerates the index. Deleted layers and documents are excluded, so a grant
+ * pointing at one becomes unplaceable and is therefore refused, which is the
+ * behaviour rule I3 asks for.
+ */
+export async function loadScopeTree(client, orgId, documentIds) {
+    const { rows: layerRows } = await client.query(`SELECT id, workspace_id FROM layers WHERE org_id = $1 AND deleted_at IS NULL`, [orgId]);
+    const layers = {};
+    for (const row of layerRows) {
+        ;
+        (layers[row.workspace_id] ??= []).push(row.id);
+    }
+    const documents = {};
+    if (documentIds.length > 0) {
+        const { rows } = await client.query(`SELECT id, layer_id FROM documents
+        WHERE org_id = $1 AND deleted_at IS NULL AND id = ANY($2::uuid[])`, [orgId, [...documentIds]]);
+        for (const row of rows)
+            documents[row.id] = row.layer_id;
+    }
+    return new MemoryScopeTree({ layers, documents });
+}
+/**
+ * Group membership, read straight from the join table.
+ *
+ * Nesting is resolved by `effectivePrincipals`, not here, and not in SQL. A
+ * recursive CTE would be faster and would also have to answer what to do about
+ * a cycle — `WITH RECURSIVE` needs a cycle clause or it does not terminate, and
+ * getting that wrong is a hung connection rather than a wrong answer. Keeping
+ * the traversal in one tested place is worth a second round trip.
+ */
+export class PostgresGroupGraph {
+    #edges;
+    constructor(edges) {
+        this.#edges = edges;
+    }
+    static async load(client, orgId) {
+        const { rows } = await client.query(`SELECT group_id, member_user, member_group FROM group_members WHERE org_id = $1`, [orgId]);
+        const edges = new Map();
+        for (const row of rows) {
+            const member = row.member_user
+                ? `user:${row.member_user}`
+                : row.member_group
+                    ? `group:${row.member_group}`
+                    : null;
+            if (member === null)
+                continue;
+            (edges.get(member) ?? edges.set(member, []).get(member)).push(row.group_id);
+        }
+        return new PostgresGroupGraph(edges);
+    }
+    directGroups(principal) {
+        return this.#edges.get(principal) ?? [];
+    }
+}
+/**
+ * The organization's current groups_version.
+ *
+ * Read in the same transaction as the grants, so the cache key and the grant
+ * set describe the same instant. Reading it separately would leave a window
+ * where the version says "fresh" about a set loaded before a change.
+ */
+export async function loadGroupsVersion(client, orgId) {
+    const { rows } = await client.query('SELECT groups_version FROM organizations WHERE id = $1', [orgId]);
+    const value = rows[0]?.groups_version;
+    if (value === undefined) {
+        // No organization means no permissions to evaluate. Rule I3: deny rather
+        // than default, and a version of 0 is a key nothing else will collide with.
+        return 0;
+    }
+    return Number(value);
+}
+//# sourceMappingURL=store.js.map

package/dist/authz/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../authz/store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAkB,MAAM,iBAAiB,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAkB,EAClB,KAAa,EACb,UAAqC;IAErC,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAA;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEhC,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAQjC;;;;;cAKU,EACV,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CACpB,CAAA;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,KAAK;QACL,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE;QACzD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAkB,EAClB,KAAa,EACb,WAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5C,8EAA8E,EAC9E,CAAC,KAAK,CAAC,CACR,CAAA;IAED,MAAM,MAAM,GAA6B,EAAE,CAAA;IAC3C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,CAAC;QAAA,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAA;IAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;0EACoE,EACpE,CAAC,KAAK,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAC1B,CAAA;QACD,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAA;IAC1D,CAAC;IAED,OAAO,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAgC;IAE/C,YAAoB,KAAqC;QACvD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,KAAa;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAIhC,iFAAiF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QAE9F,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAA;QACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAwB,GAAG,CAAC,WAAW;gBACjD,CAAC,CAAC,QAAQ,GAAG,CAAC,WAAW,EAAE;gBAC3B,CAAC,CAAC,GAAG,CAAC,YAAY;oBAChB,CAAC,CAAC,SAAS,GAAG,CAAC,YAAY,EAAE;oBAC7B,CAAC,CAAC,IAAI,CAAA;YACV,IAAI,MAAM,KAAK,IAAI;gBAAE,SACpB;YAAA,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED,YAAY,CAAC,SAAuB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACzC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,KAAa;IACvE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,wDAAwD,EACxD,CAAC,KAAK,CAAC,CACR,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAA;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,yEAAyE;QACzE,4EAA4E;QAC5E,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC"}

package/dist/authz/tags.d.ts

@@ -0,0 +1,40 @@
+import type { PrincipalRef } from '../types.js';
+/**
+ * ACL tags: the denormalization described in docs/authz.md 3.6.
+ *
+ * Each indexed chunk carries hashes of the principals allowed to read it, so a
+ * filter can narrow on the payload instead of joining back to Postgres. The
+ * thing to keep in view is what it is *not*:
+ *
+ * **`acl_tags` is a cache. The `grants` table is the source of truth.** A grant
+ * change starts a background recomputation, and until it finishes the tags are
+ * stale. That is why the layer bound stays in every query rather than being
+ * "simplified" away once tags exist — see the collision note below.
+ */
+/** Bytes kept from each hash. The default matches `NACRE_ACL_TAG_HASH_BYTES`. */
+export declare const DEFAULT_TAG_BYTES = 8;
+/**
+ * Hash one principal reference into a tag.
+ *
+ * Truncation is deliberate and it does collide: 8 bytes over a large enough
+ * population will eventually produce two principals with the same tag, and a
+ * collision means a false tag match — a chunk appearing to be readable by
+ * someone it was not granted to.
+ *
+ * That is only safe because **the query is also bounded by the allowed
+ * `layer_id` list**. A colliding tag inside a layer the caller may already read
+ * changes nothing; a colliding tag in a layer they may not read never gets
+ * considered, because the layer bound excludes it first. Remove the layer bound
+ * and the truncation becomes a leak — which is the single most important thing
+ * to know before touching this file.
+ */
+export declare function principalTag(ref: PrincipalRef, bytes?: number): string;
+/**
+ * The tags for a set of principals, sorted so the payload is stable.
+ *
+ * Stability matters for the recomputation job: an unstable order makes every
+ * chunk look changed on every pass, and the propagation metric stops meaning
+ * anything.
+ */
+export declare function aclTags(principals: Iterable<PrincipalRef>, bytes?: number): readonly string[];
+//# sourceMappingURL=tags.d.ts.map

package/dist/authz/tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../authz/tags.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,IAAI,CAAA;AAElC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,GAAE,MAA0B,GAAG,MAAM,CAMzF;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CACrB,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,EAClC,KAAK,GAAE,MAA0B,GAChC,SAAS,MAAM,EAAE,CAEnB"}

package/dist/authz/tags.js

@@ -0,0 +1,48 @@
+import { createHash } from 'node:crypto';
+/**
+ * ACL tags: the denormalization described in docs/authz.md 3.6.
+ *
+ * Each indexed chunk carries hashes of the principals allowed to read it, so a
+ * filter can narrow on the payload instead of joining back to Postgres. The
+ * thing to keep in view is what it is *not*:
+ *
+ * **`acl_tags` is a cache. The `grants` table is the source of truth.** A grant
+ * change starts a background recomputation, and until it finishes the tags are
+ * stale. That is why the layer bound stays in every query rather than being
+ * "simplified" away once tags exist — see the collision note below.
+ */
+/** Bytes kept from each hash. The default matches `NACRE_ACL_TAG_HASH_BYTES`. */
+export const DEFAULT_TAG_BYTES = 8;
+/**
+ * Hash one principal reference into a tag.
+ *
+ * Truncation is deliberate and it does collide: 8 bytes over a large enough
+ * population will eventually produce two principals with the same tag, and a
+ * collision means a false tag match — a chunk appearing to be readable by
+ * someone it was not granted to.
+ *
+ * That is only safe because **the query is also bounded by the allowed
+ * `layer_id` list**. A colliding tag inside a layer the caller may already read
+ * changes nothing; a colliding tag in a layer they may not read never gets
+ * considered, because the layer bound excludes it first. Remove the layer bound
+ * and the truncation becomes a leak — which is the single most important thing
+ * to know before touching this file.
+ */
+export function principalTag(ref, bytes = DEFAULT_TAG_BYTES) {
+    if (bytes < 1 || bytes > 32) {
+        throw new Error(`tag width must be between 1 and 32 bytes, got ${bytes}`);
+    }
+    const digest = createHash('sha256').update(ref, 'utf8').digest();
+    return `h:${digest.subarray(0, bytes).toString('hex')}`;
+}
+/**
+ * The tags for a set of principals, sorted so the payload is stable.
+ *
+ * Stability matters for the recomputation job: an unstable order makes every
+ * chunk look changed on every pass, and the propagation metric stops meaning
+ * anything.
+ */
+export function aclTags(principals, bytes = DEFAULT_TAG_BYTES) {
+    return [...new Set([...principals].map((p) => principalTag(p, bytes)))].sort();
+}
+//# sourceMappingURL=tags.js.map

package/dist/authz/tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../authz/tags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAElC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,QAAgB,iBAAiB;IAC/E,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;IAChE,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CACrB,UAAkC,EAClC,QAAgB,iBAAiB;IAEjC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAChF,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Configuration, validated whole at startup.
+ *
+ * Two rules from docs/config.md, and both are about the same failure:
+ *
+ * **Validate everything at boot and exit if anything is missing or
+ * contradictory.** Not on first use. A service that starts and then fails the
+ * first request that needs the missing value looks healthy to an orchestrator,
+ * gets traffic, and reports the problem as an error rate.
+ *
+ * **No silent defaults for secrets or URLs.** A default that quietly points at
+ * localhost is how a production deployment ends up talking to nothing and
+ * reporting success. Defaults are fine for tunables — a cache TTL has an
+ * obviously right value — and never fine for anything naming a host or
+ * carrying a credential.
+ */
+export interface Config {
+    readonly env: 'development' | 'production';
+    readonly canonicalUrl: string;
+    readonly logLevel: string;
+    readonly logFormat: 'json' | 'text';
+    readonly pgUrl: string;
+    readonly pgPoolMax: number;
+    readonly qdrantUrl: string;
+    readonly qdrantApiKey: string | undefined;
+    readonly vectorTenancy: 'collection' | 'shared';
+    readonly redisUrl: string;
+    readonly embeddingEndpoint: string;
+    readonly embeddingModel: string;
+    readonly embeddingDim: number;
+    readonly parserEndpoint: string;
+    readonly rerankerEndpoint: string | undefined;
+    readonly rerankerEnabled: boolean;
+    readonly jwtIssuer: string;
+    readonly jwtAudience: string;
+    readonly accessTokenTtl: number;
+    readonly aclCacheTtl: number;
+    readonly aclPropagationSla: number;
+    readonly aclTagHashBytes: number;
+    /**
+     * How long a tombstoned document keeps its vectors before the sweep removes
+     * them. A tunable, so a default is fine — and it is not a correctness knob:
+     * invariant I5 is held by `deleted = false` in every query, not by this.
+     */
+    readonly gcGrace: number;
+    /**
+     * How long a claimed document may stay claimed before another worker may take
+     * it back. Must exceed the slowest legitimate indexing run, because a lease
+     * that expires while the work is still going produces two workers on one
+     * document — wasteful rather than wrong, since ingest is idempotent, but it
+     * is the wrong direction to be wrong in.
+     */
+    readonly indexLease: number;
+    /**
+     * Claims after which a document is failed instead of requeued. Bounded so a
+     * document that reliably kills the worker takes itself out of the queue
+     * rather than the queue out of service.
+     */
+    readonly indexMaxAttempts: number;
+    readonly rateSearchPerMin: number;
+    readonly rateIngestPerHour: number;
+    readonly maxDocumentBytes: number;
+    readonly auditRetentionDays: number;
+    readonly auditQueryText: boolean;
+}
+export declare class ConfigError extends Error {
+    readonly problems: readonly string[];
+    constructor(problems: readonly string[]);
+}
+type Env = Readonly<Record<string, string | undefined>>;
+export declare function loadConfig(env?: Env): Config;
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAE/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA8DvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAoFzD"}