@nacre.work/core 0.1.0 → 0.3.0

package/dist/audit.d.ts

@@ -0,0 +1,41 @@
+/**
+ * What the journal is allowed to say about a query.
+ *
+ * `docs/audit.md` is normative and says two things here. Neither was true:
+ *
+ *   > **Never:** document contents, chunk text, and — with
+ *   > `NACRE_AUDIT_QUERY_TEXT=false`, the default — full query text. A query
+ *   > hash is stored instead.
+ *
+ * There was no hash. The `detail` written for a search carried a count and
+ * nothing about the query at all, so the promise that a hash is "enough to
+ * investigate an incident" was a promise about a field that did not exist —
+ * and `NACRE_AUDIT_QUERY_TEXT` was validated at startup and read by nothing,
+ * so the deployments that had decided otherwise got the same nothing.
+ *
+ * ─── why the hash is unconditional and the text is not ───
+ *
+ * The hash answers the question an investigation actually asks — *did this
+ * agent run this query, and how often* — by comparing hashes, and it cannot
+ * leak what was searched for. The text answers a different question, is a
+ * decision with a compliance owner, and is the reason the flag exists.
+ *
+ * One function so the two surfaces cannot disagree. A search over MCP and the
+ * same search over REST must leave the same record; that they did not is what
+ * `nacre_acl_denials_total` and the rate limiter both had to be fixed for.
+ */
+export interface QueryAudit {
+    /** `sha256:` and hex, the same shape as `documents.content_hash`. */
+    readonly query_hash: string;
+    /** Present only where a deployment set `NACRE_AUDIT_QUERY_TEXT`. */
+    readonly query?: string;
+}
+/**
+ * Bounded, because the journal is not a place to put an unbounded caller
+ * string. A query longer than this is truncated in the record and still hashed
+ * whole — the hash is of what was asked, not of what was stored, or two records
+ * of the same long query would not match each other.
+ */
+export declare const MAX_AUDITED_QUERY = 1024;
+export declare function queryAudit(query: string, includeText: boolean): QueryAudit;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,UAAU;IACzB,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAA;AAErC,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,UAAU,CAO1E"}

package/dist/audit.js

@@ -0,0 +1,18 @@
+import { createHash } from 'node:crypto';
+/**
+ * Bounded, because the journal is not a place to put an unbounded caller
+ * string. A query longer than this is truncated in the record and still hashed
+ * whole — the hash is of what was asked, not of what was stored, or two records
+ * of the same long query would not match each other.
+ */
+export const MAX_AUDITED_QUERY = 1024;
+export function queryAudit(query, includeText) {
+    const hash = `sha256:${createHash('sha256').update(query, 'utf8').digest('hex')}`;
+    if (!includeText)
+        return { query_hash: hash };
+    return {
+        query_hash: hash,
+        query: query.length > MAX_AUDITED_QUERY ? `${query.slice(0, MAX_AUDITED_QUERY)}…` : query,
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAmCxC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAA;AAErC,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,WAAoB;IAC5D,MAAM,IAAI,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACjF,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IAC7C,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;KAC1F,CAAA;AACH,CAAC"}

package/dist/authz/cache.d.ts

@@ -23,6 +23,26 @@ export interface CacheStore {
     get(key: string): Promise<string | undefined>;
     set(key: string, value: string, ttlSeconds: number): Promise<void>;
 }
+/**
+ * The shared implementation, over the Redis this deployment already runs.
+ *
+ * Lives here rather than in `packages/api` because MCP needs the same one, and
+ * two processes caching effective principals under two different key schemes
+ * would give the two surfaces different answers for the same principal — which
+ * is the failure mode `NACRE_RATE_*` had before both surfaces shared a bucket.
+ *
+ * Every method swallows nothing: `cachedEffectivePrincipals` is what decides
+ * that a cache failure falls through to the graph, and it can only decide that
+ * if the failure reaches it.
+ */
+export declare class RedisCache implements CacheStore {
+    private readonly redis;
+    constructor(redis: {
+        command(...parts: string[]): Promise<string | number | null | unknown[]>;
+    });
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+}
 /** For a single process, and for tests. Redis is the shared implementation. */
 export declare class MemoryCache implements CacheStore {
     #private;

package/dist/authz/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE;AAED,+EAA+E;AAC/E,qBAAa,WAAY,YAAW,UAAU;;IAGtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAErG;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CA2BpC"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAuB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,UAAW,YAAW,UAAU;IAEzC,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE;QACtB,OAAO,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,CAAA;KACzE;IAGG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzE;AAED,+EAA+E;AAC/E,qBAAa,WAAY,YAAW,UAAU;;IAGtC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAErG;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GACnC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CA2BpC"}

package/dist/authz/cache.js

@@ -1,4 +1,33 @@
 import { effectivePrincipals } from './principals.js';
+/**
+ * The shared implementation, over the Redis this deployment already runs.
+ *
+ * Lives here rather than in `packages/api` because MCP needs the same one, and
+ * two processes caching effective principals under two different key schemes
+ * would give the two surfaces different answers for the same principal — which
+ * is the failure mode `NACRE_RATE_*` had before both surfaces shared a bucket.
+ *
+ * Every method swallows nothing: `cachedEffectivePrincipals` is what decides
+ * that a cache failure falls through to the graph, and it can only decide that
+ * if the failure reaches it.
+ */
+export class RedisCache {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    async get(key) {
+        const reply = await this.redis.command('GET', key);
+        return typeof reply === 'string' ? reply : undefined;
+    }
+    async set(key, value, ttlSeconds) {
+        // EX rather than a separate EXPIRE: two commands leave a window where a
+        // crash between them writes a key that never expires, and this key is
+        // per principal per version — the set of them that never expire is
+        // unbounded.
+        await this.redis.command('SET', key, value, 'EX', String(Math.max(1, Math.floor(ttlSeconds))));
+    }
+}
 /** For a single process, and for tests. Redis is the shared implementation. */
 export class MemoryCache {
     #entries = new Map();

package/dist/authz/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAmB,MAAM,iBAAiB,CAAA;AA2BtE,+EAA+E;AAC/E,MAAM,OAAO,WAAW;IACb,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAA;IAEzE,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAoB,EAAE,aAAqB;IAC3F,OAAO,kBAAkB,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,aAAa,EAAE,CAAA;AACtF,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,EAChC,KAAiB,EACjB,SAAoC;IAEpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAEvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,GAAG,CAAC,MAAwB,CAAC,CAAA;YAC1C,CAAC;YACD,yEAAyE;YACzE,oEAAoE;YACpE,kBAAkB;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,SAAS,EAAE,CAAC,CAAA;IAE5E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../authz/cache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAmB,MAAM,iBAAiB,CAAA;AA2BtE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAEF;IADnB,YACmB,KAEhB;QAFgB,UAAK,GAAL,KAAK,CAErB;IACA,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAClD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,aAAa;QACb,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAChG,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,OAAO,WAAW;IACb,QAAQ,GAAG,IAAI,GAAG,EAA8C,CAAA;IAEzE,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACzB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAkB;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAA;IAC5E,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAoB,EAAE,aAAqB;IAC3F,OAAO,kBAAkB,KAAK,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,KAAK,aAAa,EAAE,CAAA;AACtF,CAAC;AAUD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAgC,EAChC,KAAiB,EACjB,SAAoC;IAEpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IAEvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,GAAG,CAAC,MAAwB,CAAC,CAAA;YAC1C,CAAC;YACD,yEAAyE;YACzE,oEAAoE;YACpE,kBAAkB;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,SAAS,EAAE,CAAC,CAAA;IAE5E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/authz/index.d.ts

@@ -9,7 +9,6 @@ export { buildFilter, METADATA_PREFIX } from './filter.js';
 export type { FilterClause, MetadataValue, Narrowing, QueryablePlan, VectorFilter } from './filter.js';
 export { ancestry, MemoryScopeTree } from './scope-tree.js';
 export type { ScopeTree, ScopeTreeData } from './scope-tree.js';
-export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
-export { cachedEffectivePrincipals, MemoryCache, principalsCacheKey } from './cache.js';
+export { cachedEffectivePrincipals, MemoryCache, RedisCache, principalsCacheKey } from './cache.js';
 export type { CacheStore, CachedPrincipalsOptions } from './cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACvF,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAChD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC1D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACnG,YAAY,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA"}

package/dist/authz/index.js

@@ -4,6 +4,5 @@ export { resolve } from './resolve.js';
 export { referenceAllows } from './reference.js';
 export { buildFilter, METADATA_PREFIX } from './filter.js';
 export { ancestry, MemoryScopeTree } from './scope-tree.js';
-export { aclTags, principalTag, DEFAULT_TAG_BYTES } from './tags.js';
-export { cachedEffectivePrincipals, MemoryCache, principalsCacheKey } from './cache.js';
+export { cachedEffectivePrincipals, MemoryCache, RedisCache, principalsCacheKey } from './cache.js';
 //# sourceMappingURL=index.js.map

package/dist/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAEvE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA"}

package/dist/config.d.ts

@@ -14,6 +14,7 @@
  * obviously right value — and never fine for anything naming a host or
  * carrying a credential.
  */
+import { type KeyObject } from 'node:crypto';
 export interface Config {
     readonly env: 'development' | 'production';
     readonly canonicalUrl: string;
@@ -28,8 +29,16 @@ export interface Config {
      * ourselves would be worse than leaving it out.
      */
     readonly oauthAuthorizationServer: string;
-    readonly logLevel: string;
+    readonly logLevel: 'debug' | 'info' | 'warn' | 'error';
     readonly logFormat: 'json' | 'text';
+    /**
+     * Packages to import at startup so they can register extensions.
+     *
+     * Named rather than imported, because this repository's CI fails if its
+     * source mentions the commercial package at all — see `extensions.ts`. Empty
+     * is the default and is the whole open-core product.
+     */
+    readonly modules: readonly string[];
     readonly pgUrl: string;
     readonly pgPoolMax: number;
     readonly qdrantUrl: string;
@@ -48,8 +57,6 @@ export interface Config {
     readonly accessTokenTtl: number;
     readonly refreshTokenTtl: number;
     readonly aclCacheTtl: number;
-    readonly aclPropagationSla: number;
-    readonly aclTagHashBytes: number;
     /**
      * How long a tombstoned document keeps its vectors before the sweep removes
      * them. A tunable, so a default is fine — and it is not a correctness knob:
@@ -79,6 +86,34 @@ export interface Config {
     readonly maxDocumentBytes: number;
     readonly auditRetentionDays: number;
     readonly auditQueryText: boolean;
+    /** The reindex rollback window: how long a superseded collection survives. */
+    readonly collectionRetentionDays: number;
+    /**
+     * The recall a reindex must reach before its layer switches, as a fraction.
+     *
+     * Read from a whole-number percentage. Applies only to a layer that has a
+     * reference query set — there is no gate without one.
+     */
+    readonly reindexMinRecall: number;
+    /** How long a presigned link to a document's bytes stays valid. */
+    readonly presignTtl: number;
+    /**
+     * Object storage, or `undefined` when a deployment has none.
+     *
+     * Absent is a supported configuration and not a degraded one: document bytes
+     * then live in `documents.source_ref`, which is what every deployment did
+     * before this existed. What is *not* supported is half of it — see the
+     * cross-field check, and the reason it is a check rather than a set of
+     * independent optionals.
+     */
+    readonly s3: {
+        readonly endpoint: string;
+        readonly bucket: string;
+        readonly region: string;
+        readonly accessKey: string;
+        readonly secretKey: string;
+        readonly forcePathStyle: boolean;
+    } | undefined;
 }
 /**
  * The keys a token may be verified against, and the one it is signed with.
@@ -91,11 +126,103 @@ export interface Config {
  */
 export interface JwtKeys {
     /** Everything issued from now on is signed with this. */
-    readonly key: Uint8Array;
+    readonly signing: KeyObject | Uint8Array;
+    /**
+     * What a token is verified against.
+     *
+     * The same value as `signing` for a shared secret, and the **public half**
+     * for Ed25519 — which is the whole reason the asymmetric mode is worth
+     * having. A process that only verifies never needs the private key, so the
+     * blast radius of reading a container's environment stops at "can check
+     * tokens" instead of "can mint them".
+     */
+    readonly verification: KeyObject | Uint8Array;
     /** Accepted on verification, never used to sign. Empty outside a rotation. */
-    readonly alsoAccept: readonly Uint8Array[];
+    readonly alsoAccept: readonly (KeyObject | Uint8Array)[];
+    /**
+     * Pinned, and passed to `jwtVerify` rather than left to the token's header.
+     *
+     * A verifier that accepts whatever `alg` a token claims is the classic JWT
+     * mistake. `jose` already refuses the worst shapes — `none`, and an HMAC
+     * algorithm against an asymmetric `KeyObject` — but "the library happens to
+     * stop it" is not the same statement as "this deployment accepts exactly one
+     * algorithm", and only the second one survives a dependency upgrade.
+     */
+    readonly algorithm: 'HS256' | 'EdDSA';
+    /**
+     * The current key's `kid`, put in the header of every token this process
+     * signs so a JWKS consumer can select rather than try each. Absent for HMAC,
+     * where it would name nothing anyone could fetch.
+     */
+    readonly keyId?: string;
+    /**
+     * What `/.well-known/jwks.json` serves. Absent for HMAC.
+     *
+     * A shared secret has no publishable half, and serving one would be serving
+     * the signing key — so this is optional rather than always present, and the
+     * endpoint exists only when there is something safe to put in it.
+     *
+     * The retired key is in here too during a rotation, for the same reason it is
+     * still accepted: there are tokens in the wild signed with it, and a verifier
+     * outside this process has to be able to check them. Assembled here rather
+     * than by each caller, because a JWKS missing the previous key is a rotation
+     * that breaks every external verifier at the restart.
+     */
+    readonly jwks?: readonly Record<string, unknown>[];
 }
+/**
+ * What a process that only *verifies* tokens needs — the verification key, the
+ * keys still accepted during a rotation, and the one algorithm it will honour.
+ * No `signing`, no `jwks` to publish: a resource server such as the MCP
+ * transport checks tokens and never mints them, and `loadJwtVerification` lets
+ * it be configured with only the public half, so reading its environment gets
+ * an attacker to "can check tokens" and no further.
+ */
+export interface JwtVerification {
+    readonly verification: KeyObject | Uint8Array;
+    readonly alsoAccept: readonly (KeyObject | Uint8Array)[];
+    readonly algorithm: 'HS256' | 'EdDSA';
+}
+/**
+ * A short, non-reversible name for whichever key is in use, for a startup line.
+ *
+ * An operator needs to know *which* key a process loaded when two environments
+ * disagree — and nobody needs the key itself in a log. `api` and `mcp` each had
+ * their own copy of this, taking a `Uint8Array`; two copies of a function that
+ * hashes a secret is two chances for one of them to log the wrong thing.
+ *
+ * For an asymmetric key it is a digest of the **public** half, which means the
+ * value printed by a process holding the private key matches the one printed by
+ * a process holding only the public key. That is precisely the comparison this
+ * exists to let someone make.
+ */
+export declare function keyFingerprint(key: KeyObject | Uint8Array): string;
 export declare function loadJwtKeys(env?: NodeJS.ProcessEnv): JwtKeys;
+/**
+ * Verification-only key material, for a process that checks tokens and never
+ * signs one — the MCP transport, which is a resource server.
+ *
+ * Three ways to name the key, exactly one of them at a time:
+ *
+ * - `NACRE_JWT_PUBLIC_KEY_REF` — the Ed25519 **public** key, and nothing else.
+ *   This is the one that makes the asymmetric mode worth what it claims: the
+ *   verifier holds no secret and no private key, so an attacker who reads its
+ *   environment can check tokens and cannot mint them. `NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF`
+ *   is its rotation overlap, mirroring the private side.
+ * - `NACRE_JWT_PRIVATE_KEY_REF` — the private key, from which the public half is
+ *   derived. Accepted so a process co-located with the signer, or one that
+ *   simply has the private key, still verifies; it just does not get the
+ *   separation the public-only path does.
+ * - `NACRE_JWT_SECRET` — the shared secret. Verifying and signing are the same
+ *   key here by definition, so there is no separation to be had and the process
+ *   holds the secret regardless; this exists so a Compose deployment that runs
+ *   on a shared secret still starts.
+ *
+ * Setting more than one is refused, for the same reason `loadJwtKeys` refuses
+ * two answers to "what signs a token": whichever won, the others would be
+ * configured, apparently in use, and ignored.
+ */
+export declare function loadJwtVerification(env?: NodeJS.ProcessEnv): JwtVerification;
 export declare class ConfigError extends Error {
     readonly problems: readonly string[];
     constructor(problems: readonly string[]);

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAA;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAA;CAC3C;AAED,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA0CzE;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA+EvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CA2KzD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAA;AAI3F,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAAA;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAA;IAIzC,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAEnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IAEzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAEhC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IAExB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IAExC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,EACP;QACE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAA;KACjC,GACD,SAAS,CAAA;CACd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,CAAA;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,GAAG,UAAU,CAAA;IAC7C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACxD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CACnD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,GAAG,UAAU,CAAA;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAA;CACtC;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CASlE;AAmHD,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAkGzE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,CA0GzF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,QAAQ,EAAE,SAAS,MAAM,EAAE;CAQxC;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;AA0JvD,wBAAgB,UAAU,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CA8MzD"}