@nacre.work/core 0.1.0 → 0.3.0

package/dist/config.js

@@ -14,22 +14,218 @@
  * obviously right value — and never fine for anything naming a host or
  * carrying a credential.
  */
+import { createHash, createPrivateKey, createPublicKey } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** A stable identifier for a key, from its public bytes. Never from the secret. */
+function fingerprint(der) {
+    return createHash('sha256').update(der).digest('base64url').slice(0, 16);
+}
+/**
+ * One public key as a JWK.
+ *
+ * `kid` is derived from the public bytes rather than configured, so it is
+ * stable across restarts and identical in every process without anyone having
+ * to keep two settings in step.
+ */
+function publicJwk(key) {
+    const der = key.export({ type: 'spki', format: 'der' });
+    return {
+        ...key.export({ format: 'jwk' }),
+        kid: fingerprint(der),
+        use: 'sig',
+        alg: 'EdDSA',
+    };
+}
+/**
+ * A short, non-reversible name for whichever key is in use, for a startup line.
+ *
+ * An operator needs to know *which* key a process loaded when two environments
+ * disagree — and nobody needs the key itself in a log. `api` and `mcp` each had
+ * their own copy of this, taking a `Uint8Array`; two copies of a function that
+ * hashes a secret is two chances for one of them to log the wrong thing.
+ *
+ * For an asymmetric key it is a digest of the **public** half, which means the
+ * value printed by a process holding the private key matches the one printed by
+ * a process holding only the public key. That is precisely the comparison this
+ * exists to let someone make.
+ */
+export function keyFingerprint(key) {
+    if (key instanceof Uint8Array) {
+        return `sha256:${createHash('sha256').update(key).digest('hex').slice(0, 12)}`;
+    }
+    const der = (key.type === 'private' ? createPublicKey(key) : key).export({
+        type: 'spki',
+        format: 'der',
+    });
+    return `ed25519:${fingerprint(der)}`;
+}
+/**
+ * One Ed25519 key from a `file://` reference, plus its public half.
+ *
+ * `file://` only, and that is the whole of the scheme support. The variable is
+ * named `_REF` because `docs/config.md` requires secrets to be references into
+ * a secret store rather than values, and every platform that has one — Docker
+ * secrets, Kubernetes, systemd credentials — presents it as a file. A `vault://`
+ * or `aws-kms://` scheme would be a network client on the startup path, which
+ * is a different feature with different failure modes.
+ */
+/**
+ * Read the PEM a `file://` reference names. Shared by the private- and
+ * public-key loaders so the `file://`-only rule and its error wording live in
+ * one place; `kind` only changes the noun in the messages.
+ */
+function readPemRef(ref, variable, kind) {
+    let path;
+    try {
+        const url = new URL(ref);
+        if (url.protocol !== 'file:') {
+            throw new Error(`scheme ${url.protocol} is not supported`);
+        }
+        path = fileURLToPath(url);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} is not a file:// URL: ${String(cause)}. ` +
+                `It names a file holding a PEM ${kind} key, for example ` +
+                'file:///run/secrets/jwt_ed25519.',
+        ]);
+    }
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names ${path}, which cannot be read: ${String(cause)}.`,
+        ]);
+    }
+}
+/**
+ * The public half of an Ed25519 key, from a `file://` reference to a PEM public
+ * key. This is what a process that only *verifies* tokens needs — and all it
+ * needs, which is the point: reading its environment gets an attacker to "can
+ * check tokens" and no further. See `loadJwtVerification`.
+ */
+function loadEd25519Public(ref, variable) {
+    const pem = readPemRef(ref, variable, 'public');
+    // `createPublicKey` will happily extract the public half from a *private* PEM,
+    // which would let an operator paste the private key into the public-key
+    // variable and never notice — leaving the file this variable exists to keep
+    // off this process sitting right on it. Refuse it by name: the whole point of
+    // a verify-only process is that the private key is nowhere near it.
+    if (/PRIVATE KEY/.test(pem)) {
+        throw new ConfigError([
+            `${variable} names a file that contains a PRIVATE key. This variable is for ` +
+                'the public half only — a process that verifies must not be given the ' +
+                'signing key. Export the public half with ' +
+                '`openssl pkey -in jwt_ed25519.pem -pubout -out jwt_ed25519.pub`.',
+        ]);
+    }
+    let key;
+    try {
+        key = createPublicKey(pem);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names a file that is not a PEM public key: ${String(cause)}. ` +
+                'Export one from the signing key with ' +
+                '`openssl pkey -in jwt_ed25519.pem -pubout -out jwt_ed25519.pub`.',
+        ]);
+    }
+    if (key.asymmetricKeyType !== 'ed25519') {
+        throw new ConfigError([
+            `${variable} names a ${String(key.asymmetricKeyType)} public key. Only Ed25519 ` +
+                'is accepted — it must match the signing key, which is Ed25519.',
+        ]);
+    }
+    return key;
+}
+function loadEd25519(ref, variable) {
+    const pem = readPemRef(ref, variable, 'private');
+    let key;
+    try {
+        key = createPrivateKey(pem);
+    }
+    catch (cause) {
+        throw new ConfigError([
+            `${variable} names a file that is not a PEM private key: ${String(cause)}.`,
+        ]);
+    }
+    if (key.asymmetricKeyType !== 'ed25519') {
+        // One algorithm, refused rather than adapted. RSA needs a size check and a
+        // padding choice, and EC needs a curve-to-algorithm mapping — each a place
+        // to be wrong about something a token's signature depends on. Ed25519 has
+        // no parameters, and it is what `docs/config.md` has named in its example
+        // since the variable was written.
+        throw new ConfigError([
+            `${variable} names a ${String(key.asymmetricKeyType)} key. Only Ed25519 is ` +
+                'accepted: it has no parameters to get wrong, and it is what the example ' +
+                'in docs/config.md names. Generate one with ' +
+                '`openssl genpkey -algorithm ed25519 -out jwt_ed25519.pem`.',
+        ]);
+    }
+    return { private: key, public: createPublicKey(key) };
+}
 export function loadJwtKeys(env = process.env) {
-    // Development uses a symmetric secret. Production is meant to load an Ed25519
-    // key through NACRE_JWT_PRIVATE_KEY_REF; until that lands, refusing is the
-    // honest behaviour — a hardcoded fallback here would be a signing key anyone
-    // reading the source can forge tokens with.
     const secret = env.NACRE_JWT_SECRET;
+    const ref = env.NACRE_JWT_PRIVATE_KEY_REF;
+    if (secret !== undefined && secret !== '' && ref !== undefined && ref !== '') {
+        // Refused rather than resolved by precedence. Whichever one this picked, the
+        // other would be configured, apparently in use, and silently ignored — and
+        // the operator would find out when the tokens they expected to be Ed25519
+        // turned out to be HMAC, or the other way round.
+        throw new ConfigError([
+            'NACRE_JWT_SECRET and NACRE_JWT_PRIVATE_KEY_REF are both set. They are two ' +
+                'answers to "what signs a token" and there is no order of precedence ' +
+                'worth inventing. Set one.',
+        ]);
+    }
+    if (ref !== undefined && ref !== '') {
+        const current = loadEd25519(ref, 'NACRE_JWT_PRIVATE_KEY_REF');
+        const der = current.public.export({ type: 'spki', format: 'der' });
+        const previousRef = env.NACRE_JWT_PREVIOUS_KEY_REF;
+        const previous = previousRef === undefined || previousRef === ''
+            ? undefined
+            : loadEd25519(previousRef, 'NACRE_JWT_PREVIOUS_KEY_REF');
+        if (previous !== undefined &&
+            previous.public.export({ type: 'spki', format: 'der' }).equals(der)) {
+            // The same refusal the symmetric path makes, for the same reason: this is
+            // what an operator does when they mean to rotate and copy the wrong path,
+            // and it leaves an installation that believes it has rotated and has not.
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_KEY_REF names the same key as NACRE_JWT_PRIVATE_KEY_REF. ' +
+                    'That is not a rotation: it accepts one key twice. Point ' +
+                    'NACRE_JWT_PRIVATE_KEY_REF at the new key and NACRE_JWT_PREVIOUS_KEY_REF ' +
+                    'at the one it replaces.',
+            ]);
+        }
+        return {
+            signing: current.private,
+            verification: current.public,
+            alsoAccept: previous === undefined ? [] : [previous.public],
+            algorithm: 'EdDSA',
+            keyId: fingerprint(der),
+            jwks: [
+                publicJwk(current.public),
+                ...(previous === undefined ? [] : [publicJwk(previous.public)]),
+            ],
+        };
+    }
+    // A symmetric secret is still supported and is still the default. It is what
+    // a laptop and a Compose file want, and refusing it would make the asymmetric
+    // path mandatory for a product whose first run is `docker compose up`.
     if (secret === undefined || secret.length < 32) {
         throw new ConfigError([
             'NACRE_JWT_SECRET is not set, or is shorter than 32 bytes. ' +
-                'Asymmetric keys through NACRE_JWT_PRIVATE_KEY_REF are not implemented yet; ' +
-                'until they are, this is required and there is no default.',
+                'Set it, or point NACRE_JWT_PRIVATE_KEY_REF at an Ed25519 private key. ' +
+                'There is no default: a signing key in the source is one anybody reading ' +
+                'the source can forge tokens with.',
         ]);
     }
     const previous = env.NACRE_JWT_SECRET_PREVIOUS;
     if (previous === undefined || previous === '') {
-        return { key: new TextEncoder().encode(secret), alsoAccept: [] };
+        const key = new TextEncoder().encode(secret);
+        return { signing: key, verification: key, alsoAccept: [], algorithm: 'HS256' };
     }
     if (previous.length < 32) {
         throw new ConfigError([
@@ -48,9 +244,127 @@ export function loadJwtKeys(env = process.env) {
                 'new key and NACRE_JWT_SECRET_PREVIOUS to the one it replaces.',
         ]);
     }
+    const key = new TextEncoder().encode(secret);
     return {
-        key: new TextEncoder().encode(secret),
+        signing: key,
+        verification: key,
         alsoAccept: [new TextEncoder().encode(previous)],
+        algorithm: 'HS256',
+    };
+}
+/**
+ * Verification-only key material, for a process that checks tokens and never
+ * signs one — the MCP transport, which is a resource server.
+ *
+ * Three ways to name the key, exactly one of them at a time:
+ *
+ * - `NACRE_JWT_PUBLIC_KEY_REF` — the Ed25519 **public** key, and nothing else.
+ *   This is the one that makes the asymmetric mode worth what it claims: the
+ *   verifier holds no secret and no private key, so an attacker who reads its
+ *   environment can check tokens and cannot mint them. `NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF`
+ *   is its rotation overlap, mirroring the private side.
+ * - `NACRE_JWT_PRIVATE_KEY_REF` — the private key, from which the public half is
+ *   derived. Accepted so a process co-located with the signer, or one that
+ *   simply has the private key, still verifies; it just does not get the
+ *   separation the public-only path does.
+ * - `NACRE_JWT_SECRET` — the shared secret. Verifying and signing are the same
+ *   key here by definition, so there is no separation to be had and the process
+ *   holds the secret regardless; this exists so a Compose deployment that runs
+ *   on a shared secret still starts.
+ *
+ * Setting more than one is refused, for the same reason `loadJwtKeys` refuses
+ * two answers to "what signs a token": whichever won, the others would be
+ * configured, apparently in use, and ignored.
+ */
+export function loadJwtVerification(env = process.env) {
+    const secret = env.NACRE_JWT_SECRET;
+    const publicRef = env.NACRE_JWT_PUBLIC_KEY_REF;
+    const privateRef = env.NACRE_JWT_PRIVATE_KEY_REF;
+    const named = [
+        secret !== undefined && secret !== '' ? 'NACRE_JWT_SECRET' : undefined,
+        publicRef !== undefined && publicRef !== '' ? 'NACRE_JWT_PUBLIC_KEY_REF' : undefined,
+        privateRef !== undefined && privateRef !== '' ? 'NACRE_JWT_PRIVATE_KEY_REF' : undefined,
+    ].filter((v) => v !== undefined);
+    if (named.length > 1) {
+        throw new ConfigError([
+            `${named.join(' and ')} are set together. They are ${named.length} answers to ` +
+                '"what verifies a token" and there is no order of precedence worth ' +
+                'inventing. A resource server needs exactly one: the public key ' +
+                '(NACRE_JWT_PUBLIC_KEY_REF) if the deployment signs with Ed25519, or ' +
+                'NACRE_JWT_SECRET if it signs with a shared secret.',
+        ]);
+    }
+    const sameSpki = (a, b) => a
+        .export({ type: 'spki', format: 'der' })
+        .equals(b.export({ type: 'spki', format: 'der' }));
+    if (publicRef !== undefined && publicRef !== '') {
+        const current = loadEd25519Public(publicRef, 'NACRE_JWT_PUBLIC_KEY_REF');
+        const prevRef = env.NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF;
+        const previous = prevRef === undefined || prevRef === ''
+            ? undefined
+            : loadEd25519Public(prevRef, 'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF');
+        if (previous !== undefined && sameSpki(current, previous)) {
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF names the same key as ' +
+                    'NACRE_JWT_PUBLIC_KEY_REF. That is not a rotation: it accepts one key ' +
+                    'twice. Point NACRE_JWT_PUBLIC_KEY_REF at the new public key and ' +
+                    'NACRE_JWT_PREVIOUS_PUBLIC_KEY_REF at the one it replaces.',
+            ]);
+        }
+        return {
+            verification: current,
+            alsoAccept: previous === undefined ? [] : [previous],
+            algorithm: 'EdDSA',
+        };
+    }
+    if (privateRef !== undefined && privateRef !== '') {
+        const current = loadEd25519(privateRef, 'NACRE_JWT_PRIVATE_KEY_REF');
+        const prevRef = env.NACRE_JWT_PREVIOUS_KEY_REF;
+        const previous = prevRef === undefined || prevRef === ''
+            ? undefined
+            : loadEd25519(prevRef, 'NACRE_JWT_PREVIOUS_KEY_REF');
+        if (previous !== undefined && sameSpki(current.public, previous.public)) {
+            throw new ConfigError([
+                'NACRE_JWT_PREVIOUS_KEY_REF names the same key as NACRE_JWT_PRIVATE_KEY_REF. ' +
+                    'That is not a rotation: it accepts one key twice.',
+            ]);
+        }
+        return {
+            verification: current.public,
+            alsoAccept: previous === undefined ? [] : [previous.public],
+            algorithm: 'EdDSA',
+        };
+    }
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError([
+            'no verification key is set, or NACRE_JWT_SECRET is shorter than 32 bytes. ' +
+                'A resource server needs one of NACRE_JWT_PUBLIC_KEY_REF (Ed25519 public ' +
+                'key), NACRE_JWT_PRIVATE_KEY_REF, or NACRE_JWT_SECRET — matching how the ' +
+                'issuer signs.',
+        ]);
+    }
+    const previousSecret = env.NACRE_JWT_SECRET_PREVIOUS;
+    if (previousSecret !== undefined && previousSecret !== '') {
+        if (previousSecret.length < 32) {
+            throw new ConfigError([
+                'NACRE_JWT_SECRET_PREVIOUS is set but shorter than 32 bytes. It holds the ' +
+                    'key being rotated out and is held to the same floor as the one replacing it.',
+            ]);
+        }
+        if (previousSecret === secret) {
+            throw new ConfigError([
+                'NACRE_JWT_SECRET_PREVIOUS is the same value as NACRE_JWT_SECRET. That is ' +
+                    'not a rotation: it accepts one key twice.',
+            ]);
+        }
+    }
+    const key = new TextEncoder().encode(secret);
+    return {
+        verification: key,
+        alsoAccept: previousSecret === undefined || previousSecret === ''
+            ? []
+            : [new TextEncoder().encode(previousSecret)],
+        algorithm: 'HS256',
     };
 }
 export class ConfigError extends Error {
@@ -141,6 +455,73 @@ class Reader {
         return raw;
     }
 }
+/** The protocol, or an empty string when the value does not parse at all. */
+function safeProtocol(url) {
+    try {
+        return new URL(url).protocol;
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * The object-storage block, present only when a deployment configured one.
+ *
+ * Written as a group because it *is* one. Six independent optionals would
+ * accept an endpoint with no credential, or a credential with no bucket, and
+ * every one of those parses — the failure arrives later, as an ingest that
+ * cannot store bytes, on a deployment whose configuration looked accepted.
+ *
+ * `NACRE_S3_*` spent its whole life in `docs/config.md` and in the `full`
+ * Compose profile without `loadConfig` mentioning it once, so a wrong endpoint
+ * or a missing key was silent while MinIO sat there talking to nobody. That is
+ * the specific failure this shape exists to make impossible.
+ */
+function s3From(r, env) {
+    const keys = [
+        'NACRE_S3_ENDPOINT',
+        'NACRE_S3_BUCKET',
+        'NACRE_S3_ACCESS_KEY',
+        'NACRE_S3_SECRET_KEY',
+    ];
+    const present = keys.filter((k) => (env[k] ?? '').trim() !== '');
+    if (present.length === 0)
+        return undefined;
+    if (present.length < keys.length) {
+        const missing = keys.filter((k) => !present.includes(k));
+        r.problems.push(`object storage is half configured: ${present.join(', ')} set, ` +
+            `${missing.join(', ')} missing. Set all four to store document bytes in ` +
+            'object storage, or none to keep them in Postgres. There is no partial ' +
+            'mode — the endpoint without the credential is a deployment that accepts ' +
+            'documents and cannot store them.');
+        return undefined;
+    }
+    // `r.url` only asks whether `new URL` parses, and `minio:9000` does — it
+    // reads as the scheme `minio:` with the path `9000`, with an empty host. That
+    // would start, and then every request would be built against a URL with
+    // nowhere to send it. A missing `http://` is the likeliest thing to be wrong
+    // in this variable, so it is the one thing worth checking twice.
+    const endpoint = r.url('NACRE_S3_ENDPOINT');
+    if (endpoint !== '' && !/^https?:$/.test(safeProtocol(endpoint))) {
+        r.problems.push(`NACRE_S3_ENDPOINT must be an http or https URL, and is ${JSON.stringify(endpoint)}. ` +
+            'A bare host and port parses as a URL — the host ends up empty and every ' +
+            'request goes nowhere.');
+    }
+    return {
+        endpoint,
+        bucket: r.required('NACRE_S3_BUCKET'),
+        // A default is fine here and nowhere else in this block: the region names
+        // no host and carries no credential, MinIO ignores it entirely, and it is
+        // signed into every request so it has to be *something*.
+        region: r.optional('NACRE_S3_REGION') ?? 'us-east-1',
+        accessKey: r.required('NACRE_S3_ACCESS_KEY'),
+        secretKey: r.required('NACRE_S3_SECRET_KEY'),
+        // True by default because the default deployment is self-hosted: MinIO, or
+        // an endpoint reached by a name that is not a wildcard DNS entry. AWS
+        // proper is the case that has to say so.
+        forcePathStyle: r.boolean('NACRE_S3_FORCE_PATH_STYLE', true),
+    };
+}
 export function loadConfig(env = process.env) {
     const r = new Reader(env);
     const config = {
@@ -171,6 +552,14 @@ export function loadConfig(env = process.env) {
         // this is the one tunable here that trades latency for quality directly,
         // and there is a value at which a search stops answering in time.
         rerankCandidates: r.number('NACRE_RERANK_CANDIDATES', 50, { min: 1, max: 500 }),
+        // Comma-separated, trimmed, empties dropped. A module that cannot be
+        // imported fails startup rather than warning: naming one is a statement
+        // that the deployment is paying for what it does, and coming up without it
+        // would silently be a different product.
+        modules: (env.NACRE_MODULES ?? '')
+            .split(',')
+            .map((m) => m.trim())
+            .filter((m) => m !== ''),
         jwtIssuer: r.required('NACRE_JWT_ISSUER'),
         jwtAudience: r.required('NACRE_JWT_AUDIENCE'),
         accessTokenTtl: r.number('NACRE_ACCESS_TOKEN_TTL', 900, { min: 60, max: 86_400 }),
@@ -179,7 +568,6 @@ export function loadConfig(env = process.env) {
         // choice nobody makes deliberately.
         refreshTokenTtl: r.number('NACRE_REFRESH_TOKEN_TTL', 2_592_000, { min: 300, max: 31_536_000 }),
         aclCacheTtl: r.number('NACRE_ACL_CACHE_TTL', 60, { min: 0, max: 3600 }),
-        aclPropagationSla: r.number('NACRE_ACL_PROPAGATION_SLA', 60, { min: 1, max: 3600 }),
         gcGrace: r.number('NACRE_GC_GRACE', 3600, { min: 0, max: 2_592_000 }),
         // 15 minutes: long enough for a large PDF through parse, chunk, embed, and
         // upsert, short enough that a drained node's documents are not stuck for an
@@ -187,7 +575,6 @@ export function loadConfig(env = process.env) {
         // document the instant it is claimed, which is a loop, not a setting.
         indexLease: r.number('NACRE_INDEX_LEASE', 900, { min: 60, max: 86_400 }),
         indexMaxAttempts: r.number('NACRE_INDEX_MAX_ATTEMPTS', 5, { min: 1, max: 100 }),
-        aclTagHashBytes: r.number('NACRE_ACL_TAG_HASH_BYTES', 8, { min: 4, max: 32 }),
         rateSearchPerMin: r.number('NACRE_RATE_SEARCH_PER_MIN', 60, { min: 1 }),
         rateIngestPerHour: r.number('NACRE_RATE_INGEST_PER_HOUR', 600, { min: 1 }),
         // Ten attempts per quarter hour, counted per email address. Low enough that
@@ -234,6 +621,48 @@ export function loadConfig(env = process.env) {
         // should stop the deployment, not fill a log.
         auditRetentionDays: r.number('NACRE_AUDIT_RETENTION_DAYS', 400, { min: 30 }),
         auditQueryText: r.boolean('NACRE_AUDIT_QUERY_TEXT', false),
+        // How long a superseded collection survives a model migration.
+        //
+        // It is a rollback window and nothing else. The cheap rollback in
+        // `rollback-layer-reindex.md` is "move the pointer back", which works for
+        // exactly as long as the collection it points back to still exists; past
+        // this horizon that option is gone and a rollback means reindexing.
+        //
+        // The floor is 1 rather than 0 because a collection deleted the instant the
+        // pointer moved would make a migration irreversible at the moment it is
+        // most likely to be found wrong. Setting it high costs disk: each retained
+        // collection is a full copy of the organization's vectors.
+        collectionRetentionDays: r.number('NACRE_COLLECTION_RETENTION_DAYS', 7, { min: 1 }),
+        // The floor a reindex's recall check must reach before the layer switches.
+        //
+        // A whole-number percentage rather than a fraction, because this reader
+        // takes integers and `0.8` typed into an environment file is a value two
+        // different parsers would disagree about. Divided here so everything
+        // downstream works in the [0, 1] the arithmetic produces.
+        //
+        // The default is 80 and it gates nothing on its own: a layer with no
+        // reference query set has no check at all, so this applies to deployments
+        // that went and wrote one — which is a deployment asking for a gate.
+        //
+        // 0 is allowed and means measure without blocking. That is arithmetic
+        // rather than a special case for "disabled": every recall is at least 0, so
+        // the comparison passes and the number is still recorded. `min: 1` would be
+        // wrong here for exactly the reason it is right on the retention window
+        // above — there the low value destroys something, here it destroys nothing.
+        reindexMinRecall: r.number('NACRE_REINDEX_MIN_RECALL', 80, { min: 0, max: 100 }) / 100,
+        // How long a `source_url` outlives the permission check that minted it.
+        //
+        // A presigned URL is a bearer capability: whoever holds it fetches that
+        // object without a Nacre credential, and a revocation inside the window
+        // does not reach it. So the ceiling is a week — SigV4's own maximum, and
+        // already far longer than any reason to hand one out — and the floor is a
+        // minute, because a link that expires while the client is still following
+        // the redirect is a link that never worked.
+        presignTtl: r.number('NACRE_PRESIGN_TTL', 900, { min: 60, max: 604_800 }),
+        // All of it or none of it — see the cross-field check below. Read here so
+        // that a malformed endpoint is a startup problem like any other; whether
+        // the *set* is coherent is a question no per-variable check can answer.
+        s3: s3From(r, env),
     };
     // Cross-field checks. Each one is a combination that parses fine and is
     // wrong, which is exactly the class a per-variable check cannot catch.
@@ -259,23 +688,11 @@ export function loadConfig(env = process.env) {
             'so accepting this would give you a single-collection deployment that ' +
             'believes it is isolated. Use `collection`, which is the default.');
     }
-    if (config.aclTagHashBytes !== 8) {
-        r.problems.push('NACRE_ACL_TAG_HASH_BYTES is not implemented: the tag width is fixed at 8 ' +
-            'bytes in the code that writes and matches tags. Setting it changes the ' +
-            'collision probability you think you have and nothing else. Leave it at 8.');
-    }
     if (config.refreshTokenTtl <= config.accessTokenTtl) {
         r.problems.push('NACRE_REFRESH_TOKEN_TTL is not longer than NACRE_ACCESS_TOKEN_TTL. A refresh ' +
             'token that expires no later than the access token it renews cannot renew ' +
             'anything, so every session would end at the first refresh.');
     }
-    if (config.aclCacheTtl > config.aclPropagationSla) {
-        // The cache would still be serving a revoked grant after the SLA has
-        // passed, and nacre_acl_propagation_lag_seconds would report compliance.
-        r.problems.push(`NACRE_ACL_CACHE_TTL (${config.aclCacheTtl}) is longer than ` +
-            `NACRE_ACL_PROPAGATION_SLA (${config.aclPropagationSla}); a revoked grant ` +
-            'would still be served after the SLA it promises.');
-    }
     if (config.env === 'production' && config.canonicalUrl.startsWith('http://')) {
         // The canonical URL is the OAuth issuer and goes into every token ever
         // issued. Over plaintext it is also the thing an attacker rewrites.

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8FH,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4DAA4D;gBAC1D,6EAA6E;gBAC7E,2DAA2D;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAClE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,oEAAoE;gBACpE,gDAAgD;SACnD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,wEAAwE;gBACxE,+DAA+D;SAClE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrC,UAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;KACjD,CAAA;AACH,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CACH,iCAAiC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7E,gEAAgE,CACnE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAID,MAAM,MAAM;IAEmB;IADpB,QAAQ,GAAa,EAAE,CAAA;IAChC,YAA6B,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,+EAA+E;IAC/E,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAW,EAAE,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,qBAAqB,SAAS,uBAAuB,CAAC,CAAA;YAC/E,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,GAAG,QAAQ,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,QAAiB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,MAAM,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAmB,GAAW,EAAE,OAAqB,EAAE,QAAW;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAK,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAQ,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAU,EAAE,aAAa,CAAC;QAChF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,MAAM,CAAC;QACzF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU,EAAE,MAAM,CAAC;QAEzE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU,EAAE,YAAY,CAAC;QAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAEvC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACvD,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAC3D,yDAAyD;QACzD,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAE/E,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjF,4EAA4E;QAC5E,0EAA0E;QAC1E,oCAAoC;QACpC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAE9F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAC/E,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAE7E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,0BAA0B;QAC1B,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,mCAAmC,EAAE,EAAE,EAAE;YACzE,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,MAAM;SACZ,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,wDAAwD;QACxD,EAAE;QACF,4EAA4E;QAC5E,uDAAuD;QACvD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjF,uEAAuE;QACvE,4EAA4E;QAC5E,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC5E,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;KAC3D,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IAEvE,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,yEAAyE;YACvE,sEAAsE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,kDAAkD;IAClD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,4EAA4E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,kEAAkE,CACrE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QACjC,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,2EAA2E;YACzE,yEAAyE;YACzE,2EAA2E,CAC9E,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,+EAA+E;YAC7E,2EAA2E;YAC3E,4DAA4D,CAC/D,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClD,qEAAqE;QACrE,yEAAyE;QACzE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,wBAAwB,MAAM,CAAC,WAAW,mBAAmB;YAC3D,8BAA8B,MAAM,CAAC,iBAAiB,qBAAqB;YAC3E,kDAAkD,CACrD,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,uEAAuE;QACvE,oEAAoE;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA+LxC,mFAAmF;AACnF,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,GAAc;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IACvD,OAAO;QACL,GAAI,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6B;QAC7D,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,OAAO;KACb,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAA2B;IACxD,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACvE,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAA;IACF,OAAO,WAAW,WAAW,CAAC,GAAG,CAAC,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;GASG;AACH;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,QAAgB,EAAE,IAA0B;IAC3E,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CAAA;QAC5D,CAAC;QACD,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI;gBACpD,iCAAiC,IAAI,oBAAoB;gBACzD,kCAAkC;SACrC,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,UAAU,IAAI,2BAA2B,MAAM,CAAC,KAAK,CAAC,GAAG;SACrE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,QAAgB;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAE/C,+EAA+E;IAC/E,wEAAwE;IACxE,4EAA4E;IAC5E,8EAA8E;IAC9E,oEAAoE;IACpE,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,kEAAkE;gBAC3E,uEAAuE;gBACvE,2CAA2C;gBAC3C,kEAAkE;SACrE,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAc,CAAA;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,+CAA+C,MAAM,CAAC,KAAK,CAAC,IAAI;gBACzE,uCAAuC;gBACvC,kEAAkE;SACrE,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,YAAY,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,4BAA4B;gBAC9E,gEAAgE;SACnE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,QAAgB;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IAEhD,IAAI,GAAc,CAAA;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,gDAAgD,MAAM,CAAC,KAAK,CAAC,GAAG;SAC5E,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,kCAAkC;QAClC,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,QAAQ,YAAY,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,wBAAwB;gBAC1E,0EAA0E;gBAC1E,6CAA6C;gBAC7C,4DAA4D;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAA;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAEzC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,iDAAiD;QACjD,MAAM,IAAI,WAAW,CAAC;YACpB,4EAA4E;gBAC1E,sEAAsE;gBACtE,2BAA2B;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAElE,MAAM,WAAW,GAAG,GAAG,CAAC,0BAA0B,CAAA;QAClD,MAAM,QAAQ,GACZ,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAA;QAE5D,IACE,QAAQ,KAAK,SAAS;YACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EACnE,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,IAAI,WAAW,CAAC;gBACpB,8EAA8E;oBAC5E,0DAA0D;oBAC1D,0EAA0E;oBAC1E,yBAAyB;aAC5B,CAAC,CAAA;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3D,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE;gBACJ,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;aAChE;SACF,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4DAA4D;gBAC1D,wEAAwE;gBACxE,0EAA0E;gBAC1E,mCAAmC;SACtC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC5C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;IAChF,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,oEAAoE;gBACpE,gDAAgD;SACnD,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,IAAI,WAAW,CAAC;YACpB,2EAA2E;gBACzE,wEAAwE;gBACxE,+DAA+D;SAClE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,YAAY,EAAE,GAAG;QACjB,UAAU,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,SAAS,EAAE,OAAO;KACnB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAA;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,wBAAwB,CAAA;IAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,yBAAyB,CAAA;IAEhD,MAAM,KAAK,GAAG;QACZ,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACtE,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS;QACpF,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAE7C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC;YACpB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,KAAK,CAAC,MAAM,cAAc;gBAC7E,oEAAoE;gBACpE,iEAAiE;gBACjE,sEAAsE;gBACtE,oDAAoD;SACvD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAE,CAAY,EAAW,EAAE,CACvD,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEtD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,GAAG,CAAC,iCAAiC,CAAA;QACrD,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAA;QAErE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,WAAW,CAAC;gBACpB,0DAA0D;oBACxD,uEAAuE;oBACvE,kEAAkE;oBAClE,2DAA2D;aAC9D,CAAC,CAAA;QACJ,CAAC;QAED,OAAO;YACL,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpD,SAAS,EAAE,OAAO;SACnB,CAAA;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAA;QAC9C,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;YACrC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAA;QAExD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC;gBACpB,8EAA8E;oBAC5E,mDAAmD;aACtD,CAAC,CAAA;QACJ,CAAC;QAED,OAAO;YACL,YAAY,EAAE,OAAO,CAAC,MAAM;YAC5B,UAAU,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3D,SAAS,EAAE,OAAO;SACnB,CAAA;IACH,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CAAC;YACpB,4EAA4E;gBAC1E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,eAAe;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,yBAAyB,CAAA;IACpD,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC;gBACpB,2EAA2E;oBACzE,8EAA8E;aACjF,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC;gBACpB,2EAA2E;oBACzE,2CAA2C;aAC9C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,OAAO;QACL,YAAY,EAAE,GAAG;QACjB,UAAU,EACR,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE;YACnD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,SAAS,EAAE,OAAO;KACnB,CAAA;AACH,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,QAAQ,CAAmB;IAEpC,YAAY,QAA2B;QACrC,KAAK,CACH,iCAAiC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7E,gEAAgE,CACnE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAID,MAAM,MAAM;IAEmB;IADpB,QAAQ,GAAa,EAAE,CAAA;IAChC,YAA6B,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;IAAG,CAAC;IAEzC,+EAA+E;IAC/E,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,aAAa,CAAC,CAAA;YACvC,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACnC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,GAAW,EAAE,SAAiB;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,qBAAqB,SAAS,uBAAuB,CAAC,CAAA;YAC/E,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE;QACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YACtF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,GAAG,QAAQ,GAAG,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACrG,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,QAAiB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,MAAM,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,KAAK,CAAmB,GAAW,EAAE,OAAqB,EAAE,QAAW;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACpD,IAAK,OAA6B,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAQ,CAAA;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7F,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;QACtE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,MAAM,CAAC,CAAS,EAAE,GAAQ;IACjC,MAAM,IAAI,GAAG;QACX,mBAAmB;QACnB,iBAAiB;QACjB,qBAAqB;QACrB,qBAAqB;KACb,CAAA;IAEV,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAE1C,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,sCAAsC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAC9D,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,kCAAkC,CACrC,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,0DAA0D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI;YACpF,0EAA0E;YAC1E,uBAAuB,CAC1B,CAAA;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACrC,0EAA0E;QAC1E,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,WAAW;QACpD,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC5C,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC5C,2EAA2E;QAC3E,sEAAsE;QACtE,yCAAyC;QACzC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,IAAI,CAAC;KAC7D,CAAA;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAW,OAAO,CAAC,GAAG;IAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAA;IAEzB,MAAM,MAAM,GAAW;QACrB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAU,EAAE,aAAa,CAAC;QAChF,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAC1C,wBAAwB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACxF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,EAAE,MAAM,CAAC;QACzF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,MAAM,CAAU,EAAE,MAAM,CAAC;QAEzE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAChD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAU,EAAE,YAAY,CAAC;QAC/F,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAEvC,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC;QAC5D,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACnF,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC9C,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QACvD,wEAAwE;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAC3D,yDAAyD;QACzD,uEAAuE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,kEAAkE;QAClE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAE/E,qEAAqE;QACrE,wEAAwE;QACxE,2EAA2E;QAC3E,yCAAyC;QACzC,OAAO,EAAE,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;aAC/B,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAE1B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACjF,4EAA4E;QAC5E,0EAA0E;QAC1E,oCAAoC;QACpC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QAE9F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACvE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,sEAAsE;QACtE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACxE,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAE/E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC1E,4EAA4E;QAC5E,4EAA4E;QAC5E,yEAAyE;QACzE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACpF,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,0BAA0B;QAC1B,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,mCAAmC,EAAE,EAAE,EAAE;YACzE,GAAG,EAAE,CAAC;YACN,GAAG,EAAE,MAAM;SACZ,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAChE,oEAAoE;QACpE,4EAA4E;QAC5E,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,wDAAwD;QACxD,EAAE;QACF,4EAA4E;QAC5E,uDAAuD;QACvD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEjF,uEAAuE;QACvE,4EAA4E;QAC5E,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,4BAA4B,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC5E,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;QAE1D,+DAA+D;QAC/D,EAAE;QACF,kEAAkE;QAClE,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,EAAE;QACF,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,2DAA2D;QAC3D,uBAAuB,EAAE,CAAC,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAEnF,2EAA2E;QAC3E,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,0DAA0D;QAC1D,EAAE;QACF,qEAAqE;QACrE,0EAA0E;QAC1E,qEAAqE;QACrE,EAAE;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG;QAEtF,wEAAwE;QACxE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,4CAA4C;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;QAEzE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC;KACnB,CAAA;IAED,wEAAwE;IACxE,uEAAuE;IAEvE,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,yEAAyE;YACvE,sEAAsE;YACtE,sEAAsE,CACzE,CAAA;IACH,CAAC;IAED,kDAAkD;IAClD,EAAE;IACF,0EAA0E;IAC1E,0EAA0E;IAC1E,qEAAqE;IACrE,EAAE;IACF,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAM,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;QAC1C,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,4EAA4E;YAC1E,2EAA2E;YAC3E,uEAAuE;YACvE,kEAAkE,CACrE,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,IAAI,CACb,+EAA+E;YAC7E,2EAA2E;YAC3E,4DAA4D,CAC/D,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,uEAAuE;QACvE,oEAAoE;QACpE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;IAC5F,CAAC;IAED,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/db/migrate.d.ts

@@ -11,6 +11,51 @@ export interface MigrateResult {
     readonly applied: readonly string[];
     readonly skipped: readonly string[];
 }
+/**
+ * Just enough of `Client` to ask what the connected role may do — so the check
+ * below can be exercised without a database for its branches, having been
+ * verified against a real one for its premise.
+ */
+export interface RoleReader {
+    query<T>(sql: string): Promise<{
+        rows: T[];
+    }>;
+}
+/**
+ * Refuse, before applying anything, if the connected role cannot finish.
+ *
+ * Every tenant table has `FORCE ROW LEVEL SECURITY`, and `FORCE` is what makes
+ * the policy apply to the table's **owner** as well. Migrations run as the
+ * owner and several of them read a tenant table — 0006 checks for duplicate
+ * layer slugs, 0007 backfills a lease column, 0017 rewrites a role, 0018
+ * dedupes group members. Each of those evaluates
+ * `current_setting('app.current_org')`, which is unset during a migration, so
+ * the statement fails with:
+ *
+ *     ERROR: unrecognized configuration parameter "app.current_org"
+ *
+ * That message names nothing an operator can act on. It says nothing about
+ * roles, nothing about row-level security, and it arrives at migration 0006
+ * rather than at the start — five migrations of schema already applied.
+ *
+ * It has never been seen because development connects as a superuser, and a
+ * superuser bypasses row-level security entirely. It appears the moment an
+ * operator follows `docs/config.md` and stops doing that, which is the same
+ * shape as the two subsystems already found this way.
+ *
+ * So the requirement is stated once, up front, with the SQL that satisfies it.
+ * The `WITH ADMIN OPTION` line is in the message even though it is not what is
+ * being checked: migration 0008 runs `GRANT nacre_worker TO nacre_app` and
+ * plain membership is not enough to grant a role onward. That migration's own
+ * hint says to grant membership, which does not fix it — and 0008 has been
+ * applied everywhere, so its text is checksummed and cannot be corrected in
+ * place. Naming the whole block here is what stops an operator satisfying one
+ * requirement and meeting the next one on the following run.
+ *
+ * Only called when there is something to apply, so re-running `migrate` on an
+ * up-to-date database stays a no-op whatever role it connects as.
+ */
+export declare function requireMigrationPrivileges(client: RoleReader): Promise<void>;
 /**
  * Apply every migration that has not been applied yet.
  *

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAuB,GAAG,SAAS,SAAS,EAAE,CAyBjF;AAeD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,SAAS,SAAS,EAAqB,GAClD,OAAO,CAAC,aAAa,CAAC,CA4FxB"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../db/migrate.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAuB,GAAG,SAAS,SAAS,EAAE,CAyBjF;AAeD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAA;CAC9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BlF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,OAAO,CAC3B,gBAAgB,EAAE,MAAM,EACxB,UAAU,GAAE,SAAS,SAAS,EAAqB,GAClD,OAAO,CAAC,aAAa,CAAC,CAkGxB"}