@parmana/shared 0.0.0-stage → 0.1.0

package/dist/config/Config.d.ts

@@ -0,0 +1,202 @@
+import type { CryptoMode, HashAlgorithm, SignatureAlgorithm } from "./CryptoAlgorithms.js";
+import type { StorageProvider } from "./StorageProviders.js";
+import type { KeyProvider } from "./KeyProviders.js";
+import type { SecretsProvider } from "./SecretsProviders.js";
+import type { TrustProfile } from "./TrustProfiles.js";
+import type { ApiKeyEntry } from "./ApiKeyEntry.js";
+/**
+ * Parmana Configuration.
+ *
+ * Centralized immutable configuration.
+ *
+ * This is the only configuration model used by
+ * Parmana. Environment variables are converted
+ * into strongly typed values through the
+ * ConfigValidation module.
+ */
+/**
+ * Root configuration.
+ */
+export interface Config {
+    readonly environment: EnvironmentConfig;
+    readonly storage: StorageConfig;
+    readonly crypto: CryptoConfig;
+    readonly keys: KeyConfig;
+    readonly secrets: SecretsConfig;
+    readonly authorization: AuthorizationConfig;
+    readonly policy: PolicyConfig;
+    readonly trust: TrustConfig;
+    readonly api: ApiConfig;
+    readonly auth: ApiAuthConfig;
+    readonly rateLimit: RateLimitConfig;
+    readonly logging: LoggingConfig;
+}
+/**
+ * Runtime environment.
+ */
+export interface EnvironmentConfig {
+    readonly nodeEnv: string;
+}
+/**
+ * Storage configuration.
+ */
+export interface StorageConfig {
+    readonly provider: StorageProvider;
+    readonly databaseUrl?: string;
+}
+/**
+ * Cryptographic configuration.
+ */
+export interface CryptoConfig {
+    /**
+     * Crypto operating mode.
+     */
+    readonly mode: CryptoMode;
+    /**
+     * Hash algorithm.
+     */
+    readonly hashProvider: HashAlgorithm;
+    /**
+     * Primary signature algorithm.
+     */
+    readonly primarySignatureProvider: SignatureAlgorithm;
+    /**
+     * Secondary signature algorithm.
+     *
+     * Required only in hybrid mode.
+     */
+    readonly secondarySignatureProvider?: SignatureAlgorithm;
+    /**
+     * When true, verification of a hybrid-schema-capable artifact
+     * (an ExecutionTrustRecord) MUST find a valid `signatures` array
+     * covering every configured algorithm -- a record with `signatures`
+     * absent, empty, or partial is rejected outright, never silently
+     * verified via the legacy single signature alone.
+     *
+     * Off by default so no already-issued record (hybrid or not) is
+     * affected by turning CRYPTO_MODE=hybrid on: a deployment opts into
+     * this once it is confident every record going forward is genuinely
+     * hybrid-signed. See VerificationCrypto.verifySignature()'s own
+     * comment for the exact downgrade this closes.
+     */
+    readonly requireHybridSignature: boolean;
+    /**
+     * Cutover (ADR-0016, option 2): a record created at or after this ISO-8601
+     * UTC instant must carry a valid hybrid envelope. Unset means no cutover.
+     * The same instant belongs in the offline verifier's trust file.
+     */
+    readonly hybridRequiredFrom?: string;
+    /**
+     * Schema version that hybrid signatures are made under (ADR-0016).
+     *
+     * 2 (default) signs the canonical fields plus schemaVersion. 3 signs
+     * every top-level field except the signature envelope and the
+     * post-signing fields (verifications, receipts). Records made under 3
+     * are not readable by verifiers that implement only version 2, so
+     * switch to 3 only once those consumers are updated.
+     */
+    readonly hybridSchemaVersion: 2 | 3;
+}
+/**
+ * Key management.
+ */
+export interface KeyConfig {
+    readonly provider: KeyProvider;
+    /**
+     * Root directory containing all Parmana keys.
+     */
+    readonly keyDirectory: string;
+}
+/**
+ * Secrets backend configuration (ADR-0009). Selects where connector
+ * credentials that are opaque bearer values -- not signing keys, see
+ * KeyConfig/Signer for those -- are resolved from at request time.
+ * "env" (default) is an identity pass-through: the value each
+ * connector's own env var already holds IS the secret. In
+ * "aws-secrets-manager" mode, that same env var's value is instead
+ * treated as the Secrets Manager secret's name/ARN to fetch.
+ */
+export interface SecretsConfig {
+    readonly provider: SecretsProvider;
+}
+/**
+ * Execution authorization configuration.
+ */
+export interface AuthorizationConfig {
+    /**
+     * Default TTL, in seconds, applied to a signed
+     * Execution Authorization when the caller does
+     * not specify one.
+     */
+    readonly ttlSeconds: number;
+}
+/**
+ * Policy configuration.
+ */
+export interface PolicyConfig {
+    /**
+     * Root directory containing policy files.
+     */
+    readonly directory: string;
+}
+/**
+ * Trust profile configuration.
+ */
+export interface TrustConfig {
+    readonly profile: TrustProfile;
+    readonly receiptVersion: string;
+}
+/**
+ * API configuration.
+ */
+export interface ApiConfig {
+    readonly port: number;
+}
+/**
+ * API caller authentication.
+ *
+ * Fail-closed by design: an empty `keys` array means the
+ * caller-authenticator bootstrap refuses to start the
+ * server unless `disabled` is explicitly true (local
+ * development and tutorials only).
+ */
+export interface ApiAuthConfig {
+    readonly keys: readonly ApiKeyEntry[];
+    readonly disabled: boolean;
+}
+/**
+ * Rate limiting configuration.
+ *
+ * Both are per-caller/per-IP-per-minute ceilings applied by
+ * packages/api/src/middleware/rate-limit.ts; see that file for exactly
+ * where and how each is keyed.
+ */
+export interface RateLimitConfig {
+    /**
+     * POST /execute, keyed by authenticated caller identity.
+     */
+    readonly executePerMinute: number;
+    /**
+     * GET /health and GET /ready, keyed by IP.
+     */
+    readonly healthPerMinute: number;
+    /**
+     * The unauthenticated verify routes, /handbook and key discovery,
+     * keyed by IP (G-78).
+     */
+    readonly publicPerMinute: number;
+    /**
+     * Failed caller authentications (401) on every authenticated route,
+     * keyed by IP. Each one writes a signed audit event, so an unlimited
+     * stream of bad keys would spend signing capacity real requests need.
+     */
+    readonly authFailurePerMinute: number;
+}
+/**
+ * Logging configuration.
+ */
+export interface LoggingConfig {
+    readonly level: string;
+}
+export declare function loadConfig(): Readonly<Config>;
+//# sourceMappingURL=Config.d.ts.map

package/dist/config/Config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA8FpD;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAExC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAE9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAE5C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAE9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AACD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;IAEtD;;;;OAIG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAEzD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAEzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC;CACrC;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AACD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAgED,wBAAgB,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,CA8F7C"}

package/dist/config/Config.js

@@ -0,0 +1,172 @@
+import dotenv from "dotenv";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { optionalProperty } from "./ConfigUtils.js";
+import { parseStorageProvider, parseCryptoMode, parseHashAlgorithm, parseSignatureAlgorithm, parseKeyProvider, parseSecretsProvider, parseTrustProfile, parseApiKeys, } from "./ConfigValidation.js";
+/**
+ * Resolve the repository .env file.
+ *
+ * This implementation is independent of the
+ * current working directory, allowing every
+ * Parmana package to share the same
+ * configuration.
+ */
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+function findEnvFile() {
+    let current = __dirname;
+    while (true) {
+        const candidate = join(current, ".env");
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+//
+// The .env file is read on first use of loadConfig(), not when this module
+// is imported. Importing a package (for example the offline verifier) then
+// reads no file from the working tree.
+//
+let dotEnvLoaded = false;
+function loadDotEnvOnce() {
+    // Test runs set PARMANA_SKIP_DOTENV so a local .env cannot leak into them.
+    if (dotEnvLoaded || process.env.PARMANA_SKIP_DOTENV === "1") {
+        return;
+    }
+    dotEnvLoaded = true;
+    const envFile = findEnvFile();
+    if (envFile) {
+        dotenv.config({
+            path: envFile,
+            quiet: true,
+        });
+    }
+    else {
+        dotenv.config({ quiet: true });
+    }
+}
+/**
+ * Fail-closed by design, same discipline as caller authentication
+ * (see createCallerAuthenticator.ts): refuses to start rather than let
+ * an unset policy directory surface later as a raw filesystem error
+ * (ERR_INVALID_ARG_TYPE from path.join(undefined, ...)) inside
+ * FilePolicyRepository.load at request time.
+ */
+function requirePolicyDirectory() {
+    const directory = process.env.PARMANA_POLICY_DIR;
+    if (directory === undefined || directory.trim() === "") {
+        throw new Error("PARMANA_POLICY_DIR is not set. Refusing to start without a " +
+            "configured policy directory; the server cannot load or evaluate " +
+            "policies without it. Set PARMANA_POLICY_DIR to the directory " +
+            "containing policy files (e.g. ./policies).");
+    }
+    return directory;
+}
+/**
+ * Loads the immutable Parmana configuration.
+ *
+ * This is the only location where process.env
+ * should be accessed.
+ */
+/**
+ * HYBRID_SCHEMA_VERSION: unset means 2. Any other value must be exactly
+ * 2 or 3, and anything else throws, so a typo cannot pick a schema
+ * version silently.
+ */
+function parseHybridSchemaVersion(value, acknowledged) {
+    if (value === undefined || value.trim() === "") {
+        return 2;
+    }
+    if (value === "2") {
+        return 2;
+    }
+    if (value === "3") {
+        //
+        // Schema version 3 records are not readable by the SDKs and by
+        // the published third-party verifier until those are updated (ADR-0016 issuance gate).
+        // Refuse to start unless the operator also sets the acknowledgement,
+        // so a stray value cannot switch v3 on.
+        //
+        if (acknowledged !== "true") {
+            throw new Error("HYBRID_SCHEMA_VERSION=3 is refused unless HYBRID_SCHEMA_V3_ACKNOWLEDGED=true is also set (ADR-0016 issuance gate).");
+        }
+        return 3;
+    }
+    throw new Error(`HYBRID_SCHEMA_VERSION must be 2 or 3, got "${value}".`);
+}
+/**
+ * HYBRID_REQUIRED_FROM: unset or blank means no cutover. Otherwise it must be
+ * an ISO-8601 UTC timestamp ending in "Z", so it means the same time everywhere.
+ */
+function parseHybridRequiredFrom(value) {
+    if (value === undefined || value.trim() === "") {
+        return undefined;
+    }
+    if (!value.endsWith("Z") || Number.isNaN(Date.parse(value))) {
+        throw new Error(`HYBRID_REQUIRED_FROM must be an ISO-8601 UTC timestamp ending in "Z", got "${value}".`);
+    }
+    return value;
+}
+export function loadConfig() {
+    loadDotEnvOnce();
+    return Object.freeze({
+        environment: Object.freeze({
+            nodeEnv: process.env.NODE_ENV ?? "development",
+        }),
+        storage: Object.freeze({
+            provider: parseStorageProvider(process.env.PARMANA_STORAGE),
+            ...optionalProperty("databaseUrl", process.env.DATABASE_URL),
+        }),
+        crypto: Object.freeze({
+            mode: parseCryptoMode(process.env.CRYPTO_MODE),
+            hashProvider: parseHashAlgorithm(process.env.HASH_PROVIDER),
+            primarySignatureProvider: parseSignatureAlgorithm(process.env.PRIMARY_SIGNATURE_PROVIDER),
+            ...optionalProperty("secondarySignatureProvider", process.env.SECONDARY_SIGNATURE_PROVIDER
+                ? parseSignatureAlgorithm(process.env.SECONDARY_SIGNATURE_PROVIDER)
+                : undefined),
+            requireHybridSignature: process.env.HYBRID_SIGNATURE_REQUIRED === "true",
+            ...optionalProperty("hybridRequiredFrom", parseHybridRequiredFrom(process.env.HYBRID_REQUIRED_FROM)),
+            hybridSchemaVersion: parseHybridSchemaVersion(process.env.HYBRID_SCHEMA_VERSION, process.env.HYBRID_SCHEMA_V3_ACKNOWLEDGED),
+        }),
+        keys: Object.freeze({
+            provider: parseKeyProvider(process.env.KEY_PROVIDER),
+            keyDirectory: process.env.PARMANA_KEY_DIR,
+        }),
+        secrets: Object.freeze({
+            provider: parseSecretsProvider(process.env.PARMANA_SECRETS_PROVIDER),
+        }),
+        authorization: Object.freeze({
+            ttlSeconds: Number(process.env.EXECUTION_AUTHORIZATION_TTL_SECONDS ?? 120),
+        }),
+        policy: Object.freeze({
+            directory: requirePolicyDirectory(),
+        }),
+        trust: Object.freeze({
+            profile: parseTrustProfile(process.env.TRUST_PROFILE),
+            receiptVersion: process.env.RECEIPT_VERSION ?? "1",
+        }),
+        api: Object.freeze({
+            port: Number(process.env.PORT ?? 3000),
+        }),
+        auth: Object.freeze({
+            keys: parseApiKeys(process.env.PARMANA_API_KEYS),
+            disabled: process.env.PARMANA_AUTH_DISABLED === "true",
+        }),
+        rateLimit: Object.freeze({
+            executePerMinute: Number(process.env.RATE_LIMIT_EXECUTE_PER_MINUTE ?? 30),
+            healthPerMinute: Number(process.env.RATE_LIMIT_HEALTH_PER_MINUTE ?? 300),
+            publicPerMinute: Number(process.env.RATE_LIMIT_PUBLIC_PER_MINUTE ?? 60),
+            authFailurePerMinute: Number(process.env.RATE_LIMIT_AUTH_FAILURE_PER_MINUTE ?? 30),
+        }),
+        logging: Object.freeze({
+            level: process.env.LOG_LEVEL ?? "info",
+        }),
+    });
+}
+//# sourceMappingURL=Config.js.map

package/dist/config/Config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAUzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAUpD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAElD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,WAAW;IAClB,IAAI,OAAO,GAAG,SAAS,CAAC;IAExB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,uCAAuC;AACvC,EAAE;AACF,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,SAAS,cAAc;IACrB,2EAA2E;IAC3E,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IAEpB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAEjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,kEAAkE;YAClE,+DAA+D;YAC/D,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAsOD;;;;;GAKG;AACH;;;;GAIG;AACH,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,YAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,EAAE;QACF,+DAA+D;QAC/D,uFAAuF;QACvF,qEAAqE;QACrE,wCAAwC;QACxC,EAAE;QACF,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,8EAA8E,KAAK,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,cAAc,EAAE,CAAC;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;SAC/C,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAE3D,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;SAC7D,CAAC;QAEF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAE9C,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAE3D,wBAAwB,EAAE,uBAAuB,CAC/C,OAAO,CAAC,GAAG,CAAC,0BAA0B,CACvC;YAED,GAAG,gBAAgB,CACjB,4BAA4B,EAC5B,OAAO,CAAC,GAAG,CAAC,4BAA4B;gBACtC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;gBACnE,CAAC,CAAC,SAAS,CACd;YAED,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,MAAM;YAExE,GAAG,gBAAgB,CACjB,oBAAoB,EACpB,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC1D;YAED,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAC1C;SACF,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAEpD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAgB;SAC3C,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SACrE,CAAC;QAEF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,MAAM,CAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,GAAG,CACvD;SACF,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,sBAAsB,EAAE;SACpC,CAAC;QAEF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAErD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG;SACnD,CAAC;QAEF,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;SACvC,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAEhD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;SACvD,CAAC;QAEF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC;YAEzE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC;YAExE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;YAEvE,oBAAoB,EAAE,MAAM,CAC1B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,EAAE,CACrD;SACF,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;SACvC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/config/ConfigLoader.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns the immutable Parmana configuration.
+ */
+export declare function getConfig(): Readonly<import("./Config.js").Config>;
+//# sourceMappingURL=ConfigLoader.d.ts.map

package/dist/config/ConfigLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.d.ts","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,SAAS,2CAExB"}

package/dist/config/ConfigLoader.js

@@ -0,0 +1,8 @@
+import { loadConfig } from "./Config.js";
+/**
+ * Returns the immutable Parmana configuration.
+ */
+export function getConfig() {
+    return loadConfig();
+}
+//# sourceMappingURL=ConfigLoader.js.map

package/dist/config/ConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.js","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/config/ConfigUtils.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Returns an object containing the property only when
+ * the value is defined.
+ */
+export declare function optionalProperty<T>(key: string, value: T | undefined): Record<string, T>;
+//# sourceMappingURL=ConfigUtils.d.ts.map

package/dist/config/ConfigUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigUtils.d.ts","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAEnB"}

package/dist/config/ConfigUtils.js

@@ -0,0 +1,8 @@
+/**
+ * Returns an object containing the property only when
+ * the value is defined.
+ */
+export function optionalProperty(key, value) {
+    return value === undefined ? {} : { [key]: value };
+}
+//# sourceMappingURL=ConfigUtils.js.map

package/dist/config/ConfigUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigUtils.js","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,KAAoB;IAEpB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC"}

package/dist/config/ConfigValidation.d.ts

@@ -0,0 +1,30 @@
+import { type CryptoMode, type HashAlgorithm, type SignatureAlgorithm } from "./CryptoAlgorithms.js";
+import { type StorageProvider } from "./StorageProviders.js";
+import { type KeyProvider } from "./KeyProviders.js";
+import { type SecretsProvider } from "./SecretsProviders.js";
+import { type TrustProfile } from "./TrustProfiles.js";
+import type { ApiKeyEntry } from "./ApiKeyEntry.js";
+export declare const parseStorageProvider: (value?: string) => StorageProvider;
+export declare const parseCryptoMode: (value?: string) => CryptoMode;
+export declare const parseHashAlgorithm: (value?: string) => HashAlgorithm;
+export declare const parseSignatureAlgorithm: (value?: string) => SignatureAlgorithm;
+export declare const parseKeyProvider: (value?: string) => KeyProvider;
+/**
+ * Unlike the other settings, an invalid value is not echoed: a value set
+ * in the wrong variable can be a real secret (a token pasted into
+ * PARMANA_SECRETS_PROVIDER, say), and this message reaches logs. Kept
+ * separate from parse() so the value never reaches its message.
+ */
+export declare const parseSecretsProvider: (value?: string) => SecretsProvider;
+export declare const parseTrustProfile: (value?: string) => TrustProfile;
+/**
+ * Parses PARMANA_API_KEYS: a JSON array of
+ * { "callerId": string, "keyHash": string } entries.
+ *
+ * Returns an empty array when unset — callers of this
+ * function decide what an empty result means (the
+ * caller-authenticator bootstrap treats it as "refuse to
+ * start unless auth is explicitly disabled").
+ */
+export declare function parseApiKeys(value?: string): ApiKeyEntry[];
+//# sourceMappingURL=ConfigValidation.d.ts.map

package/dist/config/ConfigValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigValidation.d.ts","sourceRoot":"","sources":["../../src/config/ConfigValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAItE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAkBpD,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,eAarD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,UACa,CAAC;AAE/D,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aACkB,CAAC;AAgBvE,eAAO,MAAM,uBAAuB,WAAY,MAAM,KAAG,kBAMtD,CAAC;AAEJ,eAAO,MAAM,gBAAgB,WAAY,MAAM,KAAG,WACc,CAAC;AAEjE;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,eAerD,CAAC;AAEF,eAAO,MAAM,iBAAiB,WAAY,MAAM,KAAG,YACa,CAAC;AAIjE;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CAuJ1D"}

package/dist/config/ConfigValidation.js

@@ -0,0 +1,170 @@
+import { CryptoModes, HashAlgorithms, SignatureAlgorithms, } from "./CryptoAlgorithms.js";
+import { StorageProviders } from "./StorageProviders.js";
+import { KeyProviders } from "./KeyProviders.js";
+import { SecretsProviders } from "./SecretsProviders.js";
+import { TrustProfiles } from "./TrustProfiles.js";
+import { createPublicKey } from "node:crypto";
+import { AuthorityType } from "../domain/authority.js";
+function parse(value, values, name, defaultValue) {
+    const resolved = value ?? defaultValue;
+    if (Object.values(values).includes(resolved)) {
+        return resolved;
+    }
+    throw new Error(`Invalid ${name}: ${resolved}`);
+}
+export const parseStorageProvider = (value) => {
+    if (process.env.DATABASE_PROVIDER !== undefined) {
+        throw new Error("DATABASE_PROVIDER is no longer read; set PARMANA_STORAGE instead.");
+    }
+    return parse(value, StorageProviders, "PARMANA_STORAGE", StorageProviders.MEMORY);
+};
+export const parseCryptoMode = (value) => parse(value, CryptoModes, "CRYPTO_MODE", CryptoModes.SINGLE);
+export const parseHashAlgorithm = (value) => parse(value, HashAlgorithms, "HASH_PROVIDER", HashAlgorithms.SHA256);
+/**
+ * Accepted input aliases for a SignatureAlgorithm config value, resolved
+ * to the canonical internal identifier before validation. Additive only:
+ * the canonical identifiers themselves (SignatureAlgorithms' own values,
+ * e.g. "dilithium3") are never renamed, so an existing
+ * PRIMARY_SIGNATURE_PROVIDER=dilithium3 deployment is unaffected. Lets a
+ * new deployment use "ml-dsa-65" (the NIST/FIPS 204 standard name this
+ * codebase's own docs already use when describing "dilithium3" to
+ * readers) without a breaking rename of the internal identifier itself.
+ */
+const SIGNATURE_ALGORITHM_ALIASES = {
+    "ml-dsa-65": SignatureAlgorithms.DILITHIUM3,
+};
+export const parseSignatureAlgorithm = (value) => parse(value !== undefined ? (SIGNATURE_ALGORITHM_ALIASES[value] ?? value) : value, SignatureAlgorithms, "SIGNATURE_PROVIDER", SignatureAlgorithms.ED25519);
+export const parseKeyProvider = (value) => parse(value, KeyProviders, "KEY_PROVIDER", KeyProviders.LOCAL);
+/**
+ * Unlike the other settings, an invalid value is not echoed: a value set
+ * in the wrong variable can be a real secret (a token pasted into
+ * PARMANA_SECRETS_PROVIDER, say), and this message reaches logs. Kept
+ * separate from parse() so the value never reaches its message.
+ */
+export const parseSecretsProvider = (value) => {
+    const accepted = Object.values(SecretsProviders);
+    const match = accepted.find((provider) => provider === value);
+    if (value === undefined) {
+        return SecretsProviders.ENV;
+    }
+    if (match === undefined) {
+        throw new Error(`Invalid PARMANA_SECRETS_PROVIDER: expected one of ${accepted.join(", ")}`);
+    }
+    return match;
+};
+export const parseTrustProfile = (value) => parse(value, TrustProfiles, "TRUST_PROFILE", TrustProfiles.V1);
+const API_KEY_HASH_PATTERN = /^[0-9a-f]{64}$/;
+/**
+ * Parses PARMANA_API_KEYS: a JSON array of
+ * { "callerId": string, "keyHash": string } entries.
+ *
+ * Returns an empty array when unset — callers of this
+ * function decide what an empty result means (the
+ * caller-authenticator bootstrap treats it as "refuse to
+ * start unless auth is explicitly disabled").
+ */
+export function parseApiKeys(value) {
+    if (value === undefined || value.trim() === "") {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("PARMANA_API_KEYS is not valid JSON. Expected an array of " +
+            '{ "callerId": string, "keyHash": string } entries.');
+    }
+    if (!Array.isArray(parsed)) {
+        throw new Error("PARMANA_API_KEYS must be a JSON array of " +
+            '{ "callerId": string, "keyHash": string } entries.');
+    }
+    return parsed.map((entry, index) => {
+        const record = entry;
+        const validEntry = typeof entry === "object" &&
+            entry !== null &&
+            typeof record.callerId === "string" &&
+            record.callerId !== "" &&
+            typeof record.keyHash === "string" &&
+            API_KEY_HASH_PATTERN.test(record.keyHash);
+        if (!validEntry) {
+            throw new Error(`PARMANA_API_KEYS[${index}] is invalid. Each entry must be ` +
+                '{ "callerId": non-empty string, "keyHash": 64-character lowercase hex }.');
+        }
+        const allowedPrincipalIds = record.allowedPrincipalIds;
+        if (allowedPrincipalIds !== undefined) {
+            const validAllowedPrincipalIds = Array.isArray(allowedPrincipalIds) &&
+                allowedPrincipalIds.every((id) => typeof id === "string" && id !== "");
+            if (!validAllowedPrincipalIds) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedPrincipalIds must be an array ` +
+                    "of non-empty strings when present.");
+            }
+        }
+        const allowedCapabilities = record.allowedCapabilities;
+        if (allowedCapabilities !== undefined) {
+            const validAllowedCapabilities = Array.isArray(allowedCapabilities) &&
+                allowedCapabilities.every((capability) => typeof capability === "string" && capability !== "");
+            if (!validAllowedCapabilities) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedCapabilities must be an array ` +
+                    'of non-empty strings when present. Use "*" as an entry to ' +
+                    "grant every capability.");
+            }
+        }
+        const allowedTenantIds = record.allowedTenantIds;
+        if (allowedTenantIds !== undefined) {
+            const validAllowedTenantIds = Array.isArray(allowedTenantIds) &&
+                allowedTenantIds.every((id) => typeof id === "string" && id !== "");
+            if (!validAllowedTenantIds) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedTenantIds must be an array ` +
+                    "of non-empty strings when present.");
+            }
+        }
+        const credentialHolderType = record.credentialHolderType;
+        if (credentialHolderType !== undefined) {
+            const validCredentialHolderType = typeof credentialHolderType === "string" &&
+                Object.values(AuthorityType).includes(credentialHolderType);
+            if (!validCredentialHolderType) {
+                throw new Error(`PARMANA_API_KEYS[${index}].credentialHolderType must be one of ` +
+                    `${Object.values(AuthorityType).join(", ")} when present.`);
+            }
+        }
+        const stepUpPublicKey = record.stepUpPublicKey;
+        if (stepUpPublicKey !== undefined) {
+            const validShape = typeof stepUpPublicKey === "string" && stepUpPublicKey.trim() !== "";
+            let validKey = false;
+            if (validShape) {
+                try {
+                    const keyObject = createPublicKey(stepUpPublicKey);
+                    validKey = keyObject.asymmetricKeyType === "ed25519";
+                }
+                catch {
+                    validKey = false;
+                }
+            }
+            if (!validShape || !validKey) {
+                throw new Error(`PARMANA_API_KEYS[${index}].stepUpPublicKey must be a PEM-encoded ` +
+                    "Ed25519 public key when present.");
+            }
+        }
+        return {
+            callerId: record.callerId,
+            keyHash: record.keyHash,
+            ...(allowedPrincipalIds !== undefined
+                ? { allowedPrincipalIds: allowedPrincipalIds }
+                : {}),
+            ...(allowedCapabilities !== undefined
+                ? { allowedCapabilities: allowedCapabilities }
+                : {}),
+            ...(allowedTenantIds !== undefined
+                ? { allowedTenantIds: allowedTenantIds }
+                : {}),
+            ...(credentialHolderType !== undefined
+                ? { credentialHolderType: credentialHolderType }
+                : {}),
+            ...(stepUpPublicKey !== undefined
+                ? { stepUpPublicKey: stepUpPublicKey }
+                : {}),
+        };
+    });
+}
+//# sourceMappingURL=ConfigValidation.js.map

package/dist/config/ConfigValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigValidation.js","sourceRoot":"","sources":["../../src/config/ConfigValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAEX,cAAc,EAEd,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAoB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,SAAS,KAAK,CACZ,KAAyB,EACzB,MAAyB,EACzB,IAAY,EACZ,YAAe;IAEf,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY,CAAC;IAEvC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAa,CAAC,EAAE,CAAC;QAClD,OAAO,QAAa,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAmB,EAAE;IACtE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CACV,KAAK,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,CAAC,MAAM,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAc,EAAE,CAC5D,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAiB,EAAE,CAClE,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAuC;IACtE,WAAW,EAAE,mBAAmB,CAAC,UAAU;CAC5C,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAsB,EAAE,CAC5E,KAAK,CACH,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAC3E,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,CAAC,OAAO,CAC5B,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAe,EAAE,CAC9D,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAmB,EAAE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qDAAqD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAgB,EAAE,CAChE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;AAEjE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2CAA2C;YACzC,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAe,EAAE;QAC9C,MAAM,MAAM,GAAG,KAAgC,CAAC;QAEhD,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,mCAAmC;gBAC1D,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAEvD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAClC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEzE,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,yCAAyC;oBAChE,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAEvD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAClC,mBAAmB,CAAC,KAAK,CACvB,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,CACpE,CAAC;YAEJ,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,yCAAyC;oBAChE,4DAA4D;oBAC5D,yBAAyB,CAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAEjD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC/B,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,sCAAsC;oBAC7D,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAEzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,yBAAyB,GAC7B,OAAO,oBAAoB,KAAK,QAAQ;gBACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,CACnC,oBAAqC,CACtC,CAAC;YAEJ,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,wCAAwC;oBAC/D,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAE/C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAEvE,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,eAAe,CAAC,eAAyB,CAAC,CAAC;oBAC7D,QAAQ,GAAG,SAAS,CAAC,iBAAiB,KAAK,SAAS,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,0CAA0C;oBACjE,kCAAkC,CACrC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAkB;YACnC,OAAO,EAAE,MAAM,CAAC,OAAiB;YACjC,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAwC,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAwC,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,gBAAgB,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAqC,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,oBAAoB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAqC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,eAAyB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}