@proteinjs/user-server 1.13.0 → 1.15.0

package/dist/test/SharedScopeEncryption.integration.test.js

@@ -0,0 +1,571 @@
+"use strict";
+var __extends = (this && this.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var db_1 = require("@proteinjs/db");
+var test_1 = require("@proteinjs/db-driver-spanner/test");
+var user_1 = require("@proteinjs/user");
+var UserServerTestEnvironment_1 = require("./UserServerTestEnvironment");
+var EncSharedNoteTable = /** @class */ (function (_super) {
+    __extends(EncSharedNoteTable, _super);
+    function EncSharedNoteTable() {
+        var _this = _super !== null && _super.apply(this, arguments) || this;
+        _this.name = 'user_test_enc_shared_note';
+        _this.auth = {
+            db: { all: 'authenticated' },
+            service: { all: 'authenticated' },
+        };
+        _this.columns = (0, user_1.withSharedRecordColumns)({
+            title: new db_1.StringColumn('title', { encrypted: { searchable: 'contains' } }),
+            label: new db_1.StringColumn('label', { encrypted: { searchable: 'equality' } }),
+            body: new db_1.StringColumn('body', { encrypted: {} }, 'MAX'),
+            kind: new db_1.StringColumn('kind', { encrypted: false }),
+        });
+        return _this;
+    }
+    return EncSharedNoteTable;
+}(db_1.Table));
+var testEnv = new UserServerTestEnvironment_1.UserServerTestEnvironment();
+var noteTable = new EncSharedNoteTable();
+var keyOwners = new user_1.SharedScopeKeyOwners();
+var envelope = new db_1.EncryptionEnvelope();
+var rawColumn = function (id, columnName) { return __awaiter(void 0, void 0, void 0, function () {
+    var rows;
+    var _a;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0: return [4 /*yield*/, testEnv.spannerDriver.runQuery(function () { return ({
+                    sql: "SELECT `".concat(columnName, "` FROM `").concat(noteTable.name, "` WHERE `id` = '").concat(id, "'"),
+                }); })];
+            case 1:
+                rows = _b.sent();
+                return [2 /*return*/, (_a = rows[0]) === null || _a === void 0 ? void 0 : _a[columnName]];
+        }
+    });
+}); };
+var titleLike = function (pattern) {
+    return new db_1.QueryBuilder(noteTable.name).condition({ field: 'title', operator: 'LIKE', value: pattern });
+};
+var clearResolvedOwnerCache = function () {
+    var _a;
+    (_a = globalThis['__proteinjs_user_sharedScopeOwnerCache']) === null || _a === void 0 ? void 0 : _a.clear();
+};
+describe('Shared-scope encryption: owner-keyed scopes, share/revoke, support path', function () {
+    var dropTestTable = (0, test_1.getDropTestTable)(testEnv.spannerDriver);
+    var owner; // O — creates the document
+    var writer; // W — write-grant contributor
+    var support; // S — the §4.4 support principal (read grant via the help flow)
+    var stranger; // X — never granted
+    var coOwner; // C — conferred owner (owner-ceiling path)
+    var root;
+    var supportGrantId;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        var tableManager, db;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, testEnv.beforeAll()];
+                case 1:
+                    _a.sent();
+                    // Register the suite's table for name-based resolution (statement generation and the
+                    // derived token-table subqueries resolve through `tableByName`), then create the
+                    // physical schema: the framework's key table + the note table (its token table and
+                    // companion columns ride the same load).
+                    (0, db_1.getTables)().push(noteTable);
+                    tableManager = testEnv.spannerDriver.getTableManager();
+                    return [4 /*yield*/, tableManager.loadTable(new db_1.DataEncryptionKeyTable())];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, tableManager.loadTable(noteTable)];
+                case 3:
+                    _a.sent();
+                    (0, db_1.setDbEncryptionConfig)({
+                        masterKeyProvider: new db_1.InMemoryMasterKeyProvider('shared-scope-encryption-test'),
+                        resolveKeyOwner: function (args) { return keyOwners.resolveKeyOwner(args); },
+                        getAccessibleKeyOwners: function (args) { return keyOwners.getAccessibleKeyOwners(args); },
+                    });
+                    db = (0, db_1.getDbAsSystem)();
+                    return [4 /*yield*/, db.delete(user_1.tables.AccessGrant, {})];
+                case 4:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(user_1.tables.User, {})];
+                case 5:
+                    _a.sent();
+                    return [4 /*yield*/, db.delete(new db_1.DataEncryptionKeyTable(), {})];
+                case 6:
+                    _a.sent();
+                    clearResolvedOwnerCache();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Enc Owner', email: 'enc-owner@test.local' })];
+                case 7:
+                    owner = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Enc Writer', email: 'enc-writer@test.local' })];
+                case 8:
+                    writer = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Enc Support', email: 'enc-support@test.local' })];
+                case 9:
+                    support = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Enc Stranger', email: 'enc-stranger@test.local' })];
+                case 10:
+                    stranger = _a.sent();
+                    return [4 /*yield*/, testEnv.createUser({ name: 'Enc CoOwner', email: 'enc-coowner@test.local' })];
+                case 11:
+                    coOwner = _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 180000);
+    afterAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    (0, db_1.setDbEncryptionConfig)(undefined);
+                    clearResolvedOwnerCache();
+                    return [4 /*yield*/, dropTestTable(new db_1.EncryptedColumns().tokenTableFor(noteTable))];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, dropTestTable(noteTable)];
+                case 2:
+                    _a.sent();
+                    return [4 /*yield*/, dropTestTable(new db_1.DataEncryptionKeyTable())];
+                case 3:
+                    _a.sent();
+                    return [4 /*yield*/, testEnv.afterAll()];
+                case 4:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
+    test('root birth: the creator keys the scope — ciphertext at rest names the owner', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _i, _a, columnName, stored, _b, grants, keyRows, fetched;
+        return __generator(this, function (_c) {
+            switch (_c.label) {
+                case 0:
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().insert(noteTable, {
+                            title: 'Therapy notes shared scope',
+                            label: 'case-407',
+                            body: 'The sensitive body text',
+                            kind: 'note',
+                        })];
+                case 1:
+                    root = _c.sent();
+                    _i = 0, _a = ['title', 'label', 'body'];
+                    _c.label = 2;
+                case 2:
+                    if (!(_i < _a.length)) return [3 /*break*/, 5];
+                    columnName = _a[_i];
+                    return [4 /*yield*/, rawColumn(root.id, columnName)];
+                case 3:
+                    stored = _c.sent();
+                    expect(envelope.isEnvelope(stored)).toBe(true);
+                    expect(String(stored)).not.toContain('Therapy');
+                    expect(String(stored)).not.toContain('sensitive');
+                    expect(envelope.parse(stored).owner).toBe(owner.id);
+                    _c.label = 4;
+                case 4:
+                    _i++;
+                    return [3 /*break*/, 2];
+                case 5:
+                    _b = expect;
+                    return [4 /*yield*/, rawColumn(root.id, 'kind')];
+                case 6:
+                    _b.apply(void 0, [_c.sent()]).toBe('note');
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(user_1.tables.AccessGrant, new db_1.QueryBuilder(user_1.tables.AccessGrant.name)
+                            .condition({ field: 'resource', operator: '=', value: root.id })
+                            .condition({ field: 'accessLevel', operator: '=', value: 'owner' }))];
+                case 7:
+                    grants = _c.sent();
+                    expect(grants.map(function (grant) { var _a; return (_a = grant.principal) === null || _a === void 0 ? void 0 : _a._id; })).toEqual([owner.id]);
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(new db_1.DataEncryptionKeyTable(), {})];
+                case 8:
+                    keyRows = _c.sent();
+                    expect(keyRows.map(function (row) { return row.owner; })).toEqual([owner.id]);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: root.id })];
+                case 9:
+                    fetched = _c.sent();
+                    expect(fetched.title).toBe('Therapy notes shared scope');
+                    expect(fetched.body).toBe('The sensitive body text');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('share with support: a read grant extends decrypt + search to the recipient (§4.4)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var supportGrant, fetched, found, byLabel, supportKeys;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    // O performs the share — an ordinary direct grant, exactly what the help-flow
+                    // affordance will mint. Caller-context: the grant table's own gate admits O (owner).
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, db_1.getDb)().insert(user_1.tables.AccessGrant, {
+                            principal: new db_1.Reference(user_1.tables.User.name, support.id),
+                            resource: new db_1.Reference(noteTable.name, root.id),
+                            resourceTable: noteTable.name,
+                            accessLevel: 'read',
+                        })];
+                case 1:
+                    supportGrant = _a.sent();
+                    supportGrantId = supportGrant.id;
+                    testEnv.actAs(support);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: root.id })];
+                case 2:
+                    fetched = _a.sent();
+                    expect(fetched.title).toBe('Therapy notes shared scope');
+                    expect(fetched.body).toBe('The sensitive body text');
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%Therapy notes%'))];
+                case 3:
+                    found = _a.sent();
+                    expect(found.map(function (row) { return row.id; })).toEqual([root.id]);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, { label: 'case-407' })];
+                case 4:
+                    byLabel = _a.sent();
+                    expect(byLabel.map(function (row) { return row.id; })).toEqual([root.id]);
+                    return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(new db_1.DataEncryptionKeyTable(), {
+                            owner: support.id,
+                        })];
+                case 5:
+                    supportKeys = _a.sent();
+                    expect(supportKeys.length).toBe(0);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('a stranger sees nothing: no rows, and search covers only their own (empty) key set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a, _b, _c;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(stranger);
+                    _a = expect;
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: root.id })];
+                case 1:
+                    _a.apply(void 0, [_d.sent()]).toBeUndefined();
+                    _b = expect;
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%Therapy%'))];
+                case 2:
+                    _b.apply(void 0, [_d.sent()]).toEqual([]);
+                    _c = expect;
+                    return [4 /*yield*/, keyOwners.getAccessibleKeyOwners({ runAsSystem: false })];
+                case 3:
+                    _c.apply(void 0, [_d.sent()]).toEqual([stranger.id]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test("a contributor's write into the shared scope keys under the DOCUMENT owner, not the writer", function () { return __awaiter(void 0, void 0, void 0, function () {
+        var child, stored, own, _a, _b, _c, lineRows, noteRows;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, db_1.getDb)().insert(user_1.tables.AccessGrant, {
+                            principal: new db_1.Reference(user_1.tables.User.name, writer.id),
+                            resource: new db_1.Reference(noteTable.name, root.id),
+                            resourceTable: noteTable.name,
+                            accessLevel: 'write',
+                        })];
+                case 1:
+                    _d.sent();
+                    // Fresh resolution (no cache): the write must derive the owner from the GRANT record.
+                    clearResolvedOwnerCache();
+                    testEnv.actAs(writer);
+                    return [4 /*yield*/, (0, user_1.getSharedDbWithOverride)().insert(noteTable, {
+                            title: 'Contributor note addendum line',
+                            label: 'addendum',
+                            body: null,
+                            kind: 'note',
+                            permissionSource: new db_1.Reference(noteTable.name, root.id),
+                        })];
+                case 2:
+                    child = _d.sent();
+                    return [4 /*yield*/, rawColumn(child.id, 'title')];
+                case 3:
+                    stored = _d.sent();
+                    expect(envelope.isEnvelope(stored)).toBe(true);
+                    expect(envelope.parse(stored).owner).toBe(owner.id);
+                    expect(envelope.parse(stored).owner).not.toBe(writer.id);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().insert(noteTable, {
+                            title: 'Writer private note planning',
+                            label: 'own',
+                            body: null,
+                            kind: 'note',
+                        })];
+                case 4:
+                    own = _d.sent();
+                    _a = expect;
+                    _c = (_b = envelope).parse;
+                    return [4 /*yield*/, rawColumn(own.id, 'title')];
+                case 5:
+                    _a.apply(void 0, [_c.apply(_b, [_d.sent()]).owner]).toBe(writer.id);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%addendum line%'))];
+                case 6:
+                    lineRows = _d.sent();
+                    expect(lineRows.map(function (row) { return row.title; })).toEqual(['Contributor note addendum line']);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%note%'))];
+                case 7:
+                    noteRows = _d.sent();
+                    expect(noteRows.map(function (row) { return row.title; }).sort()).toEqual([
+                        'Contributor note addendum line',
+                        'Therapy notes shared scope',
+                        'Writer private note planning',
+                    ]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('owner key rotation honors shares: old and new envelopes both decrypt and search for the recipient', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var newVersion, rotated, _a, _b, _c, _d, _e, _f, fetchedOld, fetchedNew, lower, both;
+        return __generator(this, function (_g) {
+            switch (_g.label) {
+                case 0: return [4 /*yield*/, new db_1.DataKeyStore().rotateKey(owner.id)];
+                case 1:
+                    newVersion = _g.sent();
+                    expect(newVersion).toBe(2);
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, user_1.getSharedDbWithOverride)().insert(noteTable, {
+                            title: 'Post-rotation Therapy addendum',
+                            label: 'rotated',
+                            body: null,
+                            kind: 'note',
+                            permissionSource: new db_1.Reference(noteTable.name, root.id),
+                        })];
+                case 2:
+                    rotated = _g.sent();
+                    _a = expect;
+                    _c = (_b = envelope).parse;
+                    return [4 /*yield*/, rawColumn(rotated.id, 'title')];
+                case 3:
+                    _a.apply(void 0, [_c.apply(_b, [_g.sent()]).version]).toBe(2);
+                    _d = expect;
+                    _f = (_e = envelope).parse;
+                    return [4 /*yield*/, rawColumn(root.id, 'title')];
+                case 4:
+                    _d.apply(void 0, [_f.apply(_e, [_g.sent()]).version]).toBe(1);
+                    testEnv.actAs(support);
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: root.id })];
+                case 5:
+                    fetchedOld = _g.sent();
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: rotated.id })];
+                case 6:
+                    fetchedNew = _g.sent();
+                    expect(fetchedOld.title).toBe('Therapy notes shared scope');
+                    expect(fetchedNew.title).toBe('Post-rotation Therapy addendum');
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%therapy%'))];
+                case 7:
+                    lower = _g.sent();
+                    expect(lower.length).toBe(0); // LIKE stays case-exact over encrypted values
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%Therapy%'))];
+                case 8:
+                    both = _g.sent();
+                    expect(both.map(function (row) { return row.id; }).sort()).toEqual([root.id, rotated.id].sort());
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('conferred co-ownership: the scope keeps keying by its ORIGINAL owner, and the co-owner searches it', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var coWrite, _a, _b, _c, accessible, found;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, db_1.getDb)().insert(user_1.tables.AccessGrant, {
+                            principal: new db_1.Reference(user_1.tables.User.name, coOwner.id),
+                            resource: new db_1.Reference(noteTable.name, root.id),
+                            resourceTable: noteTable.name,
+                            accessLevel: 'owner', // legal: O holds owner (the owner-ceiling path)
+                        })];
+                case 1:
+                    _d.sent();
+                    // Fresh resolution (no cache): the EARLIEST owner grant — O's — still keys new writes.
+                    clearResolvedOwnerCache();
+                    testEnv.actAs(coOwner);
+                    return [4 /*yield*/, (0, user_1.getSharedDbWithOverride)().insert(noteTable, {
+                            title: 'Co-owner amendment entry',
+                            label: 'co-owner',
+                            body: null,
+                            kind: 'note',
+                            permissionSource: new db_1.Reference(noteTable.name, root.id),
+                        })];
+                case 2:
+                    coWrite = _d.sent();
+                    _a = expect;
+                    _c = (_b = envelope).parse;
+                    return [4 /*yield*/, rawColumn(coWrite.id, 'title')];
+                case 3:
+                    _a.apply(void 0, [_c.apply(_b, [_d.sent()]).owner]).toBe(owner.id);
+                    return [4 /*yield*/, keyOwners.getAccessibleKeyOwners({ runAsSystem: false })];
+                case 4:
+                    accessible = _d.sent();
+                    expect(accessible.sort()).toEqual([coOwner.id, owner.id].sort());
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%amendment%'))];
+                case 5:
+                    found = _d.sent();
+                    expect(found.map(function (row) { return row.id; })).toEqual([coWrite.id]);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('revocation ends access and fan-out immediately — with NO re-encryption', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var cipherBefore, revoked, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, rawColumn(root.id, 'title')];
+                case 1:
+                    cipherBefore = _e.sent();
+                    testEnv.actAs(owner);
+                    return [4 /*yield*/, (0, db_1.getDb)().delete(user_1.tables.AccessGrant, { id: supportGrantId })];
+                case 2:
+                    revoked = _e.sent();
+                    expect(revoked).toBe(1);
+                    testEnv.actAs(support);
+                    _a = expect;
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().get(noteTable, { id: root.id })];
+                case 3:
+                    _a.apply(void 0, [_e.sent()]).toBeUndefined();
+                    _b = expect;
+                    return [4 /*yield*/, (0, user_1.getSharedDb)().query(noteTable, titleLike('%Therapy%'))];
+                case 4:
+                    _b.apply(void 0, [_e.sent()]).toEqual([]);
+                    _c = expect;
+                    return [4 /*yield*/, keyOwners.getAccessibleKeyOwners({ runAsSystem: false })];
+                case 5:
+                    _c.apply(void 0, [_e.sent()]).toEqual([support.id]);
+                    // Keys are not access control: the row's ciphertext is byte-identical — revocation is
+                    // the permission layer's act, never a re-encryption.
+                    _d = expect;
+                    return [4 /*yield*/, rawColumn(root.id, 'title')];
+                case 6:
+                    // Keys are not access control: the row's ciphertext is byte-identical — revocation is
+                    // the permission layer's act, never a re-encryption.
+                    _d.apply(void 0, [_e.sent()]).toBe(cipherBefore);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('system reads decrypt without caller context — the compliance-decrypt seam composes', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var fetched;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().get(noteTable, { id: root.id })];
+                case 1:
+                    fetched = _a.sent();
+                    expect(fetched.title).toBe('Therapy notes shared scope');
+                    expect(fetched.body).toBe('The sensitive body text');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('system searches cover EVERY key owner — an unscoped query never silently misses a scope', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var rows, rowOwners, _i, rows_1, row, _a, _b, _c, _d;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0: return [4 /*yield*/, (0, db_1.getDbAsSystem)().query(noteTable, titleLike('%note%'))];
+                case 1:
+                    rows = _e.sent();
+                    rowOwners = new Set();
+                    _i = 0, rows_1 = rows;
+                    _e.label = 2;
+                case 2:
+                    if (!(_i < rows_1.length)) return [3 /*break*/, 5];
+                    row = rows_1[_i];
+                    _b = (_a = rowOwners).add;
+                    _d = (_c = envelope).parse;
+                    return [4 /*yield*/, rawColumn(row.id, 'title')];
+                case 3:
+                    _b.apply(_a, [_d.apply(_c, [_e.sent()]).owner]);
+                    _e.label = 4;
+                case 4:
+                    _i++;
+                    return [3 /*break*/, 2];
+                case 5:
+                    // Spans O's scope AND W's private document — both key owners covered in one query.
+                    expect(rowOwners.has(owner.id)).toBe(true);
+                    expect(rowOwners.has(writer.id)).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('the resolver contract: non-shared tables fall through; caller-less searches refuse loudly', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    _a = expect;
+                    return [4 /*yield*/, keyOwners.resolveKeyOwner({ table: user_1.tables.User, record: owner })];
+                case 1:
+                    _a.apply(void 0, [_b.sent()]).toBeUndefined();
+                    testEnv.actAs({});
+                    return [4 /*yield*/, expect(keyOwners.getAccessibleKeyOwners({ runAsSystem: false })).rejects.toThrow(/without a caller identity/)];
+                case 2:
+                    _b.sent();
+                    testEnv.actAs(owner);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    test('crypto-shred: deleting the owner keys makes every envelope in the scope permanently unreadable', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var deleted;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, new db_1.DataKeyStore().shredOwnerKeys(owner.id)];
+                case 1:
+                    deleted = _a.sent();
+                    expect(deleted).toBeGreaterThanOrEqual(2); // v1 + v2
+                    return [4 /*yield*/, expect((0, db_1.getDbAsSystem)().get(noteTable, { id: root.id })).rejects.toThrow(/No data key exists for owner/)];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+//# sourceMappingURL=SharedScopeEncryption.integration.test.js.map

package/dist/test/SharedScopeEncryption.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SharedScopeEncryption.integration.test.js","sourceRoot":"","sources":["../../test/SharedScopeEncryption.integration.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oCAcuB;AAEvB,0DAAqE;AACrE,wCASyB;AACzB,yEAAwE;AAsBxE;IAAiC,sCAAoB;IAArD;QAAA,qEAYC;QAXC,UAAI,GAAG,2BAA2B,CAAC;QACnC,UAAI,GAAiC;YACnC,EAAE,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;YAC5B,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;SAClC,CAAC;QACF,aAAO,GAAG,IAAA,8BAAuB,EAAgB;YAC/C,KAAK,EAAE,IAAI,iBAAY,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;YAC3E,KAAK,EAAE,IAAI,iBAAY,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;YAC3E,IAAI,EAAE,IAAI,iBAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC;YACxD,IAAI,EAAE,IAAI,iBAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;SACrD,CAAC,CAAC;;IACL,CAAC;IAAD,yBAAC;AAAD,CAAC,AAZD,CAAiC,UAAK,GAYrC;AAED,IAAM,OAAO,GAAG,IAAI,qDAAyB,EAAE,CAAC;AAChD,IAAM,SAAS,GAAG,IAAI,kBAAkB,EAA0B,CAAC;AACnE,IAAM,SAAS,GAAG,IAAI,2BAAoB,EAAE,CAAC;AAC7C,IAAM,QAAQ,GAAG,IAAI,uBAAkB,EAAE,CAAC;AAE1C,IAAM,SAAS,GAAG,UAAO,EAAU,EAAE,UAAkB;;;;;oBACxC,qBAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAM,OAAA,CAAC;oBACvD,GAAG,EAAE,kBAAY,UAAU,qBAAa,SAAS,CAAC,IAAI,6BAAsB,EAAE,MAAG;iBAClF,CAAC,EAFsD,CAEtD,CAAC,EAAA;;gBAFG,IAAI,GAAG,SAEV;gBACH,sBAAO,MAAA,IAAI,CAAC,CAAC,CAAC,0CAAG,UAAU,CAAC,EAAC;;;KAC9B,CAAC;AAEF,IAAM,SAAS,GAAG,UAAC,OAAe;IAChC,OAAA,IAAI,iBAAY,CAAgB,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAA/G,CAA+G,CAAC;AAElH,IAAM,uBAAuB,GAAG;;IAC9B,MAAE,UAAkB,CAAC,wCAAwC,CAAsC,0CAAE,KAAK,EAAE,CAAC;AAC/G,CAAC,CAAC;AAEF,QAAQ,CAAC,yEAAyE,EAAE;IAClF,IAAM,aAAa,GAAG,IAAA,uBAAgB,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,KAAW,CAAC,CAAC,2BAA2B;IAC5C,IAAI,MAAY,CAAC,CAAC,8BAA8B;IAChD,IAAI,OAAa,CAAC,CAAC,gEAAgE;IACnF,IAAI,QAAc,CAAC,CAAC,oBAAoB;IACxC,IAAI,OAAa,CAAC,CAAC,2CAA2C;IAC9D,IAAI,IAAmB,CAAC;IACxB,IAAI,cAAsB,CAAC;IAE3B,SAAS,CAAC;;;;wBACR,qBAAM,OAAO,CAAC,SAAS,EAAE,EAAA;;oBAAzB,SAAyB,CAAC;oBAC1B,qFAAqF;oBACrF,iFAAiF;oBACjF,mFAAmF;oBACnF,yCAAyC;oBACxC,IAAA,cAAS,GAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxC,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;oBAC7D,qBAAM,YAAY,CAAC,SAAS,CAAC,IAAI,2BAAsB,EAAE,CAAC,EAAA;;oBAA1D,SAA0D,CAAC;oBAC3D,qBAAM,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;oBAExC,IAAA,0BAAqB,EAAC;wBACpB,iBAAiB,EAAE,IAAI,8BAAyB,CAAC,8BAA8B,CAAC;wBAChF,eAAe,EAAE,UAAC,IAAI,IAAK,OAAA,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,EAA/B,CAA+B;wBAC1D,sBAAsB,EAAE,UAAC,IAAI,IAAK,OAAA,SAAS,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAtC,CAAsC;qBACzE,CAAC,CAAC;oBAEG,EAAE,GAAG,IAAA,kBAAa,GAAE,CAAC;oBAC3B,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE,EAAE,CAAC,EAAA;;oBAAvC,SAAuC,CAAC;oBACxC,qBAAM,EAAE,CAAC,MAAM,CAAC,aAAM,CAAC,IAAI,EAAE,EAAE,CAAC,EAAA;;oBAAhC,SAAgC,CAAC;oBACjC,qBAAM,EAAE,CAAC,MAAM,CAAC,IAAI,2BAAsB,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAClD,uBAAuB,EAAE,CAAC;oBAElB,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,EAAA;;oBAAtF,KAAK,GAAG,SAA8E,CAAC;oBAC9E,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,EAAA;;oBAAzF,MAAM,GAAG,SAAgF,CAAC;oBAChF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAA;;oBAA5F,OAAO,GAAG,SAAkF,CAAC;oBAClF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,EAAA;;oBAA/F,QAAQ,GAAG,SAAoF,CAAC;oBACtF,qBAAM,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,EAAA;;oBAA5F,OAAO,GAAG,SAAkF,CAAC;;;;SAC9F,EAAE,MAAM,CAAC,CAAC;IAEX,QAAQ,CAAC;;;;oBACP,IAAA,0BAAqB,EAAC,SAAS,CAAC,CAAC;oBACjC,uBAAuB,EAAE,CAAC;oBAC1B,qBAAM,aAAa,CAAC,IAAI,qBAAgB,EAAE,CAAC,aAAa,CAAC,SAAS,CAAE,CAAC,EAAA;;oBAArE,SAAqE,CAAC;oBACtE,qBAAM,aAAa,CAAC,SAAS,CAAC,EAAA;;oBAA9B,SAA8B,CAAC;oBAC/B,qBAAM,aAAa,CAAC,IAAI,2BAAsB,EAAE,CAAC,EAAA;;oBAAjD,SAAiD,CAAC;oBAClD,qBAAM,OAAO,CAAC,QAAQ,EAAE,EAAA;;oBAAxB,SAAwB,CAAC;;;;SAC1B,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,6EAA6E,EAAE;;;;;oBAClF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACd,qBAAM,IAAA,kBAAW,GAAE,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC3C,KAAK,EAAE,4BAA4B;4BACnC,KAAK,EAAE,UAAU;4BACjB,IAAI,EAAE,yBAAyB;4BAC/B,IAAI,EAAE,MAAM;yBACb,CAAC,EAAA;;oBALF,IAAI,GAAG,SAKL,CAAC;0BAIgD,EAA1B,MAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;;;yBAA1B,CAAA,cAA0B,CAAA;oBAAxC,UAAU;oBACJ,qBAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,EAAA;;oBAA7C,MAAM,GAAG,SAAoC;oBACnD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;oBAClD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;;;oBAL9B,IAA0B,CAAA;;;oBAOnD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,EAAA;;oBAAvC,kBAAO,SAAgC,EAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAGvC,qBAAM,IAAA,kBAAa,GAAe,CAAC,KAAK,CACrD,aAAM,CAAC,WAAW,EAClB,IAAI,iBAAY,CAAc,aAAM,CAAC,WAAW,CAAC,IAAI,CAAC;6BACnD,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;6BAC/D,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACtE,EAAA;;oBALK,MAAM,GAAG,SAKd;oBACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAC,KAAK,YAAK,OAAA,MAAA,KAAK,CAAC,SAAS,0CAAE,GAAG,CAAA,EAAA,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAGxD,qBAAM,IAAA,kBAAa,GAAqB,CAAC,KAAK,CAAC,IAAI,2BAAsB,EAAE,EAAE,EAAE,CAAC,EAAA;;oBAA1F,OAAO,GAAG,SAAgF;oBAChG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,KAAK,EAAT,CAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;oBAG5C,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBACnE,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC1D,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;;;;SACvD,CAAC,CAAC;IAEH,IAAI,CAAC,mFAAmF,EAAE;;;;;oBACxF,8EAA8E;oBAC9E,qFAAqF;oBACrF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACA,qBAAM,IAAA,UAAK,GAAe,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE;4BACzE,SAAS,EAAE,IAAI,cAAS,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACtD,QAAQ,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;4BAChD,aAAa,EAAE,SAAS,CAAC,IAAI;4BAC7B,WAAW,EAAE,MAAM;yBACpB,CAAC,EAAA;;oBALI,YAAY,GAAG,SAKnB;oBACF,cAAc,GAAG,YAAY,CAAC,EAAE,CAAC;oBAEjC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACP,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA7D,OAAO,GAAG,SAAmD;oBACnE,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC1D,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAIxC,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,EAAA;;oBAA1E,KAAK,GAAG,SAAkE;oBAChF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,EAAE,EAAN,CAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBACtC,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAA4B,CAAC,EAAA;;oBAA/F,OAAO,GAAG,SAAqF;oBACrG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,EAAE,EAAN,CAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;oBAGpC,qBAAM,IAAA,kBAAa,GAAqB,CAAC,KAAK,CAAC,IAAI,2BAAsB,EAAE,EAAE;4BAC/F,KAAK,EAAE,OAAO,CAAC,EAAE;yBACY,CAAC,EAAA;;oBAF1B,WAAW,GAAG,SAEY;oBAChC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;;;SACpC,CAAC,CAAC;IAEH,IAAI,CAAC,oFAAoF,EAAE;;;;;oBACzF,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBACxB,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA1D,kBAAO,SAAmD,EAAC,CAAC,aAAa,EAAE,CAAC;oBAC5E,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACjF,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAArE,kBAAO,SAA8D,EAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;;;;SAC/F,CAAC,CAAC;IAEH,IAAI,CAAC,2FAA2F,EAAE;;;;;oBAChG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,qBAAM,IAAA,UAAK,GAAe,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE;4BACpD,SAAS,EAAE,IAAI,cAAS,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;4BACrD,QAAQ,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;4BAChD,aAAa,EAAE,SAAS,CAAC,IAAI;4BAC7B,WAAW,EAAE,OAAO;yBACrB,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,sFAAsF;oBACtF,uBAAuB,EAAE,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACR,qBAAM,IAAA,8BAAuB,GAAE,CAAC,MAAM,CAAC,SAAS,EAAE;4BAC9D,KAAK,EAAE,gCAAgC;4BACvC,KAAK,EAAE,UAAU;4BACjB,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,MAAM;4BACZ,gBAAgB,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;yBACzD,CAAC,EAAA;;oBANI,KAAK,GAAG,SAMZ;oBAIa,qBAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAA3C,MAAM,GAAG,SAAkC;oBACjD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACrD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAG9C,qBAAM,IAAA,kBAAW,GAAE,CAAC,MAAM,CAAC,SAAS,EAAE;4BAChD,KAAK,EAAE,8BAA8B;4BACrC,KAAK,EAAE,KAAK;4BACZ,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,MAAM;yBACb,CAAC,EAAA;;oBALI,GAAG,GAAG,SAKV;oBACF,KAAA,MAAM,CAAA;oBAAC,KAAA,CAAA,KAAA,QAAQ,CAAA,CAAC,KAAK,CAAA;oBAAC,qBAAM,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAAtD,kBAAO,cAAe,SAAgC,EAAE,CAAC,KAAK,EAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAG/D,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,EAAA;;oBAA7E,QAAQ,GAAG,SAAkE;oBACnF,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,KAAK,EAAT,CAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpE,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAA;;oBAApE,QAAQ,GAAG,SAAyD;oBAC1E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,KAAK,EAAT,CAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;wBACtD,gCAAgC;wBAChC,4BAA4B;wBAC5B,8BAA8B;qBAC/B,CAAC,CAAC;;;;SACJ,CAAC,CAAC;IAEH,IAAI,CAAC,mGAAmG,EAAE;;;;wBACrF,qBAAM,IAAI,iBAAY,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAAzD,UAAU,GAAG,SAA4C;oBAC/D,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACL,qBAAM,IAAA,8BAAuB,GAAE,CAAC,MAAM,CAAC,SAAS,EAAE;4BAChE,KAAK,EAAE,gCAAgC;4BACvC,KAAK,EAAE,SAAS;4BAChB,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,MAAM;4BACZ,gBAAgB,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;yBACzD,CAAC,EAAA;;oBANI,OAAO,GAAG,SAMd;oBACF,KAAA,MAAM,CAAA;oBAAC,KAAA,CAAA,KAAA,QAAQ,CAAA,CAAC,KAAK,CAAA;oBAAC,qBAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAA1D,kBAAO,cAAe,SAAoC,EAAE,CAAC,OAAO,EAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAC9E,KAAA,MAAM,CAAA;oBAAC,KAAA,CAAA,KAAA,QAAQ,CAAA,CAAC,KAAK,CAAA;oBAAC,qBAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAAvD,kBAAO,cAAe,SAAiC,EAAE,CAAC,OAAO,EAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAE3E,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACJ,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAhE,UAAU,GAAG,SAAmD;oBACnD,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAAnE,UAAU,GAAG,SAAsD;oBACzE,MAAM,CAAC,UAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC7D,MAAM,CAAC,UAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBAEnD,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,EAAA;;oBAApE,KAAK,GAAG,SAA4D;oBAC1E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,8CAA8C;oBAC/D,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,EAAA;;oBAAnE,IAAI,GAAG,SAA4D;oBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,EAAE,EAAN,CAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;;;;SAChF,CAAC,CAAC;IAEH,IAAI,CAAC,oGAAoG,EAAE;;;;;oBACzG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACrB,qBAAM,IAAA,UAAK,GAAe,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE;4BACpD,SAAS,EAAE,IAAI,cAAS,CAAC,aAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;4BACtD,QAAQ,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;4BAChD,aAAa,EAAE,SAAS,CAAC,IAAI;4BAC7B,WAAW,EAAE,OAAO,EAAE,gDAAgD;yBACvE,CAAC,EAAA;;oBALF,SAKE,CAAC;oBAEH,uFAAuF;oBACvF,uBAAuB,EAAE,CAAC;oBAC1B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACP,qBAAM,IAAA,8BAAuB,GAAE,CAAC,MAAM,CAAC,SAAS,EAAE;4BAChE,KAAK,EAAE,0BAA0B;4BACjC,KAAK,EAAE,UAAU;4BACjB,IAAI,EAAE,IAAI;4BACV,IAAI,EAAE,MAAM;4BACZ,gBAAgB,EAAE,IAAI,cAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;yBACzD,CAAC,EAAA;;oBANI,OAAO,GAAG,SAMd;oBACF,KAAA,MAAM,CAAA;oBAAC,KAAA,CAAA,KAAA,QAAQ,CAAA,CAAC,KAAK,CAAA;oBAAC,qBAAM,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAA1D,kBAAO,cAAe,SAAoC,EAAE,CAAC,KAAK,EAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAIhE,qBAAM,SAAS,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA3E,UAAU,GAAG,SAA8D;oBACjF,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnD,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,EAAA;;oBAAtE,KAAK,GAAG,SAA8D;oBAC5E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,UAAC,GAAG,IAAK,OAAA,GAAG,CAAC,EAAE,EAAN,CAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;;;;SAC1D,CAAC,CAAC;IAEH,IAAI,CAAC,wEAAwE,EAAE;;;;wBACxD,qBAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAAhD,YAAY,GAAG,SAAiC;oBAEtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBACL,qBAAM,IAAA,UAAK,GAAE,CAAC,MAAM,CAAC,aAAM,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,EAAA;;oBAA1E,OAAO,GAAG,SAAgE;oBAChF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAExB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACvB,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,kBAAW,GAAE,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA1D,kBAAO,SAAmD,EAAC,CAAC,aAAa,EAAE,CAAC;oBAC5E,KAAA,MAAM,CAAA;oBAAC,qBAAM,IAAA,kBAAW,GAAE,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,EAAA;;oBAAnE,kBAAO,SAA4D,EAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBACjF,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAArE,kBAAO,SAA8D,EAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;oBAE7F,sFAAsF;oBACtF,qDAAqD;oBACrD,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAFxC,sFAAsF;oBACtF,qDAAqD;oBACrD,kBAAO,SAAiC,EAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;;;;SAC9D,CAAC,CAAC;IAEH,IAAI,CAAC,oFAAoF,EAAE;;;;wBAGzE,qBAAM,IAAA,kBAAa,GAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAA;;oBAA9E,OAAO,GAAG,SAAoE;oBACpF,MAAM,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC1D,MAAM,CAAC,OAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;;;;SACvD,CAAC,CAAC;IAEH,IAAI,CAAC,yFAAyF,EAAE;;;;wBACjF,qBAAM,IAAA,kBAAa,GAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAA;;oBAAjF,IAAI,GAAG,SAA0E;oBACjF,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;0BACd,EAAJ,aAAI;;;yBAAJ,CAAA,kBAAI,CAAA;oBAAX,GAAG;oBACZ,KAAA,CAAA,KAAA,SAAS,CAAA,CAAC,GAAG,CAAA;oBAAC,KAAA,CAAA,KAAA,QAAQ,CAAA,CAAC,KAAK,CAAA;oBAAC,qBAAM,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,EAAA;;oBAA7D,cAAc,cAAe,SAAgC,EAAE,CAAC,KAAK,EAAC,CAAC;;;oBADvD,IAAI,CAAA;;;oBAGtB,mFAAmF;oBACnF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;;;SAC7C,CAAC,CAAC;IAEH,IAAI,CAAC,2FAA2F,EAAE;;;;;oBAChG,KAAA,MAAM,CAAA;oBAAC,qBAAM,SAAS,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,aAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAA;;oBAA7E,kBAAO,SAAsE,EAAC,CAAC,aAAa,EAAE,CAAC;oBAE/F,OAAO,CAAC,KAAK,CAAC,EAAU,CAAC,CAAC;oBAC1B,qBAAM,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAA;;oBAAnH,SAAmH,CAAC;oBACpH,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;;;;SACtB,CAAC,CAAC;IAEH,IAAI,CAAC,gGAAgG,EAAE;;;;wBACrF,qBAAM,IAAI,iBAAY,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,EAAA;;oBAA3D,OAAO,GAAG,SAAiD;oBACjE,MAAM,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;oBACrD,qBAAM,MAAM,CAAC,IAAA,kBAAa,GAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1F,8BAA8B,CAC/B,EAAA;;oBAFD,SAEC,CAAC;;;;SACH,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}