@pyric/cli 0.1.0-alpha.26 → 0.1.0-alpha.28

package/dist/verify/staging/engine.js

@@ -0,0 +1,371 @@
+import { rewoundRtdbTree, rtdbAuthVariable, rtdbReplaySteps, rtdbStateDrift, } from 'pyric/rules/internal/rtdb';
+import { isRestDenial } from './rest.js';
+/** The comment `pyric verify staging init` puts at the top of the instance's rules. */
+export const STAGING_MARKER_PREFIX = '/* pyric verify staging:';
+export function stagingMarker(projectId, at = new Date()) {
+    return `${STAGING_MARKER_PREFIX} this instance is dedicated to \`pyric verify --engine staging\` for project ${projectId}, enrolled ${at.toISOString()}. Its rules and data are replaced while a verification runs. */`;
+}
+/** The project an enrollment marker names, or undefined when the rules carry no marker. */
+export function markedProject(rulesText) {
+    const trimmed = rulesText.trimStart();
+    if (!trimmed.startsWith(STAGING_MARKER_PREFIX))
+        return undefined;
+    return /for project ([^\s,]+),/.exec(trimmed.slice(0, trimmed.indexOf('*/') + 2))?.[1];
+}
+export class StagingSafetyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'StagingSafetyError';
+    }
+}
+/** Production refused to deploy the candidate rules; its message is the reason. */
+export class StagingDeployRefusedError extends Error {
+    instanceLabel;
+    production;
+    constructor(instanceLabel, production) {
+        super(`production refused to deploy the candidate rules for ${instanceLabel}: ${production}`);
+        this.instanceLabel = instanceLabel;
+        this.production = production;
+        this.name = 'StagingDeployRefusedError';
+    }
+}
+/** The data node a run holds while it runs; written with a conditional request, so only one run gets it. */
+export const STAGING_LEASE_KEY = '__pyric_verify_lease__';
+/**
+ * Run `fn` against the staging instance behind `client`, guarded: refuse an
+ * instance without the marker for `projectId`, with data, or with another
+ * run's lease; on every exit restore its rules and delete its data, each step
+ * attempted on its own and retried, then read both back.
+ */
+export async function withStagingInstance(client, projectId, fn, hooks = {}) {
+    const priorRules = await client.getRulesText();
+    const marked = markedProject(priorRules);
+    if (marked === undefined) {
+        throw new StagingSafetyError(`${client.databaseUrl} is not enrolled for staging verification (its rules do not start with the enrollment marker). ` +
+            'Run `pyric verify staging init` once to enroll a dedicated, empty instance. If a verification was interrupted, run `pyric verify staging restore`.');
+    }
+    if (marked !== projectId) {
+        throw new StagingSafetyError(`${client.databaseUrl} is enrolled for project ${marked}, not ${projectId}.`);
+    }
+    const root = await client.get('/', { shallow: true });
+    if (root.status !== 200)
+        throw new StagingSafetyError(`reading ${client.databaseUrl} failed: HTTP ${root.status} ${root.text.slice(0, 200)}`);
+    if (root.body !== null) {
+        const leased = typeof root.body === 'object' && root.body !== null && STAGING_LEASE_KEY in root.body;
+        throw new StagingSafetyError(leased
+            ? `another verification holds ${client.databaseUrl} (its lease is set). Wait for it to finish; if none is running, run \`pyric verify staging restore\`.`
+            : `${client.databaseUrl} holds data, so it is not a dedicated staging instance. Refusing to replace it.`);
+    }
+    const lease = { run: `${process.pid}-${Date.now().toString(36)}`, at: new Date().toISOString() };
+    const empty = await client.get(STAGING_LEASE_KEY, { etag: true });
+    const taken = empty.etag === undefined
+        ? { status: 0, text: 'no ETag', body: null }
+        : await client.put(STAGING_LEASE_KEY, lease, { ifMatch: empty.etag });
+    if (taken.status !== 200) {
+        throw new StagingSafetyError(taken.status === 412
+            ? `another verification took ${client.databaseUrl} first. Run one verification at a time per staging instance.`
+            : `taking the lease on ${client.databaseUrl} failed: HTTP ${taken.status} ${String(taken.text).slice(0, 200)}`);
+    }
+    hooks.onBeforeChange?.(priorRules);
+    let outcome;
+    try {
+        outcome = { ok: true, value: await fn() };
+    }
+    catch (error) {
+        outcome = { ok: false, error };
+    }
+    const invariants = await restoreStagingInstance(client, priorRules);
+    if (!invariants.rulesRestored || !invariants.dataRemoved) {
+        throw new StagingSafetyError(`${client.databaseUrl} was not left as it was found (rules restored: ${invariants.rulesRestored}, data removed: ${invariants.dataRemoved}${invariants.errors.length > 0 ? `; ${invariants.errors.join('; ')}` : ''}). ` +
+            'Run `pyric verify staging restore` to put it back.');
+    }
+    hooks.onRestored?.();
+    if (!outcome.ok)
+        throw outcome.error;
+    return { result: outcome.value, invariants: { rulesRestored: true, dataRemoved: true } };
+}
+/**
+ * Put a staging instance back: deploy `rulesText` first, since candidate
+ * rules may be open, then delete the data; each step on its own, retried,
+ * and read back. Never throws: the result says what holds.
+ */
+export async function restoreStagingInstance(client, rulesText) {
+    const errors = [];
+    const attempt = async (what, step) => {
+        let last = '';
+        for (let tries = 0; tries < 3; tries += 1) {
+            try {
+                if (await step())
+                    return true;
+                last = 'did not read back';
+            }
+            catch (error) {
+                last = error instanceof Error ? error.message : String(error);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 250 * (tries + 1)));
+        }
+        errors.push(`${what}: ${last}`);
+        return false;
+    };
+    const rulesRestored = await attempt('restoring the rules', async () => {
+        const put = await client.putRules(rulesText);
+        return put.status === 200 && (await client.getRulesText()) === rulesText;
+    });
+    const dataRemoved = await attempt('deleting the data', async () => {
+        const removed = await client.delete('/');
+        const back = await client.get('/', { shallow: true });
+        return removed.status === 200 && back.status === 200 && back.body === null;
+    });
+    return { rulesRestored, dataRemoved, errors };
+}
+/**
+ * Replay one captured instance's steps against the staging instance under
+ * `rules`. Call inside `withStagingInstance`; the instance must be empty.
+ */
+export async function runStagingInstance(input) {
+    const { client, events } = input;
+    const label = input.instance === undefined ? 'the default instance' : `instance "${input.instance}"`;
+    const source = JSON.stringify(input.rules, null, 2);
+    const dry = await client.putRules(source, { dryRun: true });
+    if (dry.status !== 200)
+        throw new StagingDeployRefusedError(label, productionMessage(dry));
+    const deployed = await client.putRules(source);
+    if (deployed.status !== 200)
+        throw new StagingDeployRefusedError(label, productionMessage(deployed));
+    const lease = (await expectOk(client.get(STAGING_LEASE_KEY), 'reading the lease')).body;
+    if (input.capturedState !== undefined) {
+        const initial = await rewoundRtdbTree(events, input.capturedState, input.instance);
+        if (initial !== null)
+            await expectOk(client.put('/', withLease(initial, lease)), 'seeding the session\'s starting tree');
+    }
+    const divergences = [];
+    let checkedEvents = 0;
+    const steps = rtdbReplaySteps(events, input.instance);
+    for (const [index, step] of steps.entries()) {
+        input.signal?.throwIfAborted();
+        const before = divergences.length;
+        if (step.kind === 'admin-commit') {
+            const res = await writeCommit(client, step.event, undefined, lease);
+            if (typeof res === 'string')
+                divergences.push({ kind: 'unsupported', path: pathOf(step.event), method: step.event.method, reason: res });
+            else
+                await expectOk(Promise.resolve(res), `the admin ${step.event.method} at ${step.event.path}`);
+        }
+        else if (step.kind === 'app-commit') {
+            checkedEvents += 1;
+            const res = await writeCommit(client, step.event, authOverride(step.event), lease);
+            if (typeof res === 'string')
+                divergences.push({ kind: 'unsupported', path: pathOf(step.event), method: step.event.method, reason: res });
+            else if (isRestDenial(res.status))
+                divergences.push(denied(step.event, res));
+            else if (res.status !== 200)
+                divergences.push(unsupported(step.event, res));
+        }
+        else if (step.kind === 'allowed-read') {
+            checkedEvents += 1;
+            const query = restQuery(step.event);
+            if (typeof query === 'string') {
+                divergences.push({ kind: 'unsupported', path: pathOf(step.event), method: step.event.method, reason: query });
+            }
+            else {
+                const res = await client.get(pathOf(step.event), { auth: authOverride(step.event), query });
+                if (isRestDenial(res.status))
+                    divergences.push(denied(step.event, res));
+                else if (res.status !== 200)
+                    divergences.push(unsupported(step.event, res));
+            }
+        }
+        else {
+            checkedEvents += 1;
+            await decide(client, step.event, step.kind === 'denial' ? 'deny' : 'allow', divergences, lease);
+        }
+        // Each divergence names the replay step it came from, so engines compare step for step.
+        for (const divergence of divergences.slice(before))
+            divergence.step = index;
+    }
+    if (input.capturedState !== undefined) {
+        const finalTree = await expectOk(client.get('/'), 'reading the replayed tree');
+        divergences.push(...rtdbStateDrift(input.capturedState, withoutLease(finalTree.body)));
+    }
+    return { checkedEvents, divergences };
+}
+/** A tree with the run's lease kept at the root, so a root write does not release it. */
+function withLease(tree, lease) {
+    if (lease === null || lease === undefined)
+        return tree;
+    if (tree === null || tree === undefined)
+        return { [STAGING_LEASE_KEY]: lease };
+    if (!isObject(tree))
+        return tree;
+    return { ...tree, [STAGING_LEASE_KEY]: lease };
+}
+function withoutLease(tree) {
+    if (!isObject(tree) || !(STAGING_LEASE_KEY in tree))
+        return tree;
+    const { [STAGING_LEASE_KEY]: _lease, ...rest } = tree;
+    return Object.keys(rest).length === 0 ? null : rest;
+}
+/**
+ * Attempt a captured denial or registration as its user. A write that lands
+ * is put back as admin from the subtree read before it.
+ */
+async function decide(client, event, captured, divergences, lease) {
+    const path = pathOf(event);
+    const auth = authOverride(event);
+    let res;
+    if (event.method === 'get' || event.method === 'listen') {
+        const query = restQuery(event);
+        if (typeof query === 'string') {
+            divergences.push({ kind: 'unsupported', path, method: event.method, reason: query });
+            return;
+        }
+        res = await client.get(path, { auth, query });
+    }
+    else {
+        const write = attemptedWrite(event);
+        if (typeof write === 'string') {
+            divergences.push({ kind: 'unsupported', path, method: event.method, reason: write });
+            return;
+        }
+        const before = await expectOk(client.get(write.restorePath, { format: 'export' }), `reading ${write.restorePath} before the attempt`);
+        res = await write.send(client, auth);
+        if (res.status === 200) {
+            const restored = write.restorePath === '/' ? withLease(before.body, lease) : before.body;
+            await expectOk(client.put(write.restorePath, restored), `putting ${write.restorePath} back after the attempt`);
+        }
+    }
+    if (res.status === 200) {
+        if (captured === 'deny') {
+            divergences.push({
+                kind: 'now-allowed',
+                path,
+                method: event.method,
+                reason: 'the captured rules denied this operation; production allows it under the candidate rules.',
+            });
+        }
+    }
+    else if (isRestDenial(res.status)) {
+        if (captured === 'allow')
+            divergences.push(denied(event, res));
+    }
+    else {
+        divergences.push(unsupported(event, res));
+    }
+}
+function attemptedWrite(event) {
+    const path = pathOf(event);
+    const data = event.request?.data;
+    const detail = (event.detail ?? {});
+    switch (event.method) {
+        case 'set':
+        case 'transaction':
+            return { restorePath: path, send: (client, auth) => client.put(path, withPriority(data ?? null, detail.priority), { auth }) };
+        case 'onDisconnect.set':
+            return { restorePath: path, send: (client, auth) => client.put(path, withPriority(data ?? null, detail.priority), { auth }) };
+        case 'remove':
+        case 'onDisconnect.remove':
+            return { restorePath: path, send: (client, auth) => client.delete(path, { auth }) };
+        case 'update':
+            if (!isObject(detail.patch) || typeof detail.rootPath !== 'string') {
+                return 'the capture records only the denied path of this update, not the paths written with it, so the update cannot be rebuilt.';
+            }
+            return { restorePath: detail.rootPath, send: (client, auth) => client.patch(detail.rootPath, detail.patch, { auth }) };
+        case 'onDisconnect.update':
+            if (!isObject(data))
+                return 'the captured onDisconnect update did not contain an object patch.';
+            return { restorePath: path, send: (client, auth) => client.patch(path, data, { auth }) };
+        case 'setPriority':
+            return { restorePath: path, send: (client, auth) => client.put(`${path}/.priority`, data ?? null, { auth }) };
+        default:
+            return `the staging engine does not check '${event.method}' operations.`;
+    }
+}
+/** Perform a captured commit; the reason it cannot be performed when its method is not one replay handles. */
+async function writeCommit(client, commit, auth, lease) {
+    const path = commit.path ?? '/';
+    const atRoot = path === '/';
+    const request = auth === undefined ? {} : { auth };
+    const detail = commit.detail ?? {};
+    switch (commit.method) {
+        case 'update':
+            return client.patch(path, commit.data, request);
+        case 'remove':
+            // Removing the root as admin keeps the lease; a user's removal is decided as a write of nothing.
+            return atRoot ? client.put(path, withLease(null, lease), request) : client.delete(path, request);
+        case 'setPriority':
+            return client.put(`${path}/.priority`, commit.data ?? null, request);
+        case 'transaction':
+            return client.put(path, atRoot ? withLease(commit.data ?? null, lease) : commit.data ?? null, request);
+        case 'set': {
+            const value = withPriority(commit.data ?? null, Object.hasOwn(detail, 'priority') ? detail.priority : undefined);
+            return client.put(path, atRoot ? withLease(value, lease) : value, request);
+        }
+        default:
+            return `the staging engine does not replay '${commit.method}' commits.`;
+    }
+}
+/** A value with a `.priority`, in the shape the REST API reads it; the value itself when there is none. */
+function withPriority(value, priority) {
+    if (priority === undefined || priority === null)
+        return value;
+    if (isObject(value))
+        return { ...value, '.priority': priority };
+    return { '.value': value, '.priority': priority };
+}
+/** The REST query parameters for a captured query, or the reason REST cannot express it. */
+function restQuery(event) {
+    const spec = event.request?.query;
+    if (spec === undefined)
+        return undefined;
+    const query = {};
+    const order = spec.orderBy;
+    if (order === null) {
+        if (spec.bounds.length > 0 || spec.limit !== null)
+            query.orderBy = JSON.stringify('$priority');
+    }
+    else if (order.kind === 'child') {
+        query.orderBy = JSON.stringify(order.path);
+    }
+    else {
+        query.orderBy = JSON.stringify(`$${order.kind}`);
+    }
+    for (const bound of spec.bounds) {
+        if (bound.key !== undefined)
+            return `the REST API cannot express a ${bound.kind} bound with a key.`;
+        if (bound.kind !== 'startAt' && bound.kind !== 'endAt' && bound.kind !== 'equalTo') {
+            return `the REST API has no ${bound.kind} parameter.`;
+        }
+        query[bound.kind] = JSON.stringify(bound.value);
+    }
+    if (spec.limit !== null)
+        query[spec.limit.kind] = String(spec.limit.n);
+    return query;
+}
+function authOverride(event) {
+    if (event.auth === null)
+        return null;
+    return rtdbAuthVariable(event.auth, typeof event.at === 'number' ? event.at : Date.now());
+}
+function pathOf(event) {
+    return event.path ?? '/';
+}
+function denied(event, res) {
+    return { kind: 'now-denied', path: pathOf(event), method: event.method, reason: `production denied it under the candidate rules (HTTP ${res.status}).` };
+}
+function unsupported(event, res) {
+    return { kind: 'unsupported', path: pathOf(event), method: event.method, reason: `production answered HTTP ${res.status}: ${productionMessage(res)}` };
+}
+function productionMessage(res) {
+    const error = isObject(res.body) ? res.body.error : undefined;
+    return (typeof error === 'string' ? error : res.text).slice(0, 500);
+}
+async function expectOk(pending, what) {
+    const res = await pending;
+    if (res.status !== 200)
+        throw new Error(`staging engine: ${what} failed: HTTP ${res.status} ${productionMessage(res)}`);
+    return res;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=engine.js.map

package/dist/verify/staging/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/verify/staging/engine.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,cAAc,GAEf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,YAAY,EAAqE,MAAM,WAAW,CAAC;AAE5G,uFAAuF;AACvF,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEhE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;IAC9D,OAAO,GAAG,qBAAqB,gFAAgF,SAAS,cAAc,EAAE,CAAC,WAAW,EAAE,iEAAiE,CAAC;AAC1N,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAC7B;IAAgC;IAArD,YAAqB,aAAqB,EAAW,UAAkB;QACrE,KAAK,CAAC,wDAAwD,aAAa,KAAK,UAAU,EAAE,CAAC,CAAC;QAD3E,kBAAa,GAAb,aAAa,CAAQ;QAAW,eAAU,GAAV,UAAU,CAAQ;QAErE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAQD,4GAA4G;AAC5G,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAY1D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,SAAiB,EACjB,EAAoB,EACpB,QAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC1B,GAAG,MAAM,CAAC,WAAW,iGAAiG;YACpH,oJAAoJ,CACvJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,GAAG,MAAM,CAAC,WAAW,4BAA4B,MAAM,SAAS,SAAS,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,MAAM,CAAC,WAAW,iBAAiB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9I,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,iBAAiB,IAAI,IAAI,CAAC,IAAI,CAAC;QACrG,MAAM,IAAI,kBAAkB,CAAC,MAAM;YACjC,CAAC,CAAC,8BAA8B,MAAM,CAAC,WAAW,uGAAuG;YACzJ,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,iFAAiF,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS;QACpC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5C,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,GAAG;YAClB,CAAC,CAAC,6BAA6B,MAAM,CAAC,WAAW,8DAA8D;YAC/G,CAAC,CAAC,uBAAuB,MAAM,CAAC,WAAW,iBAAiB,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACjH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,OAA+D,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,IAAI,kBAAkB,CAC1B,GAAG,MAAM,CAAC,WAAW,kDAAkD,UAAU,CAAC,aAAa,mBAAmB,UAAU,CAAC,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;YACrN,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;IACrB,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,OAAO,CAAC,KAAK,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAsB,EACtB,SAAiB;IAEjB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAA4B,EAAoB,EAAE;QACrF,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,EAAE;oBAAE,OAAO,IAAI,CAAC;gBAC9B,IAAI,GAAG,mBAAmB,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC,KAAK,SAAS,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KASxC;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,QAAQ,GAAG,CAAC;IACrG,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,yBAAyB,CAAC,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,yBAAyB,CAAC,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErG,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC;IAC3H,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;;gBACpI,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,IAAI,CAAC,KAAK,CAAC,MAAM,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtC,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACnF,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;iBACpI,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;iBACxE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxC,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5F,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;qBACnE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;aAAM,CAAC;YACN,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAClG,CAAC;QACD,wFAAwF;QACxF,KAAK,MAAM,UAAU,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;YAAG,UAAgC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrG,CAAC;IAED,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,yFAAyF;AACzF,SAAS,SAAS,CAAC,IAAa,EAAE,KAAc;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,MAAM,CACnB,MAAsB,EACtB,KAA4B,EAC5B,QAA0B,EAC1B,WAAmC,EACnC,KAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAqB,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,KAAK,CAAC,WAAW,qBAAqB,CAAC,CAAC;QACtI,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YACzF,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,CAAC,WAAW,yBAAyB,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,aAAa;gBACnB,IAAI;gBACJ,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,2FAA2F;aACpG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,QAAQ,KAAK,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAQD,SAAS,cAAc,CAAC,KAA4B;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAgE,CAAC;IACnG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,KAAK,CAAC;QACX,KAAK,aAAa;YAChB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChI,KAAK,kBAAkB;YACrB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChI,KAAK,QAAQ,CAAC;QACd,KAAK,qBAAqB;YACxB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtF,KAAK,QAAQ;YACX,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnE,OAAO,0HAA0H,CAAC;YACpI,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAkB,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnI,KAAK,qBAAqB;YACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,mEAAmE,CAAC;YAChG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3F,KAAK,aAAa;YAChB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChH;YACE,OAAO,sCAAsC,KAAK,CAAC,MAAM,eAAe,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,WAAW,CACxB,MAAsB,EACtB,MAA0B,EAC1B,IAAkC,EAClC,KAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,KAAK,QAAQ;YACX,iGAAiG;YACjG,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnG,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,KAAK,aAAa;YAChB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;QACzG,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACjH,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD;YACE,OAAO,uCAAuC,MAAM,CAAC,MAAM,YAAY,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,2GAA2G;AAC3G,SAAS,YAAY,CAAC,KAAc,EAAE,QAAiB;IACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAChE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,KAA4B;IAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,KAEf,CAAC;IACd,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACjG,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,iCAAiC,KAAK,CAAC,IAAI,oBAAoB,CAAC;QACpG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,uBAAuB,KAAK,CAAC,IAAI,aAAa,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAiD;IACrE,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAuC,CAAC;AAClI,CAAC;AAED,SAAS,MAAM,CAAC,KAAwB;IACtC,OAAO,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,KAAwC,EAAE,GAAqB;IAC7E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,wDAAwD,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AAC3J,CAAC;AAED,SAAS,WAAW,CAAC,KAAwC,EAAE,GAAqB;IAClF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,4BAA4B,GAAG,CAAC,MAAM,KAAK,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AACzJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAqB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAkC,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;IAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,iBAAiB,GAAG,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/verify/staging/rest.d.ts

@@ -0,0 +1,68 @@
+/**
+ * A minimal Realtime Database REST client for the staging engine: data reads
+ * and writes as admin or as an application user (`auth_variable_override`),
+ * and the rules endpoint (`/.settings/rules.json`).
+ *
+ * Production applies an `auth_variable_override` object as the rules `auth`
+ * variable, `auth.token` claims included; the identity capture recorded in
+ * `packages/conformance/observations/rtdb-staging/rtdb-staging-auth-override.json`
+ * pins that for every field the engine passes.
+ */
+/** The rules `auth` variable a request runs as; `null` is signed out. Absent is admin. */
+export type RtdbAuthOverride = Record<string, unknown> | null;
+export interface RtdbRestResponse {
+    status: number;
+    /** Parsed JSON body, or the raw text when it is not JSON. */
+    body: unknown;
+    text: string;
+    /** The `ETag` of the location, when the request asked for it (`etag: true`). */
+    etag?: string;
+}
+export interface RtdbRestRequest {
+    /** Run as this `auth`; absent runs as admin. */
+    auth?: RtdbAuthOverride;
+    /** REST query parameters (`orderBy`, `startAt`, ...), already JSON-encoded where REST requires it. */
+    query?: Record<string, string>;
+    /** `export` returns priorities as `.priority` keys. */
+    format?: 'export';
+    shallow?: boolean;
+    /** Ask for the location's `ETag` (a read), for a later conditional write. */
+    etag?: boolean;
+    /** Write only if the location's `ETag` is still this one; production answers 412 otherwise. */
+    ifMatch?: string;
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    text(): Promise<string>;
+    headers?: {
+        get(name: string): string | null;
+    };
+}>;
+export declare class RtdbRestClient {
+    private readonly token;
+    private readonly fetchImpl;
+    readonly databaseUrl: string;
+    constructor(databaseUrl: string, token: () => Promise<string>, fetchImpl?: FetchLike);
+    get(path: string, request?: RtdbRestRequest): Promise<RtdbRestResponse>;
+    put(path: string, value: unknown, request?: RtdbRestRequest): Promise<RtdbRestResponse>;
+    patch(path: string, value: unknown, request?: RtdbRestRequest): Promise<RtdbRestResponse>;
+    delete(path: string, request?: RtdbRestRequest): Promise<RtdbRestResponse>;
+    /** The deployed rules as stored, comments included. */
+    getRulesText(): Promise<string>;
+    /** Deploy `source` as the rules, or validate it without deploying (`dryRun`). */
+    putRules(source: string, options?: {
+        dryRun?: boolean;
+    }): Promise<RtdbRestResponse>;
+    private rules;
+    private send;
+    private fetchResponse;
+}
+/** `/a/b` for any of `a/b`, `/a/b/`, `a//b`; the root is the empty string. */
+export declare function restPath(path: string): string;
+/** Whether a REST status is the rules denying the request. */
+export declare function isRestDenial(status: number): boolean;
+//# sourceMappingURL=rest.d.ts.map

package/dist/verify/staging/rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../../src/verify/staging/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,6DAA6D;IAC7D,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,sGAAsG;IACtG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uDAAuD;IACvD,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IACzH,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAChD,CAAC,CAAC;AAEH,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAG3B,WAAW,EAAE,MAAM,EACF,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC5B,SAAS,GAAE,SAA2C;IAKzE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI3F,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI7F,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI9E,uDAAuD;IACjD,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAMrC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAIzE,KAAK;YAKL,IAAI;YAcJ,aAAa;CAgB5B;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/verify/staging/rest.js

@@ -0,0 +1,93 @@
+/**
+ * A minimal Realtime Database REST client for the staging engine: data reads
+ * and writes as admin or as an application user (`auth_variable_override`),
+ * and the rules endpoint (`/.settings/rules.json`).
+ *
+ * Production applies an `auth_variable_override` object as the rules `auth`
+ * variable, `auth.token` claims included; the identity capture recorded in
+ * `packages/conformance/observations/rtdb-staging/rtdb-staging-auth-override.json`
+ * pins that for every field the engine passes.
+ */
+export class RtdbRestClient {
+    token;
+    fetchImpl;
+    databaseUrl;
+    constructor(databaseUrl, token, fetchImpl = (url, init) => fetch(url, init)) {
+        this.token = token;
+        this.fetchImpl = fetchImpl;
+        this.databaseUrl = databaseUrl.replace(/\/+$/, '');
+    }
+    get(path, request = {}) {
+        return this.send('GET', path, undefined, request);
+    }
+    put(path, value, request = {}) {
+        return this.send('PUT', path, JSON.stringify(value), request);
+    }
+    patch(path, value, request = {}) {
+        return this.send('PATCH', path, JSON.stringify(value), request);
+    }
+    delete(path, request = {}) {
+        return this.send('DELETE', path, undefined, request);
+    }
+    /** The deployed rules as stored, comments included. */
+    async getRulesText() {
+        const res = await this.rules('GET');
+        if (res.status !== 200)
+            throw new Error(`reading the rules of ${this.databaseUrl} failed: HTTP ${res.status} ${res.text.slice(0, 200)}`);
+        return res.text;
+    }
+    /** Deploy `source` as the rules, or validate it without deploying (`dryRun`). */
+    putRules(source, options = {}) {
+        return this.rules('PUT', source, options.dryRun === true);
+    }
+    async rules(method, body, dryRun = false) {
+        const url = `${this.databaseUrl}/.settings/rules.json${dryRun ? '?dryRun=true' : ''}`;
+        return this.fetchResponse(url, method, body);
+    }
+    async send(method, path, body, request) {
+        const params = new URLSearchParams();
+        if (request.auth !== undefined)
+            params.set('auth_variable_override', JSON.stringify(request.auth));
+        if (request.format)
+            params.set('format', request.format);
+        if (request.shallow)
+            params.set('shallow', 'true');
+        for (const [key, value] of Object.entries(request.query ?? {}))
+            params.set(key, value);
+        const query = params.toString();
+        const url = `${this.databaseUrl}${restPath(path) || '/'}.json${query ? `?${query}` : ''}`;
+        const headers = {};
+        if (request.etag)
+            headers['X-Firebase-ETag'] = 'true';
+        if (request.ifMatch !== undefined)
+            headers['if-match'] = request.ifMatch;
+        return this.fetchResponse(url, method, body, headers);
+    }
+    async fetchResponse(url, method, body, extra = {}) {
+        const res = await this.fetchImpl(url, {
+            method,
+            headers: { Authorization: `Bearer ${await this.token()}`, 'Content-Type': 'application/json', ...extra },
+            ...(body === undefined ? {} : { body }),
+        });
+        const text = await res.text();
+        let parsed = text;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            // Not JSON: keep the text.
+        }
+        const etag = res.headers?.get('etag') ?? undefined;
+        return { status: res.status, body: parsed, text, ...(etag ? { etag } : {}) };
+    }
+}
+/** `/a/b` for any of `a/b`, `/a/b/`, `a//b`; the root is the empty string. */
+export function restPath(path) {
+    const segments = path.split('/').filter(Boolean).map(encodeURIComponent);
+    return segments.length === 0 ? '' : `/${segments.join('/')}`;
+}
+/** Whether a REST status is the rules denying the request. */
+export function isRestDenial(status) {
+    return status === 401 || status === 403;
+}
+//# sourceMappingURL=rest.js.map

package/dist/verify/staging/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../../../src/verify/staging/rest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkCH,MAAM,OAAO,cAAc;IAKN;IACA;IALV,WAAW,CAAS;IAE7B,YACE,WAAmB,EACF,KAA4B,EAC5B,YAAuB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC;QADtD,UAAK,GAAL,KAAK,CAAuB;QAC5B,cAAS,GAAT,SAAS,CAA6C;QAEvE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,UAA2B,EAAE;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,UAA2B,EAAE;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAY,EAAE,KAAc,EAAE,UAA2B,EAAE;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,UAA2B,EAAE;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,WAAW,iBAAiB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzI,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,iFAAiF;IACjF,QAAQ,CAAC,MAAc,EAAE,UAAgC,EAAE;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAAqB,EAAE,IAAa,EAAE,MAAM,GAAG,KAAK;QACtE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,wBAAwB,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACtF,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,IAAwB,EAAE,OAAwB;QACjG,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1F,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;QACtD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QACzE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,IAAa,EAAE,QAAgC,EAAE;QACxG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACpC,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE;YACxG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC"}

package/dist/verify/staging/target.d.ts

@@ -0,0 +1,39 @@
+import type { FirebaseJson } from '../../cli/firebase-json.js';
+import { resolveScope } from '../../credentials/node/scope.js';
+export interface StagingTarget {
+    projectId: string;
+    databaseUrl: string;
+    /** The instance name the URL names. */
+    instance: string;
+}
+export declare class StagingConfigError extends Error {
+    constructor(message: string);
+}
+/** The staging target in a parsed `pyric.json`, or a config error naming what is missing. */
+export declare function stagingTargetFrom(config: unknown): StagingTarget;
+/**
+ * Refuse a staging instance the app uses: one `firebase.json` deploys rules
+ * to (by instance or by a `.firebaserc` target), or the default instance of
+ * the app's project.
+ */
+export declare function assertNotAppInstance(target: StagingTarget, app: {
+    firebaseJson: FirebaseJson | null;
+    appProjectId?: string;
+    targetInstances?: string[];
+}): void;
+/**
+ * An OAuth token for the staging project: a service account or Application
+ * Default Credentials (`resolveScope`), else the Firebase CLI's login
+ * (`firebase login`) while its access token is fresh.
+ */
+export declare function stagingToken(projectId: string, deps?: {
+    resolve?: typeof resolveScope;
+    env?: NodeJS.ProcessEnv;
+    now?: () => number;
+}): Promise<{
+    token: () => Promise<string>;
+    source: string;
+}>;
+/** How long a CLI token must stay valid for a run to start with it; it cannot be refreshed mid-run. */
+export declare const CLI_TOKEN_MARGIN_MS: number;
+//# sourceMappingURL=target.d.ts.map

package/dist/verify/staging/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../../src/verify/staging/target.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAgE,MAAM,iCAAiC,CAAC;AAE7H,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAID,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,aAAa,CAwBhE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,EACrB,GAAG,EAAE;IAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5F,IAAI,CAcN;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,YAAY,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GACxF,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB3D;AAOD,uGAAuG;AACvG,eAAO,MAAM,mBAAmB,QAAc,CAAC"}