@raybase/record-mount 0.0.2 → 0.3.4

package/dist/mount.d.ts

@@ -0,0 +1,219 @@
+/**
+ * The mount: read authorization as a declared interface, over one
+ * namespace-scoped client.
+ *
+ * ## Two gates, and they are different questions
+ *
+ * **Gate 1 — the route's Raybase auth declaration.** `audience` and
+ * `policy`, exactly as a Raybase action declares them, validated through
+ * Core's own `validateActionPolicy` at mount time and evaluated through
+ * Core's own `actionAudienceAllows` / `evaluateActionPolicy` on every
+ * call. `defineRecordMount` REFUSES to mount without one — a record layer
+ * is not a surface on which "I forgot" may be spellable, so this is
+ * stricter than Core: an explicitly public mount says
+ * `{ audience: "public", policy: allowAll }` and means it. A viewer who
+ * fails this gate is refused `forbidden`: they may not call at all, and
+ * pretending the record layer is empty would be a lie about the system.
+ *
+ * **Gate 2 — the read-policy hook.** Envelope in, allow/deny out, applied
+ * to EVERY Row and every `get` the mount serves. A denial is ABSENCE, not
+ * an error: a row is filtered out of its page and a `get` answers
+ * `not_found`, because "you may not see this record" and "this record does
+ * not exist" must be indistinguishable to a caller who is not allowed to
+ * learn the difference. v0's default is `allowAnyAuthenticated`; what
+ * fills it is the consumer's design.
+ *
+ * ## The two verbs a per-envelope policy cannot filter
+ *
+ * `count` and `materialize` cannot be row-filtered. `count` is folded inside
+ * the door and comes back as totals, not records: filtering it would mean
+ * counting client-side over the whole namespace, and serving it unfiltered
+ * discloses the shape of a corpus the viewer may not read. `materialize`
+ * streams stored bytes — whole files, several records to a file in some
+ * forms — so there is no envelope for a per-envelope hook to judge at all.
+ *
+ * So they are gated, and the gate arms on a **pair**, decided once at mount
+ * time: **can the effective read policy deny a viewer this mount's audience
+ * admits?** Armed, both refuse `forbidden` unless the mount declared them in
+ * `unfilteredReads`.
+ *
+ * The pair is the whole point, because each half alone gets it wrong.
+ * Asking only "did the consumer install a custom policy?" fails OPEN: the
+ * default policy denies public principals, so `{audience: "public", policy:
+ * allowAll}` — a shape this package prescribes — served an anonymous caller
+ * the namespace's totals and its stored bytes while `list` served that same
+ * caller nothing. Asking only "can this policy deny anybody?" fails NOISY:
+ * the default denies *some* principal, so every mount would arm and
+ * `unfilteredReads` would become mandatory boilerplate rather than a signal
+ * a reviewer can read.
+ *
+ * Worked through: `{signed-in, allowAnyAuthenticated}` admits only
+ * authenticated viewers and the default allows every one of them — nothing
+ * deniable, unarmed, both verbs flow. `{public, allowAnyAuthenticated}`
+ * admits a class the policy denies — armed. Any policy this package cannot
+ * see inside — armed, because unrecognised must never be the permissive
+ * answer.
+ *
+ * `unguardedDoor` remains the general escape hatch, for a caller that wants
+ * the client with no gate at all and is willing to say so at the call site.
+ *
+ * ## What the mount does not do, deliberately
+ *
+ * The read-policy hook is not a write gate, and it is not asked about
+ * writes. A filing is authorized by gate 1 and then by the door's own
+ * write policy against the actor the binding's props name — an
+ * authorization the mount cannot see, cannot influence, and must not
+ * duplicate.
+ */
+import type { ActionPolicyExpression, RaybaseActionAudience } from "@raybase/core";
+import type { RaybasePrincipal, RaybaseUser } from "@raybase/core";
+import type { RecordDoorClient } from "./client.js";
+import type { RecordAppendResult, RecordCountGroup, RecordCountResult, RecordEnvelope, RecordGetResult, RecordId, RecordListQuery, RecordListResult, RecordMaterializeEntry, RecordQuery, RecordQueryResult, RecordReverseRefsResult, RecordTransitionEvent, RecordTransitionResult } from "./contract.js";
+import type { RecordBodyComposer } from "./body.js";
+/** Who is reading. The server-owned principal is the authority; `user` is
+ *  the convenience projection Core also carries. An agent run arrives as kind
+ *  `agent`, and its authority is the principal it acts for. */
+export type RecordViewer = {
+    principal: RaybasePrincipal;
+    user?: RaybaseUser;
+};
+/** The read verbs a policy hook may be asked about. */
+export type RecordReadVerb = "get" | "list" | "query" | "reverseRefs";
+/**
+ * The declared read-authorization interface: envelope in, allow/deny out.
+ *
+ * It is called once per envelope, for every envelope the mount is about to
+ * hand back. It may be async — a hook that reads app tables is the expected
+ * case — and it is called at bounded concurrency
+ * (`readPolicyConcurrency`, default 16) rather than all at once, so a page
+ * of a thousand rows does not become a thousand simultaneous queries. A
+ * hook that repeats work across envelopes should still memoize per request.
+ *
+ * A hook that throws is not treated as a denial. It propagates: a policy
+ * that cannot decide has not decided, and swallowing that into "deny"
+ * would turn an outage into a silently empty page.
+ *
+ * The viewer arrives as given, so a hook can tell an agent from the person it
+ * acts for. A hook that judges by who is reading should read
+ * `principalOnBehalfOf(viewer.principal)`: an agent acting for a public visitor
+ * is not kind `public`, and it must not read as signed in.
+ */
+export type RecordReadPolicy = (input: {
+    envelope: RecordEnvelope;
+    viewer: RecordViewer;
+    verb: RecordReadVerb;
+}) => boolean | Promise<boolean>;
+/** v0's default: any principal that is not anonymous may read every
+ *  record the mount's namespace holds. Disabled users are not readers. An agent
+ *  counts as the principal it acts for. */
+export declare const allowAnyAuthenticated: RecordReadPolicy;
+/** Deny everything. Useful as a base for a mount that opts rows in. */
+export declare const denyAllRecords: RecordReadPolicy;
+/**
+ * The two read verbs a per-envelope policy cannot filter, and which a mount
+ * carrying a custom policy must therefore declare it wants unfiltered.
+ * See this module's header for why each is unfilterable.
+ */
+export type RecordUnfilteredRead = "count" | "materialize";
+/** The Raybase auth declaration a mount must carry. */
+export type RecordMountAuth = {
+    audience: RaybaseActionAudience;
+    policy: ActionPolicyExpression;
+};
+export type DefineRecordMountOptions = {
+    /** A name for this mount, used in refusals and in Core's own policy
+     *  validation messages. Same charset as an action name. */
+    name: string;
+    /** The one namespace-scoped client this mount serves. One mount, one
+     *  door, one namespace — the scoping is structural. */
+    door: RecordDoorClient;
+    /** The route's Raybase auth declaration. Required. */
+    auth: RecordMountAuth;
+    /** Gate 2. Defaults to `allowAnyAuthenticated`. */
+    readPolicy?: RecordReadPolicy;
+    /**
+     * The unfilterable read verbs this mount deliberately serves whole. Only
+     * consulted when a custom `readPolicy` is installed; with the default
+     * policy both verbs serve normally.
+     */
+    unfilteredReads?: readonly RecordUnfilteredRead[];
+    /**
+     * How many envelopes the read policy is asked about at once. The hook is
+     * expected to read app tables, and a page may carry up to a thousand
+     * rows — so this is bounded rather than a `Promise.all` over the page.
+     * Default 16.
+     */
+    readPolicyConcurrency?: number;
+    /**
+     * Service principals, and agents acting for a service, are refused by
+     * default (see `gateRoute`). Set this when a job, an API client or a
+     * scheduled agent legitimately fronts this mount.
+     */
+    allowServicePrincipals?: boolean;
+    /** The body builder, for a mount that files. Declaring one against a
+     *  read door refuses at mount time. */
+    composer?: RecordBodyComposer;
+};
+export type RecordMount = {
+    readonly name: string;
+    /** The declared namespace this mount serves. */
+    readonly namespace: string;
+    /** The frozen auth declaration — spread it onto the action or route
+     *  that fronts this mount so the two cannot drift. */
+    readonly auth: Readonly<RecordMountAuth>;
+    /**
+     * The client, ungated. Every call through it bypasses gate 2 and is the
+     * caller's to justify. Named this way so nobody reaches it by accident.
+     */
+    readonly unguardedDoor: RecordDoorClient;
+    /**
+     * One page of rows, gate-2 filtered.
+     *
+     * Filtering shrinks a page: a `limit: 50` list whose viewer may read
+     * twelve of them returns twelve rows and the page's own cursor. The
+     * cursor is still correct — it is the door's keyset position, not a
+     * count — so a consumer that needs full pages loops until it has
+     * enough. This is stated rather than hidden because a shrinking page is
+     * exactly what a row policy costs.
+     */
+    list(q: RecordListQuery, viewer: RecordViewer): Promise<RecordListResult>;
+    /** One record, or `not_found` — including when gate 2 denies it. */
+    get(id: RecordId, viewer: RecordViewer): Promise<RecordGetResult>;
+    /** The substrate query, gate-2 filtered. Same page-shrinking rule. */
+    query(q: RecordQuery, viewer: RecordViewer): Promise<RecordQueryResult>;
+    /** What cites this record, gate-2 filtered. */
+    reverseRefs(id: RecordId, opts: {
+        limit?: number;
+        order?: "asc" | "desc";
+    } | undefined, viewer: RecordViewer): Promise<RecordReverseRefsResult>;
+    /**
+     * Totals by lifecycle column. Under a custom read policy this refuses
+     * `forbidden` unless the mount declared `"count"` in `unfilteredReads` —
+     * an aggregate cannot be row-filtered, and an unfiltered one discloses
+     * the shape of what the viewer may not read.
+     */
+    count(args: {
+        family?: string;
+        groupBy: RecordCountGroup;
+    }, viewer: RecordViewer): Promise<RecordCountResult>;
+    /**
+     * Stored bytes under a prefix, as one iterator over the door's pages.
+     * Under a custom read policy this refuses `forbidden` unless the mount
+     * declared `"materialize"` in `unfilteredReads` — these entries are
+     * files, not envelopes, so a per-envelope hook has nothing to judge.
+     */
+    materialize(prefix: string, viewer: RecordViewer): Promise<AsyncIterable<RecordMaterializeEntry>>;
+    /** Compose a family's canonical body from a form's input and append it.
+     *  Requires a composer and a write door. */
+    file(family: string, input: Record<string, unknown>, viewer: RecordViewer): Promise<RecordAppendResult>;
+    /** Move a record's lifecycle. Gate 1 only; the door's write policy is
+     *  the authorization that matters, and it is not ours to duplicate. */
+    transition(args: {
+        id: RecordId;
+        expected: string;
+        next: string;
+        event: RecordTransitionEvent;
+    }, viewer: RecordViewer): Promise<RecordTransitionResult>;
+};
+export declare function defineRecordMount(options: DefineRecordMountOptions): RecordMount;
+//# sourceMappingURL=mount.d.ts.map

package/dist/mount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EAEvB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGpD;;+DAE+D;AAC/D,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF,uDAAuD;AACvD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAEtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE;IACrC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;CACtB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjC;;2CAE2C;AAC3C,eAAO,MAAM,qBAAqB,EAAE,gBAMnC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,cAAc,EAAE,gBAA8B,CAAC;AA2B5D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,aAAa,CAAC;AAE3D,uDAAuD;AACvD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC;+DAC2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,IAAI,EAAE,gBAAgB,CAAC;IACvB,sDAAsD;IACtD,IAAI,EAAE,eAAe,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;OAIG;IACH,eAAe,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;2CACuC;IACvC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0DACsD;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;IAEzC;;;;;;;;;OASG;IACH,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1E,oEAAoE;IACpE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClE,sEAAsE;IACtE,KAAK,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,+CAA+C;IAC/C,WAAW,CACT,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,EAC5D,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,EACpD,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,WAAW,CACT,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAClD;gDAC4C;IAC5C,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B;2EACuE;IACvE,UAAU,CACR,IAAI,EAAE;QACJ,EAAE,EAAE,QAAQ,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,qBAAqB,CAAC;KAC9B,EACD,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAmThF"}

package/dist/mount.js

@@ -0,0 +1,372 @@
+/**
+ * The mount: read authorization as a declared interface, over one
+ * namespace-scoped client.
+ *
+ * ## Two gates, and they are different questions
+ *
+ * **Gate 1 — the route's Raybase auth declaration.** `audience` and
+ * `policy`, exactly as a Raybase action declares them, validated through
+ * Core's own `validateActionPolicy` at mount time and evaluated through
+ * Core's own `actionAudienceAllows` / `evaluateActionPolicy` on every
+ * call. `defineRecordMount` REFUSES to mount without one — a record layer
+ * is not a surface on which "I forgot" may be spellable, so this is
+ * stricter than Core: an explicitly public mount says
+ * `{ audience: "public", policy: allowAll }` and means it. A viewer who
+ * fails this gate is refused `forbidden`: they may not call at all, and
+ * pretending the record layer is empty would be a lie about the system.
+ *
+ * **Gate 2 — the read-policy hook.** Envelope in, allow/deny out, applied
+ * to EVERY Row and every `get` the mount serves. A denial is ABSENCE, not
+ * an error: a row is filtered out of its page and a `get` answers
+ * `not_found`, because "you may not see this record" and "this record does
+ * not exist" must be indistinguishable to a caller who is not allowed to
+ * learn the difference. v0's default is `allowAnyAuthenticated`; what
+ * fills it is the consumer's design.
+ *
+ * ## The two verbs a per-envelope policy cannot filter
+ *
+ * `count` and `materialize` cannot be row-filtered. `count` is folded inside
+ * the door and comes back as totals, not records: filtering it would mean
+ * counting client-side over the whole namespace, and serving it unfiltered
+ * discloses the shape of a corpus the viewer may not read. `materialize`
+ * streams stored bytes — whole files, several records to a file in some
+ * forms — so there is no envelope for a per-envelope hook to judge at all.
+ *
+ * So they are gated, and the gate arms on a **pair**, decided once at mount
+ * time: **can the effective read policy deny a viewer this mount's audience
+ * admits?** Armed, both refuse `forbidden` unless the mount declared them in
+ * `unfilteredReads`.
+ *
+ * The pair is the whole point, because each half alone gets it wrong.
+ * Asking only "did the consumer install a custom policy?" fails OPEN: the
+ * default policy denies public principals, so `{audience: "public", policy:
+ * allowAll}` — a shape this package prescribes — served an anonymous caller
+ * the namespace's totals and its stored bytes while `list` served that same
+ * caller nothing. Asking only "can this policy deny anybody?" fails NOISY:
+ * the default denies *some* principal, so every mount would arm and
+ * `unfilteredReads` would become mandatory boilerplate rather than a signal
+ * a reviewer can read.
+ *
+ * Worked through: `{signed-in, allowAnyAuthenticated}` admits only
+ * authenticated viewers and the default allows every one of them — nothing
+ * deniable, unarmed, both verbs flow. `{public, allowAnyAuthenticated}`
+ * admits a class the policy denies — armed. Any policy this package cannot
+ * see inside — armed, because unrecognised must never be the permissive
+ * answer.
+ *
+ * `unguardedDoor` remains the general escape hatch, for a caller that wants
+ * the client with no gate at all and is willing to say so at the call site.
+ *
+ * ## What the mount does not do, deliberately
+ *
+ * The read-policy hook is not a write gate, and it is not asked about
+ * writes. A filing is authorized by gate 1 and then by the door's own
+ * write policy against the actor the binding's props name — an
+ * authorization the mount cannot see, cannot influence, and must not
+ * duplicate.
+ */
+import { actionAudienceAllows, evaluateActionPolicy, principalOnBehalfOf, validateActionPolicy } from "@raybase/core";
+import { recordDoorError } from "./errors.js";
+/** v0's default: any principal that is not anonymous may read every
+ *  record the mount's namespace holds. Disabled users are not readers. An agent
+ *  counts as the principal it acts for. */
+export const allowAnyAuthenticated = ({ viewer }) => {
+    const principal = principalOnBehalfOf(viewer.principal);
+    if (principal.kind === "public")
+        return false;
+    const user = principal.kind === "user" || principal.kind === "operator" ? principal.user : undefined;
+    if (user?.disabled === true)
+        return false;
+    return true;
+};
+/** Deny everything. Useful as a base for a mount that opts rows in. */
+export const denyAllRecords = () => false;
+/**
+ * Which viewer classes each KNOWN policy can deny — the data behind the
+ * unfilterable gate's arming decision.
+ *
+ * A policy in this table is one this package wrote and can therefore reason
+ * about. A policy absent from it is opaque: nobody can see inside a
+ * consumer's function, so it arms the gate unconditionally. That is also
+ * what dissolves the identity-comparison problem — a wrapper around a
+ * default and the bare default no longer differ in the dangerous direction,
+ * because being unrecognised arms rather than disarms.
+ *
+ * `allowAnyAuthenticated` also denies a disabled user, which is deliberately
+ * NOT listed: Core's session resolution returns null for a disabled account
+ * (`packages/core/src/auth.ts`), so no principal is built and that viewer
+ * never reaches this gate. The check in the policy is defence in depth, not
+ * an admitted class.
+ */
+const POLICY_DENIES = new Map([
+    [allowAnyAuthenticated, ["public"]],
+    [denyAllRecords, ["public", "signed-in"]]
+]);
+export function defineRecordMount(options) {
+    const { name, door } = options;
+    if (typeof name !== "string" || name.length === 0) {
+        throw new Error("defineRecordMount requires a name");
+    }
+    if (door === undefined || door === null || typeof door.list !== "function") {
+        throw new Error(`record mount ${name} requires a door opened with openRecordDoor()`);
+    }
+    const auth = options.auth;
+    if (auth === undefined || auth === null) {
+        throw new Error(`record mount ${name} must declare Raybase auth: { audience, policy }. A record mount serves ` +
+            "records to people; an undeclared route is not a default, it is an omission.");
+    }
+    if (auth.audience === undefined) {
+        throw new Error(`record mount ${name} must declare an audience ("signed-in" or "public")`);
+    }
+    if (auth.policy === undefined) {
+        // Core would let a public-only action omit its policy. A mount may
+        // not: "public" is a claim worth writing down beside an explicit
+        // allowAll, so that reading the declaration tells you what was meant.
+        throw new Error(`record mount ${name} must declare a policy, including on a public audience — say ` +
+            "policy: allowAll and mean it");
+    }
+    // Core's own rail does the rest: it refuses the row-dependent policy
+    // kinds (owns/operator/servicePrincipal), which belong to gate 2 here.
+    validateActionPolicy(auth.policy, name, auth.audience);
+    // A public audience admits a principal that carries no user, so a policy
+    // narrower than allowAll cannot be evaluated against it — and an
+    // unevaluable policy must not resolve in the permissive direction (the
+    // same rule the service principal gets below, applied where it is
+    // knowable at mount time). A declaration that admits anonymous callers
+    // AND names a restriction is contradictory, so it is refused here rather
+    // than silently reading as "anyone".
+    if (actionAudienceAllows(auth.audience, "public") && auth.policy.kind !== "allowAll") {
+        throw new Error(`record mount ${name} admits a public audience but declares policy '${auth.policy.kind}', ` +
+            "which cannot be evaluated against an anonymous principal. Either narrow the audience to " +
+            "\"signed-in\", or say policy: allowAll and mean it.");
+    }
+    const readPolicy = options.readPolicy ?? allowAnyAuthenticated;
+    /**
+     * Whether the unfilterable verbs are gated, decided once from the pair
+     * that actually determines it: **can the effective read policy deny a
+     * viewer this mount's audience admits?**
+     *
+     * Asking only "did the consumer install a custom policy?" was wrong in the
+     * dangerous direction. The default policy denies public principals, so a
+     * mount declared `{audience: "public", policy: allowAll}` — a shape this
+     * package's own README prescribes — served an anonymous caller the
+     * namespace's totals and its stored bytes while `list` handed the same
+     * caller zero rows.
+     *
+     * The pair gets both ends right. `{signed-in, allowAnyAuthenticated}`
+     * admits only authenticated viewers and the default allows every one of
+     * them, so nothing is deniable and `count`/`materialize` flow without a
+     * declaration. `{public, allowAnyAuthenticated}` admits a class the policy
+     * denies, so it arms. Anything opaque arms.
+     */
+    const deniable = POLICY_DENIES.get(readPolicy);
+    const armed = deniable === undefined ||
+        deniable.some((viewerClass) => actionAudienceAllows(auth.audience, viewerClass));
+    const unfiltered = new Set(options.unfilteredReads ?? []);
+    const concurrency = Math.max(1, Math.trunc(options.readPolicyConcurrency ?? 16));
+    const allowServicePrincipals = options.allowServicePrincipals === true;
+    const composer = options.composer;
+    /**
+     * The one refusal, written once, thrown from two moments.
+     *
+     * A composer over a read door is a deploy misconfiguration — the same class
+     * as an undeclared auth block, and like those it throws a plain `Error`
+     * rather than a `RecordDoorError`: it is not a refusal a caller can act on,
+     * it is a mount that should not exist.
+     */
+    const composerOverReadDoor = () => new Error(`record mount ${name} declares a body composer but its binding '${door.binding}' is a read ` +
+        "door — it carries no append verb. Bind the write entrypoint or drop the composer.");
+    // Mount time is the right moment whenever writability is already knowable,
+    // which on a plain binding it always is.
+    if (composer !== undefined && door.writable === false)
+        throw composerOverReadDoor();
+    /**
+     * The same check, at the earliest moment it can fire across an RPC seam.
+     *
+     * Over a real service binding `door.writable` is `"unknown"` until the
+     * client's contract check has resolved a `version()` reply, and
+     * `defineRecordMount` is synchronous — so the mount-time throw above simply
+     * cannot see a read door there. Rather than let the misconfiguration ride
+     * until somebody files, every verb consults this first: it forces the
+     * client's own (memoized) contract check, and refuses with the identical
+     * message the moment the door's declaration says `writes: false`.
+     *
+     * Reads pay for it too, deliberately. A mount that declares a composer over
+     * a read door is misconfigured whether or not anyone has filed yet, and
+     * surfacing that on the first read is how an operator learns at deploy
+     * smoke-test time instead of at the first user's first filing.
+     *
+     * It costs nothing on the mounts that cannot hit it: no composer, or a
+     * settled `writable`, returns before awaiting anything.
+     */
+    const ensureComposerDoorAgrees = async () => {
+        if (composer === undefined)
+            return;
+        // `writable` is a getter that sharpens once the client's contract check
+        // resolves, so this reads it twice deliberately: force the check only
+        // when the answer is not yet knowable, then read what it settled on.
+        if (door.writable === "unknown")
+            await door.assertContract();
+        if (door.writable === false)
+            throw composerOverReadDoor();
+    };
+    const frozenAuth = Object.freeze({ ...auth });
+    /**
+     * A refusal this mount authored, marked as such. `mount` is the
+     * distinguishing key: the door's own `forbidden` detail carries
+     * `{actor, verb, family, id}` and never a mount name, so a consumer can
+     * tell "the mount refused you" from "the door refused the app" without
+     * parsing a message. Sentinel values imitating the door's other keys
+     * would have read as door-authored, which is a refusal lying about where
+     * it came from.
+     */
+    const denied = (verb, why) => recordDoorError("forbidden", { mount: name, verb }, `forbidden: record mount ${name} refused ${verb} — ${why}`);
+    /**
+     * Gate 1, in Core's own order and with Core's own semantics.
+     *
+     * Every principal kind is answered for, deliberately. An `agent` is judged
+     * as the user, visitor or service it acts for, as Core's own action gate
+     * judges it: it carries that principal's authority and gains nothing by
+     * being an agent. That leaves four kinds, and the declared policy is
+     * evaluable against only two of them — so the other two are ruled here
+     * rather than falling through:
+     *
+     * - `public` — judged by the audience alone, which is what an audience is.
+     * - `user` and `operator` — both carry a `RaybaseUser`, so both are
+     *   evaluated against the declared policy. An operator is not exempt: a
+     *   mount that says `policy: role("chair")` means it, and Core's operator
+     *   authority is about Core's own admin surfaces, not about a record layer
+     *   this package knows nothing about.
+     * - `service` — carries no user, so a role policy is not merely unevaluated
+     *   but unevaluable. It is refused unless the mount declared
+     *   `allowServicePrincipals`, because "the policy could not be applied" must
+     *   not read as "the policy passed".
+     */
+    const gateRoute = (viewer, verb) => {
+        if (viewer === undefined || viewer === null || viewer.principal === undefined) {
+            throw new Error(`record mount ${name}: ${verb} requires a viewer carrying the request's server-owned ` +
+                "principal. A browser client cannot construct one, which is the point.");
+        }
+        const principal = principalOnBehalfOf(viewer.principal);
+        const audience = principal.kind === "public" ? "public" : "signed-in";
+        if (!actionAudienceAllows(frozenAuth.audience, audience)) {
+            throw denied(verb, `audience '${audience}' is not admitted by this mount`);
+        }
+        if (principal.kind === "service") {
+            if (!allowServicePrincipals) {
+                throw denied(verb, "a service principal carries no user, so this mount's declared policy cannot be " +
+                    "evaluated against it — declare allowServicePrincipals if that is intended");
+            }
+            return;
+        }
+        if (principal.kind === "public")
+            return;
+        if (!evaluateActionPolicy(frozenAuth.policy, principal.user)) {
+            throw denied(verb, "the mount's declared policy denied this viewer");
+        }
+    };
+    /**
+     * Gate 2 over a page, at bounded concurrency.
+     *
+     * The hook is expected to read app tables and a page may carry up to a
+     * thousand rows, so a `Promise.all` over the page would aim the whole page
+     * at the database at once — the unbounded fan-out that is carelessness
+     * rather than deferred optimization. Order is preserved: verdicts are
+     * written back by index, never by completion.
+     */
+    const filter = async (envelopes, viewer, verb) => {
+        const verdicts = new Array(envelopes.length);
+        let next = 0;
+        const worker = async () => {
+            for (let i = next++; i < envelopes.length; i = next++) {
+                verdicts[i] = (await readPolicy({ envelope: envelopes[i], viewer, verb })) === true;
+            }
+        };
+        const workers = Math.min(concurrency, envelopes.length);
+        await Promise.all(Array.from({ length: workers }, worker));
+        return envelopes.filter((_, i) => verdicts[i]);
+    };
+    /** The fail-closed gate on the two verbs a per-envelope hook cannot judge. */
+    const gateUnfilterable = (verb) => {
+        if (!armed || unfiltered.has(verb))
+            return;
+        throw denied(verb, `'${verb}' cannot be filtered by a per-envelope read policy, and this mount's policy can ` +
+            `deny a viewer its audience admits. Declare unfilteredReads: ["${verb}"] if namespace-wide ` +
+            `${verb} is intended.`);
+    };
+    return {
+        name,
+        namespace: door.namespace,
+        auth: frozenAuth,
+        unguardedDoor: door,
+        async list(q, viewer) {
+            gateRoute(viewer, "list");
+            await ensureComposerDoorAgrees();
+            const page = await door.list(q);
+            const rows = await filter(page.rows, viewer, "list");
+            return page.cursor === undefined ? { rows } : { rows, cursor: page.cursor };
+        },
+        async get(id, viewer) {
+            gateRoute(viewer, "get");
+            await ensureComposerDoorAgrees();
+            const found = await door.get(id);
+            const allowed = await readPolicy({ envelope: found.envelope, viewer, verb: "get" });
+            if (allowed !== true) {
+                // Absence, not a leak — and byte-identical absence, which is the
+                // whole property. The message is built from the SAME default the
+                // door's own `not_found` uses (`${code}: ${JSON.stringify(detail)}`)
+                // rather than written out here: a bespoke `not_found: <id>` matched
+                // the door on `detail` and differed on `message`, so one probe per
+                // id was still an existence oracle. Passing no message is not
+                // laziness, it is the mechanism — there is one shape and neither
+                // side spells it twice.
+                throw recordDoorError("not_found", { id });
+            }
+            return found;
+        },
+        async query(q, viewer) {
+            gateRoute(viewer, "query");
+            await ensureComposerDoorAgrees();
+            const page = await door.query(q);
+            const envelopes = await filter(page.envelopes, viewer, "query");
+            return page.cursor === undefined ? { envelopes } : { envelopes, cursor: page.cursor };
+        },
+        async reverseRefs(id, opts, viewer) {
+            gateRoute(viewer, "reverseRefs");
+            await ensureComposerDoorAgrees();
+            const found = await door.reverseRefs(id, opts);
+            return { rows: await filter(found.rows, viewer, "reverseRefs") };
+        },
+        async count(args, viewer) {
+            gateRoute(viewer, "count");
+            await ensureComposerDoorAgrees();
+            gateUnfilterable("count");
+            return door.count(args);
+        },
+        async materialize(prefix, viewer) {
+            gateRoute(viewer, "materialize");
+            await ensureComposerDoorAgrees();
+            gateUnfilterable("materialize");
+            return door.materialize(prefix);
+        },
+        async file(family, input, viewer) {
+            gateRoute(viewer, "file");
+            await ensureComposerDoorAgrees();
+            if (composer === undefined) {
+                throw new Error(`record mount ${name} was not given a body composer, so it cannot file. Pass one to ` +
+                    "defineRecordMount() with the family descriptors this mount accepts.");
+            }
+            // The composer refuses in the door's own taxonomy, so a malformed
+            // filing and a rejected filing reach the caller identically — and
+            // neither is a 500.
+            const body = composer.compose(family, input);
+            return door.append(body);
+        },
+        async transition(args, viewer) {
+            gateRoute(viewer, "transition");
+            await ensureComposerDoorAgrees();
+            return door.transition(args.id, args.expected, args.next, args.event);
+        }
+    };
+}
+//# sourceMappingURL=mount.js.map

package/dist/mount.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAuBtH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAsC9C;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAqB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;IACpE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,IAAI,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAAqB,GAAG,EAAE,CAAC,KAAK,CAAC;AAK5D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,aAAa,GAA0D,IAAI,GAAG,CAAC;IACnF,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAU,CAAC;IAC5C,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;CACnD,CAAC,CAAC;AA4HH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,+CAA+C,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,0EAA0E;YAC5F,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,qDAAqD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,mEAAmE;QACnE,iEAAiE;QACjE,sEAAsE;QACtE,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,+DAA+D;YACjF,8BAA8B,CACjC,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,kDAAkD,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK;YACzF,0FAA0F;YAC1F,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS;QACtB,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,KAAK,IAAI,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC;;;;;;;OAOG;IACH,MAAM,oBAAoB,GAAG,GAAU,EAAE,CACvC,IAAI,KAAK,CACP,gBAAgB,IAAI,8CAA8C,IAAI,CAAC,OAAO,cAAc;QAC1F,mFAAmF,CACtF,CAAC;IAEJ,2EAA2E;IAC3E,yCAAyC;IACzC,IAAI,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;QAAE,MAAM,oBAAoB,EAAE,CAAC;IAEpF;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,wBAAwB,GAAG,KAAK,IAAmB,EAAE;QACzD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO;QACnC,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;YAAE,MAAM,oBAAoB,EAAE,CAAC;IAC5D,CAAC,CAAC;IAEF,MAAM,UAAU,GAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAEzE;;;;;;;;OAQG;IACH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,EAAE,CAC3C,eAAe,CACb,WAAW,EACX,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EACrB,2BAA2B,IAAI,YAAY,IAAI,MAAM,GAAG,EAAE,CAC3D,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,SAAS,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAQ,EAAE;QAC7D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,KAAK,IAAI,yDAAyD;gBACpF,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;QACtE,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,CAAC,IAAI,EAAE,aAAa,QAAQ,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,MAAM,CACV,IAAI,EACJ,iFAAiF;oBAC/E,2EAA2E,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACxC,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,MAAM,CAAC,IAAI,EAAE,gDAAgD,CAAC,CAAC;QACvE,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,MAAM,GAAG,KAAK,EAClB,SAAc,EACd,MAAoB,EACpB,IAAoB,EACN,EAAE;QAChB,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAU,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;gBACtD,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;YACtF,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,CAAC,IAA0B,EAAQ,EAAE;QAC5D,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3C,MAAM,MAAM,CACV,IAAI,EACJ,IAAI,IAAI,kFAAkF;YACxF,iEAAiE,IAAI,uBAAuB;YAC5F,GAAG,IAAI,eAAe,CACzB,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI;QAEnB,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM;YAClB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,MAAM,wBAAwB,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,MAAM,IAAI,GAAgB,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM;YAClB,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM,wBAAwB,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACpF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,8DAA8D;gBAC9D,iEAAiE;gBACjE,wBAAwB;gBACxB,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM;YACnB,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3B,MAAM,wBAAwB,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACxF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM;YAChC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACjC,MAAM,wBAAwB,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM;YACtB,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3B,MAAM,wBAAwB,EAAE,CAAC;YACjC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM;YAC9B,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACjC,MAAM,wBAAwB,EAAE,CAAC;YACjC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM;YAC9B,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,MAAM,wBAAwB,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,iEAAiE;oBACnF,qEAAqE,CACxE,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,kEAAkE;YAClE,oBAAoB;YACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM;YAC3B,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChC,MAAM,wBAAwB,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}