@snagset/server 0.0.1

package/dist/config.js

@@ -0,0 +1,180 @@
+import { DELETED, REGISTRY } from "./config.generated.js";
+/**
+ * The boot validator — 08 §4, and the ONLY module in the server that may read
+ * `process.env`.
+ *
+ * LOCK L7 and the scaffold's import lint make that mechanical rather than
+ * conventional: a route handler that reaches for `process.env` fails the
+ * lint. Every handler takes its config from `createApp(deps)`, which is what
+ * lets a test construct one instead of mutating the process.
+ *
+ * The REGISTRY is generated from 08 §4 — see `scripts/gen-config.mjs` and the
+ * rule it quotes. Nothing here is hand-maintained; this file is the rules,
+ * not the list.
+ *
+ * §4.1's rules, as implemented:
+ *
+ *  1. `DATABASE_URL` is the one required variable, in the platform's own
+ *     spelling — the deliberate exception to the `SNAGSET_*` shape, because
+ *     the Vercel marketplace mints it in the deploy click and Railway/Render
+ *     inject it. A9's promise stands: one deployable unit, one required
+ *     datastore, and everything else defaults to something that works.
+ *  2. An unknown `SNAGSET_*` is FATAL at boot, "with the offending name, the
+ *     closest registered name by edit distance, and a link to this section" —
+ *     because a transposed letter in a retention variable that silently
+ *     reverts to its default is a data-loss bug discovered at restore time.
+ *  7. Customer-owned variables are not ours: `*_SNAGSET_ENABLED` and
+ *     `SNAGSET_PRODUCTION_TOKEN_MODE` are set on the CUSTOMER's build (06
+ *     §4), and the server "never reads them and must not reject them,
+ *     because it never sees them" — so the prefix test is anchored.
+ *  8. Booleans are `true|false|1|0` case-insensitively; anything else fatal.
+ */
+export class ConfigError extends Error {
+    /** What the operator should do about it — printed under the message. */
+    fix;
+    constructor(message, fix) {
+        super(message);
+        this.name = "ConfigError";
+        this.fix = fix;
+    }
+}
+/** §4.1 rule 7's carve-out: names a customer sets on THEIR build. */
+const NOT_OURS = /^.+_SNAGSET_ENABLED$|^SNAGSET_PRODUCTION_TOKEN_MODE$/;
+/** Levenshtein, for rule 2's "closest registered name". */
+function distance(a, b) {
+    const d = Array.from({ length: a.length + 1 }, (_, i) => Array.from({ length: b.length + 1 }, (_, j) => (i === 0 ? j : j === 0 ? i : 0)));
+    for (let i = 1; i <= a.length; i++) {
+        for (let j = 1; j <= b.length; j++) {
+            d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+    }
+    return d[a.length][b.length];
+}
+/**
+ * The near-miss suggestion, and it is TOKEN-AWARE for a measured reason.
+ *
+ * Plain edit distance failed the exact mistake a first-time operator makes.
+ * `SNAGSET_OWNER_EMAIL` → `SNAGSET_BOOTSTRAP_OWNER_EMAIL` is 10 edits away —
+ * over any sane threshold — so the error said "unknown variable" and suggested
+ * nothing, while the right answer was the same name with one word inserted.
+ * Caught by mistyping it on a cold install and getting a dead end.
+ *
+ * So: if the typed name's underscore-separated words appear IN ORDER inside a
+ * registered name, that is a dropped or added segment rather than a typo, and
+ * it is a far stronger signal than character distance. Edit distance stays as
+ * the fallback for genuine typos (`SNAGSET_PROT`).
+ */
+function closest(name) {
+    const words = name.toUpperCase().split("_").filter(Boolean);
+    // Subsequence match first, shortest winner — `SNAGSET_OWNER_EMAIL` should
+    // reach `SNAGSET_BOOTSTRAP_OWNER_EMAIL` rather than some longer name that
+    // also happens to contain those words.
+    let bySegment = null;
+    for (const row of REGISTRY) {
+        const target = row.name.split("_");
+        let i = 0;
+        for (const part of target)
+            if (i < words.length && part === words[i])
+                i++;
+        if (i === words.length && (bySegment === null || row.name.length < bySegment.length)) {
+            bySegment = row.name;
+        }
+    }
+    if (bySegment)
+        return bySegment;
+    let best = null;
+    let score = Infinity;
+    for (const row of REGISTRY) {
+        const n = distance(name, row.name);
+        if (n < score) {
+            score = n;
+            best = row.name;
+        }
+    }
+    // Beyond a few edits it is not a typo, it is a different idea — and a
+    // confident wrong suggestion is worse than none.
+    return score <= 6 ? best : null;
+}
+export function loadConfig(env) {
+    const rows = new Map(REGISTRY.map((r) => [r.name, r]));
+    const retired = new Map(DELETED.map((d) => [d.name, d.to]));
+    // Rule 2, FIRST — before any value is read. An operator who typo'd a flag
+    // wants to hear about the typo, not about the consequence of it being
+    // unset: they turned something off, it stayed on, and nothing said so.
+    for (const name of Object.keys(env)) {
+        if (!name.startsWith("SNAGSET_") || rows.has(name) || NOT_OURS.test(name))
+            continue;
+        // §4.11 exists precisely so an upgrade says what a name BECAME.
+        if (retired.has(name)) {
+            const to = retired.get(name);
+            throw new ConfigError(`${name} is no longer a Snagset variable`, to ? `it was renamed — set ${to} instead (08 §4.11)` : `it was deleted; see 08 §4.11 for what replaced it`);
+        }
+        const near = closest(name);
+        throw new ConfigError(`unknown environment variable ${name}`, 
+        // `specs/08-deployment.md §4` is the registry and is NOT in the npm
+        // tarball — an operator who installed the package has no `specs/`
+        // directory, so the one pointer this error gave was to a file they could
+        // not open. `snagset env` is the same registry, printed by the binary
+        // they already have in front of them.
+        `${near ? `did you mean ${near}? ` : ""}run \`snagset env\` for the full list`);
+    }
+    const resolved = new Map();
+    for (const row of REGISTRY) {
+        const raw = env[row.name];
+        if (raw !== undefined && raw !== "") {
+            validate(row, raw);
+            resolved.set(row.name, { value: raw, source: "env" });
+        }
+        else if (row.required) {
+            throw new ConfigError(`${row.name} is required`, `set ${row.name} — a Postgres connection string (08 §${row.section})`);
+        }
+        else {
+            resolved.set(row.name, { value: row.default, source: "default" });
+        }
+    }
+    const get = (name) => resolved.get(name)?.value ?? undefined;
+    return {
+        get,
+        int: (name) => Number(get(name)),
+        bool: (name) => /^(true|1)$/i.test(get(name) ?? ""),
+        required: (name) => {
+            const v = get(name);
+            if (v === undefined)
+                throw new ConfigError(`${name} has no value`, `set ${name}`);
+            return v;
+        },
+        describe: () => REGISTRY.map((r) => ({
+            name: r.name,
+            value: resolved.get(r.name).value,
+            source: resolved.get(r.name).source,
+            secret: r.secret,
+        })),
+    };
+}
+function validate(row, raw) {
+    const bad = (why, fix) => {
+        throw new ConfigError(`${row.name} ${why}`, fix);
+    };
+    if (row.oneOf && !row.oneOf.includes(raw)) {
+        bad(`must be one of ${row.oneOf.join(" | ")}, got ${JSON.stringify(raw)}`, `set ${row.name} to one of: ${row.oneOf.join(", ")}`);
+    }
+    // Rule 8: byte counts are integers, never "5MB" strings — a value the
+    // operator believes is 5 MB and the program reads as NaN is the worst of
+    // both, so it is refused rather than coerced.
+    if (row.type === "int" && !/^\d+$/.test(raw)) {
+        bad(`must be a whole number, got ${JSON.stringify(raw)}`, `set ${row.name} to digits only (durations are seconds/days by their suffix; byte counts are bytes)`);
+    }
+    if (row.type === "bool" && !/^(true|false|1|0)$/i.test(raw)) {
+        bad(`must be true, false, 1 or 0 — got ${JSON.stringify(raw)}`, `set ${row.name} to true or false`);
+    }
+    // The `url` type covers three families and the allowlist has to name all of
+    // them: http(s) for base URLs and webhooks, postgres(ql) for DATABASE_URL,
+    // and smtp(s) for the mail transport (08 §4.8). Found live: a correct
+    // `smtp://host:2525` was refused by a validator that only knew the first
+    // two, so the SMTP adapter could not be configured at all — a boot failure
+    // for a variable whose entire purpose is to hold an SMTP URL.
+    if (row.type === "url" && !/^(https?|postgres(ql)?|smtps?):\/\//.test(raw)) {
+        bad(`must be a URL, got ${JSON.stringify(raw)}`, `set ${row.name} to a full URL including the scheme (http://, https://, postgres://, smtp:// or smtps://)`);
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAe,MAAM,uBAAuB,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,wEAAwE;IAC/D,GAAG,CAAS;IACrB,YAAY,OAAe,EAAE,GAAW;QACtC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,QAAQ,GAAG,sDAAsD,CAAC;AAExE,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,CAAC,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAClE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChF,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,GAAG,CAAC,EACjB,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,EACjB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5D,0EAA0E;IAC1E,0EAA0E;IAC1E,uCAAuC;IACvC,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACrF,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,KAAK,GAAG,QAAQ,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;YACd,KAAK,GAAG,CAAC,CAAC;YACV,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,iDAAiD;IACjD,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAaD,MAAM,UAAU,UAAU,CAAC,GAAuC;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5D,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAEpF,gEAAgE;QAChE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,WAAW,CACnB,GAAG,IAAI,kCAAkC,EACzC,EAAE,CAAC,CAAC,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC,CAAC,mDAAmD,CAC3G,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,gCAAgC,IAAI,EAAE;QACtC,oEAAoE;QACpE,kEAAkE;QAClE,yEAAyE;QACzE,sEAAsE;QACtE,sCAAsC;QACtC,GAAG,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,uCAAuC,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+D,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CACnB,GAAG,GAAG,CAAC,IAAI,cAAc,EACzB,OAAO,GAAG,CAAC,IAAI,wCAAwC,GAAG,CAAC,OAAO,GAAG,CACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAsB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,SAAS,CAAC;IACzF,OAAO;QACL,GAAG;QACH,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,eAAe,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CACb,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,KAAK;YAClC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC,MAAM;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;KACN,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAW,EAAS,EAAE;QAC9C,MAAM,IAAI,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC;IACF,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,kBAAkB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,8CAA8C;IAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,qFAAqF,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,GAAG,CAAC,IAAI,mBAAmB,CAAC,CAAC;IACtG,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,2EAA2E;IAC3E,8DAA8D;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,GAAG,CACD,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAC3C,OAAO,GAAG,CAAC,IAAI,2FAA2F,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/crypto.js

@@ -0,0 +1,26 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+export function seal(keys, plaintext) {
+    // 12 bytes is GCM's canonical nonce length — the one at which the counter
+    // construction needs no extra hashing step.
+    const iv = randomBytes(12);
+    const c = createCipheriv("aes-256-gcm", keys.derive("credential-enc"), iv);
+    const body = Buffer.concat([c.update(plaintext, "utf8"), c.final()]);
+    return { ciphertext: Buffer.concat([body, c.getAuthTag()]), iv };
+}
+export function open(keys, sealed) {
+    try {
+        const tag = sealed.ciphertext.subarray(sealed.ciphertext.length - 16);
+        const body = sealed.ciphertext.subarray(0, sealed.ciphertext.length - 16);
+        const d = createDecipheriv("aes-256-gcm", keys.derive("credential-enc"), sealed.iv);
+        d.setAuthTag(tag);
+        return Buffer.concat([d.update(body), d.final()]).toString("utf8");
+    }
+    catch {
+        // The overwhelmingly likely cause is a changed `SNAGSET_SECRET_KEY` —
+        // which 08 §4.7 warns makes stored credentials "unrecoverable
+        // ciphertext". Null rather than throwing, so a boot with a lost key
+        // degrades to "storage disconnected" instead of failing to start.
+        return null;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA6B5E,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,SAAiB;IACnD,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAa,EAAE,MAAc;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,8DAA8D;QAC9D,oEAAoE;QACpE,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/db/connect.js

@@ -0,0 +1,49 @@
+import postgres from "postgres";
+/**
+ * The one place a connection is opened — and the one place `prepare: false`
+ * is explained, so it does not get "optimised" back on.
+ *
+ * 08 §3.2 describes the blessed path as *"marketplace Postgres attached in the
+ * click, handing the app a **pooled** `DATABASE_URL`"*. A pooled endpoint is
+ * PgBouncer in transaction mode: a connection is handed to one transaction and
+ * then to somebody else, so a prepared statement created on it may be executed
+ * later against a different backend that never saw the PREPARE.
+ *
+ * The failure is not a clean error at the point of the mistake. It surfaces
+ * as `cached plan must not change result type` on some later query, usually
+ * after a migration has changed a table the plan referenced — which reads as
+ * database corruption and is nothing of the kind. It was found here by running
+ * the share-link suite twice against one pooled Neon endpoint: the second run
+ * dropped and recreated the schema, and every query afterwards failed.
+ *
+ * THE COST IS ONE EXTRA ROUND TRIP PER PARAMETERISED STATEMENT, EVERY TIME —
+ * not per unique query shape, which is what this comment used to claim.
+ * postgres.js sets `describeFirst` whenever a query has parameters and is not
+ * prepared (connection.js: `parameters.length && !q.prepared`), so it sends
+ * Describe+Flush, waits, then Bind+Execute+Sync. Measured against London from
+ * Seoul, 4 runs each: a parameterised `SELECT $1::int` costs **520 / 521 / 509
+ * / 519 ms** unprepared against **539 / 268 / 270 / 264 ms** prepared, on a
+ * link whose one-way is ~260 ms. Every statement in a request pays it.
+ *
+ * It is still the right default, and the reason is deployment rather than
+ * performance: 08 §3.2's blessed path hands out a pooled URL, and this is the
+ * setting that makes that URL work. But the cost is now written down, because
+ * it is the largest single term in the create path's latency and the next
+ * person to look at that number should not have to measure it again.
+ *
+ * (For the record, postgres.js DOES retry both `RevalidateCachedQuery` and
+ * `FetchPreparedStatement` — so re-enabling `prepare` is a real option to
+ * evaluate, not a settled impossibility. It wants its own test against a
+ * schema change on a pooled endpoint, which is the scenario that produced the
+ * original failure, and it should not be flipped without one.)
+ */
+export function connect(url, opts = {}) {
+    return postgres(url, {
+        max: opts.max ?? 10,
+        prepare: false,
+        // The server has its own logging rules (app.ts); postgres.js NOTICE output
+        // would bypass them.
+        onnotice: () => { },
+    });
+}
+//# sourceMappingURL=connect.js.map

package/dist/db/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/db/connect.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,OAAyB,EAAE;IAC9D,OAAO,QAAQ,CAAC,GAAG,EAAE;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;QACnB,OAAO,EAAE,KAAK;QACd,2EAA2E;QAC3E,qBAAqB;QACrB,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/db/migrate.js

@@ -0,0 +1,210 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import postgres from "postgres";
+/**
+ * The migrator — 08 §5.
+ *
+ * Hand-written, and deliberately not `drizzle-kit migrate`. A9 promises `npx
+ * snagset` against one `DATABASE_URL` works, which means migrations run at BOOT
+ * on a machine nobody is watching, on a platform that may start several
+ * instances of the process at once. That is a concurrency problem before it is
+ * a schema problem, and it is the half a migration runner bolted onto a CLI
+ * does not solve.
+ *
+ * The four rules that make an unattended boot safe:
+ *
+ *  1. **One advisory lock, taken first.** Vercel starts N lambdas; a Railway
+ *     deploy overlaps old and new containers. Without the lock, two processes
+ *     run `CREATE TABLE` concurrently and the loser dies on a duplicate — which
+ *     looks exactly like a corrupt database to whoever reads the logs. With it,
+ *     the loser waits and then finds there is nothing to do.
+ *  2. **Checksums, compared every boot.** A migration file that changed after
+ *     it was applied is the single most expensive thing to discover late: every
+ *     environment is now a different schema wearing the same version number.
+ *     Refused loudly, exit 4, before a single statement runs.
+ *  3. **Each file in ONE transaction.** Postgres does transactional DDL, so a
+ *     migration either happened or did not. The `.no-txn.sql` suffix opts out
+ *     for the statements that cannot run inside one (`CREATE INDEX
+ *     CONCURRENTLY`); nothing needs it at 0001, and the mechanism exists so
+ *     that the first thing that does is not also the first time this code is
+ *     asked to handle it.
+ *  4. **A short `lock_timeout`, per file.** A migration blocked behind a long
+ *     read holds the advisory lock while every other instance queues behind it.
+ *     Three seconds, then fail cleanly and let the platform retry — a failed
+ *     deploy is recoverable, a deploy wedged for an hour is an outage.
+ *
+ * Exit codes, because a boot script has to be able to tell these apart:
+ *   0  up to date (or applied cleanly)
+ *   3  could not connect / could not take the lock
+ *   4  refused: a checksum changed, or an applied migration is missing
+ *   1  a migration failed to apply
+ */
+const HERE = dirname(fileURLToPath(import.meta.url));
+const DIR = join(HERE, "migrations");
+/**
+ * The advisory lock id. A constant, because every instance has to pick the
+ * SAME number without coordinating — that is the entire mechanism.
+ *
+ * 0x63644D47 = 1667517767, the ASCII for "cdMG". Kept rather than re-derived
+ * from the new name: the number is meaningless by design, and changing it in a
+ * fleet where an old instance still holds the old one is precisely the
+ * split-brain the lock exists to prevent. Rename residue elsewhere is a bug;
+ * here it is the point.
+ */
+export const MIGRATION_LOCK_ID = 0x63644d47;
+const sha256 = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+/** Files in lexical order — `0001_…` before `0002_…`, which is why they are numbered. */
+function files() {
+    return readdirSync(DIR)
+        .filter((f) => f.endsWith(".sql"))
+        .sort()
+        .map((name) => {
+        const sql = readFileSync(join(DIR, name), "utf8");
+        return { name, sql, checksum: sha256(sql), txn: !name.endsWith(".no-txn.sql") };
+    });
+}
+export class MigrationError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+        super(message);
+        this.name = "MigrationError";
+        this.exitCode = exitCode;
+    }
+}
+export async function migrate(sql, log = console.log) {
+    // The ledger itself, first and outside the lock: it is `IF NOT EXISTS`, it is
+    // the only DDL that can safely race, and every later step reads it.
+    await sql `
+    CREATE TABLE IF NOT EXISTS _migrations (
+      name        text PRIMARY KEY,
+      checksum    text NOT NULL,
+      applied_at  timestamptz NOT NULL DEFAULT now(),
+      duration_ms integer NOT NULL
+    )
+  `;
+    // Rule 1. Session-scoped, released in the `finally` — not `pg_advisory_xact_lock`,
+    // because each migration wants its own transaction inside the held lock.
+    const lock = await sql `
+    SELECT pg_try_advisory_lock(${MIGRATION_LOCK_ID})
+  `;
+    if (!lock[0]?.pg_try_advisory_lock) {
+        // Another instance is mid-migration. Waiting is correct: by the time the
+        // lock frees, the work is done and this process finds nothing to apply.
+        log("migrate: another instance holds the lock — waiting");
+        await sql `SELECT pg_advisory_lock(${MIGRATION_LOCK_ID})`;
+    }
+    try {
+        const done = new Map((await sql `SELECT name, checksum FROM _migrations`).map((r) => [r.name, r.checksum]));
+        const pending = [];
+        // Rule 2, and it runs over EVERY file before any of them is applied. A
+        // half-migrated database whose next file is the corrupt one is worse than
+        // one that refused at the door.
+        /*
+         * WHEN 0001 STOPS BEING REGENERABLE, and why it still is today.
+         *
+         * 0001_init.sql is GENERATED from 05 §3 (gen-migration.mjs), so §3 is the
+         * single description of the schema and the file is its rendering. That
+         * works right up to the moment a second person has applied it, and then it
+         * cannot: an applied migration is history, and history that regenerates is
+         * a checksum mismatch on somebody else's database.
+         *
+         * The switch point is M2-35, where schemaVersion freezes for publish
+         * (spine §0.2). Before it there is exactly one real install -- the studio's
+         * own dogfood -- and correcting §3 plus bringing that one database along by
+         * hand is both cheaper and more honest than a numbered ALTER for a schema
+         * nobody else has. After it, §3 describes the CURRENT schema, 0001 is
+         * frozen at what publish shipped, and every change is a new numbered file.
+         * The generator's check has to change shape with it: from "0001 renders §3"
+         * to "0001 plus every later file EQUALS §3", which needs a scratch database
+         * to answer and is therefore a gate rather than a pure function.
+         *
+         * The rule below does not soften either way. It is what makes that switch
+         * point real rather than aspirational.
+         */
+        for (const f of files()) {
+            const seen = done.get(f.name);
+            if (seen === undefined) {
+                pending.push(f);
+            }
+            else if (seen !== f.checksum) {
+                throw new MigrationError(`${f.name} has changed since it was applied (recorded ${seen.slice(0, 12)}…, ` +
+                    `file is ${f.checksum.slice(0, 12)}…). An applied migration is history: ` +
+                    `add a new file instead of editing this one.`, 4);
+            }
+            done.delete(f.name);
+        }
+        // Whatever is left was applied and no longer exists on disk — a rollback to
+        // an older build against a newer database. Refused for the same reason:
+        // the code is about to assume a schema that is not the one present.
+        if (done.size) {
+            throw new MigrationError(`the database has migrations this build does not ship: ${[...done.keys()].join(", ")}. ` +
+                `This is an older release running against a newer database.`, 4);
+        }
+        if (!pending.length) {
+            log(`migrate: up to date (${files().length} applied)`);
+            return { applied: [], alreadyApplied: files().length };
+        }
+        const applied = [];
+        for (const f of pending) {
+            const started = Date.now();
+            log(`migrate: applying ${f.name}…`);
+            const run = async (tx) => {
+                // Rule 4, per file and inside the transaction so it reverts with it.
+                await tx `SET LOCAL lock_timeout = '3s'`;
+                await tx.unsafe(f.sql);
+                await tx `
+          INSERT INTO _migrations (name, checksum, duration_ms)
+          VALUES (${f.name}, ${f.checksum}, ${Date.now() - started})
+        `;
+            };
+            // Rule 3. `.no-txn.sql` runs on the connection directly — its statements
+            // are the ones Postgres refuses inside a transaction block.
+            if (f.txn)
+                await sql.begin(run);
+            else
+                await run(sql);
+            log(`migrate: applied ${f.name} in ${Date.now() - started} ms`);
+            applied.push(f.name);
+        }
+        return { applied, alreadyApplied: files().length - applied.length };
+    }
+    finally {
+        await sql `SELECT pg_advisory_unlock(${MIGRATION_LOCK_ID})`;
+    }
+}
+/**
+ * `pnpm migrate` / `snagset migrate`. The library above takes a connection so a
+ * test can hand it one; only this half reads the environment and exits.
+ */
+if (import.meta.url === `file://${process.argv[1]}`) {
+    const { loadConfig } = await import("../config.js");
+    let code = 0;
+    let sql;
+    try {
+        const cfg = loadConfig(process.env);
+        sql = (await import("./connect.js")).connect(cfg.required("DATABASE_URL"), { max: 1 });
+        await migrate(sql);
+    }
+    catch (e) {
+        if (e instanceof MigrationError) {
+            console.error(`✗ migrate: ${e.message}`);
+            code = e.exitCode;
+        }
+        else {
+            const msg = e instanceof Error ? e.message : String(e);
+            // A connection failure and a bad migration are different operator
+            // problems; 3 means "the database was not reachable", 1 means "it was,
+            // and it said no".
+            const connectionish = /ECONNREFUSED|ENOTFOUND|ETIMEDOUT|password|SASL|SSL|does not exist/i.test(msg);
+            console.error(`✗ migrate: ${msg}`);
+            code = connectionish ? 3 : 1;
+        }
+    }
+    finally {
+        await sql?.end({ timeout: 5 });
+    }
+    process.exit(code);
+}
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAO5C,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3F,yFAAyF;AACzF,SAAS,KAAK;IACZ,OAAO,WAAW,CAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;IAClF,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,QAAQ,CAAS;IAC1B,YAAY,OAAe,EAAE,QAAgB;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAChE,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,GAAG,CAAA;;;;;;;GAOR,CAAC;IAEF,mFAAmF;IACnF,yEAAyE;IACzE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAqC;kCAC3B,iBAAiB;GAChD,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC;QACnC,yEAAyE;QACzE,wEAAwE;QACxE,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAC1D,MAAM,GAAG,CAAA,2BAA2B,iBAAiB,GAAG,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,CAAC,MAAM,GAAG,CAAsC,wCAAwC,CAAC,CAAC,GAAG,CAC3F,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAC5B,CACF,CAAC;QACF,MAAM,OAAO,GAAG,EAAE,CAAC;QAEnB,uEAAuE;QACvE,0EAA0E;QAC1E,gCAAgC;QAChC;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,IAAI,cAAc,CACtB,GAAG,CAAC,CAAC,IAAI,+CAA+C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK;oBAC5E,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,uCAAuC;oBACzE,6CAA6C,EAC/C,CAAC,CACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,4EAA4E;QAC5E,wEAAwE;QACxE,oEAAoE;QACpE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,cAAc,CACtB,yDAAyD,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACtF,4DAA4D,EAC9D,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,GAAG,CAAC,wBAAwB,KAAK,EAAE,CAAC,MAAM,WAAW,CAAC,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;YAEpC,MAAM,GAAG,GAAG,KAAK,EAAE,EAA0C,EAAiB,EAAE;gBAC9E,qEAAqE;gBACrE,MAAM,EAAE,CAAA,+BAA+B,CAAC;gBACxC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,EAAE,CAAA;;oBAEI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACzD,CAAC;YACJ,CAAC,CAAC;YAEF,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,CAAC,CAAC,GAAG;gBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;;gBAC3B,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpB,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,KAAK,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,CAAA,6BAA6B,iBAAiB,GAAG,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,cAAc,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,kEAAkE;YAClE,uEAAuE;YACvE,mBAAmB;YACnB,MAAM,aAAa,GAAG,oEAAoE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrG,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;YACnC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}