harper 5.1.20 → 5.2.0-alpha.5

package/dist/components/secretOperations.js

@@ -0,0 +1,475 @@
+'use strict';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSecret = setSecret;
+exports.grantSecret = grantSecret;
+exports.revokeSecret = revokeSecret;
+exports.listSecrets = listSecrets;
+exports.deleteSecret = deleteSecret;
+exports.getSecretsPublicKey = getSecretsPublicKey;
+exports.deriveRegistrySecretName = deriveRegistrySecretName;
+exports.ingestRegistryAuth = ingestRegistryAuth;
+exports.resolveRegistryAuth = resolveRegistryAuth;
+// Operations against system.hdb_secret — the envelope-encrypted secrets store (#715).
+//
+// Only ciphertext is ever stored: a plaintext `value` submitted to set_secret is encrypted
+// immediately with the cluster public key (custody must be registered) and the plaintext is
+// discarded; processLocalTransaction strips `value`/`envelope` from the operations log before
+// dispatch. Rows reach peers via normal system-table replication — these operations deliberately
+// do NOT call replicateOperation (op replication on top of table replication would double-apply).
+//
+// All operations are super_user only, enforced in-handler in addition to the requiredPermissions
+// registration: an `operations` allowlist on a role can otherwise delegate SU-only ops (see the
+// gate-2 bypass in utility/operation_authorization.ts), and secret custody must not be delegable.
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const databases_ts_1 = require("../resources/databases.js");
+const configUtils = __importStar(require("../config/configUtils.js"));
+const terms = __importStar(require("../utility/hdbTerms.js"));
+const hdbError_ts_1 = require("../utility/errors/hdbError.js");
+const harper_logger_ts_1 = __importDefault(require("../utility/logging/harper_logger.js"));
+const validator = __importStar(require("./operationsValidation.js"));
+const secretDecryptor_ts_1 = require("../resources/secretDecryptor.js");
+const secretEnvelope_ts_1 = require("../utility/secretEnvelope.js");
+const envFile_ts_1 = require("../utility/envFile.js");
+const { HTTP_STATUS_CODES } = hdbError_ts_1.hdbErrors;
+const SECRET_TABLE = terms.SYSTEM_TABLE_NAMES.SECRET_TABLE_NAME;
+function requireSuperUser(req) {
+    if (!req?.hdb_user?.role?.permission?.super_user) {
+        throw new hdbError_ts_1.ClientError(`Operation '${req?.operation}' is restricted to super_user roles`, HTTP_STATUS_CODES.FORBIDDEN);
+    }
+}
+function validate(validation) {
+    if (validation) {
+        throw (0, hdbError_ts_1.handleHDBError)(validation, validation.message, HTTP_STATUS_CODES.BAD_REQUEST);
+    }
+}
+function secretTable() {
+    const table = databases_ts_1.databases.system?.[SECRET_TABLE];
+    if (!table) {
+        throw new hdbError_ts_1.ClientError(`The secrets store is not initialized on this node (system.${SECRET_TABLE} missing). ` +
+            `Run upgrade or restart the server to provision the table.`);
+    }
+    return table;
+}
+// Grants are a set: duplicates would let one revoke leave a residual grant behind, so every write
+// path normalizes through this (including rows that arrived dirty via replication).
+function dedupeGrants(grants) {
+    return Array.isArray(grants) ? [...new Set(grants)] : [];
+}
+// Rebuild a plain record from a stored row's known attributes (never spread rows — RecordObject
+// prototype fields don't survive a spread reliably; see DESIGN.md).
+function toRecord(row) {
+    return {
+        name: row.name,
+        envelope: row.envelope,
+        kid: row.kid ?? null,
+        grants: dedupeGrants(row.grants),
+        processEnv: !!row.processEnv,
+        metadata: row.metadata ?? {},
+        unverified: !!row.unverified,
+        updated_by: row.updated_by ?? null,
+    };
+}
+// True when a directory with the component's name exists under the components root. Advisory
+// only (audit breadcrumb) — must never block or throw.
+function componentIsKnown(component) {
+    try {
+        return (0, node_fs_1.existsSync)((0, node_path_1.join)(configUtils.getConfigPath(terms.CONFIG_PARAMS.COMPONENTSROOT), component));
+    }
+    catch {
+        return false;
+    }
+}
+// Serialize read-modify-write mutations per secret name. The operations API dispatches these
+// handlers on the MAIN thread only, so an in-process promise chain is sufficient to make the
+// get→mutate→put of set_secret/grant_secret/revoke_secret/delete_secret atomic against local
+// concurrency (without it, overlapping grant/revoke calls can silently drop each other's
+// mutation). Cross-node concurrency remains last-write-wins on the whole row — the known
+// system-table replication semantic.
+const nameLocks = new Map();
+async function withSecretLock(name, fn) {
+    const prior = nameLocks.get(name) ?? Promise.resolve();
+    const run = prior.then(fn);
+    // The stored tail never rejects, so a failed mutation doesn't poison the chain.
+    const tail = run.then(() => undefined, () => undefined);
+    nameLocks.set(name, tail);
+    try {
+        return await run;
+    }
+    finally {
+        if (nameLocks.get(name) === tail)
+            nameLocks.delete(name);
+    }
+}
+// Structured audit event for every mutation — operation, secret name, and user, never values.
+function notifyMutation(operation, name, req, detail) {
+    harper_logger_ts_1.default.notify(`secret mutation: op=${operation} name=${name} user=${req?.hdb_user?.username ?? 'unknown'}${detail ? ` ${detail}` : ''}`);
+}
+/**
+ * Upsert a secret. Exactly one of `value` (plaintext, encrypted immediately — requires custody)
+ * or `envelope` (`enc:v1:...` ciphertext, encrypted client-side against get_secrets_public_key).
+ * `kid` is derived from the envelope server-side; a client-supplied kid field is never trusted.
+ * Never returns or logs plaintext.
+ *
+ * The delivery tier is explicit and mutually exclusive (a process-env secret is already global, so
+ * scoping it is meaningless):
+ *   - `processEnv: true` — materialized into the real `process.env` at component load, inherited by
+ *     child processes (`.env` semantics). No isolation promise.
+ *   - `grants: [...]` — scoped: never in `process.env`, exposed only to the listed components via the
+ *     `secrets` accessor.
+ * Both default to the stored row so a value rotation preserves the tier without re-specifying it.
+ */
+async function setSecret(req) {
+    requireSuperUser(req);
+    validate(validator.setSecretValidator(req));
+    const table = secretTable();
+    const { name } = req;
+    const custody = (0, secretDecryptor_ts_1.getSecretCustody)();
+    let envelope;
+    let kid;
+    let unverified = false;
+    if (req.value !== undefined) {
+        if (!custody) {
+            throw new hdbError_ts_1.ClientError('secrets custody is not initialized on this node');
+        }
+        const { publicKey, fingerprint } = custody.getPublicKey();
+        envelope = envFile_ts_1.ENV_ENCRYPTED_PREFIX + (0, secretEnvelope_ts_1.encryptEnvelope)(req.value, publicKey, fingerprint);
+        kid = fingerprint;
+        delete req.value; // plaintext is now sealed; drop the reference
+    }
+    else {
+        // Deliberately NEVER decrypted server-side: a decrypt-verify would put the plaintext in
+        // this thread's heap, defeating client-side encryption. Ingest checks are structural
+        // (marker, base64url JSON, k/iv/ct/tag base64 fields) plus a kid-vs-custody fingerprint
+        // match; a tampered-but-well-formed envelope is only caught at consumption time.
+        envelope = req.envelope;
+        if (!envelope.startsWith(envFile_ts_1.ENV_ENCRYPTED_PREFIX)) {
+            throw new hdbError_ts_1.ClientError(`'envelope' must start with '${envFile_ts_1.ENV_ENCRYPTED_PREFIX}'`);
+        }
+        let fields;
+        try {
+            fields = (0, secretEnvelope_ts_1.parseEnvelopeFields)(envelope.slice(envFile_ts_1.ENV_ENCRYPTED_PREFIX.length));
+        }
+        catch (error) {
+            throw new hdbError_ts_1.ClientError(`Invalid secret envelope: ${error.message}`);
+        }
+        kid = fields.kid ?? null;
+        if (custody) {
+            const { fingerprint } = custody.getPublicKey();
+            if (kid !== null && kid !== fingerprint) {
+                throw new hdbError_ts_1.ClientError(`Secret envelope kid '${kid}' does not match this cluster's secrets key ` +
+                    `(expected '${fingerprint}'; fetch it via get_secrets_public_key)`);
+            }
+            if (kid === null) {
+                // No sealed kid to check against custody — accept, but surface it in list_secrets.
+                unverified = true;
+                harper_logger_ts_1.default.warn(`set_secret '${name}': envelope carries no kid; accepted without key-identity verification`);
+            }
+        }
+        else {
+            // No custody on this node: accept, but mark the row so a bad envelope is visible in
+            // list_secrets instead of silently failing later.
+            unverified = true;
+            harper_logger_ts_1.default.warn(`set_secret '${name}': envelope accepted without verification (no secrets custody registered on this node)`);
+        }
+    }
+    return withSecretLock(name, async () => {
+        const existing = await table.get(name);
+        const processEnv = req.processEnv ?? existing?.processEnv ?? false;
+        const grants = dedupeGrants(req.grants ?? existing?.grants);
+        if (processEnv && grants.length > 0) {
+            throw new hdbError_ts_1.ClientError(`Secret '${name}' cannot be both processEnv and grant-scoped — a processEnv secret is global. ` +
+                `Set processEnv:false to scope it with grants, or omit grants.`);
+        }
+        await table.put({
+            name,
+            envelope,
+            kid,
+            grants: processEnv ? [] : grants,
+            processEnv,
+            metadata: req.metadata ?? existing?.metadata ?? {},
+            unverified,
+            updated_by: req.hdb_user?.username ?? null,
+        });
+        notifyMutation(terms.OPERATIONS_ENUM.SET_SECRET, name, req, unverified ? 'unverified=true' : undefined);
+        return { name, kid, created: existing == null };
+    });
+}
+async function mutateGrants(req, grant) {
+    requireSuperUser(req);
+    validate(validator.grantSecretValidator(req));
+    const table = secretTable();
+    return withSecretLock(req.name, async () => {
+        const row = await table.get(req.name);
+        if (!row) {
+            throw new hdbError_ts_1.ClientError(`No secret found with name '${req.name}'`, HTTP_STATUS_CODES.NOT_FOUND);
+        }
+        const record = toRecord(row); // record.grants comes back deduped
+        // A processEnv secret is global; granting/revoking a component scope is contradictory. Revoke
+        // is a no-op on an already-empty grants list, so only the grant path needs to reject loudly.
+        if (grant && record.processEnv) {
+            throw new hdbError_ts_1.ClientError(`Secret '${req.name}' is a processEnv (global) secret and cannot be scoped to a component. ` +
+                `Re-run set_secret with processEnv:false to convert it to a scoped secret first.`);
+        }
+        const present = record.grants.includes(req.component);
+        const storedLength = Array.isArray(row.grants) ? row.grants.length : 0;
+        // No-op short-circuit: nothing to write, nothing to audit, no updated_by/__updatedtime__
+        // bump. A stored row with duplicate grants (dirty state) is NOT a no-op — falling through
+        // persists the normalized set.
+        if ((grant ? present : !present) && record.grants.length === storedLength) {
+            return { name: req.name, grants: record.grants, changed: false };
+        }
+        if (grant && !present)
+            record.grants.push(req.component);
+        // Remove every occurrence — with the dedupe this is belt-and-braces against dirty rows.
+        if (!grant)
+            record.grants = record.grants.filter((component) => component !== req.component);
+        record.updated_by = req.hdb_user?.username ?? null;
+        await table.put(record);
+        // Granting to a not-yet-deployed component is legal (grants may precede the deploy), but an
+        // unknown name is worth a breadcrumb in the audit event — it is usually a typo.
+        let detail = `component=${req.component}`;
+        if (grant && !componentIsKnown(req.component))
+            detail += ' component_known=false';
+        notifyMutation(grant ? terms.OPERATIONS_ENUM.GRANT_SECRET : terms.OPERATIONS_ENUM.REVOKE_SECRET, req.name, req, detail);
+        return { name: req.name, grants: record.grants, changed: true };
+    });
+}
+/** Add a component to a secret's grants list (idempotent). */
+function grantSecret(req) {
+    return mutateGrants(req, true);
+}
+/** Remove a component from a secret's grants list (idempotent). */
+function revokeSecret(req) {
+    return mutateGrants(req, false);
+}
+/**
+ * List secret metadata: never envelopes, never values. Includes the node's current custody
+ * fingerprint (null when custody is absent) and a per-row kid_matches_custody flag so stale rows
+ * on a cloned/rekeyed node are immediately visible.
+ */
+async function listSecrets(req) {
+    requireSuperUser(req);
+    const table = secretTable();
+    const custody = (0, secretDecryptor_ts_1.getSecretCustody)();
+    const custodyFingerprint = custody ? custody.getPublicKey().fingerprint : null;
+    const secrets = [];
+    for await (const row of table.search([])) {
+        secrets.push({
+            name: row.name,
+            kid: row.kid ?? null,
+            grants: Array.isArray(row.grants) ? [...row.grants] : [],
+            processEnv: !!row.processEnv,
+            metadata: row.metadata ?? {},
+            unverified: !!row.unverified,
+            updated_by: row.updated_by ?? null,
+            __createdtime__: row.__createdtime__,
+            __updatedtime__: row.__updatedtime__,
+            kid_matches_custody: custodyFingerprint !== null && row.kid === custodyFingerprint,
+        });
+    }
+    secrets.sort((a, b) => String(a.name).localeCompare(String(b.name)));
+    return { secrets, custody_fingerprint: custodyFingerprint };
+}
+/** Delete a secret row. Not cryptographic erasure — audit/txn logs and backups retain envelopes. */
+async function deleteSecret(req) {
+    requireSuperUser(req);
+    validate(validator.deleteSecretValidator(req));
+    const table = secretTable();
+    return withSecretLock(req.name, async () => {
+        const row = await table.get(req.name);
+        if (!row) {
+            throw new hdbError_ts_1.ClientError(`No secret found with name '${req.name}'`, HTTP_STATUS_CODES.NOT_FOUND);
+        }
+        await table.delete(req.name);
+        notifyMutation(terms.OPERATIONS_ENUM.DELETE_SECRET, req.name, req);
+        return { message: `Successfully deleted secret '${req.name}'` };
+    });
+}
+/** The cluster secrets public key, for client-side envelope encryption. */
+function getSecretsPublicKey(req) {
+    requireSuperUser(req);
+    const custody = (0, secretDecryptor_ts_1.getSecretCustody)();
+    if (!custody) {
+        throw new hdbError_ts_1.ClientError('secrets custody is not initialized on this node');
+    }
+    const { publicKey, fingerprint } = custody.getPublicKey();
+    return { public_key: publicKey, fingerprint };
+}
+/**
+ * Deterministic name for the auto-minted secret backing a literal registry token: keyed by the
+ * deploying component and the registry, so re-supplying (or rotating) the token on a later deploy
+ * overwrites the same row rather than accumulating one per deploy. Sanitized to the set_secret name
+ * grammar (`\w.-`), since a registry can carry a scheme, port, or path.
+ */
+function deriveRegistrySecretName(component, registry) {
+    const registryKey = registry
+        .trim()
+        .replace(/^https?:\/\//i, '')
+        .replace(/^\/\//, '')
+        .replace(/\/+$/, '')
+        .toLowerCase()
+        .replace(/[^\w.-]+/g, '_');
+    const componentKey = String(component).replace(/[^\w.-]+/g, '_');
+    return `deploy.${componentKey}.${registryKey}`;
+}
+/**
+ * Ingest deploy_component `registryAuth` into the secrets store so a provided registry token lives
+ * as ciphertext in the replicated, audited `hdb_secret` store (reference, not embed) rather than
+ * travelling in the operation body. Returns the entries in reference form (`{ registry, secret }`).
+ *
+ * - A literal `{ registry, token }` entry is encrypted (via `set_secret`, custody required) under a
+ *   derived name granted to `component`, and returned as a reference. Overwrites an existing
+ *   derived row so token rotation is idempotent.
+ * - An already-reference `{ registry, secret }` entry passes through unchanged (peers re-running a
+ *   replicated deploy already carry references — they never re-ingest).
+ * - With no custody on this node (OSS core, or key not held here), literal tokens CANNOT be sealed;
+ *   they pass through untouched so the caller can fall back to the transient, this-node-only path.
+ *   The reference-form result therefore contains only entries the caller may persist and replicate.
+ *
+ * Runs on the deploying main thread where custody is registered.
+ */
+async function ingestRegistryAuth(req, registryAuth, component) {
+    if (!Array.isArray(registryAuth) || registryAuth.length === 0)
+        return registryAuth ?? [];
+    const custody = (0, secretDecryptor_ts_1.getSecretCustody)();
+    const out = [];
+    for (const entry of registryAuth) {
+        // Already a reference (or nothing to seal without custody): leave as-is.
+        if (entry.secret !== undefined || !custody) {
+            out.push(entry);
+            continue;
+        }
+        const name = deriveRegistrySecretName(component, entry.registry);
+        // Reuse set_secret's seal-and-store path (encrypt with custody, grant to the component, audit
+        // the mutation). The deploy request is already super_user, which set_secret requires.
+        await setSecret({
+            operation: terms.OPERATIONS_ENUM.SET_SECRET,
+            hdb_user: req?.hdb_user,
+            name,
+            value: entry.token,
+            grants: [component],
+            processEnv: false,
+        });
+        out.push(entry.scope === undefined
+            ? { registry: entry.registry, secret: name }
+            : { registry: entry.registry, secret: name, scope: entry.scope });
+    }
+    return out;
+}
+/** Wait (bounded) for a secret row to appear — covers the replicated-deploy race where a peer runs
+ * the deploy before the origin's hdb_secret row has replicated in. */
+async function waitForSecretRow(table, name, waitMs) {
+    const deadline = Date.now() + waitMs;
+    let row = await table.get(name);
+    while (!row && Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, Math.min(200, Math.max(1, waitMs))));
+        row = await table.get(name);
+    }
+    return row;
+}
+/**
+ * Resolve deploy_component `registryAuth` entries that reference a stored secret
+ * (`{ registry, secret }`) into concrete token entries (`{ registry, token }`) by decrypting the
+ * named hdb_secret row on this thread. Entries that already carry a literal `token` pass through
+ * unchanged, so this is a no-op for the token-only fallback form.
+ *
+ * This is intentionally NOT a `get_secret` operation — the store never returns plaintext across the
+ * API boundary. The resolved token is handed back to the install path in-memory, fed to the
+ * transient .npmrc, and never written back to the request body, replicated, or logged.
+ *
+ * Authority mirrors the accessor model (#1550): the referenced secret must be usable by the
+ * component being deployed — either a `processEnv` (global) secret or a scoped secret granted to
+ * `component`. Without that, the deploy path would let a super_user pull an arbitrary scoped secret
+ * into an .npmrc, sidestepping the grant that is the store's authority. A missing row, missing
+ * grant, absent custody, or decrypt failure throws a ClientError naming the precise reason.
+ *
+ * `options.waitMs` gives a bounded grace period for a referenced row to replicate in (used on the
+ * peer side of a replicated deploy, where the deploy op can arrive just ahead of the hdb_secret
+ * row); it defaults to 0 (the origin wrote the row before it resolves, so no wait is needed).
+ *
+ * Runs on the main thread, where the operations API dispatches deploys and the Pro secrets
+ * component registers custody — the same place set_secret decrypts. On a node without custody
+ * (OSS core, or a custody key not held here) a referenced secret cannot be resolved and the deploy
+ * fails loudly rather than silently installing without auth.
+ */
+async function resolveRegistryAuth(registryAuth, component, options = {}) {
+    if (!Array.isArray(registryAuth) || registryAuth.length === 0)
+        return registryAuth;
+    // Token-only requests must not require custody or a provisioned store — keep the fast path pure.
+    if (!registryAuth.some((entry) => entry && entry.secret !== undefined))
+        return registryAuth;
+    const waitMs = options.waitMs ?? 0;
+    const table = secretTable();
+    const resolved = [];
+    for (const entry of registryAuth) {
+        if (!entry)
+            continue; // parity with the fast-path guard above; validated entries are never null
+        if (entry.secret === undefined) {
+            resolved.push({ registry: entry.registry, token: entry.token, scope: entry.scope });
+            continue;
+        }
+        const name = entry.secret;
+        const row = waitMs > 0 ? await waitForSecretRow(table, name, waitMs) : await table.get(name);
+        if (!row) {
+            throw new hdbError_ts_1.ClientError(`registryAuth references secret '${name}', which does not exist`, HTTP_STATUS_CODES.NOT_FOUND);
+        }
+        const grants = Array.isArray(row.grants) ? row.grants : [];
+        if (!row.processEnv && !grants.includes(component)) {
+            throw new hdbError_ts_1.ClientError(`registryAuth secret '${name}' is not granted to component '${component}' ` +
+                `(grant it with grant_secret, or set it processEnv:true)`, HTTP_STATUS_CODES.FORBIDDEN);
+        }
+        const custody = (0, secretDecryptor_ts_1.getSecretCustody)();
+        if (!custody) {
+            // Server-state condition, not a client-fixable request: the same body would resolve once
+            // custody comes up, so report it retryable (503) rather than the ClientError default 400.
+            throw new hdbError_ts_1.ClientError(`secrets custody is not initialized on this node; cannot resolve registryAuth secret '${name}'`, HTTP_STATUS_CODES.SERVICE_UNAVAILABLE);
+        }
+        let token;
+        try {
+            token = custody.decrypt(row.envelope);
+        }
+        catch (error) {
+            throw new hdbError_ts_1.ClientError(`Failed to decrypt registryAuth secret '${name}': ${error.message}`, HTTP_STATUS_CODES.INTERNAL_SERVER_ERROR);
+        }
+        resolved.push({ registry: entry.registry, token, scope: entry.scope });
+    }
+    return resolved;
+}
+//# sourceMappingURL=secretOperations.js.map

package/dist/components/secretOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretOperations.js","sourceRoot":"","sources":["../../components/secretOperations.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkIb,8BAiFC;AAiDD,kCAEC;AAGD,oCAEC;AAOD,kCAuBC;AAGD,oCAcC;AAGD,kDAQC;AAsBD,4DAUC;AAkBD,gDA4BC;AAuCD,kDAuDC;AA/eD,sFAAsF;AACtF,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,8FAA8F;AAC9F,iGAAiG;AACjG,kGAAkG;AAClG,EAAE;AACF,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAElG,qCAAqC;AACrC,yCAAiC;AACjC,4DAAsD;AACtD,sEAAwD;AACxD,8DAAgD;AAChD,+DAAuF;AACvF,2FAAyD;AACzD,qEAAuD;AACvD,wEAAmE;AACnE,oEAAoF;AACpF,sDAA6D;AAE7D,MAAM,EAAE,iBAAiB,EAAE,GAAG,uBAAS,CAAC;AACxC,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;AAEhE,SAAS,gBAAgB,CAAC,GAAQ;IACjC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAW,CACpB,cAAc,GAAG,EAAE,SAAS,qCAAqC,EACjE,iBAAiB,CAAC,SAAS,CAC3B,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,UAAe;IAChC,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,IAAA,4BAAc,EAAC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC;AACF,CAAC;AAED,SAAS,WAAW;IACnB,MAAM,KAAK,GAAI,wBAAiB,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAW,CACpB,6DAA6D,YAAY,aAAa;YACrF,2DAA2D,CAC5D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,oFAAoF;AACpF,SAAS,YAAY,CAAC,MAAW;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,gGAAgG;AAChG,oEAAoE;AACpE,SAAS,QAAQ,CAAC,GAAQ;IACzB,OAAO;QACN,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;QACpB,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;QAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;KAClC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,uDAAuD;AACvD,SAAS,gBAAgB,CAAC,SAAiB;IAC1C,IAAI,CAAC;QACJ,OAAO,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,6FAA6F;AAC7F,6FAA6F;AAC7F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,qCAAqC;AACrC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;AACnD,KAAK,UAAU,cAAc,CAAI,IAAY,EAAE,EAAoB;IAClE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,gFAAgF;IAChF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,GAAQ,EAAE,MAAe;IACjF,0BAAM,CAAC,MAAM,CACZ,uBAAuB,SAAS,SAAS,IAAI,SAAS,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACzH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,SAAS,CAAC,GAAQ;IACvC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAA,qCAAgB,GAAE,CAAC;IACnC,IAAI,QAAgB,CAAC;IACrB,IAAI,GAAkB,CAAC;IACvB,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,yBAAW,CAAC,iDAAiD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1D,QAAQ,GAAG,iCAAoB,GAAG,IAAA,mCAAe,EAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACrF,GAAG,GAAG,WAAW,CAAC;QAClB,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,8CAA8C;IACjE,CAAC;SAAM,CAAC;QACP,wFAAwF;QACxF,qFAAqF;QACrF,wFAAwF;QACxF,iFAAiF;QACjF,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,iCAAoB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,yBAAW,CAAC,+BAA+B,iCAAoB,GAAG,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACJ,MAAM,GAAG,IAAA,uCAAmB,EAAC,QAAQ,CAAC,KAAK,CAAC,iCAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAW,CAAC,4BAA6B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC;QACzB,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,IAAI,yBAAW,CACpB,wBAAwB,GAAG,8CAA8C;oBACxE,cAAc,WAAW,yCAAyC,CACnE,CAAC;YACH,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,mFAAmF;gBACnF,UAAU,GAAG,IAAI,CAAC;gBAClB,0BAAM,CAAC,IAAI,CAAC,eAAe,IAAI,wEAAwE,CAAC,CAAC;YAC1G,CAAC;QACF,CAAC;aAAM,CAAC;YACP,oFAAoF;YACpF,kDAAkD;YAClD,UAAU,GAAG,IAAI,CAAC;YAClB,0BAAM,CAAC,IAAI,CACV,eAAe,IAAI,wFAAwF,CAC3G,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,KAAK,CAAC;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,yBAAW,CACpB,WAAW,IAAI,gFAAgF;gBAC9F,+DAA+D,CAChE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC,GAAG,CAAC;YACf,IAAI;YACJ,QAAQ;YACR,GAAG;YACH,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;YAChC,UAAU;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE;YAClD,UAAU;YACV,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;SAC1C,CAAC,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxG,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,GAAQ,EAAE,KAAc;IACnD,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,yBAAW,CAAC,8BAA8B,GAAG,CAAC,IAAI,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;QACjE,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,yBAAW,CACpB,WAAW,GAAG,CAAC,IAAI,yEAAyE;gBAC3F,iFAAiF,CAClF,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,yFAAyF;QACzF,0FAA0F;QAC1F,+BAA+B;QAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,wFAAwF;QACxF,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7F,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;QACnD,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxB,4FAA4F;QAC5F,gFAAgF;QAChF,IAAI,MAAM,GAAG,aAAa,GAAG,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC;QAClF,cAAc,CACb,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,EAChF,GAAG,CAAC,IAAI,EACR,GAAG,EACH,MAAM,CACN,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,WAAW,CAAC,GAAQ;IACnC,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,mEAAmE;AACnE,SAAgB,YAAY,CAAC,GAAQ;IACpC,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAC,GAAQ;IACzC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtB,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAA,qCAAgB,GAAE,CAAC;IACnC,MAAM,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI;YACpB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;YACxD,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,mBAAmB,EAAE,kBAAkB,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB;SAClF,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;AAC7D,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,YAAY,CAAC,GAAQ;IAC1C,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,yBAAW,CAAC,8BAA8B,GAAG,CAAC,IAAI,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,gCAAgC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,GAAQ;IAC3C,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,IAAA,qCAAgB,GAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,yBAAW,CAAC,iDAAiD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC;AAgBD;;;;;GAKG;AACH,SAAgB,wBAAwB,CAAC,SAAiB,EAAE,QAAgB;IAC3E,MAAM,WAAW,GAAG,QAAQ;SAC1B,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,WAAW,EAAE;SACb,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACjE,OAAO,UAAU,YAAY,IAAI,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,kBAAkB,CAAC,GAAQ,EAAE,YAA+B,EAAE,SAAiB;IACpG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,IAAI,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAA,qCAAgB,GAAE,CAAC;IACnC,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QAClC,yEAAyE;QACzE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjE,8FAA8F;QAC9F,sFAAsF;QACtF,MAAM,SAAS,CAAC;YACf,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,UAAU;YAC3C,QAAQ,EAAE,GAAG,EAAE,QAAQ;YACvB,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CACP,KAAK,CAAC,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;YAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACjE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;sEACsE;AACtE,KAAK,UAAU,gBAAgB,CAAC,KAAU,EAAE,IAAY,EAAE,MAAc;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,KAAK,UAAU,mBAAmB,CACxC,YAA+B,EAC/B,SAAiB,EACjB,UAA+B,EAAE;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACnF,iGAAiG;IACjG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IAE5F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,SAAS,CAAC,0EAA0E;QAChG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACpF,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7F,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,yBAAW,CACpB,mCAAmC,IAAI,yBAAyB,EAChE,iBAAiB,CAAC,SAAS,CAC3B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,yBAAW,CACpB,wBAAwB,IAAI,kCAAkC,SAAS,IAAI;gBAC1E,yDAAyD,EAC1D,iBAAiB,CAAC,SAAS,CAC3B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,qCAAgB,GAAE,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,yFAAyF;YACzF,0FAA0F;YAC1F,MAAM,IAAI,yBAAW,CACpB,wFAAwF,IAAI,GAAG,EAC/F,iBAAiB,CAAC,mBAAmB,CACrC,CAAC;QACH,CAAC;QACD,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACJ,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,yBAAW,CACpB,0CAA0C,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,EAC9E,iBAAiB,CAAC,qBAAqB,CACvC,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/config/configUtils.d.ts

@@ -64,7 +64,10 @@ export declare function getConfiguration(): any;
  * @param setConfigJson
 
  */
-export declare function setConfiguration(setConfigJson: any): Promise<string>;
+export declare function setConfiguration(setConfigJson: any): Promise<{
+    message: string;
+    replicated?: unknown[];
+} | "Configuration successfully set. You must restart Harper for new config settings to take effect.">;
 export declare function readConfigFile(): any;
 /**
  * This function reads config settings from old settings file(before 4.0.0), aligns old keys to new keys, gets old

package/dist/config/configUtils.js

@@ -768,9 +768,26 @@ function getConfiguration() {
  */
 async function setConfiguration(setConfigJson) {
     // eslint-disable-next-line no-unused-vars
-    const { operation, hdb_user, hdbAuthHeader, ...configFields } = setConfigJson;
+    const { operation, hdb_user, hdbAuthHeader, replicated, ...configFields } = setConfigJson;
+    // Operation-control field, not a config param: enforce boolean (matching other
+    // `replicated` surfaces, e.g. analyticsValidator) before any local write so a
+    // malformed value like the string "false" — which is truthy — can't apply config
+    // locally or trigger an unintended fan-out.
+    if (replicated !== undefined && typeof replicated !== 'boolean') {
+        throw (0, hdbError_ts_1.handleHDBError)(new Error(), `'replicated' must be a boolean`, commonErrors_ts_1.HTTP_STATUS_CODES.BAD_REQUEST, undefined, undefined, true);
+    }
     try {
         updateConfigValue(undefined, undefined, configFields, true);
+        if (replicated) {
+            // Opt-in fan-out to all cluster nodes (#660). replicateOperation forwards the
+            // body with `replicated: false`, so peers apply locally without re-replicating;
+            // per-node outcomes are returned on `response.replicated`. `replicated` must
+            // stay out of configFields on both origin and peers, or it would be written to
+            // the config file as a config param.
+            const response = await Server_ts_1.server.replication.replicateOperation(setConfigJson);
+            response.message = CONFIGURE_SUCCESS_RESPONSE;
+            return response;
+        }
         return CONFIGURE_SUCCESS_RESPONSE;
     }
     catch (err) {