@braidhq/server 0.0.1 → 0.2.0

package/dist/routes/sourceWebhooks.js

@@ -0,0 +1,301 @@
+import { Buffer } from 'node:buffer';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createLogger, NotFoundError, ServiceUnavailableError, UnauthorizedError, ValidationError } from '@braidhq/core';
+import { SourceId, WorkspaceId } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { Hono } from 'hono';
+import { WorkspaceIdParam } from './_shared.js';
+/**
+ * GitHub webhook plumbing for filesystem sources,
+ * whose loader plugin declares a `webhook` capability.
+ *
+ * Two routers.
+ *
+ *   `createGithubWebhookReceiver` is public (no Bearer auth).
+ *   GitHub POSTs deliveries here.
+ *   We verify the HMAC, confirm the payload names the claimed repo,
+ *   ask the plugin whether the event is worth a `syncOne`,
+ *   and dispatch in the background. The response returns immediately,
+ *   so GitHub's ~10s delivery timeout never trips on a slow loader.
+ *
+ *   `createSourceWebhooksAdminRouter` is workspace-scoped,
+ *   and gated by the existing auth middleware.
+ *   Studio uses it to display the webhook URL and rotate the secret.
+ *
+ * The receiver is loader-agnostic and does not switch on `loader.kind`.
+ * A new loader extends the webhook surface from its plugin definition,
+ * via `webhook: { repoIdentity, shouldDispatch }`.
+ *
+ * Secrets live in the existing `SecretStore`,
+ * under namespace `webhook-github`, keyed by `<workspaceId>--<sourceId>`.
+ * That mirrors the OAuth namespaces (oauth-google, oauth-github),
+ * which already use the same `--` separator.
+ */
+const SECRET_NAMESPACE = 'webhook-github';
+const PROVIDER = 'github';
+function secretKey(workspaceId, sourceId) {
+    return `${workspaceId}--${sourceId}`;
+}
+const receiverLogger = createLogger('webhooks.github.receiver');
+// Verify GitHub's `X-Hub-Signature-256` header.
+// GitHub computes `sha256=<hex>` over the raw body with the secret.
+// We recompute and compare in constant time.
+// The prefix check is case-insensitive,
+// because some proxies and WAFs normalise headers.
+function verifySignature(rawBody, header, secret) {
+    if (!header || !header.toLowerCase().startsWith('sha256='))
+        return false;
+    // Normalise the hex digest to lowercase,
+    // so the timing-safe compare still accepts an uppercased hex,
+    // (rare but valid).
+    const provided = `sha256=${header.slice('sha256='.length).toLowerCase()}`;
+    const expected = `sha256=${createHmac('sha256', secret).update(rawBody).digest('hex')}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(provided);
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(a, b);
+}
+// Look up the loader plugin's `webhook` capability for a source.
+// Returns undefined when the source is not webhook-capable, never throws.
+function resolveWebhookCapability(pluginRegistry, source) {
+    if (source.kind !== 'filesystem' || !source.loader)
+        return undefined;
+    const plugin = pluginRegistry.findSourceLoader(source.loader.kind);
+    if (!plugin?.webhook)
+        return undefined;
+    return { capability: plugin.webhook, config: source.loader.config };
+}
+// Uniform anonymous response for any pre-signature failure,
+// (missing workspace, source, webhook capability, secret, or HMAC).
+// Distinct error bodies would leak which pairs exist,
+// and which are webhook-armed, to an unauthenticated caller.
+// That recon ladder we deliberately close off.
+function unauthorized() {
+    throw new UnauthorizedError('Invalid webhook signature.');
+}
+// Run the full pre-signature pipeline inside a single try/catch,
+// (header presence, body read, workspace and source lookup,
+// plugin webhook capability, repo identity, secret read, HMAC verify).
+// Returns the trusted state on success and `undefined` on any failure.
+// The caller collapses every failure mode to a 401.
+async function verifyDelivery(deps, context, workspaceId, sourceId) {
+    try {
+        const signature = context.req.header('X-Hub-Signature-256');
+        if (!signature)
+            return undefined;
+        const rawBody = await context.req.text();
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const source = workspace.sources.find(s => s.id === sourceId);
+        if (!source)
+            return undefined;
+        const resolved = resolveWebhookCapability(deps.pluginRegistry, source);
+        if (!resolved)
+            return undefined;
+        const identity = resolved.capability.repoIdentity(resolved.config);
+        if (!identity || identity.provider !== PROVIDER)
+            return undefined;
+        const record = await deps.secretStore.read(SECRET_NAMESPACE, secretKey(workspaceId, sourceId));
+        if (!record)
+            return undefined;
+        if (!verifySignature(rawBody, signature, record.secret))
+            return undefined;
+        return { workspace, resolved, identity, rawBody };
+    }
+    catch (err) {
+        receiverLogger.warn({ workspaceId, sourceId, err: err instanceof Error ? err.message : String(err) }, 'webhook: pre-signature check failed');
+        return undefined;
+    }
+}
+export function createGithubWebhookReceiver(deps) {
+    const router = new Hono();
+    // `:workspaceId/:sourceId` is the routing identity,
+    // the user installs on the GitHub side.
+    // We accept the request, verify, and return 202 immediately.
+    // Sync runs in the background,
+    // so a slow loader never blocks GitHub's delivery worker.
+    // GitHub times deliveries out at ~10s.
+    router.post('/github/:workspaceId/:sourceId', async (context) => {
+        const workspaceId = WorkspaceId.parse(context.req.param('workspaceId'));
+        const sourceId = SourceId.parse(context.req.param('sourceId'));
+        // The verifyDelivery call returns either the trusted state or undefined,
+        // (workspace, resolved capability, repository identity, raw body).
+        // On undefined we always return a uniform 401,
+        // so distinct errors never tell an anonymous caller apart,
+        // "no such workspace", "no secret yet", and "bad signature".
+        const verified = await verifyDelivery(deps, context, workspaceId, sourceId);
+        if (!verified)
+            return unauthorized();
+        const { workspace, resolved, identity, rawBody } = verified;
+        // Parse the body only after the signature check,
+        // so an attacker who can't forge the HMAC, never reaches our JSON parser.
+        let payload;
+        try {
+            payload = JSON.parse(rawBody);
+        }
+        catch {
+            throw new ValidationError('Invalid JSON payload.');
+        }
+        const fullName = extractFullName(payload);
+        const expectedFullName = `${identity.owner}/${identity.repo}`.toLowerCase();
+        // GitHub repo names are case-insensitive,
+        // (a stored `Owner/Repo` may arrive as `owner/repo`, or vice versa).
+        // Compare normalised. Also REQUIRE full_name to be present.
+        // A verified delivery without one is rejected,
+        // since this receiver is per-source,
+        // (some org-level or installation events omit it).
+        if (typeof fullName !== 'string' || fullName.toLowerCase() !== expectedFullName)
+            throw new ValidationError(`Payload repository "${fullName ?? '(missing)'}" does not match configured "${expectedFullName}".`);
+        // X-GitHub-Event must be present on real deliveries.
+        // Treating an absent header as "unknown",
+        // would let a stripping proxy silently drop every event,
+        // since loaders default to skipping unknown events.
+        const event = context.req.header('X-GitHub-Event');
+        if (!event)
+            throw new ValidationError('Missing X-GitHub-Event header.');
+        const shouldDispatch = resolved.capability.shouldDispatch?.(resolved.config, { event, payload }) ?? true;
+        if (!shouldDispatch) {
+            // Return 202 so GitHub does not treat the delivery as a failure,
+            // and back off retries, deliberately accepting and dropping.
+            return context.json({ accepted: true, event, workspaceId, sourceId, skipped: true }, 202);
+        }
+        // Fire-and-forget. Deliveries time out at ~10s,
+        // and a clean repo with many issues can take minutes to poll.
+        // Errors are logged so a failing sync doesn't silently disappear,
+        // the next delivery retries.
+        // Concurrent deliveries are allowed to race, loaders are idempotent,
+        // (last-writer-wins per file) so the result still converges,
+        // to the latest remote state.
+        void deps.sourceLoaderRunner.syncOne(workspace, sourceId).catch((err) => {
+            receiverLogger.warn({
+                workspaceId,
+                sourceId,
+                err: err instanceof Error ? err.message : String(err),
+            }, 'background syncOne triggered by github webhook failed');
+        });
+        return context.json({ accepted: true, event, workspaceId, sourceId, skipped: false }, 202);
+    });
+    return router;
+}
+function extractFullName(payload) {
+    if (typeof payload !== 'object' || payload === null)
+        return undefined;
+    const repository = payload.repository;
+    if (typeof repository !== 'object' || repository === null)
+        return undefined;
+    const fullName = repository.full_name;
+    return typeof fullName === 'string' ? fullName : undefined;
+}
+const adminLogger = createLogger('webhooks.github.admin');
+const SourceIdParam = WorkspaceIdParam.extend({
+    sourceId: SourceId.openapi({ param: { name: 'sourceId', in: 'path' } }),
+});
+const WebhookStatusResponse = z.object({
+    url: z.string(),
+    hasSecret: z.boolean(),
+    createdAt: z.string().optional(),
+}).openapi('GithubWebhookStatusResponse');
+const WebhookRotateResponse = z.object({
+    url: z.string(),
+    secret: z.string(),
+    createdAt: z.string(),
+}).openapi('GithubWebhookRotateResponse');
+const ErrorBody = z.object({ error: z.string() }).openapi('GithubWebhookErrorBody');
+const getStatusRoute = createRoute({
+    method: 'get',
+    path: '/{sourceId}/github',
+    operationId: 'getGithubWebhookStatus',
+    summary: 'Read the GitHub webhook URL and whether a secret has been provisioned for a source.',
+    tags: ['source-webhooks'],
+    request: { params: SourceIdParam },
+    responses: {
+        200: {
+            description: 'Webhook URL plus secret-presence flag (the secret itself is never returned on read).',
+            content: { 'application/json': { schema: WebhookStatusResponse } },
+        },
+        400: { description: 'Source is not webhook-capable.', content: { 'application/json': { schema: ErrorBody } } },
+        404: { description: 'Source not found.', content: { 'application/json': { schema: ErrorBody } } },
+        503: { description: 'Server was not configured with apiUrl.', content: { 'application/json': { schema: ErrorBody } } },
+    },
+});
+const rotateRoute = createRoute({
+    method: 'post',
+    path: '/{sourceId}/github/rotate',
+    operationId: 'rotateGithubWebhookSecret',
+    summary: 'Generate a fresh 32-byte hex secret for the GitHub webhook, returning it ONCE.',
+    description: 'The secret is shown exactly once in the rotate response so the user can copy it into GitHub. Subsequent GET requests return only `hasSecret` + `createdAt`.',
+    tags: ['source-webhooks'],
+    request: { params: SourceIdParam },
+    responses: {
+        200: {
+            description: 'New secret minted and stored.',
+            content: { 'application/json': { schema: WebhookRotateResponse } },
+        },
+        400: { description: 'Source is not webhook-capable.', content: { 'application/json': { schema: ErrorBody } } },
+        404: { description: 'Source not found.', content: { 'application/json': { schema: ErrorBody } } },
+        503: { description: 'Server was not configured with apiUrl.', content: { 'application/json': { schema: ErrorBody } } },
+    },
+});
+export function createSourceWebhooksAdminRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(getStatusRoute, async (context) => {
+        const { workspaceId, sourceId } = context.req.valid('param');
+        if (!deps.apiUrl)
+            throw new ServiceUnavailableError('Server is not configured with a public apiUrl. Webhook URLs cannot be rendered.');
+        await guardWebhookSource(deps, workspaceId, sourceId);
+        const record = await deps.secretStore.read(SECRET_NAMESPACE, secretKey(workspaceId, sourceId));
+        return context.json({
+            url: buildWebhookUrl(deps.apiUrl, workspaceId, sourceId),
+            hasSecret: record !== undefined,
+            ...(record?.createdAt ? { createdAt: record.createdAt } : {}),
+        }, 200);
+    });
+    router.openapi(rotateRoute, async (context) => {
+        const { workspaceId, sourceId } = context.req.valid('param');
+        if (!deps.apiUrl)
+            throw new ServiceUnavailableError('Server is not configured with a public apiUrl. Webhook URLs cannot be rendered.');
+        await guardWebhookSource(deps, workspaceId, sourceId);
+        // 32 bytes is the GitHub-recommended minimum,
+        // matching what their own webhook setup UI generates.
+        const secret = randomBytes(32).toString('hex');
+        const createdAt = new Date().toISOString();
+        const record = { secret, createdAt };
+        await deps.secretStore.write(SECRET_NAMESPACE, secretKey(workspaceId, sourceId), record);
+        return context.json({
+            url: buildWebhookUrl(deps.apiUrl, workspaceId, sourceId),
+            secret,
+            createdAt,
+        }, 200);
+    });
+    return router;
+}
+// Shared admin precondition check.
+// Returns undefined when the source is a webhook-capable github source,
+// otherwise returns the 4xx the caller should surface.
+// We never throw. On schema drift defineSourceLoaderPlugin's wrapper,
+// may throw ZodError, which we catch and translate to 400.
+async function guardWebhookSource(deps, workspaceId, sourceId) {
+    const workspace = await deps.workspaceService.findById(workspaceId);
+    const source = workspace.sources.find(s => s.id === sourceId);
+    if (!source)
+        throw new NotFoundError(`Source "${sourceId}" not found`);
+    const resolved = resolveWebhookCapability(deps.pluginRegistry, source);
+    if (!resolved)
+        throw new ValidationError(`Source "${sourceId}" has no webhook-capable loader.`);
+    try {
+        const identity = resolved.capability.repoIdentity(resolved.config);
+        if (!identity || identity.provider !== PROVIDER)
+            throw new ValidationError(`Source "${sourceId}" is not bound to a github repo.`);
+    }
+    catch (err) {
+        if (err instanceof ValidationError)
+            throw err;
+        adminLogger.warn({ workspaceId, sourceId, err: err instanceof Error ? err.message : String(err) }, 'admin: repoIdentity threw');
+        throw new ValidationError(`Source "${sourceId}" loader config does not match the loader's schema.`);
+    }
+}
+function buildWebhookUrl(apiUrl, workspaceId, sourceId) {
+    const base = apiUrl.replace(/\/$/, '');
+    return `${base}/webhooks/github/${workspaceId}/${sourceId}`;
+}
+//# sourceMappingURL=sourceWebhooks.js.map

package/dist/routes/sourceWebhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceWebhooks.js","sourceRoot":"","sources":["../../src/routes/sourceWebhooks.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACxH,OAAO,EAAyB,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,gBAAgB,GAAG,gBAAgB,CAAA;AACzC,MAAM,QAAQ,GAAG,QAAiB,CAAA;AAOlC,SAAS,SAAS,CAAC,WAAwB,EAAE,QAAkB;IAC7D,OAAO,GAAG,WAAW,KAAK,QAAQ,EAAE,CAAA;AACtC,CAAC;AASD,MAAM,cAAc,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAA;AAE/D,gDAAgD;AAChD,oEAAoE;AACpE,6CAA6C;AAC7C,wCAAwC;AACxC,mDAAmD;AACnD,SAAS,eAAe,CAAC,OAAe,EAAE,MAA0B,EAAE,MAAc;IAClF,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QACxD,OAAO,KAAK,CAAA;IACd,yCAAyC;IACzC,8DAA8D;IAC9D,oBAAoB;IACpB,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;IACzE,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACvF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACvB,OAAO,KAAK,CAAA;IACd,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED,iEAAiE;AACjE,0EAA0E;AAC1E,SAAS,wBAAwB,CAC/B,cAA8B,EAC9B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,MAAM;QAChD,OAAO,SAAS,CAAA;IAClB,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,EAAE,OAAO;QAClB,OAAO,SAAS,CAAA;IAClB,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;AACrE,CAAC;AAED,4DAA4D;AAC5D,oEAAoE;AACpE,sDAAsD;AACtD,6DAA6D;AAC7D,+CAA+C;AAC/C,SAAS,YAAY;IACnB,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAA;AAC3D,CAAC;AASD,iEAAiE;AACjE,4DAA4D;AAC5D,uEAAuE;AACvE,uEAAuE;AACvE,oDAAoD;AACpD,KAAK,UAAU,cAAc,CAC3B,IAA+B,EAC/B,OAA4F,EAC5F,WAAwB,EACxB,QAAkB;IAElB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;QAC3D,IAAI,CAAC,SAAS;YACZ,OAAO,SAAS,CAAA;QAClB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QAC7D,IAAI,CAAC,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;QACtE,IAAI,CAAC,QAAQ;YACX,OAAO,SAAS,CAAA;QAClB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC7C,OAAO,SAAS,CAAA;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAsB,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnH,IAAI,CAAC,MAAM;YACT,OAAO,SAAS,CAAA;QAClB,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrD,OAAO,SAAS,CAAA;QAClB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;IACnD,CAAC;IACD,OAAO,GAAG,EAAE,CAAC;QACX,cAAc,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAA;QAC5I,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,oDAAoD;IACpD,wCAAwC;IACxC,6DAA6D;IAC7D,+BAA+B;IAC/B,0DAA0D;IAC1D,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAA;QACvE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC9D,yEAAyE;QACzE,mEAAmE;QACnE,+CAA+C;QAC/C,2DAA2D;QAC3D,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC3E,IAAI,CAAC,QAAQ;YACX,OAAO,YAAY,EAAE,CAAA;QACvB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;QAE3D,iDAAiD;QACjD,0EAA0E;QAC1E,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/B,CAAC;QACD,MAAM,CAAC;YACL,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAA;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACzC,MAAM,gBAAgB,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC3E,0CAA0C;QAC1C,qEAAqE;QACrE,4DAA4D;QAC5D,+CAA+C;QAC/C,qCAAqC;QACrC,mDAAmD;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB;YAC7E,MAAM,IAAI,eAAe,CAAC,uBAAuB,QAAQ,IAAI,WAAW,gCAAgC,gBAAgB,IAAI,CAAC,CAAA;QAE/H,qDAAqD;QACrD,0CAA0C;QAC1C,yDAAyD;QACzD,oDAAoD;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAA;QAE7D,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,IAAI,IAAI,CAAA;QACxG,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,iEAAiE;YACjE,6DAA6D;YAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3F,CAAC;QAED,gDAAgD;QAChD,8DAA8D;QAC9D,kEAAkE;QAClE,6BAA6B;QAC7B,qEAAqE;QACrE,6DAA6D;QAC7D,8BAA8B;QAC9B,KAAK,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtE,cAAc,CAAC,IAAI,CACjB;gBACE,WAAW;gBACX,QAAQ;gBACR,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACtD,EACD,uDAAuD,CACxD,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QACjD,OAAO,SAAS,CAAA;IAClB,MAAM,UAAU,GAAI,OAAoC,CAAC,UAAU,CAAA;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI;QACvD,OAAO,SAAS,CAAA;IAClB,MAAM,QAAQ,GAAI,UAAsC,CAAC,SAAS,CAAA;IAClE,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAgBD,MAAM,WAAW,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAA;AAEzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CACxE,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAEzC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;AAEzC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;AAEnF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,qFAAqF;IAC9F,IAAI,EAAE,CAAC,iBAAiB,CAAC;IACzB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IAClC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,sFAAsF;YACnG,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE;SACnE;QACD,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QAC9G,GAAG,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACjG,GAAG,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACvH;CACF,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,WAAW,CAAC;IAC9B,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,2BAA2B;IACjC,WAAW,EAAE,2BAA2B;IACxC,OAAO,EAAE,gFAAgF;IACzF,WAAW,EAAE,6JAA6J;IAC1K,IAAI,EAAE,CAAC,iBAAiB,CAAC;IACzB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IAClC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,+BAA+B;YAC5C,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,EAAE;SACnE;QACD,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QAC9G,GAAG,EAAE,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACjG,GAAG,EAAE,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;KACvH;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,+BAA+B,CAAC,IAA6B;IAC3E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YACd,MAAM,IAAI,uBAAuB,CAAC,iFAAiF,CAAC,CAAA;QACtH,MAAM,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAsB,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnH,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACxD,SAAS,EAAE,MAAM,KAAK,SAAS;YAC/B,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YACd,MAAM,IAAI,uBAAuB,CAAC,iFAAiF,CAAC,CAAA;QACtH,MAAM,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;QAErD,8CAA8C;QAC9C,sDAAsD;QACtD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,MAAM,GAAwB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QACzD,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QACxF,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;YACxD,MAAM;YACN,SAAS;SACV,EAAE,GAAG,CAAC,CAAA;IACT,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,mCAAmC;AACnC,wEAAwE;AACxE,uDAAuD;AACvD,sEAAsE;AACtE,2DAA2D;AAC3D,KAAK,UAAU,kBAAkB,CAC/B,IAA6B,EAC7B,WAAwB,EACxB,QAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,aAAa,CAAC,WAAW,QAAQ,aAAa,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IACtE,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,kCAAkC,CAAC,CAAA;IAClF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC7C,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,kCAAkC,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,eAAe;YAChC,MAAM,GAAG,CAAA;QACX,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;QAC/H,MAAM,IAAI,eAAe,CAAC,WAAW,QAAQ,qDAAqD,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,WAAwB,EAAE,QAAkB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,OAAO,GAAG,IAAI,oBAAoB,WAAW,IAAI,QAAQ,EAAE,CAAA;AAC7D,CAAC"}

package/dist/routes/users.d.ts

@@ -0,0 +1,7 @@
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import { OpenAPIHono } from '@hono/zod-openapi';
+export interface UsersRouterDeps {
+    userRegistry: UserRegistryFile;
+}
+export declare function createUsersRouter(deps: UsersRouterDeps): OpenAPIHono;
+//# sourceMappingURL=users.d.ts.map

package/dist/routes/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAGnF,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAkB/D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,gBAAgB,CAAA;CAC/B;AAmED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAmCpE"}

package/dist/routes/users.js

@@ -0,0 +1,109 @@
+import { ForbiddenError, NotFoundError } from '@braidhq/core';
+import { User, UserId } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { getUserId } from '../middleware/auth.js';
+import { ForbiddenResponse, NotFoundResponse } from './_shared.js';
+const UserIdParam = z.object({
+    userId: UserId.openapi({ param: { name: 'userId', in: 'path' } }),
+});
+const UserListResponse = z.object({
+    items: z.array(User),
+}).openapi('UserListResponse');
+// Self-service profile edit, only the display name.
+// Server-role changes go through the admin-gated `/admin/users` routes.
+const SelfProfileUpdate = z.object({
+    displayName: z.string().min(1),
+});
+const listUsersRoute = createRoute({
+    method: 'get',
+    path: '/',
+    operationId: 'listUsers',
+    summary: 'List all users on this server.',
+    tags: ['users'],
+    responses: {
+        200: {
+            description: 'A list of users.',
+            content: { 'application/json': { schema: UserListResponse } },
+        },
+    },
+});
+const getMeRoute = createRoute({
+    method: 'get',
+    path: '/me',
+    operationId: 'getMe',
+    summary: 'Return the user identified by the current request context.',
+    tags: ['users'],
+    responses: {
+        200: {
+            description: 'The current user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+    },
+});
+const getUserRoute = createRoute({
+    method: 'get',
+    path: '/{userId}',
+    operationId: 'getUser',
+    summary: 'Fetch a single user by id.',
+    tags: ['users'],
+    request: { params: UserIdParam },
+    responses: {
+        200: {
+            description: 'The requested user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+    },
+});
+const updateUserRoute = createRoute({
+    method: 'patch',
+    path: '/{userId}',
+    operationId: 'updateUser',
+    summary: 'Update your own display name, role changes go through /admin.',
+    tags: ['users'],
+    request: {
+        params: UserIdParam,
+        body: { content: { 'application/json': { schema: SelfProfileUpdate } } },
+    },
+    responses: {
+        200: {
+            description: 'The updated user.',
+            content: { 'application/json': { schema: User } },
+        },
+        403: ForbiddenResponse,
+        404: NotFoundResponse,
+    },
+});
+export function createUsersRouter(deps) {
+    const router = new OpenAPIHono();
+    router.openapi(listUsersRoute, async (context) => {
+        const users = await deps.userRegistry.list();
+        return context.json({ items: users }, 200);
+    });
+    router.openapi(getMeRoute, async (context) => {
+        const userId = getUserId(context);
+        const user = await deps.userRegistry.get(userId);
+        if (!user)
+            throw new NotFoundError(`Current user "${userId}" not found in registry`);
+        return context.json(user, 200);
+    });
+    router.openapi(getUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        const user = await deps.userRegistry.get(userId);
+        if (!user)
+            throw new NotFoundError(`User "${userId}" not found`);
+        return context.json(user, 200);
+    });
+    router.openapi(updateUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        // Self-service only. Server-admin edits go through the admin routes.
+        if (userId !== getUserId(context))
+            throw new ForbiddenError('You can only update your own profile.');
+        const patch = context.req.valid('json');
+        const updated = await deps.userRegistry.update(userId, patch);
+        return context.json(updated, 200);
+    });
+    return router;
+}
+//# sourceMappingURL=users.js.map

package/dist/routes/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAElE,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAClE,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACrB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;AAE9B,oDAAoD;AACpD,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAA;AAMF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,GAAG;IACT,WAAW,EAAE,WAAW;IACxB,OAAO,EAAE,gCAAgC;IACzC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;SAC9D;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,WAAW,CAAC;IAC7B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,4DAA4D;IACrE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,WAAW,CAAC;IAC/B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,SAAS;IACtB,OAAO,EAAE,4BAA4B;IACrC,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,+DAA+D;IACxE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE;KACzE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,gBAAgB;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAEhC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,yBAAyB,CAAC,CAAA;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAAA;QACvD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,qEAAqE;QACrE,IAAI,MAAM,KAAK,SAAS,CAAC,OAAO,CAAC;YAC/B,MAAM,IAAI,cAAc,CAAC,uCAAuC,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaceEvents.d.ts

@@ -4,10 +4,11 @@ export interface WorkspaceEventsRouterDeps {
     readonly eventBus: WorkspaceEventBus;
 }
 /**
- * SSE endpoint the Studio opens once per workspace to invalidate
- * react-query caches in real time. Pure delivery: events are dropped if
- * no one is listening, and the route makes no attempt to backfill state
- * on connect. The client re-fetches list endpoints on `EventSource.open`
+ * SSE endpoint the Studio opens once per workspace,
+ * to invalidate react-query caches in real time.
+ * Delivery is best-effort, events are dropped when no one is listening,
+ * and the route makes no attempt to backfill state on connect.
+ * The client re-fetches list endpoints on `EventSource.open`,
  * so a fresh subscriber catches up.
  */
 export declare function createWorkspaceEventsRouter(deps: WorkspaceEventsRouterDeps): Hono;

package/dist/routes/workspaceEvents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceEvents.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,iBAAiB,EAAE,MAAM,eAAe,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CA0BjF"}
+{"version":3,"file":"workspaceEvents.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CA0BjF"}

package/dist/routes/workspaceEvents.js

@@ -1,12 +1,13 @@
 import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
-import { createAsyncQueue } from '../infrastructure/agent/asyncQueue.js';
+import { createAsyncQueue } from '../infrastructure/skill/asyncQueue.js';
 import { getWorkspaceId, workspaceIdMiddleware } from '../middleware/workspaceId.js';
 /**
- * SSE endpoint the Studio opens once per workspace to invalidate
- * react-query caches in real time. Pure delivery: events are dropped if
- * no one is listening, and the route makes no attempt to backfill state
- * on connect. The client re-fetches list endpoints on `EventSource.open`
+ * SSE endpoint the Studio opens once per workspace,
+ * to invalidate react-query caches in real time.
+ * Delivery is best-effort, events are dropped when no one is listening,
+ * and the route makes no attempt to backfill state on connect.
+ * The client re-fetches list endpoints on `EventSource.open`,
  * so a fresh subscriber catches up.
  */
 export function createWorkspaceEventsRouter(deps) {
@@ -18,7 +19,7 @@ export function createWorkspaceEventsRouter(deps) {
             const unsubscribe = deps.eventBus.subscribe(workspaceId, (event) => {
                 queue.push(event);
             });
-            // Initial comment so the client's EventSource.onopen fires
+            // Initial comment so the client's EventSource.onopen fires,
             // immediately even if no event has been published yet.
             await stream.writeSSE({ event: 'ready', data: JSON.stringify({ workspaceId }) });
             try {

package/dist/routes/workspaceEvents.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceEvents.js","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMpF;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,gBAAgB,EAAkB,CAAA;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC,CAAC,CAAA;YACF,2DAA2D;YAC3D,uDAAuD;YACvD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC3E,CAAC;YACH,CAAC;oBACO,CAAC;gBACP,WAAW,EAAE,CAAA;gBACb,KAAK,CAAC,GAAG,EAAE,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"workspaceEvents.js","sourceRoot":"","sources":["../../src/routes/workspaceEvents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAMpF;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAA+B;IACzE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,sBAAsB,EAAE,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,OAAO,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,KAAK,GAAG,gBAAgB,EAAkB,CAAA;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnB,CAAC,CAAC,CAAA;YACF,4DAA4D;YAC5D,uDAAuD;YACvD,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC3E,CAAC;YACH,CAAC;oBACO,CAAC;gBACP,WAAW,EAAE,CAAA;gBACb,KAAK,CAAC,GAAG,EAAE,CAAA;YACb,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/workspaceMembers.d.ts

@@ -0,0 +1,11 @@
+import type { Clock, WorkspaceService } from '@braidhq/core';
+import type { WorkspaceRegistryFile } from '../infrastructure/workspace/WorkspaceRegistryFile.js';
+import { Hono } from 'hono';
+export interface WorkspaceMembersRouterDeps {
+    workspaceService: WorkspaceService;
+    registry: WorkspaceRegistryFile;
+    clock: Clock;
+}
+export declare function createWorkspaceMembersRouter(deps: WorkspaceMembersRouterDeps): Hono;
+export declare function createTransferOwnershipRouter(deps: WorkspaceMembersRouterDeps): Hono;
+//# sourceMappingURL=workspaceMembers.d.ts.map

package/dist/routes/workspaceMembers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceMembers.d.ts","sourceRoot":"","sources":["../../src/routes/workspaceMembers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAIjG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAqB3B,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,QAAQ,EAAE,qBAAqB,CAAA;IAC/B,KAAK,EAAE,KAAK,CAAA;CACb;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAoDnF;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAWpF"}

package/dist/routes/workspaceMembers.js

@@ -0,0 +1,81 @@
+import { NotFoundError } from '@braidhq/core';
+import { SkillPermission, UserId, WorkspaceRole } from '@braidhq/schema';
+import { zValidator } from '@hono/zod-validator';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { requirePermission } from '../middleware/workspaceAccess.js';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+const AddMemberBody = z.object({
+    userId: UserId,
+    role: WorkspaceRole.default('guest'),
+});
+const PatchMemberBody = z.object({
+    role: WorkspaceRole.optional(),
+    skillOverrides: z.record(z.string().min(1), SkillPermission).optional(),
+}).refine(body => Object.keys(body).length > 0, {
+    message: 'PATCH body must include role and/or skillOverrides',
+});
+const TransferBody = z.object({
+    newOwnerId: UserId,
+});
+export function createWorkspaceMembersRouter(deps) {
+    const router = new Hono();
+    const ownerOnly = requirePermission('workspace.write');
+    // List is open to every member of the workspace.
+    // The access middleware upstream already enforced membership.
+    router.get('/', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const members = await deps.registry.listMembers(workspace.rootPath);
+        return context.json({ items: members });
+    });
+    router.post('/', ownerOnly, zValidator('json', AddMemberBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { userId, role } = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const member = {
+            userId,
+            role,
+            joinedAt: deps.clock.now(),
+        };
+        await deps.registry.addMember(workspace.rootPath, member);
+        return context.json(member, 201);
+    });
+    router.patch('/:memberUserId', ownerOnly, zValidator('json', PatchMemberBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const memberUserId = UserId.parse(context.req.param('memberUserId'));
+        const patch = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const next = await deps.registry.updateMember(workspace.rootPath, memberUserId, {
+            ...(patch.role ? { role: patch.role } : {}),
+            ...(patch.skillOverrides
+                ? { skillOverrides: patch.skillOverrides }
+                : {}),
+        });
+        return context.json(next);
+    });
+    router.delete('/:memberUserId', ownerOnly, async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const memberUserId = UserId.parse(context.req.param('memberUserId'));
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        const exists = await deps.registry.getMember(workspace.rootPath, memberUserId);
+        if (!exists)
+            throw new NotFoundError(`User "${memberUserId}" is not a member of this workspace`);
+        await deps.registry.removeMember(workspace.rootPath, memberUserId);
+        return context.body(null, 204);
+    });
+    return router;
+}
+export function createTransferOwnershipRouter(deps) {
+    const router = new Hono();
+    router.post('/', requirePermission('workspace.write'), zValidator('json', TransferBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { newOwnerId } = context.req.valid('json');
+        const workspace = await deps.workspaceService.findById(workspaceId);
+        await deps.registry.transferOwnership(workspace.rootPath, newOwnerId);
+        const members = await deps.registry.listMembers(workspace.rootPath);
+        return context.json({ items: members });
+    });
+    return router;
+}
+//# sourceMappingURL=workspaceMembers.js.map

package/dist/routes/workspaceMembers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaceMembers.js","sourceRoot":"","sources":["../../src/routes/workspaceMembers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAE7D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;CACrC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;IAC9C,OAAO,EAAE,oDAAoD;CAC9D,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM;CACnB,CAAC,CAAA;AAQF,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IACzB,MAAM,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,CAAC,CAAA;IAEtD,iDAAiD;IACjD,8DAA8D;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAwB;YAClC,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAe;SACxC,CAAA;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACzD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/F,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE;YAC9E,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,cAAc;gBACtB,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAA2E,EAAE;gBACvG,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3D,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QACpE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAC9E,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,aAAa,CAAC,SAAS,YAAY,qCAAqC,CAAC,CAAA;QACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;QAClE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAgC;IAC5E,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IACzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzG,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACrE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC"}