@cat-factory/server 0.68.0 → 0.68.2

package/dist/auth/signing.d.ts

@@ -55,7 +55,8 @@ export interface MachinePayload {
 export declare function signerFor(secret: string): HmacSigner;
 export declare class HmacSigner {
     private readonly secret;
-    private keyPromise?;
+    /** Per-audience signing keys, keyed by the `aud` string (`''` = the raw-secret base key). */
+    private readonly keyCache;
     constructor(secret: string);
     sign(payload: object): Promise<string>;
     /**
@@ -71,6 +72,21 @@ export declare class HmacSigner {
         aud?: TokenAudience;
     }): Promise<T | null>;
     private mac;
-    private importKey;
+    /**
+     * The HMAC signing key for an audience (HKDF-derived), memoised. Only a {@link
+     * KNOWN_AUDIENCES} value gets a derived subkey; an absent OR unrecognised `aud` uses the
+     * raw-secret base key (cache slot `''`). Bounding the derive/cache to the known set is
+     * what stops an attacker-chosen `aud` (read before the MAC check in `verify`) from
+     * ballooning the cache or forcing a per-request key derivation.
+     */
+    private keyFor;
+    /** Raw-secret HMAC key — the fallback for audience-less (test/legacy) payloads. */
+    private importBaseKey;
+    /**
+     * Derive an independent 256-bit HMAC key for one audience: import the master secret as
+     * HKDF key material, expand it with a per-audience `info` tag, and import the result as
+     * the signing key. Isolates each token class cryptographically from the others.
+     */
+    private deriveAudienceKey;
 }
 //# sourceMappingURL=signing.d.ts.map

package/dist/auth/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAqBA,yEAAyE;AACzE,eAAO,MAAM,cAAc;IACzB,gDAAgD;aAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;aACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;aAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;aACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;aACH,OAAO,EAAE,SAAS;CACV,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEhF,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,0DAA0D;IAC1D,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AASD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOpD;AAED,qBAAa,UAAU;IAGT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3C;IAED;;;;;;;;OAQG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA6BnB;YAEa,GAAG;IAKjB,OAAO,CAAC,SAAS;CAYlB"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AA8BA,yEAAyE;AACzE,eAAO,MAAM,cAAc;IACzB,gDAAgD;aAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;aACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;aAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;aACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;aACH,OAAO,EAAE,SAAS;CACV,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEhF,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,0DAA0D;IAC1D,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAwBD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOpD;AACD,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAEjE,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3C;IAED;;;;;;;;OAQG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA8BnB;YAEa,GAAG;IAKjB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAUd,mFAAmF;IACnF,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;YACW,iBAAiB;CAoBhC"}

package/dist/auth/signing.js

@@ -7,12 +7,21 @@ import { base64url, base64urlToBytes, timingSafeEqual } from '../crypto/encoding
 //   - the *container* token an implementation container uses against the LLM proxy
 //   - the short-lived *ws ticket* that authorises one WebSocket event stream
 //
-// Because they share a key and verifier, every token MUST carry an `aud`
+// Because they share a secret and verifier, every token MUST carry an `aud`
 // (audience) claim and every verifier MUST pin the audience it expects, so a
 // token minted for one purpose cannot be replayed as another (e.g. a container
 // proxy token acting as a full user session). `verify` rejects any token whose
 // `aud` does not match the caller's expected audience.
 //
+// Beyond that pin, each audience is signed with its OWN key: the master secret is
+// run through HKDF-SHA256 with a per-audience `info` tag to derive an independent
+// 256-bit subkey. So a token class is cryptographically isolated — a signature made
+// under one audience's key can't validate under another's even before the `aud`
+// check — and the effective HMAC key is a full-entropy 32 bytes rather than the raw
+// secret string. (Audience-less — or unrecognised-audience — payloads fall back to the
+// raw secret; only the fixed known audiences get a derived subkey, so an attacker-chosen
+// `aud` can't grow the key cache.)
+//
 // Format: `base64url(JSON payload).base64url(HMAC(base64url(JSON payload)))`.
 // The payload is base64url (no dots), so the dot split is unambiguous. Payloads
 // carrying an `exp` (epoch ms) are rejected once expired. There is no server-side
@@ -34,9 +43,22 @@ export const TOKEN_AUDIENCE = {
      */
     machine: 'machine',
 };
+/** HKDF `info` tag for a token audience's derived signing subkey. */
+function audienceInfo(aud) {
+    return `cat-factory:token:${aud}`;
+}
+/**
+ * The fixed set of audiences that get their own derived subkey. `verify` reads a token's
+ * CLAIMED `aud` before checking the MAC (to pick the key), and that claim is fully
+ * attacker-controlled — so the derive/cache path MUST be bounded to this known set.
+ * Otherwise a stream of tokens carrying distinct junk `aud` values would force an HKDF
+ * derivation per request AND grow the key cache without bound (an unauthenticated CPU +
+ * memory DoS). An unrecognised (or absent) audience falls back to the raw-secret base key.
+ */
+const KNOWN_AUDIENCES = new Set(Object.values(TOKEN_AUDIENCE));
 /**
  * Process-wide signer cache keyed by secret, so per-request verifications reuse the
- * instance's imported HMAC `CryptoKey` instead of re-running `crypto.subtle.importKey`
+ * instance's derived/imported HMAC `CryptoKey`s instead of re-running the key setup
  * on every call. The secrets are few and config-derived, so the map stays tiny.
  */
 const signers = new Map();
@@ -50,13 +72,14 @@ export function signerFor(secret) {
 }
 export class HmacSigner {
     secret;
-    keyPromise;
+    /** Per-audience signing keys, keyed by the `aud` string (`''` = the raw-secret base key). */
+    keyCache = new Map();
     constructor(secret) {
         this.secret = secret;
     }
     async sign(payload) {
         const body = base64url(JSON.stringify(payload));
-        return `${body}.${base64url(await this.mac(body))}`;
+        return `${body}.${base64url(await this.mac(body, audienceOf(payload)))}`;
     }
     /**
      * Return the payload when the signature is valid, unexpired, and (when an
@@ -74,25 +97,24 @@ export class HmacSigner {
         if (dot <= 0 || dot === token.length - 1)
             return null;
         const body = token.slice(0, dot);
-        // Decode the signature segment defensively: a malformed base64url tail must
-        // fail closed (null → 401), never throw out of `atob` into a 500.
+        // Decode the signature + payload defensively: a malformed base64url tail or a
+        // non-JSON body must fail closed (null → 401), never throw out of `atob` into a 500.
         let provided;
+        let payload;
         try {
             provided = base64urlToBytes(token.slice(dot + 1));
+            payload = JSON.parse(new TextDecoder().decode(base64urlToBytes(body)));
         }
         catch {
             return null;
         }
-        const expected = new Uint8Array(await this.mac(body));
+        // Select the signing key from the token's CLAIMED audience so it matches whatever
+        // `sign` used. Reading the claimed `aud` before verifying is safe: it only chooses
+        // which key the MAC is checked against, and forging still requires that key. The
+        // caller's `opts.aud` pin below is the actual cross-token-confusion defence.
+        const expected = new Uint8Array(await this.mac(body, audienceOf(payload)));
         if (!timingSafeEqual(provided, expected))
             return null;
-        let payload;
-        try {
-            payload = JSON.parse(new TextDecoder().decode(base64urlToBytes(body)));
-        }
-        catch {
-            return null;
-        }
         const exp = payload.exp;
         if (typeof exp === 'number' && exp < Date.now())
             return null;
@@ -102,15 +124,49 @@ export class HmacSigner {
             return null;
         return payload;
     }
-    async mac(input) {
-        const key = await this.importKey();
+    async mac(input, aud) {
+        const key = await this.keyFor(aud);
         return crypto.subtle.sign('HMAC', key, new TextEncoder().encode(input));
     }
-    importKey() {
-        if (!this.keyPromise) {
-            this.keyPromise = crypto.subtle.importKey('raw', new TextEncoder().encode(this.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    /**
+     * The HMAC signing key for an audience (HKDF-derived), memoised. Only a {@link
+     * KNOWN_AUDIENCES} value gets a derived subkey; an absent OR unrecognised `aud` uses the
+     * raw-secret base key (cache slot `''`). Bounding the derive/cache to the known set is
+     * what stops an attacker-chosen `aud` (read before the MAC check in `verify`) from
+     * ballooning the cache or forcing a per-request key derivation.
+     */
+    keyFor(aud) {
+        const cacheKey = aud !== undefined && KNOWN_AUDIENCES.has(aud) ? aud : '';
+        let key = this.keyCache.get(cacheKey);
+        if (!key) {
+            key = cacheKey === '' ? this.importBaseKey() : this.deriveAudienceKey(cacheKey);
+            this.keyCache.set(cacheKey, key);
         }
-        return this.keyPromise;
+        return key;
     }
+    /** Raw-secret HMAC key — the fallback for audience-less (test/legacy) payloads. */
+    importBaseKey() {
+        return crypto.subtle.importKey('raw', new TextEncoder().encode(this.secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    }
+    /**
+     * Derive an independent 256-bit HMAC key for one audience: import the master secret as
+     * HKDF key material, expand it with a per-audience `info` tag, and import the result as
+     * the signing key. Isolates each token class cryptographically from the others.
+     */
+    async deriveAudienceKey(aud) {
+        const material = await crypto.subtle.importKey('raw', new TextEncoder().encode(this.secret), 'HKDF', false, ['deriveBits']);
+        const bits = await crypto.subtle.deriveBits({
+            name: 'HKDF',
+            hash: 'SHA-256',
+            salt: new Uint8Array(0),
+            info: new TextEncoder().encode(audienceInfo(aud)),
+        }, material, 256);
+        return crypto.subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    }
+}
+/** The `aud` claim of a payload as a string, or undefined (⇒ the raw-secret base key). */
+function audienceOf(payload) {
+    const aud = payload.aud;
+    return typeof aud === 'string' ? aud : undefined;
 }
 //# sourceMappingURL=signing.js.map

package/dist/auth/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,0EAA0E;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;IACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;IAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;IACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;IACH,OAAO,EAAE,SAAS;CACV,CAAA;AAyCV;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,UAAU;IAGQ,MAAM;IAF3B,UAAU,CAAqB;IAEvC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAA;IACrD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,IAA8B;QAE9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAEhC,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,QAAoB,CAAA;QACxB,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QACrD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAErD,IAAI,OAAU,CAAA;QACd,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAM,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5D,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,uFAAuF;AACvF,yFAAyF;AACzF,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,0EAA0E;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;IACjC,UAAU,EAAE,aAAa;IACzB,kDAAkD;IAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;IACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;IACH,OAAO,EAAE,SAAS;CACV,CAAA;AAyCV,qEAAqE;AACrE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,qBAAqB,GAAG,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAEnF;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,OAAO,UAAU;IAIQ,MAAM;IAHnC,6FAA6F;IAC5E,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEjE,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,IAA8B;QAE9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,qFAAqF;QACrF,IAAI,QAAoB,CAAA;QACxB,IAAI,OAAU,CAAA;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAM,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAErD,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5D,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAY;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,GAAY;QACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mFAAmF;IAC3E,aAAa;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SAClD,EACD,QAAQ,EACR,GAAG,CACJ,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC"}

package/dist/github/WebCryptoWebhookVerifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoWebhookVerifier.d.ts","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAY1D,qBAAa,wBAAyB,YAAW,eAAe;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnF;IAED,OAAO,CAAC,SAAS;CAYlB"}
+{"version":3,"file":"WebCryptoWebhookVerifier.d.ts","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAY1D,qBAAa,wBAAyB,YAAW,eAAe;IAGlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,UAAU,CAAC,CAAoB;IAEvC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnF;IAED,OAAO,CAAC,SAAS;CAYlB"}

package/dist/github/WebCryptoWebhookVerifier.js

@@ -13,6 +13,10 @@ export class WebCryptoWebhookVerifier {
         this.secret = secret;
     }
     async verify(rawBody, signatureHeader) {
+        // Fail closed on an unconfigured secret: an empty HMAC key would let an attacker
+        // forge a signature over their own body (matches the GitLab verifier's guard).
+        if (!this.secret)
+            return false;
         if (!signatureHeader || !signatureHeader.startsWith(PREFIX))
             return false;
         const provided = hexToBytes(signatureHeader.slice(PREFIX.length));

package/dist/github/WebCryptoWebhookVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoWebhookVerifier.js","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,kFAAkF;AAClF,iEAAiE;AACjE,wEAAwE;AACxE,mFAAmF;AACnF,qFAAqF;AACrF,uEAAuE;AAEvE,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,OAAO,wBAAwB;IAGN,MAAM;IAF3B,UAAU,CAAqB;IAEvC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,eAA8B;QAC/D,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"WebCryptoWebhookVerifier.js","sourceRoot":"","sources":["../../src/github/WebCryptoWebhookVerifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,kFAAkF;AAClF,iEAAiE;AACjE,wEAAwE;AACxE,mFAAmF;AACnF,qFAAqF;AACrF,uEAAuE;AAEvE,MAAM,MAAM,GAAG,SAAS,CAAA;AAExB,MAAM,OAAO,wBAAwB;IAGN,MAAM;IAF3B,UAAU,CAAqB;IAEvC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,OAAoB,EAAE,eAA8B;QAC/D,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC9B,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAE3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QAClC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;QAC/E,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACrF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3F,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/http/cors.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Whether an unset `CORS_ALLOWED_ORIGINS` should reflect any origin: yes only when
+ * `ENVIRONMENT` is an explicitly recognised development value (dev/test convenience), no
+ * otherwise — an UNSET, unknown, or production `ENVIRONMENT` all default-deny. Pass the
+ * deployment's `ENVIRONMENT` env value.
+ */
+export declare function corsReflectsWhenUnset(environment: string | undefined): boolean;
 /**
  * The request headers the browser is allowed to send cross-origin (the preflight
  * `Access-Control-Allow-Headers` response). Shared by every runtime facade so the
@@ -17,9 +24,11 @@ export declare function parseAllowedOrigins(configured: string | undefined): str
  * request's `Origin` and the configured allowlist. Returns the origin to echo
  * back (so it works without credentials), or `null` to omit the header.
  *
- * - No allowlist configured, or it contains `*` → allow any origin (echo it).
- * - Otherwise → echo the origin only when it's explicitly listed.
+ * - Allowlist contains `*` → allow any origin (explicit opt-in).
+ * - Allowlist has entries → echo the origin only when it's explicitly listed.
+ * - Allowlist unset/empty → reflect any origin when `reflectWhenUnset` (non-production),
+ *   else `null` (production default-deny).
  * - No request Origin (non-browser caller) → `null`; CORS doesn't apply.
  */
-export declare function resolveCorsOrigin(requestOrigin: string | undefined | null, configured: string | undefined): string | null;
+export declare function resolveCorsOrigin(requestOrigin: string | undefined | null, configured: string | undefined, reflectWhenUnset?: boolean): string | null;
 //# sourceMappingURL=cors.d.ts.map

package/dist/http/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,UAKhC,CAAA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAK5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACxC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,GAAG,IAAI,CAKf"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE9E;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,UAKhC,CAAA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAK5E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACxC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,UAAO,GACtB,MAAM,GAAG,IAAI,CAMf"}

package/dist/http/cors.js

@@ -1,8 +1,29 @@
 // CORS origin policy. The set of allowed browser Origins is configuration, not
 // code: this is a self-hosted system, so each provisioning org declares its own
-// frontend origin(s) (comma-separated). A lone `*` — or no value at all — allows
-// any origin, which is safe here because every route is bearer-gated and fails
-// closed; pinning origins is defense-in-depth.
+// frontend origin(s) (comma-separated). A lone `*` explicitly opts into reflecting
+// any origin. An UNSET allowlist reflects any origin ONLY when ENVIRONMENT is an
+// explicitly recognised development value (dev/test convenience); an unset, unknown, or
+// production ENVIRONMENT default-denies, so a deployment that forgets to set
+// CORS_ALLOWED_ORIGINS fails safe rather than silently reflecting. Auth is a bearer
+// header (not cookies) and credentials mode is off, so this is defense-in-depth.
+/**
+ * Deployment ENVIRONMENT values that are EXPLICITLY non-production, where an unset
+ * `CORS_ALLOWED_ORIGINS` may reflect any origin as a dev/test convenience. The reflect
+ * behaviour is opt-in on one of these values — NOT the default — so a production
+ * deployment that sets neither `ENVIRONMENT` nor `CORS_ALLOWED_ORIGINS` fails safe
+ * (default-deny) rather than silently reflecting. e2e/dev set their own
+ * `CORS_ALLOWED_ORIGINS` anyway, so they're unaffected by the stricter default.
+ */
+const DEVELOPMENT_ENVIRONMENTS = new Set(['development', 'dev', 'test', 'testing', 'local', 'e2e']);
+/**
+ * Whether an unset `CORS_ALLOWED_ORIGINS` should reflect any origin: yes only when
+ * `ENVIRONMENT` is an explicitly recognised development value (dev/test convenience), no
+ * otherwise — an UNSET, unknown, or production `ENVIRONMENT` all default-deny. Pass the
+ * deployment's `ENVIRONMENT` env value.
+ */
+export function corsReflectsWhenUnset(environment) {
+    return DEVELOPMENT_ENVIRONMENTS.has((environment ?? '').trim().toLowerCase());
+}
 /**
  * The request headers the browser is allowed to send cross-origin (the preflight
  * `Access-Control-Allow-Headers` response). Shared by every runtime facade so the
@@ -32,16 +53,20 @@ export function parseAllowedOrigins(configured) {
  * request's `Origin` and the configured allowlist. Returns the origin to echo
  * back (so it works without credentials), or `null` to omit the header.
  *
- * - No allowlist configured, or it contains `*` → allow any origin (echo it).
- * - Otherwise → echo the origin only when it's explicitly listed.
+ * - Allowlist contains `*` → allow any origin (explicit opt-in).
+ * - Allowlist has entries → echo the origin only when it's explicitly listed.
+ * - Allowlist unset/empty → reflect any origin when `reflectWhenUnset` (non-production),
+ *   else `null` (production default-deny).
  * - No request Origin (non-browser caller) → `null`; CORS doesn't apply.
  */
-export function resolveCorsOrigin(requestOrigin, configured) {
+export function resolveCorsOrigin(requestOrigin, configured, reflectWhenUnset = true) {
     if (!requestOrigin)
         return null;
     const allowed = parseAllowedOrigins(configured);
-    if (allowed.length === 0 || allowed.includes('*'))
+    if (allowed.includes('*'))
         return requestOrigin;
+    if (allowed.length === 0)
+        return reflectWhenUnset ? requestOrigin : null;
     return allowed.includes(requestOrigin) ? requestOrigin : null;
 }
 //# sourceMappingURL=cors.js.map

package/dist/http/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,+CAA+C;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAA;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAA8B;IAChE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAwC,EACxC,UAA8B;IAE9B,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACvE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/http/cors.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAChF,mFAAmF;AACnF,iFAAiF;AACjF,wFAAwF;AACxF,6EAA6E;AAC7E,oFAAoF;AACpF,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;AAEnG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA+B;IACnE,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,iBAAiB;CAClB,CAAA;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,UAA8B;IAChE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAA;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAwC,EACxC,UAA8B,EAC9B,gBAAgB,GAAG,IAAI;IAEvB,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACxE,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/D,CAAC"}

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
 export { mountAuthGate } from './http/authGate.js';
 export { param } from './http/params.js';
 export { handleError } from './http/errorHandler.js';
-export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from './http/cors.js';
+export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
 export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
 export { WebCryptoSecretCipher, type WebCryptoSecretCipherOptions, } from './crypto/WebCryptoSecretCipher.js';
 export { WebCryptoPersonalSecretCipher } from './crypto/WebCryptoPersonalSecretCipher.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAI5E,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAI5E,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -38,7 +38,7 @@ export { InAppNotificationChannel } from './events/InAppNotificationChannel.js';
 export { mountAuthGate } from './http/authGate.js';
 export { param } from './http/params.js';
 export { handleError } from './http/errorHandler.js';
-export { CORS_ALLOWED_HEADERS, parseAllowedOrigins, resolveCorsOrigin } from './http/cors.js';
+export { CORS_ALLOWED_HEADERS, corsReflectsWhenUnset, parseAllowedOrigins, resolveCorsOrigin, } from './http/cors.js';
 export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
 // Runtime-neutral (Web Crypto) credential encryption + GitHub-App authentication,
 // shared by both facades so the Node service can mint installation tokens and

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GAQvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAC7F,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAkC,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAsB3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAE5E,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAA+D,MAAM,eAAe,CAAA;AAC3F,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GAQvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,GAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,GAEvB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EAAE,aAAa,EAAkC,MAAM,2BAA2B,CAAA;AACzF,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAsB3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA;AAE5E,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/dist/modules/webSearch/upstreams.d.ts

@@ -1,4 +1,10 @@
 import type { WebSearchResponse, WebSearchUpstream } from '../../runtime/gateways.js';
+export declare const WEB_SEARCH_URL_SAFETY_POLICY: {
+    readonly schemes: readonly ['http', 'https'];
+    readonly allowHosts: readonly [];
+};
+/** Assert an account-supplied web-search URL is not an SSRF vector. Throws on a bad host. */
+export declare function assertSafeWebSearchUrl(url: string): void;
 /** Default number of results requested per search. */
 export declare const DEFAULT_WEB_SEARCH_COUNT = 5;
 /**

package/dist/modules/webSearch/upstreams.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAQrF,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAgBzC;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAE5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF3B,YACmB,MAAM,EAAE,MAAM,EACd,QAAQ,SAAmD,EAC1E;IAEE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAkB5B;CACF;AAOD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAH1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,YACE,OAAO,EAAE,MAAM,EACE,MAAM,CAAC,EAAE,MAAM,YAAA,EAGjC;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAuB5B;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,GAAG,iBAAiB,GAAG,SAAS,CAMhC"}
+{"version":3,"file":"upstreams.d.ts","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAOrF,eAAO,MAAM,4BAA4B;aAAK,OAAO,YAAG,MAAM,EAAE,OAAO;aAAG,UAAU;CAAe,CAAA;AAEnG,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAExD;AAeD,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAgBzC;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAE5D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF3B,YACmB,MAAM,EAAE,MAAM,EACd,QAAQ,SAAmD,EAC1E;IAEE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAkB5B;CACF;AAOD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,iBAAiB;IAI9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAH1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,YACE,OAAO,EAAE,MAAM,EACE,MAAM,CAAC,EAAE,MAAM,YAAA,EAGjC;IAEK,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;CACF;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,GAAG,iBAAiB,GAAG,SAAS,CAMhC"}

package/dist/modules/webSearch/upstreams.js

@@ -1,3 +1,18 @@
+import { environmentsLogic, readCappedText, safeFetch } from '@cat-factory/integrations';
+// SearXNG is reached at an account-configured URL, so — unlike the hardcoded Brave
+// endpoint — it MUST be SSRF-guarded: block private/internal/metadata hosts (the SSRF
+// target) while still allowing a public self-hosted instance over http or https. The
+// same policy guards the write boundary (AccountSettingsService), so a bad URL is
+// rejected when saved AND re-checked (with per-hop redirect revalidation) when fetched.
+export const WEB_SEARCH_URL_SAFETY_POLICY = { schemes: ['http', 'https'], allowHosts: [] };
+/** Assert an account-supplied web-search URL is not an SSRF vector. Throws on a bad host. */
+export function assertSafeWebSearchUrl(url) {
+    environmentsLogic.assertSafeEnvironmentUrl(url, 'SearXNG URL', WEB_SEARCH_URL_SAFETY_POLICY);
+}
+/** Redirect/size failures from the shared SSRF-safe fetch surface as a plain search error. */
+const makeSearchError = (status, message) => new Error(`Web search ${message.toLowerCase()} (HTTP ${status})`);
+/** Hard cap on the bytes read off a search response body. */
+const MAX_SEARCH_RESPONSE_BYTES = 2_000_000;
 // Runtime-neutral web-search upstreams for the container search proxy. Each performs
 // the actual search server-side (under the deployment's own provider key) and maps the
 // provider's payload into the normalised SearXNG-style shape the proxy returns. They
@@ -65,17 +80,21 @@ export class SearxngWebSearchUpstream {
         const url = new URL(`${this.base}/search`);
         url.searchParams.set('q', query);
         url.searchParams.set('format', 'json');
-        const res = await fetch(url, {
+        // Re-validate the (account-configured) host on every redirect hop so a permitted
+        // base can't 302 the request — with the optional bearer attached — to an internal
+        // or metadata host.
+        const res = await safeFetch(url.toString(), {
             headers: {
                 accept: 'application/json',
                 ...(this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {}),
             },
             ...(opts.signal ? { signal: opts.signal } : {}),
-        });
+        }, assertSafeWebSearchUrl, makeSearchError);
         if (!res.ok) {
             throw new Error(`SearXNG search failed (HTTP ${res.status})`);
         }
-        const json = (await res.json());
+        const text = await readCappedText(res, MAX_SEARCH_RESPONSE_BYTES, makeSearchError);
+        const json = JSON.parse(text);
         const limit = clampCount(opts.count);
         const results = (json.results ?? [])
             .filter((r) => {

package/dist/modules/webSearch/upstreams.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstreams.js","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACjF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,EAAE,oBAAoB,CAAC,CAAA;AACpE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAEd,MAAM;IACN,QAAQ;IAF3B,YACmB,MAAc,EACd,QAAQ,GAAG,gDAAgD;sBAD3D,MAAM;wBACN,QAAQ;IACxB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAA8D,EAAE;YACxE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAIhB,MAAM;IAHR,IAAI,CAAQ;IAC7B,YACE,OAAe,EACE,MAAe;sBAAf,MAAM;QAEvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC,CAAA;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACxD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAA0D,EAAE;YACpE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAIvC;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACtC,IAAI,OAAO;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,SAAS,CAAA;AAClB,CAAC"}
+{"version":3,"file":"upstreams.js","sourceRoot":"","sources":["../../../src/modules/webSearch/upstreams.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAGxF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,kFAAkF;AAClF,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,EAAE,EAAW,CAAA;AAEnG,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,iBAAiB,CAAC,wBAAwB,CAAC,GAAG,EAAE,aAAa,EAAE,4BAA4B,CAAC,CAAA;AAC9F,CAAC;AAED,8FAA8F;AAC9F,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE,CAC1D,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,WAAW,EAAE,UAAU,MAAM,GAAG,CAAC,CAAA;AAEnE,6DAA6D;AAC7D,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAE3C,qFAAqF;AACrF,uFAAuF;AACvF,qFAAqF;AACrF,oFAAoF;AACpF,gFAAgF;AAEhF,sDAAsD;AACtD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAE/B,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,wBAAwB,CAAA;IACjF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAe,CAAC,EAAE,oBAAoB,CAAC,CAAA;AACpE,CAAC;AAOD;;;;;GAKG;AACH,MAAM,OAAO,sBAAsB;IAEd,MAAM;IACN,QAAQ;IAF3B,YACmB,MAAc,EACd,QAAQ,GAAG,gDAAgD;sBAD3D,MAAM;wBACN,QAAQ;IACxB,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,IAAI,CAAC,MAAM,EAAE;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAA8D,EAAE;YACxE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAOD;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IAIhB,MAAM;IAHR,IAAI,CAAQ;IAC7B,YACE,OAAe,EACE,MAAe;sBAAf,MAAM;QAEvB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa,EACb,IAAI,GAA6C,EAAE;QAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,SAAS,CAAC,CAAA;QAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACtC,iFAAiF;QACjF,kFAAkF;QAClF,oBAAoB;QACpB,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,CAAC,QAAQ,EAAE,EACd;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,EACD,sBAAsB,EACtB,eAAe,CAChB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,eAAe,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAA;QACtD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAA0D,EAAE;YACpE,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAA;QAClC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/E,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAIvC;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACtC,IAAI,OAAO;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACpF,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/persistence/mappers.d.ts

@@ -45,6 +45,10 @@ export interface BlockRow {
     instance_size: string | null;
     /** Frontend-frame-level: serialized FrontendConfig (build/serve/mock + backend bindings), JSON object. */
     frontend_config?: string | null;
+    /** Service-frame-level: directed consumer→provider service connections, JSON array. */
+    service_connections?: string | null;
+    /** Task-level: connected service frames directly involved in the task, JSON array of ids. */
+    involved_service_ids?: string | null;
     created_by: string | null;
     responsible_product_user_id: string | null;
     /** Task-level: the task-estimator's triage (complexity/risk/impact), JSON object. */

package/dist/persistence/mappers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mappers.d.ts","sourceRoot":"","sources":["../../src/persistence/mappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,EAEV,KAAK,EACL,iBAAiB,EACjB,QAAQ,EAER,SAAS,EACV,MAAM,wBAAwB,CAAA;AAiB/B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAQ3D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oEAAoE;IACpE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,0GAA0G;IAC1G,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AAoWD,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,KAAK,CAE/C;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IACjC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAClC,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAmBxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAEtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAGnC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAgCD,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAuCD,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoDnE;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAarE"}
+{"version":3,"file":"mappers.d.ts","sourceRoot":"","sources":["../../src/persistence/mappers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,EAEV,KAAK,EACL,iBAAiB,EACjB,QAAQ,EAER,SAAS,EACV,MAAM,wBAAwB,CAAA;AAiB/B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAQ3D;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,sEAAsE;IACtE,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oFAAoF;IACpF,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,oEAAoE;IACpE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,0GAA0G;IAC1G,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,0FAA0F;IAC1F,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,oFAAoF;IACpF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzC;AA2YD,wBAAgB,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,KAAK,CAE/C;AAED,+CAA+C;AAC/C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9E;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IACjC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;IAClC,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,CAmBxD;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAEtB,UAAU,EAAE,MAAM,CAAA;IAClB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAGnC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AAgCD,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAuCD,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,iBAAiB,CAoDnE;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAarE"}

package/dist/persistence/mappers.js

@@ -302,6 +302,45 @@ const blockFields = [
     optField('instanceSize'),
     // Frontend-frame-level config (build/serve/mock + backend bindings) — a JSON object.
     optJsonField('frontendConfig'),
+    // Service-frame connections (consumer→provider edges). Patch treats an empty array as
+    // "clear them" (length check), mirroring `serviceFragmentIds`.
+    {
+        read: (row, out) => {
+            if (row.service_connections != null)
+                out.serviceConnections = JSON.parse(row.service_connections);
+        },
+        insert: (b, out) => {
+            out.service_connections = b.serviceConnections?.length
+                ? JSON.stringify(b.serviceConnections)
+                : null;
+        },
+        patch: (p, out) => {
+            if (p.serviceConnections !== undefined) {
+                out.service_connections = p.serviceConnections?.length
+                    ? JSON.stringify(p.serviceConnections)
+                    : null;
+            }
+        },
+    },
+    // A task's involved connected services. Patch treats an empty array as "clear it".
+    {
+        read: (row, out) => {
+            if (row.involved_service_ids != null)
+                out.involvedServiceIds = JSON.parse(row.involved_service_ids);
+        },
+        insert: (b, out) => {
+            out.involved_service_ids = b.involvedServiceIds?.length
+                ? JSON.stringify(b.involvedServiceIds)
+                : null;
+        },
+        patch: (p, out) => {
+            if (p.involvedServiceIds !== undefined) {
+                out.involved_service_ids = p.involvedServiceIds?.length
+                    ? JSON.stringify(p.involvedServiceIds)
+                    : null;
+            }
+        },
+    },
     // `createdBy` is set at insert time and never patched. LEGACY: a pre-#94 numeric id is
     // dropped to null on read (see the LEGACY USER-ID REPAIR note; remove after 2026-07-15).
     legacyUserIdField('createdBy'),

package/dist/persistence/mappers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mappers.js","sourceRoot":"","sources":["../../src/persistence/mappers.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAsB,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExE,0EAA0E;AAC1E,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AAavC,MAAM,UAAU,cAAc,CAAC,GAAiB;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;KAClC,CAAA;AACH,CAAC;AAiFD,2GAA2G;AAC3G,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,2FAA2F;AAC3F,+EAA+E;AAC/E,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,0DAA0D;AAC1D,EAAE;AACF,wFAAwF;AACxF,oFAAoF;AACpF,kFAAkF;AAClF,oBAAoB;AACpB,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,2FAA2F;QAC3F,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAY,EACZ,MAAuC,EACvC,KAAa,EACb,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtB,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,KAAK,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;QAC9C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CACf,IAAY,EACZ,IAAI,GAAqE,EAAE;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,SAAS;gBAAE,OAAM;YACtB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;KACF,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;KACF,CAAA;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5B,CAAC;KACF,CAAA;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,gBAAgB,CACvB,MAAoC;IAMpC,OAAO;QACL,OAAO,CAAC,GAAG;YACT,MAAM,GAAG,GAAW,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,IAAI,CAAC,GAAa,EAAE,GAAG,CAAC,CAAA;YAClD,OAAO,GAAa,CAAA;QACtB,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,GAAG,GAAiB,EAAE,CAAA;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC7C,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,OAAO,CAAC,KAAK;YACX,MAAM,GAAG,GAAiB,EAAE,CAAA;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,MAAM,WAAW,GAAqC;IACpD,WAAW,CAAC,IAAI,CAAC;IACjB,WAAW,CAAC,OAAO,CAAC;IACpB,WAAW,CAAC,MAAM,CAAC;IACnB,WAAW,CAAC,aAAa,CAAC;IAC1B;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;QAC/C,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YACxB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACxB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;KACF;IACD;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC3F,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;YAC7B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;QAChC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;gBAC7B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;YAChC,CAAC;QACH,CAAC;KACF;IACD,SAAS,CAAC,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,CAAC;IAChD,WAAW,CAAC,UAAU,CAAC;IACvB,0FAA0F;IAC1F;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,UAAoB,EAAE;gBACpE,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC7E,CAAC;KACF;IACD,WAAW,CAAC,aAAa,CAAC;IAC1B,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC;IAC9C,WAAW,CAAC,UAAU,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,eAAe,CAAC,qBAAqB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC;IACtB,YAAY,CAAC,aAAa,CAAC;IAC3B,sFAAsF;IACtF,oFAAoF;IACpF;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,oBAAoB,IAAI,IAAI;gBAClC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAA8B,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/F,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,oBAAoB;oBACtB,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBACjD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;wBACtC,CAAC,CAAC,IAAI,CAAA;YACZ,CAAC;QACH,CAAC;KACF;IACD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,YAAY,CAAC,aAAa,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9C,qFAAqF;IACrF;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI;gBAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAsB,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC7F,CAAC;QACH,CAAC;KACF;IACD,0FAA0F;IAC1F,YAAY,CAAC,cAAc,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC;IACxB,qFAAqF;IACrF,YAAY,CAAC,gBAAgB,CAAC;IAC9B,uFAAuF;IACvF,yFAAyF;IACzF,iBAAiB,CAAC,WAAW,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,wDAAwD;IACxD,YAAY,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC;IACpB,YAAY,CAAC,gBAAgB,CAAC;IAC9B,0FAA0F;IAC1F,0FAA0F;IAC1F;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;gBAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAC3B,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,CAAC;KACF;IACD,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC1D,CAAA;AAED,MAAM,WAAW,GAAG,gBAAgB,CAA8B,WAAW,CAAC,CAAA;AAE9E,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,KAAY;IAC5C,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AA8BD,MAAM,UAAU,aAAa,CAAC,GAAgB;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAA8B,EAAE;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAA;AACH,CAAC;AAoCD,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,oFAAoF;AACpF,wFAAwF;AACxF,yFAAyF;AACzF,0FAA0F;AAC1F,uFAAuF;AACvF,uEAAuE;AACvE,EAAE;AACF,uFAAuF;AACvF,0EAA0E;AAC1E,EAAE;AACF,wFAAwF;AACxF,4FAA4F;AAC5F,0DAA0D;AAC1D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAExF,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;QACzC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAiB;IAC9C,IAAI,MAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAA;IACb,CAAC;IACD,qFAAqF;IACrF,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE;YAC5D,KAAK,EAAE,YAAY;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAA;IAC3C,0FAA0F;IAC1F,2FAA2F;IAC3F,0CAA0C;IAC1C,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,EAAE;YACrE,KAAK,EAAE,YAAY;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,iFAAiF;QACjF,uEAAuE;QACvE,KAAK;QACL,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE;YACpD,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC;QACF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QACvC,yFAAyF;QACzF,8EAA8E;QAC9E,cAAc,EAAE,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1D,qFAAqF;QACrF,kEAAkE;QAClE,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7C,4EAA4E;QAC5E,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;KAClB,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,8EAA8E;QAC9E,iFAAiF;QACjF,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACzC,wFAAwF;QACxF,0DAA0D;QAC1D,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"mappers.js","sourceRoot":"","sources":["../../src/persistence/mappers.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAsB,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExE,0EAA0E;AAC1E,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;AAavC,MAAM,UAAU,cAAc,CAAC,GAAiB;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;KAClC,CAAA;AACH,CAAC;AAqFD,2GAA2G;AAC3G,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,yFAAyF;AACzF,yFAAyF;AACzF,oFAAoF;AACpF,2FAA2F;AAC3F,+EAA+E;AAC/E,EAAE;AACF,2FAA2F;AAC3F,2FAA2F;AAC3F,0DAA0D;AAC1D,EAAE;AACF,wFAAwF;AACxF,oFAAoF;AACpF,kFAAkF;AAClF,oBAAoB;AACpB,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,2FAA2F;QAC3F,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;KAChB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,IAAY,EACZ,MAAuC,EACvC,KAAa,EACb,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAEtB,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,KAAK,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;QAC9C,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CACf,IAAY,EACZ,IAAI,GAAqE,EAAE;IAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAC3C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,SAAS;gBAAE,OAAM;YACtB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;KACF,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,YAAY,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAW,CAAC,CAAA;QACxE,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5C,CAAC;KACF,CAAA;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,eAAe,CAAO,IAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACxD,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,MAAM,CAAC,GAAI,CAAY,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAM;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5B,CAAC;KACF,CAAA;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,gBAAgB,CACvB,MAAoC;IAMpC,OAAO;QACL,OAAO,CAAC,GAAG;YACT,MAAM,GAAG,GAAW,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,IAAI,CAAC,GAAa,EAAE,GAAG,CAAC,CAAA;YAClD,OAAO,GAAa,CAAA;QACtB,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,GAAG,GAAiB,EAAE,CAAA;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YAC7C,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,OAAO,CAAC,KAAK;YACX,MAAM,GAAG,GAAiB,EAAE,CAAA;YAC5B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC3C,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,sFAAsF;AACtF,wFAAwF;AACxF,MAAM,WAAW,GAAqC;IACpD,WAAW,CAAC,IAAI,CAAC;IACjB,WAAW,CAAC,OAAO,CAAC;IACpB,WAAW,CAAC,MAAM,CAAC;IACnB,WAAW,CAAC,aAAa,CAAC;IAC1B;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;QAC/C,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YACxB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC1B,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACxB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC1B,CAAC;QACH,CAAC;KACF;IACD;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC3F,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;YAC7B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;QAChC,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;gBAC7B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAA;YAChC,CAAC;QACH,CAAC;KACF;IACD,SAAS,CAAC,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,CAAC;IAChD,WAAW,CAAC,UAAU,CAAC;IACvB,0FAA0F;IAC1F;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,eAAe,EAAE,GAAG,CAAC,UAAoB,EAAE;gBACpE,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,GAAG,CAAC,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC9C,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC7E,CAAC;KACF;IACD,WAAW,CAAC,aAAa,CAAC;IAC1B,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC;IAC9C,WAAW,CAAC,UAAU,CAAC;IACvB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,eAAe,CAAC,qBAAqB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC;IACtB,YAAY,CAAC,aAAa,CAAC;IAC3B,sFAAsF;IACtF,oFAAoF;IACpF;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,oBAAoB,IAAI,IAAI;gBAClC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAA8B,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/F,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,oBAAoB;oBACtB,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,kBAAkB,CAAC,MAAM;wBACjD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;wBACtC,CAAC,CAAC,IAAI,CAAA;YACZ,CAAC;QACH,CAAC;KACF;IACD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,YAAY,CAAC,aAAa,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IACjD,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC9C,qFAAqF;IACrF;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI;gBAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAsB,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7F,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC7F,CAAC;QACH,CAAC;KACF;IACD,0FAA0F;IAC1F,YAAY,CAAC,cAAc,CAAC;IAC5B,QAAQ,CAAC,eAAe,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC;IACxB,qFAAqF;IACrF,YAAY,CAAC,gBAAgB,CAAC;IAC9B,sFAAsF;IACtF,+DAA+D;IAC/D;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,mBAAmB,IAAI,IAAI;gBACjC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAA6B,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,EAAE,MAAM;gBACpD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBACtC,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,EAAE,MAAM;oBACpD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;QACH,CAAC;KACF;IACD,mFAAmF;IACnF;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,oBAAoB,IAAI,IAAI;gBAClC,GAAG,CAAC,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAA8B,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,EAAE,MAAM;gBACrD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBACtC,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;gBACvC,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,EAAE,MAAM;oBACrD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACtC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;QACH,CAAC;KACF;IACD,uFAAuF;IACvF,yFAAyF;IACzF,iBAAiB,CAAC,WAAW,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC5D,wDAAwD;IACxD,YAAY,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC;IACpB,YAAY,CAAC,gBAAgB,CAAC;IAC9B,0FAA0F;IAC1F,0FAA0F;IAC1F;QACE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI;gBAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YACjB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAClE,CAAC;QACD,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;YAChB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAC3B,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACpE,CAAC;KACF;IACD,sGAAsG;IACtG,QAAQ,CAAC,wBAAwB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;CAC1D,CAAA;AAED,MAAM,WAAW,GAAG,gBAAgB,CAA8B,WAAW,CAAC,CAAA;AAE9E,MAAM,UAAU,UAAU,CAAC,GAAa;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iBAAiB,CAAC,KAAY;IAC5C,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,KAAiB;IACnD,OAAO,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AA8BD,MAAM,UAAU,aAAa,CAAC,GAAgB;IAC5C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAA2B;QACjE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAA8B,EAAE;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAA;AACH,CAAC;AAoCD,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,oFAAoF;AACpF,wFAAwF;AACxF,yFAAyF;AACzF,0FAA0F;AAC1F,uFAAuF;AACvF,uEAAuE;AACvE,EAAE;AACF,uFAAuF;AACvF,0EAA0E;AAC1E,EAAE;AACF,wFAAwF;AACxF,4FAA4F;AAC5F,0DAA0D;AAC1D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAExF,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,GAAkB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAA;QACzC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAiB;IAC9C,IAAI,MAAgC,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAA;IACb,CAAC;IACD,qFAAqF;IACrF,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE;YAC5D,KAAK,EAAE,YAAY;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAA;IAC3C,0FAA0F;IAC1F,2FAA2F;IAC3F,0CAA0C;IAC1C,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,EAAE;YACrE,KAAK,EAAE,YAAY;YACnB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,iFAAiF;QACjF,uEAAuE;QACvE,KAAK;QACL,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE;YACpD,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,QAAQ;YAChB,EAAE,EAAE,GAAG,CAAC,EAAE;SACX,CAAC;QACF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC;QACvC,yFAAyF;QACzF,8EAA8E;QAC9E,cAAc,EAAE,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1D,qFAAqF;QACrF,kEAAkE;QAClE,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7C,4EAA4E;QAC5E,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;KAClB,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB,CAAC,QAA2B;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,8EAA8E;QAC9E,iFAAiF;QACjF,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACzC,wFAAwF;QACxF,0DAA0D;QAC1D,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC,CAAA;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.68.0",
+  "version": "0.68.2",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -30,13 +30,13 @@
     "hono": "^4.12.27",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.26.13",
-    "@cat-factory/contracts": "0.82.0",
-    "@cat-factory/kernel": "0.70.0",
-    "@cat-factory/orchestration": "0.59.0",
-    "@cat-factory/integrations": "0.56.1",
-    "@cat-factory/prompt-fragments": "0.9.42",
-    "@cat-factory/spend": "0.10.74"
+    "@cat-factory/agents": "0.26.15",
+    "@cat-factory/contracts": "0.83.0",
+    "@cat-factory/integrations": "0.56.3",
+    "@cat-factory/kernel": "0.70.2",
+    "@cat-factory/orchestration": "0.59.2",
+    "@cat-factory/prompt-fragments": "0.9.43",
+    "@cat-factory/spend": "0.10.76"
   },
   "devDependencies": {
     "typescript": "7.0.1-rc",