@cats-inc/cats-platform 0.1.10 → 0.2.8

package/build/server/platform/apps/packageInstaller.d.ts

@@ -0,0 +1,19 @@
+import { type AppPin } from '#cats-app-package';
+import type { CatsAppManifestV1 } from '../../shared/catsAppManifest.js';
+export declare function validateRendererPackage(bytes: Uint8Array, pin: Pick<AppPin, 'id' | 'version' | 'sha256'>): {
+    manifest: CatsAppManifestV1;
+    files: {
+        path: string;
+        data: Buffer;
+    }[];
+    sha256: string;
+};
+export declare function installRendererPackage(options: {
+    chatStatePath: string;
+    bytes: Uint8Array;
+    pin: Pick<AppPin, 'id' | 'version' | 'sha256'>;
+    source: 'desktop-bundle' | 'local-package';
+    enable?: boolean;
+}): Promise<import("../../shared/catsAppManifest.js").CatsInstalledAppRecord>;
+export declare function installBundledApps(chatStatePath: string, lockPath: string): Promise<void>;
+//# sourceMappingURL=packageInstaller.d.ts.map

package/build/server/platform/apps/packageInstaller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageInstaller.d.ts","sourceRoot":"","sources":["../../../../src/platform/apps/packageInstaller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsG,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEpJ,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAIzE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC;;;;;;;EAUxG;AAID,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,CAAC,CAAC;IACzF,MAAM,EAAE,gBAAgB,GAAG,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC9D,6EA2CA;AAED,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/F"}

package/build/server/platform/apps/packageInstaller.js

@@ -0,0 +1,92 @@
+import { mkdir, mkdtemp, readFile, rename, writeFile, lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { APP_SDK_VERSION, PLATFORM_VERSION, decodeAppPackage, parseAppLock, resolveAppLock, supportsVersion } from '#cats-app-package';
+import { parseCatsAppManifestV1 } from '../../shared/catsAppValidation.js';
+import { resolveCatsAppPackageInstallDir, resolveCatsAppStoragePathsFromChatState } from './paths.js';
+import { FileCatsAppRegistry } from './registry.js';
+export function validateRendererPackage(bytes, pin) {
+    const decoded = decodeAppPackage(bytes, pin);
+    const result = parseCatsAppManifestV1(decoded.manifest);
+    if (!result.ok)
+        throw new Error(result.issues.map((issue) => issue.message).join(' '));
+    const manifest = result.manifest;
+    if (manifest.category !== 'user-app' || ['install', 'validate'].includes(manifest.id))
+        throw new Error('Only utility user-app packages are supported.');
+    if (!supportsVersion(PLATFORM_VERSION, manifest.compatibility.catsPlatform)
+        || !supportsVersion(APP_SDK_VERSION, manifest.compatibility.appSdk))
+        throw new Error('Incompatible platform or App SDK version.');
+    if (manifest.permissions.some((permission) => !['ui.route', 'ui.lobby', 'runtime.telemetry.read', 'runtime.telemetry.refresh'].includes(permission)))
+        throw new Error('This package requests capabilities not supported by the renderer host.');
+    return { ...decoded, manifest };
+}
+const installQueues = new Map();
+export async function installRendererPackage(options) {
+    const paths = resolveCatsAppStoragePathsFromChatState(options.chatStatePath);
+    const key = paths.registryPath.toLowerCase();
+    const pending = (installQueues.get(key) ?? Promise.resolve()).catch(() => { }).then(async () => {
+        const decoded = validateRendererPackage(options.bytes, options.pin);
+        const registry = new FileCatsAppRegistry({ registryPath: paths.registryPath });
+        const previous = (await registry.readState()).apps.find((app) => app.id === decoded.manifest.id);
+        // Desktop updates respect an explicit disable/uninstall. The owner's local install is explicit.
+        if (options.source === 'desktop-bundle' && previous?.installState === 'uninstalled')
+            return previous;
+        const target = resolveCatsAppPackageInstallDir(paths, decoded.manifest.id, decoded.manifest.version);
+        const manifest = {
+            ...decoded.manifest,
+            trustTier: options.source === 'desktop-bundle' ? 'system' : 'local-user',
+        };
+        await mkdir(path.dirname(target), { recursive: true });
+        let exists = false;
+        try {
+            const targetStat = await lstat(target);
+            if (!targetStat.isDirectory() || targetStat.isSymbolicLink())
+                throw new Error('Unsafe package install directory.');
+            exists = true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (exists) {
+            const installed = JSON.parse(await readFile(path.join(target, '.package.json'), 'utf8'));
+            if (installed.sha256 !== decoded.sha256)
+                throw new Error('The same app version already exists with a different digest. Publish a new version.');
+            // Re-check the immutable archive on every activation, not just its metadata file.
+            const archive = await readFile(path.join(target, 'payload.catsapp'));
+            decodeAppPackage(archive, options.pin);
+        }
+        else {
+            // No executable hooks or extraction of arbitrary paths. Keep failed staging recoverable.
+            const stage = await mkdtemp(path.join(path.dirname(target), '.staging-'));
+            await writeFile(path.join(stage, 'payload.catsapp'), options.bytes, { flag: 'wx' });
+            await writeFile(path.join(stage, 'cats.app.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+            await writeFile(path.join(stage, '.package.json'), `${JSON.stringify({ sha256: decoded.sha256, source: options.source })}\n`);
+            await rename(stage, target);
+        }
+        const enabled = options.source === 'desktop-bundle' && previous
+            ? previous.enabled && previous.installState === 'enabled' : options.enable === true;
+        return registry.installApp({ manifest, packagePath: target, packageSha256: decoded.sha256,
+            packageSource: options.source, enabled, installState: enabled ? 'enabled' : 'disabled' });
+    });
+    installQueues.set(key, pending);
+    try {
+        return await pending;
+    }
+    finally {
+        if (installQueues.get(key) === pending)
+            installQueues.delete(key);
+    }
+}
+export async function installBundledApps(chatStatePath, lockPath) {
+    const selection = parseAppLock(JSON.parse(await readFile(lockPath, 'utf8')));
+    if (selection.apps.some((app) => app.artifact !== `${app.id}-${app.version}.catsapp`)) {
+        throw new Error('A Desktop bundle must use adjacent local archives; network/path traversal inputs are forbidden at startup.');
+    }
+    const apps = await resolveAppLock(lockPath);
+    // Validate the entire selection before changing active registry entries.
+    for (const app of apps)
+        validateRendererPackage(app.bytes, app);
+    for (const app of apps)
+        await installRendererPackage({ chatStatePath, bytes: app.bytes, pin: app, source: 'desktop-bundle', enable: true });
+}
+//# sourceMappingURL=packageInstaller.js.map

package/build/server/platform/apps/packageInstaller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageInstaller.js","sourceRoot":"","sources":["../../../../src/platform/apps/packageInstaller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAe,MAAM,mBAAmB,CAAC;AACpJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E,OAAO,EAAE,+BAA+B,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AACtG,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,UAAU,uBAAuB,CAAC,KAAiB,EAAE,GAA8C;IACvG,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxJ,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,QAAQ,CAAC,aAAa,CAAC,YAAY,CAAC;WACtE,CAAC,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACpI,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,wBAAwB,EAAE,2BAA2B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAChP,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAG5C;IACC,MAAM,KAAK,GAAG,uCAAuC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAC5F,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjG,gGAAgG;QAChG,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ,EAAE,YAAY,KAAK,aAAa;YAAE,OAAO,QAAQ,CAAC;QACrG,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAsB;YAClC,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SACzE,CAAC;QACF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACnH,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACxF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;YAChH,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;YAChJ,kFAAkF;YAClF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACrE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,yFAAyF;YACzF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1E,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7F,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9H,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,gBAAgB,IAAI,QAAQ;YAC7D,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;QACtF,OAAO,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM;YACvF,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IACH,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QAAC,OAAO,MAAM,OAAO,CAAC;IAAC,CAAC;YACrB,CAAC;QAAC,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,QAAgB;IAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,UAAU,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;IAChI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,yEAAyE;IACzE,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,MAAM,sBAAsB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9I,CAAC"}

package/build/server/platform/apps/registry.d.ts

@@ -8,6 +8,8 @@ export interface CatsAppRegistryInstallInput {
     packagePath: string;
     installState?: CatsAppInstallState;
     enabled?: boolean;
+    packageSha256?: string;
+    packageSource?: 'desktop-bundle' | 'local-package';
 }
 export interface CatsAppRegistryUpdateStateInput {
     installState: CatsAppInstallState;
@@ -29,8 +31,12 @@ export declare class FileCatsAppRegistry {
     listInstalledApps(): Promise<CatsInstalledAppRecord[]>;
     getInstalledApp(appId: string): Promise<CatsInstalledAppRecord | null>;
     installApp(input: CatsAppRegistryInstallInput): Promise<CatsInstalledAppRecord>;
+    private installAppUnlocked;
     updateAppState(appId: string, input: CatsAppRegistryUpdateStateInput): Promise<CatsInstalledAppRecord>;
+    private updateAppStateUnlocked;
     uninstallApp(appId: string, options?: CatsAppRegistryUninstallOptions): Promise<CatsInstalledAppRecord | null>;
+    private uninstallAppUnlocked;
     private writeState;
+    private serialize;
 }
 //# sourceMappingURL=registry.d.ts.map

package/build/server/platform/apps/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/platform/apps/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,+BAA+B;IAC9C,YAAY,EAAE,mBAAmB,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AA+CD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,OAAO,EAAE,0BAA0B;IAKzC,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAW1C,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAOtD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAMtE,UAAU,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA0B/E,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,sBAAsB,CAAC;IAgB5B,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;YAwB3B,UAAU;CAMzB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/platform/apps/registry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,sBAAsB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAC;CACpD;AAED,MAAM,WAAW,+BAA+B;IAC9C,YAAY,EAAE,mBAAmB,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAiDD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAErB,OAAO,EAAE,0BAA0B;IAKzC,SAAS,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAW1C,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAOtD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAMtE,UAAU,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAIvE,kBAAkB;IA2B1B,cAAc,CAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,sBAAsB,CAAC;YAIpB,sBAAsB;IAgB9B,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;YAI3B,oBAAoB;YAwBpB,UAAU;YAOV,SAAS;CAQxB"}

package/build/server/platform/apps/registry.js

@@ -39,6 +39,7 @@ function parseRegistryState(raw) {
 function enabledForState(state) {
     return state === 'enabled';
 }
+const registryWrites = new Map();
 export class FileCatsAppRegistry {
     registryPath;
     now;
@@ -69,6 +70,9 @@ export class FileCatsAppRegistry {
         return matched ? cloneRecord(matched) : null;
     }
     async installApp(input) {
+        return this.serialize(() => this.installAppUnlocked(input));
+    }
+    async installAppUnlocked(input) {
         const state = await this.readState();
         const now = this.now().toISOString();
         const installState = input.installState ?? 'installed';
@@ -81,6 +85,7 @@ export class FileCatsAppRegistry {
             installedAt: now,
             updatedAt: now,
             lastError: null,
+            ...(input.packageSha256 ? { packageSha256: input.packageSha256, packageSource: input.packageSource } : {}),
         };
         const existingIndex = state.apps.findIndex((record) => record.id === nextRecord.id);
         if (existingIndex >= 0) {
@@ -95,6 +100,9 @@ export class FileCatsAppRegistry {
         return cloneRecord(nextRecord);
     }
     async updateAppState(appId, input) {
+        return this.serialize(() => this.updateAppStateUnlocked(appId, input));
+    }
+    async updateAppStateUnlocked(appId, input) {
         const state = await this.readState();
         const record = state.apps.find((entry) => entry.id === appId);
         if (!record) {
@@ -110,6 +118,9 @@ export class FileCatsAppRegistry {
         return cloneRecord(record);
     }
     async uninstallApp(appId, options = {}) {
+        return this.serialize(() => this.uninstallAppUnlocked(appId, options));
+    }
+    async uninstallAppUnlocked(appId, options) {
         const state = await this.readState();
         const existingIndex = state.apps.findIndex((record) => record.id === appId);
         if (existingIndex < 0) {
@@ -138,6 +149,19 @@ export class FileCatsAppRegistry {
         await writeFile(tempPath, `${JSON.stringify(cloneState(state), null, 2)}\n`, 'utf8');
         await rename(tempPath, this.registryPath);
     }
+    async serialize(operation) {
+        const key = path.resolve(this.registryPath).toLowerCase();
+        const previous = registryWrites.get(key) ?? Promise.resolve();
+        const current = previous.catch(() => { }).then(operation);
+        registryWrites.set(key, current);
+        try {
+            return await current;
+        }
+        finally {
+            if (registryWrites.get(key) === current)
+                registryWrites.delete(key);
+        }
+    }
 }
 function isNodeError(error) {
     return error instanceof Error && 'code' in error;

package/build/server/platform/apps/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/platform/apps/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAmC7B,SAAS,kBAAkB;IACzB,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA2B;IAC7C,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,KAA0C,CAAC;QACpD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,mBAAmB;IACb,YAAY,CAAS;IACrB,GAAG,CAAa;IAEjC,YAAY,OAAmC;QAC7C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,kBAAkB,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,aAAa,CAAC;aACzD,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,aAAa,CAAC,CAAC;QAC1G,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAkC;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;QACvD,MAAM,UAAU,GAA2B;YACzC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,YAAY,CAAC;YACvD,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QACpF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3C,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,KAAsC;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,UAA2C,EAAE;QAE7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAC5E,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,WAAW,CAAC;gBACjB,GAAG,MAAM;gBACT,YAAY,EAAE,aAAa;gBAC3B,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,aAAa,CAAC;QACpC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAA2B;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACzE,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../../src/platform/apps/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,IAAI,MAAM,WAAW,CAAC;AAqC7B,SAAS,kBAAkB;IACzB,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,EAAE;KACT,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAA8B;IACjD,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAA2B;IAC7C,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,KAA0C,CAAC;QACpD,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAA0B;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE3D,MAAM,OAAO,mBAAmB;IACb,YAAY,CAAS;IACrB,GAAG,CAAa;IAEjC,YAAY,OAAmC;QAC7C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,OAAO,kBAAkB,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI;aACd,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,aAAa,CAAC;aACzD,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,MAAM,CAAC,YAAY,KAAK,aAAa,CAAC,CAAC;QAC1G,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAkC;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAkC;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,WAAW,CAAC;QACvD,MAAM,UAAU,GAA2B;YACzC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,YAAY,CAAC;YACvD,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3G,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC;QACpF,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3C,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,KAAsC;QAEtC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,KAAsC;QACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACzC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,UAA2C,EAAE;QAE7C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,OAAwC;QACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAC5E,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,WAAW,CAAC;gBACjB,GAAG,MAAM;gBACT,YAAY,EAAE,aAAa;gBAC3B,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,aAAa,CAAC;QACpC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAA2B;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QACzE,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,SAAS,CAAI,SAA2B;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC;QAAC,CAAC;gBACrB,CAAC;YAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IAClF,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/build/server/platform/apps/renderer.d.ts

@@ -0,0 +1,6 @@
+import type { CatsInstalledAppRecord } from '../../shared/catsAppManifest.js';
+export declare function readAppRenderer(record: CatsInstalledAppRecord): Promise<{
+    html: string;
+    sdk: string;
+}>;
+//# sourceMappingURL=renderer.d.ts.map

package/build/server/platform/apps/renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.d.ts","sourceRoot":"","sources":["../../../../src/platform/apps/renderer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAE9E,wBAAsB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAU5G"}

package/build/server/platform/apps/renderer.js

@@ -0,0 +1,18 @@
+import { readFile, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { decodeAppPackage, readBrowserSdk, MAX_PACKAGE_BYTES } from '#cats-app-package';
+export async function readAppRenderer(record) {
+    if (!record.packageSha256 || !record.packageSource)
+        throw new Error('This app has no verified renderer package. Install a .catsapp artifact.');
+    const archivePath = path.join(record.packagePath, 'payload.catsapp');
+    if ((await stat(archivePath)).size > MAX_PACKAGE_BYTES)
+        throw new Error('App package exceeds size limit.');
+    const decoded = decodeAppPackage(await readFile(archivePath), {
+        id: record.id, version: record.manifest.version, sha256: record.packageSha256,
+    });
+    const html = decoded.files.find((file) => file.path === record.manifest.entrypoints?.renderer)?.data.toString('utf8');
+    if (!html || !/<head\s*>/i.test(html))
+        throw new Error('App renderer must contain an explicit <head>.');
+    return { html, sdk: await readBrowserSdk() };
+}
+//# sourceMappingURL=renderer.js.map

package/build/server/platform/apps/renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer.js","sourceRoot":"","sources":["../../../../src/platform/apps/renderer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGxF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA8B;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC/I,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,GAAG,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,EAAE;QAC5D,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa;KAC9E,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtH,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACxG,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,cAAc,EAAE,EAAE,CAAC;AAC/C,CAAC"}

package/build/server/platform/auth/actionGrant.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Short-lived, single-use, purpose-bound step-up capability.
+ *
+ * ADR-111 section 3 rejects both a renderer-only password modal and a broad
+ * `recentlyAuthenticatedAt` timestamp on the session: the first is not an
+ * authorization boundary at all, and the second can authorize several
+ * unrelated sensitive actions. A grant is therefore bound to one account, one
+ * browser session, and one purpose, and is consumed on the first attempt that
+ * presents it — whether or not the rest of that attempt succeeds.
+ *
+ * Grants live in memory only. They are five-minute capabilities that should
+ * die with the process, so they are never written to the auth-state file.
+ */
+export declare const PLATFORM_AUTH_ACTION_GRANT_TTL_MS: number;
+export declare const PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES = 32;
+export declare const MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS = 32;
+export declare const PLATFORM_AUTH_ACTION_HEADER = "x-cats-auth-action";
+export declare const PLATFORM_AUTH_ACTION_GRANT_PURPOSES: readonly ["link_google", "unlink_google"];
+export type PlatformAuthActionGrantPurpose = (typeof PLATFORM_AUTH_ACTION_GRANT_PURPOSES)[number];
+export declare function isPlatformAuthActionGrantPurpose(value: unknown): value is PlatformAuthActionGrantPurpose;
+export interface PlatformAuthActionGrantIssueInput {
+    accountId: string;
+    sessionId: string;
+    purpose: PlatformAuthActionGrantPurpose;
+    sessionSecret: string;
+    ttlMs?: number;
+    now?: Date;
+}
+export interface PlatformAuthActionGrantIssueResult {
+    token: string;
+    expiresAt: string;
+}
+export interface PlatformAuthActionGrantConsumeInput {
+    token: string;
+    accountId: string;
+    sessionId: string;
+    purpose: PlatformAuthActionGrantPurpose;
+    sessionSecret: string;
+    now?: Date;
+}
+export type PlatformAuthActionGrantRejectionReason = 'missing_token' | 'unknown_or_expired' | 'purpose_mismatch' | 'account_mismatch' | 'session_mismatch';
+export type PlatformAuthActionGrantConsumeOutcome = {
+    ok: true;
+    purpose: PlatformAuthActionGrantPurpose;
+} | {
+    ok: false;
+    reason: PlatformAuthActionGrantRejectionReason;
+};
+export interface PlatformAuthActionGrantStore {
+    issue(input: PlatformAuthActionGrantIssueInput): PlatformAuthActionGrantIssueResult;
+    consume(input: PlatformAuthActionGrantConsumeInput): PlatformAuthActionGrantConsumeOutcome;
+    revokeForSession(sessionId: string): void;
+}
+export declare class MemoryPlatformAuthActionGrantStore implements PlatformAuthActionGrantStore {
+    private readonly grants;
+    issue(input: PlatformAuthActionGrantIssueInput): PlatformAuthActionGrantIssueResult;
+    consume(input: PlatformAuthActionGrantConsumeInput): PlatformAuthActionGrantConsumeOutcome;
+    revokeForSession(sessionId: string): void;
+    private prune;
+}
+//# sourceMappingURL=actionGrant.d.ts.map

package/build/server/platform/auth/actionGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionGrant.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/actionGrant.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,iCAAiC,QAAgB,CAAC;AAC/D,eAAO,MAAM,sCAAsC,KAAK,CAAC;AACzD,eAAO,MAAM,uCAAuC,KAAK,CAAC;AAC1D,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAEhE,eAAO,MAAM,mCAAmC,2CAGtC,CAAC;AAEX,MAAM,MAAM,8BAA8B,GACxC,CAAC,OAAO,mCAAmC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,8BAA8B,CAGzC;AAED,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,8BAA8B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,8BAA8B,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,MAAM,sCAAsC,GAC9C,eAAe,GACf,oBAAoB,GACpB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,qCAAqC,GAC7C;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,8BAA8B,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sCAAsC,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,iCAAiC,GAAG,kCAAkC,CAAC;IACpF,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,qCAAqC,CAAC;IAC3F,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAWD,qBAAa,kCAAmC,YAAW,4BAA4B;IACrF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoD;IAE3E,KAAK,CAAC,KAAK,EAAE,iCAAiC,GAAG,kCAAkC;IAsCnF,OAAO,CAAC,KAAK,EAAE,mCAAmC,GAAG,qCAAqC;IA8B1F,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAQzC,OAAO,CAAC,KAAK;CAQd"}

package/build/server/platform/auth/actionGrant.js

@@ -0,0 +1,108 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { hashSessionToken } from './session.js';
+/**
+ * Short-lived, single-use, purpose-bound step-up capability.
+ *
+ * ADR-111 section 3 rejects both a renderer-only password modal and a broad
+ * `recentlyAuthenticatedAt` timestamp on the session: the first is not an
+ * authorization boundary at all, and the second can authorize several
+ * unrelated sensitive actions. A grant is therefore bound to one account, one
+ * browser session, and one purpose, and is consumed on the first attempt that
+ * presents it — whether or not the rest of that attempt succeeds.
+ *
+ * Grants live in memory only. They are five-minute capabilities that should
+ * die with the process, so they are never written to the auth-state file.
+ */
+export const PLATFORM_AUTH_ACTION_GRANT_TTL_MS = 5 * 60 * 1000;
+export const PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES = 32;
+export const MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS = 32;
+export const PLATFORM_AUTH_ACTION_HEADER = 'x-cats-auth-action';
+export const PLATFORM_AUTH_ACTION_GRANT_PURPOSES = [
+    'link_google',
+    'unlink_google',
+];
+export function isPlatformAuthActionGrantPurpose(value) {
+    return typeof value === 'string'
+        && PLATFORM_AUTH_ACTION_GRANT_PURPOSES.includes(value);
+}
+export class MemoryPlatformAuthActionGrantStore {
+    grants = new Map();
+    issue(input) {
+        const accountId = input.accountId.trim();
+        const sessionId = input.sessionId.trim();
+        if (!accountId || !sessionId) {
+            throw new Error('Action grant account and session ids are required.');
+        }
+        const now = input.now ?? new Date();
+        this.prune(now);
+        const ttlMs = input.ttlMs ?? PLATFORM_AUTH_ACTION_GRANT_TTL_MS;
+        const token = randomBytes(PLATFORM_AUTH_ACTION_GRANT_TOKEN_BYTES).toString('base64url');
+        const tokenHash = hashSessionToken(token, input.sessionSecret);
+        const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
+        // A caller that keeps requesting grants without spending them must not be
+        // able to grow this map without bound. Evicting the oldest entry keeps the
+        // most recent step-up usable, which is the one the operator just performed.
+        if (this.grants.size >= MAX_PENDING_PLATFORM_AUTH_ACTION_GRANTS) {
+            const oldest = [...this.grants.entries()].sort((left, right) => Date.parse(left[1].createdAt) - Date.parse(right[1].createdAt))[0];
+            if (oldest) {
+                this.grants.delete(oldest[0]);
+            }
+        }
+        this.grants.set(tokenHash, {
+            tokenHash,
+            accountId,
+            sessionId,
+            purpose: input.purpose,
+            createdAt: now.toISOString(),
+            expiresAt,
+        });
+        return { token, expiresAt };
+    }
+    consume(input) {
+        const token = input.token.trim();
+        if (!token) {
+            return { ok: false, reason: 'missing_token' };
+        }
+        const now = input.now ?? new Date();
+        this.prune(now);
+        const tokenHash = hashSessionToken(token, input.sessionSecret);
+        const stored = this.grants.get(tokenHash) ?? null;
+        if (!stored || !matchesTokenHash(stored.tokenHash, tokenHash)) {
+            return { ok: false, reason: 'unknown_or_expired' };
+        }
+        // SPEC-113 requirement 22: the grant is spent on the first matching attempt
+        // even when a later check in that same attempt fails.
+        this.grants.delete(tokenHash);
+        if (stored.purpose !== input.purpose) {
+            return { ok: false, reason: 'purpose_mismatch' };
+        }
+        if (stored.accountId !== input.accountId) {
+            return { ok: false, reason: 'account_mismatch' };
+        }
+        if (stored.sessionId !== input.sessionId) {
+            return { ok: false, reason: 'session_mismatch' };
+        }
+        return { ok: true, purpose: stored.purpose };
+    }
+    revokeForSession(sessionId) {
+        for (const [tokenHash, grant] of this.grants) {
+            if (grant.sessionId === sessionId) {
+                this.grants.delete(tokenHash);
+            }
+        }
+    }
+    prune(now) {
+        const nowMs = now.getTime();
+        for (const [tokenHash, grant] of this.grants) {
+            if (Date.parse(grant.expiresAt) <= nowMs) {
+                this.grants.delete(tokenHash);
+            }
+        }
+    }
+}
+function matchesTokenHash(storedHash, candidateHash) {
+    const stored = Buffer.from(storedHash, 'utf8');
+    const candidate = Buffer.from(candidateHash, 'utf8');
+    return stored.length === candidate.length && timingSafeEqual(stored, candidate);
+}
+//# sourceMappingURL=actionGrant.js.map

package/build/server/platform/auth/actionGrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actionGrant.js","sourceRoot":"","sources":["../../../../src/platform/auth/actionGrant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/D,MAAM,CAAC,MAAM,sCAAsC,GAAG,EAAE,CAAC;AACzD,MAAM,CAAC,MAAM,uCAAuC,GAAG,EAAE,CAAC;AAC1D,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,aAAa;IACb,eAAe;CACP,CAAC;AAKX,MAAM,UAAU,gCAAgC,CAC9C,KAAc;IAEd,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC1B,mCAAyD,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAmDD,MAAM,OAAO,kCAAkC;IAC5B,MAAM,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE3E,KAAK,CAAC,KAAwC;QAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,iCAAiC,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,sCAAsC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxF,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhE,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,uCAAuC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAC5C,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAChF,CAAC,CAAC,CAAC,CAAC;YACL,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE;YACzB,SAAS;YACT,SAAS;YACT,SAAS;YACT,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,KAA0C;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEhB,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QAED,4EAA4E;QAC5E,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE9B,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAS;QACrB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,UAAkB,EAAE,aAAqB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC"}

package/build/server/platform/auth/adminCredentials.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared Admin credential rules for first-admin setup and repair bootstrap.
+ *
+ * ADR-111 fixes one promotion-period password policy for both paths: 8 to 256
+ * Unicode code points inclusive, with no composition rules. Length is counted
+ * in code points, not UTF-16 code units, so an emoji or other astral character
+ * counts once rather than twice.
+ */
+export declare const PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS = 8;
+export declare const PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS = 256;
+export type PlatformAdminCredentialRejectionReason = 'identifier_required' | 'password_required' | 'password_too_short' | 'password_too_long';
+export interface PlatformAdminCredentials {
+    identifier: string;
+    password: string;
+}
+export type PlatformAdminCredentialValidation = {
+    ok: true;
+    credentials: PlatformAdminCredentials;
+} | {
+    ok: false;
+    reason: PlatformAdminCredentialRejectionReason;
+};
+export declare class PlatformAdminCredentialError extends Error {
+    readonly reason: PlatformAdminCredentialRejectionReason;
+    constructor(reason: PlatformAdminCredentialRejectionReason);
+}
+export declare function countUnicodeCodePoints(value: string): number;
+export declare function validatePlatformAdminCredentials(input: {
+    identifier: unknown;
+    password: unknown;
+}): PlatformAdminCredentialValidation;
+export declare function assertPlatformAdminCredentials(input: {
+    identifier: unknown;
+    password: unknown;
+}): PlatformAdminCredentials;
+export declare function describePlatformAdminCredentialRejection(reason: PlatformAdminCredentialRejectionReason): string;
+//# sourceMappingURL=adminCredentials.d.ts.map

package/build/server/platform/auth/adminCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCredentials.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/adminCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,uCAAuC,IAAI,CAAC;AACzD,eAAO,MAAM,uCAAuC,MAAM,CAAC;AAE3D,MAAM,MAAM,sCAAsC,GAC9C,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,iCAAiC,GACzC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,wBAAwB,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sCAAsC,CAAA;CAAE,CAAC;AAElE,qBAAa,4BAA6B,SAAQ,KAAK;aACzB,MAAM,EAAE,sCAAsC;gBAA9C,MAAM,EAAE,sCAAsC;CAI3E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,iCAAiC,CAoBpC;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,GAAG,wBAAwB,CAM3B;AAED,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,sCAAsC,GAC7C,MAAM,CAeR"}

package/build/server/platform/auth/adminCredentials.js

@@ -0,0 +1,63 @@
+/**
+ * Shared Admin credential rules for first-admin setup and repair bootstrap.
+ *
+ * ADR-111 fixes one promotion-period password policy for both paths: 8 to 256
+ * Unicode code points inclusive, with no composition rules. Length is counted
+ * in code points, not UTF-16 code units, so an emoji or other astral character
+ * counts once rather than twice.
+ */
+export const PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS = 8;
+export const PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS = 256;
+export class PlatformAdminCredentialError extends Error {
+    reason;
+    constructor(reason) {
+        super(describePlatformAdminCredentialRejection(reason));
+        this.reason = reason;
+        this.name = 'PlatformAdminCredentialError';
+    }
+}
+export function countUnicodeCodePoints(value) {
+    let count = 0;
+    for (const _codePoint of value) {
+        count += 1;
+    }
+    return count;
+}
+export function validatePlatformAdminCredentials(input) {
+    const identifier = typeof input.identifier === 'string' ? input.identifier.trim() : '';
+    if (!identifier) {
+        return { ok: false, reason: 'identifier_required' };
+    }
+    const password = typeof input.password === 'string' ? input.password : '';
+    if (!password) {
+        return { ok: false, reason: 'password_required' };
+    }
+    const codePoints = countUnicodeCodePoints(password);
+    if (codePoints < PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS) {
+        return { ok: false, reason: 'password_too_short' };
+    }
+    if (codePoints > PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS) {
+        return { ok: false, reason: 'password_too_long' };
+    }
+    return { ok: true, credentials: { identifier, password } };
+}
+export function assertPlatformAdminCredentials(input) {
+    const validation = validatePlatformAdminCredentials(input);
+    if (!validation.ok) {
+        throw new PlatformAdminCredentialError(validation.reason);
+    }
+    return validation.credentials;
+}
+export function describePlatformAdminCredentialRejection(reason) {
+    switch (reason) {
+        case 'identifier_required':
+            return 'Admin identifier is required.';
+        case 'password_required':
+            return 'Admin password is required.';
+        case 'password_too_short':
+            return `Admin password must contain at least ${PLATFORM_ADMIN_PASSWORD_MIN_CODE_POINTS} characters.`;
+        case 'password_too_long':
+            return `Admin password must contain at most ${PLATFORM_ADMIN_PASSWORD_MAX_CODE_POINTS} characters.`;
+    }
+}
+//# sourceMappingURL=adminCredentials.js.map

package/build/server/platform/auth/adminCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminCredentials.js","sourceRoot":"","sources":["../../../../src/platform/auth/adminCredentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,CAAC;AAiB3D,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAA8C;QACxE,KAAK,CAAC,wCAAwC,CAAC,MAAM,CAAC,CAAC,CAAC;QAD9B,WAAM,GAAN,MAAM,CAAwC;QAExE,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAGhD;IACC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,GAAG,uCAAuC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,UAAU,GAAG,uCAAuC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAG9C;IACC,MAAM,UAAU,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,UAAU,CAAC,WAAW,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,MAA8C;IAE9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,+BAA+B,CAAC;QACzC,KAAK,mBAAmB;YACtB,OAAO,6BAA6B,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,wCACL,uCACF,cAAc,CAAC;QACjB,KAAK,mBAAmB;YACtB,OAAO,uCACL,uCACF,cAAc,CAAC;IACnB,CAAC;AACH,CAAC"}

package/build/server/platform/auth/bootstrap.d.ts

@@ -1,5 +1,19 @@
 import { type BrowserSessionIssueResult } from './session.js';
 import type { PlatformAccountRecord, PlatformAuthState, PlatformIdentityRecord, PlatformMembershipRecord } from './types.js';
+/**
+ * Raised when first-admin creation loses the uniqueness recheck that runs
+ * inside the serialized auth-state mutation. Callers map this to a conflict
+ * response instead of creating a second Account.
+ */
+export declare class PlatformFirstAdminExistsError extends Error {
+    constructor();
+}
+/**
+ * SPEC-113 requirement 5: the "no Admin exists" check must run inside the same
+ * serialized mutation that persists the new records. A prior setup-status read
+ * is not concurrency control.
+ */
+export declare function hasExistingPlatformAdmin(state: PlatformAuthState): boolean;
 export interface CreateFirstAdminLocalInput {
     state: PlatformAuthState;
     displayName: string;

package/build/server/platform/auth/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA0DtC;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../../../src/platform/auth/bootstrap.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EACV,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAK1E;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,iBAAiB,CAAC;IACzB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,wBAAwB,CAAC;IACrC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CA8DtC;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMrE"}