@cogenta/cli 0.3.0 → 0.6.0

package/dist/commands/serve.d.ts

@@ -1,12 +1,20 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
-import { type AgentsRouter, type AssistantRouter, type AuditRouter, type AuthRouter, createContentGateway, type MediaImageProcessor, type MediaRouter, type NoticeRouter, type PermissionLayer, type RestRouter, type SearchRouter, type SitePlanRouter, type TaxonomyRouter, type UsersRouter } from '@cogenta/api';
+import { type AnalyticsStore } from '@cogenta/analytics';
+import { type AdminThemeRouter, type AgentSkillsRouter, type AgentsRouter, type AnalyticsRouter, type ApiKeysRouter, type AssistantRouter, type AuditRouter, type AuthRouter, createContentGateway, type FormsRouter, type HealthRouter, type ImportRouter, type MarketplaceRouter, type McpConnectionsRouter, type MediaImageProcessor, type MediaRouter, type MenuRouter, type NotFoundRouter, type NoticeChannelSettingsRouter, type NoticeRouter, type ObservabilityRouter, type OpsStatusRouter, type PatternRouter, type PermissionLayer, type PromptTemplatesRouter, type ProvidersRouter, type RedirectRouter, type RestRouter, type ReviewRouter, type RolePermissionRouter, type ScheduledTasksRouter, type SearchConsoleRouter, type SearchRouter, type SeoRouter, type ShellStatusRouter, type SitePlanRouter, type SiteSettingsRouter, type TaxonomyRouter, type ThemeRouter, type ToolsRouter, type UpdateRouter, type UsersRouter } from '@cogenta/api';
 import { type AuthStore } from '@cogenta/auth';
-import { type DatabaseHandle, type HealthReport, type Logger, type MediaStore, type StorageDriver } from '@cogenta/core';
-import { type CollectionDefinition, type RedirectStore, type SchemaDocument, type TaxonomyDefinition } from '@cogenta/schema';
+import { type CommentSettingsStore, type CommentStore, type CommentsRouter } from '@cogenta/comments';
+import { type CommerceAdminRouter } from '@cogenta/commerce';
+import { type DatabaseHandle, type ErrorLog, type HealthReport, type Logger, type MediaStore, type RateLimitDriver, type StorageDriver } from '@cogenta/core';
+import { type FormStore } from '@cogenta/forms';
+import { type CollectionDefinition, type MaintenanceStore, type NotFoundLogStore, type RedirectPatternStore, type RedirectStore, type RolePermissionStore, type SchemaDocument, type SiteSettingsStore, type TaxonomyDefinition } from '@cogenta/schema';
+import { type SitemapUrl } from '@cogenta/seo';
 import type { GraphQLSchema } from 'graphql';
 import type { Output, Writer } from '../output.js';
+import { type RunPackageInstall } from '../update/index.js';
 import { type SecurityConfig } from './http-security.js';
 import { type SecurityAlertWatch } from './security-alerts.js';
+import { type TermArchiveResolution } from './term-archive-page.js';
+import { type SiteIdentityMedia } from './theme-render.js';
 /**
  * Loads a project's content model.
  *
@@ -41,25 +49,203 @@ export declare function loadSchemaModule(projectRoot: string): Promise<LoadedSch
  * with orphan tables and no collections after the restart it was told to do.
  */
 export declare function findSchemaFile(projectRoot: string): Promise<string | undefined>;
+/**
+ * What one sweep of the trash auto-purge (fiche 07 task 5) found, one
+ * collection at a time. `purgeExpired()` skips a still-`restrict`ed row
+ * rather than throwing (see `@cogenta/schema`'s `store.ts`), so this is
+ * never partial in a way that needs reporting here — it is simply how many
+ * of each collection's expired rows were actually removed.
+ */
+interface TrashPurgeSummary {
+    readonly purged: number;
+    readonly perCollection: readonly {
+        readonly collection: string;
+        readonly purged: number;
+    }[];
+}
 interface Site {
     readonly db: DatabaseHandle;
     readonly auth: AuthStore;
+    /** `@cogenta/core`'s own package version (fiche 22 tâche 8, part 4) — the admin footer/topbar and, branding permitting, the public footer. */
+    readonly cogentaVersion: string;
     readonly restRouter: RestRouter;
     readonly authRouter: AuthRouter;
     readonly mediaRouter: MediaRouter;
     readonly auditRouter: AuditRouter;
     /** `GET /api/search` — the full-text index, reachable for the first time (L10 task 3). */
     readonly searchRouter: SearchRouter;
+    /** `GET /api/review` — the editorial workflow's review queue (`schema@2.1`, ADR-0027). */
+    readonly reviewRouter: ReviewRouter;
+    /**
+     * `/api/seo` — fiche 13: the admin's only door onto what `@cogenta/seo`
+     * actually computes. `POST .../preview` follows `update` on the named
+     * collection; `GET .../diagnostics` is admin-only, same as `redirectRouter`
+     * and `opsStatusRouter` above.
+     */
+    readonly seoRouter: SeoRouter;
+    /**
+     * `/api/seo/search-console` — fiche 70 task 4, ADR-0032: the optional,
+     * off-by-default Google Search Console connector. Admin-only except its
+     * own `callback` route, which Google's browser redirect reaches with no
+     * bearer token at all (see the router's own module comment for why that
+     * is still safe).
+     */
+    readonly searchConsoleRouter: SearchConsoleRouter;
+    /**
+     * Self-hosted, cookie-free page-view analytics (`@cogenta/analytics`).
+     *
+     * `analyticsStore` is the aggregate/write side used both by `analyticsRouter`
+     * (`/api/analytics/beacon` and `/api/analytics/summary`) and directly by the
+     * admin dashboard widget's server-rendered data. Always mounted — a site
+     * with nobody reading the dashboard still collects nothing more than it
+     * would with the feature switched off (R1/R2 spirit: purely additive).
+     */
+    readonly analyticsStore: AnalyticsStore;
+    readonly analyticsRouter: AnalyticsRouter;
+    /**
+     * Purges event rows (and their daily salts) past the site's configured
+     * retention (fiche 27 task 3) — same shape as `tickScheduledPublishing`,
+     * ticked by `runServe` on a `setInterval` rather than called ad hoc. Returns
+     * how many event rows were dropped, for a test to assert against without
+     * waiting for the real interval.
+     */
+    readonly tickAnalyticsPurge: () => Promise<number>;
     /** `/api/taxonomies/*` — terms, mounted apart from content because a taxonomy is not a collection (`schema@2.0`, ADR-0022). */
     readonly taxonomyRouter: TaxonomyRouter;
+    /** `/api/marketplace/*` — L17's local plugin/theme/skin catalog, reusing `@cogenta/plugins`' real Ed25519 verification unchanged. Always mounted; the catalog is empty until a site configures one. */
+    readonly marketplaceRouter: MarketplaceRouter;
+    /** `/api/menus/*` — navigation menus. Not schema-declared like a taxonomy: created and edited entirely at runtime, so this is always mounted, empty until the admin (or the API) creates the first one. */
+    readonly menuRouter: MenuRouter;
+    /**
+     * `/api/patterns/*` — the page builder's motif/model library (fiche 43
+     * sub-chantier A). Not schema-declared either: one fixed table, the same
+     * one-fixed-table treatment as `menuRouter` above, always mounted and
+     * empty until an editor saves the first selection as a pattern.
+     */
+    readonly patternRouter: PatternRouter;
+    /**
+     * `/api/commerce/*` — contract E's back office (ADR-0024), mounted for the
+     * first time. `@cogenta/commerce`'s tables are only created and this
+     * router is only present once a site actually reaches this point — a site
+     * that never sells anything never pays for it (mirrors the taxonomy story).
+     */
+    readonly commerceRouter: CommerceAdminRouter;
+    /**
+     * Contract F's own router (ADR-0025) — moderation queue AND the CMS's
+     * first public write route, `POST /api/comments`, both dispatched from
+     * one mount the way `commerceRouter` above already is.
+     */
+    readonly commentsRouter: CommentsRouter;
+    /** Exposed directly, the same way `siteSettingsStore` is, so `theme-render.ts` can read the public thread for a page without an in-process HTTP round trip. */
+    readonly commentsStore: CommentStore;
+    readonly commentsSettingsStore: CommentSettingsStore;
+    /** `/api/redirects` — admin-only management of the redirect table `cogenta serve` already applies to every public GET (audit follow-up to L10 task 2; extended by fiche 12 with editing, search, patterns and CSV import/export). */
+    readonly redirectRouter: RedirectRouter;
+    /**
+     * Prefix redirects (`/blog/*` to `/actualites/*`, fiche 12 task 4) — a
+     * second, deliberately simpler table beside `redirects`, checked only when
+     * the exact-match table finds nothing. Never a regular expression: see
+     * `@cogenta/schema`'s `redirect-patterns.ts` for why that is structural,
+     * not a convention someone could accidentally violate.
+     */
+    readonly redirectPatterns: RedirectPatternStore;
+    /**
+     * Fiche 63, ADR-0028 — the database-backed override layer of a role's
+     * permissions. Exposed so `cogenta roles export` and the admin route below
+     * share the exact same store a running `cogenta serve` reads, never a
+     * second connection to the same table.
+     */
+    readonly rolePermissionStore: RolePermissionStore;
+    /**
+     * `/api/role-permissions` — admin-only reads and writes of the override
+     * table above; a write calls the overlay's `refresh()` before answering,
+     * which is what makes the very next request already see it.
+     */
+    readonly rolePermissionRouter: RolePermissionRouter;
+    /**
+     * The log of public URLs that answered a 404 (fiche 12 task 1). Written on
+     * the public GET path in this file's own request handler, read and
+     * dismissed through `notFoundRouter` below.
+     */
+    readonly notFoundLog: NotFoundLogStore;
+    readonly notFoundLogEnabled: boolean;
+    /** `/api/not-found` — admin-only reads of `notFoundLog`. Never writes: the log fills itself. */
+    readonly notFoundRouter: NotFoundRouter;
+    /** Drains rows of `notFoundLog` older than its configured retention. Ticked by `runServe`, exposed so a test can call it directly instead of waiting a day. */
+    readonly tickNotFoundPurge: () => Promise<number>;
+    /** `GET /api/security-status` and `GET /api/webhooks-status` — read-only mirrors of the site's configuration file, admin-only (audit follow-up to L10 task 6 / L14 task 1). */
+    readonly opsStatusRouter: OpsStatusRouter;
+    /**
+     * `GET|PATCH /api/settings` — the editorial site settings a rédacteur can
+     * change without a terminal (fiche 23, ADR-0025's third category: not
+     * infrastructure like `opsStatusRouter` above, not a personal preference
+     * like the admin's interface language, but a site property stored in the
+     * database precisely so it can change without a redeploy).
+     */
+    readonly siteSettingsRouter: SiteSettingsRouter;
+    /**
+     * The same store `siteSettingsRouter` writes through, exposed directly so
+     * an internal caller — `theme-render.ts`'s `homePath` accessor — can read
+     * a live value without an in-process HTTP round trip to itself.
+     */
+    readonly siteSettingsStore: SiteSettingsStore;
+    /**
+     * `GET|PUT /api/admin-theme` — the admin's own runtime template +
+     * personalisation (L21 task 2), never the public site's (`themeRouter`,
+     * contract D — a distinct surface on purpose, see `admin-theme-router.ts`).
+     * Read is public (the login screen needs it before a session exists);
+     * write is `admin`-only, checked by the router itself.
+     */
+    readonly adminThemeRouter: AdminThemeRouter;
+    /**
+     * `GET /api/shell-status` — fiche 35 task 3: one aggregated read for
+     * every badge and feature flag the admin's chrome draws (trash count,
+     * pending orders, whether the shop has ever sold anything, marketplace
+     * updates), so a navigation never fires one request per badge.
+     */
+    readonly shellStatusRouter: ShellStatusRouter;
     /** ADR-0021's half that replaces the MFA sign-in gate: recommendations the admin shows, never a block. */
     readonly noticeRouter: NoticeRouter;
+    /** `/api/notices/channels/*` — fiche 38 tasks 3-4: linking a channel and its notification preferences. Always mounted; empty until an account links one. */
+    readonly noticeChannelSettingsRouter: NoticeChannelSettingsRouter;
     /** Refused sign-ins, watched for a run worth alerting on (L14 task 4). `null` when nothing is configured to receive one. */
     readonly securityAlerts: SecurityAlertWatch | null;
     /** Account management from the admin instead of `cogenta users create` on a terminal (L11 task 3). */
     readonly usersRouter: UsersRouter;
-    /** Only set when a caller passes `agents` into `assembleSite` — no site constructs one today (R2: agents are optional, not a hard dependency of the CMS). */
+    /** `/api/api-keys` — machine-to-machine bearer credentials, admin-only (L13 task 8). */
+    readonly apiKeysRouter: ApiKeysRouter;
+    /**
+     * Per-API-key request quota, checked once by `resolveActor` for every
+     * request (fiche 20 task 3, R1). `undefined` only in a test harness that
+     * builds a `Site` without going through `runServe` — every real server
+     * gets one, selected by `createRateLimitRegistry`, Redis when configured
+     * and available, an in-process counter otherwise.
+     */
+    readonly requestQuota?: RateLimitDriver;
+    /**
+     * `/api/agents` — L22 task 1: a real, persistent `AgentRegistry` this site
+     * actually runs (superagent + two example built-ins, seeded on first
+     * boot), not the pre-L22 read-only wrapper over a fixed declaration
+     * array. Set only when a caller passes `agentsRuntimeConfig` into
+     * `assembleSite` — a bare `Site` built by hand (tests included) goes on
+     * working unchanged with this omitted.
+     */
     readonly agentsRouter?: AgentsRouter;
+    /** `/api/providers` — L22 task 1bis: which LLM providers this site has enabled, with a masked key. Same optionality as `agentsRouter`, built alongside it from the same `agentsRuntimeConfig`. */
+    readonly providersRouter?: ProvidersRouter;
+    /** `/api/agent-skills` — L22 task 1bis: named instruction text an agent loads into its context. Same optionality as `agentsRouter`. */
+    readonly agentSkillsRouter?: AgentSkillsRouter;
+    /** `/api/prompt-templates` — fiche 45's shared prompt library. Same optionality as `agentsRouter`, built alongside it from the same `agentsRuntimeConfig`. */
+    readonly promptTemplatesRouter?: PromptTemplatesRouter;
+    /**
+     * `/api/mcp-connections` — fiche 58 tasks 2/3: external MCP servers this
+     * site's own agents may consume. Unlike `agentsRouter`/`providersRouter`/
+     * `agentSkillsRouter` above, this one is **not** gated on
+     * `agentsRuntimeConfig` — the registry (add/test/expose-tools) is useful
+     * on its own, and `assembleSite` always builds the underlying store (see
+     * `mcpConnections` near the top of this function).
+     */
+    readonly mcpConnectionsRouter?: McpConnectionsRouter;
     /**
      * `/api/site-plans` — L19 task 7's document-driven planning on a live site.
      *
@@ -68,12 +254,80 @@ interface Site {
      * `SITE_PLAN_NO_PROVIDER` for the routes that would need a model.
      */
     readonly sitePlanRouter?: SitePlanRouter;
+    /**
+     * `/api/updates` — L22 task 9: checking npm for a newer
+     * `@cogenta/core`/`@cogenta/cli`, applying one with a mandatory restore
+     * point first. Always mounted — checking and reviewing need no external
+     * provider, only outbound network access to registry.npmjs.org, which
+     * degrades to an honest per-package `checkError` rather than a broken
+     * screen when unavailable (same shape as `sitePlanRouter`'s `SITE_PLAN_NO_PROVIDER`).
+     */
+    readonly updatesRouter: UpdateRouter;
+    /**
+     * `/api/import` — the admin's counterpart to `cogenta import wordpress` on
+     * a terminal. Always mounted: unlike the site planner it needs no external
+     * provider, only this site's own database and storage, which `assembleSite`
+     * already has in scope.
+     */
+    readonly importRouter: ImportRouter;
     /**
      * `/api/assistant` — L18. Always mounted, even on a site with no AI provider:
      * it is the route that *answers* `{available: false}`, which is what lets the
      * admin panel disappear instead of erroring.
      */
     readonly assistantRouter: AssistantRouter;
+    /**
+     * Contract G (ADR-0026, fiche 16) — form definitions and submissions.
+     * Always mounted: a site that never builds a form still creates these
+     * tables (unlike commerce, which is opt-in), because the tables are
+     * cheap and the alternative — deciding at startup whether to mount a
+     * route — is the kind of conditional wiring this file already avoids
+     * everywhere else it can.
+     */
+    readonly formStore: FormStore;
+    /** `/api/forms/*` — admin CRUD on definitions/submissions, plus the public `POST .../submit`. */
+    readonly formsRouter: FormsRouter;
+    /** Purges submissions past each form's own `retainDays` (fiche 16 task 7's GDPR retention, ADR-0022's `purgeExpired` model). Ticked by `runServe` on a `setInterval`. */
+    readonly tickFormsPurge: () => Promise<number>;
+    /**
+     * Sends whatever queued order confirmation/shipment e-mail is due, retrying
+     * a transient failure on the next tick (fiche 52 task 2, "file avec
+     * reprise"). `null` on a site with no e-mail transport configured — ticked
+     * by `runServe` the same way `tickFormsPurge` is.
+     */
+    readonly tickCommerceEmails: (() => Promise<{
+        readonly sent: number;
+        readonly failed: number;
+    }>) | null;
+    /**
+     * Bills every subscription whose `nextBillingAt` has come due, retries
+     * whatever renewal payment is due for retry today, then sends any renewal
+     * notice that has fallen inside its warning window (fiche 53 tasks 3 and
+     * 5, audit T-COM-01: `runBilling`/`runDunning`/`sendRenewalNotices` had no
+     * caller anywhere in `cogenta serve`, so a subscription was never actually
+     * billed on a real site). Never `null`: unlike `tickCommerceEmails`, this
+     * needs no email transport — `sendRenewalNotices` is its own safe no-op
+     * (R2) when `commerceSubscriptions` has no `notifyRenewal` configured.
+     * Ticked by `runServe` the same way `tickFormsPurge` is.
+     */
+    readonly tickCommerceSubscriptions: () => Promise<{
+        readonly billed: number;
+        readonly dunningRetried: number;
+        readonly dunningSuspended: number;
+        readonly renewalNoticesSent: number;
+    }>;
+    /**
+     * Marks every open cart stale past its threshold as abandoned (audit
+     * A1-commerce P2: `CartStore.abandon()` existed since fiche 32 with no
+     * automatic caller). Never `null`: needs nothing but this site's own
+     * commerce tables, already created unconditionally. Ticked by `runServe`
+     * the same way `tickFormsPurge` is.
+     */
+    readonly tickCartAbandon: (options?: {
+        readonly olderThanMs?: number;
+    }) => Promise<{
+        readonly abandoned: number;
+    }>;
     /** Not routed through `mediaRouter`: serving a binary body is outside the JSON-only `RestResponse` shape, so the file route is handled directly (same treatment `/api/schema` already gets). */
     readonly mediaStore: MediaStore;
     readonly storage: StorageDriver;
@@ -107,8 +361,86 @@ interface Site {
         /** Which page answers an unmatched URL (L14 task 2). `/404` by default. */
         readonly notFoundPath: string;
     };
-    /** The skin's custom properties plus the theme's own stylesheet, minified into one. `null` when neither could be loaded — the theme-render fallback serves unstyled HTML rather than refusing. */
+    /** The skin's custom properties plus the theme's own stylesheet, minified into one, as computed once at startup. `null` when neither could be loaded — the theme-render fallback serves unstyled HTML rather than refusing. Kept for callers with no theme wiring; a live request should call `resolveStyles()` instead — see its own comment for why. */
     readonly styles: string | null;
+    /**
+     * The live stylesheet (fiche 14): `theme.tokens.json` overlaid with
+     * whatever an `admin` saved from the appearance screen, recomputed on
+     * every call rather than cached at startup — this is what makes a saved
+     * override show up on the very next page view without a restart. Falls
+     * back to the static `styles` above when this instance built no theme
+     * wiring (`options.theme` absent — only test harnesses that do not care
+     * about appearance omit it).
+     */
+    readonly resolveStyles: () => Promise<string | null>;
+    /**
+     * The appearance screen's live preview (fiche 14 task 2): renders the
+     * given token/CSS candidate without saving it. Absent under the same
+     * condition as `themeRouter`.
+     */
+    readonly previewStyles?: (candidate: {
+        readonly tokens?: Record<string, unknown>;
+        readonly additionalCss?: string;
+    }) => Promise<string | null>;
+    /** `/api/theme` (fiche 14). Absent only when this instance built no theme wiring — see `resolveStyles`. */
+    readonly themeRouter?: ThemeRouter;
+    /**
+     * The appearance screen's theme *gallery* preview (fiche L24 task 5): the
+     * combined skin + stylesheet for an arbitrary theme package **by name**,
+     * never just the currently active one — `resolveStyles`/`previewStyles`
+     * above both resolve against the active theme only, which is exactly the
+     * wrong resolution for "show me what theme X would look like without
+     * switching to it". Absent under the same condition every other theme
+     * field here is (`options.theme` absent — a test harness with no theme
+     * wiring).
+     *
+     * `tokens` (L26 task 5, the Theme Creator workshop) lets a caller preview
+     * an unsaved candidate skin against a theme *other than* the active one —
+     * exactly the combination `previewStyles`/`themeGalleryStyles` previously
+     * had no way to express together: the former knows tokens but not a
+     * foreign theme's CSS, the latter knows a foreign theme's CSS but only its
+     * own on-disk default tokens. Absent means the previous behaviour
+     * (`themeName`'s own default skin), unchanged.
+     */
+    readonly themeGalleryStyles?: (themeName: string, tokens?: Record<string, unknown>) => Promise<string | null>;
+    /**
+     * The active theme *package* name (fiche L23) — `null` for the built-in
+     * default. Read live off the same theme-overrides row `resolveStyles`
+     * already reads, so a switch made from the appearance screen renders on
+     * the very next page view, no restart. `undefined` (not a function at all)
+     * under the same condition `themeRouter` is absent — a test harness with
+     * no theme wiring renders with the default theme, exactly as before this
+     * field existed.
+     */
+    readonly activeTheme?: () => Promise<string | null>;
+    /**
+     * The site's own logo/dark logo/favicon/share image, read live off the
+     * same theme-overrides row `activeTheme` above already reads (audit
+     * 2026-09-01 §7 T01 — the four settings the appearance screen saved and
+     * nothing ever read). `undefined` under the same condition every other
+     * theme field here is, and `theme-render.ts` then renders exactly as it
+     * did before this existed.
+     */
+    readonly siteIdentity?: () => Promise<SiteIdentityMedia>;
+    /**
+     * `/{taxonomy}/{term-slug}` → the term, its lineage and everything
+     * published under it, or `null` when either half names nothing (audit
+     * 2026-09-01, 04-taxonomies-menus.md T01).
+     */
+    readonly resolveTermArchive: (taxonomyName: string, termSlug: string) => Promise<TermArchiveResolution | null>;
+    /** Every term archive URL worth listing in `/sitemap.xml` — terms with nothing published under them are left out. */
+    readonly termSitemapUrls: () => Promise<readonly SitemapUrl[]>;
+    /**
+     * One taxonomy term, resolved to a label and a route — the same lookup
+     * `resolveMenuTerm` already does for a menu item pointing at a term,
+     * exposed here so `theme-render.ts`'s `ThemeRenderOptions.resolveTerm`
+     * (contract D `theme@1.4`, an entry's classified terms) reuses it rather
+     * than a second lookup path.
+     */
+    readonly resolveTaxonomyTerm: (taxonomyName: string, termId: string) => Promise<{
+        readonly label: string;
+        readonly route: string | null;
+    } | null>;
     /** CORS, security headers and cache-control, applied to every response (L10 task 6). */
     readonly security: SecurityConfig;
     /** Live, not cached: a driver that just went down must show as down the next time this is called, not until the process restarts. */
@@ -116,8 +448,84 @@ interface Site {
         readonly database: HealthReport;
         readonly storage: HealthReport;
     }>;
+    /**
+     * Drains one batch of due scheduled-publication jobs. `runServe` calls this
+     * on a `setInterval` for as long as the process runs — see its comment for
+     * why a fixed period is the honest, R1-compliant substitute for a real
+     * worker. Exposed so a test can call it directly instead of waiting.
+     */
+    readonly tickScheduledPublishing: () => Promise<number>;
+    /**
+     * Runs one scheduled audit-integrity check (fiche 21 task 3) and sends the
+     * outbound alert when this run is what first finds the chain broken.
+     * `runServe` calls this on its own `setInterval`, daily by default; exposed
+     * so a test can call it directly instead of waiting a day.
+     */
+    readonly checkAuditIntegrity: () => Promise<void>;
+    /**
+     * Purges audit-log entries older than `security.audit.retainDays`
+     * (T09-01) — `AuditLog.prune()` has existed since fiche 21 task 5 with no
+     * caller anywhere in the codebase. A no-op returning `{ pruned: 0 }` when
+     * `retainDays` is absent or `0` (never configured, or explicitly "never
+     * purge") — the silent "grows without bound" default stays exactly that,
+     * silent, unless a site opts in. `runServe` calls this on its own
+     * `setInterval`, daily by default; exposed so a test can call it directly
+     * instead of waiting a day.
+     */
+    readonly tickAuditPrune: () => Promise<{
+        readonly pruned: number;
+    }>;
+    /**
+     * Sweeps every collection's trash past its `retainDays` (fiche 07 task 5).
+     * `purgeExpired()` has existed on every `ContentStore` since ADR-0022;
+     * nothing ever called it, so a site's trash grew forever despite the admin
+     * being about to say otherwise. `runServe` calls this on its own
+     * `setInterval`, the same shape as `tickScheduledPublishing`. Exposed so a
+     * test can call it directly instead of waiting a day.
+     */
+    readonly tickTrashPurge: () => Promise<TrashPurgeSummary>;
+    /**
+     * Flushes whatever channel notifications fiche 38's notice-to-channel
+     * bridge queued for grouping or quiet hours (`@cogenta/channels`'
+     * `NotificationDispatcher.flushDue`, unchanged since L6). `runServe` calls
+     * this on its own `setInterval`, same shape as `tickScheduledPublishing`.
+     */
+    readonly tickChannelNotifications: () => Promise<readonly string[]>;
     dispose(): Promise<void>;
 }
+/**
+ * Fiche 24's extra runtime state — health/tools/maintenance/error-log — kept
+ * separate from `Site` rather than folded into it: none of it is part of
+ * "what a site is" the way a `ContentStore` or a `MediaStore` is, and every
+ * caller that already constructs a bare `Site` by hand (tests included) goes
+ * on working unchanged with this omitted, in which case the routes it would
+ * serve simply do not exist.
+ */
+export interface RuntimeExtras {
+    readonly healthRouter: HealthRouter;
+    readonly toolsRouter: ToolsRouter;
+    /**
+     * The "Tâches planifiées" screen (fiche 28 task 2). Optional for the same
+     * pragmatic reason `Site.agentsRouter` is: a caller that builds a bare
+     * `Site` by hand (tests included) goes on working unchanged with this
+     * omitted — `GET /api/scheduled-tasks` then simply does not exist, rather
+     * than 500ing on a registry nobody constructed. `cogenta serve` always
+     * passes one (L20 audit §1 point 6: before this it never did, so the
+     * screen's own two requests 404'd against no route at all).
+     */
+    readonly scheduledTasksRouter?: ScheduledTasksRouter;
+    readonly maintenance: MaintenanceStore;
+    readonly errorLog: ErrorLog;
+    readonly siteName: string;
+    /**
+     * The "Exploitation" > Observability screen (fiche L22 task 5). Optional
+     * for the same pragmatic reason `scheduledTasksRouter` is — a caller that
+     * builds a bare `Site` by hand goes on working unchanged, and
+     * `GET /api/observability` simply does not exist rather than 500ing on a
+     * runtime nobody constructed. `cogenta serve` always passes one.
+     */
+    readonly observabilityRouter?: ObservabilityRouter;
+}
 /**
  * Builds the Node request handler from an already-assembled site.
  *
@@ -127,7 +535,7 @@ interface Site {
  * to that shape and back, so a serverless adapter later is the same kind of
  * thin layer rather than a second implementation of any of it.
  */
-export declare function createRequestListener(site: Site, logger: Logger): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function createRequestListener(site: Site, logger: Logger, extras?: RuntimeExtras): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
 export interface ServeOptions {
     readonly cwd?: string;
     readonly env?: Record<string, string | undefined>;
@@ -162,6 +570,81 @@ export interface ServeOptions {
      * only the write is held to the decision.
      */
     readonly development?: boolean;
+    /**
+     * Overrides `SCHEDULED_PUBLISH_TICK_MS`. Not a CLI flag — an operator has
+     * no reason to change a 60-second cadence, and this exists so a test can
+     * prove the interval really drains the queue without waiting a minute for
+     * it.
+     */
+    readonly scheduledPublishTickMs?: number;
+    /** Overrides `NOT_FOUND_PURGE_TICK_MS`, for the same reason `scheduledPublishTickMs` exists. */
+    readonly notFoundPurgeTickMs?: number;
+    /**
+     * Overrides `AUDIT_INTEGRITY_TICK_MS` (fiche 21 task 3). Not a CLI flag,
+     * same reason as `scheduledPublishTickMs` — exists so a test can prove the
+     * scheduled check really runs without waiting a day for it.
+     */
+    readonly auditIntegrityTickMs?: number;
+    /**
+     * Overrides `AUDIT_PRUNE_TICK_MS` (T09-01). Not a CLI flag, same reasoning
+     * as `auditIntegrityTickMs` — exists so a test can prove the sweep really
+     * runs without waiting a day for it.
+     */
+    readonly auditPruneTickMs?: number;
+    /**
+     * Overrides `TRASH_PURGE_TICK_MS`. Not a CLI flag, same reasoning as
+     * `scheduledPublishTickMs`: no operator has a reason to change a daily
+     * cadence, this exists so a test can prove the sweep really runs without
+     * waiting a day for it.
+     */
+    readonly trashPurgeTickMs?: number;
+    /** Test seam for the forms GDPR retention sweep (fiche 16 task 7) — production always uses `FORMS_PURGE_TICK_MS`. */
+    readonly formsPurgeTickMs?: number;
+    /** Overrides `CHANNEL_NOTIFICATION_TICK_MS`, for the same reason as `scheduledPublishTickMs`. */
+    readonly channelNotificationTickMs?: number;
+    /** Test seam for the commerce order-email retry queue (fiche 52 task 2) — production always uses `COMMERCE_EMAIL_TICK_MS`. */
+    readonly commerceEmailTickMs?: number;
+    /**
+     * Test seam for the subscription billing/dunning/renewal-notice sweep
+     * (fiche 53 tasks 3 and 5, audit T-COM-01) — production always uses
+     * `COMMERCE_BILLING_TICK_MS`.
+     */
+    readonly commerceBillingTickMs?: number;
+    /**
+     * Test seam for the abandoned-cart sweep (audit A1-commerce P2) —
+     * production always uses `CART_ABANDON_TICK_MS`.
+     */
+    readonly cartAbandonTickMs?: number;
+    /**
+     * How stale an open cart must be before the sweep marks it abandoned.
+     * Not a CLI flag: a shop that wants a different definition of "gave up"
+     * sets it in code, the same way every other tick override here is a test
+     * seam first — production always uses `CartStore`'s own
+     * `DEFAULT_CART_ABANDON_MS` (24h) unless this is set.
+     */
+    readonly cartAbandonAfterMs?: number;
+    /**
+     * Overrides `ANALYTICS_PURGE_TICK_MS`. Not a CLI flag, same reason as
+     * `scheduledPublishTickMs`: a test proves the retention sweep really runs
+     * without waiting a day for it.
+     */
+    readonly analyticsPurgeTickMs?: number;
+    /**
+     * Overrides `OBSERVABILITY_SETTINGS_TICK_MS` (fiche L22 task 5). Not a CLI
+     * flag, same reason as `scheduledPublishTickMs`: a test proves a settings
+     * change really takes effect without waiting out the real interval.
+     */
+    readonly observabilitySettingsTickMs?: number;
+    /**
+     * Overrides `UPDATES_AUTO_CHECK_TICK_MS` (L22 task 9). Not a CLI flag,
+     * same reasoning as `scheduledPublishTickMs`: a test proves the
+     * auto-update policy is really honoured without waiting a day for it.
+     */
+    readonly updatesAutoCheckTickMs?: number;
+    /** Test seam: replaces the real `fetch` to registry.npmjs.org with a scripted one — every update test in `packages/cli/test/` uses this rather than hitting the real network. */
+    readonly updatesFetchImpl?: typeof fetch;
+    /** Test seam: replaces the real `npm install` child process — no test in this repository actually installs an npm package. */
+    readonly updatesRunInstall?: RunPackageInstall;
 }
 /**
  * Runs until `options.signal` aborts. Returns 0 on a clean shutdown, 1 if

package/dist/commands/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAInF,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,eAAe,EAEpB,KAAK,WAAW,EAChB,KAAK,UAAU,EAMf,oBAAoB,EAepB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EAGpB,KAAK,UAAU,EAEf,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,eAAe,CAAA;AAC/D,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,YAAY,EAEjB,KAAK,MAAM,EAEX,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAGL,KAAK,oBAAoB,EAQzB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,KAAK,kBAAkB,EAKxB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAIlD,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAGvE,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AA+BxF;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAE1C;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACnD;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWrF;AAuCD,UAAU,IAAI;IACZ,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,+HAA+H;IAC/H,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,4HAA4H;IAC5H,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAClD,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,6JAA6J;IAC7J,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC,gMAAgM;IAChM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,qJAAqJ;IACrJ,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,kMAAkM;IAClM,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,qIAAqI;IACrI,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;QAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;KAC/B,CAAC,CAAA;IACF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AA+rBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,GACb,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA2e9D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IAC/D,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AAQD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAgJrE"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/commands/serve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAanF,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EAEpB,KAAK,WAAW,EAChB,KAAK,UAAU,EAaf,oBAAoB,EAiDpB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EAGjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAEhB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,2BAA2B,EAChC,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EAEpB,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAGzB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEnB,KAAK,kBAAkB,EAEvB,KAAK,cAAc,EACnB,KAAK,WAAW,EAEhB,KAAK,WAAW,EAEhB,KAAK,YAAY,EACjB,KAAK,WAAW,EAEjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAiB,KAAK,SAAS,EAAmC,MAAM,eAAe,CAAA;AAY9F,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,YAAY,EAEjB,KAAK,cAAc,EAQpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,KAAK,mBAAmB,EAqBzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAcL,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,KAAK,YAAY,EAGjB,KAAK,MAAM,EAIX,KAAK,UAAU,EAEf,KAAK,eAAe,EAEpB,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAkCnF,OAAO,EAKL,KAAK,oBAAoB,EA6BzB,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAKxB,KAAK,cAAc,EAInB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EAOxB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EASL,KAAK,UAAU,EAChB,MAAM,cAAc,CAAA;AAGrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EASL,KAAK,iBAAiB,EAIvB,MAAM,oBAAoB,CAAA;AAe3B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAIvE,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAUxF,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAG1F,OAAO,EAaL,KAAK,iBAAiB,EAEvB,MAAM,mBAAmB,CAAA;AA+B1B;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAE1C;AAED,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACnD;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDjF;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAWrF;AAuCD;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC5F;AAED,UAAU,IAAI;IACZ,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,8IAA8I;IAC9I,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAA;IACjD;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAClD,+HAA+H;IAC/H,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,uMAAuM;IACvM,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,2MAA2M;IAC3M,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,+JAA+J;IAC/J,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAA;IACpC,QAAQ,CAAC,qBAAqB,EAAE,oBAAoB,CAAA;IACpD,qOAAqO;IACrO,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAA;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAA;IACjD;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;IACnD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,+JAA+J;IAC/J,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACjD,+KAA+K;IAC/K,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,4JAA4J;IAC5J,QAAQ,CAAC,2BAA2B,EAAE,2BAA2B,CAAA;IACjE,4HAA4H;IAC5H,QAAQ,CAAC,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAClD,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAA;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC,kMAAkM;IAClM,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C,uIAAuI;IACvI,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IAC9C,8JAA8J;IAC9J,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAA;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,iGAAiG;IACjG,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,yKAAyK;IACzK,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EACvB,CAAC,MAAM,OAAO,CAAC;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAC,CAAC,GACH,IAAI,CAAA;IACR;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,yBAAyB,EAAE,MAAM,OAAO,CAAC;QAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;KACpC,CAAC,CAAA;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAC9B,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7C,gMAAgM;IAChM,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;IACzD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,qJAAqJ;IACrJ,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,2EAA2E;QAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAC9B,CAAA;IACD,0VAA0V;IAC1V,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpD;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE;QACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAChC,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5B,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAC5B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACnD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxD;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAC3B,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAA;IAC1C,qHAAqH;IACrH,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAC9D;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAC9E,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,qIAAqI;IACrI,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;QAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;KAC/B,CAAC,CAAA;IACF;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;;;;;;;;;OASG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,wBAAwB,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACnE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAy8FD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CACnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,aAAa,GACrB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CA8mD9D;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IAC/D,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IACxC,gGAAgG;IAChG,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,qHAAqH;IACrH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,iGAAiG;IACjG,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAC3C,8HAA8H;IAC9H,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAA;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAA;IACxC,iLAAiL;IACjL,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,KAAK,CAAA;IACxC,8HAA8H;IAC9H,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CAC/C;AAwJD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAm2BrE"}