@de-otio/trellis 0.4.0

package/dist/lib/context-aware-data-access.js

@@ -0,0 +1,97 @@
+"use strict";
+/**
+ * Context-Aware Data Access
+ *
+ * PREPARATORY: Border Safety Mode - Context-aware query filters
+ *
+ * Manages data access filters based on user's profile context (primary vs decoy).
+ * Currently dormant - always returns full access filters. This abstraction layer
+ * prepares for future implementation where different contexts have different data visibility.
+ *
+ * FUTURE USE: When Border Safety Mode is implemented, this class will:
+ * - Filter data based on profile context (primary vs decoy)
+ * - Exclude sensitive data when in decoy context
+ * - Apply context-specific visibility rules
+ * - Support selective data wiping based on context
+ *
+ * @see doc/01-business/features/b2c-features/border-safety-mode/preparatory-design-changes/03-api-design.md
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextAwareDataAccess = void 0;
+/**
+ * Context-Aware Data Access Manager
+ *
+ * Provides data access filters based on user's session context.
+ * Currently returns full access filters for all users (dormant).
+ */
+class ContextAwareDataAccess {
+    /**
+     * Get data access filter for current session context
+     *
+     * PREPARATORY: Currently always returns full access (backward compatible).
+     * This method prepares for future implementation where different contexts
+     * have different data visibility rules.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Check session.profileContext
+     * - Return filtered access for decoy contexts (exclude sensitive data)
+     * - Return full access for primary contexts
+     * - Respect user's travel mode settings
+     *
+     * @param session - User session with profileContext field
+     * @returns Data access context with filtering rules
+     * @throws Error if session is invalid or missing required fields
+     */
+    getAccessFilter(session) {
+        if (!session || !session.userId) {
+            throw new Error("Invalid session: userId is required");
+        }
+        // PREPARATORY: Always return full access for now
+        // FUTURE: Filter based on session.profileContext when Border Safety Mode is implemented
+        const profileContext = session.profileContext || "primary";
+        return {
+            userId: session.userId,
+            profileContext: profileContext,
+            includeDecoy: true, // Always true until feature is enabled
+            includeSensitive: true, // Always true until feature is enabled
+        };
+    }
+    /**
+     * Apply data access filter to a Prisma query
+     *
+     * PREPARATORY: Currently a no-op (returns query unchanged).
+     * This method prepares for future implementation where queries are filtered
+     * based on context and sensitivity level.
+     *
+     * FUTURE USE: When Border Safety Mode is implemented, this will:
+     * - Add WHERE clauses to filter by sensitivityLevel
+     * - Filter by ownerContext based on profileContext
+     * - Exclude decoy data when includeDecoy is false
+     * - Exclude sensitive data when includeSensitive is false
+     *
+     * Example future implementation:
+     * ```typescript
+     * if (!filter.includeSensitive) {
+     *   query.where.sensitivityLevel = { not: 'sensitive' };
+     * }
+     * if (!filter.includeDecoy) {
+     *   query.where.ownerContext = filter.profileContext;
+     * }
+     * ```
+     *
+     * @param query - Prisma query object (any type for flexibility)
+     * @param filter - Data access context filter
+     * @returns Query with filters applied (currently unchanged)
+     */
+    applyFilter(query, filter) {
+        // PREPARATORY: No-op for now - returns query unchanged
+        // TODO: Add filtering logic when Border Safety Mode is implemented (Phase 3)
+        // This will add WHERE clauses based on:
+        // - filter.includeSensitive (exclude sensitive data if false)
+        // - filter.includeDecoy (exclude decoy data if false)
+        // - filter.profileContext (filter by ownerContext)
+        return query;
+    }
+}
+exports.ContextAwareDataAccess = ContextAwareDataAccess;
+//# sourceMappingURL=context-aware-data-access.js.map

package/dist/lib/context-aware-data-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-aware-data-access.js","sourceRoot":"","sources":["../../src/lib/context-aware-data-access.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAwBH;;;;;GAKG;AACH,MAAa,sBAAsB;IACjC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CAAC,OAAgB;QAC9B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,iDAAiD;QACjD,wFAAwF;QACxF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC;QAE3D,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,cAAc;YAC9B,YAAY,EAAE,IAAI,EAAE,uCAAuC;YAC3D,gBAAgB,EAAE,IAAI,EAAE,uCAAuC;SAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,WAAW,CAAI,KAAQ,EAAE,MAAyB;QAChD,uDAAuD;QACvD,6EAA6E;QAC7E,wCAAwC;QACxC,8DAA8D;QAC9D,sDAAsD;QACtD,mDAAmD;QAEnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAxED,wDAwEC"}

package/dist/lib/cors-handler.d.ts

@@ -0,0 +1,29 @@
+/**
+ * CORS Handler
+ *
+ * Handles CORS-related functionality including origin validation
+ * and header management.
+ */
+import type { Env } from "../env";
+export declare class CorsHandler {
+    /**
+     * Get allowed CORS origin based on request origin and configured allowed origins
+     * When credentials are involved, we must return the exact origin (not '*')
+     */
+    static getAllowedOrigin(request: Request, env: Env): string | null;
+    /**
+     * Add CORS headers to a response
+     * Creates a new response with CORS headers added
+     * Note: Response bodies can only be read once, so we need to clone first
+     *
+     * PREPARATORY: Also adds region headers for debugging
+     */
+    static addCorsHeaders(response: Response, request: Request, env: Env, requestContext?: {
+        region: string;
+    }): Promise<Response>;
+    /**
+     * Get CORS headers object
+     */
+    static getCorsHeaders(request: Request, env: Env): Record<string, string>;
+}
+//# sourceMappingURL=cors-handler.d.ts.map

package/dist/lib/cors-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-handler.d.ts","sourceRoot":"","sources":["../../src/lib/cors-handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAGlC,qBAAa,WAAW;IACtB;;;OAGG;IACH,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI;IAsGlE;;;;;;OAMG;WACU,cAAc,CACzB,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,cAAc,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC,QAAQ,CAAC;IAyIpB;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAa1E"}

package/dist/lib/cors-handler.js

@@ -0,0 +1,225 @@
+"use strict";
+/**
+ * CORS Handler
+ *
+ * Handles CORS-related functionality including origin validation
+ * and header management.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CorsHandler = void 0;
+const logger_1 = require("./logger");
+class CorsHandler {
+    /**
+     * Get allowed CORS origin based on request origin and configured allowed origins
+     * When credentials are involved, we must return the exact origin (not '*')
+     */
+    static getAllowedOrigin(request, env) {
+        const requestOrigin = request.headers.get("Origin");
+        if (!requestOrigin) {
+            // No origin header (e.g., same-origin request or non-browser client)
+            // CORS doesn't apply to same-origin requests, but we return APP_DOMAIN for safety
+            return env.APP_DOMAIN?.replace(/\/$/, "") || null;
+        }
+        // Build list of allowed origins
+        const allowedOrigins = [];
+        // Add origins from ALLOWED_ORIGINS env var (comma-separated)
+        if (env.ALLOWED_ORIGINS) {
+            const origins = env.ALLOWED_ORIGINS.split(",").map((o) => o.trim().replace(/\/$/, ""));
+            allowedOrigins.push(...origins);
+        }
+        // Add APP_DOMAIN and its www/non-www variations
+        if (env.APP_DOMAIN) {
+            const appDomain = env.APP_DOMAIN.replace(/\/$/, "");
+            allowedOrigins.push(appDomain);
+            // Also allow www and non-www variations
+            const domainWithoutProtocol = appDomain.replace(/^https?:\/\//, "");
+            if (domainWithoutProtocol.startsWith("www.")) {
+                allowedOrigins.push(`https://${domainWithoutProtocol.replace(/^www\./, "")}`);
+            }
+            else {
+                allowedOrigins.push(`https://www.${domainWithoutProtocol}`);
+            }
+        }
+        // Normalize request origin (remove trailing slash)
+        const normalizedRequestOrigin = requestOrigin.replace(/\/$/, "");
+        // Check if request origin is in allowed list
+        if (allowedOrigins.includes(normalizedRequestOrigin)) {
+            return normalizedRequestOrigin;
+        }
+        // If no APP_DOMAIN or ALLOWED_ORIGINS is configured (local dev), allow the request origin
+        // This is a safety fallback for local development
+        if (!env.APP_DOMAIN && !env.ALLOWED_ORIGINS) {
+            logger_1.Logger.getInstance(env).info(`[CORS] No APP_DOMAIN or ALLOWED_ORIGINS configured, allowing origin: ${normalizedRequestOrigin}`);
+            return normalizedRequestOrigin;
+        }
+        // Allow Cloudflare Pages domains (only specific known projects)
+        if (normalizedRequestOrigin.includes(".pages.dev")) {
+            const allowedPagesProjects = [
+                "trellis-web",
+                "trellis-preview",
+                "trellis-at",
+            ];
+            const pagesDomainMatch = normalizedRequestOrigin.match(/^https:\/\/([^.]+)\.pages\.dev$/);
+            if (pagesDomainMatch &&
+                allowedPagesProjects.includes(pagesDomainMatch[1])) {
+                logger_1.Logger.getInstance(env).info(`[CORS] Allowing Cloudflare Pages project: ${pagesDomainMatch[1]}`);
+                return normalizedRequestOrigin;
+            }
+            logger_1.Logger.getInstance(env).info(`[CORS] Cloudflare Pages project not in whitelist: ${normalizedRequestOrigin}`);
+            return null;
+        }
+        // S1.6 — Allow known production domains with strict suffix matching
+        try {
+            const originUrl = new URL(normalizedRequestOrigin);
+            const host = originUrl.hostname;
+            const knownDomains = ["rkm1.de", "example.com"];
+            const isKnownDomain = knownDomains.some((domain) => host === domain || host.endsWith(`.${domain}`));
+            if (isKnownDomain) {
+                logger_1.Logger.getInstance(env).info(`[CORS] Allowing known domain origin: ${normalizedRequestOrigin}`);
+                return normalizedRequestOrigin;
+            }
+        }
+        catch {
+            // Invalid URL, fall through to rejection
+        }
+        // Origin not allowed
+        logger_1.Logger.getInstance(env).info(`[CORS] Origin not allowed: ${normalizedRequestOrigin}. Allowed origins: ${allowedOrigins.join(", ")}`);
+        return null;
+    }
+    /**
+     * Add CORS headers to a response
+     * Creates a new response with CORS headers added
+     * Note: Response bodies can only be read once, so we need to clone first
+     *
+     * PREPARATORY: Also adds region headers for debugging
+     */
+    static async addCorsHeaders(response, request, env, requestContext) {
+        try {
+            const allowedOrigin = CorsHandler.getAllowedOrigin(request, env);
+            const corsHeaders = {
+                "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-CSRF-Token, X-Retry-Count",
+                "Access-Control-Allow-Credentials": "true",
+            };
+            if (allowedOrigin) {
+                corsHeaders["Access-Control-Allow-Origin"] = allowedOrigin;
+            }
+            else {
+                // Log when origin is not allowed for debugging
+                const requestOrigin = request.headers.get("Origin");
+                logger_1.Logger.getInstance(env).info(`[CORS] No allowed origin found. Request origin: ${requestOrigin}, APP_DOMAIN: ${env.APP_DOMAIN}, ALLOWED_ORIGINS: ${env.ALLOWED_ORIGINS}`);
+                // Still add other CORS headers even if origin is not allowed
+                // The browser will reject it, but at least we tried
+            }
+            // CRITICAL: For binary responses (images, files), we must NOT read as text
+            // Reading binary data as text corrupts it (UTF-8 decoding)
+            // Check Content-Type to determine if this is binary data
+            const contentType = response.headers.get("Content-Type") || "";
+            const isBinaryResponse = contentType.startsWith("image/") ||
+                contentType.startsWith("video/") ||
+                contentType.startsWith("audio/") ||
+                contentType.startsWith("application/octet-stream") ||
+                contentType.startsWith("application/pdf");
+            let responseBody;
+            let allHeaders;
+            if (isBinaryResponse) {
+                // For binary responses, read as ArrayBuffer to preserve binary data
+                try {
+                    const clonedResponse = response.clone();
+                    responseBody = await clonedResponse.arrayBuffer();
+                }
+                catch (cloneError) {
+                    // If cloning fails, try to read the original response body
+                    logger_1.Logger.getInstance(env).error("[CORS] Error cloning binary response, trying direct read:", cloneError);
+                    responseBody = await response.arrayBuffer();
+                }
+                // Copy existing headers (this preserves Set-Cookie headers)
+                allHeaders = new Headers(response.headers);
+            }
+            else {
+                // For text responses (JSON, HTML, etc.), read as text
+                let bodyText;
+                try {
+                    const clonedResponse = response.clone();
+                    bodyText = await clonedResponse.text();
+                }
+                catch (cloneError) {
+                    // If cloning fails, try to read the original response body
+                    logger_1.Logger.getInstance(env).error("[CORS] Error cloning response, trying direct read:", cloneError);
+                    bodyText = await response.text();
+                }
+                responseBody = bodyText;
+                // Copy existing headers (this preserves Set-Cookie headers)
+                allHeaders = new Headers(response.headers);
+            }
+            // Log Set-Cookie header before adding CORS headers
+            const setCookieBefore = allHeaders.get("Set-Cookie");
+            if (setCookieBefore) {
+                logger_1.Logger.getInstance(env).info("[CORS] Preserving Set-Cookie header (first 100 chars):", setCookieBefore.substring(0, 100));
+            }
+            // Add CORS headers
+            Object.entries(corsHeaders).forEach(([key, value]) => {
+                allHeaders.set(key, value);
+            });
+            // PREPARATORY: Add region headers for debugging (if requestContext provided)
+            if (requestContext) {
+                allHeaders.set("X-Region", requestContext.region);
+                allHeaders.set("X-Region-Detected", requestContext.region);
+            }
+            // Verify Set-Cookie is still present after adding CORS headers
+            const setCookieAfter = allHeaders.get("Set-Cookie");
+            if (setCookieBefore && !setCookieAfter) {
+                logger_1.Logger.getInstance(env).error("[CORS] WARNING: Set-Cookie header was lost!");
+            }
+            // Create new response with all headers and body
+            // Use the appropriate body type (ArrayBuffer for binary, string for text)
+            return new Response(responseBody, {
+                status: response.status,
+                statusText: response.statusText,
+                headers: allHeaders,
+            });
+        }
+        catch (error) {
+            // If adding CORS headers fails, at least return a response with CORS headers
+            logger_1.Logger.getInstance(env).error("[CORS] Error adding CORS headers:", error);
+            const allowedOrigin = CorsHandler.getAllowedOrigin(request, env);
+            const corsHeaders = {
+                "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+                "Access-Control-Allow-Headers": "Content-Type, Authorization, X-CSRF-Token",
+                "Access-Control-Allow-Credentials": "true",
+            };
+            if (allowedOrigin) {
+                corsHeaders["Access-Control-Allow-Origin"] = allowedOrigin;
+            }
+            // Return error response with CORS headers
+            // Note: requestContext not available in error handler, so region headers won't be added
+            return new Response(JSON.stringify({
+                error: "Failed to process response",
+                message: error.message,
+            }), {
+                status: 500,
+                headers: {
+                    "content-type": "application/json",
+                    ...corsHeaders,
+                },
+            });
+        }
+    }
+    /**
+     * Get CORS headers object
+     */
+    static getCorsHeaders(request, env) {
+        const allowedOrigin = CorsHandler.getAllowedOrigin(request, env);
+        const corsHeaders = {
+            "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, Authorization, X-CSRF-Token",
+            "Access-Control-Allow-Credentials": "true",
+        };
+        if (allowedOrigin) {
+            corsHeaders["Access-Control-Allow-Origin"] = allowedOrigin;
+        }
+        return corsHeaders;
+    }
+}
+exports.CorsHandler = CorsHandler;
+//# sourceMappingURL=cors-handler.js.map

package/dist/lib/cors-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-handler.js","sourceRoot":"","sources":["../../src/lib/cors-handler.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAGH,qCAAkC;AAElC,MAAa,WAAW;IACtB;;;OAGG;IACH,MAAM,CAAC,gBAAgB,CAAC,OAAgB,EAAE,GAAQ;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,qEAAqE;YACrE,kFAAkF;YAClF,OAAO,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QACpD,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,6DAA6D;QAC7D,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC5B,CAAC;YACF,cAAc,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,gDAAgD;QAChD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpD,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE/B,wCAAwC;YACxC,MAAM,qBAAqB,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACpE,IAAI,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,cAAc,CAAC,IAAI,CACjB,WAAW,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CACzD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,eAAe,qBAAqB,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,MAAM,uBAAuB,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjE,6CAA6C;QAC7C,IAAI,cAAc,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACrD,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,0FAA0F;QAC1F,kDAAkD;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;YAC5C,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,wEAAwE,uBAAuB,EAAE,CAClG,CAAC;YACF,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,gEAAgE;QAChE,IAAI,uBAAuB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,MAAM,oBAAoB,GAAG;gBAC3B,aAAa;gBACb,iBAAiB;gBACjB,YAAY;aACb,CAAC;YACF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,KAAK,CACpD,iCAAiC,CAClC,CAAC;YACF,IACE,gBAAgB;gBAChB,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAClD,CAAC;gBACD,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,6CAA6C,gBAAgB,CAAC,CAAC,CAAC,EAAE,CACnE,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC;YACD,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,qDAAqD,uBAAuB,EAAE,CAC/E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC;YAChC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAC3D,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,wCAAwC,uBAAuB,EAAE,CAClE,CAAC;gBACF,OAAO,uBAAuB,CAAC;YACjC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,qBAAqB;QACrB,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,8BAA8B,uBAAuB,sBAAsB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,QAAkB,EAClB,OAAgB,EAChB,GAAQ,EACR,cAAmC;QAEnC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,WAAW,GAA2B;gBAC1C,8BAA8B,EAC5B,wCAAwC;gBAC1C,8BAA8B,EAC5B,0DAA0D;gBAC5D,kCAAkC,EAAE,MAAM;aAC3C,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,WAAW,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpD,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,mDAAmD,aAAa,iBAAiB,GAAG,CAAC,UAAU,sBAAsB,GAAG,CAAC,eAAe,EAAE,CAC3I,CAAC;gBACF,6DAA6D;gBAC7D,oDAAoD;YACtD,CAAC;YAED,2EAA2E;YAC3E,2DAA2D;YAC3D,yDAAyD;YACzD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,gBAAgB,GACpB,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAChC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAChC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAChC,WAAW,CAAC,UAAU,CAAC,0BAA0B,CAAC;gBAClD,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;YAE5C,IAAI,YAAkC,CAAC;YACvC,IAAI,UAAmB,CAAC;YAExB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,oEAAoE;gBACpE,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACxC,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;gBACpD,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,2DAA2D;oBAC3D,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,2DAA2D,EAC3D,UAAU,CACX,CAAC;oBACF,YAAY,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,CAAC;gBACD,4DAA4D;gBAC5D,UAAU,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,sDAAsD;gBACtD,IAAI,QAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;oBACxC,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;gBACzC,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,2DAA2D;oBAC3D,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,oDAAoD,EACpD,UAAU,CACX,CAAC;oBACF,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;gBACxB,4DAA4D;gBAC5D,UAAU,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAED,mDAAmD;YACnD,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,eAAe,EAAE,CAAC;gBACpB,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAC1B,wDAAwD,EACxD,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAClC,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACnD,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,IAAI,cAAc,EAAE,CAAC;gBACnB,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;gBAClD,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC;YAED,+DAA+D;YAC/D,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvC,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAC3B,6CAA6C,CAC9C,CAAC;YACJ,CAAC;YAED,gDAAgD;YAChD,0EAA0E;YAC1E,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE;gBAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,UAAU;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,6EAA6E;YAC7E,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YAC1E,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,WAAW,GAA2B;gBAC1C,8BAA8B,EAC5B,wCAAwC;gBAC1C,8BAA8B,EAC5B,2CAA2C;gBAC7C,kCAAkC,EAAE,MAAM;aAC3C,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBAClB,WAAW,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;YAC7D,CAAC;YACD,0CAA0C;YAC1C,wFAAwF;YACxF,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;gBACb,KAAK,EAAE,4BAA4B;gBACnC,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,EACF;gBACE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,WAAW;iBACf;aACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,OAAgB,EAAE,GAAQ;QAC9C,MAAM,aAAa,GAAG,WAAW,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,WAAW,GAA2B;YAC1C,8BAA8B,EAAE,wCAAwC;YACxE,8BAA8B,EAC5B,2CAA2C;YAC7C,kCAAkC,EAAE,MAAM;SAC3C,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAClB,WAAW,CAAC,6BAA6B,CAAC,GAAG,aAAa,CAAC;QAC7D,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AAhRD,kCAgRC"}

package/dist/lib/cost-accumulator.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Cost Accumulator
+ *
+ * Tracks counts of expensive operations in-memory, flushes to DynamoDB
+ * periodically. Provides estimated daily spend by service.
+ *
+ * record() is synchronous and never throws — safe to call on every operation.
+ * Flush happens every 10 seconds via setTimeout.
+ */
+export interface CostEvent {
+    service: "openai" | "sqs" | "dynamodb" | "s3" | "ses";
+    operation: string;
+    units: number;
+}
+export interface DailyCostSummary {
+    date: string;
+    estimatedTotal: number;
+    limit: number;
+    services: Record<string, number>;
+}
+export interface CostLimitsConfig {
+    dailyTotal: number;
+    dailyPerService: Record<string, number>;
+}
+export declare class CostAccumulator {
+    private buffer;
+    private flushTimer;
+    private readonly flushIntervalMs;
+    private readonly logger;
+    private costLimits;
+    constructor(costLimits: CostLimitsConfig);
+    /** Get or create the singleton instance. */
+    static getInstance(costLimits?: CostLimitsConfig): CostAccumulator;
+    /** Reset singleton (for testing). */
+    static resetInstance(): void;
+    /**
+     * Record a cost event. Synchronous, never throws, zero I/O.
+     */
+    record(event: CostEvent): void;
+    /**
+     * Get estimated daily spend by service from DynamoDB.
+     */
+    getDailySummary(): Promise<DailyCostSummary>;
+    /**
+     * Check if any service exceeds its daily budget.
+     */
+    isOverBudget(): Promise<{
+        exceeded: boolean;
+        services: string[];
+    }>;
+    /** Force an immediate flush (for graceful shutdown or testing). */
+    forceFlush(): Promise<void>;
+    private ensureFlushScheduled;
+    private flush;
+    private atomicAdd;
+    private readServiceCount;
+}
+//# sourceMappingURL=cost-accumulator.d.ts.map

package/dist/lib/cost-accumulator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-accumulator.d.ts","sourceRoot":"","sources":["../../src/lib/cost-accumulator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,QAAQ,GAAG,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAoBD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,UAAU,CAA8C;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,UAAU,CAAmB;gBAEzB,UAAU,EAAE,gBAAgB;IAIxC,4CAA4C;IAC5C,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,eAAe;IAOlE,qCAAqC;IACrC,MAAM,CAAC,aAAa,IAAI,IAAI;IAO5B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAM9B;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,gBAAgB,CAAC;IA8BlD;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAkBxE,mEAAmE;IAC7D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAQjC,OAAO,CAAC,oBAAoB;YAUd,KAAK;YAoBL,SAAS;YAkBT,gBAAgB;CAc/B"}

package/dist/lib/cost-accumulator.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Cost Accumulator
+ *
+ * Tracks counts of expensive operations in-memory, flushes to DynamoDB
+ * periodically. Provides estimated daily spend by service.
+ *
+ * record() is synchronous and never throws — safe to call on every operation.
+ * Flush happens every 10 seconds via setTimeout.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CostAccumulator = void 0;
+const client_dynamodb_1 = require("@aws-sdk/client-dynamodb");
+const logger_1 = require("./logger");
+/** Approximate unit costs in USD. Within 2x of real pricing is fine. */
+const UNIT_COSTS = {
+    openai: { moderation: 0.001 },
+    ses: { "send-email": 0.0001 },
+    sqs: { "send-message": 0.0000004 },
+    s3: { "put-object": 0.000005, "get-object": 0.0000004 },
+    dynamodb: { write: 0.00000125, read: 0.00000025 },
+};
+const dynamoClient = new client_dynamodb_1.DynamoDBClient({
+    region: process.env.AWS_REGION || "us-east-1",
+    ...(process.env.DYNAMODB_ENDPOINT ? { endpoint: process.env.DYNAMODB_ENDPOINT } : {}),
+});
+const TABLE_NAME = process.env.DYNAMODB_TABLE || `${process.env.STAGE || "dev"}-trellis`;
+let _instance = null;
+class CostAccumulator {
+    buffer = new Map();
+    flushTimer = null;
+    flushIntervalMs = 10_000;
+    logger = logger_1.Logger.getInstance();
+    costLimits;
+    constructor(costLimits) {
+        this.costLimits = costLimits;
+    }
+    /** Get or create the singleton instance. */
+    static getInstance(costLimits) {
+        if (!_instance) {
+            _instance = new CostAccumulator(costLimits || { dailyTotal: 10, dailyPerService: {} });
+        }
+        return _instance;
+    }
+    /** Reset singleton (for testing). */
+    static resetInstance() {
+        if (_instance?.flushTimer) {
+            clearTimeout(_instance.flushTimer);
+        }
+        _instance = null;
+    }
+    /**
+     * Record a cost event. Synchronous, never throws, zero I/O.
+     */
+    record(event) {
+        const key = `${event.service}:${event.operation}`;
+        this.buffer.set(key, (this.buffer.get(key) || 0) + event.units);
+        this.ensureFlushScheduled();
+    }
+    /**
+     * Get estimated daily spend by service from DynamoDB.
+     */
+    async getDailySummary() {
+        const date = new Date().toISOString().slice(0, 10);
+        const services = {};
+        let estimatedTotal = 0;
+        for (const service of Object.keys(UNIT_COSTS)) {
+            try {
+                const count = await this.readServiceCount(date, service);
+                let cost = 0;
+                for (const [op, unitCost] of Object.entries(UNIT_COSTS[service])) {
+                    // For simplicity, all units for a service are attributed to its first op cost
+                    cost += count * unitCost;
+                    break; // Use first operation's cost as estimate
+                }
+                // Refine: read per-op counts if stored
+                services[service] = Math.round(cost * 100) / 100;
+                estimatedTotal += cost;
+            }
+            catch {
+                services[service] = 0;
+            }
+        }
+        return {
+            date,
+            estimatedTotal: Math.round(estimatedTotal * 100) / 100,
+            limit: this.costLimits.dailyTotal,
+            services,
+        };
+    }
+    /**
+     * Check if any service exceeds its daily budget.
+     */
+    async isOverBudget() {
+        const summary = await this.getDailySummary();
+        const overServices = [];
+        if (summary.estimatedTotal >= this.costLimits.dailyTotal) {
+            return { exceeded: true, services: ["total"] };
+        }
+        for (const [service, cost] of Object.entries(summary.services)) {
+            const limit = this.costLimits.dailyPerService[service];
+            if (limit && cost >= limit) {
+                overServices.push(service);
+            }
+        }
+        return { exceeded: overServices.length > 0, services: overServices };
+    }
+    /** Force an immediate flush (for graceful shutdown or testing). */
+    async forceFlush() {
+        if (this.flushTimer) {
+            clearTimeout(this.flushTimer);
+            this.flushTimer = null;
+        }
+        await this.flush();
+    }
+    ensureFlushScheduled() {
+        if (this.flushTimer)
+            return;
+        this.flushTimer = setTimeout(() => {
+            this.flushTimer = null;
+            this.flush().catch((err) => {
+                this.logger.warn("[CostAccumulator] Flush error", { error: err });
+            });
+        }, this.flushIntervalMs);
+    }
+    async flush() {
+        if (this.buffer.size === 0)
+            return;
+        const snapshot = new Map(this.buffer);
+        this.buffer.clear();
+        const date = new Date().toISOString().slice(0, 10);
+        for (const [key, units] of snapshot) {
+            const [service] = key.split(":");
+            try {
+                await this.atomicAdd(date, service, units);
+            }
+            catch {
+                // Re-buffer on failure — will be retried on next flush
+                this.buffer.set(key, (this.buffer.get(key) || 0) + units);
+                this.ensureFlushScheduled();
+            }
+        }
+    }
+    async atomicAdd(date, service, units) {
+        await dynamoClient.send(new client_dynamodb_1.UpdateItemCommand({
+            TableName: TABLE_NAME,
+            Key: {
+                pk: { S: `costtrack:${date}:${service}` },
+                sk: { S: "v" },
+            },
+            UpdateExpression: "ADD #units :inc SET #ttl = if_not_exists(#ttl, :ttl)",
+            ExpressionAttributeNames: { "#units": "units", "#ttl": "ttl" },
+            ExpressionAttributeValues: {
+                ":inc": { N: String(units) },
+                ":ttl": { N: String(Math.floor(Date.now() / 1000) + 172800) }, // 48h TTL
+            },
+        }));
+    }
+    async readServiceCount(date, service) {
+        const result = await dynamoClient.send(new client_dynamodb_1.GetItemCommand({
+            TableName: TABLE_NAME,
+            Key: {
+                pk: { S: `costtrack:${date}:${service}` },
+                sk: { S: "v" },
+            },
+            ProjectionExpression: "#units",
+            ExpressionAttributeNames: { "#units": "units" },
+        }));
+        return parseInt(result.Item?.units?.N || "0", 10);
+    }
+}
+exports.CostAccumulator = CostAccumulator;
+//# sourceMappingURL=cost-accumulator.js.map

package/dist/lib/cost-accumulator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-accumulator.js","sourceRoot":"","sources":["../../src/lib/cost-accumulator.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,8DAIkC;AAClC,qCAAkC;AAoBlC,wEAAwE;AACxE,MAAM,UAAU,GAA2C;IACzD,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;IAC7B,GAAG,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;IAC7B,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE;IACvD,QAAQ,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE;CAClD,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,gCAAc,CAAC;IACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW;IAC7C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,UAAU,CAAC;AAEzF,IAAI,SAAS,GAA2B,IAAI,CAAC;AAE7C,MAAa,eAAe;IAClB,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IACxC,UAAU,GAAyC,IAAI,CAAC;IAC/C,eAAe,GAAG,MAAM,CAAC;IACzB,MAAM,GAAG,eAAM,CAAC,WAAW,EAAE,CAAC;IACvC,UAAU,CAAmB;IAErC,YAAY,UAA4B;QACtC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,4CAA4C;IAC5C,MAAM,CAAC,WAAW,CAAC,UAA6B;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,IAAI,eAAe,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qCAAqC;IACrC,MAAM,CAAC,aAAa;QAClB,IAAI,SAAS,EAAE,UAAU,EAAE,CAAC;YAC1B,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAgB;QACrB,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzD,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBACjE,8EAA8E;oBAC9E,IAAI,IAAI,KAAK,GAAG,QAAQ,CAAC;oBACzB,MAAM,CAAC,yCAAyC;gBAClD,CAAC;gBACD,uCAAuC;gBACvC,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;gBACjD,cAAc,IAAI,IAAI,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG;YACtD,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;YACjC,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,CAAC;QAED,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC3B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACvE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAEO,oBAAoB;QAC1B,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,KAAa;QAClE,MAAM,YAAY,CAAC,IAAI,CACrB,IAAI,mCAAiB,CAAC;YACpB,SAAS,EAAE,UAAU;YACrB,GAAG,EAAE;gBACH,EAAE,EAAE,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI,OAAO,EAAE,EAAE;gBACzC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;aACf;YACD,gBAAgB,EAAE,sDAAsD;YACxE,wBAAwB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YAC9D,yBAAyB,EAAE;gBACzB,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;gBAC5B,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,EAAE,UAAU;aAC1E;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,OAAe;QAC1D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACpC,IAAI,gCAAc,CAAC;YACjB,SAAS,EAAE,UAAU;YACrB,GAAG,EAAE;gBACH,EAAE,EAAE,EAAE,CAAC,EAAE,aAAa,IAAI,IAAI,OAAO,EAAE,EAAE;gBACzC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE;aACf;YACD,oBAAoB,EAAE,QAAQ;YAC9B,wBAAwB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;SAChD,CAAC,CACH,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,CAAC;CACF;AAjKD,0CAiKC"}