@heavybit/shared-lib 0.0.0-stage → 1.1.0

package/dist/cjs/contracts/editorial-draft.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.editorialDraftSubmitSchema = exports.FACT_KINDS = exports.QUALITY_GATE_NAMES = exports.GATE_VERDICTS = exports.DRAFT_RISKS = exports.DRAFT_SOURCE_ROLES = exports.EDITORIAL_DRAFT_LIMITS = exports.EDITORIAL_DRAFT_SUBMIT = void 0;
+const zod_1 = require("zod");
+const index_js_1 = require("../validation/index.js");
+/**
+ * The newswire → editorial draft hand-off (design Appendix A.4 plus `paragraphFactIds` and
+ * `image.uploadId`, decision R14). newswire-service stages it through its outbox; editorial-service
+ * validates it with the same schema before creating the story. One contract for both sides.
+ */
+exports.EDITORIAL_DRAFT_SUBMIT = 'editorial:draft.submit';
+/** Field limits of the contract (editorial's story columns). */
+exports.EDITORIAL_DRAFT_LIMITS = {
+    headline: 200,
+    excerpt: 400,
+    tags: 6,
+    seoTitle: 70,
+    seoDescription: 170,
+};
+exports.DRAFT_SOURCE_ROLES = ['primary', 'corroborating'];
+exports.DRAFT_RISKS = ['low', 'medium', 'high'];
+exports.GATE_VERDICTS = ['pass', 'review', 'block'];
+/**
+ * Every quality gate newswire runs on a draft, in design order. A submitted draft carries one result per
+ * gate; editorial treats a missing one as not passed (auto-publish never runs on an unchecked draft).
+ */
+exports.QUALITY_GATE_NAMES = [
+    'originality', 'grounding', 'quote_limits', 'corroboration', 'conflicts',
+    'sensitivity', 'category', 'freshness', 'duplicate_of_published', 'length_format',
+];
+exports.FACT_KINDS = ['event', 'person', 'date', 'place', 'number', 'quote', 'context'];
+const text = zod_1.z.string().trim().min(1);
+const httpsUrl = zod_1.z
+    .string()
+    .url()
+    .refine((u) => u.startsWith('https://'), 'Source URL must use https');
+const draftSourceSchema = zod_1.z.object({
+    name: text.max(160),
+    url: httpsUrl,
+    publishedAt: zod_1.z.string().datetime({ offset: true }).optional(),
+    role: zod_1.z.enum(exports.DRAFT_SOURCE_ROLES),
+});
+const gateResultSchema = zod_1.z.object({
+    gate: text,
+    verdict: zod_1.z.enum(exports.GATE_VERDICTS),
+    reasons: zod_1.z.array(zod_1.z.string()),
+    metrics: zod_1.z.record(zod_1.z.string(), zod_1.z.number()).optional(),
+});
+const factSupportSchema = zod_1.z.object({ itemId: index_js_1.idSchema, paragraph: zod_1.z.number().int().min(1) });
+const factSchema = zod_1.z.object({
+    id: text,
+    statement: text,
+    kind: zod_1.z.enum(exports.FACT_KINDS),
+    entities: zod_1.z.array(zod_1.z.string()),
+    supportedBy: zod_1.z.array(factSupportSchema).min(1),
+    conflictsWith: zod_1.z.array(zod_1.z.string()),
+    independentSources: zod_1.z.number().int().min(0),
+});
+const quoteSchema = factSupportSchema.extend({ text, speaker: text });
+const conflictSchema = zod_1.z.object({ description: text, factIds: zod_1.z.array(zod_1.z.string()) });
+exports.editorialDraftSubmitSchema = zod_1.z
+    .object({
+    draftId: index_js_1.idSchema,
+    clusterId: index_js_1.idSchema,
+    headline: text.max(exports.EDITORIAL_DRAFT_LIMITS.headline),
+    excerpt: text.max(exports.EDITORIAL_DRAFT_LIMITS.excerpt),
+    paragraphs: zod_1.z.array(text).min(1),
+    /** The fact-sheet fact ids each paragraph asserts (same length as `paragraphs`). */
+    paragraphFactIds: zod_1.z.array(zod_1.z.array(zod_1.z.string())),
+    category: text.max(60),
+    tags: zod_1.z.array(text.max(40)).max(exports.EDITORIAL_DRAFT_LIMITS.tags),
+    seo: zod_1.z.object({
+        title: text.max(exports.EDITORIAL_DRAFT_LIMITS.seoTitle),
+        description: text.max(exports.EDITORIAL_DRAFT_LIMITS.seoDescription),
+    }),
+    social: zod_1.z.object({ facebook: text, x: text, whatsapp: text, instagram: text }),
+    sources: zod_1.z.array(draftSourceSchema).min(1),
+    /** An imported or profile cover (upload-service id), or null when the draft has none. */
+    image: zod_1.z.object({ uploadId: index_js_1.idSchema, credit: text.max(160), alt: text.max(255) }).nullable(),
+    relatedProfileIds: zod_1.z.array(index_js_1.idSchema),
+    suggestedProfileIds: zod_1.z.array(index_js_1.idSchema),
+    review: zod_1.z.object({
+        confidence: zod_1.z.number().min(0).max(1),
+        risk: zod_1.z.enum(exports.DRAFT_RISKS),
+        riskReasons: zod_1.z.array(zod_1.z.string()),
+        gates: zod_1.z.array(gateResultSchema),
+        factSheet: zod_1.z.object({
+            facts: zod_1.z.array(factSchema),
+            quotes: zod_1.z.array(quoteSchema),
+            conflicts: zod_1.z.array(conflictSchema),
+        }),
+        /** Prompt slug → version used to produce the draft. */
+        promptVersions: zod_1.z.record(zod_1.z.string(), zod_1.z.number().int().positive()),
+    }),
+})
+    .superRefine((draft, ctx) => {
+    if (draft.paragraphFactIds.length !== draft.paragraphs.length) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['paragraphFactIds'], message: 'Must have one entry per paragraph' });
+    }
+    const factIds = new Set(draft.review.factSheet.facts.map((f) => f.id));
+    draft.paragraphFactIds.forEach((ids, i) => {
+        for (const id of ids) {
+            if (!factIds.has(id))
+                ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['paragraphFactIds', i], message: `Unknown fact id ${id}` });
+        }
+    });
+    if (draft.sources.filter((s) => s.role === 'primary').length !== 1) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['sources'], message: 'Exactly one source must be primary' });
+    }
+});
+//# sourceMappingURL=editorial-draft.js.map

package/dist/cjs/contracts/editorial-draft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorial-draft.js","sourceRoot":"","sources":["../../../src/contracts/editorial-draft.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAAkD;AAElD;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,gEAAgE;AACnD,QAAA,sBAAsB,GAAG;IACpC,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,GAAG;IACZ,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,EAAE;IACZ,cAAc,EAAE,GAAG;CACX,CAAC;AAEE,QAAA,kBAAkB,GAAG,CAAC,SAAS,EAAE,eAAe,CAAU,CAAC;AAC3D,QAAA,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AACjD,QAAA,aAAa,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAClE;;;GAGG;AACU,QAAA,kBAAkB,GAAG;IAChC,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW;IACxE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,eAAe;CACzE,CAAC;AAEE,QAAA,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAEtG,MAAM,IAAI,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,QAAQ,GAAG,OAAC;KACf,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAAC;AAExE,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnB,GAAG,EAAE,QAAQ;IACb,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7D,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,0BAAkB,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,IAAI;IACV,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC;IAC9B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAQ,EAAE,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,UAAU,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,kBAAU,CAAC;IACxB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;IAClC,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtE,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAExE,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,mBAAQ;IACjB,SAAS,EAAE,mBAAQ;IACnB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,8BAAsB,CAAC,QAAQ,CAAC;IACnD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,8BAAsB,CAAC,OAAO,CAAC;IACjD,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,oFAAoF;IACpF,gBAAgB,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtB,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,8BAAsB,CAAC,IAAI,CAAC;IAC5D,GAAG,EAAE,OAAC,CAAC,MAAM,CAAC;QACZ,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,8BAAsB,CAAC,QAAQ,CAAC;QAChD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,8BAAsB,CAAC,cAAc,CAAC;KAC7D,CAAC;IACF,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9E,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,yFAAyF;IACzF,KAAK,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,mBAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7F,iBAAiB,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAQ,CAAC;IACpC,mBAAmB,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAQ,CAAC;IACtC,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC;QACf,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,mBAAW,CAAC;QACzB,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC;QAChC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAChC,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC;YAClB,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5B,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,cAAc,CAAC;SACnC,CAAC;QACF,uDAAuD;QACvD,cAAc,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;KAClE,CAAC;CACH,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,CAAC,CAAC;QACvI,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;IAClH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cjs/contracts/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./editorial-draft.js"), exports);
+__exportStar(require("./notification-dispatch.js"), exports);
+__exportStar(require("./upload-import.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/contracts/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,6DAA2C;AAC3C,qDAAmC"}

package/dist/cjs/contracts/notification-dispatch.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISPATCH_TEMPLATE_VARIABLES = exports.notificationDispatchSchema = exports.dispatchRecipientSchema = exports.dispatchValueSchema = exports.DISPATCH_LIMITS = exports.NOTIFICATION_CATEGORIES = exports.DISPATCH_CHANNELS = exports.NOTIFICATION_DISPATCH = void 0;
+const zod_1 = require("zod");
+/**
+ * `notification:dispatch` — the one command every Showbiz service stages (through its outbox) to have
+ * notification-service render a seeded template and deliver it by email and/or the in-app feed. No
+ * other service sends email itself. One contract for both sides: producers type their payload with it
+ * and notification-service validates against it, so the two cannot drift.
+ */
+exports.NOTIFICATION_DISPATCH = 'notification:dispatch';
+/** Channels a dispatch may ask for. `in_app` needs a recipient `userId` (the bell feed is per user). */
+exports.DISPATCH_CHANNELS = ['email', 'in_app'];
+/**
+ * What a dispatch is about. Account mail (`security`, `account`, `team`, `marketing`) goes to a user;
+ * `staff` is an operational alert to a configured staff address.
+ */
+exports.NOTIFICATION_CATEGORIES = ['security', 'account', 'team', 'marketing', 'staff'];
+exports.DISPATCH_LIMITS = {
+    template: 100,
+    email: 254,
+    name: 200,
+    dataKeys: 40,
+    dataKey: 64,
+    dataValue: 2000,
+    secretKeys: 10,
+    permission: 100,
+};
+/** Template variables are flat scalars: they are printed into the copy, never serialised objects. */
+exports.dispatchValueSchema = zod_1.z.union([zod_1.z.string().max(exports.DISPATCH_LIMITS.dataValue), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]);
+exports.dispatchRecipientSchema = zod_1.z.object({
+    email: zod_1.z.string().trim().email().max(exports.DISPATCH_LIMITS.email),
+    name: zod_1.z.string().trim().max(exports.DISPATCH_LIMITS.name).optional(),
+    userId: zod_1.z.string().max(36).nullish(),
+    locale: zod_1.z.string().max(20).nullish(),
+    /** IANA zone; time variables are rendered in it. */
+    timezone: zod_1.z.string().max(64).nullish(),
+});
+const dataKey = zod_1.z.string().regex(/^[A-Za-z][A-Za-z0-9_]*$/, 'Use a template variable name').max(exports.DISPATCH_LIMITS.dataKey);
+exports.notificationDispatchSchema = zod_1.z
+    .object({
+    /** Seeded `notification_templates.slug`. */
+    template: zod_1.z.string().trim().min(1).max(exports.DISPATCH_LIMITS.template),
+    category: zod_1.z.enum(exports.NOTIFICATION_CATEGORIES),
+    recipient: exports.dispatchRecipientSchema,
+    channels: zod_1.z.array(zod_1.z.enum(exports.DISPATCH_CHANNELS)).min(1).max(exports.DISPATCH_CHANNELS.length),
+    data: zod_1.z
+        .record(dataKey, exports.dispatchValueSchema)
+        .default({})
+        .refine((data) => Object.keys(data).length <= exports.DISPATCH_LIMITS.dataKeys, `At most ${exports.DISPATCH_LIMITS.dataKeys} variables`),
+    /**
+     * Keys of `data` holding a one-time secret (a sign-in code, a reset or confirm link). They are used to
+     * render the email and nothing else: notification-service never stores them and never puts them in the
+     * in-app feed, and email-service masks them in what it keeps.
+     */
+    secretKeys: zod_1.z.array(dataKey).max(exports.DISPATCH_LIMITS.secretKeys).default([]),
+    /** Security and staff alerts are always delivered, whatever the recipient's preferences. */
+    bypassPreferences: zod_1.z.boolean().optional(),
+    /** The permission staff recipients hold; informational until recipients are resolved by permission. */
+    targetPermission: zod_1.z.string().max(exports.DISPATCH_LIMITS.permission).optional(),
+})
+    .superRefine((dispatch, ctx) => {
+    for (const key of dispatch.secretKeys) {
+        if (!(key in dispatch.data)) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['secretKeys'], message: `Secret key "${key}" is not in data` });
+        }
+    }
+});
+/**
+ * The seeded templates Showbiz services dispatch, with the variables (`data` keys) each dispatch carries.
+ * Producers send exactly these keys; a seeded template may use any subset (notification-service dead-letters
+ * a dispatch missing a variable its template uses). Both sides test against this table.
+ */
+exports.DISPATCH_TEMPLATE_VARIABLES = {
+    // auth-admin-service: account and security mail
+    'account-activation': ['name', 'code', 'expiresInHours'],
+    'login-otp': ['name', 'code', 'expiresInMinutes', 'device'],
+    'password-reset': ['name', 'resetUrl', 'expiresInMinutes'],
+    'staff-invitation': ['name', 'resetUrl', 'expiresInMinutes'],
+    'password-changed': ['name', 'changedAt'],
+    'new-device-login': ['name', 'device', 'ip', 'country', 'occurredAt', 'confirmUrl', 'disputeUrl'],
+    'team-member-added': ['name', 'profileName', 'role', 'invitedBy'],
+    'account-suspended': ['name', 'reason'],
+    'welcome-listener': ['name'],
+    'welcome-creator': ['name'],
+    // ai / newswire / editorial: staff alerts
+    'ai_budget_threshold': ['requester', 'period', 'threshold_pct', 'spent_usd', 'limit_usd'],
+    'newswire_source_unhealthy': ['source_name', 'source_slug', 'consecutive_failures', 'last_error', 'last_success_at'],
+    'newswire_block_rate_high': ['blocked', 'total', 'block_rate_pct', 'window_hours'],
+    'autopublish_audit_alert': ['problem_rate_pct', 'problem_count', 'sample_count', 'window_days', 'action_taken'],
+};
+//# sourceMappingURL=notification-dispatch.js.map

package/dist/cjs/contracts/notification-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-dispatch.js","sourceRoot":"","sources":["../../../src/contracts/notification-dispatch.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D,wGAAwG;AAC3F,QAAA,iBAAiB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAG9D;;;GAGG;AACU,QAAA,uBAAuB,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;AAGzF,QAAA,eAAe,GAAG;IAC7B,QAAQ,EAAE,GAAG;IACb,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;IACX,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,GAAG;CACP,CAAC;AAEX,qGAAqG;AACxF,QAAA,mBAAmB,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,SAAS,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,OAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAGvH,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,KAAK,CAAC;IAC3D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5D,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,oDAAoD;IACpD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,OAAO,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,EAAE,8BAA8B,CAAC,CAAC,GAAG,CAAC,uBAAe,CAAC,OAAO,CAAC,CAAC;AAE5G,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,4CAA4C;IAC5C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAe,CAAC,QAAQ,CAAC;IAChE,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,+BAAuB,CAAC;IACzC,SAAS,EAAE,+BAAuB;IAClC,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,yBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAiB,CAAC,MAAM,CAAC;IACjF,IAAI,EAAE,OAAC;SACJ,MAAM,CAAC,OAAO,EAAE,2BAAmB,CAAC;SACpC,OAAO,CAAC,EAAE,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,uBAAe,CAAC,QAAQ,EAAE,WAAW,uBAAe,CAAC,QAAQ,YAAY,CAAC;IAC1H;;;;OAIG;IACH,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,uBAAe,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxE,4FAA4F;IAC5F,iBAAiB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,uGAAuG;IACvG,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,kBAAkB,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACU,QAAA,2BAA2B,GAAG;IACzC,gDAAgD;IAChD,oBAAoB,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC;IACxD,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC;IAC1D,kBAAkB,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC;IAC5D,kBAAkB,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;IACzC,kBAAkB,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;IACjG,mBAAmB,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC;IACjE,mBAAmB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;IACvC,kBAAkB,EAAE,CAAC,MAAM,CAAC;IAC5B,iBAAiB,EAAE,CAAC,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,qBAAqB,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;IACzF,2BAA2B,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,sBAAsB,EAAE,YAAY,EAAE,iBAAiB,CAAC;IACpH,0BAA0B,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,CAAC;IAClF,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,CAAC;CAC3D,CAAC"}

package/dist/cjs/contracts/upload-import.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadImportFailedSchema = exports.uploadImportCompletedSchema = exports.uploadImportCommandSchema = exports.UPLOAD_IMPORT_LIMITS = exports.UPLOAD_IMPORT_POLICIES = exports.UPLOAD_IMPORT_EVENTS = exports.UPLOAD_IMPORT = void 0;
+const zod_1 = require("zod");
+const index_js_1 = require("../validation/index.js");
+/**
+ * Licensed image import by URL (Newswire R5, decision R39). newswire-service (and later
+ * editorial-service) sends `upload:import`; upload-service fetches the file and answers with an
+ * `upload.import.completed` or `upload.import.failed` event. One contract for both sides.
+ */
+exports.UPLOAD_IMPORT = 'upload:import';
+exports.UPLOAD_IMPORT_EVENTS = {
+    COMPLETED: 'upload.import.completed',
+    FAILED: 'upload.import.failed',
+};
+/** Upload policies an import may use. */
+exports.UPLOAD_IMPORT_POLICIES = ['news_image'];
+/** Field limits of the contract (upload-service's `uploads` columns). */
+exports.UPLOAD_IMPORT_LIMITS = {
+    url: 2048,
+    ownerType: 50,
+    licenceHolder: 160,
+    licenceBasis: 255,
+    reason: 255,
+};
+/**
+ * `upload:import` data. The URL is only length-checked here: upload-service rejects a non-https or
+ * unsafe URL itself, so the sender hears about it through a `failed` event instead of a dead letter.
+ */
+exports.uploadImportCommandSchema = zod_1.z.object({
+    /** ULID the outcome event echoes back; upload-service is idempotent on it. */
+    importId: index_js_1.idSchema,
+    url: zod_1.z.string().min(1).max(exports.UPLOAD_IMPORT_LIMITS.url),
+    policy: zod_1.z.enum(exports.UPLOAD_IMPORT_POLICIES),
+    /** Echoed in the outcome only; the imported upload is a system row with no owner. */
+    ownerType: zod_1.z.string().min(1).max(exports.UPLOAD_IMPORT_LIMITS.ownerType),
+    ownerId: index_js_1.idSchema,
+    licence: zod_1.z.object({
+        holder: zod_1.z.string().trim().min(1).max(exports.UPLOAD_IMPORT_LIMITS.licenceHolder),
+        basis: zod_1.z.string().trim().min(1).max(exports.UPLOAD_IMPORT_LIMITS.licenceBasis),
+    }),
+});
+exports.uploadImportCompletedSchema = zod_1.z.object({
+    importId: index_js_1.idSchema,
+    uploadId: index_js_1.idSchema,
+    ownerType: zod_1.z.string().min(1).max(exports.UPLOAD_IMPORT_LIMITS.ownerType),
+    ownerId: index_js_1.idSchema,
+});
+/** `reason` is a machine code (`too_large`, `http_404`, …; see upload-service `ImportFailureReason`). */
+exports.uploadImportFailedSchema = zod_1.z.object({
+    importId: index_js_1.idSchema,
+    reason: zod_1.z.string().min(1).max(exports.UPLOAD_IMPORT_LIMITS.reason),
+});
+//# sourceMappingURL=upload-import.js.map

package/dist/cjs/contracts/upload-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-import.js","sourceRoot":"","sources":["../../../src/contracts/upload-import.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,qDAAkD;AAElD;;;;GAIG;AACU,QAAA,aAAa,GAAG,eAAe,CAAC;AAEhC,QAAA,oBAAoB,GAAG;IAClC,SAAS,EAAE,yBAAyB;IACpC,MAAM,EAAE,sBAAsB;CACtB,CAAC;AAEX,yCAAyC;AAC5B,QAAA,sBAAsB,GAAG,CAAC,YAAY,CAAU,CAAC;AAG9D,yEAAyE;AAC5D,QAAA,oBAAoB,GAAG;IAClC,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,EAAE;IACb,aAAa,EAAE,GAAG;IAClB,YAAY,EAAE,GAAG;IACjB,MAAM,EAAE,GAAG;CACH,CAAC;AAEX;;;GAGG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,8EAA8E;IAC9E,QAAQ,EAAE,mBAAQ;IAClB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,GAAG,CAAC;IACpD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,8BAAsB,CAAC;IACtC,qFAAqF;IACrF,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,SAAS,CAAC;IAChE,OAAO,EAAE,mBAAQ;IACjB,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,aAAa,CAAC;QACxE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,YAAY,CAAC;KACvE,CAAC;CACH,CAAC,CAAC;AAEU,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,mBAAQ;IAClB,QAAQ,EAAE,mBAAQ;IAClB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,SAAS,CAAC;IAChE,OAAO,EAAE,mBAAQ;CAClB,CAAC,CAAC;AAEH,yGAAyG;AAC5F,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,mBAAQ;IAClB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAAoB,CAAC,MAAM,CAAC;CAC3D,CAAC,CAAC"}

package/dist/cjs/database/index.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMysqlPool = createMysqlPool;
+exports.createKnexConfig = createKnexConfig;
+exports.pingMysql = pingMysql;
+exports.escapeLike = escapeLike;
+const promise_1 = __importDefault(require("mysql2/promise"));
+/**
+ * mysql2 pool for Drizzle. Sessions run in UTC and utf8mb4 so timestamps and emoji round-trip
+ * unchanged regardless of server defaults.
+ */
+function createMysqlPool(options) {
+    return promise_1.default.createPool({
+        host: options.host,
+        port: options.port,
+        user: options.user,
+        password: options.password,
+        database: options.database,
+        connectionLimit: options.poolMax ?? 10,
+        waitForConnections: true,
+        enableKeepAlive: true,
+        timezone: 'Z',
+        charset: 'utf8mb4_unicode_ci',
+        dateStrings: false,
+        supportBigNumbers: true,
+    });
+}
+/** Knex config for migrations/seeds and query-builder use (same session settings as the pool). */
+function createKnexConfig(options) {
+    return {
+        client: 'mysql2',
+        connection: {
+            host: options.host,
+            port: options.port,
+            user: options.user,
+            password: options.password,
+            database: options.database,
+            timezone: 'Z',
+            charset: 'utf8mb4',
+        },
+        pool: { min: 0, max: options.poolMax ?? 10 },
+        migrations: { directory: options.migrationsDir ?? './migrations', tableName: 'knex_migrations', loadExtensions: ['.cjs', '.js'] },
+        seeds: { directory: options.seedsDir ?? './seeds', loadExtensions: ['.cjs', '.js'] },
+    };
+}
+/** Readiness probe helper. */
+async function pingMysql(pool) {
+    await pool.query('SELECT 1');
+}
+/** Escapes `%`, `_` and `\` for use inside a LIKE pattern. */
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/database/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/database/index.ts"],"names":[],"mappings":";;;;;AAgBA,0CAeC;AAGD,4CAgBC;AAGD,8BAEC;AAGD,gCAEC;AA3DD,6DAAmC;AAWnC;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAA+B;IAC7D,OAAO,iBAAK,CAAC,UAAU,CAAC;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;QACtC,kBAAkB,EAAE,IAAI;QACxB,eAAe,EAAE,IAAI;QACrB,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC;AAED,kGAAkG;AAClG,SAAgB,gBAAgB,CAAC,OAA+E;IAC9G,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,SAAS;SACnB;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;QAC5C,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,IAAI,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;QACjI,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,cAAc,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,8BAA8B;AACvB,KAAK,UAAU,SAAS,CAAC,IAAgB;IAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC/B,CAAC;AAED,8DAA8D;AAC9D,SAAgB,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/cjs/express/auth.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireRole = exports.requireAllPermissions = exports.requirePermission = void 0;
+exports.authenticateFromGateway = authenticateFromGateway;
+exports.optionalAuthFromGateway = optionalAuthFromGateway;
+exports.requireInternalServiceSecret = requireInternalServiceSecret;
+const index_js_1 = require("../access/index.js");
+const crypto_js_1 = require("../common/crypto.js");
+const response_js_1 = require("../common/response.js");
+const index_js_2 = require("../identity/index.js");
+function resolveIdentity(req, options) {
+    const result = (0, index_js_2.verifyIdentityHeaders)(req.headers, options.secret, { maxSkewMs: options.maxSkewMs });
+    if (result.status === 'authenticated') {
+        req.user = result.user;
+        return 'ok';
+    }
+    if (result.status === 'invalid') {
+        options.logger?.warn('Rejected forged or stale gateway identity', { reason: result.reason, path: req.path });
+        return 'invalid';
+    }
+    return 'anonymous';
+}
+/** Requires a valid gateway-signed identity; 401 otherwise. */
+function authenticateFromGateway(options) {
+    return (req, res, next) => {
+        if (resolveIdentity(req, options) === 'ok')
+            return next();
+        res.status(401).json((0, response_js_1.errorResponse)('Authentication required', undefined, 'UNAUTHENTICATED'));
+    };
+}
+/** Attaches `req.user` when a valid identity is present; continues anonymously otherwise. */
+function optionalAuthFromGateway(options) {
+    return (req, res, next) => {
+        if (resolveIdentity(req, options) === 'invalid') {
+            res.status(401).json((0, response_js_1.errorResponse)('Invalid identity', undefined, 'UNAUTHENTICATED'));
+            return;
+        }
+        next();
+    };
+}
+function guard(check, message = 'You do not have permission to perform this action') {
+    return (req, res, next) => {
+        if (!req.user) {
+            res.status(401).json((0, response_js_1.errorResponse)('Authentication required', undefined, 'UNAUTHENTICATED'));
+            return;
+        }
+        if (!check(req.user)) {
+            res.status(403).json((0, response_js_1.errorResponse)(message, undefined, 'FORBIDDEN'));
+            return;
+        }
+        next();
+    };
+}
+/** Allows callers holding any of `permissions`. */
+const requirePermission = (...permissions) => guard((u) => (0, index_js_1.hasPermission)(u, ...permissions));
+exports.requirePermission = requirePermission;
+/** Allows callers holding every one of `permissions`. */
+const requireAllPermissions = (...permissions) => guard((u) => (0, index_js_1.hasAllPermissions)(u, ...permissions));
+exports.requireAllPermissions = requireAllPermissions;
+/** Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only. */
+const requireRole = (...roles) => guard((u) => (0, index_js_1.hasRole)(u, ...roles), 'Insufficient role');
+exports.requireRole = requireRole;
+/** Guards `/internal/*` routes: requires the shared service secret header. */
+function requireInternalServiceSecret(secret) {
+    return (req, res, next) => {
+        const provided = req.headers[index_js_2.CONTEXT_HEADERS.INTERNAL_SECRET];
+        if (typeof provided === 'string' && secret && (0, crypto_js_1.safeEqual)(provided, secret))
+            return next();
+        res.status(401).json((0, response_js_1.errorResponse)('Invalid internal service credentials', undefined, 'UNAUTHENTICATED'));
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/cjs/express/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":";;;AAoCA,0DAKC;AAGD,0DAQC;AA0BD,oEAMC;AAnFD,iDAA+E;AAC/E,mDAAgD;AAChD,uDAAsD;AACtD,mDAA8E;AAkB9E,SAAS,eAAe,CAAC,GAAY,EAAE,OAA2B;IAChE,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,mDAAmD;AAC5C,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAa,EAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAAjH,QAAA,iBAAiB,qBAAgG;AAE9H,yDAAyD;AAClD,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAAzH,QAAA,qBAAqB,yBAAoG;AAEtI,+FAA+F;AACxF,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAO,EAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAA9G,QAAA,WAAW,eAAmG;AAE3H,8EAA8E;AAC9E,SAAgB,4BAA4B,CAAC,MAAc;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAA,qBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,sCAAsC,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/express/health.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.livenessHandler = livenessHandler;
+exports.readinessHandler = readinessHandler;
+const async_js_1 = require("../common/async.js");
+/** `GET /health` — liveness: the process is up. Never touches dependencies. */
+function livenessHandler(options) {
+    const startedAt = Date.now();
+    return (_req, res) => {
+        res.json({ status: 'ok', service: options.service, version: options.version, uptimeSec: Math.round((Date.now() - startedAt) / 1000) });
+    };
+}
+/** `GET /health/ready` — readiness: every dependency responds. 503 when any fails. */
+function readinessHandler(options) {
+    return async (_req, res) => {
+        const entries = Object.entries(options.checks ?? {});
+        const results = await Promise.all(entries.map(async ([name, check]) => {
+            const started = Date.now();
+            try {
+                const detail = await (0, async_js_1.withTimeout)(Promise.resolve(check()), options.timeoutMs ?? 3000, () => new Error('timeout'));
+                return [name, { status: 'up', latencyMs: Date.now() - started, ...(detail && typeof detail === 'object' ? { detail } : {}) }];
+            }
+            catch (error) {
+                return [name, { status: 'down', latencyMs: Date.now() - started, error: error.message }];
+            }
+        }));
+        const healthy = results.every(([, r]) => r.status === 'up');
+        res.status(healthy ? 200 : 503).json({ status: healthy ? 'ok' : 'degraded', service: options.service, checks: Object.fromEntries(results) });
+    };
+}
+//# sourceMappingURL=health.js.map

package/dist/cjs/express/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/express/health.ts"],"names":[],"mappings":";;AAcA,0CAKC;AAGD,4CAeC;AApCD,iDAAiD;AAYjD,+EAA+E;AAC/E,SAAgB,eAAe,CAAC,OAAsB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,gBAAgB,CAAC,OAAsB;IACrD,OAAO,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAA,sBAAW,EAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClH,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAU,CAAC;YACzI,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAU,CAAC;YAC/G,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/express/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.js"), exports);
+__exportStar(require("./middleware.js"), exports);
+__exportStar(require("./health.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B"}

package/dist/cjs/express/middleware.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.correlationMiddleware = correlationMiddleware;
+exports.correlationId = correlationId;
+exports.clientIp = clientIp;
+exports.clientTimezone = clientTimezone;
+exports.anonId = anonId;
+exports.validate = validate;
+exports.asyncHandler = asyncHandler;
+exports.errorHandler = errorHandler;
+exports.notFoundHandler = notFoundHandler;
+const errors_js_1 = require("../common/errors.js");
+const id_js_1 = require("../common/id.js");
+const response_js_1 = require("../common/response.js");
+const index_js_1 = require("../identity/index.js");
+const index_js_2 = require("../validation/index.js");
+/** Ensures every request carries `x-correlation-id` (reused from the gateway when present). */
+function correlationMiddleware() {
+    return (req, res, next) => {
+        const incoming = req.headers[index_js_1.CONTEXT_HEADERS.CORRELATION_ID];
+        const id = typeof incoming === 'string' && incoming.length <= 128 ? incoming : (0, id_js_1.newId)();
+        req.headers[index_js_1.CONTEXT_HEADERS.CORRELATION_ID] = id;
+        res.setHeader(index_js_1.CONTEXT_HEADERS.CORRELATION_ID, id);
+        next();
+    };
+}
+function correlationId(req) {
+    const value = req.headers[index_js_1.CONTEXT_HEADERS.CORRELATION_ID];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Real client IP: gateway-forwarded header first, then Express's `req.ip`. */
+function clientIp(req) {
+    const forwarded = req.headers[index_js_1.CONTEXT_HEADERS.CLIENT_IP];
+    if (typeof forwarded === 'string' && forwarded)
+        return forwarded;
+    return req.ip ?? null;
+}
+function clientTimezone(req) {
+    const tz = req.headers[index_js_1.CONTEXT_HEADERS.TIMEZONE];
+    return typeof tz === 'string' && tz ? tz : null;
+}
+function anonId(req) {
+    const id = req.headers[index_js_1.CONTEXT_HEADERS.ANON_ID];
+    return typeof id === 'string' && id ? id : null;
+}
+/** Validates and replaces `req[part]` with the parsed value; 422 with field errors on failure. */
+function validate(schema, part = 'body') {
+    return (req, res, next) => {
+        const result = schema.safeParse(req[part]);
+        if (!result.success) {
+            res.status(422).json((0, response_js_1.errorResponse)('Validation failed', (0, index_js_2.zodIssuesToErrors)(result.error), 'VALIDATION_FAILED'));
+            return;
+        }
+        // Express 5 exposes req.query as a getter; redefine to store the parsed value.
+        Object.defineProperty(req, part, { value: result.data, writable: true, configurable: true, enumerable: true });
+        next();
+    };
+}
+/** Wraps an async handler so rejections reach the error middleware (needed on Express 4). */
+function asyncHandler(fn) {
+    return (req, res, next) => {
+        fn(req, res, next).catch(next);
+    };
+}
+/** Maps AppErrors to their status; everything else becomes a logged 500 with a generic message. */
+function errorHandler(logger) {
+    return (err, req, res, _next) => {
+        if (res.headersSent)
+            return;
+        const bodyError = err;
+        if (bodyError?.type === 'entity.parse.failed') {
+            res.status(400).json((0, response_js_1.errorResponse)('Malformed JSON body', undefined, 'BAD_REQUEST'));
+            return;
+        }
+        if (bodyError?.type === 'entity.too.large') {
+            res.status(413).json((0, response_js_1.errorResponse)('Request body too large', undefined, 'PAYLOAD_TOO_LARGE'));
+            return;
+        }
+        if ((0, errors_js_1.isAppError)(err)) {
+            if (err.statusCode >= 500)
+                logger?.error(err.message, { path: req.path, code: err.code, correlationId: correlationId(req) });
+            res.status(err.statusCode).json((0, response_js_1.errorResponse)((0, errors_js_1.publicMessage)(err), err.errors, err.code));
+            return;
+        }
+        const error = err instanceof Error ? err : new Error(String(err));
+        logger?.error('Unhandled error', { error: error.message, stack: error.stack, path: req.path, correlationId: correlationId(req) });
+        res.status(500).json((0, response_js_1.errorResponse)('Internal server error', undefined, 'INTERNAL_ERROR'));
+    };
+}
+function notFoundHandler() {
+    return (_req, res) => {
+        res.status(404).json((0, response_js_1.errorResponse)('Resource not found', undefined, 'NOT_FOUND'));
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/cjs/express/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":";;AAUA,sDAQC;AAED,sCAGC;AAGD,4BAIC;AAED,wCAGC;AAED,wBAGC;AAKD,4BAWC;AAGD,oCAIC;AAGD,oCAqBC;AAED,0CAIC;AA3FD,mDAAgE;AAChE,2CAAwC;AACxC,uDAAsD;AACtD,mDAAuD;AAEvD,qDAA2D;AAE3D,+FAA+F;AAC/F,SAAgB,qBAAqB;IACnC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAA,aAAK,GAAE,CAAC;QACvF,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,0BAAe,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,GAAY;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,QAAQ,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,SAAgB,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAgB,MAAM,CAAC,GAAY;IACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAID,kGAAkG;AAClG,SAAgB,QAAQ,CAAC,MAAkB,EAAE,OAAoB,MAAM;IACrE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,mBAAmB,EAAE,IAAA,4BAAiB,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAgB,YAAY,CAAgC,EAAqE;IAC/H,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAgB,YAAY,CAAC,MAAe;IAC1C,OAAO,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO;QAC5B,MAAM,SAAS,GAAG,GAAyC,CAAC;QAC5D,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,qBAAqB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,wBAAwB,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,IAAA,sBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,IAAA,yBAAa,EAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,oBAAoB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC;AACJ,CAAC"}