@ixo/decision-oracle 0.0.0-stage → 0.2.0

package/dist/routes/v1/api/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/me.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAIL,MAAM,EAEN,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAkB,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAExE,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAU,CAAC;AAErC,MAAM,MAAM,GAAW;IACrB,YAAY,EAAE,mBAAmB;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,oBAAoB,EAAE,sBAAsB;IAC5C,YAAY,EAAE,cAAc;CAC7B,CAAC;AAEF,8EAA8E;AAC9E,MAAM,SAAS,GAAG,CAAC,MAAoB,EAAE,GAAe,EAAE,EAAE,CAC1D,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;AAE/D,SAAS,UAAU,CAAC,MAAoB;IACtC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IACD,uFAAuF;IACvF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,kEAAkE,CAAC,CAAC;IAClG,CAAC;IACD,2FAA2F;IAC3F,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;KAC3D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAa,EAAE,MAAiB;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,MAAM;QACN,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;KACtB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAE5B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,MAAM,CAAC,IAAI,KAAK,KAAK;QACnB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAE3C,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3E,WAAW;YACT,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAC3B,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC/C,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;aAC/D,CAAC;YACJ,CAAC,CAAC,IAAI;QACR,QAAQ;YACN,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACxB,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAC5C,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aACzD,CAAC;YACJ,CAAC,CAAC,IAAI;QACR,aAAa;YACX,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC;gBACjC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;gBACrD,OAAO,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;aAC7E,CAAC;YACJ,CAAC,CAAC,IAAI;QACR,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9C,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAErE,MAAM,IAAI,GAAO;QACf,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM;QACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,aAAa;KACd,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC,CAAC,CAAC"}

package/dist/routes/v1/api/members.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A source's people (go-prod spec §3.4): invite → accept → the owner's signed grant → revoke /
+ * remove, and each member's own reviewer key (§10). A role IS the grant: this file stores what
+ * `verifyGrant` (`middleware/api/console.ts`) proved, and a revoke lists the grant's CID in
+ * `api_revocations` in the same `db.batch` as the row's stamp, so it is effective on the very next
+ * request however warm the token cache is.
+ *
+ * The source's roots are DIDs, never a role label (`sourceRoots`: the organisation entity's current
+ * controllers — D10): a root's row carries no grant and can be neither granted, revoked nor removed
+ * (409). A controller removed on chain is an ordinary member from then on: their row (if any)
+ * stays, and needs a controller's grant like anyone else's. A member of another source is `404`,
+ * never `403`.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const members: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=members.d.ts.map

package/dist/routes/v1/api/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiC5B,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAGxE,eAAO,MAAM,OAAO,qDAAqB,CAAC"}

package/dist/routes/v1/api/members.js

@@ -0,0 +1,406 @@
+/**
+ * A source's people (go-prod spec §3.4): invite → accept → the owner's signed grant → revoke /
+ * remove, and each member's own reviewer key (§10). A role IS the grant: this file stores what
+ * `verifyGrant` (`middleware/api/console.ts`) proved, and a revoke lists the grant's CID in
+ * `api_revocations` in the same `db.batch` as the row's stamp, so it is effective on the very next
+ * request however warm the token cache is.
+ *
+ * The source's roots are DIDs, never a role label (`sourceRoots`: the organisation entity's current
+ * controllers — D10): a root's row carries no grant and can be neither granted, revoked nor removed
+ * (409). A controller removed on chain is an ordinary member from then on: their row (if any)
+ * stays, and needs a controller's grant like anyone else's. A member of another source is `404`,
+ * never `403`.
+ */
+import { and, eq, isNull } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { AcceptInviteRequest, GrantMemberRequest, InviteMemberRequest, UpdateMemberRequest, } from "../../../contracts/index.js";
+import { apiMembers, apiRevocations, apiSources, } from "../../../db/schema.js";
+import { sourceRoots } from "../../../lib/api-lane/company.js";
+import { newId } from "../../../lib/api-lane/ids.js";
+import { dropLinksOf } from "../../../lib/api-lane/linked.js";
+import { emailAccessGranted, emailInvite, emailInviteAccepted, } from "../../../lib/api-lane/member-emails.js";
+import { sha256Hex } from "../../../lib/hash.js";
+import { b64urlToText, ed25519JwsVerifies, ed25519KeyOf } from "../../../lib/review/attestation.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { chainOf, verifyGrant } from "../../../middleware/api/console.js";
+import { ApiError, assertLinked } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+import { memberView } from "./views.js";
+export const members = new Hono();
+/** An email invite's token works this long (§3.4 step 2); a re-invite mints a fresh one. */
+const INVITE_TTL_MS = 7 * 24 * 60 * 60_000;
+/** A reviewer proof's `iat` may be this far from our clock either way (seconds). */
+const PROOF_SKEW_SEC = 600;
+const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+/** `inv_` + 40 base62 chars; rejection-sampled so every char is uniform. */
+function inviteToken() {
+    let out = "";
+    while (out.length < 40) {
+        for (const b of crypto.getRandomValues(new Uint8Array(48))) {
+            if (b < 248 && out.length < 40)
+                out += BASE62[b % 62];
+        }
+    }
+    return `inv_${out}`;
+}
+/** SQLite's answer when a write hits a unique index (drizzle may wrap it in a cause). */
+const isUniqueViolation = (err) => /UNIQUE constraint failed/.test(`${err} ${err?.cause ?? ""}`);
+const duplicateMember = (message) => new ApiError("CONFLICT", message, { reason: "duplicate_member" });
+/** The source's roots now (one Blocksync read once linked). */
+const rootsOf = (c, source) => sourceRoots(chainOf(c), source);
+async function memberOf(db, source, memberId) {
+    const row = await db.query.apiMembers.findFirst({
+        where: and(eq(apiMembers.sourceId, source.sourceId), eq(apiMembers.memberId, memberId)),
+    });
+    if (!row)
+        throw new ApiError("NOT_FOUND", "This member was not found on this source.");
+    return row;
+}
+function notRoot(row, roots, what) {
+    if (row.did !== null && roots.includes(row.did)) {
+        throw new ApiError("CONFLICT", `A controller of the organisation can't be ${what}: its controllers always keep full access.`, {
+            reason: "root_member",
+        });
+    }
+}
+function actorDid(c) {
+    const caller = c.get("caller");
+    return "did" in caller ? caller.did : null;
+}
+function emailDeps(c, db) {
+    return {
+        db,
+        chain: chainOf(c),
+        config: c.get("config"),
+        logger: c.get("logger"),
+        metrics: c.get("metrics"),
+        email: c.env.EMAIL,
+    };
+}
+/**
+ * A revoke's or removal's `write` in ONE batch with what must land with it: the grant's CID onto
+ * the revocation list, and the member's linked collections dropped (lib/api-lane/linked.ts) — a
+ * link rides on its linker's standing, so no read after this shows those claims. Answers the
+ * write's result and the links dropped. An open invite (no DID yet) linked nothing.
+ */
+async function withRevocation(db, c, sourceId, row, write) {
+    const drop = row.did ? dropLinksOf(db, sourceId, row.did) : null;
+    const revoke = row.delegationCid ? revokeCid(db, c, sourceId, row.delegationCid) : null;
+    const results = await db.batch([write, ...(drop ? [drop] : []), ...(revoke ? [revoke] : [])]);
+    return [results[0], drop ? results[1] : []];
+}
+/** Each link a revoke or removal dropped, audited as the hourly re-check audits its drops. */
+async function auditDroppedLinks(c, row, links) {
+    for (const { collectionId } of links) {
+        await audit(c, "source.collection_unlinked", collectionId, {
+            reason: "linker_not_member",
+            linkedBy: row.did,
+        });
+    }
+}
+/** The CID onto the source's revocation list — for life, added once. */
+const revokeCid = (db, c, sourceId, cid) => db
+    .insert(apiRevocations)
+    .values({ sourceId, cid, revokedBy: actorDid(c) })
+    .onConflictDoNothing();
+members.get("/members", access({ op: "listMembers", scope: "none", capability: null }), async (c) => {
+    const { source } = sourceOf(c);
+    const db = await c.var.db();
+    const rows = await db.query.apiMembers.findMany({
+        where: eq(apiMembers.sourceId, source.sourceId),
+        orderBy: (m, { asc }) => [asc(m.invitedAt), asc(m.memberId)],
+    });
+    const roots = await rootsOf(c, source);
+    return c.json({ items: rows.map((row) => memberView(row, roots)) });
+});
+members.post("/members", access({ op: "inviteMember", scope: "none", capability: "source/*" }), idempotent({ secretFields: ["inviteToken"] }), validate("json", InviteMemberRequest), async (c) => {
+    const { source } = sourceOf(c);
+    const body = c.req.valid("json");
+    const db = await c.var.db();
+    const roots = await rootsOf(c, source);
+    if (body.did !== undefined && roots.includes(body.did))
+        throw duplicateMember("The source's owner is already a member.");
+    // By DID the account exists, so it is accepted at once; by email it waits for `accept`.
+    const token = body.did === undefined ? inviteToken() : null;
+    const now = new Date();
+    const invite = token
+        ? {
+            inviteTokenHash: await sha256Hex(token),
+            inviteExpiresAt: new Date(now.getTime() + INVITE_TTL_MS),
+        }
+        : {};
+    let row;
+    const taken = token && body.email !== undefined
+        ? await db.query.apiMembers.findFirst({
+            where: and(eq(apiMembers.sourceId, source.sourceId), eq(apiMembers.email, body.email)),
+        })
+        : undefined;
+    if (taken) {
+        // A re-invite (§3.4 step 2): an open invite gets a FRESH token — the old one stops working
+        // — and a fresh email. Conditional, so an accept racing it wins and this one 409s.
+        if (taken.acceptedAt)
+            throw duplicateMember(`${body.email} is already a member of this source.`);
+        [row] = await db
+            .update(apiMembers)
+            .set({ ...invite, role: body.role, invitedBy: actorDid(c), revokedAt: null })
+            .where(and(eq(apiMembers.memberId, taken.memberId), isNull(apiMembers.acceptedAt)))
+            .returning();
+        if (!row)
+            throw duplicateMember(`${body.email} is already a member of this source.`);
+    }
+    else {
+        [row] = await db
+            .insert(apiMembers)
+            .values({
+            memberId: newId("mem"),
+            sourceId: source.sourceId,
+            did: body.did ?? null,
+            email: body.email ?? null,
+            role: body.role,
+            ...invite,
+            invitedBy: actorDid(c),
+            invitedAt: now,
+            acceptedAt: token ? null : now,
+        })
+            // The (sourceId, did) index is the mutex: an account is a member of a source once.
+            .onConflictDoNothing()
+            .returning();
+        if (!row)
+            throw duplicateMember("This account is already a member of this source.");
+    }
+    await audit(c, taken ? "member.reinvited" : "member.invited", row.memberId, {
+        role: row.role,
+        via: token ? "email" : "did",
+    });
+    if (token)
+        await emailInvite(emailDeps(c, db), source, row, token);
+    return c.json({ ...memberView(row, roots), inviteToken: token }, 201);
+});
+members.post("/members/accept", access({ op: "acceptInvite", scope: "none", capability: "account" }), idempotent(), validate("json", AcceptInviteRequest), async (c) => {
+    const caller = c.get("caller");
+    if (caller.kind !== "account")
+        throw new ApiError("UNAUTHORIZED", "Sign in to the Decision Console with your IXO account to accept this invitation.");
+    const hash = await sha256Hex(c.req.valid("json").inviteToken);
+    const db = await c.var.db();
+    const open = and(eq(apiMembers.inviteTokenHash, hash), isNull(apiMembers.acceptedAt));
+    const invite = await db.query.apiMembers.findFirst({
+        columns: { memberId: true, sourceId: true, inviteExpiresAt: true },
+        where: open,
+    });
+    if (!invite)
+        throw new ApiError("NOT_FOUND", "This invitation link is not valid or was already used. Ask the source's owner for a new one.");
+    // 7 days (§3.4 step 2): the owner re-invites for a fresh link. (Null: an invite from before
+    // expiries were kept — it stays open.)
+    if (invite.inviteExpiresAt && invite.inviteExpiresAt.getTime() <= Date.now()) {
+        throw new ApiError("NOT_FOUND", "This invitation has expired. Ask the source's owner to invite you again.");
+    }
+    // An account route, so no caller guard ran: a source that is not linked (an invite made before
+    // it went `disputed`) takes no new member (D10).
+    const source = await db.query.apiSources.findFirst({
+        where: eq(apiSources.sourceId, invite.sourceId),
+    });
+    if (source)
+        assertLinked(source);
+    // ONE conditional statement: a token works once, whoever races for it.
+    let row;
+    try {
+        [row] = await db
+            .update(apiMembers)
+            .set({
+            did: caller.did,
+            acceptedAt: new Date(),
+            inviteTokenHash: null,
+            inviteExpiresAt: null,
+        })
+            .where(and(eq(apiMembers.memberId, invite.memberId), open))
+            .returning();
+    }
+    catch (err) {
+        if (isUniqueViolation(err)) {
+            throw duplicateMember("This account is already a member of this source.");
+        }
+        throw err;
+    }
+    if (!row)
+        throw new ApiError("NOT_FOUND", "This invitation link is not valid or was already used. Ask the source's owner for a new one.");
+    await audit(c, "member.accepted", row.memberId, { role: row.role }, row.sourceId);
+    if (source)
+        await emailInviteAccepted(emailDeps(c, db), source, row);
+    return c.json(memberView(row, source ? await rootsOf(c, source) : []));
+});
+members.put("/members/:memberId/delegation", access({ op: "grantMember", scope: "none", capability: "source/*" }), idempotent(), validate("json", GrantMemberRequest), async (c) => {
+    const { source } = sourceOf(c);
+    const body = c.req.valid("json");
+    const db = await c.var.db();
+    const row = await memberOf(db, source, c.req.param("memberId"));
+    const roots = await rootsOf(c, source);
+    notRoot(row, roots, "granted a role");
+    if (!row.did || !row.acceptedAt) {
+        throw new ApiError("CONFLICT", "This person hasn't accepted their invitation yet; a role can be given once they have.", {
+            reason: "not_accepted",
+        });
+    }
+    const grant = await verifyGrant(c, body.delegation, {
+        source,
+        memberDid: row.did,
+        role: body.role,
+    });
+    // A role change is a revoke plus a new grant (§3.4): the replaced CID is listed in the SAME
+    // batch as the row that stops naming it. The write lands only if the row still names the grant
+    // we read — a concurrent grant would otherwise be overwritten without ever being listed.
+    const replaced = row.delegationCid && row.delegationCid !== grant.cid ? row.delegationCid : null;
+    const store = db
+        .update(apiMembers)
+        .set({
+        role: body.role,
+        delegation: grant.delegation,
+        delegationCid: grant.cid,
+        nbProtocols: grant.protocols,
+        expiresAt: grant.expiresAt,
+        revokedAt: null,
+    })
+        .where(and(eq(apiMembers.memberId, row.memberId), row.delegationCid === null
+        ? isNull(apiMembers.delegationCid)
+        : eq(apiMembers.delegationCid, row.delegationCid), 
+    // A revoke that landed since the read wins: this upload must not quietly un-revoke.
+    row.revokedAt === null
+        ? isNull(apiMembers.revokedAt)
+        : eq(apiMembers.revokedAt, row.revokedAt)))
+        .returning();
+    const [updated] = replaced
+        ? (await db.batch([revokeCid(db, c, source.sourceId, replaced), store]))[1]
+        : await store;
+    if (!updated) {
+        throw new ApiError("CONFLICT", "This member's access was changed by someone else meanwhile. Reload the member and try again.", {
+            reason: "grant_changed",
+        });
+    }
+    await audit(c, "member.granted", row.memberId, {
+        role: body.role,
+        delegationCid: grant.cid,
+        replaced,
+    });
+    await emailAccessGranted(emailDeps(c, db), source, updated, actorDid(c) ?? source.ownerDid);
+    return c.json(memberView(updated, roots));
+});
+members.post("/members/:memberId/revoke", access({ op: "revokeMember", scope: "none", capability: "source/*" }), idempotent(), async (c) => {
+    const { source } = sourceOf(c);
+    const db = await c.var.db();
+    const row = await memberOf(db, source, c.req.param("memberId"));
+    const roots = await rootsOf(c, source);
+    notRoot(row, roots, "revoked");
+    // An open invite dies with it: its token must not accept afterwards (accept never reads
+    // `revokedAt`). A re-invite mints a fresh one.
+    const stamp = db
+        .update(apiMembers)
+        .set({
+        revokedAt: row.revokedAt ?? new Date(),
+        ...(row.acceptedAt ? {} : { inviteTokenHash: null, inviteExpiresAt: null }),
+    })
+        .where(eq(apiMembers.memberId, row.memberId))
+        .returning();
+    const [[updated], dropped] = await withRevocation(db, c, source.sourceId, row, stamp);
+    if (!updated)
+        throw new ApiError("NOT_FOUND", "This member was not found on this source.");
+    await audit(c, "member.revoked", row.memberId, { delegationCid: row.delegationCid });
+    await auditDroppedLinks(c, row, dropped);
+    return c.json(memberView(updated, roots));
+});
+members.patch("/members/:memberId", access({ op: "updateMember", scope: "none", capability: "claims/review" }), idempotent(), validate("json", UpdateMemberRequest), async (c) => {
+    const caller = sourceOf(c);
+    const { source } = caller;
+    const body = c.req.valid("json");
+    const db = await c.var.db();
+    const row = await memberOf(db, source, c.req.param("memberId"));
+    // The settings are the member's own: not even the owner sets another member's.
+    if (caller.kind !== "member" || caller.memberId !== row.memberId) {
+        throw new ApiError("FORBIDDEN", "Members can only change their own reviewer key and email settings.");
+    }
+    if (typeof body.reviewerDid === "string") {
+        await checkReviewerProof(body.reviewerProof ?? "", {
+            memberId: row.memberId,
+            sourceId: source.sourceId,
+            reviewerDid: body.reviewerDid,
+        });
+    }
+    let updated;
+    try {
+        [updated] = await db
+            .update(apiMembers)
+            .set({ reviewerDid: body.reviewerDid, notifyReviews: body.notifyReviews })
+            .where(eq(apiMembers.memberId, row.memberId))
+            .returning();
+    }
+    catch (err) {
+        if (isUniqueViolation(err)) {
+            throw new ApiError("CONFLICT", "This reviewer key is already registered by another member. Each member needs their own key.", {
+                reason: "duplicate_reviewer_key",
+            });
+        }
+        throw err;
+    }
+    if (!updated)
+        throw new ApiError("NOT_FOUND", "This member was not found on this source.");
+    if (body.reviewerDid !== undefined) {
+        await audit(c, body.reviewerDid ? "member.reviewer_key_set" : "member.reviewer_key_cleared", row.memberId, { reviewerDid: body.reviewerDid ?? row.reviewerDid });
+    }
+    return c.json(memberView(updated, await rootsOf(c, source)));
+});
+members.delete("/members/:memberId", access({ op: "removeMember", scope: "none", capability: "source/*" }), idempotent(), async (c) => {
+    const { source } = sourceOf(c);
+    const db = await c.var.db();
+    const row = await memberOf(db, source, c.req.param("memberId"));
+    notRoot(row, await rootsOf(c, source), "removed");
+    const remove = db.delete(apiMembers).where(eq(apiMembers.memberId, row.memberId));
+    const [, dropped] = await withRevocation(db, c, source.sourceId, row, remove);
+    await audit(c, "member.removed", row.memberId, {
+        role: row.role,
+        delegationCid: row.delegationCid,
+    });
+    await auditDroppedLinks(c, row, dropped);
+    return c.body(null, 204);
+});
+const ProofHeader = z.object({ alg: z.literal("EdDSA"), kid: z.string().optional() });
+const ProofPayload = z.object({
+    memberId: z.string(),
+    sourceId: z.string(),
+    reviewerDid: z.string(),
+    iat: z.number().int(),
+});
+/**
+ * `reviewerProof` (§10, §14): a compact JWS signed by the did:key being registered over `{
+ * memberId, sourceId, reviewerDid, iat }` — possession of the key, bound to this member and source,
+ * fresh within ±10 min so a captured proof cannot re-enrol the key later. Any miss is
+ * `400 VALIDATION`.
+ */
+async function checkReviewerProof(jws, expected) {
+    const refuse = (why) => new ApiError("VALIDATION", `The reviewer key could not be registered: ${why}. Register it again from the console.`);
+    const [headerPart = "", payloadPart = ""] = jws.split(".");
+    let header;
+    let payload;
+    try {
+        header = ProofHeader.parse(JSON.parse(b64urlToText(headerPart)));
+        payload = ProofPayload.parse(JSON.parse(b64urlToText(payloadPart)));
+    }
+    catch {
+        throw refuse("the proof of the key is not a valid signed statement (an EdDSA JWS over { memberId, sourceId, reviewerDid, iat })");
+    }
+    if (header.kid !== undefined && header.kid !== expected.reviewerDid) {
+        throw refuse("the proof names a different key than the one being registered");
+    }
+    for (const field of ["memberId", "sourceId", "reviewerDid"]) {
+        if (payload[field] !== expected[field])
+            throw refuse(`the proof's ${field} does not match this request`);
+    }
+    if (Math.abs(Math.floor(Date.now() / 1000) - payload.iat) > PROOF_SKEW_SEC) {
+        throw refuse("the proof is more than 10 minutes old (or dated in the future) — check the device clock");
+    }
+    const key = ed25519KeyOf(expected.reviewerDid);
+    if (!key || !(await ed25519JwsVerifies(key, jws))) {
+        throw refuse("the proof is not signed by the key being registered");
+    }
+}
+//# sourceMappingURL=members.js.map

package/dist/routes/v1/api/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAGL,UAAU,EACV,cAAc,EACd,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,GAEpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,IAAI,EAAU,CAAC;AAE1C,4FAA4F;AAC5F,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC3C,oFAAoF;AACpF,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAEhF,4EAA4E;AAC5E,SAAS,WAAW;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;gBAAE,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAE,EAAE,CACzC,0BAA0B,CAAC,IAAI,CAAC,GAAG,GAAG,IAAK,GAA2B,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;AAEzF,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAC1C,IAAI,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,OAAO,GAAG,CAAC,CAAa,EAAE,MAAiB,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAEtF,KAAK,UAAU,QAAQ,CAAC,EAAY,EAAE,MAAiB,EAAE,QAAgB;IACvE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;KACxF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IACvF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,GAAc,EAAE,KAAwB,EAAE,IAAY;IACrE,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,6CAA6C,IAAI,4CAA4C,EAC7F;YACE,MAAM,EAAE,aAAa;SACtB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAa;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,CAAa,EAAE,EAAY;IAC5C,OAAO;QACL,EAAE;QACF,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACjB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QACzB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAC3B,EAAY,EACZ,CAAa,EACb,QAAgB,EAChB,GAAc,EACd,KAAQ;IAER,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxF,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAE,OAAO,CAAC,CAAC,CAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,iBAAiB,CAC9B,CAAa,EACb,GAAc,EACd,KAA0C;IAE1C,KAAK,MAAM,EAAE,YAAY,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,CAAC,EAAE,4BAA4B,EAAE,YAAY,EAAE;YACzD,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,GAAG,CAAC,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,SAAS,GAAG,CAAC,EAAY,EAAE,CAAa,EAAE,QAAgB,EAAE,GAAW,EAAE,EAAE,CAC/E,EAAE;KACC,MAAM,CAAC,cAAc,CAAC;KACtB,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,mBAAmB,EAAE,CAAC;AAE3B,OAAO,CAAC,GAAG,CACT,UAAU,EACV,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAC9D,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC/C,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KAC7D,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,IAAI,CACV,UAAU,EACV,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACrE,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,EAC7C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACpD,MAAM,eAAe,CAAC,yCAAyC,CAAC,CAAC;IACnE,wFAAwF;IACxF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC;YACE,eAAe,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC;YACvC,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC;SACzD;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,GAA0B,CAAC;IAC/B,MAAM,KAAK,GACT,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;YAClC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;SACvF,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,KAAK,EAAE,CAAC;QACV,2FAA2F;QAC3F,mFAAmF;QACnF,IAAI,KAAK,CAAC,UAAU;YAClB,MAAM,eAAe,CAAC,GAAG,IAAI,CAAC,KAAK,sCAAsC,CAAC,CAAC;QAC7E,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACb,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aAC5E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;aAClF,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG;YAAE,MAAM,eAAe,CAAC,GAAG,IAAI,CAAC,KAAK,sCAAsC,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACb,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YACtB,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;SAC/B,CAAC;YACF,mFAAmF;aAClF,mBAAmB,EAAE;aACrB,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG;YAAE,MAAM,eAAe,CAAC,kDAAkD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;QAC1E,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;KAC7B,CAAC,CAAC;IACH,IAAI,KAAK;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,IAAI,CACV,iBAAiB,EACjB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,EACpE,UAAU,EAAE,EACZ,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,kFAAkF,CACnF,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE;QAClE,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,8FAA8F,CAC/F,CAAC;IACJ,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7E,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,+FAA+F;IAC/F,iDAAiD;IACjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QACjD,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IAEjC,uEAAuE;IACvE,IAAI,GAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACb,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;aAC1D,SAAS,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,eAAe,CAAC,kDAAkD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG;QACN,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,8FAA8F,CAC/F,CAAC;IACJ,MAAM,KAAK,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClF,IAAI,MAAM;QAAE,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,GAAG,CACT,+BAA+B,EAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACpE,UAAU,EAAE,EACZ,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,uFAAuF,EACvF;YACE,MAAM,EAAE,cAAc;SACvB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE;QAClD,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IAEH,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,MAAM,QAAQ,GACZ,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC;QACH,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,GAAG;QACxB,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,IAAI;KAChB,CAAC;SACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EACrC,GAAG,CAAC,aAAa,KAAK,IAAI;QACxB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;QAClC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,CAAC,aAAa,CAAC;IACnD,oFAAoF;IACpF,GAAG,CAAC,SAAS,KAAK,IAAI;QACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAC5C,CACF;SACA,SAAS,EAAE,CAAC;IACf,MAAM,CAAC,OAAO,CAAC,GAAG,QAAQ;QACxB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,MAAM,KAAK,CAAC;IAChB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,8FAA8F,EAC9F;YACE,MAAM,EAAE,eAAe;SACxB,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,KAAK,CAAC,GAAG;QACxB,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,IAAI,CACV,2BAA2B,EAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACrE,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/B,wFAAwF;IACxF,+CAA+C;IAC/C,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC;QACH,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;QACtC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;KAC5E,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;SAC5C,SAAS,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IAC3F,MAAM,KAAK,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACrF,MAAM,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,KAAK,CACX,oBAAoB,EACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,EAC1E,UAAU,EAAE,EACZ,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACrC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,+EAA+E;IAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE;YACjD,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;aAC5C,SAAS,EAAE,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAChB,UAAU,EACV,6FAA6F,EAC7F;gBACE,MAAM,EAAE,wBAAwB;aACjC,CACF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IAC3F,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,CACT,CAAC,EACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,6BAA6B,EAC5E,GAAG,CAAC,QAAQ,EACZ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC,CACF,CAAC;AAEF,OAAO,CAAC,MAAM,CACZ,oBAAoB,EACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,EACrE,UAAU,EAAE,EACZ,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,KAAK,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC,CAAC;IACH,MAAM,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CACF,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACtB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,QAAqE;IAErE,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,IAAI,QAAQ,CACV,YAAY,EACZ,6CAA6C,GAAG,uCAAuC,CACxF,CAAC;IACJ,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,MAAmC,CAAC;IACxC,IAAI,OAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,CACV,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,MAAM,CAAC,+DAA+D,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,CAAU,EAAE,CAAC;QACrE,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC;YACpC,MAAM,MAAM,CAAC,eAAe,KAAK,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,cAAc,EAAE,CAAC;QAC3E,MAAM,MAAM,CACV,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,CAAC,qDAAqD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/routes/v1/api/meta.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The Decision API's machine-readable surface (go-prod spec §4.2): `GET /v1/api/openapi.json` and
+ * `GET /llms.txt`, both public. The document is `openapi.gen.ts` — the YAML as a module, generated
+ * with it — with `servers` pointed at THIS oracle, so a client generated from it calls the host it
+ * was fetched from. `llms.txt` (llmstxt.org) is the short read for an agent: what the API is, where
+ * the full contract lives, and the codes it branches on — the list comes from the contract, never
+ * a copy.
+ */
+import type { ApiContext } from "../../../middleware/api/types.js";
+export declare function openApiJson(c: ApiContext): Response;
+export declare function llmsTxt(c: ApiContext): Response;
+//# sourceMappingURL=meta.d.ts.map

package/dist/routes/v1/api/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAKhE,wBAAgB,WAAW,CAAC,CAAC,EAAE,UAAU,GAAG,QAAQ,CAOnD;AAaD,wBAAgB,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,QAAQ,CA4B/C"}

package/dist/routes/v1/api/meta.js

@@ -0,0 +1,59 @@
+/**
+ * The Decision API's machine-readable surface (go-prod spec §4.2): `GET /v1/api/openapi.json` and
+ * `GET /llms.txt`, both public. The document is `openapi.gen.ts` — the YAML as a module, generated
+ * with it — with `servers` pointed at THIS oracle, so a client generated from it calls the host it
+ * was fetched from. `llms.txt` (llmstxt.org) is the short read for an agent: what the API is, where
+ * the full contract lives, and the codes it branches on — the list comes from the contract, never
+ * a copy.
+ */
+import { ApiErrorCode } from "../../../contracts/errors.js";
+import { OPENAPI_DOCUMENT } from "./openapi.gen.js";
+const CACHE = "public, max-age=300";
+export function openApiJson(c) {
+    const host = c.get("config").ORACLE_HOSTNAME;
+    c.header("Cache-Control", CACHE);
+    return c.json({
+        ...OPENAPI_DOCUMENT,
+        servers: [{ url: `https://${host}`, description: "This oracle" }],
+    });
+}
+const KEY_ROUTES = [
+    ["POST /v1/api/claims", "submit one claim (`Prefer: wait=N` to wait for the decision)"],
+    ["POST /v1/api/claims/batch", "submit up to 100 claims"],
+    ["GET /v1/api/claims/{claimId}", "the claim's status and decision"],
+    ["GET /v1/api/claims/{claimId}/receipt", "the engine's signed receipt"],
+    ["POST /v1/api/claims/{claimId}/review", "answer a claim pending review"],
+    ["PUT /v1/api/uploads", "upload an attachment, reference it by uploadId"],
+    ["GET /v1/api/protocols", "the protocols this oracle evaluates, and what each asks for"],
+    ["POST /v1/api/webhooks/endpoints", "receive decisions by signed webhook"],
+];
+export function llmsTxt(c) {
+    const base = `https://${c.get("config").ORACLE_HOSTNAME}`;
+    const text = `# IXO Decision API
+
+> Submit evidence as a claim against a published protocol; this oracle produces the facts, the
+> IXO decision engine decides against the protocol's rubric, and you get the engine's signed
+> decision and receipt — synchronously, or by signed webhook. Pay per call over x402 (\`ixo-pay\`
+> scheme): an unpaid submit answers 402 with the price, the retry carries the payment.
+
+- [OpenAPI 3.1](${base}/v1/api/openapi.json): the complete contract — every route, schema and example
+
+## Key routes
+
+${KEY_ROUTES.map(([route, what]) => `- \`${route}\`: ${what}`).join("\n")}
+
+## Auth
+
+- Integrations: \`Authorization: Bearer <API key>\` (\`eo_live_…\` / \`eo_test_…\`), gated by the key's scopes.
+- Decision Console: \`Authorization: Bearer <UCAN invocation>\` from the member's did:ixo, \`X-Source-Id\` naming the source.
+- \`Idempotency-Key\` on every POST/PUT: same key + same body ⇒ the same answer for 24 h.
+
+## Errors
+
+Every non-2xx is \`{ "error": { "code", "message", "requestId", "details", "docsUrl" } }\`; branch on \`code\`:
+${ApiErrorCode.options.map((code) => `\`${code}\``).join(", ")}.
+`;
+    c.header("Cache-Control", CACHE);
+    return c.text(text);
+}
+//# sourceMappingURL=meta.js.map

package/dist/routes/v1/api/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,KAAK,GAAG,qBAAqB,CAAC;AAEpC,MAAM,UAAU,WAAW,CAAC,CAAa;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC;IAC7C,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,IAAI,CAAC;QACZ,GAAG,gBAAgB;QACnB,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;KAClE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG;IACjB,CAAC,qBAAqB,EAAE,8DAA8D,CAAC;IACvF,CAAC,2BAA2B,EAAE,yBAAyB,CAAC;IACxD,CAAC,8BAA8B,EAAE,iCAAiC,CAAC;IACnE,CAAC,sCAAsC,EAAE,6BAA6B,CAAC;IACvE,CAAC,sCAAsC,EAAE,+BAA+B,CAAC;IACzE,CAAC,qBAAqB,EAAE,gDAAgD,CAAC;IACzE,CAAC,uBAAuB,EAAE,6DAA6D,CAAC;IACxF,CAAC,iCAAiC,EAAE,qCAAqC,CAAC;CAClE,CAAC;AAEX,MAAM,UAAU,OAAO,CAAC,CAAa;IACnC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG;;;;;;;kBAOG,IAAI;;;;EAIpB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;EAWvE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;CAC7D,CAAC;IACA,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/routes/v1/api/openapi.gen.d.ts

@@ -0,0 +1,2 @@
+export declare const OPENAPI_DOCUMENT: Record<string, unknown>;
+//# sourceMappingURL=openapi.gen.d.ts.map

package/dist/routes/v1/api/openapi.gen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.gen.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/openapi.gen.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAA+/jX,CAAC"}