@ixo/decision-oracle 0.0.0-stage → 0.2.1

package/dist/routes/v1/api/claims.js

@@ -0,0 +1,407 @@
+/**
+ * Submit and read one claim (go-prod spec §4.2–§4.6; payments spec §4). The submit order is the
+ * `startApiClaim` seam's, and every step before `recordApiClaims` is free for the caller:
+ *
+ *   repeat? → paused? → protocol allowed? → work order + answers (§4.3) → pay (402 / verify,
+ *     which reserves) → recordApiClaims → startApiClaims → wait → 200 record | 202
+ *
+ * The money moves on the engine's receipt (contracts v1.3): the workflow settles after the decision
+ * row, and a `200` carrying a decision carries that settle answer as `PAYMENT-RESPONSE`.
+ *
+ * **Idempotency is the claim's own id** (§4.6): with an `Idempotency-Key` the claimId is
+ * `apc_` + 40 hex of sha256(sourceId|key), so a repeat finds the claim and answers its CURRENT
+ * state — never a second charge, never a second run; the same key over a different body is
+ * `409 IDEMPOTENCY_MISMATCH`. Without a key, a paid retry takes its claimId from the offer its
+ * nonce names, so a (402, paid retry) pair is one claim either way. The check runs before the
+ * gate (payments spec §0 rule 6).
+ *
+ * **Who pays** (§3.2): a source in billing mode `none` never meets the gate — no 402, no charge
+ * row. An `x402` source pays through S4's `PaymentGate`; with `API_PAYMENTS` off it is
+ * `503 SOURCE_PAUSED { reason: payments-disabled }`, as when the facilitator is down.
+ */
+import { eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { MAX_WAIT_SECONDS, SubmitClaimRequest, } from "../../../contracts/index.js";
+import { apiClaims } from "../../../db/schema.js";
+import { claimContent, claimRecord, recordApiClaims, startApiClaims } from "../../../lib/api-lane/index.js";
+import { newId } from "../../../lib/api-lane/ids.js";
+import { submitterFor } from "../../../lib/api-lane/submitter.js";
+import { AppError } from "../../../lib/errors.js";
+import { canonicalJson, sha256Hex } from "../../../lib/hash.js";
+import { GRANT_CAP_CENTS_PER_DAY, overGrantCap, priceDisplay } from "../../../lib/oauth/approvals.js";
+import { createPaymentGate, encodeHeader, paymentResponse, refreshRefund, } from "../../../lib/payments/index.js";
+import { validate } from "../../../lib/validator.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { ApiError, count402 } from "../../../middleware/api/errors.js";
+import { noteReserving } from "../../../middleware/api/oauth.js";
+import { awaitLanding, preferredWait } from "../../../middleware/api/wait.js";
+import { ClaimParam, claimOf, readableClaimOf } from "./claims-read.js";
+import { checkSubmission, workOrderFor } from "./work-orders.js";
+export const claims = new Hono();
+/** How long a 202 tells the client to wait before polling (§4.6). */
+const RETRY_AFTER_SEC = 5;
+/** A facilitator outage is a pause of the payment lane, not of the claim: retry soon. */
+const PAYMENTS_RETRY_SEC = 30;
+claims.post("/claims", access({ op: "submitClaim", scope: "claims:write", capability: "claims/submit" }), validate("json", SubmitClaimRequest), async (c) => {
+    const caller = sourceOf(c);
+    const body = c.req.valid("json");
+    const db = await c.var.db();
+    const idempotencyKey = idempotencyKeyOf(c);
+    const requestDigest = idempotencyKey ? await sha256Hex(canonicalJson(body)) : null;
+    const paymentHeader = c.req.header("PAYMENT-SIGNATURE") ?? null;
+    const wait = preferredWait(c.req.header("Prefer"));
+    let claimId = idempotencyKey
+        ? await keyedClaimId(caller.source.sourceId, idempotencyKey)
+        : null;
+    if (claimId) {
+        const existing = await findClaim(db, claimId);
+        if (existing)
+            return answerRepeat(c, caller, existing, requestDigest, wait);
+    }
+    const { source } = caller;
+    if (source.status === "paused") {
+        throw sourcePaused(source.pausedReason);
+    }
+    const protocolDid = protocolOf(body.protocolDid, source.allowedProtocols);
+    // `claims/submit` is never narrowed itself, but a grant's `nb.protocols` is the grant's word.
+    if (caller.kind !== "key" && caller.protocols && !caller.protocols.includes(protocolDid)) {
+        throw new ApiError("FORBIDDEN", protocolOutOfReach(protocolDid));
+    }
+    checkOAuthSubmitter(caller, body.submitter);
+    const work = await workOrderFor(c.env, protocolDid);
+    // Who the claim is about: the caller's own word, else the company's `payeeField` answer.
+    const submitter = submitterFor(body, source.payeeField);
+    // The payment first names the claim when no key did; the work-order check needs the id to
+    // tell this claim's own uploads from another claim's.
+    const pay = source.billingMode === "x402" ? await gateFor(c) : null;
+    let charge = null;
+    if (pay) {
+        if (!paymentHeader) {
+            const offered = claimId ?? newId("apc");
+            await checkSubmission(db, work, submission(body, source, [offered], submitter));
+            const body402 = await pay.run((g) => g.offer(offerFor(caller, offered, protocolDid)));
+            return paymentRequired(c, body402);
+        }
+        // Every check that can refuse runs BEFORE `verify` reserves: the gate's own (offer, payer,
+        // key cap), then this request's against the offer's items, the repeat and the submission.
+        const checked = await preflightOrNone(pay, paymentHeader, caller);
+        if (checked && !checked.ok)
+            return paymentRequired(c, checked.paymentRequired);
+        const [item] = checked?.items ?? [];
+        if (checked?.items.length !== 1 || !item || (claimId && item.claimId !== claimId)) {
+            // A header for no offer of this request (expired, another claim's, a batch's): nothing it
+            // names can be paid here, so answer what CAN be — a fresh 402 for this claim.
+            const offered = claimId ?? newId("apc");
+            await checkSubmission(db, work, submission(body, source, [offered], submitter));
+            return paymentRequired(c, await pay.run((g) => g.offer(offerFor(caller, offered, protocolDid))));
+        }
+        if (item.protocolDid !== protocolDid) {
+            throw new ApiError("VALIDATION", "The payment in the PAYMENT-SIGNATURE header is for a different protocol than this claim. Resend without it to get an offer for this claim.", {
+                issues: [{ path: "protocolDid", message: `the offer was for ${item.protocolDid}` }],
+            });
+        }
+        if (!claimId) {
+            // A paid retry without a key: the offer's claim may already be recorded (a repeat).
+            claimId = item.claimId;
+            const existing = await findClaim(db, claimId);
+            if (existing)
+                return answerRepeat(c, caller, existing, null, wait);
+        }
+        await checkSubmission(db, work, submission(body, source, [claimId], submitter));
+        // An AI app over OAuth (S7): its grant's daily cap, whatever its approvals said — except the
+        // resume of a confirmed 3-D Secure payment, whose offer was already within the cap (N5).
+        if (caller.kind === "oauth" &&
+            c.get("oauth")?.resume?.offerId !== checked?.offerId &&
+            (await overGrantCap(db, caller.grantId, item.amountCents))) {
+            throw grantCapReached();
+        }
+        const wasReserving = noteReserving(c, true);
+        const verified = await reserve(pay, paymentHeader, caller);
+        if (!verified.ok) {
+            // `/verify` refused: THIS attempt reserved nothing — but an earlier one may have (N4).
+            if (!wasReserving)
+                noteReserving(c, false);
+            return paymentRequired(c, verified.paymentRequired);
+        }
+        charge = {
+            amount: item.amount,
+            amountCents: item.amountCents,
+            offerId: verified.offerId,
+            payerDid: verified.payer,
+            paymentHeader,
+        };
+    }
+    else {
+        claimId ??= newId("apc");
+        await checkSubmission(db, work, submission(body, source, [claimId], submitter));
+    }
+    claimId ??= newId("apc");
+    const [recorded] = await recordApiClaims(c.env, [
+        {
+            claimId,
+            sourceId: source.sourceId,
+            protocolDid,
+            answers: body.answers,
+            attachments: body.attachments ?? [],
+            submitter,
+            metadata: body.metadata ?? null,
+            webhookUrl: body.webhookUrl ?? null,
+            idempotencyKey,
+            requestDigest,
+            content: claimContent(body, protocolDid),
+            keyPrefix: keyPrefixOf(caller),
+            submittedBy: submittedByOf(caller),
+            submittedVia: submittedViaOf(caller),
+            ...(caller.kind === "oauth"
+                ? { oauth: { clientId: caller.clientId, grantId: caller.grantId } }
+                : {}),
+            charge,
+        },
+    ]);
+    // Lost a race to the same key: the winner starts; this caller answers its state.
+    if (recorded?.status === "exists") {
+        const existing = await findClaim(db, claimId);
+        if (!existing)
+            throw AppError.internal(`recorded as existing but not found: ${claimId}`);
+        return answerRepeat(c, caller, existing, requestDigest, wait);
+    }
+    // Counted before the start: a claim taken is a submit even if its start fails (the reconcile
+    // starts it). `wait=0` asks nothing, so it is async.
+    c.get("metrics").count("api.submit", 1, { op: wait ? "sync" : "async" });
+    await startApiClaims(c.env, [claimId]);
+    return answerState(c, caller, claimId, wait);
+});
+claims.get("/claims/:claimId", access({ op: "getClaim", scope: "claims:read", capability: "claims/read" }), validate("param", ClaimParam), validate("query", z.object({ wait: z.coerce.number().int().min(0).optional() })), async (c) => {
+    const caller = sourceOf(c);
+    const claim = await readableClaimOf(c, c.req.valid("param").claimId);
+    // `?wait=N` or `Prefer: wait=N`, capped at 90 like the submit's (§4.1).
+    const asked = c.req.valid("query").wait ?? preferredWait(c.req.header("Prefer"));
+    const wait = asked === null ? null : Math.min(asked, MAX_WAIT_SECONDS);
+    const db = await c.var.db();
+    if (wait) {
+        const landed = await awaitLanding(db, caller.source.sourceId, claim.claimId, wait);
+        c.get("metrics").count("api.wait", 1, { op: "get", outcome: landed ? "hit" : "miss" });
+        if (landed)
+            c.header("Preference-Applied", `wait=${wait}`);
+    }
+    // A linked collection's chain claim carries the reading source (record.ts).
+    return c.json(await recordOf(db, claim.claimId, caller.source.sourceId));
+});
+/**
+ * Ask the facilitator now whether this claim's card payment was refunded, record it, and answer
+ * the record (v1.4.3). The reconcile picks refunds up on its own; this is the console's "after I
+ * refunded" read. The facilitator's word is the only one written — never the caller's. Idempotent
+ * by nature, so no `Idempotency-Key`; a claim with no card payment answers its record unchanged.
+ */
+claims.post("/claims/:claimId/payment/refresh", access({ op: "refreshClaimPayment", scope: "claims:read", capability: "claims/read" }), validate("param", ClaimParam), async (c) => {
+    const caller = sourceOf(c);
+    // API claims only: a linked chain claim was paid on chain, never by card here (§14: 404).
+    const claim = await claimOf(c, c.req.valid("param").claimId);
+    const db = await c.var.db();
+    await refreshRefund({
+        db,
+        config: c.get("config"),
+        logger: c.get("logger"),
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+    }, claim.claimId);
+    return c.json(await recordOf(db, claim.claimId, caller.source.sourceId));
+});
+// --- the repeat and the answer --------------------------------------------------------------------
+/**
+ * A claim this key already named (§4.6): its current state, never a second charge — the claim was
+ * recorded only after `/verify` reserved its price, so there is nothing left to pay.
+ */
+async function answerRepeat(c, caller, claim, requestDigest, wait) {
+    if (requestDigest !== null &&
+        claim.requestDigest !== null &&
+        claim.requestDigest !== requestDigest) {
+        throw new ApiError("IDEMPOTENCY_MISMATCH", "This Idempotency-Key was already used for a different request. Use a new key for a new request, or resend the original request unchanged.");
+    }
+    c.get("metrics").count("api.idempotent_replay", 1, { op: "submit" });
+    // A crash between record and start leaves a reserved, queued claim: starting again is free.
+    await startApiClaims(c.env, [claim.claimId]);
+    return answerState(c, caller, claim.claimId, wait);
+}
+/** `200` + the record when the decision has landed (within `wait`, if asked), else `202`. */
+async function answerState(c, caller, claimId, wait) {
+    const db = await c.var.db();
+    const landed = await awaitLanding(db, caller.source.sourceId, claimId, wait ?? 0);
+    if (wait) {
+        c.get("metrics").count("api.wait", 1, { op: "submit", outcome: landed ? "hit" : "miss" });
+    }
+    if (landed) {
+        if (wait !== null)
+            c.header("Preference-Applied", `wait=${wait}`);
+        // Payments spec §4 step 8: the decision's settle answer (for PAY usually `settlement_pending`).
+        const settled = c.get("config").X402_FACILITATOR_URL
+            ? await paymentResponse({
+                config: c.get("config"),
+                logger: c.get("logger"),
+                trace: c.get("trace"),
+                cache: c.env.CACHE_KV,
+                db,
+            }, claimId)
+            : null;
+        if (settled)
+            c.header("PAYMENT-RESPONSE", encodeHeader(settled));
+        return c.json(await recordOf(db, claimId), 200);
+    }
+    const record = await recordOf(db, claimId);
+    const pollUrl = `https://${c.get("config").ORACLE_HOSTNAME}/v1/api/claims/${claimId}`;
+    c.header("Location", pollUrl);
+    c.header("Retry-After", String(RETRY_AFTER_SEC));
+    return c.json({ claimId, status: record.status, pollUrl }, 202);
+}
+async function recordOf(db, claimId, sourceId) {
+    const record = await claimRecord(db, claimId, { sourceId });
+    if (!record)
+        throw AppError.internal(`api_claims row vanished: ${claimId}`);
+    return record;
+}
+/** The gate, or null for a free source; `API_PAYMENTS` off ⇒ `503 payments-disabled`. `run`
+ *  turns a facilitator outage into the same 503 — the payment lane is paused, not the claim. */
+export async function gateFor(c) {
+    const config = c.get("config");
+    if (!config.API_PAYMENTS)
+        throw paymentsDisabled(c);
+    const gate = createPaymentGate({
+        config,
+        logger: c.get("logger"),
+        trace: c.get("trace"),
+        cache: c.env.CACHE_KV,
+        db: await c.var.db(),
+        requestId: c.get("requestId"),
+    });
+    return {
+        gate,
+        run: async (f) => {
+            try {
+                return await f(gate);
+            }
+            catch (err) {
+                if (err instanceof AppError && err.code === "UNAVAILABLE")
+                    throw paymentsDisabled(c, err);
+                throw err;
+            }
+        },
+    };
+}
+function paymentsDisabled(c, cause) {
+    c.header("Retry-After", String(PAYMENTS_RETRY_SEC));
+    if (cause)
+        c.get("logger").warn("api.payments-unavailable", { detail: String(cause) });
+    return new ApiError("SOURCE_PAUSED", "Payments are unavailable on this oracle right now, so it can't take paid claims. Retry in a few minutes (the Retry-After header says when); if it keeps happening, contact the oracle's operator.", {
+        reason: "payments-disabled",
+    });
+}
+/** The gate's `preflight` (nothing reserved), with "no offer of yours" (`nonce_unknown`) as null —
+ *  the caller answers a fresh 402 instead of one with nothing to pay. */
+export async function preflightOrNone(pay, header, caller) {
+    try {
+        return await pay.run((g) => g.preflight(header, { sourceId: caller.source.sourceId, keyPrefix: keyPrefixOf(caller) }));
+    }
+    catch (err) {
+        const reason = err instanceof AppError && err.details?.reason;
+        if (reason === "nonce_unknown")
+            return null;
+        throw err;
+    }
+}
+/** The gate's `verify` — it RESERVES; call it only once every check that can refuse has passed. */
+export const reserve = (pay, header, caller) => pay.run((g) => g.verify(header, { sourceId: caller.source.sourceId, keyPrefix: keyPrefixOf(caller) }));
+/** The gate's 402 as it built it (the §4.1 envelope, `docsUrl` included), and the authoritative
+ *  `PAYMENT-REQUIRED` header when there is something to pay (board D30). */
+export function paymentRequired(c, body) {
+    const offered = body.error.details.paymentRequired;
+    if (offered)
+        c.header("PAYMENT-REQUIRED", encodeHeader(offered));
+    count402(c.get("metrics"), c.req.header("PAYMENT-SIGNATURE"), body.error.code);
+    return c.json(body, 402);
+}
+const offerFor = (caller, claimId, protocolDid) => ({
+    sourceId: caller.source.sourceId,
+    keyPrefix: keyPrefixOf(caller),
+    items: [{ claimId, protocolDid }],
+});
+// --- small readers -----------------------------------------------------------------------------------
+/** A console submit has no key: only the payment delegation caps it (§4.1 `SPEND_CAP`). */
+export const keyPrefixOf = (caller) => caller.kind === "key" ? caller.key.prefix : null;
+export const submission = (body, source, ownClaims, 
+/** The resolved submitter (`submitterFor`): the caller's, else the `payeeField` answer. */
+submitter) => ({
+    sourceId: source.sourceId,
+    ownClaims,
+    answers: body.answers,
+    attachments: body.attachments ?? [],
+    submitter,
+    payeeField: source.payeeField,
+});
+/**
+ * An AI app over OAuth acts for ONE person, so the claim can only be about them: an explicit
+ * `submitter` that is not the signed-in user's DID is refused (owner, 2026-10-10). A key or the
+ * console submits for its people and names whom it likes.
+ */
+export function checkOAuthSubmitter(caller, submitter, path = "submitter") {
+    if (caller.kind !== "oauth" || submitter === undefined || submitter === caller.did)
+        return;
+    throw new ApiError("VALIDATION", "Signed in through an AI app, you can only submit claims about yourself: leave `submitter` out, or send your own DID.", { issues: [{ path, message: `must be ${caller.did}` }] });
+}
+/** Who sent the claim, server-side: the OAuth user (a person); a key or the console names no one
+ *  here — the key prefix and the audit log say which integration or member it was. */
+export const submittedByOf = (caller) => caller.kind === "oauth" ? caller.did : null;
+/** Which AI app sent it. The name is the app's pick at dynamic registration, so untrusted text —
+ *  trimmed and capped at 100 characters, otherwise verbatim (a blank one falls back to the client
+ *  id) — and a display hint only, never an authorisation input; `verified` is AuthHub's. */
+export const submittedViaOf = (caller) => caller.kind === "oauth"
+    ? {
+        name: capName(caller.clientName.trim() || caller.clientId),
+        verified: caller.clientVerified,
+    }
+    : null;
+/** ≤ 100 UTF-16 code units (the contract's `max(100)` counts them), never ending in half a
+ *  surrogate pair or in whitespace the cut exposed. */
+function capName(name) {
+    const cut = name.slice(0, 100);
+    return (/[\uD800-\uDBFF]$/.test(cut) ? cut.slice(0, -1) : cut).trimEnd();
+}
+export function idempotencyKeyOf(c) {
+    const key = c.req.header("Idempotency-Key");
+    if (key === undefined)
+        return null;
+    if (key.length < 1 || key.length > 255) {
+        throw new ApiError("VALIDATION", "The Idempotency-Key header must be 1 to 255 characters long.");
+    }
+    return key;
+}
+/** `apc_` + 40 hex of sha256(sourceId|key) — the ledger's primary key IS the duplicate guard. */
+export async function keyedClaimId(sourceId, key) {
+    return `apc_${(await sha256Hex(`${sourceId}|${key}`)).slice(0, 40)}`;
+}
+export const findClaim = (db, claimId) => db.query.apiClaims.findFirst({ where: eq(apiClaims.claimId, claimId) });
+/** S3 review §8: one OAuth grant's charges over 24 h stop at `GRANT_CAP_CENTS_PER_DAY`. */
+export const grantCapReached = () => new ApiError("SPEND_CAP", `This AI app has reached its spending limit for today (${priceDisplay(GRANT_CAP_CENTS_PER_DAY)}). Wait until tomorrow, or submit from the console or with an API key.`, { reason: "grant_daily_cap" });
+/** A paused source takes no new claim; the reason stays in `details` as before. */
+export const sourcePaused = (reason) => new ApiError("SOURCE_PAUSED", `This source is paused (${reason ?? "operator"}), so it isn't taking new claims. Claims already submitted are safe; its owner can see why in the console.`, { reason: reason ?? "operator" });
+/** A member whose role is narrowed to some protocols submits under another. */
+export const protocolOutOfReach = (protocolDid) => `Your role on this source doesn't cover protocol ${protocolDid}. Ask the source's owner for access to it.`;
+/** The named protocol, which must be on the allow-list; unnamed ⇒ the source's only one (§4.3). */
+export function protocolOf(named, allowed) {
+    if (allowed.length === 0) {
+        throw new ApiError("PROTOCOL_NOT_ALLOWED", "This source has no protocol enabled yet, so it can't take claims. Ask this oracle's operator to enable one for it.");
+    }
+    if (named === undefined) {
+        const [only] = allowed;
+        if (allowed.length === 1 && only)
+            return only;
+        throw new ApiError("VALIDATION", "This source accepts several protocols, so say which one this claim is for in protocolDid.", {
+            issues: [{ path: "protocolDid", message: "required" }],
+        });
+    }
+    if (!allowed.includes(named)) {
+        throw new ApiError("PROTOCOL_NOT_ALLOWED", `Protocol ${named} is not enabled for this source. Use one of its protocols, or ask this oracle's operator to enable it.`);
+    }
+    return named;
+}
+//# sourceMappingURL=claims.js.map

package/dist/routes/v1/api/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/claims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,gBAAgB,EAEhB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAiC,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE9D,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAU,CAAC;AAEzC,qEAAqE;AACrE,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,yFAAyF;AACzF,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,CAAC,IAAI,CACT,SAAS,EACT,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,EACjF,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,EACpC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,cAAc,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnD,IAAI,OAAO,GAAG,cAAc;QAC1B,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ;YAAE,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1E,8FAA8F;IAC9F,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpD,yFAAyF;IACzF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAExD,0FAA0F;IAC1F,sDAAsD;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;YACtF,OAAO,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAClF,0FAA0F;YAC1F,8EAA8E;YAC9E,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAChF,OAAO,eAAe,CACpB,CAAC,EACD,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAChB,YAAY,EACZ,4IAA4I,EAC5I;gBACE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;aACpF,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,oFAAoF;YACpF,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,6FAA6F;QAC7F,yFAAyF;QACzF,IACE,MAAM,CAAC,IAAI,KAAK,OAAO;YACvB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,EAAE,OAAO;YACpD,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAC1D,CAAC;YACD,MAAM,eAAe,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,uFAAuF;YACvF,IAAI,CAAC,YAAY;gBAAE,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3C,OAAO,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,GAAG;YACP,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK;YACxB,aAAa;SACd,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IAEzB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE;QAC9C;YACE,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;YACnC,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;YACnC,cAAc;YACd,aAAa;YACb,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC;YACxC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC;YAC9B,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC;YAClC,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC;YACpC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;gBACzB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;SACP;KACF,CAAC,CAAC;IACH,iFAAiF;IACjF,IAAI,QAAQ,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;QACzF,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,6FAA6F;IAC7F,qDAAqD;IACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EAC3E,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAChF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,IAAI,MAAM;YAAE,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,4EAA4E;IAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,IAAI,CACT,kCAAkC,EAClC,MAAM,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACtF,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,EAC7B,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,0FAA0F;IAC1F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,aAAa,CACjB;QACE,EAAE;QACF,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;KACtB,EACD,KAAK,CAAC,OAAO,CACd,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC,CACF,CAAC;AAEF,qGAAqG;AAErG;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,CAAa,EACb,MAAoB,EACpB,KAAe,EACf,aAA4B,EAC5B,IAAmB;IAEnB,IACE,aAAa,KAAK,IAAI;QACtB,KAAK,CAAC,aAAa,KAAK,IAAI;QAC5B,KAAK,CAAC,aAAa,KAAK,aAAa,EACrC,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,2IAA2I,CAC5I,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,4FAA4F;IAC5F,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,WAAW,CACxB,CAAa,EACb,MAAoB,EACpB,OAAe,EACf,IAAmB;IAEnB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,IAAI,KAAK,IAAI;YAAE,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAClE,gGAAgG;QAChG,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,oBAAoB;YAClD,CAAC,CAAC,MAAM,eAAe,CACnB;gBACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACvB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;gBACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;gBACrB,EAAE;aACH,EACD,OAAO,CACR;YACH,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,OAAO;YAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,eAAe,kBAAkB,OAAO,EAAE,CAAC;IACtF,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAqB,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,EAAY,EAAE,OAAe,EAAE,QAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM;QAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD;gGACgG;AAChG,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,CAAa;IAEb,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC;QAC7B,MAAM;QACN,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QACrB,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;oBAAE,MAAM,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC1F,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAa,EAAE,KAAe;IACtD,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,QAAQ,CACjB,eAAe,EACf,mMAAmM,EACnM;QACE,MAAM,EAAE,mBAAmB;KAC5B,CACF,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAqD,EACrD,MAAc,EACd,MAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAC1F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,QAAQ,IAAK,GAAG,CAAC,OAA2C,EAAE,MAAM,CAAC;QACtF,IAAI,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,GAAqD,EACrD,MAAc,EACd,MAAoB,EACpB,EAAE,CACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CACvF,CAAC;AAEJ;4EAC4E;AAC5E,MAAM,UAAU,eAAe,CAAC,CAAa,EAAE,IAAyB;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;IACnD,IAAI,OAAO;QAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAE,OAAe,EAAE,WAAmB,EAAE,EAAE,CAAC,CAAC;IAChF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;IAChC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,wGAAwG;AAExG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAoB,EAAE,EAAE,CAClD,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAEnD,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,IAAwB,EACxB,MAAiB,EACjB,SAA4B;AAC5B,2FAA2F;AAC3F,SAAwB,EACxB,EAAE,CAAC,CAAC;IACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,SAAS;IACT,OAAO,EAAE,IAAI,CAAC,OAAO;IACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;IACnC,SAAS;IACT,UAAU,EAAE,MAAM,CAAC,UAAU;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAoB,EACpB,SAA6B,EAC7B,IAAI,GAAG,WAAW;IAElB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO;IAC3F,MAAM,IAAI,QAAQ,CAChB,YAAY,EACZ,sHAAsH,EACtH,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CACzD,CAAC;AACJ,CAAC;AAED;sFACsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,EAAE,CACpD,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9C;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAoB,EAA+B,EAAE,CAClF,MAAM,CAAC,IAAI,KAAK,OAAO;IACrB,CAAC,CAAC;QACE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC;QAC1D,QAAQ,EAAE,MAAM,CAAC,cAAc;KAChC;IACH,CAAC,CAAC,IAAI,CAAC;AAEX;uDACuD;AACvD,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,QAAQ,CAChB,YAAY,EACZ,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAW;IAC9D,OAAO,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAY,EAAE,OAAe,EAAE,EAAE,CACzD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AAE1E,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,EAAE,CAClC,IAAI,QAAQ,CACV,WAAW,EACX,yDAAyD,YAAY,CAAC,uBAAuB,CAAC,wEAAwE,EACtK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B,CAAC;AAEJ,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CACpD,IAAI,QAAQ,CACV,eAAe,EACf,0BAA0B,MAAM,IAAI,UAAU,4GAA4G,EAC1J,EAAE,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE,CACjC,CAAC;AAEJ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAmB,EAAE,EAAE,CACxD,mDAAmD,WAAW,4CAA4C,CAAC;AAE7G,mGAAmG;AACnG,MAAM,UAAU,UAAU,CAAC,KAAyB,EAAE,OAA0B;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,oHAAoH,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QACvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAChB,YAAY,EACZ,2FAA2F,EAC3F;YACE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;SACvD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,YAAY,KAAK,wGAAwG,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/routes/v1/api/collections-link.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Linked on-chain collections (Go Prod S3 M6): an organisation links a claim collection its
+ * signed-in member OWNS on chain (company authority D9), and the source's claim reads then include that
+ * collection's chain claims. Billing for those stays the collection owner's on-chain evaluation
+ * payment — nothing here charges, never a 402.
+ *
+ * Linking is console-only (`settings/manage`, keys cannot): the chain check is about the INVOKING
+ * member's `did:ixo`, which an API key does not have. Listing is a claims read (`claims:read` /
+ * `claims/read`). The standing check and the hourly re-check live in `lib/api-lane/linked.ts`.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const collectionsLink: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=collections-link.d.ts.map

package/dist/routes/v1/api/collections-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-link.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/collections-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAU5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D,eAAO,MAAM,eAAe,qDAAqB,CAAC"}

package/dist/routes/v1/api/collections-link.js

@@ -0,0 +1,97 @@
+/**
+ * Linked on-chain collections (Go Prod S3 M6): an organisation links a claim collection its
+ * signed-in member OWNS on chain (company authority D9), and the source's claim reads then include that
+ * collection's chain claims. Billing for those stays the collection owner's on-chain evaluation
+ * payment — nothing here charges, never a 402.
+ *
+ * Linking is console-only (`settings/manage`, keys cannot): the chain check is about the INVOKING
+ * member's `did:ixo`, which an API key does not have. Listing is a claims read (`claims:read` /
+ * `claims/read`). The standing check and the hourly re-check live in `lib/api-lane/linked.ts`.
+ */
+import { desc, eq } from "drizzle-orm";
+import { Hono } from "hono";
+import { z } from "zod";
+import { CollectionId, LinkCollectionRequest } from "../../../contracts/index.js";
+import { apiSourceCollections } from "../../../db/schema.js";
+import { collectionStanding, linkWhere } from "../../../lib/api-lane/linked.js";
+import { validate } from "../../../lib/validator.js";
+import { audit } from "../../../middleware/api/audit.js";
+import { access, sourceOf } from "../../../middleware/api/auth.js";
+import { ApiError } from "../../../middleware/api/errors.js";
+import { idempotent } from "../../../middleware/api/idempotency.js";
+export const collectionsLink = new Hono();
+const MANAGE = { scope: "none", capability: "settings/manage" };
+const CollectionParam = z.object({ collectionId: CollectionId });
+const linkView = (row) => ({
+    collectionId: row.collectionId,
+    protocolDid: row.protocolDid,
+    linkedBy: row.linkedBy,
+    linkedAt: row.linkedAt.toISOString(),
+});
+const alreadyLinked = () => new ApiError("CONFLICT", "This collection is already linked to this source; there is nothing to do.", {
+    reason: "already_linked",
+});
+collectionsLink.get("/source/collections", access({ op: "listLinkedCollections", scope: "claims:read", capability: "claims/read" }), async (c) => {
+    const caller = sourceOf(c);
+    const db = await c.var.db();
+    const rows = await db
+        .select()
+        .from(apiSourceCollections)
+        .where(eq(apiSourceCollections.sourceId, caller.source.sourceId))
+        .orderBy(desc(apiSourceCollections.linkedAt), desc(apiSourceCollections.collectionId));
+    // `claims/read` narrowed by `nb.protocols` sees only the collections of its protocols.
+    const protocols = caller.kind === "key" ? null : caller.protocols;
+    const items = rows.filter((r) => protocols === null || protocols.includes(r.protocolDid));
+    return c.json({ items: items.map(linkView) });
+});
+collectionsLink.post("/source/collections", access({ op: "linkCollection", ...MANAGE }), idempotent(), validate("json", LinkCollectionRequest), async (c) => {
+    const caller = sourceOf(c);
+    // `scope: "none"` keeps keys out; the standing checked is the invoking member's own.
+    if (caller.kind !== "member") {
+        throw new ApiError("FORBIDDEN", "Collections are linked from the Decision Console, signed in as a member of the source.");
+    }
+    const { sourceId } = caller.source;
+    const { collectionId } = c.req.valid("json");
+    const db = await c.var.db();
+    // Before the chain reads: a repeat costs no Blocksync round trip.
+    const existing = await db.query.apiSourceCollections.findFirst({
+        where: linkWhere(sourceId, collectionId),
+    });
+    if (existing)
+        throw alreadyLinked();
+    const standing = await collectionStanding({ config: c.get("config"), trace: c.get("trace") }, collectionId, caller.did);
+    if (!standing)
+        throw new ApiError("NOT_FOUND", `Collection ${collectionId} was not found on chain. Check the collection id and the network.`);
+    if (!standing.owner) {
+        throw new ApiError("FORBIDDEN", `Only the owner of collection ${collectionId} on chain can link it. Sign in with the account that owns it.`, { reason: "not_owner" });
+    }
+    const [row] = await db
+        .insert(apiSourceCollections)
+        .values({
+        sourceId,
+        collectionId,
+        protocolDid: standing.protocolDid,
+        linkedBy: caller.did,
+    })
+        .onConflictDoNothing()
+        .returning();
+    // A concurrent link landed between the read and the insert.
+    if (!row)
+        throw alreadyLinked();
+    await audit(c, "source.collection_linked", collectionId, { protocolDid: row.protocolDid });
+    return c.json(linkView(row), 201);
+});
+collectionsLink.delete("/source/collections/:collectionId", access({ op: "unlinkCollection", ...MANAGE }), idempotent(), validate("param", CollectionParam), async (c) => {
+    const { sourceId } = sourceOf(c).source;
+    const { collectionId } = c.req.valid("param");
+    const db = await c.var.db();
+    const [row] = await db
+        .delete(apiSourceCollections)
+        .where(linkWhere(sourceId, collectionId))
+        .returning({ collectionId: apiSourceCollections.collectionId });
+    // Idempotent: a link already gone is the answer asked for, audited only when one went.
+    if (row)
+        await audit(c, "source.collection_unlinked", collectionId, { reason: "member" });
+    return c.body(null, 204);
+});
+//# sourceMappingURL=collections-link.js.map

package/dist/routes/v1/api/collections-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collections-link.js","sourceRoot":"","sources":["../../../../src/routes/v1/api/collections-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAA4B,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAGjE,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,IAAI,EAAU,CAAC;AAElD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAW,CAAC;AAEzE,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;AAEjE,MAAM,QAAQ,GAAG,CAAC,GAAwB,EAAoB,EAAE,CAAC,CAAC;IAChE,YAAY,EAAE,GAAG,CAAC,YAAY;IAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,GAAG,EAAE,CACzB,IAAI,QAAQ,CACV,UAAU,EACV,2EAA2E,EAC3E;IACE,MAAM,EAAE,gBAAgB;CACzB,CACF,CAAC;AAEJ,eAAe,CAAC,GAAG,CACjB,qBAAqB,EACrB,MAAM,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,EACxF,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,EAAE;SACR,IAAI,CAAC,oBAAoB,CAAC;SAC1B,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SAChE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC;IACzF,uFAAuF;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC,CACF,CAAC;AAEF,eAAe,CAAC,IAAI,CAClB,qBAAqB,EACrB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,CAAC,EAC3C,UAAU,EAAE,EACZ,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC,EACvC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3B,qFAAqF;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,kEAAkE;IAClE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC;QAC7D,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC;KACzC,CAAC,CAAC;IACH,IAAI,QAAQ;QAAE,MAAM,aAAa,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAClD,YAAY,EACZ,MAAM,CAAC,GAAG,CACX,CAAC;IACF,IAAI,CAAC,QAAQ;QACX,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,cAAc,YAAY,mEAAmE,CAC9F,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,gCAAgC,YAAY,+DAA+D,EAC3G,EAAE,MAAM,EAAE,WAAW,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,oBAAoB,CAAC;SAC5B,MAAM,CAAC;QACN,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,MAAM,CAAC,GAAG;KACrB,CAAC;SACD,mBAAmB,EAAE;SACrB,SAAS,EAAE,CAAC;IACf,4DAA4D;IAC5D,IAAI,CAAC,GAAG;QAAE,MAAM,aAAa,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,CAAC,EAAE,0BAA0B,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC,CACF,CAAC;AAEF,eAAe,CAAC,MAAM,CACpB,mCAAmC,EACnC,MAAM,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,MAAM,EAAE,CAAC,EAC7C,UAAU,EAAE,EACZ,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,EAClC,KAAK,EAAE,CAAC,EAAE,EAAE;IACV,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,oBAAoB,CAAC;SAC5B,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;SACxC,SAAS,CAAC,EAAE,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;IAClE,uFAAuF;IACvF,IAAI,GAAG;QAAE,MAAM,KAAK,CAAC,CAAC,EAAE,4BAA4B,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1F,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC,CACF,CAAC"}

package/dist/routes/v1/api/export.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `GET /v1/api/export` (go-prod spec §6.3): the source's personal data as ONE JSON document — its
+ * settings, members (emails, DIDs), webhook endpoints (URLs, never secrets), every stored claim
+ * (body, metadata, submitter, attachment descriptors), its uploaded files (listed — a signed URL
+ * would expire long before anyone reads the archive), the webhook delivery log (targets, never
+ * payloads) and the review answers given on its claims — written to `API_UPLOADS` as an
+ * `api_uploads` row under `exports/` and handed back behind the same short-lived signed URL an
+ * upload gets. The file route serves it as an `attachment`; the row's one-day `deleteAt` lets the
+ * housekeeping sweep take it (a copy the organisation asked for, not its data). The `exports/` key
+ * is what keeps the archive from ever being named as a claim's attachment (`checkSubmission`,
+ * `acceptClaim` bind `uploads/` keys only).
+ *
+ * - **Memory stays bounded.** A source holds every body it has not erased, each up to the 1 MiB
+ *   request cap — more than a Worker can buffer. So every array is paged (claims a few at a time)
+ *   and the document streams into an R2 multipart upload in fixed parts (R2: every part but the
+ *   last the same size, ≥ 5 MiB); a part's leftover is copied out so the part's buffer can go.
+ * - **The `cid` is real.** The bytes are hashed incrementally as they stream — workerd's native
+ *   `crypto.DigestStream` (standard WebCrypto has no incremental digest; this Workers extension
+ *   does, off the JS heap) — so the row carries the same `raw` sha2-256 CID `cidForBytes` would
+ *   give the whole file — no placeholder, no etag standing in for one.
+ * - **The row lands before the object**, as an upload's does: the object exists only once the
+ *   multipart upload completes, and the row is written just before that. A failure before it
+ *   aborts the upload (R2 aborts a forgotten one after 7 days anyway); a failed `complete` leaves a
+ *   row the sweep removes harmlessly.
+ * - **Erased stays erased.** A body the erase route nulled exports as null;
+ *   nothing is re-derived from digests or webhook payloads.
+ */
+import { Hono } from "hono";
+import type { ApiEnv } from "../../../middleware/api/types.js";
+export declare const dataExport: Hono<ApiEnv, import("hono/types").BlankSchema, "/">;
+/** Text in, fixed-size multipart parts out, hashed as it goes. Exported for its test. */
+export declare class PartWriter {
+    private readonly upload;
+    private readonly hash;
+    private readonly hasher;
+    size: number;
+    private buffered;
+    private bufferedBytes;
+    private readonly parts;
+    constructor(upload: R2MultipartUpload);
+    write(text: string): Promise<void>;
+    /** The sha2-256 of everything written — once, after the last write. */
+    digest(): Promise<Uint8Array>;
+    /** The last (short) part; every part before it was exactly `PART_BYTES`. */
+    flushAll(): Promise<R2UploadedPart[]>;
+    private uploadPart;
+}
+//# sourceMappingURL=export.d.ts.map

package/dist/routes/v1/api/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../../../src/routes/v1/api/export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAoB5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAI5D,eAAO,MAAM,UAAU,qDAAqB,CAAC;AA8O7C,yFAAyF;AACzF,qBAAa,UAAU;IAQT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsC;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,IAAI,SAAK;IACT,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAE9C,YAA6B,MAAM,EAAE,iBAAiB,EAAI;IAEpD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvC;IAED,uEAAuE;IACjE,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAGlC;IAED,4EAA4E;IACtE,QAAQ,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAG1C;YAEa,UAAU;CAazB"}