@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/approvals.js

@@ -0,0 +1,551 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { REVIEWER_ROLE_RANK } from '@kindgi/authz';
+import { serializePublicKeyPem, signEd25519 } from '@kindgi/crypto';
+import { canonicalize } from '@kindgi/schema';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+const APPROVAL_STATUSES = new Set([
+    'pending',
+    'assigned',
+    'in_review',
+    'approved',
+    'rejected',
+    'escalated',
+    'expired',
+    'withdrawn',
+]);
+const DECISION_KINDS = new Set([
+    'approve',
+    'reject',
+    'escalate',
+    'withdraw',
+]);
+const ROLE_VALUES = new Set(['standard', 'senior', 'admin']);
+/**
+ * Terminal approval statuses — the ones an audit bundle can be exported for.
+ * An `expired` approval has no recorded decision.
+ */
+const DECIDED_STATUSES = new Set([
+    'approved',
+    'rejected',
+    'escalated',
+    'expired',
+    'withdrawn',
+]);
+/** Audit-bundle body schema version — bump when the bundle wire shape changes. */
+const AUDIT_BUNDLE_SCHEMA_VERSION = 1;
+/**
+ * Approvals resource routes.
+ *
+ * Reviewer-role scoping: routes require `c.get('reviewerRole')` to be
+ * set by the auth middleware (see `TokenResolution.reviewerRole`).
+ * Tokens without a reviewer role get `403 permission-denied` on every
+ * approvals route — this surface is reviewer-only.
+ *
+ * Visibility filter: a caller with role `R` sees approvals whose
+ * `requiredRole` rank ≤ their rank (standard < senior < admin). The
+ * scoping is applied post-fetch on the returned rows — pushing the
+ * filter into the storage query would require a role-set predicate on
+ * `listApprovals`.
+ */
+export function approvalsRouter(conversationBinding, reviewerBinding, hitlBinding, runBinding, options = {}) {
+    const r = new Hono();
+    const signingKey = options.signingKey;
+    const runHandler = options.runHandler;
+    // ---------- role gate for the whole resource ----------
+    r.use('*', async (c, next) => {
+        const requestId = c.get('requestId');
+        const role = c.get('reviewerRole');
+        if (role === undefined) {
+            c.status(statusFor('permission-denied'));
+            return c.json(toWireError({
+                code: 'permission-denied',
+                message: 'This token was not provisioned with a reviewer role; approvals surface is reviewer-only.',
+            }, requestId));
+        }
+        await next();
+        return;
+    });
+    // ---------- GET / (list, cursor-paginated, role-scoped) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const role = c.get('reviewerRole');
+        const limit = clampLimit(c.req.query('limit'));
+        const statusRaw = c.req.query('status');
+        let statusFilter;
+        if (statusRaw !== undefined && statusRaw.length > 0) {
+            if (!APPROVAL_STATUSES.has(statusRaw)) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: `Unknown \`status\` value: ${statusRaw}` }, requestId));
+            }
+            statusFilter = statusRaw;
+        }
+        const requiredRoleRaw = c.req.query('requiredRole');
+        let requiredRoleFilter;
+        if (requiredRoleRaw !== undefined && requiredRoleRaw.length > 0) {
+            if (!ROLE_VALUES.has(requiredRoleRaw)) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({
+                    code: 'bad-input',
+                    message: `Unknown \`requiredRole\` value: ${requiredRoleRaw}`,
+                }, requestId));
+            }
+            requiredRoleFilter = requiredRoleRaw;
+            // Refuse a filter that asks for a tier the caller cannot decide —
+            // preserves the "reviewer never sees above their tier" guardrail
+            // regardless of what the caller passes.
+            if (REVIEWER_ROLE_RANK[requiredRoleFilter] > REVIEWER_ROLE_RANK[role]) {
+                c.status(statusFor('permission-denied'));
+                return c.json(toWireError({
+                    code: 'permission-denied',
+                    message: `Role ${role} cannot query approvals scoped to ${requiredRoleFilter}.`,
+                }, requestId));
+            }
+        }
+        const createdAfterRaw = c.req.query('createdAfter');
+        let createdAfterIso;
+        if (createdAfterRaw !== undefined && createdAfterRaw.length > 0) {
+            const parsed = new Date(createdAfterRaw);
+            if (Number.isNaN(parsed.getTime())) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`createdAfter` must be an ISO date string' }, requestId));
+            }
+            createdAfterIso = parsed.toISOString();
+        }
+        const cursor = c.req.query('cursor');
+        if (cursor !== undefined && cursor.length > 0) {
+            const parsed = new Date(cursor);
+            if (Number.isNaN(parsed.getTime())) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`cursor` is malformed' }, requestId));
+            }
+        }
+        // `listApprovals` takes an ISO-timestamp cursor. Over-fetch up to 4×
+        // the page size (capped at 500) so a page still fills when
+        // role-scoping filters rows out; the extra rows (or the binding's
+        // own cursor) also tell us `hasMore`.
+        const HITL_LIMIT_CAP = Math.min(limit * 4, 500);
+        const listInput = {
+            tenantId,
+            limit: HITL_LIMIT_CAP,
+            ...(statusFilter !== undefined && { status: statusFilter }),
+            ...(requiredRoleFilter !== undefined && { requiredRole: requiredRoleFilter }),
+            ...(createdAfterIso !== undefined && { since: createdAfterIso }),
+            ...(cursor !== undefined && cursor.length > 0 && { cursor: cursor }),
+        };
+        const listed = await hitlBinding.listApprovals(listInput);
+        if (listed.kind === 'err') {
+            c.status(statusFor(listed.error.code));
+            return c.json(toWireError(listed.error, requestId));
+        }
+        const roleRank = REVIEWER_ROLE_RANK[role];
+        const visible = listed.value.approvals.filter((a) => REVIEWER_ROLE_RANK[a.requiredRole] <= roleRank);
+        const page = visible.slice(0, limit);
+        const hasMore = visible.length > limit || listed.value.nextCursor !== undefined;
+        const last = page[page.length - 1];
+        const nextCursor = hasMore && last !== undefined ? last.createdAt : undefined;
+        return c.json({
+            data: page.map(serializeApproval),
+            hasMore,
+            ...(nextCursor !== undefined && { nextCursor }),
+        });
+    });
+    // ---------- GET /:approvalId (role-scoped) ----------
+    r.get('/:approvalId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const role = c.get('reviewerRole');
+        const approvalId = c.req.param('approvalId');
+        const got = await hitlBinding.getApproval(tenantId, approvalId);
+        if (got.kind === 'err') {
+            c.status(statusFor(got.error.code));
+            return c.json(toWireError(got.error, requestId));
+        }
+        const approval = got.value;
+        // Out-of-scope reads are 404 (per API-ROUTE-CONVENTIONS.md §2.4 —
+        // avoid leaking existence across role tiers).
+        if (REVIEWER_ROLE_RANK[approval.requiredRole] > REVIEWER_ROLE_RANK[role]) {
+            c.status(statusFor('approval-not-found'));
+            return c.json(toWireError({
+                code: 'approval-not-found',
+                message: `No approval with id ${approvalId}`,
+                approvalId: approvalId,
+            }, requestId));
+        }
+        return c.json(serializeApproval(approval));
+    });
+    // ---------- POST /:approvalId/complete ----------
+    r.post('/:approvalId/complete', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const role = c.get('reviewerRole');
+        const userId = c.get('userId');
+        const approvalId = c.req.param('approvalId');
+        if (userId === undefined) {
+            c.status(statusFor('permission-denied'));
+            return c.json(toWireError({
+                code: 'permission-denied',
+                message: 'Token has a reviewer role but no user identity — cannot resolve reviewer for decision.',
+            }, requestId));
+        }
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        const parsed = parseCompleteBody(body);
+        if (parsed.kind === 'err') {
+            c.status(statusFor(parsed.error.code));
+            return c.json(toWireError(parsed.error, requestId));
+        }
+        const found = await hitlBinding.getApproval(tenantId, approvalId);
+        if (found.kind === 'err') {
+            c.status(statusFor(found.error.code));
+            return c.json(toWireError(found.error, requestId));
+        }
+        const approval = found.value;
+        if (REVIEWER_ROLE_RANK[approval.requiredRole] > REVIEWER_ROLE_RANK[role]) {
+            c.status(statusFor('approval-not-found'));
+            return c.json(toWireError({
+                code: 'approval-not-found',
+                message: `No approval with id ${approvalId}`,
+                approvalId: approvalId,
+            }, requestId));
+        }
+        const reviewerId = await reviewerBinding.resolveReviewer({
+            tenantId,
+            userId: userId,
+        });
+        if (reviewerId === null) {
+            c.status(statusFor('permission-denied'));
+            return c.json(toWireError({
+                code: 'permission-denied',
+                message: 'No reviewer row registered for this user under this tenant.',
+            }, requestId));
+        }
+        const submitted = await hitlBinding.submitReview({
+            tenantId,
+            approvalId,
+            reviewerId: reviewerId,
+            decision: parsed.value.decision,
+            ...(parsed.value.rationale !== undefined && { rationale: parsed.value.rationale }),
+        });
+        if (submitted.kind === 'err') {
+            c.status(statusFor(submitted.error.code));
+            return c.json(toWireError(submitted.error, requestId));
+        }
+        // If the approval carries a waitpoint reference AND the decision is
+        // a terminal accept/reject, resolve the run's waitpoint so the
+        // suspended run resumes. Escalate/withdraw don't resume — the run
+        // stays suspended until the new (escalated) approval terminates,
+        // or the run is cancelled explicitly.
+        //
+        // Resume value shape: `{ decided, rationale? }` — the shape the
+        // agent's approval gate consumes. The caller CAN supply an explicit
+        // `value` in the wire body to override it, when the resume payload
+        // must carry more than the decision.
+        let waitpointResolved = false;
+        if (approval.waitTokenId !== undefined &&
+            approval.provenanceRef?.runId !== undefined &&
+            (parsed.value.decision === 'approve' || parsed.value.decision === 'reject')) {
+            const resumeValue = parsed.value.value !== undefined
+                ? parsed.value.value
+                : {
+                    decided: parsed.value.decision,
+                    ...(parsed.value.rationale !== undefined && { rationale: parsed.value.rationale }),
+                };
+            const resolved = await runBinding.completeToken(tenantId, approval.provenanceRef.runId, approval.waitTokenId, resumeValue);
+            if (resolved.kind === 'err') {
+                c.status(statusFor(resolved.error.code));
+                return c.json(toWireError(resolved.error, requestId));
+            }
+            waitpointResolved = true;
+            // Inline resume — when a runHandler is wired,
+            // drive resumeRun synchronously in the same request. The runtime
+            // replays from the journal; the parked run reaches its next
+            // terminal state (or re-suspends on a subsequent gate). Reviewer
+            // gets the new state in the same HTTP response.
+            //
+            // Failure here is intentionally soft: `completeToken` already
+            // journaled `wait.resumed`. The approval-complete surface reports
+            // the decision as successful; a run that stayed suspended because
+            // the inline resume failed can be resumed later.
+            if (runHandler !== undefined) {
+                try {
+                    await runHandler.resumeRun({
+                        tenantId,
+                        runId: approval.provenanceRef.runId,
+                    });
+                }
+                catch {
+                    // Soft-fail — the decision is durable; the run can be resumed later.
+                }
+            }
+        }
+        const result = submitted.value;
+        return c.json({
+            kind: result.kind,
+            approval: serializeApproval(result.approval),
+            decision: serializeDecision(result.decision),
+            ...(result.kind === 'escalated' && {
+                nextApproval: serializeApproval(result.nextApproval),
+            }),
+            waitpointResolved,
+        });
+    });
+    // ---------- POST /:approvalId/audit-bundle (signed bundle) ----------
+    r.post('/:approvalId/audit-bundle', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const role = c.get('reviewerRole');
+        const approvalId = c.req.param('approvalId');
+        if (signingKey === undefined) {
+            c.status(statusFor('signing-not-configured'));
+            return c.json(toWireError({
+                code: 'signing-not-configured',
+                message: 'This deployment does not have a `signingKey` binding mounted; signed audit bundles are unavailable.',
+            }, requestId));
+        }
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const parsed = parseAuditBundleBody(body);
+        if (parsed.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: parsed.message }, requestId));
+        }
+        const { signingKeyId, includeMessages } = parsed.value;
+        // 1. Load the approval + enforce role scoping (404 for out-of-scope).
+        const found = await hitlBinding.getApproval(tenantId, approvalId);
+        if (found.kind === 'err') {
+            c.status(statusFor(found.error.code));
+            return c.json(toWireError(found.error, requestId));
+        }
+        const approval = found.value;
+        if (REVIEWER_ROLE_RANK[approval.requiredRole] > REVIEWER_ROLE_RANK[role]) {
+            c.status(statusFor('approval-not-found'));
+            return c.json(toWireError({
+                code: 'approval-not-found',
+                message: `No approval with id ${approvalId}`,
+                approvalId: approvalId,
+            }, requestId));
+        }
+        // 2. Refuse to sign a bundle for a still-pending approval — bundles
+        //    are only meaningful post-decision.
+        if (!DECIDED_STATUSES.has(approval.status)) {
+            c.status(statusFor('approval-not-decided'));
+            return c.json(toWireError({
+                code: 'approval-not-decided',
+                message: `Approval ${approvalId} is still ${approval.status}; audit bundles are only exportable after a terminal decision.`,
+                approvalId: approvalId,
+                status: approval.status,
+            }, requestId));
+        }
+        // 3. Load the decision row (may be absent when the approval expired
+        //    without human interaction — status 'expired'). Bundle carries
+        //    `decision: null` in that case.
+        const decisionQuery = await hitlBinding.loadReviewDecision(tenantId, approvalId);
+        if (decisionQuery.kind === 'err') {
+            c.status(statusFor('persistence-error'));
+            return c.json(toWireError({
+                code: 'persistence-error',
+                message: `Failed to load review decision: ${decisionQuery.error.message}`,
+            }, requestId));
+        }
+        const decisionRow = decisionQuery.value;
+        // 4. Optionally hydrate messages tied to the approval's run.
+        let messages;
+        if (includeMessages && approval.provenanceRef?.runId !== undefined) {
+            const msgResult = await conversationBinding.readMessages({
+                tenantId,
+                conversationId: approval.provenanceRef.runId,
+            });
+            messages = msgResult.kind === 'ok' ? msgResult.value : [];
+        }
+        else if (includeMessages) {
+            messages = [];
+        }
+        // 5. Look up the private key material.
+        const privateKey = signingKey.getPrivateKey(signingKeyId);
+        if (privateKey === null) {
+            c.status(statusFor('signing-key-not-found'));
+            return c.json(toWireError({
+                code: 'signing-key-not-found',
+                message: `No signing key registered with id "${signingKeyId}"`,
+                signingKeyId: signingKeyId,
+            }, requestId));
+        }
+        const publicKeyRaw = signingKey.getPublicKey(signingKeyId);
+        if (publicKeyRaw === null) {
+            c.status(statusFor('signing-key-not-found'));
+            return c.json(toWireError({
+                code: 'signing-key-not-found',
+                message: `Signing key "${signingKeyId}" resolved a private key but no public key`,
+                signingKeyId: signingKeyId,
+            }, requestId));
+        }
+        // 6. Build the canonical bundle body.
+        const guardrailResults = extractGuardrailResults(approval.context);
+        const bundleBody = {
+            bundleVersion: AUDIT_BUNDLE_SCHEMA_VERSION,
+            approvalId: approval.id,
+            tenantId: approval.tenantId,
+            subjectKind: approval.subjectKind,
+            subjectRef: approval.subjectRef,
+            requiredRole: approval.requiredRole,
+            status: approval.status,
+            createdAt: approval.createdAt,
+            ...(approval.decidedAt !== undefined && {
+                decidedAt: approval.decidedAt,
+            }),
+            decision: decisionRow !== null
+                ? {
+                    kind: decisionRow.decision,
+                    reviewerId: decisionRow.reviewerId,
+                    reviewerRoleAtDecision: decisionRow.reviewerRoleAtDecision,
+                    decidedAt: decisionRow.decidedAt,
+                    ...(decisionRow.rationale !== undefined && { rationale: decisionRow.rationale }),
+                }
+                : null,
+            evidence: {
+                ...(guardrailResults !== undefined && { guardrailResults }),
+                ...(messages !== undefined && { messages }),
+            },
+            exportedAt: new Date().toISOString(),
+        };
+        const canonicalBundleBytes = new TextEncoder().encode(canonicalize(bundleBody));
+        // 7. Sign.
+        const signResult = signEd25519(privateKey, canonicalBundleBytes);
+        if (signResult.kind === 'err') {
+            c.status(statusFor('export-key-error'));
+            return c.json(toWireError({
+                code: 'export-key-error',
+                message: `Failed to sign audit bundle: ${signResult.error.message}`,
+            }, requestId));
+        }
+        return c.json({
+            approvalId: approvalId,
+            bundle: Buffer.from(canonicalBundleBytes).toString('base64'),
+            bundleSchemaVersion: AUDIT_BUNDLE_SCHEMA_VERSION,
+            algorithm: 'ed25519',
+            signingKeyId: signingKeyId,
+            signature: Buffer.from(signResult.value).toString('base64'),
+            publicKey: serializePublicKeyPem(publicKeyRaw),
+            canonicalization: 'sorted-key-json',
+            exportedAt: new Date().toISOString(),
+        });
+    });
+    return r;
+}
+// Extract guardrail results out of the approval's `context` envelope. HITL
+// stores kind-specific context opaquely; agent-turn approvals populate
+// `context.guardrailResults` when guardrail violations trigger the approval.
+// Absent-or-mismatched → return undefined so the bundle omits the field.
+function extractGuardrailResults(context) {
+    if (context === undefined)
+        return undefined;
+    const raw = context.guardrailResults;
+    return Array.isArray(raw) ? raw : undefined;
+}
+function serializeApproval(a) {
+    return {
+        id: a.id,
+        tenantId: a.tenantId,
+        projectId: a.projectId,
+        subjectKind: a.subjectKind,
+        subjectRef: a.subjectRef,
+        requiredRole: a.requiredRole,
+        status: a.status,
+        assignedTo: a.assignedTo,
+        batchKey: a.batchKey,
+        title: a.title,
+        description: a.description,
+        context: a.context,
+        provenanceRef: a.provenanceRef,
+        waitTokenId: a.waitTokenId,
+        createdAt: a.createdAt,
+        updatedAt: a.updatedAt,
+        decidedAt: a.decidedAt,
+        expiresAt: a.expiresAt,
+    };
+}
+function serializeDecision(d) {
+    return {
+        id: d.id,
+        approvalId: d.approvalId,
+        reviewerId: d.reviewerId,
+        decision: d.decision,
+        ...(d.rationale !== undefined && { rationale: d.rationale }),
+        reviewerRoleAtDecision: d.reviewerRoleAtDecision,
+        decidedAt: d.decidedAt,
+    };
+}
+function parseCompleteBody(body) {
+    if (body === null || typeof body !== 'object') {
+        return {
+            kind: 'err',
+            error: { code: 'bad-input', message: 'Request body must be an object' },
+        };
+    }
+    const b = body;
+    const decision = b.decision;
+    if (typeof decision !== 'string' || !DECISION_KINDS.has(decision)) {
+        return {
+            kind: 'err',
+            error: {
+                code: 'bad-input',
+                message: '`decision` must be one of: approve, reject, escalate, withdraw',
+            },
+        };
+    }
+    const rationale = b.rationale;
+    if (rationale !== undefined && typeof rationale !== 'string') {
+        return {
+            kind: 'err',
+            error: { code: 'bad-input', message: '`rationale` must be a string when supplied' },
+        };
+    }
+    const out = {
+        decision: decision,
+        ...(rationale !== undefined && { rationale }),
+        ...('value' in b && { value: b.value }),
+    };
+    return { kind: 'ok', value: out };
+}
+function parseAuditBundleBody(body) {
+    const raw = body.signingKeyId;
+    if (typeof raw !== 'string' || raw.length === 0) {
+        return { kind: 'err', message: 'Field `signingKeyId` must be a non-empty string' };
+    }
+    let includeMessages = false;
+    if ('includeMessages' in body) {
+        const im = body.includeMessages;
+        if (typeof im !== 'boolean') {
+            return { kind: 'err', message: 'Field `includeMessages` must be a boolean when present' };
+        }
+        includeMessages = im;
+    }
+    return {
+        kind: 'ok',
+        value: {
+            signingKeyId: raw,
+            includeMessages,
+        },
+    };
+}
+//# sourceMappingURL=approvals.js.map

package/dist/routes/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../src/routes/approvals.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAqB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAa9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAKtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,iBAAiB,GAAgC,IAAI,GAAG,CAAC;IAC7D,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAoC,IAAI,GAAG,CAAC;IAC9D,SAAS;IACT,QAAQ;IACR,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,WAAW,GAA8B,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAExF;;;GAGG;AACH,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IAC5D,UAAU;IACV,UAAU;IACV,WAAW;IACX,SAAS;IACT,WAAW;CACZ,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAgBtC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,mBAAwC,EACxC,eAAgC,EAChC,WAAwB,EACxB,UAAsB,EACtB,UAAkC,EAAE;IAEpC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,yDAAyD;IACzD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,0FAA0F;aAC7F,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAiB,CAAC;QACnD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,YAAwC,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAA2B,CAAC,EAAE,CAAC;gBACxD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6BAA6B,SAAS,EAAE,EAAE,EACxE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,SAA2B,CAAC;QAC7C,CAAC;QAED,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,kBAA4C,CAAC;QACjD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,eAA+B,CAAC,EAAE,CAAC;gBACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,mCAAmC,eAAe,EAAE;iBAC9D,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,kBAAkB,GAAG,eAA+B,CAAC;YACrD,kEAAkE;YAClE,iEAAiE;YACjE,wCAAwC;YACxC,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,QAAQ,IAAI,qCAAqC,kBAAkB,GAAG;iBAChF,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,eAAmC,CAAC;QACxC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,EAC3E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,2DAA2D;QAC3D,kEAAkE;QAClE,sCAAsC;QACtC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG;YAChB,QAAQ;YACR,KAAK,EAAE,cAAc;YACrB,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YAC3D,GAAG,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,kBAAkB,EAAE,CAAC;YAC7E,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,eAAuC,EAAE,CAAC;YACxF,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;SAC/E,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,QAAQ,CACtD,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;QAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,UAAU,GACd,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,SAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YACjC,OAAO;YACP,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAiB,CAAC;QACnD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAe,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC;QAC3B,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,uBAAuB,UAA+B,EAAE;gBACjE,UAAU,EAAE,UAA+B;aAC5C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAiB,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAe,CAAC;QAE3D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,wFAAwF;aAC3F,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,uBAAuB,UAA+B,EAAE;gBACjE,UAAU,EAAE,UAA+B;aAC5C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC;YACvD,QAAQ;YACR,MAAM,EAAE,MAAgB;SACzB,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,6DAA6D;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC;YAC/C,QAAQ;YACR,UAAU;YACV,UAAU,EAAE,UAAwB;YACpC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;YAC/B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,sCAAsC;QACtC,EAAE;QACF,gEAAgE;QAChE,oEAAoE;QACpE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,QAAQ,CAAC,aAAa,EAAE,KAAK,KAAK,SAAS;YAC3C,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAC3E,CAAC;YACD,MAAM,WAAW,GACf,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS;gBAC9B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK;gBACpB,CAAC,CAAC;oBACE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,QAAgC;oBACtD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;iBACnF,CAAC;YACR,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,aAAa,CAC7C,QAAQ,EACR,QAAQ,CAAC,aAAa,CAAC,KAAc,EACrC,QAAQ,CAAC,WAAW,EACpB,WAAW,CACZ,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC5B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;gBAClD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC;YAEzB,8CAA8C;YAC9C,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,gDAAgD;YAChD,EAAE;YACF,8DAA8D;YAC9D,kEAAkE;YAClE,kEAAkE;YAClE,iDAAiD;YACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,SAAS,CAAC;wBACzB,QAAQ;wBACR,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAc;qBAC7C,CAAC,CAAC;gBACL,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/B,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5C,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI;gBACjC,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC;aACrD,CAAC;YACF,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,CAAC,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAiB,CAAC;QACnD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAe,CAAC;QAE3D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAU,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,qGAAqG;aACxG,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAA+B,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAEvD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;QAC7B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAU,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,uBAAuB,UAA+B,EAAE;gBACjE,UAAU,EAAE,UAA+B;aAC5C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,wCAAwC;QACxC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAU,CAAC,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,YAAY,UAA+B,aAAa,QAAQ,CAAC,MAAM,gEAAgE;gBAChJ,UAAU,EAAE,UAA+B;gBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,oCAAoC;QACpC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjF,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,mCAAmC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE;aAC1E,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC;QAExC,6DAA6D;QAC7D,IAAI,QAAwC,CAAC;QAC7C,IAAI,eAAe,IAAI,QAAQ,CAAC,aAAa,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC;gBACvD,QAAQ;gBACR,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAkC;aAC1E,CAAC,CAAC;YACH,QAAQ,GAAG,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sCAAsC,YAAiC,GAAG;gBACnF,YAAY,EAAE,YAAiC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,gBAAgB,YAAiC,4CAA4C;gBACtG,YAAY,EAAE,YAAiC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,UAAU,GAA4B;YAC1C,aAAa,EAAE,2BAA2B;YAC1C,UAAU,EAAE,QAAQ,CAAC,EAAuB;YAC5C,QAAQ,EAAE,QAAQ,CAAC,QAA6B;YAChD,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAA8B;YAClD,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI;gBACtC,SAAS,EAAE,QAAQ,CAAC,SAA8B;aACnD,CAAC;YACF,QAAQ,EACN,WAAW,KAAK,IAAI;gBAClB,CAAC,CAAC;oBACE,IAAI,EAAE,WAAW,CAAC,QAAQ;oBAC1B,UAAU,EAAE,WAAW,CAAC,UAAU;oBAClC,sBAAsB,EAAE,WAAW,CAAC,sBAAsB;oBAC1D,SAAS,EAAE,WAAW,CAAC,SAA8B;oBACrD,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;iBACjF;gBACH,CAAC,CAAC,IAAI;YACV,QAAQ,EAAE;gBACR,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;gBAC3D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C;YACD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,MAAM,oBAAoB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhF,WAAW;QACX,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,gCAAgC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE;aACpE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,UAA+B;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,mBAAmB,EAAE,2BAA2B;YAChD,SAAS,EAAE,SAAkB;YAC7B,YAAY,EAAE,YAAiC;YAC/C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3D,SAAS,EAAE,qBAAqB,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,iBAA0B;YAC5C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAA0B;SAC7D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,SAAS,uBAAuB,CAC9B,OAAsD;IAEtD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAI,OAAmC,CAAC,gBAAgB,CAAC;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAW;IACpC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAQ1B;IACC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5D,sBAAsB,EAAE,CAAC,CAAC,sBAAsB;QAChD,SAAS,EAAE,CAAC,CAAC,SAAS;KACvB,CAAC;AACJ,CAAC;AAQD,SAAS,iBAAiB,CACxB,IAAa;IAIb,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAA8B,CAAC,EAAE,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,gEAAgE;aAC1E;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAmB;QAC1B,QAAQ,EAAE,QAA8B;QACxC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;KACxC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAOD,SAAS,oBAAoB,CAC3B,IAA6B;IAI7B,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;QAC5F,CAAC;QACD,eAAe,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,YAAY,EAAE,GAAmB;YACjC,eAAe;SAChB;KACF,CAAC;AACJ,CAAC"}

package/dist/routes/artifacts.d.ts

@@ -0,0 +1,25 @@
+import { Hono } from 'hono';
+import type { BlobStorageBinding } from '@kindgi/blob-binding';
+import type { AppEnv } from '../types.js';
+/**
+ * Artifacts resource routes over the caller-plugged, tenant-scoped
+ * `BlobStorageBinding` (from `@kindgi/blob-binding`). Five routes:
+ * multipart upload (POST) / streaming GET / HEAD / LIST / DELETE.
+ *
+ * Storage implementations (filesystem-backed for dev + tests, object
+ * stores in production) plug in through the binding.
+ *
+ * Multipart is the ONLY upload wire format. JSON-body base64 would blow
+ * up memory on large blobs. Presigned upload URLs and chunked /
+ * resumable uploads are not supported.
+ *
+ * Scope filtering — indirect. Artifacts do NOT accept the
+ * `?scopeKind + ?scopeId + ?inherit` triplet that content-scoped
+ * resources accept. A blob carries its owning run (`ownerRunId`), and
+ * that run's project is the authoritative scope anchor, so scope
+ * filtering goes through runs rather than a field on the blob metadata.
+ * Callers who want scope-narrowed artifacts should first list runs at
+ * the desired scope, then list artifacts by `?ownerRunId=`.
+ */
+export declare function artifactsRouter(binding: BlobStorageBinding): Hono<AppEnv>;
+//# sourceMappingURL=artifacts.d.ts.map

package/dist/routes/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../src/routes/artifacts.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAsC,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,CAuIzE"}