@nxuss/lemma 1.43.0 → 1.44.0

package/dist/cjs/cloud/v2/routes/admin.d.ts

@@ -0,0 +1,24 @@
+import { type Router } from 'express';
+import type { IdentityStore } from '../../identity/identityStore';
+import { PlanPolicy } from '../../identity/PlanPolicy';
+import type { UsageLedger } from '../../metering';
+import { type StripeApi } from '../../billing/stripeApi';
+import { type ConsoleStore } from '../../console/ConsoleStore';
+export declare const MIN_ADMIN_TOKEN_LENGTH = 32;
+export interface AdminDeps {
+    /** The operator secret. Absent or shorter than MIN_ADMIN_TOKEN_LENGTH => admin routes are not mounted. */
+    adminToken?: string;
+    identityStore?: IdentityStore;
+    policy?: PlanPolicy;
+    usageLedger?: Pick<UsageLedger, 'computeUsage' | 'computeKeyActivity'>;
+    /** Present only when STRIPE_SECRET_KEY is configured: enables the checkout and portal routes. */
+    stripeApi?: Pick<StripeApi, 'createCheckout' | 'createPortal'>;
+    /** Present when the console is enabled: turns on the member routes. */
+    consoleStore?: ConsoleStore;
+    /** Where the console is reachable, for the sign-in links this router hands out. */
+    publicBaseUrl?: string;
+}
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+export declare function adminRouter(deps: AdminDeps): Router | null;
+export default adminRouter;
+//# sourceMappingURL=admin.d.ts.map

package/dist/cjs/cloud/v2/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":"AA6BA,OAAgB,EAAuE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAIpH,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAY,UAAU,EAAe,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI7E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAIzC,MAAM,WAAW,SAAS;IACxB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,oBAAoB,CAAC,CAAC;IACvE,iGAAiG;IACjG,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,cAAc,CAAC,CAAC;IAC/D,uEAAuE;IACvE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAiED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAmQ1D;AAED,eAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/admin.js

@@ -0,0 +1,329 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_ADMIN_TOKEN_LENGTH = void 0;
+exports.adminRouter = adminRouter;
+/**
+ * Lemma API v2 — operator routes: tenants, seats and keys.
+ *
+ * Not part of the public openapi.yaml contract (customers never call these; the
+ * operator does, from the CLI or a dashboard). Guarded by one operator secret,
+ * `LEMMA_ADMIN_TOKEN`, which is NOT an API key and resolves to no tenant. With the
+ * secret unset the router is simply not mounted, so there is nothing to probe.
+ *
+ *   POST   /v2/admin/tenants                 {id, name?, plan?}  create a company
+ *   GET    /v2/admin/tenants/:id                                  plan, seats used/limit, keys
+ *   PATCH  /v2/admin/tenants/:id             {plan}               change plan (never below seats in use)
+ *   POST   /v2/admin/tenants/:id/keys        {name}               issue a key (shown once)
+ *   DELETE /v2/admin/tenants/:id/keys/:keyId                      revoke (the dev left)
+ *   GET    /v2/admin/tenants/:id/usage?since=<epoch ms>           usage by operation and by dev
+ *   POST   /v2/admin/tenants/:id/checkout    {plan, interval, founder?, email?}  Stripe Checkout link to send the customer
+ *   POST   /v2/admin/tenants/:id/portal                           Stripe billing-portal link for a paying tenant
+ *
+ *   POST   /v2/admin/tenants/:id/members    {email, role?}        let a person sign in to the console (owner | admin | member)
+ *   GET    /v2/admin/tenants/:id/members                          who can sign in
+ *   DELETE /v2/admin/tenants/:id/members/:email                   remove them (their sessions end at once)
+ *   POST   /v2/admin/tenants/:id/members/:email/login-link        a one-time sign-in link, to hand over by hand
+ *
+ * The checkout and portal routes exist only when STRIPE_SECRET_KEY is set; the member routes only with a console store. The checkout link carries the tenant id, so paying
+ * is what links the Stripe customer to the tenant; the webhook then sets the plan.
+ *
+ * A seat is one active, unexpired key. Issuing past the plan's seat ceiling is a 429
+ * `quota_exceeded`; the check and the insert are atomic in the store.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+const express_1 = __importDefault(require("express"));
+const zod_1 = require("zod");
+const errors_1 = require("../../../contracts/errors");
+const ApiKey_1 = require("../../identity/ApiKey");
+const PlanPolicy_1 = require("../../identity/PlanPolicy");
+const inputGuard_1 = require("../inputGuard");
+const stripeApi_1 = require("../../billing/stripeApi");
+const ConsoleStore_1 = require("../../console/ConsoleStore");
+const consoleRouter_1 = require("../../console/consoleRouter");
+const memories_1 = require("./memories");
+exports.MIN_ADMIN_TOKEN_LENGTH = 32;
+const TENANT_ID = /^[a-z0-9][a-z0-9_-]{1,62}$/;
+const KEY_ID = /^key_[0-9a-f]{12}$/;
+const PlanSchema = zod_1.z.enum(PlanPolicy_1.PLAN_IDS);
+const CreateTenantSchema = zod_1.z.object({
+    id: zod_1.z.string().regex(TENANT_ID, 'id must be 2-63 chars: a-z, 0-9, "_" or "-", starting with a letter or digit'),
+    name: zod_1.z.string().max(200).optional(),
+    plan: PlanSchema.optional(),
+});
+const PatchTenantSchema = zod_1.z.object({ plan: PlanSchema });
+const AddMemberSchema = zod_1.z.object({
+    email: zod_1.z.string().trim().email().max(254),
+    role: zod_1.z.enum(ConsoleStore_1.MEMBER_ROLES).optional(),
+});
+const CheckoutSchema = zod_1.z.object({
+    plan: zod_1.z.enum(stripeApi_1.SELLABLE_PLANS),
+    interval: zod_1.z.enum(['month', 'year']),
+    /** The founder discount: first teams only, monthly billing only (a coupon on a yearly price would take 20 or 70 off once). */
+    founder: zod_1.z.boolean().optional(),
+    email: zod_1.z.string().trim().email().max(254).optional(),
+});
+const CreateKeySchema = zod_1.z.object({
+    name: zod_1.z
+        .string()
+        .trim()
+        .min(1)
+        .max(100)
+        .refine((n) => !(0, inputGuard_1.hasControlChars)(n), 'name must not contain control characters'),
+});
+const sha = (s) => crypto_1.default.createHash('sha256').update(s).digest();
+function bearer(req) {
+    const m = /^Bearer\s+(.+)$/i.exec((req.headers.authorization ?? '').trim());
+    return m ? m[1].trim() : null;
+}
+function requireAdmin(token) {
+    const expected = sha(token);
+    return (req, res, next) => {
+        const given = bearer(req);
+        // Hash both sides first so the compare is constant-time regardless of the given length.
+        if (given && crypto_1.default.timingSafeEqual(sha(given), expected))
+            return next();
+        res.status(401).set('WWW-Authenticate', 'Bearer').json(new errors_1.LemmaApiError({ code: 'unauthenticated', status: 401, message: 'missing or invalid operator token' }).toJSON());
+    };
+}
+const notFound = (what) => new errors_1.LemmaApiError({ code: 'not_found', status: 404, message: `${what} not found` });
+const publicKey = (k) => ({
+    id: k.id,
+    name: k.name,
+    prefix: k.prefix,
+    active: k.active,
+    createdAt: k.createdAt,
+    revokedAt: k.revokedAt,
+});
+const wrap = (fn) => (req, res, next) => {
+    fn(req, res).catch(next);
+};
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+function adminRouter(deps) {
+    const { adminToken, identityStore: store } = deps;
+    if (!adminToken || adminToken.length < exports.MIN_ADMIN_TOKEN_LENGTH || !store)
+        return null;
+    const policy = deps.policy ?? new PlanPolicy_1.PlanPolicy();
+    const r = express_1.default.Router();
+    r.use(requireAdmin(adminToken));
+    r.use((0, inputGuard_1.rejectUnsafeBody)());
+    const tenantParam = (req) => {
+        const id = req.params.tenantId;
+        if (!TENANT_ID.test(id))
+            throw notFound('tenant');
+        return id;
+    };
+    const tenantView = async (id) => {
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const keys = await store.listKeys(id);
+        const now = Date.now();
+        const used = keys.filter((k) => k.active && (k.expiresAt === null || k.expiresAt > now)).length;
+        return {
+            id: tenant.id,
+            name: tenant.name,
+            plan: tenant.plan,
+            createdAt: tenant.createdAt,
+            seats: { used, limit: policy.limitsFor(tenant.plan).seats },
+            keys: keys.map(publicKey),
+        };
+    };
+    r.post('/tenants', wrap(async (req, res) => {
+        const parsed = CreateTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const { id, name, plan } = parsed.data;
+        const created = await store.createTenant({ id, name: name ?? id, plan: (plan ?? 'free') });
+        if (!created)
+            throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'tenant already exists', field: 'id' });
+        res.status(201).json({ id: created.id, name: created.name, plan: created.plan });
+    }));
+    r.get('/tenants/:tenantId', wrap(async (req, res) => {
+        res.json(await tenantView(tenantParam(req)));
+    }));
+    r.patch('/tenants/:tenantId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = PatchTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const current = await tenantView(id);
+        const newSeats = policy.limitsFor(parsed.data.plan).seats;
+        if (current.seats.used > newSeats) {
+            throw new errors_1.LemmaApiError({
+                code: 'invalid_request',
+                status: 409,
+                message: `plan "${parsed.data.plan}" allows ${newSeats} seats but ${current.seats.used} are in use: revoke keys first`,
+                field: 'plan',
+            });
+        }
+        await store.setTenantPlan(id, parsed.data.plan);
+        res.json(await tenantView(id));
+    }));
+    r.post('/tenants/:tenantId/keys', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = CreateKeySchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const generated = (0, ApiKey_1.generateApiKey)(ApiKey_1.KEY_PREFIX_LIVE);
+        const result = await store.createKeyWithinSeats({ tenantId: id, name: parsed.data.name, plan: tenant.plan, prefix: ApiKey_1.KEY_PREFIX_LIVE, hash: generated.hash }, policy.limitsFor(tenant.plan).seats);
+        if (!result.ok) {
+            if (result.reason === 'no_tenant')
+                throw notFound('tenant');
+            if (result.reason === 'duplicate_name') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'an active key with that name already exists', field: 'name' });
+            }
+            throw new errors_1.LemmaApiError({
+                code: 'quota_exceeded',
+                status: 429,
+                message: `seat limit reached: ${result.used}/${result.seats} on plan "${tenant.plan}"`,
+            });
+        }
+        // The only response that ever carries the plaintext key.
+        res.status(201).json({ id: result.key.id, name: result.key.name, prefix: result.key.prefix, key: generated.key });
+    }));
+    r.delete('/tenants/:tenantId/keys/:keyId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const keyId = req.params.keyId;
+        if (!KEY_ID.test(keyId))
+            throw notFound('key');
+        // The key must belong to THIS tenant: an id from another tenant is the same 404.
+        const keys = await store.listKeys(id);
+        if (!keys.some((k) => k.id === keyId))
+            throw notFound('key');
+        await store.revokeKey(keyId);
+        res.json({ revoked: [keyId] });
+    }));
+    r.get('/tenants/:tenantId/usage', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        if (!(await store.getTenant(id)))
+            throw notFound('tenant');
+        const ledger = deps.usageLedger;
+        if (!ledger || !ledger.computeKeyActivity)
+            throw new errors_1.LemmaApiError({ code: 'not_implemented', status: 501, message: 'usage ledger unavailable' });
+        const rawSince = req.query.since;
+        let since;
+        if (rawSince !== undefined) {
+            // Digits only: Number('') is 0 and Number(' 5 ') is 5, neither of which is a timestamp anyone meant.
+            since = typeof rawSince === 'string' && /^\d{1,16}$/.test(rawSince) ? Number(rawSince) : NaN;
+            if (!Number.isSafeInteger(since)) {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 400, message: 'since must be a non-negative integer (epoch ms)', field: 'since' });
+            }
+        }
+        const [usage, activity, keys] = await Promise.all([
+            ledger.computeUsage({ tenantId: id, since }),
+            ledger.computeKeyActivity({ tenantId: id, since }),
+            store.listKeys(id),
+        ]);
+        const names = new Map(keys.map((k) => [k.id, k.name]));
+        res.json({
+            tenantId: id,
+            since: since ?? null,
+            metrics: usage.metrics,
+            excludedEvents: usage.excludedEvents,
+            // One row per key that made calls, with the dev's name and whether the key is still live.
+            keys: activity.map((a) => ({
+                keyId: a.keyId,
+                name: names.get(a.keyId) ?? null,
+                active: keys.find((k) => k.id === a.keyId)?.active ?? false,
+                requests: a.requests,
+                tokens: a.tokens,
+                byOperation: a.byOperation,
+            })),
+        });
+    }));
+    if (deps.stripeApi) {
+        const stripeApi = deps.stripeApi;
+        // A subscription in any of these states already pays for the tenant: a second one would bill twice.
+        const LIVE_SUBSCRIPTION = new Set(['active', 'trialing', 'past_due', 'unpaid', 'incomplete']);
+        r.post('/tenants/:tenantId/checkout', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = CheckoutSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw (0, memories_1.zodToApiError)(parsed.error);
+            const { plan, interval, founder = false, email } = parsed.data;
+            if (founder && interval !== 'month') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 400, message: 'the founder price is for monthly billing only', field: 'founder' });
+            }
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (tenant.plan === 'internal') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'an internal tenant is not sold through Stripe' });
+            }
+            const status = tenant.billing.status;
+            if (tenant.billing.subscriptionId && status && LIVE_SUBSCRIPTION.has(status)) {
+                throw new errors_1.LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: `this tenant already has a subscription (${status}): change it in the billing portal instead`,
+                });
+            }
+            const link = await stripeApi.createCheckout({ tenantId: id, plan, interval, founder, existingCustomerId: tenant.billing.customerId, email });
+            res.status(201).json({ tenantId: id, plan, interval, founder, trialDays: 14, url: link.url, expiresAt: link.expiresAt });
+        }));
+        r.post('/tenants/:tenantId/portal', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (!tenant.billing.customerId) {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'this tenant has no Stripe customer yet: send it a checkout link first' });
+            }
+            res.json({ tenantId: id, url: (await stripeApi.createPortal(tenant.billing.customerId)).url });
+        }));
+    }
+    if (deps.consoleStore) {
+        const consoleStore = deps.consoleStore;
+        r.post('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = AddMemberSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw (0, memories_1.zodToApiError)(parsed.error);
+            const added = await consoleStore.addMember(id, parsed.data.email, parsed.data.role ?? 'member');
+            if (!added.ok) {
+                if (added.reason === 'no_tenant')
+                    throw notFound('tenant');
+                throw new errors_1.LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: added.reason === 'exists' ? 'that person is already a member of this tenant' : 'that email already belongs to another tenant',
+                    field: 'email',
+                });
+            }
+            res.status(201).json({ id: added.member.id, email: added.member.email, role: added.member.role });
+        }));
+        r.get('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await store.getTenant(id)))
+                throw notFound('tenant');
+            res.json({ members: (await consoleStore.listMembers(id)).map((m) => ({ email: m.email, role: m.role })) });
+        }));
+        r.delete('/tenants/:tenantId/members/:email', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await consoleStore.removeMember(id, req.params.email)))
+                throw notFound('member');
+            res.json({ removed: req.params.email.trim().toLowerCase() });
+        }));
+        r.post('/tenants/:tenantId/members/:email/login-link', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const member = await consoleStore.findMemberByEmail(req.params.email);
+            // Another tenant's member is the same 404 as a stranger: this route never confirms who belongs where.
+            if (!member || member.tenantId !== id)
+                throw notFound('member');
+            const issued = await (0, consoleRouter_1.issueLoginLink)(consoleStore, member.email, Date.now());
+            if (!issued)
+                throw notFound('member');
+            res.status(201).json({ email: issued.email, url: (0, consoleRouter_1.loginLink)((0, consoleRouter_1.publicBase)(req, deps.publicBaseUrl), issued.token), expiresAt: issued.expiresAt });
+        }));
+    }
+    r.use((_req, _res, next) => next(notFound('route')));
+    return r;
+}
+exports.default = adminRouter;
+//# sourceMappingURL=admin.js.map

package/dist/cjs/cloud/v2/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":";;;;;;AA4HA,kCAmQC;AA/XD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,oDAA4B;AAC5B,sDAAoH;AACpH,6BAAwB;AACxB,sDAA0D;AAC1D,kDAAwE;AAExE,0DAA8E;AAE9E,8CAAkE;AAClE,uDAAyE;AACzE,6DAA6E;AAC7E,+DAAoF;AACpF,yCAA2C;AAE9B,QAAA,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC;AAgBpC,MAAM,UAAU,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAQ,CAAC,CAAC;AACpC,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,8EAA8E,CAAC;IAC/G,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACzD,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,2BAAY,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,0BAAc,CAAC;IAC5B,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,8HAA8H;IAC9H,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,4BAAe,EAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAElF,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,KAAK,IAAI,gBAAM,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CACpD,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CACnH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;AAEvH,MAAM,SAAS,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,IAAI,GACR,CAAC,EAAkD,EAAkB,EAAE,CACvE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAClD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEJ,wGAAwG;AACxG,SAAgB,WAAW,CAAC,IAAe;IACzC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,8BAAsB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,uBAAU,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,IAAA,6BAAgB,GAAE,CAAC,CAAC;IAE1B,MAAM,WAAW,GAAG,CAAC,GAAY,EAAU,EAAE;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;SAC1B,CAAC;IACJ,CAAC,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,UAAU,EACV,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,CAAW,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,KAAK,CACL,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAC1D,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAa,CAAC;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,QAAQ,cAAc,OAAO,CAAC,KAAK,CAAC,IAAI,gCAAgC;gBACtH,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,yBAAyB,EACzB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uBAAc,EAAC,wBAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAC7C,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAe,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CACpC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3I,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,uBAAuB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,IAAI,GAAG;aACvF,CAAC,CAAC;QACL,CAAC;QACD,yDAAyD;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,MAAM,CACN,gCAAgC,EAChC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,iFAAiF;QACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,0BAA0B,EAC1B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,qGAAqG;YACrG,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC5C,MAAM,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAClD,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,0FAA0F;YAC1F,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI;gBAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,KAAK;gBAC3D,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,oGAAoG;QACpG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAE9F,CAAC,CAAC,IAAI,CACJ,6BAA6B,EAC7B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/D,IAAI,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC9H,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,sBAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,2CAA2C,MAAM,4CAA4C;iBACvG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7I,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3H,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,2BAA2B,EAC3B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;YACtJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAEvC,CAAC,CAAC,IAAI,CACJ,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;oBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,MAAM,IAAI,sBAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,8CAA8C;oBACtI,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,GAAG,CACH,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,MAAM,CACN,mCAAmC,EACnC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,8CAA8C,EAC9C,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,sGAAsG;YACtG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAc,EAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAA,yBAAS,EAAC,IAAA,0BAAU,EAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAChJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kBAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/entitlement.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lemma API v2 — GET /v2/entitlement
+ *
+ * What the presented key may do on the client, beyond the API itself: today, whether a seat on this
+ * plan also unlocks the local Pro tools. The answer comes from the tenant's plan (PLAN_INCLUDES_PRO),
+ * never from anything the caller sends. A revoked or expired key never gets here: authenticateV2
+ * answers it 401 first, which is how a client learns a seat was taken away.
+ */
+import type { RequestHandler } from 'express';
+/** GET /v2/entitlement */
+export declare function entitlementHandler(): RequestHandler;
+export default entitlementHandler;
+//# sourceMappingURL=entitlement.d.ts.map

package/dist/cjs/cloud/v2/routes/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C,0BAA0B;AAC1B,wBAAgB,kBAAkB,IAAI,cAAc,CAenD;AAED,eAAe,kBAAkB,CAAC"}

package/dist/cjs/cloud/v2/routes/entitlement.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entitlementHandler = entitlementHandler;
+const PlanPolicy_1 = require("../../identity/PlanPolicy");
+/** GET /v2/entitlement */
+function entitlementHandler() {
+    return (req, res, next) => {
+        try {
+            const { tenant } = req;
+            const body = {
+                tenantId: tenant.id,
+                plan: tenant.plan,
+                includesPro: PlanPolicy_1.PLAN_INCLUDES_PRO[tenant.plan] === true,
+                ...(tenant.keyName ? { keyName: tenant.keyName } : {}),
+            };
+            res.json(body);
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+exports.default = entitlementHandler;
+//# sourceMappingURL=entitlement.js.map

package/dist/cjs/cloud/v2/routes/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":";;AAcA,gDAeC;AAlBD,0DAA8D;AAE9D,0BAA0B;AAC1B,SAAgB,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAA2B,CAAC;YAC/C,MAAM,IAAI,GAAwB;gBAChC,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,8BAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;gBACpD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,kBAAe,kBAAkB,CAAC"}

package/dist/cjs/cloud/v2/routes/index.d.ts

@@ -18,7 +18,20 @@ import { type MemoriesDeps } from './memories';
 import { type RecallDeps } from './recall';
 import { type VerifyDeps } from './verify';
 import { type UsageDeps } from './usage';
-export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps;
+import { type AdminDeps } from './admin';
+import type { StripeBillingConfig } from '../../billing/stripeWebhook';
+import type { ConsoleStore } from '../../console/ConsoleStore';
+import type { LoginMailer } from '../../console/mailer';
+export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps & AdminDeps & {
+    billing?: StripeBillingConfig;
+    /** The web console: members, sign-in links and sessions. Absent => /console and the member routes are not mounted. */
+    consoleStore?: ConsoleStore;
+    loginMailer?: LoginMailer;
+    /** Where the console is reachable (CLOUD_PUBLIC_URL), for links in emails. */
+    publicBaseUrl?: string;
+    consoleDir?: string;
+    insecureCookies?: boolean;
+};
 export declare function mountRoutes(app: Express, deps: MountDeps): void;
 export default mountRoutes;
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/cloud/v2/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAIvD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhG,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAuB/D;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA8D,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3G,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG;IAC1G,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,sHAAsH;IACtH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEJ,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAyD/D;AAED,eAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/index.js

@@ -6,8 +6,14 @@ const memories_1 = require("./memories");
 const recall_1 = require("./recall");
 const verify_1 = require("./verify");
 const usage_1 = require("./usage");
+const entitlement_1 = require("./entitlement");
+const tenant_1 = require("./tenant");
 const scrub_1 = require("./scrub");
 const errors_1 = require("../../../contracts/errors");
+const inputGuard_1 = require("../inputGuard");
+const admin_1 = require("./admin");
+const usageRecorder_1 = require("../usageRecorder");
+const consoleRouter_1 = require("../../console/consoleRouter");
 function mountRoutes(app, deps) {
     // Public: no tenant, no auth (Lane F, stateless).
     const scrub = (0, scrub_1.scrubRouter)();
@@ -22,14 +28,44 @@ function mountRoutes(app, deps) {
             next(err);
         }
     });
+    // Operator routes: their own secret, mounted only when LEMMA_ADMIN_TOKEN is strong enough.
+    const admin = (0, admin_1.adminRouter)({ adminToken: deps.adminToken, identityStore: deps.identityStore, policy: deps.policy, usageLedger: deps.usageLedger, stripeApi: deps.stripeApi, consoleStore: deps.consoleStore, publicBaseUrl: deps.publicBaseUrl });
+    if (admin)
+        app.use('/v2/admin', admin);
+    // The web console has its own identity (a person's session, not an API key), so it sits outside the /v2 key auth.
+    if (deps.consoleStore && deps.identityStore) {
+        app.use('/console', (0, consoleRouter_1.consoleRouter)({
+            consoleStore: deps.consoleStore,
+            identityStore: deps.identityStore,
+            policy: deps.policy,
+            store: deps.store,
+            rateLimiter: deps.rateLimiter,
+            rateLimitWindowMs: deps.rateLimitWindowMs,
+            usageLedger: deps.usageLedger,
+            stripeApi: deps.stripeApi,
+            mailer: deps.loginMailer,
+            publicBaseUrl: deps.publicBaseUrl,
+            consoleDir: deps.consoleDir,
+            insecureCookies: deps.insecureCookies,
+            now: deps.now,
+        }));
+    }
     // Everything below requires a valid tenant.
     const auth = (0, authenticateV2_1.authenticateV2)(deps);
     app.use('/v2', auth);
+    // After auth, so an unauthenticated probe still gets 401. /v2/scrub is mounted above
+    // and stays untouched: it is stateless and never reaches a store.
+    app.use('/v2', (0, inputGuard_1.rejectUnsafeBody)());
+    app.use('/v2', (0, usageRecorder_1.usageRecorder)(deps.usageLedger));
+    app.param('id', inputGuard_1.rejectUnsafeIdParam);
     app.post('/v2/memories', (0, memories_1.createMemoryHandler)(deps));
+    app.get('/v2/memories/:id', (0, memories_1.getMemoryHandler)(deps));
     app.delete('/v2/memories/:id', (0, memories_1.forgetMemoryHandler)(deps));
     app.post('/v2/recall', (0, recall_1.recallHandler)(deps));
     app.post('/v2/verify', (0, verify_1.verifyHandler)(deps));
     app.get('/v2/usage', (0, usage_1.usageHandler)(deps));
+    app.get('/v2/entitlement', (0, entitlement_1.entitlementHandler)());
+    app.get('/v2/tenant', (0, tenant_1.tenantOverviewHandler)(deps));
 }
 exports.default = mountRoutes;
 //# sourceMappingURL=index.js.map

package/dist/cjs/cloud/v2/routes/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":";;AAyBA,kCAuBC;AAjCD,kEAAwF;AACxF,yCAAyF;AACzF,qCAA0D;AAC1D,qCAA0D;AAC1D,mCAAuD;AACvD,mCAAsC;AACtC,sDAA0D;AAI1D,SAAgB,WAAW,CAAC,GAAY,EAAE,IAAe;IACvD,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAA,mBAAW,GAAE,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAA,+BAAc,EAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAErB,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAA,8BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,8BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAA,oBAAY,EAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,kBAAe,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":";;AA2CA,kCAyDC;AArFD,kEAAwF;AACxF,yCAA2G;AAC3G,qCAA0D;AAC1D,qCAA0D;AAC1D,mCAAuD;AACvD,+CAAmD;AACnD,qCAAiD;AACjD,mCAAsC;AACtC,sDAA0D;AAC1D,8CAAsE;AACtE,mCAAsD;AACtD,oDAAiD;AAEjD,+DAA4D;AAe5D,SAAgB,WAAW,CAAC,GAAY,EAAE,IAAe;IACvD,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAA,mBAAW,GAAE,CAAC;IAC5B,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2FAA2F;IAC3F,MAAM,KAAK,GAAG,IAAA,mBAAW,EAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACjP,IAAI,KAAK;QAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAEvC,kHAAkH;IAClH,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,GAAG,CAAC,GAAG,CACL,UAAU,EACV,IAAA,6BAAa,EAAC;YACZ,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,MAAM,IAAI,GAAG,IAAA,+BAAc,EAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrB,qFAAqF;IACrF,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAA,6BAAgB,GAAE,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,IAAA,6BAAa,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,gCAAmB,CAAC,CAAC;IAErC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAA,8BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAA,2BAAgB,EAAC,IAAI,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,8BAAmB,EAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,IAAA,sBAAa,EAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAA,oBAAY,EAAC,IAAI,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAA,gCAAkB,GAAE,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,IAAA,8BAAqB,EAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,kBAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/memories.d.ts

@@ -1,9 +1,10 @@
 import type { RequestHandler } from 'express';
 import { z, type ZodError } from 'zod';
 import { LemmaApiError } from '../../../contracts/errors';
-import type { CreateMemoryRequest, MemoryClaim, MemoryState } from '../../../contracts/api-v2.types';
+import type { CreateMemoryRequest, MemoryAuthor, MemoryClaim, ProjectRef, MemoryState, MemoryView } from '../../../contracts/api-v2.types';
 import type { Evidence } from '../../../contracts/evidence';
 import type { BrainStore } from '../../../contracts/store';
+import { PlanPolicy } from '../../identity/PlanPolicy';
 export declare const MAX_CLAIMS = 50;
 export declare const MAX_VERIFY_IDS = 200;
 export declare const MAX_BODY_BYTES = 1000000;
@@ -30,6 +31,10 @@ export declare const CreateMemoryRequestSchema: z.ZodObject<{
         branch: z.ZodOptional<z.ZodString>;
         commit: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
+    project: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     derivedFrom: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 /** Turns the first zod issue into the API's stable invalid_request shape — never a raw zod dump. */
@@ -43,8 +48,18 @@ export interface StoredMemory {
     query: string;
     response: string;
     createdAt: number;
+    /** The key that wrote it. Absent on memories stored before authorship existed. */
+    author?: MemoryAuthor;
+    /** The repo it was written in. Absent on memories stored before projects were recorded. */
+    project?: ProjectRef;
 }
 declare function isStoredMemory(v: unknown): v is StoredMemory;
+/**
+ * The wire view of a stored memory: readable claims + provenance. The freshness
+ * hashes on each claim are deliberately dropped — they are server-side state and
+ * were never part of any response schema (see CreateMemoryResponse).
+ */
+export declare function toMemoryView(id: string, memory: StoredMemory): MemoryView;
 /**
  * Builds the persisted claims from the request: each claim only tracks the
  * files/symbols it explicitly declared, hashed from the top-level `evidence`
@@ -72,10 +87,14 @@ export interface MemoryStateResult {
  */
 export declare function computeMemoryState(claims: MemoryClaim[], currentEvidence: Evidence | undefined): MemoryStateResult;
 export interface MemoriesDeps {
-    store: Pick<BrainStore, 'put' | 'get' | 'delete'>;
+    store: Pick<BrainStore, 'put' | 'get' | 'delete' | 'count'>;
+    /** Ceilings per plan; the store route refuses a new memory past `activeMemories`. */
+    policy?: PlanPolicy;
 }
 /** POST /v2/memories */
 export declare function createMemoryHandler(deps: MemoriesDeps): RequestHandler;
+/** GET /v2/memories/:id — read one memory's content (no freshness; use /v2/verify for that). */
+export declare function getMemoryHandler(deps: Pick<MemoriesDeps, 'store'>): RequestHandler;
 /** DELETE /v2/memories/:id */
 export declare function forgetMemoryHandler(deps: MemoriesDeps): RequestHandler;
 export { isStoredMemory };

package/dist/cjs/cloud/v2/routes/memories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memories.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/memories.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,mBAAmB,EAGnB,WAAW,EACX,WAAW,EACZ,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAM3D,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,cAAc,UAAY,CAAC;AAIxC,eAAO,MAAM,cAAc;;;;;;iBAMK,CAAC;AAEjC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;iBAapC,CAAC;AAEH,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAS5D;AAID;;qEAEqE;AACrE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iBAAS,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,YAAY,CAMrD;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,WAAW,EAAE,CA4CpE;AAyDD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,eAAe,EAAE,QAAQ,GAAG,SAAS,GAAG,iBAAiB,CAoBlH;AAID,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;CACnD;AAED,wBAAwB;AACxB,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CA+BtE;AAED,8BAA8B;AAC9B,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAoBtE;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"memories.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/memories.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,KAAK,QAAQ,EAAE,MAAM,KAAK,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EACV,mBAAmB,EAGnB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,UAAU,EACX,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAK3D,OAAO,EAAE,UAAU,EAAkB,MAAM,2BAA2B,CAAC;AAIvE,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,cAAc,MAAM,CAAC;AAClC,eAAO,MAAM,cAAc,UAAY,CAAC;AAIxC,eAAO,MAAM,cAAc;;;;;;iBAMK,CAAC;AAEjC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;iBAoBpC,CAAC;AAEH,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAS5D;AAID;;qEAEqE;AACrE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,iBAAS,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,YAAY,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,UAAU,CAqBzE;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,WAAW,EAAE,CA4CpE;AAyDD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,eAAe,EAAE,QAAQ,GAAG,SAAS,GAAG,iBAAiB,CAoBlH;AAID,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC;IAC5D,qFAAqF;IACrF,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,wBAAwB;AACxB,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAgDtE;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,cAAc,CAkBlF;AAED,8BAA8B;AAC9B,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,YAAY,GAAG,cAAc,CAqBtE;AAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,eAAe,mBAAmB,CAAC"}