@nxuss/lemma 1.43.0 → 1.45.0

package/dist/cjs/cloud/v2/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../../src/cloud/v2/app.ts"],"names":[],"mappings":";;;;;AAkDA,8BAeC;AAjED;;;;;;;;GAQG;AACH,sDAA0H;AAC1H,mDAAuD;AACvD,qCAAuD;AACvD,gDAAmD;AAInD;;2DAE2D;AAC3D,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACzE,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAI,GAAgD,CAAC,MAAM,IAAK,GAA+B,CAAC,UAAU,CAAC;YACvH,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC;gBAC/B,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBAClC,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,gFAAgF;QAChF,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAc,EAAE,CAAC,CAAC,CAAC;IAEjD,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kBAAe,SAAS,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../../../src/cloud/v2/app.ts"],"names":[],"mappings":";;;;;AAmDA,8BAmBC;AAtED;;;;;;;;GAQG;AACH,sDAA0H;AAC1H,mDAAuD;AACvD,qCAAuD;AACvD,gDAAmD;AACnD,4DAA+D;AAI/D;;2DAE2D;AAC3D,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,CAAC,GAAY,EAAE,IAAa,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACzE,IAAI,GAAG,YAAY,sBAAa,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAI,GAAgD,CAAC,MAAM,IAAK,GAA+B,CAAC,UAAU,CAAC;YACvH,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC;gBAC/B,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBAClC,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,gFAAgF;QAChF,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,SAAgB,SAAS,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,gHAAgH;IAChH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IAC1B,+FAA+F;IAC/F,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa;QAAE,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAA,mCAAmB,EAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACrI,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAc,EAAE,CAAC,CAAC,CAAC;IAEjD,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAExB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kBAAe,SAAS,CAAC"}

package/dist/cjs/cloud/v2/inputGuard.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Lemma API v2 — input guard
+ *
+ * Postgres cannot store `\u0000` in text or jsonb, nor a lone UTF-16 surrogate in
+ * jsonb: either one makes the driver throw, which the error handler turns into a
+ * 500. The file-backed store accepts both, so this only shows up against the real
+ * database. A client must never be able to provoke a 500 with its own bytes, so the
+ * edge rejects these inputs, before any store sees them, with the stable 4xx shape.
+ */
+import type { NextFunction, Request, Response, RequestHandler } from 'express';
+/** Longest id any store here generates is far below this. */
+export declare const MAX_ID_LENGTH = 200;
+export declare function isUnsafeText(s: string): boolean;
+export declare function hasControlChars(s: string): boolean;
+export declare function isSafeId(id: string): boolean;
+/**
+ * Walks the parsed JSON body (keys and string values) and answers 400 on the first
+ * unsafe string. Iterative: a hostile deeply nested body must not overflow the stack.
+ */
+export declare function rejectUnsafeBody(): RequestHandler;
+/** app.param('id') handler: an id that cannot exist is the same 404 as one that does not. */
+export declare function rejectUnsafeIdParam(_req: Request, _res: Response, next: NextFunction, id: string): void;
+//# sourceMappingURL=inputGuard.d.ts.map

package/dist/cjs/cloud/v2/inputGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputGuard.d.ts","sourceRoot":"","sources":["../../../../src/cloud/v2/inputGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAa/E,6DAA6D;AAC7D,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAkBjD;AAUD,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAKvG"}

package/dist/cjs/cloud/v2/inputGuard.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_ID_LENGTH = void 0;
+exports.isUnsafeText = isUnsafeText;
+exports.hasControlChars = hasControlChars;
+exports.isSafeId = isSafeId;
+exports.rejectUnsafeBody = rejectUnsafeBody;
+exports.rejectUnsafeIdParam = rejectUnsafeIdParam;
+const errors_1 = require("../../contracts/errors");
+// Detecting control characters is the whole point of this file, so no-control-regex is switched off
+// for the two patterns below, and only for them.
+/** NUL, or a surrogate half with no partner (an invalid UTF-16 string). */
+// eslint-disable-next-line no-control-regex
+const UNSAFE_TEXT = /\u0000|[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+/** Control characters (C0, DEL) never appear in a real memory id or a key name. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/** Longest id any store here generates is far below this. */
+exports.MAX_ID_LENGTH = 200;
+function isUnsafeText(s) {
+    return UNSAFE_TEXT.test(s);
+}
+function hasControlChars(s) {
+    return CONTROL_CHARS.test(s);
+}
+function isSafeId(id) {
+    return id.length > 0 && id.length <= exports.MAX_ID_LENGTH && !CONTROL_CHARS.test(id) && !UNSAFE_TEXT.test(id);
+}
+/**
+ * Walks the parsed JSON body (keys and string values) and answers 400 on the first
+ * unsafe string. Iterative: a hostile deeply nested body must not overflow the stack.
+ */
+function rejectUnsafeBody() {
+    return (req, _res, next) => {
+        const stack = [req.body];
+        while (stack.length > 0) {
+            const v = stack.pop();
+            if (typeof v === 'string') {
+                if (UNSAFE_TEXT.test(v))
+                    return next(unsafeBodyError());
+            }
+            else if (Array.isArray(v)) {
+                for (const item of v)
+                    stack.push(item);
+            }
+            else if (typeof v === 'object' && v !== null) {
+                for (const [k, item] of Object.entries(v)) {
+                    if (UNSAFE_TEXT.test(k))
+                        return next(unsafeBodyError());
+                    stack.push(item);
+                }
+            }
+        }
+        next();
+    };
+}
+function unsafeBodyError() {
+    return new errors_1.LemmaApiError({
+        code: 'invalid_request',
+        status: 400,
+        message: 'request contains a NUL character or invalid Unicode',
+    });
+}
+/** app.param('id') handler: an id that cannot exist is the same 404 as one that does not. */
+function rejectUnsafeIdParam(_req, _res, next, id) {
+    if (!isSafeId(id)) {
+        return next(new errors_1.LemmaApiError({ code: 'not_found', status: 404, message: 'memory not found' }));
+    }
+    next();
+}
+//# sourceMappingURL=inputGuard.js.map

package/dist/cjs/cloud/v2/inputGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputGuard.js","sourceRoot":"","sources":["../../../../src/cloud/v2/inputGuard.ts"],"names":[],"mappings":";;;AAyBA,oCAEC;AAED,0CAEC;AAED,4BAEC;AAMD,4CAkBC;AAWD,kDAKC;AAjED,mDAAuD;AAEvD,oGAAoG;AACpG,iDAAiD;AACjD,2EAA2E;AAC3E,4CAA4C;AAC5C,MAAM,WAAW,GAAG,+EAA+E,CAAC;AAEpG,mFAAmF;AACnF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,6DAA6D;AAChD,QAAA,aAAa,GAAG,GAAG,CAAC;AAEjC,SAAgB,YAAY,CAAC,CAAS;IACpC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,eAAe,CAAC,CAAS;IACvC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,QAAQ,CAAC,EAAU;IACjC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,qBAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5B,KAAK,MAAM,IAAI,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1C,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;oBACxD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,IAAI,sBAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,qDAAqD;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAgB,mBAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAU;IAC/F,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/cjs/cloud/v2/routes/admin.d.ts

@@ -0,0 +1,24 @@
+import { type Router } from 'express';
+import type { IdentityStore } from '../../identity/identityStore';
+import { PlanPolicy } from '../../identity/PlanPolicy';
+import type { UsageLedger } from '../../metering';
+import { type StripeApi } from '../../billing/stripeApi';
+import { type ConsoleStore } from '../../console/ConsoleStore';
+export declare const MIN_ADMIN_TOKEN_LENGTH = 32;
+export interface AdminDeps {
+    /** The operator secret. Absent or shorter than MIN_ADMIN_TOKEN_LENGTH => admin routes are not mounted. */
+    adminToken?: string;
+    identityStore?: IdentityStore;
+    policy?: PlanPolicy;
+    usageLedger?: Pick<UsageLedger, 'computeUsage' | 'computeKeyActivity'>;
+    /** Present only when STRIPE_SECRET_KEY is configured: enables the checkout and portal routes. */
+    stripeApi?: Pick<StripeApi, 'createCheckout' | 'createPortal'>;
+    /** Present when the console is enabled: turns on the member routes. */
+    consoleStore?: ConsoleStore;
+    /** Where the console is reachable, for the sign-in links this router hands out. */
+    publicBaseUrl?: string;
+}
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+export declare function adminRouter(deps: AdminDeps): Router | null;
+export default adminRouter;
+//# sourceMappingURL=admin.d.ts.map

package/dist/cjs/cloud/v2/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":"AA8BA,OAAgB,EAAuE,KAAK,MAAM,EAAE,MAAM,SAAS,CAAC;AAIpH,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAY,UAAU,EAAe,MAAM,2BAA2B,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAgB,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI7E,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAIzC,MAAM,WAAW,SAAS;IACxB,0GAA0G;IAC1G,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,oBAAoB,CAAC,CAAC;IACvE,iGAAiG;IACjG,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,cAAc,CAAC,CAAC;IAC/D,uEAAuE;IACvE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mFAAmF;IACnF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAoED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAgR1D;AAED,eAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/admin.js

@@ -0,0 +1,344 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_ADMIN_TOKEN_LENGTH = void 0;
+exports.adminRouter = adminRouter;
+/**
+ * Lemma API v2 — operator routes: tenants, seats and keys.
+ *
+ * Not part of the public openapi.yaml contract (customers never call these; the
+ * operator does, from the CLI or a dashboard). Guarded by one operator secret,
+ * `LEMMA_ADMIN_TOKEN`, which is NOT an API key and resolves to no tenant. With the
+ * secret unset the router is simply not mounted, so there is nothing to probe.
+ *
+ *   POST   /v2/admin/tenants                 {id, name?, plan?, founder?}  create a company
+ *   GET    /v2/admin/tenants/:id                                  plan, seats used/limit, keys
+ *   PATCH  /v2/admin/tenants/:id             {plan}               change plan (never below seats in use)
+ *   POST   /v2/admin/tenants/:id/founder     {founder}            mark a founder team (keeps the founder limits)
+ *   POST   /v2/admin/tenants/:id/keys        {name}               issue a key (shown once)
+ *   DELETE /v2/admin/tenants/:id/keys/:keyId                      revoke (the dev left)
+ *   GET    /v2/admin/tenants/:id/usage?since=<epoch ms>           usage by operation and by dev
+ *   POST   /v2/admin/tenants/:id/checkout    {plan, interval, founder?, email?}  Stripe Checkout link to send the customer
+ *   POST   /v2/admin/tenants/:id/portal                           Stripe billing-portal link for a paying tenant
+ *
+ *   POST   /v2/admin/tenants/:id/members    {email, role?}        let a person sign in to the console (owner | admin | member)
+ *   GET    /v2/admin/tenants/:id/members                          who can sign in
+ *   DELETE /v2/admin/tenants/:id/members/:email                   remove them (their sessions end at once)
+ *   POST   /v2/admin/tenants/:id/members/:email/login-link        a one-time sign-in link, to hand over by hand
+ *
+ * The checkout and portal routes exist only when STRIPE_SECRET_KEY is set; the member routes only with a console store. The checkout link carries the tenant id, so paying
+ * is what links the Stripe customer to the tenant; the webhook then sets the plan.
+ *
+ * A seat is one active, unexpired key. Issuing past the plan's seat ceiling is a 429
+ * `quota_exceeded`; the check and the insert are atomic in the store.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+const express_1 = __importDefault(require("express"));
+const zod_1 = require("zod");
+const errors_1 = require("../../../contracts/errors");
+const ApiKey_1 = require("../../identity/ApiKey");
+const PlanPolicy_1 = require("../../identity/PlanPolicy");
+const inputGuard_1 = require("../inputGuard");
+const stripeApi_1 = require("../../billing/stripeApi");
+const ConsoleStore_1 = require("../../console/ConsoleStore");
+const consoleRouter_1 = require("../../console/consoleRouter");
+const memories_1 = require("./memories");
+exports.MIN_ADMIN_TOKEN_LENGTH = 32;
+const TENANT_ID = /^[a-z0-9][a-z0-9_-]{1,62}$/;
+const KEY_ID = /^key_[0-9a-f]{12}$/;
+const PlanSchema = zod_1.z.enum(PlanPolicy_1.PLAN_IDS);
+const CreateTenantSchema = zod_1.z.object({
+    id: zod_1.z.string().regex(TENANT_ID, 'id must be 2-63 chars: a-z, 0-9, "_" or "-", starting with a letter or digit'),
+    name: zod_1.z.string().max(200).optional(),
+    plan: PlanSchema.optional(),
+    /** A founder team created by hand: it keeps the founder limits (PlanPolicy FOUNDER_LIMITS). */
+    founder: zod_1.z.boolean().optional(),
+});
+const FounderSchema = zod_1.z.object({ founder: zod_1.z.boolean() }).strict();
+const PatchTenantSchema = zod_1.z.object({ plan: PlanSchema });
+const AddMemberSchema = zod_1.z.object({
+    email: zod_1.z.string().trim().email().max(254),
+    role: zod_1.z.enum(ConsoleStore_1.MEMBER_ROLES).optional(),
+});
+const CheckoutSchema = zod_1.z.object({
+    plan: zod_1.z.enum(stripeApi_1.SELLABLE_PLANS),
+    interval: zod_1.z.enum(['month', 'year']),
+    /** The founder discount: first teams only, monthly billing only (a coupon on a yearly price would take 20 or 70 off once). */
+    founder: zod_1.z.boolean().optional(),
+    email: zod_1.z.string().trim().email().max(254).optional(),
+});
+const CreateKeySchema = zod_1.z.object({
+    name: zod_1.z
+        .string()
+        .trim()
+        .min(1)
+        .max(100)
+        .refine((n) => !(0, inputGuard_1.hasControlChars)(n), 'name must not contain control characters'),
+});
+const sha = (s) => crypto_1.default.createHash('sha256').update(s).digest();
+function bearer(req) {
+    const m = /^Bearer\s+(.+)$/i.exec((req.headers.authorization ?? '').trim());
+    return m ? m[1].trim() : null;
+}
+function requireAdmin(token) {
+    const expected = sha(token);
+    return (req, res, next) => {
+        const given = bearer(req);
+        // Hash both sides first so the compare is constant-time regardless of the given length.
+        if (given && crypto_1.default.timingSafeEqual(sha(given), expected))
+            return next();
+        res.status(401).set('WWW-Authenticate', 'Bearer').json(new errors_1.LemmaApiError({ code: 'unauthenticated', status: 401, message: 'missing or invalid operator token' }).toJSON());
+    };
+}
+const notFound = (what) => new errors_1.LemmaApiError({ code: 'not_found', status: 404, message: `${what} not found` });
+const publicKey = (k) => ({
+    id: k.id,
+    name: k.name,
+    prefix: k.prefix,
+    active: k.active,
+    createdAt: k.createdAt,
+    revokedAt: k.revokedAt,
+});
+const wrap = (fn) => (req, res, next) => {
+    fn(req, res).catch(next);
+};
+/** Returns null when the operator secret is missing or too weak: the caller must not mount anything. */
+function adminRouter(deps) {
+    const { adminToken, identityStore: store } = deps;
+    if (!adminToken || adminToken.length < exports.MIN_ADMIN_TOKEN_LENGTH || !store)
+        return null;
+    const policy = deps.policy ?? new PlanPolicy_1.PlanPolicy();
+    const r = express_1.default.Router();
+    r.use(requireAdmin(adminToken));
+    r.use((0, inputGuard_1.rejectUnsafeBody)());
+    const tenantParam = (req) => {
+        const id = req.params.tenantId;
+        if (!TENANT_ID.test(id))
+            throw notFound('tenant');
+        return id;
+    };
+    const tenantView = async (id) => {
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const keys = await store.listKeys(id);
+        const now = Date.now();
+        const used = keys.filter((k) => k.active && (k.expiresAt === null || k.expiresAt > now)).length;
+        return {
+            id: tenant.id,
+            name: tenant.name,
+            plan: tenant.plan,
+            founder: tenant.founder,
+            createdAt: tenant.createdAt,
+            seats: { used, limit: policy.limitsFor(tenant.plan, { founder: tenant.founder }).seats },
+            keys: keys.map(publicKey),
+        };
+    };
+    r.post('/tenants', wrap(async (req, res) => {
+        const parsed = CreateTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const { id, name, plan, founder } = parsed.data;
+        const created = await store.createTenant({ id, name: name ?? id, plan: (plan ?? 'free'), founder: founder === true });
+        if (!created)
+            throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'tenant already exists', field: 'id' });
+        res.status(201).json({ id: created.id, name: created.name, plan: created.plan, founder: created.founder });
+    }));
+    r.get('/tenants/:tenantId', wrap(async (req, res) => {
+        res.json(await tenantView(tenantParam(req)));
+    }));
+    r.patch('/tenants/:tenantId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = PatchTenantSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const current = await tenantView(id);
+        const newSeats = policy.limitsFor(parsed.data.plan).seats;
+        if (current.seats.used > newSeats) {
+            throw new errors_1.LemmaApiError({
+                code: 'invalid_request',
+                status: 409,
+                message: `plan "${parsed.data.plan}" allows ${newSeats} seats but ${current.seats.used} are in use: revoke keys first`,
+                field: 'plan',
+            });
+        }
+        await store.setTenantPlan(id, parsed.data.plan);
+        res.json(await tenantView(id));
+    }));
+    // Mark (or, to correct a mistake, unmark) a founder. Billing marks paid founder checkouts by itself.
+    r.post('/tenants/:tenantId/founder', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = FounderSchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        if (!(await store.setTenantFounder(id, parsed.data.founder)))
+            throw notFound('tenant');
+        res.json(await tenantView(id));
+    }));
+    r.post('/tenants/:tenantId/keys', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const parsed = CreateKeySchema.safeParse(req.body);
+        if (!parsed.success)
+            throw (0, memories_1.zodToApiError)(parsed.error);
+        const tenant = await store.getTenant(id);
+        if (!tenant)
+            throw notFound('tenant');
+        const generated = (0, ApiKey_1.generateApiKey)(ApiKey_1.KEY_PREFIX_LIVE);
+        const result = await store.createKeyWithinSeats({ tenantId: id, name: parsed.data.name, plan: tenant.plan, prefix: ApiKey_1.KEY_PREFIX_LIVE, hash: generated.hash }, policy.limitsFor(tenant.plan).seats);
+        if (!result.ok) {
+            if (result.reason === 'no_tenant')
+                throw notFound('tenant');
+            if (result.reason === 'duplicate_name') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'an active key with that name already exists', field: 'name' });
+            }
+            throw new errors_1.LemmaApiError({
+                code: 'quota_exceeded',
+                status: 429,
+                message: `seat limit reached: ${result.used}/${result.seats} on plan "${tenant.plan}"`,
+            });
+        }
+        // The only response that ever carries the plaintext key.
+        res.status(201).json({ id: result.key.id, name: result.key.name, prefix: result.key.prefix, key: generated.key });
+    }));
+    r.delete('/tenants/:tenantId/keys/:keyId', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        const keyId = req.params.keyId;
+        if (!KEY_ID.test(keyId))
+            throw notFound('key');
+        // The key must belong to THIS tenant: an id from another tenant is the same 404.
+        const keys = await store.listKeys(id);
+        if (!keys.some((k) => k.id === keyId))
+            throw notFound('key');
+        await store.revokeKey(keyId);
+        res.json({ revoked: [keyId] });
+    }));
+    r.get('/tenants/:tenantId/usage', wrap(async (req, res) => {
+        const id = tenantParam(req);
+        if (!(await store.getTenant(id)))
+            throw notFound('tenant');
+        const ledger = deps.usageLedger;
+        if (!ledger || !ledger.computeKeyActivity)
+            throw new errors_1.LemmaApiError({ code: 'not_implemented', status: 501, message: 'usage ledger unavailable' });
+        const rawSince = req.query.since;
+        let since;
+        if (rawSince !== undefined) {
+            // Digits only: Number('') is 0 and Number(' 5 ') is 5, neither of which is a timestamp anyone meant.
+            since = typeof rawSince === 'string' && /^\d{1,16}$/.test(rawSince) ? Number(rawSince) : NaN;
+            if (!Number.isSafeInteger(since)) {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 400, message: 'since must be a non-negative integer (epoch ms)', field: 'since' });
+            }
+        }
+        const [usage, activity, keys] = await Promise.all([
+            ledger.computeUsage({ tenantId: id, since }),
+            ledger.computeKeyActivity({ tenantId: id, since }),
+            store.listKeys(id),
+        ]);
+        const names = new Map(keys.map((k) => [k.id, k.name]));
+        res.json({
+            tenantId: id,
+            since: since ?? null,
+            metrics: usage.metrics,
+            excludedEvents: usage.excludedEvents,
+            // One row per key that made calls, with the dev's name and whether the key is still live.
+            keys: activity.map((a) => ({
+                keyId: a.keyId,
+                name: names.get(a.keyId) ?? null,
+                active: keys.find((k) => k.id === a.keyId)?.active ?? false,
+                requests: a.requests,
+                tokens: a.tokens,
+                byOperation: a.byOperation,
+            })),
+        });
+    }));
+    if (deps.stripeApi) {
+        const stripeApi = deps.stripeApi;
+        // A subscription in any of these states already pays for the tenant: a second one would bill twice.
+        const LIVE_SUBSCRIPTION = new Set(['active', 'trialing', 'past_due', 'unpaid', 'incomplete']);
+        r.post('/tenants/:tenantId/checkout', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = CheckoutSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw (0, memories_1.zodToApiError)(parsed.error);
+            const { plan, interval, founder = false, email } = parsed.data;
+            if (founder && interval !== 'month') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 400, message: 'the founder price is for monthly billing only', field: 'founder' });
+            }
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (tenant.plan === 'internal') {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'an internal tenant is not sold through Stripe' });
+            }
+            const status = tenant.billing.status;
+            if (tenant.billing.subscriptionId && status && LIVE_SUBSCRIPTION.has(status)) {
+                throw new errors_1.LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: `this tenant already has a subscription (${status}): change it in the billing portal instead`,
+                });
+            }
+            const link = await stripeApi.createCheckout({ tenantId: id, plan, interval, founder, existingCustomerId: tenant.billing.customerId, email });
+            res.status(201).json({ tenantId: id, plan, interval, founder, trialDays: 14, url: link.url, expiresAt: link.expiresAt });
+        }));
+        r.post('/tenants/:tenantId/portal', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const tenant = await store.getTenant(id);
+            if (!tenant)
+                throw notFound('tenant');
+            if (!tenant.billing.customerId) {
+                throw new errors_1.LemmaApiError({ code: 'invalid_request', status: 409, message: 'this tenant has no Stripe customer yet: send it a checkout link first' });
+            }
+            res.json({ tenantId: id, url: (await stripeApi.createPortal(tenant.billing.customerId)).url });
+        }));
+    }
+    if (deps.consoleStore) {
+        const consoleStore = deps.consoleStore;
+        r.post('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const parsed = AddMemberSchema.safeParse(req.body);
+            if (!parsed.success)
+                throw (0, memories_1.zodToApiError)(parsed.error);
+            const added = await consoleStore.addMember(id, parsed.data.email, parsed.data.role ?? 'member');
+            if (!added.ok) {
+                if (added.reason === 'no_tenant')
+                    throw notFound('tenant');
+                throw new errors_1.LemmaApiError({
+                    code: 'invalid_request',
+                    status: 409,
+                    message: added.reason === 'exists' ? 'that person is already a member of this tenant' : 'that email already belongs to another tenant',
+                    field: 'email',
+                });
+            }
+            res.status(201).json({ id: added.member.id, email: added.member.email, role: added.member.role });
+        }));
+        r.get('/tenants/:tenantId/members', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await store.getTenant(id)))
+                throw notFound('tenant');
+            res.json({ members: (await consoleStore.listMembers(id)).map((m) => ({ email: m.email, role: m.role })) });
+        }));
+        r.delete('/tenants/:tenantId/members/:email', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            if (!(await consoleStore.removeMember(id, req.params.email)))
+                throw notFound('member');
+            res.json({ removed: req.params.email.trim().toLowerCase() });
+        }));
+        r.post('/tenants/:tenantId/members/:email/login-link', wrap(async (req, res) => {
+            const id = tenantParam(req);
+            const member = await consoleStore.findMemberByEmail(req.params.email);
+            // Another tenant's member is the same 404 as a stranger: this route never confirms who belongs where.
+            if (!member || member.tenantId !== id)
+                throw notFound('member');
+            const issued = await (0, consoleRouter_1.issueLoginLink)(consoleStore, member.email, Date.now());
+            if (!issued)
+                throw notFound('member');
+            res.status(201).json({ email: issued.email, url: (0, consoleRouter_1.loginLink)((0, consoleRouter_1.publicBase)(req, deps.publicBaseUrl), issued.token), expiresAt: issued.expiresAt });
+        }));
+    }
+    r.use((_req, _res, next) => next(notFound('route')));
+    return r;
+}
+exports.default = adminRouter;
+//# sourceMappingURL=admin.js.map

package/dist/cjs/cloud/v2/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/admin.ts"],"names":[],"mappings":";;;;;;AAgIA,kCAgRC;AAhZD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,oDAA4B;AAC5B,sDAAoH;AACpH,6BAAwB;AACxB,sDAA0D;AAC1D,kDAAwE;AAExE,0DAA8E;AAE9E,8CAAkE;AAClE,uDAAyE;AACzE,6DAA6E;AAC7E,+DAAoF;AACpF,yCAA2C;AAE9B,QAAA,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC;AAgBpC,MAAM,UAAU,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAQ,CAAC,CAAC;AACpC,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,8EAA8E,CAAC;IAC/G,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;IAC3B,+FAA+F;IAC/F,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAClE,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AACzD,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,2BAAY,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,0BAAc,CAAC;IAC5B,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,8HAA8H;IAC9H,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,OAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,4BAAe,EAAC,CAAC,CAAC,EAAE,0CAA0C,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAElF,SAAS,MAAM,CAAC,GAAY;IAC1B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,wFAAwF;QACxF,IAAI,KAAK,IAAI,gBAAM,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CACpD,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CACnH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;AAEvH,MAAM,SAAS,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS;CACvB,CAAC,CAAC;AAEH,MAAM,IAAI,GACR,CAAC,EAAkD,EAAkB,EAAE,CACvE,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;IAClD,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEJ,wGAAwG;AACxG,SAAgB,WAAW,CAAC,IAAe;IACzC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,8BAAsB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,uBAAU,EAAE,CAAC;IAE/C,MAAM,CAAC,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,IAAA,6BAAgB,GAAE,CAAC,CAAC;IAE1B,MAAM,WAAW,GAAG,CAAC,GAAY,EAAU,EAAE;QAC3C,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EAAE,EAAU,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE;YACxF,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;SAC1B,CAAC;IACJ,CAAC,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,UAAU,EACV,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,CAAW,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,KAAK,CACL,oBAAoB,EACpB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAC1D,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAa,CAAC;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,YAAY,QAAQ,cAAc,OAAO,CAAC,KAAK,CAAC,IAAI,gCAAgC;gBACtH,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,qGAAqG;IACrG,CAAC,CAAC,IAAI,CACJ,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,IAAI,CACJ,yBAAyB,EACzB,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uBAAc,EAAC,wBAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAC7C,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAe,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,EAC1G,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CACpC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,6CAA6C,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3I,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,uBAAuB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,IAAI,GAAG;aACvF,CAAC,CAAC;QACL,CAAC;QACD,yDAAyD;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACpH,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,MAAM,CACN,gCAAgC,EAChC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,iFAAiF;QACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CACH,CAAC;IAEF,CAAC,CAAC,GAAG,CACH,0BAA0B,EAC1B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAClJ,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,qGAAqG;YACrG,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iDAAiD,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAC5C,MAAM,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAClD,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;SACnB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,KAAK,IAAI,IAAI;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,0FAA0F;YAC1F,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI;gBAChC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,KAAK;gBAC3D,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,WAAW,EAAE,CAAC,CAAC,WAAW;aAC3B,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,oGAAoG;QACpG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QAE9F,CAAC,CAAC,IAAI,CACJ,6BAA6B,EAC7B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YAC/D,IAAI,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAChJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;YAC9H,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,sBAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,2CAA2C,MAAM,4CAA4C;iBACvG,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7I,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3H,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,2BAA2B,EAC3B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC/B,MAAM,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;YACtJ,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAEvC,CAAC,CAAC,IAAI,CACJ,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAA,wBAAa,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;oBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3D,MAAM,IAAI,sBAAa,CAAC;oBACtB,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,8CAA8C;oBACtI,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,GAAG,CACH,4BAA4B,EAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,MAAM,CACN,mCAAmC,EACnC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CACH,CAAC;QAEF,CAAC,CAAC,IAAI,CACJ,8CAA8C,EAC9C,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtB,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,sGAAsG;YACtG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAc,EAAC,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAA,yBAAS,EAAC,IAAA,0BAAU,EAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAChJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kBAAe,WAAW,CAAC"}

package/dist/cjs/cloud/v2/routes/entitlement.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lemma API v2 — GET /v2/entitlement
+ *
+ * What the presented key may do on the client, beyond the API itself: today, whether a seat on this
+ * plan also unlocks the local Pro tools. The answer comes from the tenant's plan (PLAN_INCLUDES_PRO),
+ * never from anything the caller sends. A revoked or expired key never gets here: authenticateV2
+ * answers it 401 first, which is how a client learns a seat was taken away.
+ */
+import type { RequestHandler } from 'express';
+/** GET /v2/entitlement */
+export declare function entitlementHandler(): RequestHandler;
+export default entitlementHandler;
+//# sourceMappingURL=entitlement.d.ts.map

package/dist/cjs/cloud/v2/routes/entitlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAK9C,0BAA0B;AAC1B,wBAAgB,kBAAkB,IAAI,cAAc,CAenD;AAED,eAAe,kBAAkB,CAAC"}

package/dist/cjs/cloud/v2/routes/entitlement.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entitlementHandler = entitlementHandler;
+const PlanPolicy_1 = require("../../identity/PlanPolicy");
+/** GET /v2/entitlement */
+function entitlementHandler() {
+    return (req, res, next) => {
+        try {
+            const { tenant } = req;
+            const body = {
+                tenantId: tenant.id,
+                plan: tenant.plan,
+                includesPro: PlanPolicy_1.PLAN_INCLUDES_PRO[tenant.plan] === true,
+                ...(tenant.keyName ? { keyName: tenant.keyName } : {}),
+            };
+            res.json(body);
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+exports.default = entitlementHandler;
+//# sourceMappingURL=entitlement.js.map

package/dist/cjs/cloud/v2/routes/entitlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement.js","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/entitlement.ts"],"names":[],"mappings":";;AAcA,gDAeC;AAlBD,0DAA8D;AAE9D,0BAA0B;AAC1B,SAAgB,kBAAkB;IAChC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAA2B,CAAC;YAC/C,MAAM,IAAI,GAAwB;gBAChC,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,WAAW,EAAE,8BAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI;gBACpD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,kBAAe,kBAAkB,CAAC"}

package/dist/cjs/cloud/v2/routes/index.d.ts

@@ -18,7 +18,20 @@ import { type MemoriesDeps } from './memories';
 import { type RecallDeps } from './recall';
 import { type VerifyDeps } from './verify';
 import { type UsageDeps } from './usage';
-export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps;
+import { type AdminDeps } from './admin';
+import type { StripeBillingConfig } from '../../billing/stripeWebhook';
+import type { ConsoleStore } from '../../console/ConsoleStore';
+import type { LoginMailer } from '../../console/mailer';
+export type MountDeps = AuthenticateV2Deps & MemoriesDeps & RecallDeps & VerifyDeps & UsageDeps & AdminDeps & {
+    billing?: StripeBillingConfig;
+    /** The web console: members, sign-in links and sessions. Absent => /console and the member routes are not mounted. */
+    consoleStore?: ConsoleStore;
+    loginMailer?: LoginMailer;
+    /** Where the console is reachable (CLOUD_PUBLIC_URL), for links in emails. */
+    publicBaseUrl?: string;
+    consoleDir?: string;
+    insecureCookies?: boolean;
+};
 export declare function mountRoutes(app: Express, deps: MountDeps): void;
 export default mountRoutes;
 //# sourceMappingURL=index.d.ts.map

package/dist/cjs/cloud/v2/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAIvD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhG,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAuB/D;AAED,eAAe,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/cloud/v2/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxF,OAAO,EAA8D,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3G,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAMvD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAEtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG;IAC1G,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,sHAAsH;IACtH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEJ,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAyD/D;AAED,eAAe,WAAW,CAAC"}