@pablo2410/core-server 0.11.0 → 0.12.0

package/dist/{chunk-NSTH36LS.js → chunk-PYIA5WYH.js}

@@ -1,6 +1,25 @@
 // src/hierarchy.ts
+import { TRPCError } from "@trpc/server";
 import { scopeHierarchyToEnterprise } from "@pablo2410/shared-ui/hierarchy/core";
 var FIFTEEN_MINUTES = 15 * 60 * 1e3;
+var HierarchyRefusedError = class extends TRPCError {
+  /** HTTP status the Portal answered with (401 or 403). */
+  status;
+  /** The Portal's own reason (its `error` field), if it gave one. */
+  portalReason;
+  /** The company the app asked for. */
+  enterpriseId;
+  constructor(status, portalReason, enterpriseId) {
+    super({
+      code: "FORBIDDEN",
+      message: `Portal refused this app's key for this company (HTTP ${status}${portalReason ? `: ${portalReason}` : ""})`
+    });
+    this.name = "HierarchyRefusedError";
+    this.status = status;
+    this.portalReason = portalReason;
+    this.enterpriseId = enterpriseId;
+  }
+};
 function enterpriseIdOf(user) {
   const id = user?.enterpriseId;
   return typeof id === "number" && Number.isSafeInteger(id) && id > 0 ? id : null;
@@ -39,6 +58,18 @@ function createHierarchyService(config) {
       console.error(`[HierarchyService] ${lastError} (url=${url})`);
       return null;
     }
+    if (res.status === 401 || res.status === 403) {
+      const body = await res.json().catch(() => null);
+      const reason = typeof body?.error === "string" && body.error ? body.error : null;
+      const refused = new HierarchyRefusedError(
+        res.status,
+        reason,
+        enterpriseId
+      );
+      lastError = `${refused.message} from ${url}`;
+      console.error(`[HierarchyService] ${lastError}`);
+      throw refused;
+    }
     if (!res.ok) {
       lastError = `HTTP ${res.status} ${res.statusText} from ${url}`;
       console.error(`[HierarchyService] ${lastError}`);
@@ -55,7 +86,13 @@ function createHierarchyService(config) {
   }
   async function getFullHierarchy() {
     if (isFresh(fullCache)) return fullCache.data;
-    const data = await fetchRaw();
+    let data;
+    try {
+      data = await fetchRaw();
+    } catch (err) {
+      if (err instanceof HierarchyRefusedError) return null;
+      throw err;
+    }
     if (data && cacheTtlMs > 0) fullCache = { data, at: now() };
     return data;
   }
@@ -135,6 +172,7 @@ function normalize(data) {
 }
 
 export {
+  HierarchyRefusedError,
   createHierarchyService
 };
-//# sourceMappingURL=chunk-NSTH36LS.js.map
+//# sourceMappingURL=chunk-PYIA5WYH.js.map

package/dist/chunk-PYIA5WYH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hierarchy.ts"],"sourcesContent":["/**\n * Hierarchy Service — the single server-side source for org-hierarchy data.\n *\n * Fetches the canonical org-hierarchy from the Portal Service API\n * (GET /api/service/hierarchy, authenticated with the service key), naming the\n * caller's company with X-Enterprise-Id (#91, as Policy Deployment does since\n * PD#313). Caches it per company with a TTL, and scopes it to that company with\n * the shared isolation rule (scopeHierarchyToEnterprise from\n * @pablo2410/shared-ui) on every read, as a second check.\n *\n * One fetch, one mapper, one cache, one scope policy. Every subdomain constructs\n * this once from its env and calls getScopedHierarchy(ctx.user) in its tRPC\n * `hierarchy` procedure — no per-app fetch/scope/null-policy reinvention.\n *\n * Quick example:\n *   const hierarchy = createHierarchyService({\n *     portalApiUrl: process.env.PORTAL_API_URL ?? \"\",\n *     portalApiKey: process.env.PORTAL_API_KEY ?? \"\",\n *   });\n *   // in a tRPC router:\n *   hierarchy: protectedProcedure.query(({ ctx }) => hierarchy.getScopedHierarchy(ctx.user)),\n */\nimport { TRPCError } from \"@trpc/server\";\nimport type { OrgHierarchyData } from \"@pablo2410/shared-ui/hierarchy/core\";\nimport { scopeHierarchyToEnterprise } from \"@pablo2410/shared-ui/hierarchy/core\";\n\nexport interface HierarchyServiceConfig {\n  /** Portal Service API base URL, e.g. https://portal.oplyticsdigital.net */\n  portalApiUrl: string;\n  /** Platform-level X-Service-Key for the Portal Service API. */\n  portalApiKey: string;\n  /** Cache TTL in milliseconds. Default 15 minutes. Set 0 to disable caching. */\n  cacheTtlMs?: number;\n  /** Injectable fetch implementation (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /** Injectable clock (for tests). Defaults to Date.now. */\n  now?: () => number;\n}\n\nexport interface HierarchyService {\n  /**\n   * The org-hierarchy scoped to the caller's enterprise, fetched with\n   * `X-Enterprise-Id: <enterpriseId>` and cached per enterprise. A user with no\n   * resolved enterprise (null/undefined, or not a positive whole number)\n   * receives an empty hierarchy without a Portal call — see\n   * scopeHierarchyToEnterprise for the policy. Never returns null.\n   *\n   * Throws HierarchyRefusedError when the Portal refuses this app's key for\n   * the company (HTTP 401/403), so a refusal is never shown as an empty tree\n   * (#142). Any other failure (unconfigured, unreachable, 5xx, bad body) still\n   * returns an empty tree, with the reason in getStatus().lastError.\n   */\n  getScopedHierarchy(\n    user: { enterpriseId?: number | null } | null\n  ): Promise<OrgHierarchyData>;\n  /**\n   * The full, unscoped hierarchy (every enterprise). For Portal/admin tooling\n   * only — subdomains must use getScopedHierarchy. It names no company, so the\n   * Portal may refuse it with the master key once un-named company reads are\n   * refused (subdomains#1037). null if unconfigured/unreachable/refused.\n   */\n  getFullHierarchy(): Promise<OrgHierarchyData | null>;\n  /** Clear one enterprise's cache, or every cache with no argument. */\n  invalidate(enterpriseId?: number): void;\n  /** Config + cache status, for health endpoints. */\n  getStatus(): {\n    configured: boolean;\n    /** Whether anything is cached (any enterprise, or the full tree). */\n    cached: boolean;\n    /** Age of the oldest cached entry, in ms. */\n    ageMs: number | null;\n    /** How many enterprises have a cached hierarchy. */\n    cachedEnterprises: number;\n    /** Reason the last fetch failed (null if the last fetch succeeded). */\n    lastError: string | null;\n  };\n}\n\nconst FIFTEEN_MINUTES = 15 * 60 * 1000;\n\n/**\n * The Portal refused this app's service key for the company (HTTP 401/403,\n * e.g. \"enterpriseId does not match your key\"). A TRPCError with code\n * FORBIDDEN, so a tRPC procedure that lets it through hands the app the\n * message rather than an empty tree. FORBIDDEN for a 401 too: the user is\n * signed in, it is the app's key that was refused, and an UNAUTHORIZED would\n * send the user to sign in again (#142).\n */\nexport class HierarchyRefusedError extends TRPCError {\n  /** HTTP status the Portal answered with (401 or 403). */\n  readonly status: number;\n  /** The Portal's own reason (its `error` field), if it gave one. */\n  readonly portalReason: string | null;\n  /** The company the app asked for. */\n  readonly enterpriseId: number | undefined;\n\n  constructor(\n    status: number,\n    portalReason: string | null,\n    enterpriseId?: number\n  ) {\n    super({\n      code: \"FORBIDDEN\",\n      message: `Portal refused this app's key for this company (HTTP ${status}${\n        portalReason ? `: ${portalReason}` : \"\"\n      })`,\n    });\n    this.name = \"HierarchyRefusedError\";\n    this.status = status;\n    this.portalReason = portalReason;\n    this.enterpriseId = enterpriseId;\n  }\n}\n\ntype CacheEntry = { data: OrgHierarchyData; at: number };\n\n/** The caller's enterprise if it is a positive whole number, else null. */\nfunction enterpriseIdOf(\n  user: { enterpriseId?: number | null } | null\n): number | null {\n  const id = user?.enterpriseId;\n  return typeof id === \"number\" && Number.isSafeInteger(id) && id > 0\n    ? id\n    : null;\n}\n\nexport function createHierarchyService(\n  config: HierarchyServiceConfig\n): HierarchyService {\n  const {\n    portalApiUrl,\n    portalApiKey,\n    cacheTtlMs = FIFTEEN_MINUTES,\n    fetchImpl = fetch,\n    now = Date.now,\n  } = config;\n\n  const configured = Boolean(portalApiUrl && portalApiKey);\n  // One cache per company, holding only that company's slice, so one\n  // company's hierarchy can never be served to another (#91).\n  const scopedCache = new Map<number, CacheEntry>();\n  let fullCache: CacheEntry | null = null;\n  const isFresh = (entry: CacheEntry | null | undefined): entry is CacheEntry =>\n    cacheTtlMs > 0 && !!entry && now() - entry.at < cacheTtlMs;\n  // Last fetch failure reason, surfaced via getStatus() for diagnostics. A\n  // configured service that returns an empty hierarchy is almost always a fetch\n  // failure (wrong URL/key, unreachable Portal, non-200) — without this it was\n  // swallowed to a silent null and looked like \"enterprise has no data\".\n  let lastError: string | null = null;\n\n  async function fetchRaw(\n    enterpriseId?: number\n  ): Promise<OrgHierarchyData | null> {\n    if (!configured) {\n      lastError = \"not configured (PORTAL_API_URL/PORTAL_API_KEY missing)\";\n      return null;\n    }\n    const url = `${portalApiUrl.replace(/\\/$/, \"\")}/api/service/hierarchy`;\n    let res: Response;\n    try {\n      res = await fetchImpl(url, {\n        headers: {\n          \"X-Service-Key\": portalApiKey,\n          \"Content-Type\": \"application/json\",\n          // Names the caller's company (portal#348).\n          ...(enterpriseId !== undefined\n            ? { \"X-Enterprise-Id\": String(enterpriseId) }\n            : {}),\n        },\n      });\n    } catch (err) {\n      lastError = `fetch threw: ${err instanceof Error ? err.message : String(err)}`;\n      console.error(`[HierarchyService] ${lastError} (url=${url})`);\n      return null;\n    }\n    if (res.status === 401 || res.status === 403) {\n      const body = await res.json().catch(() => null);\n      const reason =\n        typeof body?.error === \"string\" && body.error ? body.error : null;\n      const refused = new HierarchyRefusedError(\n        res.status,\n        reason,\n        enterpriseId\n      );\n      lastError = `${refused.message} from ${url}`;\n      console.error(`[HierarchyService] ${lastError}`);\n      throw refused;\n    }\n    if (!res.ok) {\n      lastError = `HTTP ${res.status} ${res.statusText} from ${url}`;\n      console.error(`[HierarchyService] ${lastError}`);\n      return null;\n    }\n    const json = await res.json().catch(() => null);\n    if (!json) {\n      lastError = `invalid/empty JSON body from ${url}`;\n      console.error(`[HierarchyService] ${lastError}`);\n      return null;\n    }\n    lastError = null;\n    return normalize(json);\n  }\n\n  async function getFullHierarchy(): Promise<OrgHierarchyData | null> {\n    if (isFresh(fullCache)) return fullCache.data;\n    let data: OrgHierarchyData | null;\n    try {\n      data = await fetchRaw();\n    } catch (err) {\n      if (err instanceof HierarchyRefusedError) return null;\n      throw err;\n    }\n    if (data && cacheTtlMs > 0) fullCache = { data, at: now() };\n    return data;\n  }\n\n  async function getScopedHierarchy(\n    user: { enterpriseId?: number | null } | null\n  ): Promise<OrgHierarchyData> {\n    const enterpriseId = enterpriseIdOf(user);\n    // No company: nothing to show, and nothing to ask the Portal for.\n    if (enterpriseId === null) return scopeHierarchyToEnterprise(null, null);\n\n    let entry = scopedCache.get(enterpriseId);\n    if (!isFresh(entry)) {\n      // A refusal throws HierarchyRefusedError from here, uncached (#142).\n      const raw = await fetchRaw(enterpriseId);\n      if (!raw) return scopeHierarchyToEnterprise(null, enterpriseId);\n      // Keep only this company's slice: today's Portal ignores the header on\n      // /hierarchy and returns every company.\n      entry = {\n        data: scopeHierarchyToEnterprise(raw, enterpriseId),\n        at: now(),\n      };\n      if (cacheTtlMs > 0) scopedCache.set(enterpriseId, entry);\n    }\n    // Scoped again on every read: a fresh copy per caller, and the isolation\n    // rule stays the last word whatever the Portal returned.\n    return scopeHierarchyToEnterprise(entry.data, enterpriseId);\n  }\n\n  function invalidate(enterpriseId?: number): void {\n    if (enterpriseId !== undefined) {\n      scopedCache.delete(enterpriseId);\n      return;\n    }\n    scopedCache.clear();\n    fullCache = null;\n  }\n\n  function getStatus() {\n    const ats = [...scopedCache.values()].map(e => e.at);\n    if (fullCache) ats.push(fullCache.at);\n    return {\n      configured,\n      cached: ats.length > 0,\n      ageMs: ats.length > 0 ? now() - Math.min(...ats) : null,\n      cachedEnterprises: scopedCache.size,\n      lastError,\n    };\n  }\n\n  return { getScopedHierarchy, getFullHierarchy, invalidate, getStatus };\n}\n\n/**\n * Map the Portal Service API response to the canonical OrgHierarchyData shape.\n * Tolerant of missing arrays (defaults to []) so a partial payload never throws.\n */\nfunction normalize(data: unknown): OrgHierarchyData {\n  const d = (data ?? {}) as Record<string, any[]>;\n  return {\n    enterprises: (d.enterprises ?? []).map(e => ({\n      id: e.id,\n      name: e.name,\n      code: e.code,\n    })),\n    businessUnits: (d.businessUnits ?? []).map(bu => ({\n      id: bu.id,\n      name: bu.name,\n      code: bu.code,\n      enterpriseId: bu.enterpriseId,\n    })),\n    sites: (d.sites ?? []).map(s => ({\n      id: s.id,\n      name: s.name,\n      code: s.code,\n      enterpriseId: s.enterpriseId,\n      businessUnitId: s.businessUnitId ?? 0,\n      location: s.location,\n    })),\n    areas: (d.areas ?? []).map(a => ({\n      id: a.id,\n      name: a.name,\n      code: a.code,\n      siteId: a.siteId,\n    })),\n    assets: (d.assets ?? []).map(a => ({\n      id: a.id,\n      name: a.name,\n      code: a.code,\n      siteId: a.siteId,\n      areaId: a.areaId ?? 0,\n      assetType: a.assetType,\n    })),\n  };\n}\n"],"mappings":";AAsBA,SAAS,iBAAiB;AAE1B,SAAS,kCAAkC;AAsD3C,IAAM,kBAAkB,KAAK,KAAK;AAU3B,IAAM,wBAAN,cAAoC,UAAU;AAAA;AAAA,EAE1C;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YACE,QACA,cACA,cACA;AACA,UAAM;AAAA,MACJ,MAAM;AAAA,MACN,SAAS,wDAAwD,MAAM,GACrE,eAAe,KAAK,YAAY,KAAK,EACvC;AAAA,IACF,CAAC;AACD,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,eAAe;AACpB,SAAK,eAAe;AAAA,EACtB;AACF;AAKA,SAAS,eACP,MACe;AACf,QAAM,KAAK,MAAM;AACjB,SAAO,OAAO,OAAO,YAAY,OAAO,cAAc,EAAE,KAAK,KAAK,IAC9D,KACA;AACN;AAEO,SAAS,uBACd,QACkB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,EACb,IAAI;AAEJ,QAAM,aAAa,QAAQ,gBAAgB,YAAY;AAGvD,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,YAA+B;AACnC,QAAM,UAAU,CAAC,UACf,aAAa,KAAK,CAAC,CAAC,SAAS,IAAI,IAAI,MAAM,KAAK;AAKlD,MAAI,YAA2B;AAE/B,iBAAe,SACb,cACkC;AAClC,QAAI,CAAC,YAAY;AACf,kBAAY;AACZ,aAAO;AAAA,IACT;AACA,UAAM,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,CAAC;AAC9C,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,KAAK;AAAA,QACzB,SAAS;AAAA,UACP,iBAAiB;AAAA,UACjB,gBAAgB;AAAA;AAAA,UAEhB,GAAI,iBAAiB,SACjB,EAAE,mBAAmB,OAAO,YAAY,EAAE,IAC1C,CAAC;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,kBAAY,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC5E,cAAQ,MAAM,sBAAsB,SAAS,SAAS,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AACA,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,YAAM,SACJ,OAAO,MAAM,UAAU,YAAY,KAAK,QAAQ,KAAK,QAAQ;AAC/D,YAAM,UAAU,IAAI;AAAA,QAClB,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AACA,kBAAY,GAAG,QAAQ,OAAO,SAAS,GAAG;AAC1C,cAAQ,MAAM,sBAAsB,SAAS,EAAE;AAC/C,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAI,IAAI;AACX,kBAAY,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,SAAS,GAAG;AAC5D,cAAQ,MAAM,sBAAsB,SAAS,EAAE;AAC/C,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAI,CAAC,MAAM;AACT,kBAAY,gCAAgC,GAAG;AAC/C,cAAQ,MAAM,sBAAsB,SAAS,EAAE;AAC/C,aAAO;AAAA,IACT;AACA,gBAAY;AACZ,WAAO,UAAU,IAAI;AAAA,EACvB;AAEA,iBAAe,mBAAqD;AAClE,QAAI,QAAQ,SAAS,EAAG,QAAO,UAAU;AACzC,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI,eAAe,sBAAuB,QAAO;AACjD,YAAM;AAAA,IACR;AACA,QAAI,QAAQ,aAAa,EAAG,aAAY,EAAE,MAAM,IAAI,IAAI,EAAE;AAC1D,WAAO;AAAA,EACT;AAEA,iBAAe,mBACb,MAC2B;AAC3B,UAAM,eAAe,eAAe,IAAI;AAExC,QAAI,iBAAiB,KAAM,QAAO,2BAA2B,MAAM,IAAI;AAEvE,QAAI,QAAQ,YAAY,IAAI,YAAY;AACxC,QAAI,CAAC,QAAQ,KAAK,GAAG;AAEnB,YAAM,MAAM,MAAM,SAAS,YAAY;AACvC,UAAI,CAAC,IAAK,QAAO,2BAA2B,MAAM,YAAY;AAG9D,cAAQ;AAAA,QACN,MAAM,2BAA2B,KAAK,YAAY;AAAA,QAClD,IAAI,IAAI;AAAA,MACV;AACA,UAAI,aAAa,EAAG,aAAY,IAAI,cAAc,KAAK;AAAA,IACzD;AAGA,WAAO,2BAA2B,MAAM,MAAM,YAAY;AAAA,EAC5D;AAEA,WAAS,WAAW,cAA6B;AAC/C,QAAI,iBAAiB,QAAW;AAC9B,kBAAY,OAAO,YAAY;AAC/B;AAAA,IACF;AACA,gBAAY,MAAM;AAClB,gBAAY;AAAA,EACd;AAEA,WAAS,YAAY;AACnB,UAAM,MAAM,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,IAAI,OAAK,EAAE,EAAE;AACnD,QAAI,UAAW,KAAI,KAAK,UAAU,EAAE;AACpC,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,IAAI,SAAS;AAAA,MACrB,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,IAAI;AAAA,MACnD,mBAAmB,YAAY;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoB,kBAAkB,YAAY,UAAU;AACvE;AAMA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAK,QAAQ,CAAC;AACpB,SAAO;AAAA,IACL,cAAc,EAAE,eAAe,CAAC,GAAG,IAAI,QAAM;AAAA,MAC3C,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,IACF,gBAAgB,EAAE,iBAAiB,CAAC,GAAG,IAAI,SAAO;AAAA,MAChD,IAAI,GAAG;AAAA,MACP,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,cAAc,GAAG;AAAA,IACnB,EAAE;AAAA,IACF,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,MAC/B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,cAAc,EAAE;AAAA,MAChB,gBAAgB,EAAE,kBAAkB;AAAA,MACpC,UAAU,EAAE;AAAA,IACd,EAAE;AAAA,IACF,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,MAC/B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,SAAS,EAAE,UAAU,CAAC,GAAG,IAAI,QAAM;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE,UAAU;AAAA,MACpB,WAAW,EAAE;AAAA,IACf,EAAE;AAAA,EACJ;AACF;","names":[]}

package/dist/hierarchy.d.ts

@@ -1,3 +1,4 @@
+import { TRPCError } from '@trpc/server';
 import { OrgHierarchyData } from '@pablo2410/shared-ui/hierarchy/core';
 
 /**
@@ -42,6 +43,11 @@ interface HierarchyService {
      * resolved enterprise (null/undefined, or not a positive whole number)
      * receives an empty hierarchy without a Portal call — see
      * scopeHierarchyToEnterprise for the policy. Never returns null.
+     *
+     * Throws HierarchyRefusedError when the Portal refuses this app's key for
+     * the company (HTTP 401/403), so a refusal is never shown as an empty tree
+     * (#142). Any other failure (unconfigured, unreachable, 5xx, bad body) still
+     * returns an empty tree, with the reason in getStatus().lastError.
      */
     getScopedHierarchy(user: {
         enterpriseId?: number | null;
@@ -50,7 +56,7 @@ interface HierarchyService {
      * The full, unscoped hierarchy (every enterprise). For Portal/admin tooling
      * only — subdomains must use getScopedHierarchy. It names no company, so the
      * Portal may refuse it with the master key once un-named company reads are
-     * refused (subdomains#1037). null if unconfigured/unreachable.
+     * refused (subdomains#1037). null if unconfigured/unreachable/refused.
      */
     getFullHierarchy(): Promise<OrgHierarchyData | null>;
     /** Clear one enterprise's cache, or every cache with no argument. */
@@ -68,7 +74,24 @@ interface HierarchyService {
         lastError: string | null;
     };
 }
+/**
+ * The Portal refused this app's service key for the company (HTTP 401/403,
+ * e.g. "enterpriseId does not match your key"). A TRPCError with code
+ * FORBIDDEN, so a tRPC procedure that lets it through hands the app the
+ * message rather than an empty tree. FORBIDDEN for a 401 too: the user is
+ * signed in, it is the app's key that was refused, and an UNAUTHORIZED would
+ * send the user to sign in again (#142).
+ */
+declare class HierarchyRefusedError extends TRPCError {
+    /** HTTP status the Portal answered with (401 or 403). */
+    readonly status: number;
+    /** The Portal's own reason (its `error` field), if it gave one. */
+    readonly portalReason: string | null;
+    /** The company the app asked for. */
+    readonly enterpriseId: number | undefined;
+    constructor(status: number, portalReason: string | null, enterpriseId?: number);
+}
 declare function createHierarchyService(config: HierarchyServiceConfig): HierarchyService;
 
-export { createHierarchyService };
+export { HierarchyRefusedError, createHierarchyService };
 export type { HierarchyService, HierarchyServiceConfig };

package/dist/hierarchy.js

@@ -1,7 +1,9 @@
 import {
+  HierarchyRefusedError,
   createHierarchyService
-} from "./chunk-NSTH36LS.js";
+} from "./chunk-PYIA5WYH.js";
 export {
+  HierarchyRefusedError,
   createHierarchyService
 };
 //# sourceMappingURL=hierarchy.js.map

package/dist/index.d.ts

@@ -1,6 +1,7 @@
-export { HierarchyService, HierarchyServiceConfig, createHierarchyService } from './hierarchy.js';
+export { HierarchyRefusedError, HierarchyService, HierarchyServiceConfig, createHierarchyService } from './hierarchy.js';
 export { AuthEnv, BaseUser, DbAdapter, PortalUser, RoleMapper, SessionPayload, SubdomainAuth, SubdomainAuthConfig, UpsertUserPayload, createSubdomainAuth } from './auth.js';
 import { Request, Response, NextFunction } from 'express';
+import '@trpc/server';
 import '@pablo2410/shared-ui/hierarchy/core';
 
 declare const SQDCP_PILLARS: readonly ["safety", "quality", "delivery", "cost", "people"];

package/dist/index.js

@@ -7,8 +7,9 @@ import {
   sandboxPortalOrigin
 } from "./chunk-RSIH3FKC.js";
 import {
+  HierarchyRefusedError,
   createHierarchyService
-} from "./chunk-NSTH36LS.js";
+} from "./chunk-PYIA5WYH.js";
 
 // src/constants/sqdcp.ts
 var SQDCP_PILLARS = [
@@ -1029,6 +1030,7 @@ export {
   AiUnavailableError,
   DEFAULT_COST_RATE,
   DEFAULT_LLM_MODEL,
+  HierarchyRefusedError,
   KNOWLEDGE,
   LLMBudgetError,
   LLMProviderError,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/constants/sqdcp.ts","../src/metering.ts","../src/llm.ts","../src/aiGate.ts","../src/ai/personas.ts","../src/ai/knowledge.ts","../src/ai/supportEngine.ts","../src/securityHeaders.ts"],"sourcesContent":["export const SQDCP_PILLARS = [\n  \"safety\",\n  \"quality\",\n  \"delivery\",\n  \"cost\",\n  \"people\",\n] as const;\nexport type SqdcpPillar = (typeof SQDCP_PILLARS)[number];\nexport const SQDCP_PILLAR_COLORS: Record<SqdcpPillar, string> = {\n  safety: \"#ef4444\",\n  quality: \"#3b82f6\",\n  delivery: \"#f59e0b\",\n  cost: \"#10b981\",\n  people: \"#a855f7\",\n};\nexport const SQDCP_PILLAR_LABELS: Record<SqdcpPillar, string> = {\n  safety: \"Safety\",\n  quality: \"Quality\",\n  delivery: \"Delivery\",\n  cost: \"Cost\",\n  people: \"People\",\n};\n","/**\n * Metering + cost-control primitives for the AI layer.\n *\n * Every LLM call funnels through `createLLMClient` (see llm.ts), which is the one\n * place we capture token usage and enforce budgets. This module holds the\n * storage-agnostic types and pure helpers; core-server only *emits* usage and\n * *asks* a guard — each app decides where usage lands and how budgets are stored\n * (typically the Business Hub ledger).\n */\n\n/** Per-1k-token pricing used to estimate cost from token counts. */\nexport interface TokenCostRate {\n  inputPer1k: number;\n  outputPer1k: number;\n}\n\n/**\n * Default rate (USD per 1k tokens). Was priced for gemini-2.5-flash;\n * llm.ts's MODEL moved to gemini-3.5-flash (2.5-flash was deprecated for new\n * API keys) but this rate was NOT re-verified against 3.5-flash's actual\n * published pricing — treat cost figures as stale until confirmed.\n * Override per app via createLLMClient options once real pricing is known.\n */\nexport const DEFAULT_COST_RATE: TokenCostRate = {\n  inputPer1k: 0.000075, // $0.075 / 1M input tokens (gemini-2.5-flash rate, UNVERIFIED for 3.5)\n  outputPer1k: 0.0003, // $0.30  / 1M output tokens (gemini-2.5-flash rate, UNVERIFIED for 3.5)\n};\n\n/** Per-call context that varies request-to-request (set via InvokeParams.meta). */\nexport interface CallMeta {\n  /** Feature/surface label, e.g. \"opi\", \"ai-advisor\", \"insights\". */\n  label?: string;\n  /** \"marketing\" | \"operational\" | a feature name. */\n  mode?: string;\n  /** Authenticated user, when known (operational surfaces). */\n  user?: { id?: string; role?: string; enterpriseId?: string | number };\n  /** Current page/route (page-awareness + per-surface attribution). */\n  page?: string;\n}\n\n/** Emitted after every successful call. The metering sink persists this. */\nexport interface UsageEvent extends CallMeta {\n  /** App identifier, e.g. \"marketing-site\", \"businesshub\", \"oee\". */\n  app: string;\n  model: string;\n  promptTokens: number;\n  completionTokens: number;\n  totalTokens: number;\n  estCostUsd: number;\n  /** True when token counts were estimated (provider returned no usage block). */\n  estimated: boolean;\n  /** ISO timestamp. */\n  at: string;\n}\n\n/** Asked BEFORE a call, so over-budget / disabled traffic never spends. */\nexport interface GuardRequest extends CallMeta {\n  app: string;\n  /** Rough prompt-token estimate, for budget math before the call. */\n  estPromptTokens: number;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  /** User-facing reason when blocked (kill-switch, budget exceeded, rate limit). */\n  reason?: string;\n}\n\n/** Thrown by invokeLLM when a guard blocks the call. */\nexport class LLMBudgetError extends Error {\n  readonly code = \"LLM_BUDGET_BLOCKED\";\n  constructor(reason: string) {\n    super(reason);\n    this.name = \"LLMBudgetError\";\n  }\n}\n\n/** Rough token estimate (~4 chars/token) — fallback when no usage is returned. */\nexport function estimateTokens(text: string): number {\n  if (!text) return 0;\n  return Math.ceil(text.length / 4);\n}\n\n/** Estimate prompt tokens across a set of message strings. */\nexport function estimateMessageTokens(contents: string[]): number {\n  return contents.reduce((sum, c) => sum + estimateTokens(c), 0);\n}\n\n/** Compute estimated USD cost from token counts. */\nexport function computeCostUsd(\n  promptTokens: number,\n  completionTokens: number,\n  rate: TokenCostRate = DEFAULT_COST_RATE\n): number {\n  const cost =\n    (promptTokens / 1000) * rate.inputPer1k +\n    (completionTokens / 1000) * rate.outputPer1k;\n  // Round to 6 dp — sub-cent precision without float noise.\n  return Math.round(cost * 1e6) / 1e6;\n}\n","/**\n * LLM helper — calls Google's Gemini API via its OpenAI-compatible endpoint.\n *\n * A provider failure (any non-2xx answer, or no answer within `timeoutMs`)\n * throws an LLMProviderError carrying the provider, status, model, the\n * provider's own message and request ID (#98). Its message keeps the old\n * \"LLM invoke failed: <status> <statusText> – <body>\" text, so string parsing\n * keeps working. 429 and 503 can be retried (`retryDelaysMs`), and a 503 can\n * fall back to a lighter model (`fallbackModel`). All three are off unless set.\n *\n * Example:\n *   const invokeLLM = createLLMClient(ENV);\n *   const result = await invokeLLM({\n *     messages: [\n *       { role: \"system\", content: \"You are a helpful assistant.\" },\n *       { role: \"user\", content: \"Hello, world!\" },\n *     ],\n *   });\n */\nimport type { CoreEnv } from \"./types\";\nimport {\n  type CallMeta,\n  type TokenCostRate,\n  type UsageEvent,\n  type GuardRequest,\n  type GuardResult,\n  DEFAULT_COST_RATE,\n  LLMBudgetError,\n  computeCostUsd,\n  estimateMessageTokens,\n  estimateTokens,\n} from \"./metering\";\nimport type { AiGate } from \"./aiGate\";\n\nexport type Role = \"system\" | \"user\" | \"assistant\" | \"tool\" | \"function\";\n\nexport type TextContent = {\n  type: \"text\";\n  text: string;\n};\n\nexport type ImageContent = {\n  type: \"image_url\";\n  image_url: {\n    url: string;\n    detail?: \"auto\" | \"low\" | \"high\";\n  };\n};\n\nexport type FileContent = {\n  type: \"file_url\";\n  file_url: {\n    url: string;\n    mime_type?:\n      | \"audio/mpeg\"\n      | \"audio/wav\"\n      | \"application/pdf\"\n      | \"audio/mp4\"\n      | \"video/mp4\";\n  };\n};\n\nexport type MessageContent = string | TextContent | ImageContent | FileContent;\n\nexport type Message = {\n  role: Role;\n  name?: string;\n  tool_call_id?: string;\n  content: MessageContent | MessageContent[];\n};\n\nexport type Tool = {\n  type: \"function\";\n  function: {\n    name: string;\n    description?: string;\n    parameters?: Record<string, unknown>;\n  };\n};\n\ntype ToolChoiceExplicit = {\n  type: \"function\";\n  function: { name: string };\n};\n\nexport type ToolChoice =\n  \"none\" | \"auto\" | \"required\" | { name: string } | ToolChoiceExplicit;\n\ntype JsonSchema = {\n  name: string;\n  schema: Record<string, unknown>;\n  strict?: boolean;\n};\n\nexport type ResponseFormat =\n  | { type: \"text\" }\n  | { type: \"json_object\" }\n  | { type: \"json_schema\"; json_schema: JsonSchema };\n\nexport type OutputSchema = {\n  name: string;\n  schema: Record<string, unknown>;\n  strict?: boolean;\n};\n\nexport type InvokeParams = {\n  messages: Message[];\n  tools?: Tool[];\n  toolChoice?: ToolChoice;\n  tool_choice?: ToolChoice;\n  outputSchema?: OutputSchema;\n  output_schema?: OutputSchema;\n  responseFormat?: ResponseFormat;\n  response_format?: ResponseFormat;\n  /** Per-call attribution for metering/guarding (label, mode, user, page). */\n  meta?: CallMeta;\n};\n\n/** Optional metering + cost-control hooks, set once per app. */\nexport type LLMClientOptions = {\n  /** App identifier recorded on every usage event, e.g. \"marketing-site\". */\n  app?: string;\n  /** Pricing used to estimate cost from tokens. Defaults to gemini-3.5-flash (rate unverified, see metering.ts). */\n  costRate?: TokenCostRate;\n  /** Metering sink — called after each successful call. Errors are swallowed. */\n  onUsage?: (event: UsageEvent) => void | Promise<void>;\n  /** Budget/kill-switch check — called before each call; block = no spend. */\n  guard?: (req: GuardRequest) => GuardResult | Promise<GuardResult>;\n  /** The model to call. Default DEFAULT_LLM_MODEL. */\n  model?: string;\n  /**\n   * A lighter model to try once when the main model still answers 503 after\n   * its retries (#98). Off unless set.\n   */\n  fallbackModel?: string;\n  /**\n   * Give up on an attempt after this many ms: the request is aborted and an\n   * LLMProviderError with status \"TIMEOUT\" is thrown. Off unless set (Portal\n   * uses 45 000 for chat).\n   */\n  timeoutMs?: number;\n  /**\n   * Waits before each retry of a 429 or 503, e.g. [2000, 6000] for two\n   * retries. Default [] (no retries).\n   */\n  retryDelaysMs?: number[];\n  /** Injectable fetch (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /**\n   * The AI plan gate (createAiGate, #101). When set, every call must name its\n   * caller in `meta.user` ({ role, enterpriseId }) or it throws, and a caller\n   * whose company has no AI gets AiUnavailableError (the Portal's message)\n   * before any spend.\n   */\n  aiGate?: AiGate;\n};\n\n/** The model createLLMClient calls unless `model` says otherwise. */\nexport const DEFAULT_LLM_MODEL = \"gemini-3.5-flash\";\n\n/** Which AI provider answered. Only Gemini today; Azure OpenAI is #90. */\nexport type LLMProviderName = \"gemini\";\n\n/** An HTTP status from the provider, or \"TIMEOUT\" when it didn't answer. */\nexport type LLMProviderStatus = number | \"TIMEOUT\";\n\n/**\n * The AI provider failed: it answered with a non-2xx status, or not within\n * the timeout. The API key never appears in it.\n */\nexport class LLMProviderError extends Error {\n  readonly provider: LLMProviderName;\n  readonly status: LLMProviderStatus;\n  readonly statusText?: string;\n  /** The provider's own error message, at most 300 characters. */\n  readonly providerMessage?: string;\n  /** The provider's error code, e.g. \"UNAVAILABLE\" or \"RESOURCE_EXHAUSTED\". */\n  readonly providerCode?: string;\n  /** The provider's request ID, from the response headers or body. */\n  readonly providerRequestId?: string;\n  /** The model the failing attempt called. */\n  readonly model: string;\n  /** How many attempts were made in all, fallback included. */\n  readonly attempts: number;\n  /** The provider's Retry-After, in seconds, when it sent one. */\n  readonly retryAfterSeconds?: number;\n\n  constructor(init: {\n    message: string;\n    provider: LLMProviderName;\n    status: LLMProviderStatus;\n    statusText?: string;\n    providerMessage?: string;\n    providerCode?: string;\n    providerRequestId?: string;\n    model: string;\n    attempts: number;\n    retryAfterSeconds?: number;\n  }) {\n    super(init.message);\n    this.name = \"LLMProviderError\";\n    this.provider = init.provider;\n    this.status = init.status;\n    this.statusText = init.statusText;\n    this.providerMessage = init.providerMessage;\n    this.providerCode = init.providerCode;\n    this.providerRequestId = init.providerRequestId;\n    this.model = init.model;\n    this.attempts = init.attempts;\n    this.retryAfterSeconds = init.retryAfterSeconds;\n  }\n}\n\n/** Response headers that carry a provider's request ID (Google, Azure). */\nconst REQUEST_ID_HEADERS = [\n  \"x-request-id\",\n  \"x-goog-request-id\",\n  \"request-id\",\n  \"x-ms-request-id\",\n  \"apim-request-id\",\n];\n\n/** The first string (or number) under a key matching `key`, anywhere in `value`. */\nfunction findValue(value: unknown, key: RegExp, depth = 0): string | undefined {\n  if (depth > 5 || value == null || typeof value !== \"object\") return undefined;\n  for (const [k, inner] of Object.entries(value as Record<string, unknown>)) {\n    if (\n      key.test(k) &&\n      (typeof inner === \"string\" || typeof inner === \"number\")\n    ) {\n      return String(inner);\n    }\n    const found = findValue(inner, key, depth + 1);\n    if (found) return found;\n  }\n  return undefined;\n}\n\nfunction parseBody(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction retryAfterSeconds(header: string | null): number | undefined {\n  if (!header) return undefined;\n  const seconds = Number(header.trim());\n  return Number.isFinite(seconds) && seconds >= 0 ? seconds : undefined;\n}\n\nconst RETRYABLE = new Set<LLMProviderStatus>([429, 503]);\n\nexport type InvokeResult = {\n  id: string;\n  object: string;\n  created: number;\n  model: string;\n  choices: Array<{\n    index: number;\n    message: {\n      role: string;\n      content: string | null;\n      tool_calls?: Array<{\n        id: string;\n        type: \"function\";\n        function: { name: string; arguments: string };\n      }>;\n    };\n    finish_reason: string;\n  }>;\n  usage?: {\n    prompt_tokens: number;\n    completion_tokens: number;\n    total_tokens: number;\n  };\n};\n\nconst ensureArray = (\n  value: MessageContent | MessageContent[]\n): MessageContent[] => (Array.isArray(value) ? value : [value]);\n\nconst normalizeContentPart = (\n  part: MessageContent\n): TextContent | ImageContent | FileContent => {\n  if (typeof part === \"string\") {\n    return { type: \"text\", text: part };\n  }\n  if (part.type === \"text\") return part;\n  if (part.type === \"image_url\") return part;\n  if (part.type === \"file_url\") return part;\n  throw new Error(\"Unsupported message content part\");\n};\n\nconst normalizeMessage = (message: Message) => {\n  const { role, name, tool_call_id } = message;\n  if (role === \"tool\" || role === \"function\") {\n    const content = ensureArray(message.content)\n      .map(part => (typeof part === \"string\" ? part : JSON.stringify(part)))\n      .join(\"\\n\");\n    return { role, name, tool_call_id, content };\n  }\n  const contentParts = ensureArray(message.content).map(normalizeContentPart);\n  if (contentParts.length === 1 && contentParts[0].type === \"text\") {\n    return { role, name, content: contentParts[0].text };\n  }\n  return { role, name, content: contentParts };\n};\n\nconst normalizeToolChoice = (\n  toolChoice: ToolChoice | undefined,\n  tools: Tool[] | undefined\n): \"none\" | \"auto\" | ToolChoiceExplicit | undefined => {\n  if (!toolChoice) return undefined;\n  if (toolChoice === \"none\" || toolChoice === \"auto\") return toolChoice;\n  if (toolChoice === \"required\") {\n    if (!tools || tools.length === 0) {\n      throw new Error(\n        \"tool_choice 'required' was provided but no tools were configured\"\n      );\n    }\n    if (tools.length > 1) {\n      throw new Error(\n        \"tool_choice 'required' needs a single tool or specify the tool name explicitly\"\n      );\n    }\n    return { type: \"function\", function: { name: tools[0].function.name } };\n  }\n  if (\"name\" in toolChoice) {\n    return { type: \"function\", function: { name: toolChoice.name } };\n  }\n  return toolChoice;\n};\n\nconst normalizeResponseFormat = ({\n  responseFormat,\n  response_format,\n  outputSchema,\n  output_schema,\n}: {\n  responseFormat?: ResponseFormat;\n  response_format?: ResponseFormat;\n  outputSchema?: OutputSchema;\n  output_schema?: OutputSchema;\n}):\n  | { type: \"json_schema\"; json_schema: JsonSchema }\n  | { type: \"text\" }\n  | { type: \"json_object\" }\n  | undefined => {\n  const explicitFormat = responseFormat || response_format;\n  if (explicitFormat) {\n    if (\n      explicitFormat.type === \"json_schema\" &&\n      !explicitFormat.json_schema?.schema\n    ) {\n      throw new Error(\n        \"responseFormat json_schema requires a defined schema object\"\n      );\n    }\n    return explicitFormat;\n  }\n  const schema = outputSchema || output_schema;\n  if (!schema) return undefined;\n  if (!schema.name || !schema.schema) {\n    throw new Error(\"outputSchema requires both name and schema\");\n  }\n  return {\n    type: \"json_schema\",\n    json_schema: {\n      name: schema.name,\n      schema: schema.schema,\n      ...(typeof schema.strict === \"boolean\" ? { strict: schema.strict } : {}),\n    },\n  };\n};\n\n/** Flatten a message's content to plain text for token estimation. */\nfunction messageToText(content: unknown): string {\n  if (typeof content === \"string\") return content;\n  if (Array.isArray(content)) {\n    return content\n      .map(part => {\n        if (typeof part === \"string\") return part;\n        if (part && typeof part === \"object\" && \"text\" in part) {\n          return String((part as { text?: unknown }).text ?? \"\");\n        }\n        return \"\";\n      })\n      .join(\" \");\n  }\n  return \"\";\n}\n\nexport function createLLMClient(env: CoreEnv, options: LLMClientOptions = {}) {\n  const {\n    app = \"unknown\",\n    costRate = DEFAULT_COST_RATE,\n    onUsage,\n    guard,\n    model: mainModel = DEFAULT_LLM_MODEL,\n    fallbackModel,\n    timeoutMs,\n    retryDelaysMs = [],\n    fetchImpl = fetch,\n    aiGate,\n  } = options;\n  const provider: LLMProviderName = \"gemini\";\n\n  /** Never let the key into an error, whatever the provider echoes back. */\n  const redact = (text: string) =>\n    env.geminiApiKey ? text.split(env.geminiApiKey).join(\"[redacted]\") : text;\n\n  const resolveApiUrl = () =>\n    env.geminiApiUrl && env.geminiApiUrl.trim().length > 0\n      ? `${env.geminiApiUrl.replace(/\\/$/, \"\")}/chat/completions`\n      : \"https://generativelanguage.googleapis.com/v1beta/openai/chat/completions\";\n\n  const assertApiKey = () => {\n    if (!env.geminiApiKey) {\n      throw new Error(\"GEMINI_API_KEY is not configured\");\n    }\n  };\n\n  return async function invokeLLM(params: InvokeParams): Promise<InvokeResult> {\n    assertApiKey();\n\n    const {\n      messages,\n      tools,\n      toolChoice,\n      tool_choice,\n      outputSchema,\n      output_schema,\n      responseFormat,\n      response_format,\n      meta = {},\n    } = params;\n\n    // ── AI plan gate: is AI on for this caller's company? (#101) ──\n    if (aiGate) {\n      if (!meta.user) {\n        throw new Error(\n          \"[core-server] this LLM client has an aiGate, so every call must name its caller in meta.user ({ role, enterpriseId })\"\n        );\n      }\n      await aiGate.assertAvailable(meta.user);\n    }\n\n    const estPromptTokens = estimateMessageTokens(\n      messages.map(m => messageToText(m.content))\n    );\n\n    // ── Cost control: ask the guard before spending anything ──\n    if (guard) {\n      const verdict = await guard({ app, estPromptTokens, ...meta });\n      if (!verdict.allowed) {\n        throw new LLMBudgetError(\n          verdict.reason ?? \"AI is temporarily unavailable.\"\n        );\n      }\n    }\n\n    const payload: Record<string, unknown> = {\n      messages: messages.map(normalizeMessage),\n    };\n\n    if (tools && tools.length > 0) {\n      payload.tools = tools;\n    }\n\n    const normalizedToolChoice = normalizeToolChoice(\n      toolChoice || tool_choice,\n      tools\n    );\n    if (normalizedToolChoice) {\n      payload.tool_choice = normalizedToolChoice;\n    }\n\n    payload.max_tokens = 32768;\n\n    const normalizedResponseFormat = normalizeResponseFormat({\n      responseFormat,\n      response_format,\n      outputSchema,\n      output_schema,\n    });\n    if (normalizedResponseFormat) {\n      payload.response_format = normalizedResponseFormat;\n    }\n\n    let attempts = 0;\n\n    /** One request to one model. Throws LLMProviderError on a provider failure. */\n    const attempt = async (model: string): Promise<InvokeResult> => {\n      attempts++;\n      const timeout =\n        timeoutMs && timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;\n      try {\n        const response = await fetchImpl(resolveApiUrl(), {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            authorization: `Bearer ${env.geminiApiKey}`,\n          },\n          body: JSON.stringify({ model, ...payload }),\n          signal: timeout,\n        });\n\n        if (!response.ok) {\n          const errorText = await response.text();\n          const body = parseBody(errorText);\n          const providerMessage = redact(\n            (body !== undefined\n              ? findValue(body, /^message$/)\n              : errorText.trim()) ?? \"\"\n          ).slice(0, 300);\n          throw new LLMProviderError({\n            // Unchanged text, so callers that still parse it keep working.\n            message: redact(\n              `LLM invoke failed: ${response.status} ${response.statusText} – ${errorText}`\n            ),\n            provider,\n            status: response.status,\n            statusText: response.statusText || undefined,\n            providerMessage: providerMessage || undefined,\n            providerCode:\n              body !== undefined ? findValue(body, /^status$/) : undefined,\n            providerRequestId:\n              REQUEST_ID_HEADERS.map(h => response.headers.get(h)).find(\n                Boolean\n              ) ??\n              (body !== undefined\n                ? findValue(body, /^(request_?id|trace_?id)$/i)\n                : undefined) ??\n              undefined,\n            model,\n            attempts,\n            retryAfterSeconds: retryAfterSeconds(\n              response.headers.get(\"retry-after\")\n            ),\n          });\n        }\n\n        return (await response.json()) as InvokeResult;\n      } catch (err) {\n        if (err instanceof LLMProviderError) throw err;\n        if (timeout?.aborted) {\n          throw new LLMProviderError({\n            message: `LLM invoke failed: TIMEOUT – no answer from ${provider} (${model}) within ${timeoutMs} ms`,\n            provider,\n            status: \"TIMEOUT\",\n            model,\n            attempts,\n          });\n        }\n        throw err;\n      }\n    };\n\n    /** A model's attempts: the first, then one per retry delay on 429/503. */\n    const withRetries = async (\n      model: string,\n      delays: number[]\n    ): Promise<InvokeResult> => {\n      for (let i = 0; ; i++) {\n        try {\n          return await attempt(model);\n        } catch (err) {\n          if (\n            err instanceof LLMProviderError &&\n            RETRYABLE.has(err.status) &&\n            i < delays.length\n          ) {\n            await new Promise(resolve => setTimeout(resolve, delays[i]));\n            continue;\n          }\n          throw err;\n        }\n      }\n    };\n\n    let usedModel = mainModel;\n    let result: InvokeResult;\n    try {\n      result = await withRetries(mainModel, retryDelaysMs);\n    } catch (err) {\n      // Still busy after its retries: one try on the lighter model.\n      if (\n        !fallbackModel ||\n        !(err instanceof LLMProviderError) ||\n        err.status !== 503\n      ) {\n        throw err;\n      }\n      usedModel = fallbackModel;\n      result = await attempt(fallbackModel);\n    }\n\n    // ── Metering: capture usage and emit to the sink (never breaks the call) ──\n    if (onUsage) {\n      try {\n        const provided = result.usage;\n        const estimated = !provided;\n        const promptTokens = provided?.prompt_tokens ?? estPromptTokens;\n        const completionTokens =\n          provided?.completion_tokens ??\n          estimateTokens(messageToText(result.choices?.[0]?.message?.content));\n        const totalTokens =\n          provided?.total_tokens ?? promptTokens + completionTokens;\n\n        const event: UsageEvent = {\n          app,\n          model: result.model ?? usedModel,\n          promptTokens,\n          completionTokens,\n          totalTokens,\n          estCostUsd: computeCostUsd(promptTokens, completionTokens, costRate),\n          estimated,\n          at: new Date().toISOString(),\n          ...meta,\n        };\n\n        await onUsage(event);\n      } catch (err) {\n        // Metering must never take down a working chat.\n        console.warn(\"[core-server] onUsage sink failed:\", err);\n      }\n    }\n\n    return result;\n  };\n}\n","/**\n * AI plan gate — \"is Opi's AI on for this company?\", asked of the Portal\n * before a model call (#101, subdomains#1076 option B).\n *\n * The answer is the Portal's own `ai.availability` (assertAiAllowed: the\n * environment, the platform and company switches, the plan), fetched for a\n * named company over the Service API (oplytics-portal#397):\n *\n *   GET /api/service/ai/availability?role=<role>\n *   X-Service-Key: <key>   X-Enterprise-Id: <company>\n *   → { available: true } | { available: false, reason, message }\n *\n * Cached per company and per platform-admin-or-not (only platform_admin\n * changes the Portal's answer), for `cacheTtlMs`.\n *\n * Fails open: when the Portal can't tell (the route isn't there yet, the\n * Portal is down or slow, an odd reply), the call goes ahead, as in\n * subdomains#1070. This is a plan gate, not a security boundary, and an\n * outage must not switch Opi off for every company.\n *\n * Usually not called directly: pass it to createLLMClient (or\n * createSupportEngine) as `aiGate`, and every call through that client is\n * checked before any spend.\n */\n\n/** Why the Portal says AI is off (its AiDisabledReason). */\nexport type AiUnavailableReason =\n  \"non-production\" | \"kill-switch\" | \"enterprise-disabled\" | \"plan-tier\";\n\nexport type AiAvailability =\n  | {\n      available: true;\n      /** True when the Portal couldn't tell and the call is let through. */\n      unknown?: true;\n    }\n  | {\n      available: false;\n      /** The Portal's reason, e.g. \"plan-tier\". */\n      reason: AiUnavailableReason | string;\n      /** The Portal's user-facing message. */\n      message: string;\n    };\n\n/** Who a model call is for: the same shape as CallMeta's `user`. */\nexport interface AiCaller {\n  enterpriseId?: number | string | null;\n  role?: string | null;\n}\n\n/** AI is off for this caller's company. `message` is the Portal's own text. */\nexport class AiUnavailableError extends Error {\n  readonly reason: AiUnavailableReason | string;\n  readonly enterpriseId: number | null;\n\n  constructor(\n    reason: AiUnavailableReason | string,\n    message: string,\n    enterpriseId: number | null\n  ) {\n    super(message);\n    this.name = \"AiUnavailableError\";\n    this.reason = reason;\n    this.enterpriseId = enterpriseId;\n  }\n}\n\nexport interface AiGateConfig {\n  /** Portal Service API base URL, e.g. https://portal.oplyticsdigital.net */\n  portalApiUrl: string;\n  /** The app's X-Service-Key. */\n  portalApiKey: string;\n  /** How long an answer is reused, in ms. Default 60 s. */\n  cacheTtlMs?: number;\n  /** How long to wait for the Portal before letting the call through. Default 2 s. */\n  timeoutMs?: number;\n  /** Injectable fetch (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /** Injectable clock (for tests). Defaults to Date.now. */\n  now?: () => number;\n}\n\nexport interface AiGate {\n  /** The Portal's answer for this caller (cached). Never throws. */\n  check(caller: AiCaller | null | undefined): Promise<AiAvailability>;\n  /** Throws AiUnavailableError when AI is off for this caller. */\n  assertAvailable(caller: AiCaller | null | undefined): Promise<void>;\n  /** Forget one company's answers, or every answer with no argument. */\n  invalidate(enterpriseId?: number): void;\n}\n\n/** A company id: a positive whole number, from a number or a numeric string. */\nfunction enterpriseIdOf(caller: AiCaller | null | undefined): number | null {\n  const raw = caller?.enterpriseId;\n  const id =\n    typeof raw === \"number\"\n      ? raw\n      : typeof raw === \"string\" && /^\\d+$/.test(raw.trim())\n        ? Number(raw.trim())\n        : NaN;\n  return Number.isSafeInteger(id) && id > 0 ? id : null;\n}\n\nconst UNKNOWN: AiAvailability = { available: true, unknown: true };\n\nexport function createAiGate(config: AiGateConfig): AiGate {\n  const {\n    portalApiUrl,\n    portalApiKey,\n    cacheTtlMs = 60_000,\n    timeoutMs = 2_000,\n    fetchImpl = fetch,\n    now = Date.now,\n  } = config;\n  const configured = Boolean(portalApiUrl && portalApiKey);\n  const url = `${portalApiUrl.replace(/\\/$/, \"\")}/api/service/ai/availability`;\n\n  const cache = new Map<string, { answer: AiAvailability; at: number }>();\n  const inflight = new Map<string, Promise<AiAvailability>>();\n  const warned = new Set<string>();\n  const warnOnce = (key: string, message: string) => {\n    if (warned.has(key)) return;\n    warned.add(key);\n    console.warn(`[core-server aiGate] ${message}`);\n  };\n\n  async function ask(\n    enterpriseId: number | null,\n    role: string | undefined\n  ): Promise<AiAvailability> {\n    if (!configured) {\n      warnOnce(\n        \"unconfigured\",\n        \"no Portal API URL/key — AI plan not checked, calls go ahead\"\n      );\n      return UNKNOWN;\n    }\n    try {\n      const res = await fetchImpl(\n        role ? `${url}?role=${encodeURIComponent(role)}` : url,\n        {\n          headers: {\n            \"X-Service-Key\": portalApiKey,\n            ...(enterpriseId !== null\n              ? { \"X-Enterprise-Id\": String(enterpriseId) }\n              : {}),\n          },\n          signal: AbortSignal.timeout(timeoutMs),\n        }\n      );\n      if (res.status === 404) {\n        warnOnce(\n          \"404\",\n          \"the Portal has no /api/service/ai/availability yet (oplytics-portal#397) — AI plan not checked, calls go ahead\"\n        );\n        return UNKNOWN;\n      }\n      if (!res.ok) {\n        console.warn(\n          `[core-server aiGate] Portal answered ${res.status} for company ${enterpriseId ?? \"-\"} — letting the call through`\n        );\n        return UNKNOWN;\n      }\n      const body = (await res.json().catch(() => null)) as {\n        available?: unknown;\n        reason?: unknown;\n        message?: unknown;\n      } | null;\n      if (body?.available === true) return { available: true };\n      if (body?.available === false && typeof body.message === \"string\") {\n        return {\n          available: false,\n          reason: typeof body.reason === \"string\" ? body.reason : \"unavailable\",\n          message: body.message,\n        };\n      }\n      console.warn(\n        `[core-server aiGate] odd reply for company ${enterpriseId ?? \"-\"} — letting the call through`\n      );\n      return UNKNOWN;\n    } catch (err) {\n      console.warn(\n        `[core-server aiGate] Portal check failed for company ${enterpriseId ?? \"-\"} (${err instanceof Error ? err.message : String(err)}) — letting the call through`\n      );\n      return UNKNOWN;\n    }\n  }\n\n  async function check(\n    caller: AiCaller | null | undefined\n  ): Promise<AiAvailability> {\n    const enterpriseId = enterpriseIdOf(caller);\n    const role = caller?.role ?? undefined;\n    // Only platform_admin changes the Portal's answer for a company.\n    const key = `${enterpriseId ?? \"-\"}|${role === \"platform_admin\" ? \"pa\" : \"user\"}`;\n\n    const hit = cache.get(key);\n    if (hit && now() - hit.at < cacheTtlMs) return hit.answer;\n\n    let pending = inflight.get(key);\n    if (!pending) {\n      pending = ask(enterpriseId, role)\n        .then(answer => {\n          if (cacheTtlMs > 0) cache.set(key, { answer, at: now() });\n          return answer;\n        })\n        .finally(() => inflight.delete(key));\n      inflight.set(key, pending);\n    }\n    return pending;\n  }\n\n  async function assertAvailable(\n    caller: AiCaller | null | undefined\n  ): Promise<void> {\n    const answer = await check(caller);\n    if (!answer.available) {\n      throw new AiUnavailableError(\n        answer.reason,\n        answer.message,\n        enterpriseIdOf(caller)\n      );\n    }\n  }\n\n  function invalidate(enterpriseId?: number): void {\n    if (enterpriseId === undefined) {\n      cache.clear();\n      return;\n    }\n    for (const key of [...cache.keys()]) {\n      if (key.startsWith(`${enterpriseId}|`)) cache.delete(key);\n    }\n  }\n\n  return { check, assertAvailable, invalidate };\n}\n","/**\n * Personas for the shared Oplytics AI assistant.\n *\n * One brain, two voices: the same knowledge base is wrapped in a customer-facing\n * persona (\"Opi\" on the marketing site) or an operational persona (the in-app\n * \"AI Support Engineer\" in the portal / subdomains). The mode selects the overlay.\n */\n\nimport {\n  PRODUCTION_MARKETING_ORIGIN,\n  resolveMarketingOrigin,\n} from \"../sandbox\";\n\nexport type AssistantMode = \"marketing\" | \"operational\";\n\n/** Identity + tone shared by every surface. */\nconst BASE_PERSONA = `\nYou are the Oplytics AI assistant — a knowledgeable, friendly guide to the Oplytics operational-excellence platform.\nYour personality is warm, approachable, and genuinely helpful, while staying clear, professional, and competent — especially on operational safety and platform technicals.\n\nShared guidelines:\n- Use a warm, professional tone: clear, concise, and easy to follow. Avoid heavy slang, forced catchphrases, or over-familiarity — be friendly without overdoing it.\n- For anything safety- or incident-related, stay serious and accurate while keeping the warm tone — prioritise accuracy over speed.\n- If you don't know something, be honest and guide the user to the right place rather than inventing an answer.\n- Prefer the supplied Oplytics knowledge below over your own assumptions. If the knowledge doesn't cover it, say so plainly.\n`.trim();\n\n/**\n * Real, live Oplytics pages, injected into every persona so Opi can cite an\n * actual URL instead of inventing one. Copied word for word from Portal's\n * OPLYTICS_FACTS (oplytics-portal server/routers/ai.ts, portal#259) so the two\n * Opis give the same answer. UPDATE THIS LIST whenever a public page is added\n * to or removed from the marketing site (routes: marketing-site\n * client/src/App.tsx), and keep Portal's copy in step. These are the\n * production addresses; buildSystemPrompt points them at the sandbox\n * marketing site when running as the sandbox (#86).\n */\nexport const OPLYTICS_VERIFIED_LINKS = `\nReal Oplytics links. Only cite links from this list. Never invent, guess or modify a URL.\n- Home / product overview: https://oplytics.digital\n- Pricing: https://oplytics.digital/pricing\n- Contact / book a demo: https://oplytics.digital/contact\n- About: https://oplytics.digital/about\n- Opi and the AI platform: https://oplytics.digital/ai\n- The Obeya Room: https://oplytics.digital/obeya\n- Why Oplytics: https://oplytics.digital/why-us\n- Resources: https://oplytics.digital/resources\n- Terms of Service: https://oplytics.digital/terms\n- Privacy Policy: https://oplytics.digital/privacy\n- Cookie Policy: https://oplytics.digital/cookies\n- Acceptable Use Policy: https://oplytics.digital/aup\n- Data Processing Agreement (DPA): https://oplytics.digital/dpa\n- Service Level Agreement (SLA): https://oplytics.digital/sla\nIf asked for a page that is not in this list (for example careers), say there is no link for it and describe where to look instead, such as the Contact page or the relevant area of the app. Do not make up a link.\n`.trim();\n\n/** Customer-facing overlay — Opi on the public marketing site. */\nconst MARKETING_OVERLAY = `\nYou are \"Opi\", talking to a prospective customer on the public Oplytics marketing site.\n- Focus on features, benefits, outcomes, and helping them book a demo or get in touch.\n- Be persuasive but never pushy or salesy; lead with how Oplytics solves their problem.\n- Never discuss competitor products by name.\n- For specific pricing, direct the user to the Contact page (https://oplytics.digital/contact) rather than quoting figures.\n- You do not have access to any account or operational data — you are pre-sales only.\n`.trim();\n\n/** Authenticated overlay — the in-app AI Support Engineer. */\nconst OPERATIONAL_OVERLAY = `\nYou are the Oplytics AI Support Engineer, supporting a verified, logged-in user inside the platform.\n- Tailor responses to their role and enterprise context (supplied below when available).\n- Help with deep operational support: platform setup, training, troubleshooting, data interpretation, and specific tasks.\n- For safety-related queries, always prioritise accuracy and cite the correct workflow.\n- You may reference platform features and the user's context, but never expose data the user shouldn't see.\n`.trim();\n\nconst OVERLAYS: Record<AssistantMode, string> = {\n  marketing: MARKETING_OVERLAY,\n  operational: OPERATIONAL_OVERLAY,\n};\n\nexport interface BuildSystemPromptParams {\n  mode: AssistantMode;\n  /** Pre-formatted knowledge block (see formatKnowledge) injected into the prompt. */\n  knowledge?: string;\n  /** Free-form runtime context (current page, user/role, enterprise, etc.). */\n  context?: string;\n  /**\n   * Origin for the marketing links Opi cites. Default: MARKETING_ORIGIN if\n   * set, else http://localhost:3007 in the local sandbox\n   * (INFISICAL_ENV=staging), else https://oplytics.digital (#86).\n   */\n  marketingOrigin?: string;\n}\n\n/** Compose the full system prompt: base identity + mode overlay + verified links + knowledge + context. */\nexport function buildSystemPrompt({\n  mode,\n  knowledge,\n  context,\n  marketingOrigin = resolveMarketingOrigin(),\n}: BuildSystemPromptParams): string {\n  // The fixed text cites production pages; in the sandbox they point at the\n  // sandbox marketing site instead, so Opi never sends anyone to production.\n  const sections = [BASE_PERSONA, OVERLAYS[mode], OPLYTICS_VERIFIED_LINKS].map(\n    s => s.replaceAll(PRODUCTION_MARKETING_ORIGIN, marketingOrigin)\n  );\n\n  if (knowledge && knowledge.trim().length > 0) {\n    sections.push(`Relevant Oplytics knowledge:\\n${knowledge.trim()}`);\n  }\n\n  if (context && context.trim().length > 0) {\n    sections.push(`Current context:\\n${context.trim()}`);\n  }\n\n  return sections.join(\"\\n\\n\");\n}\n","/**\n * Shared Oplytics knowledge base + a RAG-ready retrieval interface.\n *\n * Phase 2a ships the knowledge as version-controlled data injected into the\n * system prompt, behind a `Retriever` interface. Phase 2b can swap the static\n * retriever for a vector-store-backed one WITHOUT changing any consumer — the\n * signature is the contract.\n *\n * This is a deliberately small seed. Expand `KNOWLEDGE` over time (it's the one\n * source of truth shared by Opi and the in-app AI Support Engineer).\n */\nimport type { AssistantMode } from \"./personas\";\n\nexport interface KnowledgeItem {\n  id: string;\n  question: string;\n  answer: string;\n  /** Lowercase keywords/tags used by the static retriever's scoring. */\n  tags: string[];\n  /** If set, this item is only surfaced in the listed modes. Default: both. */\n  modes?: AssistantMode[];\n}\n\nexport interface RetrieveOptions {\n  mode: AssistantMode;\n  /** Max items to return. Default 4. */\n  limit?: number;\n}\n\n/**\n * A retriever maps a user query to the most relevant knowledge items.\n * Async so a future vector/embedding implementation can drop in unchanged.\n */\nexport type Retriever = (\n  query: string,\n  options: RetrieveOptions\n) => Promise<KnowledgeItem[]> | KnowledgeItem[];\n\n/** Seed knowledge. Sourced from the Oplytics solution set; extend freely. */\nexport const KNOWLEDGE: KnowledgeItem[] = [\n  // ── Platform ──────────────────────────────────────────────────────────────\n  {\n    id: \"platform-overview\",\n    question: \"What does Oplytics do?\",\n    answer:\n      \"Oplytics is an integrated operational-excellence platform for manufacturers. Its modules share data, context, and AI insights so individual tools compound into one advantage instead of working in silos. Four services are live today (OEE Manager, the SQDCP Dashboard, Policy Deployment, and Action Manager), with more on the way.\",\n    tags: [\n      \"platform\",\n      \"overview\",\n      \"what\",\n      \"oplytics\",\n      \"modules\",\n      \"manufacturing\",\n    ],\n  },\n  {\n    id: \"who-for\",\n    question: \"Who is Oplytics for?\",\n    answer:\n      \"Manufacturers and factory operations teams running continuous improvement, lean, and daily management — from the shop floor to senior leadership. It suits anyone replacing whiteboards, spreadsheets, and disconnected point tools with one connected system.\",\n    tags: [\n      \"who\",\n      \"for\",\n      \"audience\",\n      \"manufacturer\",\n      \"factory\",\n      \"lean\",\n      \"operations\",\n    ],\n  },\n  {\n    id: \"live-services\",\n    question: \"Which services are available right now?\",\n    answer:\n      \"Live today: OEE Manager, the SQDCP Dashboard, Policy Deployment, and Action Manager.\",\n    tags: [\n      \"live\",\n      \"available\",\n      \"services\",\n      \"roadmap\",\n      \"coming\",\n      \"soon\",\n      \"status\",\n    ],\n  },\n  {\n    id: \"integrated-platform\",\n    question: \"Why one platform instead of separate tools?\",\n    answer:\n      \"Every module shares the same data and context, so an action raised on a tier board, a loss in OEE, and a strategic objective all connect. That shared backbone is what lets the AI surface patterns no single tool could see alone.\",\n    tags: [\"integrated\", \"platform\", \"connected\", \"modules\", \"data\", \"why\"],\n  },\n  {\n    id: \"methodologies\",\n    question: \"What improvement methodologies does it support?\",\n    answer:\n      \"Best-practice CI is built into the workflows: Lean, Kaizen, and PDCA throughout, plus Hoshin Kanri (with X-matrix and catchball) for strategy deployment and the SQDCP framework for daily management.\",\n    tags: [\n      \"lean\",\n      \"kaizen\",\n      \"pdca\",\n      \"hoshin\",\n      \"methodology\",\n      \"ci\",\n      \"continuous\",\n      \"improvement\",\n    ],\n  },\n  {\n    id: \"mobile-desktop\",\n    question: \"Can we use it on mobile?\",\n    answer:\n      \"Yes — Oplytics works on desktop and mobile, so boards, actions, and reports are accessible from any device, on the floor or off-site.\",\n    tags: [\"mobile\", \"desktop\", \"device\", \"tablet\", \"phone\", \"access\"],\n  },\n  // ── OEE Manager (live) ─────────────────────────────────────────────────────\n  {\n    id: \"oee-manager\",\n    question: \"How does OEE Manager work?\",\n    answer:\n      \"OEE Manager tracks Overall Equipment Effectiveness — availability, performance, and quality — in real time across every machine and line. It categorises downtime and speed losses, builds Pareto/loss analysis, and trends OEE by shift, line, product, and operator so teams target the biggest losses first.\",\n    tags: [\n      \"oee\",\n      \"manager\",\n      \"downtime\",\n      \"loss\",\n      \"availability\",\n      \"performance\",\n      \"quality\",\n      \"tracking\",\n      \"equipment\",\n    ],\n  },\n  {\n    id: \"oee-data-collection\",\n    question: \"Does OEE data have to be entered by hand?\",\n    answer:\n      \"No — machines and other systems can send live data to OEE Manager automatically through its REST API or webhooks, eliminating manual-entry errors. Manual entry is still available where automation isn't in place.\",\n    tags: [\n      \"oee\",\n      \"data\",\n      \"collection\",\n      \"automated\",\n      \"api\",\n      \"webhook\",\n      \"plc\",\n      \"sensor\",\n      \"manual\",\n    ],\n  },\n  {\n    id: \"oee-targets-handover\",\n    question: \"Can we set OEE targets and run shift handovers?\",\n    answer:\n      \"Yes. Set OEE targets by line, product, and shift with live visual indicators against target, and generate digital shift-handover reports with OEE summaries, open actions, and key events from the previous shift.\",\n    tags: [\"oee\", \"target\", \"shift\", \"handover\", \"report\", \"goal\"],\n  },\n  // ── SQDCP Dashboard (live) ─────────────────────────────────────────────────\n  {\n    id: \"sqdcp\",\n    question: \"What is the SQDCP Dashboard?\",\n    answer:\n      \"SQDCP replaces physical whiteboards with real-time digital tier boards covering Safety, Quality, Delivery, Cost, and People. Boards are accessible from any device and keep daily management consistent across shifts and sites.\",\n    tags: [\n      \"sqdcp\",\n      \"tier\",\n      \"board\",\n      \"dashboard\",\n      \"daily\",\n      \"management\",\n      \"whiteboard\",\n    ],\n  },\n  {\n    id: \"sqdcp-pillars\",\n    question: \"What does SQDCP track?\",\n    answer:\n      \"The five pillars: Safety (incidents, near-misses, observations), Quality (first-pass yield, scrap, complaints), Delivery (on-time delivery, schedule adherence), Cost (operational cost and waste), and People (attendance, training, skills).\",\n    tags: [\n      \"sqdcp\",\n      \"safety\",\n      \"quality\",\n      \"delivery\",\n      \"cost\",\n      \"people\",\n      \"pillars\",\n      \"metrics\",\n    ],\n  },\n  // ── Policy Deployment (live) ───────────────────────────────────────────────\n  {\n    id: \"policy-deployment\",\n    question: \"What is Policy Deployment?\",\n    answer:\n      \"Policy Deployment cascades strategy through every level using Hoshin Kanri: define 3-5 year breakthrough objectives and annual priorities, link them in a visual X-matrix, deploy via the catchball process, and review progress on a monthly/quarterly cadence with bowling charts.\",\n    tags: [\n      \"policy\",\n      \"deployment\",\n      \"hoshin\",\n      \"kanri\",\n      \"strategy\",\n      \"xmatrix\",\n      \"catchball\",\n      \"objectives\",\n    ],\n  },\n  {\n    id: \"catchball\",\n    question: \"What is the catchball process?\",\n    answer:\n      \"Catchball is how objectives are aligned top-down and bottom-up: leadership proposes goals, teams feed back what's achievable, and the two iterate until aligned. Oplytics facilitates this digitally so strategy doesn't get lost between management layers.\",\n    tags: [\n      \"catchball\",\n      \"hoshin\",\n      \"alignment\",\n      \"objectives\",\n      \"policy\",\n      \"deployment\",\n    ],\n  },\n  // ── Action Manager (live) ──────────────────────────────────────────────────\n  {\n    id: \"action-manager\",\n    question: \"What is Action Manager?\",\n    answer:\n      \"Action Manager is one unified action register: capture actions from any source (audits, incidents, meetings, tier boards), assign them with owners and due dates, auto-escalate overdue items, and track status from open to verified closure. Analytics show completion rates, ageing, and source breakdown.\",\n    tags: [\n      \"action\",\n      \"manager\",\n      \"tasks\",\n      \"improvement\",\n      \"ci\",\n      \"register\",\n      \"escalation\",\n      \"closure\",\n    ],\n  },\n  // ── Integrations ───────────────────────────────────────────────────────────\n  {\n    id: \"connect-integrations\",\n    question: \"Can Oplytics connect to our machines and systems?\",\n    answer:\n      \"Yes — machines and other systems can send live data to OEE Manager automatically through its REST API or webhooks. For a particular protocol, machine type, or business system, get in touch via /contact so the team can scope your setup.\",\n    tags: [\n      \"connect\",\n      \"integration\",\n      \"machine\",\n      \"plc\",\n      \"scada\",\n      \"sensor\",\n      \"opcua\",\n      \"mqtt\",\n      \"modbus\",\n      \"iot\",\n      \"api\",\n      \"webhook\",\n    ],\n  },\n  {\n    id: \"erp-integration\",\n    question: \"Can it integrate with our ERP or other systems?\",\n    answer:\n      \"Oplytics focuses on shop-floor connectivity (machines, PLCs, sensors) today. For ERP or other business-system integrations, the best step is to get in touch via /contact so the team can scope your specific setup.\",\n    tags: [\"erp\", \"integration\", \"system\", \"api\", \"data\", \"contact\"],\n  },\n  {\n    id: \"protocols\",\n    question: \"Which industrial protocols are supported?\",\n    answer:\n      \"Today OEE Manager takes live machine data through a REST API (data sent by HTTP POST) and webhooks. If your equipment uses a specific industrial protocol such as OPC-UA, MQTT, or Modbus, get in touch via /contact so the team can confirm the best way to connect it.\",\n    tags: [\n      \"protocol\",\n      \"opcua\",\n      \"mqtt\",\n      \"modbus\",\n      \"plc\",\n      \"scada\",\n      \"edge\",\n      \"connectivity\",\n    ],\n  },\n  // ── AI ─────────────────────────────────────────────────────────────────────\n  {\n    id: \"integrated-ai\",\n    question: \"How does the AI help?\",\n    answer:\n      \"AI runs across every module — surfacing patterns, predicting issues, and recommending actions no single tool could spot alone — and the assistant helps users navigate, answers questions, and suggests next steps.\",\n    tags: [\n      \"ai\",\n      \"insights\",\n      \"predict\",\n      \"assistant\",\n      \"recommend\",\n      \"intelligence\",\n    ],\n  },\n  {\n    id: \"ai-assistant\",\n    question: \"Who are you / what can you help with?\",\n    answer:\n      \"I'm Opi, the Oplytics AI guide. I can explain what the platform and each module do, point you to the right place, and help you book a demo or get in touch.\",\n    tags: [\"opi\", \"assistant\", \"help\", \"who\", \"guide\", \"bot\"],\n  },\n  // ── Pricing, demos, getting started (marketing) ────────────────────────────\n  {\n    id: \"pricing\",\n    question: \"How much does it cost?\",\n    answer:\n      \"Pricing is tailored to your sites and the modules you use, so figures aren't published. The best next step is to get in touch via the contact page (/contact) and the team will put together a quote.\",\n    tags: [\"pricing\", \"price\", \"cost\", \"quote\", \"how\", \"much\", \"plan\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"plans\",\n    question: \"What plans are available?\",\n    answer:\n      \"There are tiers to suit different stages — an Early Beta Partner programme, Starter, Professional, and Enterprise — covering different usage limits and capabilities like custom integrations and SLAs. All four live services are included; reach out via /contact to find the right fit.\",\n    tags: [\n      \"plan\",\n      \"tier\",\n      \"starter\",\n      \"professional\",\n      \"enterprise\",\n      \"beta\",\n      \"package\",\n    ],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"beta\",\n    question: \"Is there a beta or early-adopter option?\",\n    answer:\n      \"Yes — the Early Beta Partner programme is for teams who want to get started early and shape the platform. Get in touch via /contact to learn more.\",\n    tags: [\"beta\", \"early\", \"partner\", \"adopter\", \"trial\", \"pilot\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"demo\",\n    question: \"Can I see a demo?\",\n    answer:\n      \"Absolutely — you can book a demo or try the live module demos. Head to the contact page (/contact) to get set up.\",\n    tags: [\"demo\", \"trial\", \"try\", \"book\", \"see\", \"show\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"contact\",\n    question: \"How do I get in touch?\",\n    answer:\n      \"Head to the contact page at /contact — tell the team a little about your operation and they'll take it from there, whether that's a demo, a quote, or answering questions.\",\n    tags: [\"contact\", \"touch\", \"reach\", \"sales\", \"talk\", \"email\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"getting-started\",\n    question: \"How do we get started?\",\n    answer:\n      \"Start with a conversation: get in touch via /contact for a demo and onboarding. The team will help you stand up the live services for your sites and connect your data.\",\n    tags: [\"start\", \"started\", \"onboarding\", \"begin\", \"setup\", \"trial\"],\n  },\n];\n\n/** Lowercase word tokens, length >= 3. */\nfunction tokenize(text: string): string[] {\n  return (text.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter(\n    w => w.length >= 3\n  );\n}\n\n/** Score an item against the query tokens (tag hits weighted over text hits). */\nfunction scoreItem(item: KnowledgeItem, queryTokens: string[]): number {\n  if (queryTokens.length === 0) return 0;\n  const haystack = tokenize(`${item.question} ${item.answer}`);\n  let score = 0;\n  for (const token of queryTokens) {\n    if (item.tags.includes(token)) score += 3;\n    if (haystack.includes(token)) score += 1;\n  }\n  return score;\n}\n\n/**\n * Build a static, keyword-scored retriever over the supplied knowledge.\n * Drop-in replaceable by a vector retriever implementing the same `Retriever`.\n */\nexport function createStaticRetriever(\n  knowledge: KnowledgeItem[] = KNOWLEDGE\n): Retriever {\n  return (query, { mode, limit = 4 }) => {\n    const queryTokens = tokenize(query);\n    const eligible = knowledge.filter(k => !k.modes || k.modes.includes(mode));\n\n    const scored = eligible\n      .map(item => ({ item, score: scoreItem(item, queryTokens) }))\n      .filter(s => s.score > 0)\n      .sort((a, b) => b.score - a.score)\n      .slice(0, limit)\n      .map(s => s.item);\n\n    // Cold-start / no keyword hits: fall back to the first few eligible items\n    // so the assistant always has some grounding to work from.\n    if (scored.length === 0) return eligible.slice(0, limit);\n    return scored;\n  };\n}\n\n/** Render retrieved items into a compact block for the system prompt. */\nexport function formatKnowledge(items: KnowledgeItem[]): string {\n  return items.map(i => `Q: ${i.question}\\nA: ${i.answer}`).join(\"\\n\\n\");\n}\n","/**\n * createSupportEngine — the shared chat brain for Opi (marketing) and the in-app\n * AI Support Engineer (operational). Composes persona + retrieved knowledge +\n * runtime context, then calls the existing LLM client.\n *\n *   const engine = createSupportEngine(ENV);\n *   const { content } = await engine.chat({ mode: \"marketing\", messages });\n */\nimport type { CoreEnv } from \"../types\";\nimport { createLLMClient } from \"../llm\";\nimport type { Message, LLMClientOptions } from \"../llm\";\nimport type { AiGate } from \"../aiGate\";\nimport { buildSystemPrompt, type AssistantMode } from \"./personas\";\nimport {\n  createStaticRetriever,\n  formatKnowledge,\n  type Retriever,\n} from \"./knowledge\";\n\n/** Lightweight, mode-agnostic chat message (system prompt is added internally). */\nexport interface ChatMessage {\n  role: \"user\" | \"assistant\";\n  content: string;\n}\n\n/** Optional runtime context to ground the assistant. */\nexport interface SupportContext {\n  /** Current page / route the user is on (page-awareness). */\n  page?: string;\n  /** Authenticated user details (operational mode). */\n  user?: { name?: string; role?: string; enterpriseId?: string | number };\n  /** Any extra free-form context to append. */\n  extra?: string;\n}\n\nexport interface ChatParams {\n  mode: AssistantMode;\n  messages: ChatMessage[];\n  context?: SupportContext;\n}\n\nexport interface ChatResult {\n  content: string;\n}\n\nexport interface SupportEngineOptions {\n  /**\n   * Knowledge retriever. Defaults to the bundled static keyword retriever.\n   * Swap for a vector-store retriever later with zero consumer changes.\n   */\n  retrieve?: Retriever;\n  /** Items to retrieve per turn. Default 4. */\n  knowledgeLimit?: number;\n  /** Metering + cost-control hooks (app, onUsage sink, budget guard, costRate). */\n  metering?: LLMClientOptions;\n  /**\n   * The AI plan gate (createAiGate, #101). When set, `chat` needs\n   * `context.user` (role, enterpriseId) and refuses with AiUnavailableError\n   * when the user's company has no AI. Leave unset on the public marketing\n   * site, which has no signed-in user.\n   */\n  aiGate?: AiGate;\n}\n\nfunction renderContext(mode: AssistantMode, context?: SupportContext): string {\n  const lines: string[] = [\n    `Mode: ${mode === \"marketing\" ? \"Public Marketing Site\" : \"Authenticated Portal\"}`,\n  ];\n  if (context?.page) lines.push(`Page: ${context.page}`);\n  if (context?.user?.name) lines.push(`User: ${context.user.name}`);\n  if (context?.user?.role) lines.push(`Role: ${context.user.role}`);\n  if (context?.user?.enterpriseId != null)\n    lines.push(`Enterprise ID: ${context.user.enterpriseId}`);\n  if (context?.extra) lines.push(context.extra);\n  return lines.join(\"\\n\");\n}\n\nexport function createSupportEngine(\n  env: CoreEnv,\n  options: SupportEngineOptions = {}\n) {\n  const invokeLLM = createLLMClient(env, {\n    ...options.metering,\n    ...(options.aiGate ? { aiGate: options.aiGate } : {}),\n  });\n  const retrieve = options.retrieve ?? createStaticRetriever();\n  const knowledgeLimit = options.knowledgeLimit ?? 4;\n\n  async function chat({\n    mode,\n    messages,\n    context,\n  }: ChatParams): Promise<ChatResult> {\n    // Defense in depth (marketing-site#269): ChatMessage.role is \"user\" |\n    // \"assistant\" only at the type level, but a caller sends JSON over HTTP,\n    // which TypeScript cannot enforce at runtime. Without this filter, a\n    // caller could inject its own \"system\" (or any other) role straight\n    // into the message list this engine sends the model, after its own\n    // system prompt below. Every consumer route should already validate\n    // this at the edge; this is the engine's own backstop regardless.\n    const safeMessages = messages.filter(\n      (m): m is ChatMessage => m?.role === \"user\" || m?.role === \"assistant\"\n    );\n    const lastUser = [...safeMessages].reverse().find(m => m.role === \"user\");\n    const query = lastUser?.content ?? \"\";\n\n    const items = await retrieve(query, { mode, limit: knowledgeLimit });\n    const knowledge = formatKnowledge(items);\n\n    const systemPrompt = buildSystemPrompt({\n      mode,\n      knowledge,\n      context: renderContext(mode, context),\n    });\n\n    const llmMessages: Message[] = [\n      { role: \"system\", content: systemPrompt },\n      ...safeMessages.map(m => ({ role: m.role, content: m.content })),\n    ];\n\n    const result = await invokeLLM({\n      messages: llmMessages,\n      meta: {\n        label: \"support-engine\",\n        mode,\n        page: context?.page,\n        user: context?.user\n          ? { role: context.user.role, enterpriseId: context.user.enterpriseId }\n          : undefined,\n      },\n    });\n    const raw = result.choices[0]?.message?.content;\n    const content = typeof raw === \"string\" ? raw : JSON.stringify(raw ?? \"\");\n\n    return { content };\n  }\n\n  return { chat };\n}\n\nexport type SupportEngine = ReturnType<typeof createSupportEngine>;\n","/**\n * Security response headers for every Oplytics Express app.\n *\n * Set once, at the top of the middleware chain (before any route), so every\n * response — API, SPA shell, static asset, redirect — carries them. Replaces\n * the \"no Helmet, no CSP, no HSTS at the app layer\" gap flagged in the\n * 2026-08 ISO 27001 gap analysis (RISK-09). Cloudflare sits in front but was\n * verified to inject none of these.\n *\n * Deliberately dependency-free — Helmet for a fixed set of static headers is\n * just `res.setHeader` calls, and core-server already keeps its dependency\n * surface at zero.\n *\n * The Content-Security-Policy is sent **report-only** by default: browsers\n * evaluate it and report violations but block nothing, so a too-tight policy\n * can't take the SPA down. Once the report stream is clean for a given app,\n * pass `cspMode: \"enforce\"` to switch it to a blocking policy.\n */\nimport type { Request, Response, NextFunction } from \"express\";\nimport {\n  isSandboxEnv,\n  PRODUCTION_PORTAL_ORIGIN,\n  sandboxPortalOrigin,\n} from \"./sandbox\";\n\nexport interface SecurityHeadersOptions {\n  /**\n   * Extra origins the app's browser code legitimately talks to, beyond the\n   * platform defaults (self, the Portal, Google Fonts). The Portal is\n   * https://portal.oplyticsdigital.net, or in the local sandbox\n   * (INFISICAL_ENV=staging) the app's PORTAL_LOGIN_URL origin, else\n   * http://localhost:3000 (#86). Used for\n   * `connect-src` / `img-src` / `script-src` as appropriate — e.g. an\n   * analytics endpoint or a CDN. Origins only (`https://host[:port]`).\n   */\n  extraConnectSrc?: string[];\n  extraImgSrc?: string[];\n  extraScriptSrc?: string[];\n  extraStyleSrc?: string[];\n  /**\n   * \"report-only\" (default) sends `Content-Security-Policy-Report-Only`;\n   * \"enforce\" sends a blocking `Content-Security-Policy`; \"off\" omits CSP\n   * entirely (the other headers still apply).\n   */\n  cspMode?: \"report-only\" | \"enforce\" | \"off\";\n  /**\n   * HSTS max-age in seconds. Default 180 days. Set 0 to omit the header\n   * (e.g. while still testing HTTPS). `includeSubDomains` is always set when\n   * the header is present; `preload` is opt-in via `hstsPreload`.\n   */\n  hstsMaxAge?: number;\n  hstsPreload?: boolean;\n}\n\nconst DAY = 86_400;\n\n/** Fonts + the shared portal API origin every app in the platform uses. */\nconst GOOGLE_FONTS_CSS = \"https://fonts.googleapis.com\";\nconst GOOGLE_FONTS_FILES = \"https://fonts.gstatic.com\";\n\nfunction buildCsp(\n  opts: SecurityHeadersOptions,\n  cspMode: \"report-only\" | \"enforce\"\n): string {\n  // The sandbox lists its own Portal instead of production's, so a sandbox\n  // page calling production shows up as a violation (#86, portal#261).\n  const portalOrigin = isSandboxEnv()\n    ? sandboxPortalOrigin()\n    : PRODUCTION_PORTAL_ORIGIN;\n  const connect = [\"'self'\", portalOrigin, ...(opts.extraConnectSrc ?? [])];\n  const img = [\"'self'\", \"data:\", \"blob:\", ...(opts.extraImgSrc ?? [])];\n  const script = [\"'self'\", ...(opts.extraScriptSrc ?? [])];\n  // Vite's runtime and several UI libs inject <style> tags at runtime, so\n  // style-src needs 'unsafe-inline'. This is low-risk (style injection can't\n  // exfiltrate) and is the standard trade-off for a bundled SPA.\n  const style = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    GOOGLE_FONTS_CSS,\n    ...(opts.extraStyleSrc ?? []),\n  ];\n  const font = [\"'self'\", GOOGLE_FONTS_FILES, \"data:\"];\n\n  const directives = [\n    \"default-src 'self'\",\n    `connect-src ${connect.join(\" \")}`,\n    `img-src ${img.join(\" \")}`,\n    `script-src ${script.join(\" \")}`,\n    `style-src ${style.join(\" \")}`,\n    `font-src ${font.join(\" \")}`,\n    \"object-src 'none'\",\n    \"base-uri 'self'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n  ];\n  // upgrade-insecure-requests is an ENFORCEMENT directive — per spec it has\n  // no effect when the policy is delivered report-only, and Chrome logs a\n  // console warning (\"...is ignored when delivered in a report-only\n  // policy\") on every single page load telling you exactly that. Fleet-wide\n  // since RISK-09 shipped, because every app currently runs the report-only\n  // default — caught via the nightly E2E's console-error assertion\n  // (oplytics-subdomains Action Manager, 2026-09-10). Only include it once\n  // the policy actually enforces.\n  if (cspMode === \"enforce\") directives.push(\"upgrade-insecure-requests\");\n\n  return directives.join(\"; \");\n}\n\n/**\n * Express middleware that stamps the platform security headers on every\n * response. Mount it before the body parser:\n *\n *   const app = express();\n *   app.use(securityHeaders({ extraScriptSrc: [ANALYTICS_ORIGIN] }));\n *   app.use(express.json());\n */\nexport function securityHeaders(opts: SecurityHeadersOptions = {}) {\n  const cspMode = opts.cspMode ?? \"report-only\";\n  const hstsMaxAge = opts.hstsMaxAge ?? 180 * DAY;\n  const csp = cspMode === \"off\" ? null : buildCsp(opts, cspMode);\n  const cspHeader =\n    cspMode === \"enforce\"\n      ? \"Content-Security-Policy\"\n      : \"Content-Security-Policy-Report-Only\";\n\n  return function securityHeadersMiddleware(\n    _req: Request,\n    res: Response,\n    next: NextFunction\n  ): void {\n    // Express advertises itself by default — remove the fingerprint.\n    res.removeHeader(\"X-Powered-By\");\n\n    res.setHeader(\"X-Content-Type-Options\", \"nosniff\");\n    res.setHeader(\"X-Frame-Options\", \"DENY\");\n    res.setHeader(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n    res.setHeader(\"X-Permitted-Cross-Domain-Policies\", \"none\");\n    res.setHeader(\"Cross-Origin-Opener-Policy\", \"same-origin\");\n    res.setHeader(\"Cross-Origin-Resource-Policy\", \"same-site\");\n    res.setHeader(\n      \"Permissions-Policy\",\n      \"camera=(), microphone=(), geolocation=(), payment=()\"\n    );\n\n    if (hstsMaxAge > 0) {\n      const preload = opts.hstsPreload ? \"; preload\" : \"\";\n      res.setHeader(\n        \"Strict-Transport-Security\",\n        `max-age=${hstsMaxAge}; includeSubDomains${preload}`\n      );\n    }\n\n    if (csp) res.setHeader(cspHeader, csp);\n\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAAO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,sBAAmD;AAAA,EAC9D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AACV;AACO,IAAM,sBAAmD;AAAA,EAC9D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AACV;;;ACEO,IAAM,oBAAmC;AAAA,EAC9C,YAAY;AAAA;AAAA,EACZ,aAAa;AAAA;AACf;AA2CO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB,YAAY,QAAgB;AAC1B,UAAM,MAAM;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,eAAe,MAAsB;AACnD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,KAAK,KAAK,SAAS,CAAC;AAClC;AAGO,SAAS,sBAAsB,UAA4B;AAChE,SAAO,SAAS,OAAO,CAAC,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG,CAAC;AAC/D;AAGO,SAAS,eACd,cACA,kBACA,OAAsB,mBACd;AACR,QAAM,OACH,eAAe,MAAQ,KAAK,aAC5B,mBAAmB,MAAQ,KAAK;AAEnC,SAAO,KAAK,MAAM,OAAO,GAAG,IAAI;AAClC;;;AC2DO,IAAM,oBAAoB;AAY1B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAWT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK;AACrB,SAAK,SAAS,KAAK;AACnB,SAAK,aAAa,KAAK;AACvB,SAAK,kBAAkB,KAAK;AAC5B,SAAK,eAAe,KAAK;AACzB,SAAK,oBAAoB,KAAK;AAC9B,SAAK,QAAQ,KAAK;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,oBAAoB,KAAK;AAAA,EAChC;AACF;AAGA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,UAAU,OAAgB,KAAa,QAAQ,GAAuB;AAC7E,MAAI,QAAQ,KAAK,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACpE,aAAW,CAAC,GAAG,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACzE,QACE,IAAI,KAAK,CAAC,MACT,OAAO,UAAU,YAAY,OAAO,UAAU,WAC/C;AACA,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,UAAM,QAAQ,UAAU,OAAO,KAAK,QAAQ,CAAC;AAC7C,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAuB;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,QAA2C;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,OAAO,KAAK,CAAC;AACpC,SAAO,OAAO,SAAS,OAAO,KAAK,WAAW,IAAI,UAAU;AAC9D;AAEA,IAAM,YAAY,oBAAI,IAAuB,CAAC,KAAK,GAAG,CAAC;AA2BvD,IAAM,cAAc,CAClB,UACsB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAE7D,IAAM,uBAAuB,CAC3B,SAC6C;AAC7C,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,EAAE,MAAM,QAAQ,MAAM,KAAK;AAAA,EACpC;AACA,MAAI,KAAK,SAAS,OAAQ,QAAO;AACjC,MAAI,KAAK,SAAS,YAAa,QAAO;AACtC,MAAI,KAAK,SAAS,WAAY,QAAO;AACrC,QAAM,IAAI,MAAM,kCAAkC;AACpD;AAEA,IAAM,mBAAmB,CAAC,YAAqB;AAC7C,QAAM,EAAE,MAAM,MAAM,aAAa,IAAI;AACrC,MAAI,SAAS,UAAU,SAAS,YAAY;AAC1C,UAAM,UAAU,YAAY,QAAQ,OAAO,EACxC,IAAI,UAAS,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI,CAAE,EACpE,KAAK,IAAI;AACZ,WAAO,EAAE,MAAM,MAAM,cAAc,QAAQ;AAAA,EAC7C;AACA,QAAM,eAAe,YAAY,QAAQ,OAAO,EAAE,IAAI,oBAAoB;AAC1E,MAAI,aAAa,WAAW,KAAK,aAAa,CAAC,EAAE,SAAS,QAAQ;AAChE,WAAO,EAAE,MAAM,MAAM,SAAS,aAAa,CAAC,EAAE,KAAK;AAAA,EACrD;AACA,SAAO,EAAE,MAAM,MAAM,SAAS,aAAa;AAC7C;AAEA,IAAM,sBAAsB,CAC1B,YACA,UACqD;AACrD,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,eAAe,UAAU,eAAe,OAAQ,QAAO;AAC3D,MAAI,eAAe,YAAY;AAC7B,QAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE;AAAA,EACxE;AACA,MAAI,UAAU,YAAY;AACxB,WAAO,EAAE,MAAM,YAAY,UAAU,EAAE,MAAM,WAAW,KAAK,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,IAAM,0BAA0B,CAAC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MASiB;AACf,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QACE,eAAe,SAAS,iBACxB,CAAC,eAAe,aAAa,QAC7B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,QAAQ;AAClC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,MACX,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,GAAI,OAAO,OAAO,WAAW,YAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AACF;AAGA,SAAS,cAAc,SAA0B;AAC/C,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QACJ,IAAI,UAAQ;AACX,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,UAAI,QAAQ,OAAO,SAAS,YAAY,UAAU,MAAM;AACtD,eAAO,OAAQ,KAA4B,QAAQ,EAAE;AAAA,MACvD;AACA,aAAO;AAAA,IACT,CAAC,EACA,KAAK,GAAG;AAAA,EACb;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,KAAc,UAA4B,CAAC,GAAG;AAC5E,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,OAAO,YAAY;AAAA,IACnB;AAAA,IACA;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AACJ,QAAM,WAA4B;AAGlC,QAAM,SAAS,CAAC,SACd,IAAI,eAAe,KAAK,MAAM,IAAI,YAAY,EAAE,KAAK,YAAY,IAAI;AAEvE,QAAM,gBAAgB,MACpB,IAAI,gBAAgB,IAAI,aAAa,KAAK,EAAE,SAAS,IACjD,GAAG,IAAI,aAAa,QAAQ,OAAO,EAAE,CAAC,sBACtC;AAEN,QAAM,eAAe,MAAM;AACzB,QAAI,CAAC,IAAI,cAAc;AACrB,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AAAA,EACF;AAEA,SAAO,eAAe,UAAU,QAA6C;AAC3E,iBAAa;AAEb,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,CAAC;AAAA,IACV,IAAI;AAGJ,QAAI,QAAQ;AACV,UAAI,CAAC,KAAK,MAAM;AACd,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,gBAAgB,KAAK,IAAI;AAAA,IACxC;AAEA,UAAM,kBAAkB;AAAA,MACtB,SAAS,IAAI,OAAK,cAAc,EAAE,OAAO,CAAC;AAAA,IAC5C;AAGA,QAAI,OAAO;AACT,YAAM,UAAU,MAAM,MAAM,EAAE,KAAK,iBAAiB,GAAG,KAAK,CAAC;AAC7D,UAAI,CAAC,QAAQ,SAAS;AACpB,cAAM,IAAI;AAAA,UACR,QAAQ,UAAU;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAmC;AAAA,MACvC,UAAU,SAAS,IAAI,gBAAgB;AAAA,IACzC;AAEA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,uBAAuB;AAAA,MAC3B,cAAc;AAAA,MACd;AAAA,IACF;AACA,QAAI,sBAAsB;AACxB,cAAQ,cAAc;AAAA,IACxB;AAEA,YAAQ,aAAa;AAErB,UAAM,2BAA2B,wBAAwB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,0BAA0B;AAC5B,cAAQ,kBAAkB;AAAA,IAC5B;AAEA,QAAI,WAAW;AAGf,UAAM,UAAU,OAAO,UAAyC;AAC9D;AACA,YAAM,UACJ,aAAa,YAAY,IAAI,YAAY,QAAQ,SAAS,IAAI;AAChE,UAAI;AACF,cAAM,WAAW,MAAM,UAAU,cAAc,GAAG;AAAA,UAChD,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,IAAI,YAAY;AAAA,UAC3C;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,gBAAM,OAAO,UAAU,SAAS;AAChC,gBAAM,kBAAkB;AAAA,aACrB,SAAS,SACN,UAAU,MAAM,WAAW,IAC3B,UAAU,KAAK,MAAM;AAAA,UAC3B,EAAE,MAAM,GAAG,GAAG;AACd,gBAAM,IAAI,iBAAiB;AAAA;AAAA,YAEzB,SAAS;AAAA,cACP,sBAAsB,SAAS,MAAM,IAAI,SAAS,UAAU,WAAM,SAAS;AAAA,YAC7E;AAAA,YACA;AAAA,YACA,QAAQ,SAAS;AAAA,YACjB,YAAY,SAAS,cAAc;AAAA,YACnC,iBAAiB,mBAAmB;AAAA,YACpC,cACE,SAAS,SAAY,UAAU,MAAM,UAAU,IAAI;AAAA,YACrD,mBACE,mBAAmB,IAAI,OAAK,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE;AAAA,cACnD;AAAA,YACF,MACC,SAAS,SACN,UAAU,MAAM,4BAA4B,IAC5C,WACJ;AAAA,YACF;AAAA,YACA;AAAA,YACA,mBAAmB;AAAA,cACjB,SAAS,QAAQ,IAAI,aAAa;AAAA,YACpC;AAAA,UACF,CAAC;AAAA,QACH;AAEA,eAAQ,MAAM,SAAS,KAAK;AAAA,MAC9B,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAkB,OAAM;AAC3C,YAAI,SAAS,SAAS;AACpB,gBAAM,IAAI,iBAAiB;AAAA,YACzB,SAAS,oDAA+C,QAAQ,KAAK,KAAK,YAAY,SAAS;AAAA,YAC/F;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,UAAM,cAAc,OAClB,OACA,WAC0B;AAC1B,eAAS,IAAI,KAAK,KAAK;AACrB,YAAI;AACF,iBAAO,MAAM,QAAQ,KAAK;AAAA,QAC5B,SAAS,KAAK;AACZ,cACE,eAAe,oBACf,UAAU,IAAI,IAAI,MAAM,KACxB,IAAI,OAAO,QACX;AACA,kBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,OAAO,CAAC,CAAC,CAAC;AAC3D;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,WAAW,aAAa;AAAA,IACrD,SAAS,KAAK;AAEZ,UACE,CAAC,iBACD,EAAE,eAAe,qBACjB,IAAI,WAAW,KACf;AACA,cAAM;AAAA,MACR;AACA,kBAAY;AACZ,eAAS,MAAM,QAAQ,aAAa;AAAA,IACtC;AAGA,QAAI,SAAS;AACX,UAAI;AACF,cAAM,WAAW,OAAO;AACxB,cAAM,YAAY,CAAC;AACnB,cAAM,eAAe,UAAU,iBAAiB;AAChD,cAAM,mBACJ,UAAU,qBACV,eAAe,cAAc,OAAO,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC;AACrE,cAAM,cACJ,UAAU,gBAAgB,eAAe;AAE3C,cAAM,QAAoB;AAAA,UACxB;AAAA,UACA,OAAO,OAAO,SAAS;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY,eAAe,cAAc,kBAAkB,QAAQ;AAAA,UACnE;AAAA,UACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,UAC3B,GAAG;AAAA,QACL;AAEA,cAAM,QAAQ,KAAK;AAAA,MACrB,SAAS,KAAK;AAEZ,gBAAQ,KAAK,sCAAsC,GAAG;AAAA,MACxD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACtkBO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EAET,YACE,QACA,SACA,cACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,eAAe;AAAA,EACtB;AACF;AA2BA,SAAS,eAAe,QAAoD;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,KACJ,OAAO,QAAQ,WACX,MACA,OAAO,QAAQ,YAAY,QAAQ,KAAK,IAAI,KAAK,CAAC,IAChD,OAAO,IAAI,KAAK,CAAC,IACjB;AACR,SAAO,OAAO,cAAc,EAAE,KAAK,KAAK,IAAI,KAAK;AACnD;AAEA,IAAM,UAA0B,EAAE,WAAW,MAAM,SAAS,KAAK;AAE1D,SAAS,aAAa,QAA8B;AACzD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,EACb,IAAI;AACJ,QAAM,aAAa,QAAQ,gBAAgB,YAAY;AACvD,QAAM,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,CAAC;AAE9C,QAAM,QAAQ,oBAAI,IAAoD;AACtE,QAAM,WAAW,oBAAI,IAAqC;AAC1D,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,WAAW,CAAC,KAAa,YAAoB;AACjD,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,YAAQ,KAAK,wBAAwB,OAAO,EAAE;AAAA,EAChD;AAEA,iBAAe,IACb,cACA,MACyB;AACzB,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB,OAAO,GAAG,GAAG,SAAS,mBAAmB,IAAI,CAAC,KAAK;AAAA,QACnD;AAAA,UACE,SAAS;AAAA,YACP,iBAAiB;AAAA,YACjB,GAAI,iBAAiB,OACjB,EAAE,mBAAmB,OAAO,YAAY,EAAE,IAC1C,CAAC;AAAA,UACP;AAAA,UACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,QACvC;AAAA,MACF;AACA,UAAI,IAAI,WAAW,KAAK;AACtB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AACA,eAAO;AAAA,MACT;AACA,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,wCAAwC,IAAI,MAAM,gBAAgB,gBAAgB,GAAG;AAAA,QACvF;AACA,eAAO;AAAA,MACT;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAK/C,UAAI,MAAM,cAAc,KAAM,QAAO,EAAE,WAAW,KAAK;AACvD,UAAI,MAAM,cAAc,SAAS,OAAO,KAAK,YAAY,UAAU;AACjE,eAAO;AAAA,UACL,WAAW;AAAA,UACX,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAAA,UACxD,SAAS,KAAK;AAAA,QAChB;AAAA,MACF;AACA,cAAQ;AAAA,QACN,8CAA8C,gBAAgB,GAAG;AAAA,MACnE;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,wDAAwD,gBAAgB,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAClI;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,MACb,QACyB;AACzB,UAAM,eAAe,eAAe,MAAM;AAC1C,UAAM,OAAO,QAAQ,QAAQ;AAE7B,UAAM,MAAM,GAAG,gBAAgB,GAAG,IAAI,SAAS,mBAAmB,OAAO,MAAM;AAE/E,UAAM,MAAM,MAAM,IAAI,GAAG;AACzB,QAAI,OAAO,IAAI,IAAI,IAAI,KAAK,WAAY,QAAO,IAAI;AAEnD,QAAI,UAAU,SAAS,IAAI,GAAG;AAC9B,QAAI,CAAC,SAAS;AACZ,gBAAU,IAAI,cAAc,IAAI,EAC7B,KAAK,YAAU;AACd,YAAI,aAAa,EAAG,OAAM,IAAI,KAAK,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACxD,eAAO;AAAA,MACT,CAAC,EACA,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC;AACrC,eAAS,IAAI,KAAK,OAAO;AAAA,IAC3B;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBACb,QACe;AACf,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,eAAe,MAAM;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,WAAW,cAA6B;AAC/C,QAAI,iBAAiB,QAAW;AAC9B,YAAM,MAAM;AACZ;AAAA,IACF;AACA,eAAW,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG;AACnC,UAAI,IAAI,WAAW,GAAG,YAAY,GAAG,EAAG,OAAM,OAAO,GAAG;AAAA,IAC1D;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,iBAAiB,WAAW;AAC9C;;;AC3NA,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASnB,KAAK;AAYA,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBrC,KAAK;AAGP,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxB,KAAK;AAGP,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,KAAK;AAEP,IAAM,WAA0C;AAAA,EAC9C,WAAW;AAAA,EACX,aAAa;AACf;AAiBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAkB,uBAAuB;AAC3C,GAAoC;AAGlC,QAAM,WAAW,CAAC,cAAc,SAAS,IAAI,GAAG,uBAAuB,EAAE;AAAA,IACvE,OAAK,EAAE,WAAW,6BAA6B,eAAe;AAAA,EAChE;AAEA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,aAAS,KAAK;AAAA,EAAiC,UAAU,KAAK,CAAC,EAAE;AAAA,EACnE;AAEA,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,aAAS,KAAK;AAAA,EAAqB,QAAQ,KAAK,CAAC,EAAE;AAAA,EACrD;AAEA,SAAO,SAAS,KAAK,MAAM;AAC7B;;;AC7EO,IAAM,YAA6B;AAAA;AAAA,EAExC;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,cAAc,YAAY,aAAa,WAAW,QAAQ,KAAK;AAAA,EACxE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,UAAU,WAAW,UAAU,UAAU,SAAS,QAAQ;AAAA,EACnE;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,UAAU,SAAS,YAAY,UAAU,MAAM;AAAA,EAC/D;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,eAAe,UAAU,OAAO,QAAQ,SAAS;AAAA,EACjE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,aAAa,QAAQ,OAAO,SAAS,KAAK;AAAA,EAC1D;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,WAAW,SAAS,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAAA,IACjE,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,QAAQ,SAAS,WAAW,WAAW,SAAS,OAAO;AAAA,IAC9D,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,QAAQ,SAAS,OAAO,QAAQ,OAAO,MAAM;AAAA,IACpD,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,WAAW,SAAS,SAAS,SAAS,QAAQ,OAAO;AAAA,IAC5D,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,SAAS,WAAW,cAAc,SAAS,SAAS,OAAO;AAAA,EACpE;AACF;AAGA,SAAS,SAAS,MAAwB;AACxC,UAAQ,KAAK,YAAY,EAAE,MAAM,YAAY,KAAK,CAAC,GAAG;AAAA,IACpD,OAAK,EAAE,UAAU;AAAA,EACnB;AACF;AAGA,SAAS,UAAU,MAAqB,aAA+B;AACrE,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,WAAW,SAAS,GAAG,KAAK,QAAQ,IAAI,KAAK,MAAM,EAAE;AAC3D,MAAI,QAAQ;AACZ,aAAW,SAAS,aAAa;AAC/B,QAAI,KAAK,KAAK,SAAS,KAAK,EAAG,UAAS;AACxC,QAAI,SAAS,SAAS,KAAK,EAAG,UAAS;AAAA,EACzC;AACA,SAAO;AACT;AAMO,SAAS,sBACd,YAA6B,WAClB;AACX,SAAO,CAAC,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM;AACrC,UAAM,cAAc,SAAS,KAAK;AAClC,UAAM,WAAW,UAAU,OAAO,OAAK,CAAC,EAAE,SAAS,EAAE,MAAM,SAAS,IAAI,CAAC;AAEzE,UAAM,SAAS,SACZ,IAAI,WAAS,EAAE,MAAM,OAAO,UAAU,MAAM,WAAW,EAAE,EAAE,EAC3D,OAAO,OAAK,EAAE,QAAQ,CAAC,EACvB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,MAAM,GAAG,KAAK,EACd,IAAI,OAAK,EAAE,IAAI;AAIlB,QAAI,OAAO,WAAW,EAAG,QAAO,SAAS,MAAM,GAAG,KAAK;AACvD,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAgC;AAC9D,SAAO,MAAM,IAAI,OAAK,MAAM,EAAE,QAAQ;AAAA,KAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,MAAM;AACvE;;;ACxVA,SAAS,cAAc,MAAqB,SAAkC;AAC5E,QAAM,QAAkB;AAAA,IACtB,SAAS,SAAS,cAAc,0BAA0B,sBAAsB;AAAA,EAClF;AACA,MAAI,SAAS,KAAM,OAAM,KAAK,SAAS,QAAQ,IAAI,EAAE;AACrD,MAAI,SAAS,MAAM,KAAM,OAAM,KAAK,SAAS,QAAQ,KAAK,IAAI,EAAE;AAChE,MAAI,SAAS,MAAM,KAAM,OAAM,KAAK,SAAS,QAAQ,KAAK,IAAI,EAAE;AAChE,MAAI,SAAS,MAAM,gBAAgB;AACjC,UAAM,KAAK,kBAAkB,QAAQ,KAAK,YAAY,EAAE;AAC1D,MAAI,SAAS,MAAO,OAAM,KAAK,QAAQ,KAAK;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,oBACd,KACA,UAAgC,CAAC,GACjC;AACA,QAAM,YAAY,gBAAgB,KAAK;AAAA,IACrC,GAAG,QAAQ;AAAA,IACX,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY,sBAAsB;AAC3D,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,iBAAe,KAAK;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAoC;AAQlC,UAAM,eAAe,SAAS;AAAA,MAC5B,CAAC,MAAwB,GAAG,SAAS,UAAU,GAAG,SAAS;AAAA,IAC7D;AACA,UAAM,WAAW,CAAC,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,OAAK,EAAE,SAAS,MAAM;AACxE,UAAM,QAAQ,UAAU,WAAW;AAEnC,UAAM,QAAQ,MAAM,SAAS,OAAO,EAAE,MAAM,OAAO,eAAe,CAAC;AACnE,UAAM,YAAY,gBAAgB,KAAK;AAEvC,UAAM,eAAe,kBAAkB;AAAA,MACrC;AAAA,MACA;AAAA,MACA,SAAS,cAAc,MAAM,OAAO;AAAA,IACtC,CAAC;AAED,UAAM,cAAyB;AAAA,MAC7B,EAAE,MAAM,UAAU,SAAS,aAAa;AAAA,MACxC,GAAG,aAAa,IAAI,QAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,EAAE;AAAA,IACjE;AAEA,UAAM,SAAS,MAAM,UAAU;AAAA,MAC7B,UAAU;AAAA,MACV,MAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,OACX,EAAE,MAAM,QAAQ,KAAK,MAAM,cAAc,QAAQ,KAAK,aAAa,IACnE;AAAA,MACN;AAAA,IACF,CAAC;AACD,UAAM,MAAM,OAAO,QAAQ,CAAC,GAAG,SAAS;AACxC,UAAM,UAAU,OAAO,QAAQ,WAAW,MAAM,KAAK,UAAU,OAAO,EAAE;AAExE,WAAO,EAAE,QAAQ;AAAA,EACnB;AAEA,SAAO,EAAE,KAAK;AAChB;;;ACpFA,IAAM,MAAM;AAGZ,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAE3B,SAAS,SACP,MACA,SACQ;AAGR,QAAM,eAAe,aAAa,IAC9B,oBAAoB,IACpB;AACJ,QAAM,UAAU,CAAC,UAAU,cAAc,GAAI,KAAK,mBAAmB,CAAC,CAAE;AACxE,QAAM,MAAM,CAAC,UAAU,SAAS,SAAS,GAAI,KAAK,eAAe,CAAC,CAAE;AACpE,QAAM,SAAS,CAAC,UAAU,GAAI,KAAK,kBAAkB,CAAC,CAAE;AAIxD,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,KAAK,iBAAiB,CAAC;AAAA,EAC7B;AACA,QAAM,OAAO,CAAC,UAAU,oBAAoB,OAAO;AAEnD,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,eAAe,QAAQ,KAAK,GAAG,CAAC;AAAA,IAChC,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA,IACxB,cAAc,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9B,aAAa,MAAM,KAAK,GAAG,CAAC;AAAA,IAC5B,YAAY,KAAK,KAAK,GAAG,CAAC;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AASA,MAAI,YAAY,UAAW,YAAW,KAAK,2BAA2B;AAEtE,SAAO,WAAW,KAAK,IAAI;AAC7B;AAUO,SAAS,gBAAgB,OAA+B,CAAC,GAAG;AACjE,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,aAAa,KAAK,cAAc,MAAM;AAC5C,QAAM,MAAM,YAAY,QAAQ,OAAO,SAAS,MAAM,OAAO;AAC7D,QAAM,YACJ,YAAY,YACR,4BACA;AAEN,SAAO,SAAS,0BACd,MACA,KACA,MACM;AAEN,QAAI,aAAa,cAAc;AAE/B,QAAI,UAAU,0BAA0B,SAAS;AACjD,QAAI,UAAU,mBAAmB,MAAM;AACvC,QAAI,UAAU,mBAAmB,iCAAiC;AAClE,QAAI,UAAU,qCAAqC,MAAM;AACzD,QAAI,UAAU,8BAA8B,aAAa;AACzD,QAAI,UAAU,gCAAgC,WAAW;AACzD,QAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,aAAa,GAAG;AAClB,YAAM,UAAU,KAAK,cAAc,cAAc;AACjD,UAAI;AAAA,QACF;AAAA,QACA,WAAW,UAAU,sBAAsB,OAAO;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,IAAK,KAAI,UAAU,WAAW,GAAG;AAErC,SAAK;AAAA,EACP;AACF;","names":[]}
+{"version":3,"sources":["../src/constants/sqdcp.ts","../src/metering.ts","../src/llm.ts","../src/aiGate.ts","../src/ai/personas.ts","../src/ai/knowledge.ts","../src/ai/supportEngine.ts","../src/securityHeaders.ts"],"sourcesContent":["export const SQDCP_PILLARS = [\n  \"safety\",\n  \"quality\",\n  \"delivery\",\n  \"cost\",\n  \"people\",\n] as const;\nexport type SqdcpPillar = (typeof SQDCP_PILLARS)[number];\nexport const SQDCP_PILLAR_COLORS: Record<SqdcpPillar, string> = {\n  safety: \"#ef4444\",\n  quality: \"#3b82f6\",\n  delivery: \"#f59e0b\",\n  cost: \"#10b981\",\n  people: \"#a855f7\",\n};\nexport const SQDCP_PILLAR_LABELS: Record<SqdcpPillar, string> = {\n  safety: \"Safety\",\n  quality: \"Quality\",\n  delivery: \"Delivery\",\n  cost: \"Cost\",\n  people: \"People\",\n};\n","/**\n * Metering + cost-control primitives for the AI layer.\n *\n * Every LLM call funnels through `createLLMClient` (see llm.ts), which is the one\n * place we capture token usage and enforce budgets. This module holds the\n * storage-agnostic types and pure helpers; core-server only *emits* usage and\n * *asks* a guard — each app decides where usage lands and how budgets are stored\n * (typically the Business Hub ledger).\n */\n\n/** Per-1k-token pricing used to estimate cost from token counts. */\nexport interface TokenCostRate {\n  inputPer1k: number;\n  outputPer1k: number;\n}\n\n/**\n * Default rate (USD per 1k tokens). Was priced for gemini-2.5-flash;\n * llm.ts's MODEL moved to gemini-3.5-flash (2.5-flash was deprecated for new\n * API keys) but this rate was NOT re-verified against 3.5-flash's actual\n * published pricing — treat cost figures as stale until confirmed.\n * Override per app via createLLMClient options once real pricing is known.\n */\nexport const DEFAULT_COST_RATE: TokenCostRate = {\n  inputPer1k: 0.000075, // $0.075 / 1M input tokens (gemini-2.5-flash rate, UNVERIFIED for 3.5)\n  outputPer1k: 0.0003, // $0.30  / 1M output tokens (gemini-2.5-flash rate, UNVERIFIED for 3.5)\n};\n\n/** Per-call context that varies request-to-request (set via InvokeParams.meta). */\nexport interface CallMeta {\n  /** Feature/surface label, e.g. \"opi\", \"ai-advisor\", \"insights\". */\n  label?: string;\n  /** \"marketing\" | \"operational\" | a feature name. */\n  mode?: string;\n  /** Authenticated user, when known (operational surfaces). */\n  user?: { id?: string; role?: string; enterpriseId?: string | number };\n  /** Current page/route (page-awareness + per-surface attribution). */\n  page?: string;\n}\n\n/** Emitted after every successful call. The metering sink persists this. */\nexport interface UsageEvent extends CallMeta {\n  /** App identifier, e.g. \"marketing-site\", \"businesshub\", \"oee\". */\n  app: string;\n  model: string;\n  promptTokens: number;\n  completionTokens: number;\n  totalTokens: number;\n  estCostUsd: number;\n  /** True when token counts were estimated (provider returned no usage block). */\n  estimated: boolean;\n  /** ISO timestamp. */\n  at: string;\n}\n\n/** Asked BEFORE a call, so over-budget / disabled traffic never spends. */\nexport interface GuardRequest extends CallMeta {\n  app: string;\n  /** Rough prompt-token estimate, for budget math before the call. */\n  estPromptTokens: number;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  /** User-facing reason when blocked (kill-switch, budget exceeded, rate limit). */\n  reason?: string;\n}\n\n/** Thrown by invokeLLM when a guard blocks the call. */\nexport class LLMBudgetError extends Error {\n  readonly code = \"LLM_BUDGET_BLOCKED\";\n  constructor(reason: string) {\n    super(reason);\n    this.name = \"LLMBudgetError\";\n  }\n}\n\n/** Rough token estimate (~4 chars/token) — fallback when no usage is returned. */\nexport function estimateTokens(text: string): number {\n  if (!text) return 0;\n  return Math.ceil(text.length / 4);\n}\n\n/** Estimate prompt tokens across a set of message strings. */\nexport function estimateMessageTokens(contents: string[]): number {\n  return contents.reduce((sum, c) => sum + estimateTokens(c), 0);\n}\n\n/** Compute estimated USD cost from token counts. */\nexport function computeCostUsd(\n  promptTokens: number,\n  completionTokens: number,\n  rate: TokenCostRate = DEFAULT_COST_RATE\n): number {\n  const cost =\n    (promptTokens / 1000) * rate.inputPer1k +\n    (completionTokens / 1000) * rate.outputPer1k;\n  // Round to 6 dp — sub-cent precision without float noise.\n  return Math.round(cost * 1e6) / 1e6;\n}\n","/**\n * LLM helper — calls Google's Gemini API via its OpenAI-compatible endpoint.\n *\n * A provider failure (any non-2xx answer, or no answer within `timeoutMs`)\n * throws an LLMProviderError carrying the provider, status, model, the\n * provider's own message and request ID (#98). Its message keeps the old\n * \"LLM invoke failed: <status> <statusText> – <body>\" text, so string parsing\n * keeps working. 429 and 503 can be retried (`retryDelaysMs`), and a 503 can\n * fall back to a lighter model (`fallbackModel`). All three are off unless set.\n *\n * Example:\n *   const invokeLLM = createLLMClient(ENV);\n *   const result = await invokeLLM({\n *     messages: [\n *       { role: \"system\", content: \"You are a helpful assistant.\" },\n *       { role: \"user\", content: \"Hello, world!\" },\n *     ],\n *   });\n */\nimport type { CoreEnv } from \"./types\";\nimport {\n  type CallMeta,\n  type TokenCostRate,\n  type UsageEvent,\n  type GuardRequest,\n  type GuardResult,\n  DEFAULT_COST_RATE,\n  LLMBudgetError,\n  computeCostUsd,\n  estimateMessageTokens,\n  estimateTokens,\n} from \"./metering\";\nimport type { AiGate } from \"./aiGate\";\n\nexport type Role = \"system\" | \"user\" | \"assistant\" | \"tool\" | \"function\";\n\nexport type TextContent = {\n  type: \"text\";\n  text: string;\n};\n\nexport type ImageContent = {\n  type: \"image_url\";\n  image_url: {\n    url: string;\n    detail?: \"auto\" | \"low\" | \"high\";\n  };\n};\n\nexport type FileContent = {\n  type: \"file_url\";\n  file_url: {\n    url: string;\n    mime_type?:\n      | \"audio/mpeg\"\n      | \"audio/wav\"\n      | \"application/pdf\"\n      | \"audio/mp4\"\n      | \"video/mp4\";\n  };\n};\n\nexport type MessageContent = string | TextContent | ImageContent | FileContent;\n\nexport type Message = {\n  role: Role;\n  name?: string;\n  tool_call_id?: string;\n  content: MessageContent | MessageContent[];\n};\n\nexport type Tool = {\n  type: \"function\";\n  function: {\n    name: string;\n    description?: string;\n    parameters?: Record<string, unknown>;\n  };\n};\n\ntype ToolChoiceExplicit = {\n  type: \"function\";\n  function: { name: string };\n};\n\nexport type ToolChoice =\n  \"none\" | \"auto\" | \"required\" | { name: string } | ToolChoiceExplicit;\n\ntype JsonSchema = {\n  name: string;\n  schema: Record<string, unknown>;\n  strict?: boolean;\n};\n\nexport type ResponseFormat =\n  | { type: \"text\" }\n  | { type: \"json_object\" }\n  | { type: \"json_schema\"; json_schema: JsonSchema };\n\nexport type OutputSchema = {\n  name: string;\n  schema: Record<string, unknown>;\n  strict?: boolean;\n};\n\nexport type InvokeParams = {\n  messages: Message[];\n  tools?: Tool[];\n  toolChoice?: ToolChoice;\n  tool_choice?: ToolChoice;\n  outputSchema?: OutputSchema;\n  output_schema?: OutputSchema;\n  responseFormat?: ResponseFormat;\n  response_format?: ResponseFormat;\n  /** Per-call attribution for metering/guarding (label, mode, user, page). */\n  meta?: CallMeta;\n};\n\n/** Optional metering + cost-control hooks, set once per app. */\nexport type LLMClientOptions = {\n  /** App identifier recorded on every usage event, e.g. \"marketing-site\". */\n  app?: string;\n  /** Pricing used to estimate cost from tokens. Defaults to gemini-3.5-flash (rate unverified, see metering.ts). */\n  costRate?: TokenCostRate;\n  /** Metering sink — called after each successful call. Errors are swallowed. */\n  onUsage?: (event: UsageEvent) => void | Promise<void>;\n  /** Budget/kill-switch check — called before each call; block = no spend. */\n  guard?: (req: GuardRequest) => GuardResult | Promise<GuardResult>;\n  /** The model to call. Default DEFAULT_LLM_MODEL. */\n  model?: string;\n  /**\n   * A lighter model to try once when the main model still answers 503 after\n   * its retries (#98). Off unless set.\n   */\n  fallbackModel?: string;\n  /**\n   * Give up on an attempt after this many ms: the request is aborted and an\n   * LLMProviderError with status \"TIMEOUT\" is thrown. Off unless set (Portal\n   * uses 45 000 for chat).\n   */\n  timeoutMs?: number;\n  /**\n   * Waits before each retry of a 429 or 503, e.g. [2000, 6000] for two\n   * retries. Default [] (no retries).\n   */\n  retryDelaysMs?: number[];\n  /** Injectable fetch (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /**\n   * The AI plan gate (createAiGate, #101). When set, every call must name its\n   * caller in `meta.user` ({ role, enterpriseId }) or it throws, and a caller\n   * whose company has no AI gets AiUnavailableError (the Portal's message)\n   * before any spend.\n   */\n  aiGate?: AiGate;\n};\n\n/** The model createLLMClient calls unless `model` says otherwise. */\nexport const DEFAULT_LLM_MODEL = \"gemini-3.5-flash\";\n\n/** Which AI provider answered. Only Gemini today; Azure OpenAI is #90. */\nexport type LLMProviderName = \"gemini\";\n\n/** An HTTP status from the provider, or \"TIMEOUT\" when it didn't answer. */\nexport type LLMProviderStatus = number | \"TIMEOUT\";\n\n/**\n * The AI provider failed: it answered with a non-2xx status, or not within\n * the timeout. The API key never appears in it.\n */\nexport class LLMProviderError extends Error {\n  readonly provider: LLMProviderName;\n  readonly status: LLMProviderStatus;\n  readonly statusText?: string;\n  /** The provider's own error message, at most 300 characters. */\n  readonly providerMessage?: string;\n  /** The provider's error code, e.g. \"UNAVAILABLE\" or \"RESOURCE_EXHAUSTED\". */\n  readonly providerCode?: string;\n  /** The provider's request ID, from the response headers or body. */\n  readonly providerRequestId?: string;\n  /** The model the failing attempt called. */\n  readonly model: string;\n  /** How many attempts were made in all, fallback included. */\n  readonly attempts: number;\n  /** The provider's Retry-After, in seconds, when it sent one. */\n  readonly retryAfterSeconds?: number;\n\n  constructor(init: {\n    message: string;\n    provider: LLMProviderName;\n    status: LLMProviderStatus;\n    statusText?: string;\n    providerMessage?: string;\n    providerCode?: string;\n    providerRequestId?: string;\n    model: string;\n    attempts: number;\n    retryAfterSeconds?: number;\n  }) {\n    super(init.message);\n    this.name = \"LLMProviderError\";\n    this.provider = init.provider;\n    this.status = init.status;\n    this.statusText = init.statusText;\n    this.providerMessage = init.providerMessage;\n    this.providerCode = init.providerCode;\n    this.providerRequestId = init.providerRequestId;\n    this.model = init.model;\n    this.attempts = init.attempts;\n    this.retryAfterSeconds = init.retryAfterSeconds;\n  }\n}\n\n/** Response headers that carry a provider's request ID (Google, Azure). */\nconst REQUEST_ID_HEADERS = [\n  \"x-request-id\",\n  \"x-goog-request-id\",\n  \"request-id\",\n  \"x-ms-request-id\",\n  \"apim-request-id\",\n];\n\n/** The first string (or number) under a key matching `key`, anywhere in `value`. */\nfunction findValue(value: unknown, key: RegExp, depth = 0): string | undefined {\n  if (depth > 5 || value == null || typeof value !== \"object\") return undefined;\n  for (const [k, inner] of Object.entries(value as Record<string, unknown>)) {\n    if (\n      key.test(k) &&\n      (typeof inner === \"string\" || typeof inner === \"number\")\n    ) {\n      return String(inner);\n    }\n    const found = findValue(inner, key, depth + 1);\n    if (found) return found;\n  }\n  return undefined;\n}\n\nfunction parseBody(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction retryAfterSeconds(header: string | null): number | undefined {\n  if (!header) return undefined;\n  const seconds = Number(header.trim());\n  return Number.isFinite(seconds) && seconds >= 0 ? seconds : undefined;\n}\n\nconst RETRYABLE = new Set<LLMProviderStatus>([429, 503]);\n\nexport type InvokeResult = {\n  id: string;\n  object: string;\n  created: number;\n  model: string;\n  choices: Array<{\n    index: number;\n    message: {\n      role: string;\n      content: string | null;\n      tool_calls?: Array<{\n        id: string;\n        type: \"function\";\n        function: { name: string; arguments: string };\n      }>;\n    };\n    finish_reason: string;\n  }>;\n  usage?: {\n    prompt_tokens: number;\n    completion_tokens: number;\n    total_tokens: number;\n  };\n};\n\nconst ensureArray = (\n  value: MessageContent | MessageContent[]\n): MessageContent[] => (Array.isArray(value) ? value : [value]);\n\nconst normalizeContentPart = (\n  part: MessageContent\n): TextContent | ImageContent | FileContent => {\n  if (typeof part === \"string\") {\n    return { type: \"text\", text: part };\n  }\n  if (part.type === \"text\") return part;\n  if (part.type === \"image_url\") return part;\n  if (part.type === \"file_url\") return part;\n  throw new Error(\"Unsupported message content part\");\n};\n\nconst normalizeMessage = (message: Message) => {\n  const { role, name, tool_call_id } = message;\n  if (role === \"tool\" || role === \"function\") {\n    const content = ensureArray(message.content)\n      .map(part => (typeof part === \"string\" ? part : JSON.stringify(part)))\n      .join(\"\\n\");\n    return { role, name, tool_call_id, content };\n  }\n  const contentParts = ensureArray(message.content).map(normalizeContentPart);\n  if (contentParts.length === 1 && contentParts[0].type === \"text\") {\n    return { role, name, content: contentParts[0].text };\n  }\n  return { role, name, content: contentParts };\n};\n\nconst normalizeToolChoice = (\n  toolChoice: ToolChoice | undefined,\n  tools: Tool[] | undefined\n): \"none\" | \"auto\" | ToolChoiceExplicit | undefined => {\n  if (!toolChoice) return undefined;\n  if (toolChoice === \"none\" || toolChoice === \"auto\") return toolChoice;\n  if (toolChoice === \"required\") {\n    if (!tools || tools.length === 0) {\n      throw new Error(\n        \"tool_choice 'required' was provided but no tools were configured\"\n      );\n    }\n    if (tools.length > 1) {\n      throw new Error(\n        \"tool_choice 'required' needs a single tool or specify the tool name explicitly\"\n      );\n    }\n    return { type: \"function\", function: { name: tools[0].function.name } };\n  }\n  if (\"name\" in toolChoice) {\n    return { type: \"function\", function: { name: toolChoice.name } };\n  }\n  return toolChoice;\n};\n\nconst normalizeResponseFormat = ({\n  responseFormat,\n  response_format,\n  outputSchema,\n  output_schema,\n}: {\n  responseFormat?: ResponseFormat;\n  response_format?: ResponseFormat;\n  outputSchema?: OutputSchema;\n  output_schema?: OutputSchema;\n}):\n  | { type: \"json_schema\"; json_schema: JsonSchema }\n  | { type: \"text\" }\n  | { type: \"json_object\" }\n  | undefined => {\n  const explicitFormat = responseFormat || response_format;\n  if (explicitFormat) {\n    if (\n      explicitFormat.type === \"json_schema\" &&\n      !explicitFormat.json_schema?.schema\n    ) {\n      throw new Error(\n        \"responseFormat json_schema requires a defined schema object\"\n      );\n    }\n    return explicitFormat;\n  }\n  const schema = outputSchema || output_schema;\n  if (!schema) return undefined;\n  if (!schema.name || !schema.schema) {\n    throw new Error(\"outputSchema requires both name and schema\");\n  }\n  return {\n    type: \"json_schema\",\n    json_schema: {\n      name: schema.name,\n      schema: schema.schema,\n      ...(typeof schema.strict === \"boolean\" ? { strict: schema.strict } : {}),\n    },\n  };\n};\n\n/** Flatten a message's content to plain text for token estimation. */\nfunction messageToText(content: unknown): string {\n  if (typeof content === \"string\") return content;\n  if (Array.isArray(content)) {\n    return content\n      .map(part => {\n        if (typeof part === \"string\") return part;\n        if (part && typeof part === \"object\" && \"text\" in part) {\n          return String((part as { text?: unknown }).text ?? \"\");\n        }\n        return \"\";\n      })\n      .join(\" \");\n  }\n  return \"\";\n}\n\nexport function createLLMClient(env: CoreEnv, options: LLMClientOptions = {}) {\n  const {\n    app = \"unknown\",\n    costRate = DEFAULT_COST_RATE,\n    onUsage,\n    guard,\n    model: mainModel = DEFAULT_LLM_MODEL,\n    fallbackModel,\n    timeoutMs,\n    retryDelaysMs = [],\n    fetchImpl = fetch,\n    aiGate,\n  } = options;\n  const provider: LLMProviderName = \"gemini\";\n\n  /** Never let the key into an error, whatever the provider echoes back. */\n  const redact = (text: string) =>\n    env.geminiApiKey ? text.split(env.geminiApiKey).join(\"[redacted]\") : text;\n\n  const resolveApiUrl = () =>\n    env.geminiApiUrl && env.geminiApiUrl.trim().length > 0\n      ? `${env.geminiApiUrl.replace(/\\/$/, \"\")}/chat/completions`\n      : \"https://generativelanguage.googleapis.com/v1beta/openai/chat/completions\";\n\n  const assertApiKey = () => {\n    if (!env.geminiApiKey) {\n      throw new Error(\"GEMINI_API_KEY is not configured\");\n    }\n  };\n\n  return async function invokeLLM(params: InvokeParams): Promise<InvokeResult> {\n    assertApiKey();\n\n    const {\n      messages,\n      tools,\n      toolChoice,\n      tool_choice,\n      outputSchema,\n      output_schema,\n      responseFormat,\n      response_format,\n      meta = {},\n    } = params;\n\n    // ── AI plan gate: is AI on for this caller's company? (#101) ──\n    if (aiGate) {\n      if (!meta.user) {\n        throw new Error(\n          \"[core-server] this LLM client has an aiGate, so every call must name its caller in meta.user ({ role, enterpriseId })\"\n        );\n      }\n      await aiGate.assertAvailable(meta.user);\n    }\n\n    const estPromptTokens = estimateMessageTokens(\n      messages.map(m => messageToText(m.content))\n    );\n\n    // ── Cost control: ask the guard before spending anything ──\n    if (guard) {\n      const verdict = await guard({ app, estPromptTokens, ...meta });\n      if (!verdict.allowed) {\n        throw new LLMBudgetError(\n          verdict.reason ?? \"AI is temporarily unavailable.\"\n        );\n      }\n    }\n\n    const payload: Record<string, unknown> = {\n      messages: messages.map(normalizeMessage),\n    };\n\n    if (tools && tools.length > 0) {\n      payload.tools = tools;\n    }\n\n    const normalizedToolChoice = normalizeToolChoice(\n      toolChoice || tool_choice,\n      tools\n    );\n    if (normalizedToolChoice) {\n      payload.tool_choice = normalizedToolChoice;\n    }\n\n    payload.max_tokens = 32768;\n\n    const normalizedResponseFormat = normalizeResponseFormat({\n      responseFormat,\n      response_format,\n      outputSchema,\n      output_schema,\n    });\n    if (normalizedResponseFormat) {\n      payload.response_format = normalizedResponseFormat;\n    }\n\n    let attempts = 0;\n\n    /** One request to one model. Throws LLMProviderError on a provider failure. */\n    const attempt = async (model: string): Promise<InvokeResult> => {\n      attempts++;\n      const timeout =\n        timeoutMs && timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;\n      try {\n        const response = await fetchImpl(resolveApiUrl(), {\n          method: \"POST\",\n          headers: {\n            \"content-type\": \"application/json\",\n            authorization: `Bearer ${env.geminiApiKey}`,\n          },\n          body: JSON.stringify({ model, ...payload }),\n          signal: timeout,\n        });\n\n        if (!response.ok) {\n          const errorText = await response.text();\n          const body = parseBody(errorText);\n          const providerMessage = redact(\n            (body !== undefined\n              ? findValue(body, /^message$/)\n              : errorText.trim()) ?? \"\"\n          ).slice(0, 300);\n          throw new LLMProviderError({\n            // Unchanged text, so callers that still parse it keep working.\n            message: redact(\n              `LLM invoke failed: ${response.status} ${response.statusText} – ${errorText}`\n            ),\n            provider,\n            status: response.status,\n            statusText: response.statusText || undefined,\n            providerMessage: providerMessage || undefined,\n            providerCode:\n              body !== undefined ? findValue(body, /^status$/) : undefined,\n            providerRequestId:\n              REQUEST_ID_HEADERS.map(h => response.headers.get(h)).find(\n                Boolean\n              ) ??\n              (body !== undefined\n                ? findValue(body, /^(request_?id|trace_?id)$/i)\n                : undefined) ??\n              undefined,\n            model,\n            attempts,\n            retryAfterSeconds: retryAfterSeconds(\n              response.headers.get(\"retry-after\")\n            ),\n          });\n        }\n\n        return (await response.json()) as InvokeResult;\n      } catch (err) {\n        if (err instanceof LLMProviderError) throw err;\n        if (timeout?.aborted) {\n          throw new LLMProviderError({\n            message: `LLM invoke failed: TIMEOUT – no answer from ${provider} (${model}) within ${timeoutMs} ms`,\n            provider,\n            status: \"TIMEOUT\",\n            model,\n            attempts,\n          });\n        }\n        throw err;\n      }\n    };\n\n    /** A model's attempts: the first, then one per retry delay on 429/503. */\n    const withRetries = async (\n      model: string,\n      delays: number[]\n    ): Promise<InvokeResult> => {\n      for (let i = 0; ; i++) {\n        try {\n          return await attempt(model);\n        } catch (err) {\n          if (\n            err instanceof LLMProviderError &&\n            RETRYABLE.has(err.status) &&\n            i < delays.length\n          ) {\n            await new Promise(resolve => setTimeout(resolve, delays[i]));\n            continue;\n          }\n          throw err;\n        }\n      }\n    };\n\n    let usedModel = mainModel;\n    let result: InvokeResult;\n    try {\n      result = await withRetries(mainModel, retryDelaysMs);\n    } catch (err) {\n      // Still busy after its retries: one try on the lighter model.\n      if (\n        !fallbackModel ||\n        !(err instanceof LLMProviderError) ||\n        err.status !== 503\n      ) {\n        throw err;\n      }\n      usedModel = fallbackModel;\n      result = await attempt(fallbackModel);\n    }\n\n    // ── Metering: capture usage and emit to the sink (never breaks the call) ──\n    if (onUsage) {\n      try {\n        const provided = result.usage;\n        const estimated = !provided;\n        const promptTokens = provided?.prompt_tokens ?? estPromptTokens;\n        const completionTokens =\n          provided?.completion_tokens ??\n          estimateTokens(messageToText(result.choices?.[0]?.message?.content));\n        const totalTokens =\n          provided?.total_tokens ?? promptTokens + completionTokens;\n\n        const event: UsageEvent = {\n          app,\n          model: result.model ?? usedModel,\n          promptTokens,\n          completionTokens,\n          totalTokens,\n          estCostUsd: computeCostUsd(promptTokens, completionTokens, costRate),\n          estimated,\n          at: new Date().toISOString(),\n          ...meta,\n        };\n\n        await onUsage(event);\n      } catch (err) {\n        // Metering must never take down a working chat.\n        console.warn(\"[core-server] onUsage sink failed:\", err);\n      }\n    }\n\n    return result;\n  };\n}\n","/**\n * AI plan gate — \"is Opi's AI on for this company?\", asked of the Portal\n * before a model call (#101, subdomains#1076 option B).\n *\n * The answer is the Portal's own `ai.availability` (assertAiAllowed: the\n * environment, the platform and company switches, the plan), fetched for a\n * named company over the Service API (oplytics-portal#397):\n *\n *   GET /api/service/ai/availability?role=<role>\n *   X-Service-Key: <key>   X-Enterprise-Id: <company>\n *   → { available: true } | { available: false, reason, message }\n *\n * Cached per company and per platform-admin-or-not (only platform_admin\n * changes the Portal's answer), for `cacheTtlMs`.\n *\n * Fails open: when the Portal can't tell (the route isn't there yet, the\n * Portal is down or slow, an odd reply), the call goes ahead, as in\n * subdomains#1070. This is a plan gate, not a security boundary, and an\n * outage must not switch Opi off for every company.\n *\n * Usually not called directly: pass it to createLLMClient (or\n * createSupportEngine) as `aiGate`, and every call through that client is\n * checked before any spend.\n */\n\n/** Why the Portal says AI is off (its AiDisabledReason). */\nexport type AiUnavailableReason =\n  \"non-production\" | \"kill-switch\" | \"enterprise-disabled\" | \"plan-tier\";\n\nexport type AiAvailability =\n  | {\n      available: true;\n      /** True when the Portal couldn't tell and the call is let through. */\n      unknown?: true;\n    }\n  | {\n      available: false;\n      /** The Portal's reason, e.g. \"plan-tier\". */\n      reason: AiUnavailableReason | string;\n      /** The Portal's user-facing message. */\n      message: string;\n    };\n\n/** Who a model call is for: the same shape as CallMeta's `user`. */\nexport interface AiCaller {\n  enterpriseId?: number | string | null;\n  role?: string | null;\n}\n\n/** AI is off for this caller's company. `message` is the Portal's own text. */\nexport class AiUnavailableError extends Error {\n  readonly reason: AiUnavailableReason | string;\n  readonly enterpriseId: number | null;\n\n  constructor(\n    reason: AiUnavailableReason | string,\n    message: string,\n    enterpriseId: number | null\n  ) {\n    super(message);\n    this.name = \"AiUnavailableError\";\n    this.reason = reason;\n    this.enterpriseId = enterpriseId;\n  }\n}\n\nexport interface AiGateConfig {\n  /** Portal Service API base URL, e.g. https://portal.oplyticsdigital.net */\n  portalApiUrl: string;\n  /** The app's X-Service-Key. */\n  portalApiKey: string;\n  /** How long an answer is reused, in ms. Default 60 s. */\n  cacheTtlMs?: number;\n  /** How long to wait for the Portal before letting the call through. Default 2 s. */\n  timeoutMs?: number;\n  /** Injectable fetch (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /** Injectable clock (for tests). Defaults to Date.now. */\n  now?: () => number;\n}\n\nexport interface AiGate {\n  /** The Portal's answer for this caller (cached). Never throws. */\n  check(caller: AiCaller | null | undefined): Promise<AiAvailability>;\n  /** Throws AiUnavailableError when AI is off for this caller. */\n  assertAvailable(caller: AiCaller | null | undefined): Promise<void>;\n  /** Forget one company's answers, or every answer with no argument. */\n  invalidate(enterpriseId?: number): void;\n}\n\n/** A company id: a positive whole number, from a number or a numeric string. */\nfunction enterpriseIdOf(caller: AiCaller | null | undefined): number | null {\n  const raw = caller?.enterpriseId;\n  const id =\n    typeof raw === \"number\"\n      ? raw\n      : typeof raw === \"string\" && /^\\d+$/.test(raw.trim())\n        ? Number(raw.trim())\n        : NaN;\n  return Number.isSafeInteger(id) && id > 0 ? id : null;\n}\n\nconst UNKNOWN: AiAvailability = { available: true, unknown: true };\n\nexport function createAiGate(config: AiGateConfig): AiGate {\n  const {\n    portalApiUrl,\n    portalApiKey,\n    cacheTtlMs = 60_000,\n    timeoutMs = 2_000,\n    fetchImpl = fetch,\n    now = Date.now,\n  } = config;\n  const configured = Boolean(portalApiUrl && portalApiKey);\n  const url = `${portalApiUrl.replace(/\\/$/, \"\")}/api/service/ai/availability`;\n\n  const cache = new Map<string, { answer: AiAvailability; at: number }>();\n  const inflight = new Map<string, Promise<AiAvailability>>();\n  const warned = new Set<string>();\n  const warnOnce = (key: string, message: string) => {\n    if (warned.has(key)) return;\n    warned.add(key);\n    console.warn(`[core-server aiGate] ${message}`);\n  };\n\n  async function ask(\n    enterpriseId: number | null,\n    role: string | undefined\n  ): Promise<AiAvailability> {\n    if (!configured) {\n      warnOnce(\n        \"unconfigured\",\n        \"no Portal API URL/key — AI plan not checked, calls go ahead\"\n      );\n      return UNKNOWN;\n    }\n    try {\n      const res = await fetchImpl(\n        role ? `${url}?role=${encodeURIComponent(role)}` : url,\n        {\n          headers: {\n            \"X-Service-Key\": portalApiKey,\n            ...(enterpriseId !== null\n              ? { \"X-Enterprise-Id\": String(enterpriseId) }\n              : {}),\n          },\n          signal: AbortSignal.timeout(timeoutMs),\n        }\n      );\n      if (res.status === 404) {\n        warnOnce(\n          \"404\",\n          \"the Portal has no /api/service/ai/availability yet (oplytics-portal#397) — AI plan not checked, calls go ahead\"\n        );\n        return UNKNOWN;\n      }\n      if (!res.ok) {\n        console.warn(\n          `[core-server aiGate] Portal answered ${res.status} for company ${enterpriseId ?? \"-\"} — letting the call through`\n        );\n        return UNKNOWN;\n      }\n      const body = (await res.json().catch(() => null)) as {\n        available?: unknown;\n        reason?: unknown;\n        message?: unknown;\n      } | null;\n      if (body?.available === true) return { available: true };\n      if (body?.available === false && typeof body.message === \"string\") {\n        return {\n          available: false,\n          reason: typeof body.reason === \"string\" ? body.reason : \"unavailable\",\n          message: body.message,\n        };\n      }\n      console.warn(\n        `[core-server aiGate] odd reply for company ${enterpriseId ?? \"-\"} — letting the call through`\n      );\n      return UNKNOWN;\n    } catch (err) {\n      console.warn(\n        `[core-server aiGate] Portal check failed for company ${enterpriseId ?? \"-\"} (${err instanceof Error ? err.message : String(err)}) — letting the call through`\n      );\n      return UNKNOWN;\n    }\n  }\n\n  async function check(\n    caller: AiCaller | null | undefined\n  ): Promise<AiAvailability> {\n    const enterpriseId = enterpriseIdOf(caller);\n    const role = caller?.role ?? undefined;\n    // Only platform_admin changes the Portal's answer for a company.\n    const key = `${enterpriseId ?? \"-\"}|${role === \"platform_admin\" ? \"pa\" : \"user\"}`;\n\n    const hit = cache.get(key);\n    if (hit && now() - hit.at < cacheTtlMs) return hit.answer;\n\n    let pending = inflight.get(key);\n    if (!pending) {\n      pending = ask(enterpriseId, role)\n        .then(answer => {\n          if (cacheTtlMs > 0) cache.set(key, { answer, at: now() });\n          return answer;\n        })\n        .finally(() => inflight.delete(key));\n      inflight.set(key, pending);\n    }\n    return pending;\n  }\n\n  async function assertAvailable(\n    caller: AiCaller | null | undefined\n  ): Promise<void> {\n    const answer = await check(caller);\n    if (!answer.available) {\n      throw new AiUnavailableError(\n        answer.reason,\n        answer.message,\n        enterpriseIdOf(caller)\n      );\n    }\n  }\n\n  function invalidate(enterpriseId?: number): void {\n    if (enterpriseId === undefined) {\n      cache.clear();\n      return;\n    }\n    for (const key of [...cache.keys()]) {\n      if (key.startsWith(`${enterpriseId}|`)) cache.delete(key);\n    }\n  }\n\n  return { check, assertAvailable, invalidate };\n}\n","/**\n * Personas for the shared Oplytics AI assistant.\n *\n * One brain, two voices: the same knowledge base is wrapped in a customer-facing\n * persona (\"Opi\" on the marketing site) or an operational persona (the in-app\n * \"AI Support Engineer\" in the portal / subdomains). The mode selects the overlay.\n */\n\nimport {\n  PRODUCTION_MARKETING_ORIGIN,\n  resolveMarketingOrigin,\n} from \"../sandbox\";\n\nexport type AssistantMode = \"marketing\" | \"operational\";\n\n/** Identity + tone shared by every surface. */\nconst BASE_PERSONA = `\nYou are the Oplytics AI assistant — a knowledgeable, friendly guide to the Oplytics operational-excellence platform.\nYour personality is warm, approachable, and genuinely helpful, while staying clear, professional, and competent — especially on operational safety and platform technicals.\n\nShared guidelines:\n- Use a warm, professional tone: clear, concise, and easy to follow. Avoid heavy slang, forced catchphrases, or over-familiarity — be friendly without overdoing it.\n- For anything safety- or incident-related, stay serious and accurate while keeping the warm tone — prioritise accuracy over speed.\n- If you don't know something, be honest and guide the user to the right place rather than inventing an answer.\n- Prefer the supplied Oplytics knowledge below over your own assumptions. If the knowledge doesn't cover it, say so plainly.\n`.trim();\n\n/**\n * Real, live Oplytics pages, injected into every persona so Opi can cite an\n * actual URL instead of inventing one. Copied word for word from Portal's\n * OPLYTICS_FACTS (oplytics-portal server/routers/ai.ts, portal#259) so the two\n * Opis give the same answer. UPDATE THIS LIST whenever a public page is added\n * to or removed from the marketing site (routes: marketing-site\n * client/src/App.tsx), and keep Portal's copy in step. These are the\n * production addresses; buildSystemPrompt points them at the sandbox\n * marketing site when running as the sandbox (#86).\n */\nexport const OPLYTICS_VERIFIED_LINKS = `\nReal Oplytics links. Only cite links from this list. Never invent, guess or modify a URL.\n- Home / product overview: https://oplytics.digital\n- Pricing: https://oplytics.digital/pricing\n- Contact / book a demo: https://oplytics.digital/contact\n- About: https://oplytics.digital/about\n- Opi and the AI platform: https://oplytics.digital/ai\n- The Obeya Room: https://oplytics.digital/obeya\n- Why Oplytics: https://oplytics.digital/why-us\n- Resources: https://oplytics.digital/resources\n- Terms of Service: https://oplytics.digital/terms\n- Privacy Policy: https://oplytics.digital/privacy\n- Cookie Policy: https://oplytics.digital/cookies\n- Acceptable Use Policy: https://oplytics.digital/aup\n- Data Processing Agreement (DPA): https://oplytics.digital/dpa\n- Service Level Agreement (SLA): https://oplytics.digital/sla\nIf asked for a page that is not in this list (for example careers), say there is no link for it and describe where to look instead, such as the Contact page or the relevant area of the app. Do not make up a link.\n`.trim();\n\n/** Customer-facing overlay — Opi on the public marketing site. */\nconst MARKETING_OVERLAY = `\nYou are \"Opi\", talking to a prospective customer on the public Oplytics marketing site.\n- Focus on features, benefits, outcomes, and helping them book a demo or get in touch.\n- Be persuasive but never pushy or salesy; lead with how Oplytics solves their problem.\n- Never discuss competitor products by name.\n- For specific pricing, direct the user to the Contact page (https://oplytics.digital/contact) rather than quoting figures.\n- You do not have access to any account or operational data — you are pre-sales only.\n`.trim();\n\n/** Authenticated overlay — the in-app AI Support Engineer. */\nconst OPERATIONAL_OVERLAY = `\nYou are the Oplytics AI Support Engineer, supporting a verified, logged-in user inside the platform.\n- Tailor responses to their role and enterprise context (supplied below when available).\n- Help with deep operational support: platform setup, training, troubleshooting, data interpretation, and specific tasks.\n- For safety-related queries, always prioritise accuracy and cite the correct workflow.\n- You may reference platform features and the user's context, but never expose data the user shouldn't see.\n`.trim();\n\nconst OVERLAYS: Record<AssistantMode, string> = {\n  marketing: MARKETING_OVERLAY,\n  operational: OPERATIONAL_OVERLAY,\n};\n\nexport interface BuildSystemPromptParams {\n  mode: AssistantMode;\n  /** Pre-formatted knowledge block (see formatKnowledge) injected into the prompt. */\n  knowledge?: string;\n  /** Free-form runtime context (current page, user/role, enterprise, etc.). */\n  context?: string;\n  /**\n   * Origin for the marketing links Opi cites. Default: MARKETING_ORIGIN if\n   * set, else http://localhost:3007 in the local sandbox\n   * (INFISICAL_ENV=staging), else https://oplytics.digital (#86).\n   */\n  marketingOrigin?: string;\n}\n\n/** Compose the full system prompt: base identity + mode overlay + verified links + knowledge + context. */\nexport function buildSystemPrompt({\n  mode,\n  knowledge,\n  context,\n  marketingOrigin = resolveMarketingOrigin(),\n}: BuildSystemPromptParams): string {\n  // The fixed text cites production pages; in the sandbox they point at the\n  // sandbox marketing site instead, so Opi never sends anyone to production.\n  const sections = [BASE_PERSONA, OVERLAYS[mode], OPLYTICS_VERIFIED_LINKS].map(\n    s => s.replaceAll(PRODUCTION_MARKETING_ORIGIN, marketingOrigin)\n  );\n\n  if (knowledge && knowledge.trim().length > 0) {\n    sections.push(`Relevant Oplytics knowledge:\\n${knowledge.trim()}`);\n  }\n\n  if (context && context.trim().length > 0) {\n    sections.push(`Current context:\\n${context.trim()}`);\n  }\n\n  return sections.join(\"\\n\\n\");\n}\n","/**\n * Shared Oplytics knowledge base + a RAG-ready retrieval interface.\n *\n * Phase 2a ships the knowledge as version-controlled data injected into the\n * system prompt, behind a `Retriever` interface. Phase 2b can swap the static\n * retriever for a vector-store-backed one WITHOUT changing any consumer — the\n * signature is the contract.\n *\n * This is a deliberately small seed. Expand `KNOWLEDGE` over time (it's the one\n * source of truth shared by Opi and the in-app AI Support Engineer).\n */\nimport type { AssistantMode } from \"./personas\";\n\nexport interface KnowledgeItem {\n  id: string;\n  question: string;\n  answer: string;\n  /** Lowercase keywords/tags used by the static retriever's scoring. */\n  tags: string[];\n  /** If set, this item is only surfaced in the listed modes. Default: both. */\n  modes?: AssistantMode[];\n}\n\nexport interface RetrieveOptions {\n  mode: AssistantMode;\n  /** Max items to return. Default 4. */\n  limit?: number;\n}\n\n/**\n * A retriever maps a user query to the most relevant knowledge items.\n * Async so a future vector/embedding implementation can drop in unchanged.\n */\nexport type Retriever = (\n  query: string,\n  options: RetrieveOptions\n) => Promise<KnowledgeItem[]> | KnowledgeItem[];\n\n/** Seed knowledge. Sourced from the Oplytics solution set; extend freely. */\nexport const KNOWLEDGE: KnowledgeItem[] = [\n  // ── Platform ──────────────────────────────────────────────────────────────\n  {\n    id: \"platform-overview\",\n    question: \"What does Oplytics do?\",\n    answer:\n      \"Oplytics is an integrated operational-excellence platform for manufacturers. Its modules share data, context, and AI insights so individual tools compound into one advantage instead of working in silos. Four services are live today (OEE Manager, the SQDCP Dashboard, Policy Deployment, and Action Manager), with more on the way.\",\n    tags: [\n      \"platform\",\n      \"overview\",\n      \"what\",\n      \"oplytics\",\n      \"modules\",\n      \"manufacturing\",\n    ],\n  },\n  {\n    id: \"who-for\",\n    question: \"Who is Oplytics for?\",\n    answer:\n      \"Manufacturers and factory operations teams running continuous improvement, lean, and daily management — from the shop floor to senior leadership. It suits anyone replacing whiteboards, spreadsheets, and disconnected point tools with one connected system.\",\n    tags: [\n      \"who\",\n      \"for\",\n      \"audience\",\n      \"manufacturer\",\n      \"factory\",\n      \"lean\",\n      \"operations\",\n    ],\n  },\n  {\n    id: \"live-services\",\n    question: \"Which services are available right now?\",\n    answer:\n      \"Live today: OEE Manager, the SQDCP Dashboard, Policy Deployment, and Action Manager.\",\n    tags: [\n      \"live\",\n      \"available\",\n      \"services\",\n      \"roadmap\",\n      \"coming\",\n      \"soon\",\n      \"status\",\n    ],\n  },\n  {\n    id: \"integrated-platform\",\n    question: \"Why one platform instead of separate tools?\",\n    answer:\n      \"Every module shares the same data and context, so an action raised on a tier board, a loss in OEE, and a strategic objective all connect. That shared backbone is what lets the AI surface patterns no single tool could see alone.\",\n    tags: [\"integrated\", \"platform\", \"connected\", \"modules\", \"data\", \"why\"],\n  },\n  {\n    id: \"methodologies\",\n    question: \"What improvement methodologies does it support?\",\n    answer:\n      \"Best-practice CI is built into the workflows: Lean, Kaizen, and PDCA throughout, plus Hoshin Kanri (with X-matrix and catchball) for strategy deployment and the SQDCP framework for daily management.\",\n    tags: [\n      \"lean\",\n      \"kaizen\",\n      \"pdca\",\n      \"hoshin\",\n      \"methodology\",\n      \"ci\",\n      \"continuous\",\n      \"improvement\",\n    ],\n  },\n  {\n    id: \"mobile-desktop\",\n    question: \"Can we use it on mobile?\",\n    answer:\n      \"Yes — Oplytics works on desktop and mobile, so boards, actions, and reports are accessible from any device, on the floor or off-site.\",\n    tags: [\"mobile\", \"desktop\", \"device\", \"tablet\", \"phone\", \"access\"],\n  },\n  // ── OEE Manager (live) ─────────────────────────────────────────────────────\n  {\n    id: \"oee-manager\",\n    question: \"How does OEE Manager work?\",\n    answer:\n      \"OEE Manager tracks Overall Equipment Effectiveness — availability, performance, and quality — in real time across every machine and line. It categorises downtime and speed losses, builds Pareto/loss analysis, and trends OEE by shift, line, product, and operator so teams target the biggest losses first.\",\n    tags: [\n      \"oee\",\n      \"manager\",\n      \"downtime\",\n      \"loss\",\n      \"availability\",\n      \"performance\",\n      \"quality\",\n      \"tracking\",\n      \"equipment\",\n    ],\n  },\n  {\n    id: \"oee-data-collection\",\n    question: \"Does OEE data have to be entered by hand?\",\n    answer:\n      \"No — machines and other systems can send live data to OEE Manager automatically through its REST API or webhooks, eliminating manual-entry errors. Manual entry is still available where automation isn't in place.\",\n    tags: [\n      \"oee\",\n      \"data\",\n      \"collection\",\n      \"automated\",\n      \"api\",\n      \"webhook\",\n      \"plc\",\n      \"sensor\",\n      \"manual\",\n    ],\n  },\n  {\n    id: \"oee-targets-handover\",\n    question: \"Can we set OEE targets and run shift handovers?\",\n    answer:\n      \"Yes. Set OEE targets by line, product, and shift with live visual indicators against target, and generate digital shift-handover reports with OEE summaries, open actions, and key events from the previous shift.\",\n    tags: [\"oee\", \"target\", \"shift\", \"handover\", \"report\", \"goal\"],\n  },\n  // ── SQDCP Dashboard (live) ─────────────────────────────────────────────────\n  {\n    id: \"sqdcp\",\n    question: \"What is the SQDCP Dashboard?\",\n    answer:\n      \"SQDCP replaces physical whiteboards with real-time digital tier boards covering Safety, Quality, Delivery, Cost, and People. Boards are accessible from any device and keep daily management consistent across shifts and sites.\",\n    tags: [\n      \"sqdcp\",\n      \"tier\",\n      \"board\",\n      \"dashboard\",\n      \"daily\",\n      \"management\",\n      \"whiteboard\",\n    ],\n  },\n  {\n    id: \"sqdcp-pillars\",\n    question: \"What does SQDCP track?\",\n    answer:\n      \"The five pillars: Safety (incidents, near-misses, observations), Quality (first-pass yield, scrap, complaints), Delivery (on-time delivery, schedule adherence), Cost (operational cost and waste), and People (attendance, training, skills).\",\n    tags: [\n      \"sqdcp\",\n      \"safety\",\n      \"quality\",\n      \"delivery\",\n      \"cost\",\n      \"people\",\n      \"pillars\",\n      \"metrics\",\n    ],\n  },\n  // ── Policy Deployment (live) ───────────────────────────────────────────────\n  {\n    id: \"policy-deployment\",\n    question: \"What is Policy Deployment?\",\n    answer:\n      \"Policy Deployment cascades strategy through every level using Hoshin Kanri: define 3-5 year breakthrough objectives and annual priorities, link them in a visual X-matrix, deploy via the catchball process, and review progress on a monthly/quarterly cadence with bowling charts.\",\n    tags: [\n      \"policy\",\n      \"deployment\",\n      \"hoshin\",\n      \"kanri\",\n      \"strategy\",\n      \"xmatrix\",\n      \"catchball\",\n      \"objectives\",\n    ],\n  },\n  {\n    id: \"catchball\",\n    question: \"What is the catchball process?\",\n    answer:\n      \"Catchball is how objectives are aligned top-down and bottom-up: leadership proposes goals, teams feed back what's achievable, and the two iterate until aligned. Oplytics facilitates this digitally so strategy doesn't get lost between management layers.\",\n    tags: [\n      \"catchball\",\n      \"hoshin\",\n      \"alignment\",\n      \"objectives\",\n      \"policy\",\n      \"deployment\",\n    ],\n  },\n  // ── Action Manager (live) ──────────────────────────────────────────────────\n  {\n    id: \"action-manager\",\n    question: \"What is Action Manager?\",\n    answer:\n      \"Action Manager is one unified action register: capture actions from any source (audits, incidents, meetings, tier boards), assign them with owners and due dates, auto-escalate overdue items, and track status from open to verified closure. Analytics show completion rates, ageing, and source breakdown.\",\n    tags: [\n      \"action\",\n      \"manager\",\n      \"tasks\",\n      \"improvement\",\n      \"ci\",\n      \"register\",\n      \"escalation\",\n      \"closure\",\n    ],\n  },\n  // ── Integrations ───────────────────────────────────────────────────────────\n  {\n    id: \"connect-integrations\",\n    question: \"Can Oplytics connect to our machines and systems?\",\n    answer:\n      \"Yes — machines and other systems can send live data to OEE Manager automatically through its REST API or webhooks. For a particular protocol, machine type, or business system, get in touch via /contact so the team can scope your setup.\",\n    tags: [\n      \"connect\",\n      \"integration\",\n      \"machine\",\n      \"plc\",\n      \"scada\",\n      \"sensor\",\n      \"opcua\",\n      \"mqtt\",\n      \"modbus\",\n      \"iot\",\n      \"api\",\n      \"webhook\",\n    ],\n  },\n  {\n    id: \"erp-integration\",\n    question: \"Can it integrate with our ERP or other systems?\",\n    answer:\n      \"Oplytics focuses on shop-floor connectivity (machines, PLCs, sensors) today. For ERP or other business-system integrations, the best step is to get in touch via /contact so the team can scope your specific setup.\",\n    tags: [\"erp\", \"integration\", \"system\", \"api\", \"data\", \"contact\"],\n  },\n  {\n    id: \"protocols\",\n    question: \"Which industrial protocols are supported?\",\n    answer:\n      \"Today OEE Manager takes live machine data through a REST API (data sent by HTTP POST) and webhooks. If your equipment uses a specific industrial protocol such as OPC-UA, MQTT, or Modbus, get in touch via /contact so the team can confirm the best way to connect it.\",\n    tags: [\n      \"protocol\",\n      \"opcua\",\n      \"mqtt\",\n      \"modbus\",\n      \"plc\",\n      \"scada\",\n      \"edge\",\n      \"connectivity\",\n    ],\n  },\n  // ── AI ─────────────────────────────────────────────────────────────────────\n  {\n    id: \"integrated-ai\",\n    question: \"How does the AI help?\",\n    answer:\n      \"AI runs across every module — surfacing patterns, predicting issues, and recommending actions no single tool could spot alone — and the assistant helps users navigate, answers questions, and suggests next steps.\",\n    tags: [\n      \"ai\",\n      \"insights\",\n      \"predict\",\n      \"assistant\",\n      \"recommend\",\n      \"intelligence\",\n    ],\n  },\n  {\n    id: \"ai-assistant\",\n    question: \"Who are you / what can you help with?\",\n    answer:\n      \"I'm Opi, the Oplytics AI guide. I can explain what the platform and each module do, point you to the right place, and help you book a demo or get in touch.\",\n    tags: [\"opi\", \"assistant\", \"help\", \"who\", \"guide\", \"bot\"],\n  },\n  // ── Pricing, demos, getting started (marketing) ────────────────────────────\n  {\n    id: \"pricing\",\n    question: \"How much does it cost?\",\n    answer:\n      \"Pricing is tailored to your sites and the modules you use, so figures aren't published. The best next step is to get in touch via the contact page (/contact) and the team will put together a quote.\",\n    tags: [\"pricing\", \"price\", \"cost\", \"quote\", \"how\", \"much\", \"plan\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"plans\",\n    question: \"What plans are available?\",\n    answer:\n      \"There are tiers to suit different stages — an Early Beta Partner programme, Starter, Professional, and Enterprise — covering different usage limits and capabilities like custom integrations and SLAs. All four live services are included; reach out via /contact to find the right fit.\",\n    tags: [\n      \"plan\",\n      \"tier\",\n      \"starter\",\n      \"professional\",\n      \"enterprise\",\n      \"beta\",\n      \"package\",\n    ],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"beta\",\n    question: \"Is there a beta or early-adopter option?\",\n    answer:\n      \"Yes — the Early Beta Partner programme is for teams who want to get started early and shape the platform. Get in touch via /contact to learn more.\",\n    tags: [\"beta\", \"early\", \"partner\", \"adopter\", \"trial\", \"pilot\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"demo\",\n    question: \"Can I see a demo?\",\n    answer:\n      \"Absolutely — you can book a demo or try the live module demos. Head to the contact page (/contact) to get set up.\",\n    tags: [\"demo\", \"trial\", \"try\", \"book\", \"see\", \"show\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"contact\",\n    question: \"How do I get in touch?\",\n    answer:\n      \"Head to the contact page at /contact — tell the team a little about your operation and they'll take it from there, whether that's a demo, a quote, or answering questions.\",\n    tags: [\"contact\", \"touch\", \"reach\", \"sales\", \"talk\", \"email\"],\n    modes: [\"marketing\"],\n  },\n  {\n    id: \"getting-started\",\n    question: \"How do we get started?\",\n    answer:\n      \"Start with a conversation: get in touch via /contact for a demo and onboarding. The team will help you stand up the live services for your sites and connect your data.\",\n    tags: [\"start\", \"started\", \"onboarding\", \"begin\", \"setup\", \"trial\"],\n  },\n];\n\n/** Lowercase word tokens, length >= 3. */\nfunction tokenize(text: string): string[] {\n  return (text.toLowerCase().match(/[a-z0-9]+/g) ?? []).filter(\n    w => w.length >= 3\n  );\n}\n\n/** Score an item against the query tokens (tag hits weighted over text hits). */\nfunction scoreItem(item: KnowledgeItem, queryTokens: string[]): number {\n  if (queryTokens.length === 0) return 0;\n  const haystack = tokenize(`${item.question} ${item.answer}`);\n  let score = 0;\n  for (const token of queryTokens) {\n    if (item.tags.includes(token)) score += 3;\n    if (haystack.includes(token)) score += 1;\n  }\n  return score;\n}\n\n/**\n * Build a static, keyword-scored retriever over the supplied knowledge.\n * Drop-in replaceable by a vector retriever implementing the same `Retriever`.\n */\nexport function createStaticRetriever(\n  knowledge: KnowledgeItem[] = KNOWLEDGE\n): Retriever {\n  return (query, { mode, limit = 4 }) => {\n    const queryTokens = tokenize(query);\n    const eligible = knowledge.filter(k => !k.modes || k.modes.includes(mode));\n\n    const scored = eligible\n      .map(item => ({ item, score: scoreItem(item, queryTokens) }))\n      .filter(s => s.score > 0)\n      .sort((a, b) => b.score - a.score)\n      .slice(0, limit)\n      .map(s => s.item);\n\n    // Cold-start / no keyword hits: fall back to the first few eligible items\n    // so the assistant always has some grounding to work from.\n    if (scored.length === 0) return eligible.slice(0, limit);\n    return scored;\n  };\n}\n\n/** Render retrieved items into a compact block for the system prompt. */\nexport function formatKnowledge(items: KnowledgeItem[]): string {\n  return items.map(i => `Q: ${i.question}\\nA: ${i.answer}`).join(\"\\n\\n\");\n}\n","/**\n * createSupportEngine — the shared chat brain for Opi (marketing) and the in-app\n * AI Support Engineer (operational). Composes persona + retrieved knowledge +\n * runtime context, then calls the existing LLM client.\n *\n *   const engine = createSupportEngine(ENV);\n *   const { content } = await engine.chat({ mode: \"marketing\", messages });\n */\nimport type { CoreEnv } from \"../types\";\nimport { createLLMClient } from \"../llm\";\nimport type { Message, LLMClientOptions } from \"../llm\";\nimport type { AiGate } from \"../aiGate\";\nimport { buildSystemPrompt, type AssistantMode } from \"./personas\";\nimport {\n  createStaticRetriever,\n  formatKnowledge,\n  type Retriever,\n} from \"./knowledge\";\n\n/** Lightweight, mode-agnostic chat message (system prompt is added internally). */\nexport interface ChatMessage {\n  role: \"user\" | \"assistant\";\n  content: string;\n}\n\n/** Optional runtime context to ground the assistant. */\nexport interface SupportContext {\n  /** Current page / route the user is on (page-awareness). */\n  page?: string;\n  /** Authenticated user details (operational mode). */\n  user?: { name?: string; role?: string; enterpriseId?: string | number };\n  /** Any extra free-form context to append. */\n  extra?: string;\n}\n\nexport interface ChatParams {\n  mode: AssistantMode;\n  messages: ChatMessage[];\n  context?: SupportContext;\n}\n\nexport interface ChatResult {\n  content: string;\n}\n\nexport interface SupportEngineOptions {\n  /**\n   * Knowledge retriever. Defaults to the bundled static keyword retriever.\n   * Swap for a vector-store retriever later with zero consumer changes.\n   */\n  retrieve?: Retriever;\n  /** Items to retrieve per turn. Default 4. */\n  knowledgeLimit?: number;\n  /** Metering + cost-control hooks (app, onUsage sink, budget guard, costRate). */\n  metering?: LLMClientOptions;\n  /**\n   * The AI plan gate (createAiGate, #101). When set, `chat` needs\n   * `context.user` (role, enterpriseId) and refuses with AiUnavailableError\n   * when the user's company has no AI. Leave unset on the public marketing\n   * site, which has no signed-in user.\n   */\n  aiGate?: AiGate;\n}\n\nfunction renderContext(mode: AssistantMode, context?: SupportContext): string {\n  const lines: string[] = [\n    `Mode: ${mode === \"marketing\" ? \"Public Marketing Site\" : \"Authenticated Portal\"}`,\n  ];\n  if (context?.page) lines.push(`Page: ${context.page}`);\n  if (context?.user?.name) lines.push(`User: ${context.user.name}`);\n  if (context?.user?.role) lines.push(`Role: ${context.user.role}`);\n  if (context?.user?.enterpriseId != null)\n    lines.push(`Enterprise ID: ${context.user.enterpriseId}`);\n  if (context?.extra) lines.push(context.extra);\n  return lines.join(\"\\n\");\n}\n\nexport function createSupportEngine(\n  env: CoreEnv,\n  options: SupportEngineOptions = {}\n) {\n  const invokeLLM = createLLMClient(env, {\n    ...options.metering,\n    ...(options.aiGate ? { aiGate: options.aiGate } : {}),\n  });\n  const retrieve = options.retrieve ?? createStaticRetriever();\n  const knowledgeLimit = options.knowledgeLimit ?? 4;\n\n  async function chat({\n    mode,\n    messages,\n    context,\n  }: ChatParams): Promise<ChatResult> {\n    // Defense in depth (marketing-site#269): ChatMessage.role is \"user\" |\n    // \"assistant\" only at the type level, but a caller sends JSON over HTTP,\n    // which TypeScript cannot enforce at runtime. Without this filter, a\n    // caller could inject its own \"system\" (or any other) role straight\n    // into the message list this engine sends the model, after its own\n    // system prompt below. Every consumer route should already validate\n    // this at the edge; this is the engine's own backstop regardless.\n    const safeMessages = messages.filter(\n      (m): m is ChatMessage => m?.role === \"user\" || m?.role === \"assistant\"\n    );\n    const lastUser = [...safeMessages].reverse().find(m => m.role === \"user\");\n    const query = lastUser?.content ?? \"\";\n\n    const items = await retrieve(query, { mode, limit: knowledgeLimit });\n    const knowledge = formatKnowledge(items);\n\n    const systemPrompt = buildSystemPrompt({\n      mode,\n      knowledge,\n      context: renderContext(mode, context),\n    });\n\n    const llmMessages: Message[] = [\n      { role: \"system\", content: systemPrompt },\n      ...safeMessages.map(m => ({ role: m.role, content: m.content })),\n    ];\n\n    const result = await invokeLLM({\n      messages: llmMessages,\n      meta: {\n        label: \"support-engine\",\n        mode,\n        page: context?.page,\n        user: context?.user\n          ? { role: context.user.role, enterpriseId: context.user.enterpriseId }\n          : undefined,\n      },\n    });\n    const raw = result.choices[0]?.message?.content;\n    const content = typeof raw === \"string\" ? raw : JSON.stringify(raw ?? \"\");\n\n    return { content };\n  }\n\n  return { chat };\n}\n\nexport type SupportEngine = ReturnType<typeof createSupportEngine>;\n","/**\n * Security response headers for every Oplytics Express app.\n *\n * Set once, at the top of the middleware chain (before any route), so every\n * response — API, SPA shell, static asset, redirect — carries them. Replaces\n * the \"no Helmet, no CSP, no HSTS at the app layer\" gap flagged in the\n * 2026-08 ISO 27001 gap analysis (RISK-09). Cloudflare sits in front but was\n * verified to inject none of these.\n *\n * Deliberately dependency-free — Helmet for a fixed set of static headers is\n * just `res.setHeader` calls, and core-server already keeps its dependency\n * surface at zero.\n *\n * The Content-Security-Policy is sent **report-only** by default: browsers\n * evaluate it and report violations but block nothing, so a too-tight policy\n * can't take the SPA down. Once the report stream is clean for a given app,\n * pass `cspMode: \"enforce\"` to switch it to a blocking policy.\n */\nimport type { Request, Response, NextFunction } from \"express\";\nimport {\n  isSandboxEnv,\n  PRODUCTION_PORTAL_ORIGIN,\n  sandboxPortalOrigin,\n} from \"./sandbox\";\n\nexport interface SecurityHeadersOptions {\n  /**\n   * Extra origins the app's browser code legitimately talks to, beyond the\n   * platform defaults (self, the Portal, Google Fonts). The Portal is\n   * https://portal.oplyticsdigital.net, or in the local sandbox\n   * (INFISICAL_ENV=staging) the app's PORTAL_LOGIN_URL origin, else\n   * http://localhost:3000 (#86). Used for\n   * `connect-src` / `img-src` / `script-src` as appropriate — e.g. an\n   * analytics endpoint or a CDN. Origins only (`https://host[:port]`).\n   */\n  extraConnectSrc?: string[];\n  extraImgSrc?: string[];\n  extraScriptSrc?: string[];\n  extraStyleSrc?: string[];\n  /**\n   * \"report-only\" (default) sends `Content-Security-Policy-Report-Only`;\n   * \"enforce\" sends a blocking `Content-Security-Policy`; \"off\" omits CSP\n   * entirely (the other headers still apply).\n   */\n  cspMode?: \"report-only\" | \"enforce\" | \"off\";\n  /**\n   * HSTS max-age in seconds. Default 180 days. Set 0 to omit the header\n   * (e.g. while still testing HTTPS). `includeSubDomains` is always set when\n   * the header is present; `preload` is opt-in via `hstsPreload`.\n   */\n  hstsMaxAge?: number;\n  hstsPreload?: boolean;\n}\n\nconst DAY = 86_400;\n\n/** Fonts + the shared portal API origin every app in the platform uses. */\nconst GOOGLE_FONTS_CSS = \"https://fonts.googleapis.com\";\nconst GOOGLE_FONTS_FILES = \"https://fonts.gstatic.com\";\n\nfunction buildCsp(\n  opts: SecurityHeadersOptions,\n  cspMode: \"report-only\" | \"enforce\"\n): string {\n  // The sandbox lists its own Portal instead of production's, so a sandbox\n  // page calling production shows up as a violation (#86, portal#261).\n  const portalOrigin = isSandboxEnv()\n    ? sandboxPortalOrigin()\n    : PRODUCTION_PORTAL_ORIGIN;\n  const connect = [\"'self'\", portalOrigin, ...(opts.extraConnectSrc ?? [])];\n  const img = [\"'self'\", \"data:\", \"blob:\", ...(opts.extraImgSrc ?? [])];\n  const script = [\"'self'\", ...(opts.extraScriptSrc ?? [])];\n  // Vite's runtime and several UI libs inject <style> tags at runtime, so\n  // style-src needs 'unsafe-inline'. This is low-risk (style injection can't\n  // exfiltrate) and is the standard trade-off for a bundled SPA.\n  const style = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    GOOGLE_FONTS_CSS,\n    ...(opts.extraStyleSrc ?? []),\n  ];\n  const font = [\"'self'\", GOOGLE_FONTS_FILES, \"data:\"];\n\n  const directives = [\n    \"default-src 'self'\",\n    `connect-src ${connect.join(\" \")}`,\n    `img-src ${img.join(\" \")}`,\n    `script-src ${script.join(\" \")}`,\n    `style-src ${style.join(\" \")}`,\n    `font-src ${font.join(\" \")}`,\n    \"object-src 'none'\",\n    \"base-uri 'self'\",\n    \"frame-ancestors 'none'\",\n    \"form-action 'self'\",\n  ];\n  // upgrade-insecure-requests is an ENFORCEMENT directive — per spec it has\n  // no effect when the policy is delivered report-only, and Chrome logs a\n  // console warning (\"...is ignored when delivered in a report-only\n  // policy\") on every single page load telling you exactly that. Fleet-wide\n  // since RISK-09 shipped, because every app currently runs the report-only\n  // default — caught via the nightly E2E's console-error assertion\n  // (oplytics-subdomains Action Manager, 2026-09-10). Only include it once\n  // the policy actually enforces.\n  if (cspMode === \"enforce\") directives.push(\"upgrade-insecure-requests\");\n\n  return directives.join(\"; \");\n}\n\n/**\n * Express middleware that stamps the platform security headers on every\n * response. Mount it before the body parser:\n *\n *   const app = express();\n *   app.use(securityHeaders({ extraScriptSrc: [ANALYTICS_ORIGIN] }));\n *   app.use(express.json());\n */\nexport function securityHeaders(opts: SecurityHeadersOptions = {}) {\n  const cspMode = opts.cspMode ?? \"report-only\";\n  const hstsMaxAge = opts.hstsMaxAge ?? 180 * DAY;\n  const csp = cspMode === \"off\" ? null : buildCsp(opts, cspMode);\n  const cspHeader =\n    cspMode === \"enforce\"\n      ? \"Content-Security-Policy\"\n      : \"Content-Security-Policy-Report-Only\";\n\n  return function securityHeadersMiddleware(\n    _req: Request,\n    res: Response,\n    next: NextFunction\n  ): void {\n    // Express advertises itself by default — remove the fingerprint.\n    res.removeHeader(\"X-Powered-By\");\n\n    res.setHeader(\"X-Content-Type-Options\", \"nosniff\");\n    res.setHeader(\"X-Frame-Options\", \"DENY\");\n    res.setHeader(\"Referrer-Policy\", \"strict-origin-when-cross-origin\");\n    res.setHeader(\"X-Permitted-Cross-Domain-Policies\", \"none\");\n    res.setHeader(\"Cross-Origin-Opener-Policy\", \"same-origin\");\n    res.setHeader(\"Cross-Origin-Resource-Policy\", \"same-site\");\n    res.setHeader(\n      \"Permissions-Policy\",\n      \"camera=(), microphone=(), geolocation=(), payment=()\"\n    );\n\n    if (hstsMaxAge > 0) {\n      const preload = opts.hstsPreload ? \"; preload\" : \"\";\n      res.setHeader(\n        \"Strict-Transport-Security\",\n        `max-age=${hstsMaxAge}; includeSubDomains${preload}`\n      );\n    }\n\n    if (csp) res.setHeader(cspHeader, csp);\n\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAAO,IAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,sBAAmD;AAAA,EAC9D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AACV;AACO,IAAM,sBAAmD;AAAA,EAC9D,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AACV;;;ACEO,IAAM,oBAAmC;AAAA,EAC9C,YAAY;AAAA;AAAA,EACZ,aAAa;AAAA;AACf;AA2CO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EAC/B,OAAO;AAAA,EAChB,YAAY,QAAgB;AAC1B,UAAM,MAAM;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,eAAe,MAAsB;AACnD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,KAAK,KAAK,SAAS,CAAC;AAClC;AAGO,SAAS,sBAAsB,UAA4B;AAChE,SAAO,SAAS,OAAO,CAAC,KAAK,MAAM,MAAM,eAAe,CAAC,GAAG,CAAC;AAC/D;AAGO,SAAS,eACd,cACA,kBACA,OAAsB,mBACd;AACR,QAAM,OACH,eAAe,MAAQ,KAAK,aAC5B,mBAAmB,MAAQ,KAAK;AAEnC,SAAO,KAAK,MAAM,OAAO,GAAG,IAAI;AAClC;;;AC2DO,IAAM,oBAAoB;AAY1B,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAWT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK;AACrB,SAAK,SAAS,KAAK;AACnB,SAAK,aAAa,KAAK;AACvB,SAAK,kBAAkB,KAAK;AAC5B,SAAK,eAAe,KAAK;AACzB,SAAK,oBAAoB,KAAK;AAC9B,SAAK,QAAQ,KAAK;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,oBAAoB,KAAK;AAAA,EAChC;AACF;AAGA,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,SAAS,UAAU,OAAgB,KAAa,QAAQ,GAAuB;AAC7E,MAAI,QAAQ,KAAK,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACpE,aAAW,CAAC,GAAG,KAAK,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACzE,QACE,IAAI,KAAK,CAAC,MACT,OAAO,UAAU,YAAY,OAAO,UAAU,WAC/C;AACA,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,UAAM,QAAQ,UAAU,OAAO,KAAK,QAAQ,CAAC;AAC7C,QAAI,MAAO,QAAO;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,UAAU,MAAuB;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,QAA2C;AACpE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,OAAO,KAAK,CAAC;AACpC,SAAO,OAAO,SAAS,OAAO,KAAK,WAAW,IAAI,UAAU;AAC9D;AAEA,IAAM,YAAY,oBAAI,IAAuB,CAAC,KAAK,GAAG,CAAC;AA2BvD,IAAM,cAAc,CAClB,UACsB,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAE7D,IAAM,uBAAuB,CAC3B,SAC6C;AAC7C,MAAI,OAAO,SAAS,UAAU;AAC5B,WAAO,EAAE,MAAM,QAAQ,MAAM,KAAK;AAAA,EACpC;AACA,MAAI,KAAK,SAAS,OAAQ,QAAO;AACjC,MAAI,KAAK,SAAS,YAAa,QAAO;AACtC,MAAI,KAAK,SAAS,WAAY,QAAO;AACrC,QAAM,IAAI,MAAM,kCAAkC;AACpD;AAEA,IAAM,mBAAmB,CAAC,YAAqB;AAC7C,QAAM,EAAE,MAAM,MAAM,aAAa,IAAI;AACrC,MAAI,SAAS,UAAU,SAAS,YAAY;AAC1C,UAAM,UAAU,YAAY,QAAQ,OAAO,EACxC,IAAI,UAAS,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI,CAAE,EACpE,KAAK,IAAI;AACZ,WAAO,EAAE,MAAM,MAAM,cAAc,QAAQ;AAAA,EAC7C;AACA,QAAM,eAAe,YAAY,QAAQ,OAAO,EAAE,IAAI,oBAAoB;AAC1E,MAAI,aAAa,WAAW,KAAK,aAAa,CAAC,EAAE,SAAS,QAAQ;AAChE,WAAO,EAAE,MAAM,MAAM,SAAS,aAAa,CAAC,EAAE,KAAK;AAAA,EACrD;AACA,SAAO,EAAE,MAAM,MAAM,SAAS,aAAa;AAC7C;AAEA,IAAM,sBAAsB,CAC1B,YACA,UACqD;AACrD,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,eAAe,UAAU,eAAe,OAAQ,QAAO;AAC3D,MAAI,eAAe,YAAY;AAC7B,QAAI,CAAC,SAAS,MAAM,WAAW,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,MAAM,YAAY,UAAU,EAAE,MAAM,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE;AAAA,EACxE;AACA,MAAI,UAAU,YAAY;AACxB,WAAO,EAAE,MAAM,YAAY,UAAU,EAAE,MAAM,WAAW,KAAK,EAAE;AAAA,EACjE;AACA,SAAO;AACT;AAEA,IAAM,0BAA0B,CAAC;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MASiB;AACf,QAAM,iBAAiB,kBAAkB;AACzC,MAAI,gBAAgB;AAClB,QACE,eAAe,SAAS,iBACxB,CAAC,eAAe,aAAa,QAC7B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,QAAQ;AAClC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,MACX,MAAM,OAAO;AAAA,MACb,QAAQ,OAAO;AAAA,MACf,GAAI,OAAO,OAAO,WAAW,YAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AACF;AAGA,SAAS,cAAc,SAA0B;AAC/C,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,WAAO,QACJ,IAAI,UAAQ;AACX,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,UAAI,QAAQ,OAAO,SAAS,YAAY,UAAU,MAAM;AACtD,eAAO,OAAQ,KAA4B,QAAQ,EAAE;AAAA,MACvD;AACA,aAAO;AAAA,IACT,CAAC,EACA,KAAK,GAAG;AAAA,EACb;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,KAAc,UAA4B,CAAC,GAAG;AAC5E,QAAM;AAAA,IACJ,MAAM;AAAA,IACN,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,OAAO,YAAY;AAAA,IACnB;AAAA,IACA;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,YAAY;AAAA,IACZ;AAAA,EACF,IAAI;AACJ,QAAM,WAA4B;AAGlC,QAAM,SAAS,CAAC,SACd,IAAI,eAAe,KAAK,MAAM,IAAI,YAAY,EAAE,KAAK,YAAY,IAAI;AAEvE,QAAM,gBAAgB,MACpB,IAAI,gBAAgB,IAAI,aAAa,KAAK,EAAE,SAAS,IACjD,GAAG,IAAI,aAAa,QAAQ,OAAO,EAAE,CAAC,sBACtC;AAEN,QAAM,eAAe,MAAM;AACzB,QAAI,CAAC,IAAI,cAAc;AACrB,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AAAA,EACF;AAEA,SAAO,eAAe,UAAU,QAA6C;AAC3E,iBAAa;AAEb,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,CAAC;AAAA,IACV,IAAI;AAGJ,QAAI,QAAQ;AACV,UAAI,CAAC,KAAK,MAAM;AACd,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,OAAO,gBAAgB,KAAK,IAAI;AAAA,IACxC;AAEA,UAAM,kBAAkB;AAAA,MACtB,SAAS,IAAI,OAAK,cAAc,EAAE,OAAO,CAAC;AAAA,IAC5C;AAGA,QAAI,OAAO;AACT,YAAM,UAAU,MAAM,MAAM,EAAE,KAAK,iBAAiB,GAAG,KAAK,CAAC;AAC7D,UAAI,CAAC,QAAQ,SAAS;AACpB,cAAM,IAAI;AAAA,UACR,QAAQ,UAAU;AAAA,QACpB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAmC;AAAA,MACvC,UAAU,SAAS,IAAI,gBAAgB;AAAA,IACzC;AAEA,QAAI,SAAS,MAAM,SAAS,GAAG;AAC7B,cAAQ,QAAQ;AAAA,IAClB;AAEA,UAAM,uBAAuB;AAAA,MAC3B,cAAc;AAAA,MACd;AAAA,IACF;AACA,QAAI,sBAAsB;AACxB,cAAQ,cAAc;AAAA,IACxB;AAEA,YAAQ,aAAa;AAErB,UAAM,2BAA2B,wBAAwB;AAAA,MACvD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,0BAA0B;AAC5B,cAAQ,kBAAkB;AAAA,IAC5B;AAEA,QAAI,WAAW;AAGf,UAAM,UAAU,OAAO,UAAyC;AAC9D;AACA,YAAM,UACJ,aAAa,YAAY,IAAI,YAAY,QAAQ,SAAS,IAAI;AAChE,UAAI;AACF,cAAM,WAAW,MAAM,UAAU,cAAc,GAAG;AAAA,UAChD,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,IAAI,YAAY;AAAA,UAC3C;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,UAC1C,QAAQ;AAAA,QACV,CAAC;AAED,YAAI,CAAC,SAAS,IAAI;AAChB,gBAAM,YAAY,MAAM,SAAS,KAAK;AACtC,gBAAM,OAAO,UAAU,SAAS;AAChC,gBAAM,kBAAkB;AAAA,aACrB,SAAS,SACN,UAAU,MAAM,WAAW,IAC3B,UAAU,KAAK,MAAM;AAAA,UAC3B,EAAE,MAAM,GAAG,GAAG;AACd,gBAAM,IAAI,iBAAiB;AAAA;AAAA,YAEzB,SAAS;AAAA,cACP,sBAAsB,SAAS,MAAM,IAAI,SAAS,UAAU,WAAM,SAAS;AAAA,YAC7E;AAAA,YACA;AAAA,YACA,QAAQ,SAAS;AAAA,YACjB,YAAY,SAAS,cAAc;AAAA,YACnC,iBAAiB,mBAAmB;AAAA,YACpC,cACE,SAAS,SAAY,UAAU,MAAM,UAAU,IAAI;AAAA,YACrD,mBACE,mBAAmB,IAAI,OAAK,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE;AAAA,cACnD;AAAA,YACF,MACC,SAAS,SACN,UAAU,MAAM,4BAA4B,IAC5C,WACJ;AAAA,YACF;AAAA,YACA;AAAA,YACA,mBAAmB;AAAA,cACjB,SAAS,QAAQ,IAAI,aAAa;AAAA,YACpC;AAAA,UACF,CAAC;AAAA,QACH;AAEA,eAAQ,MAAM,SAAS,KAAK;AAAA,MAC9B,SAAS,KAAK;AACZ,YAAI,eAAe,iBAAkB,OAAM;AAC3C,YAAI,SAAS,SAAS;AACpB,gBAAM,IAAI,iBAAiB;AAAA,YACzB,SAAS,oDAA+C,QAAQ,KAAK,KAAK,YAAY,SAAS;AAAA,YAC/F;AAAA,YACA,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,UAAM,cAAc,OAClB,OACA,WAC0B;AAC1B,eAAS,IAAI,KAAK,KAAK;AACrB,YAAI;AACF,iBAAO,MAAM,QAAQ,KAAK;AAAA,QAC5B,SAAS,KAAK;AACZ,cACE,eAAe,oBACf,UAAU,IAAI,IAAI,MAAM,KACxB,IAAI,OAAO,QACX;AACA,kBAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,OAAO,CAAC,CAAC,CAAC;AAC3D;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,YAAY;AAChB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,WAAW,aAAa;AAAA,IACrD,SAAS,KAAK;AAEZ,UACE,CAAC,iBACD,EAAE,eAAe,qBACjB,IAAI,WAAW,KACf;AACA,cAAM;AAAA,MACR;AACA,kBAAY;AACZ,eAAS,MAAM,QAAQ,aAAa;AAAA,IACtC;AAGA,QAAI,SAAS;AACX,UAAI;AACF,cAAM,WAAW,OAAO;AACxB,cAAM,YAAY,CAAC;AACnB,cAAM,eAAe,UAAU,iBAAiB;AAChD,cAAM,mBACJ,UAAU,qBACV,eAAe,cAAc,OAAO,UAAU,CAAC,GAAG,SAAS,OAAO,CAAC;AACrE,cAAM,cACJ,UAAU,gBAAgB,eAAe;AAE3C,cAAM,QAAoB;AAAA,UACxB;AAAA,UACA,OAAO,OAAO,SAAS;AAAA,UACvB;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY,eAAe,cAAc,kBAAkB,QAAQ;AAAA,UACnE;AAAA,UACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,UAC3B,GAAG;AAAA,QACL;AAEA,cAAM,QAAQ,KAAK;AAAA,MACrB,SAAS,KAAK;AAEZ,gBAAQ,KAAK,sCAAsC,GAAG;AAAA,MACxD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACtkBO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EAET,YACE,QACA,SACA,cACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,eAAe;AAAA,EACtB;AACF;AA2BA,SAAS,eAAe,QAAoD;AAC1E,QAAM,MAAM,QAAQ;AACpB,QAAM,KACJ,OAAO,QAAQ,WACX,MACA,OAAO,QAAQ,YAAY,QAAQ,KAAK,IAAI,KAAK,CAAC,IAChD,OAAO,IAAI,KAAK,CAAC,IACjB;AACR,SAAO,OAAO,cAAc,EAAE,KAAK,KAAK,IAAI,KAAK;AACnD;AAEA,IAAM,UAA0B,EAAE,WAAW,MAAM,SAAS,KAAK;AAE1D,SAAS,aAAa,QAA8B;AACzD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,EACb,IAAI;AACJ,QAAM,aAAa,QAAQ,gBAAgB,YAAY;AACvD,QAAM,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,CAAC;AAE9C,QAAM,QAAQ,oBAAI,IAAoD;AACtE,QAAM,WAAW,oBAAI,IAAqC;AAC1D,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,WAAW,CAAC,KAAa,YAAoB;AACjD,QAAI,OAAO,IAAI,GAAG,EAAG;AACrB,WAAO,IAAI,GAAG;AACd,YAAQ,KAAK,wBAAwB,OAAO,EAAE;AAAA,EAChD;AAEA,iBAAe,IACb,cACA,MACyB;AACzB,QAAI,CAAC,YAAY;AACf;AAAA,QACE;AAAA,QACA;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB,OAAO,GAAG,GAAG,SAAS,mBAAmB,IAAI,CAAC,KAAK;AAAA,QACnD;AAAA,UACE,SAAS;AAAA,YACP,iBAAiB;AAAA,YACjB,GAAI,iBAAiB,OACjB,EAAE,mBAAmB,OAAO,YAAY,EAAE,IAC1C,CAAC;AAAA,UACP;AAAA,UACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,QACvC;AAAA,MACF;AACA,UAAI,IAAI,WAAW,KAAK;AACtB;AAAA,UACE;AAAA,UACA;AAAA,QACF;AACA,eAAO;AAAA,MACT;AACA,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,wCAAwC,IAAI,MAAM,gBAAgB,gBAAgB,GAAG;AAAA,QACvF;AACA,eAAO;AAAA,MACT;AACA,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAK/C,UAAI,MAAM,cAAc,KAAM,QAAO,EAAE,WAAW,KAAK;AACvD,UAAI,MAAM,cAAc,SAAS,OAAO,KAAK,YAAY,UAAU;AACjE,eAAO;AAAA,UACL,WAAW;AAAA,UACX,QAAQ,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;AAAA,UACxD,SAAS,KAAK;AAAA,QAChB;AAAA,MACF;AACA,cAAQ;AAAA,QACN,8CAA8C,gBAAgB,GAAG;AAAA,MACnE;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,wDAAwD,gBAAgB,GAAG,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAClI;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,iBAAe,MACb,QACyB;AACzB,UAAM,eAAe,eAAe,MAAM;AAC1C,UAAM,OAAO,QAAQ,QAAQ;AAE7B,UAAM,MAAM,GAAG,gBAAgB,GAAG,IAAI,SAAS,mBAAmB,OAAO,MAAM;AAE/E,UAAM,MAAM,MAAM,IAAI,GAAG;AACzB,QAAI,OAAO,IAAI,IAAI,IAAI,KAAK,WAAY,QAAO,IAAI;AAEnD,QAAI,UAAU,SAAS,IAAI,GAAG;AAC9B,QAAI,CAAC,SAAS;AACZ,gBAAU,IAAI,cAAc,IAAI,EAC7B,KAAK,YAAU;AACd,YAAI,aAAa,EAAG,OAAM,IAAI,KAAK,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;AACxD,eAAO;AAAA,MACT,CAAC,EACA,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC;AACrC,eAAS,IAAI,KAAK,OAAO;AAAA,IAC3B;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBACb,QACe;AACf,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,QACP,eAAe,MAAM;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,WAAS,WAAW,cAA6B;AAC/C,QAAI,iBAAiB,QAAW;AAC9B,YAAM,MAAM;AACZ;AAAA,IACF;AACA,eAAW,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG;AACnC,UAAI,IAAI,WAAW,GAAG,YAAY,GAAG,EAAG,OAAM,OAAO,GAAG;AAAA,IAC1D;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,iBAAiB,WAAW;AAC9C;;;AC3NA,IAAM,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASnB,KAAK;AAYA,IAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBrC,KAAK;AAGP,IAAM,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxB,KAAK;AAGP,IAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,KAAK;AAEP,IAAM,WAA0C;AAAA,EAC9C,WAAW;AAAA,EACX,aAAa;AACf;AAiBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA,kBAAkB,uBAAuB;AAC3C,GAAoC;AAGlC,QAAM,WAAW,CAAC,cAAc,SAAS,IAAI,GAAG,uBAAuB,EAAE;AAAA,IACvE,OAAK,EAAE,WAAW,6BAA6B,eAAe;AAAA,EAChE;AAEA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,aAAS,KAAK;AAAA,EAAiC,UAAU,KAAK,CAAC,EAAE;AAAA,EACnE;AAEA,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,aAAS,KAAK;AAAA,EAAqB,QAAQ,KAAK,CAAC,EAAE;AAAA,EACrD;AAEA,SAAO,SAAS,KAAK,MAAM;AAC7B;;;AC7EO,IAAM,YAA6B;AAAA;AAAA,EAExC;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,cAAc,YAAY,aAAa,WAAW,QAAQ,KAAK;AAAA,EACxE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,UAAU,WAAW,UAAU,UAAU,SAAS,QAAQ;AAAA,EACnE;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,UAAU,SAAS,YAAY,UAAU,MAAM;AAAA,EAC/D;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,eAAe,UAAU,OAAO,QAAQ,SAAS;AAAA,EACjE;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,OAAO,aAAa,QAAQ,OAAO,SAAS,KAAK;AAAA,EAC1D;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,WAAW,SAAS,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAAA,IACjE,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,QAAQ,SAAS,WAAW,WAAW,SAAS,OAAO;AAAA,IAC9D,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,QAAQ,SAAS,OAAO,QAAQ,OAAO,MAAM;AAAA,IACpD,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,WAAW,SAAS,SAAS,SAAS,QAAQ,OAAO;AAAA,IAC5D,OAAO,CAAC,WAAW;AAAA,EACrB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,QACE;AAAA,IACF,MAAM,CAAC,SAAS,WAAW,cAAc,SAAS,SAAS,OAAO;AAAA,EACpE;AACF;AAGA,SAAS,SAAS,MAAwB;AACxC,UAAQ,KAAK,YAAY,EAAE,MAAM,YAAY,KAAK,CAAC,GAAG;AAAA,IACpD,OAAK,EAAE,UAAU;AAAA,EACnB;AACF;AAGA,SAAS,UAAU,MAAqB,aAA+B;AACrE,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,WAAW,SAAS,GAAG,KAAK,QAAQ,IAAI,KAAK,MAAM,EAAE;AAC3D,MAAI,QAAQ;AACZ,aAAW,SAAS,aAAa;AAC/B,QAAI,KAAK,KAAK,SAAS,KAAK,EAAG,UAAS;AACxC,QAAI,SAAS,SAAS,KAAK,EAAG,UAAS;AAAA,EACzC;AACA,SAAO;AACT;AAMO,SAAS,sBACd,YAA6B,WAClB;AACX,SAAO,CAAC,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM;AACrC,UAAM,cAAc,SAAS,KAAK;AAClC,UAAM,WAAW,UAAU,OAAO,OAAK,CAAC,EAAE,SAAS,EAAE,MAAM,SAAS,IAAI,CAAC;AAEzE,UAAM,SAAS,SACZ,IAAI,WAAS,EAAE,MAAM,OAAO,UAAU,MAAM,WAAW,EAAE,EAAE,EAC3D,OAAO,OAAK,EAAE,QAAQ,CAAC,EACvB,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,MAAM,GAAG,KAAK,EACd,IAAI,OAAK,EAAE,IAAI;AAIlB,QAAI,OAAO,WAAW,EAAG,QAAO,SAAS,MAAM,GAAG,KAAK;AACvD,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAgC;AAC9D,SAAO,MAAM,IAAI,OAAK,MAAM,EAAE,QAAQ;AAAA,KAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,MAAM;AACvE;;;ACxVA,SAAS,cAAc,MAAqB,SAAkC;AAC5E,QAAM,QAAkB;AAAA,IACtB,SAAS,SAAS,cAAc,0BAA0B,sBAAsB;AAAA,EAClF;AACA,MAAI,SAAS,KAAM,OAAM,KAAK,SAAS,QAAQ,IAAI,EAAE;AACrD,MAAI,SAAS,MAAM,KAAM,OAAM,KAAK,SAAS,QAAQ,KAAK,IAAI,EAAE;AAChE,MAAI,SAAS,MAAM,KAAM,OAAM,KAAK,SAAS,QAAQ,KAAK,IAAI,EAAE;AAChE,MAAI,SAAS,MAAM,gBAAgB;AACjC,UAAM,KAAK,kBAAkB,QAAQ,KAAK,YAAY,EAAE;AAC1D,MAAI,SAAS,MAAO,OAAM,KAAK,QAAQ,KAAK;AAC5C,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,oBACd,KACA,UAAgC,CAAC,GACjC;AACA,QAAM,YAAY,gBAAgB,KAAK;AAAA,IACrC,GAAG,QAAQ;AAAA,IACX,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY,sBAAsB;AAC3D,QAAM,iBAAiB,QAAQ,kBAAkB;AAEjD,iBAAe,KAAK;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAoC;AAQlC,UAAM,eAAe,SAAS;AAAA,MAC5B,CAAC,MAAwB,GAAG,SAAS,UAAU,GAAG,SAAS;AAAA,IAC7D;AACA,UAAM,WAAW,CAAC,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,OAAK,EAAE,SAAS,MAAM;AACxE,UAAM,QAAQ,UAAU,WAAW;AAEnC,UAAM,QAAQ,MAAM,SAAS,OAAO,EAAE,MAAM,OAAO,eAAe,CAAC;AACnE,UAAM,YAAY,gBAAgB,KAAK;AAEvC,UAAM,eAAe,kBAAkB;AAAA,MACrC;AAAA,MACA;AAAA,MACA,SAAS,cAAc,MAAM,OAAO;AAAA,IACtC,CAAC;AAED,UAAM,cAAyB;AAAA,MAC7B,EAAE,MAAM,UAAU,SAAS,aAAa;AAAA,MACxC,GAAG,aAAa,IAAI,QAAM,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,EAAE;AAAA,IACjE;AAEA,UAAM,SAAS,MAAM,UAAU;AAAA,MAC7B,UAAU;AAAA,MACV,MAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA,MAAM,SAAS;AAAA,QACf,MAAM,SAAS,OACX,EAAE,MAAM,QAAQ,KAAK,MAAM,cAAc,QAAQ,KAAK,aAAa,IACnE;AAAA,MACN;AAAA,IACF,CAAC;AACD,UAAM,MAAM,OAAO,QAAQ,CAAC,GAAG,SAAS;AACxC,UAAM,UAAU,OAAO,QAAQ,WAAW,MAAM,KAAK,UAAU,OAAO,EAAE;AAExE,WAAO,EAAE,QAAQ;AAAA,EACnB;AAEA,SAAO,EAAE,KAAK;AAChB;;;ACpFA,IAAM,MAAM;AAGZ,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAE3B,SAAS,SACP,MACA,SACQ;AAGR,QAAM,eAAe,aAAa,IAC9B,oBAAoB,IACpB;AACJ,QAAM,UAAU,CAAC,UAAU,cAAc,GAAI,KAAK,mBAAmB,CAAC,CAAE;AACxE,QAAM,MAAM,CAAC,UAAU,SAAS,SAAS,GAAI,KAAK,eAAe,CAAC,CAAE;AACpE,QAAM,SAAS,CAAC,UAAU,GAAI,KAAK,kBAAkB,CAAC,CAAE;AAIxD,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,KAAK,iBAAiB,CAAC;AAAA,EAC7B;AACA,QAAM,OAAO,CAAC,UAAU,oBAAoB,OAAO;AAEnD,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,eAAe,QAAQ,KAAK,GAAG,CAAC;AAAA,IAChC,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA,IACxB,cAAc,OAAO,KAAK,GAAG,CAAC;AAAA,IAC9B,aAAa,MAAM,KAAK,GAAG,CAAC;AAAA,IAC5B,YAAY,KAAK,KAAK,GAAG,CAAC;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AASA,MAAI,YAAY,UAAW,YAAW,KAAK,2BAA2B;AAEtE,SAAO,WAAW,KAAK,IAAI;AAC7B;AAUO,SAAS,gBAAgB,OAA+B,CAAC,GAAG;AACjE,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,aAAa,KAAK,cAAc,MAAM;AAC5C,QAAM,MAAM,YAAY,QAAQ,OAAO,SAAS,MAAM,OAAO;AAC7D,QAAM,YACJ,YAAY,YACR,4BACA;AAEN,SAAO,SAAS,0BACd,MACA,KACA,MACM;AAEN,QAAI,aAAa,cAAc;AAE/B,QAAI,UAAU,0BAA0B,SAAS;AACjD,QAAI,UAAU,mBAAmB,MAAM;AACvC,QAAI,UAAU,mBAAmB,iCAAiC;AAClE,QAAI,UAAU,qCAAqC,MAAM;AACzD,QAAI,UAAU,8BAA8B,aAAa;AACzD,QAAI,UAAU,gCAAgC,WAAW;AACzD,QAAI;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAEA,QAAI,aAAa,GAAG;AAClB,YAAM,UAAU,KAAK,cAAc,cAAc;AACjD,UAAI;AAAA,QACF;AAAA,QACA,WAAW,UAAU,sBAAsB,OAAO;AAAA,MACpD;AAAA,IACF;AAEA,QAAI,IAAK,KAAI,UAAU,WAAW,GAAG;AAErC,SAAK;AAAA,EACP;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pablo2410/core-server",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Shared server utilities for Oplytics.digital subdomains",
   "type": "module",
   "exports": {
@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@pablo2410/shared-ui": "^0.30.0",
+    "@pablo2410/shared-ui": "^0.32.0",
     "@types/express": "^5.0.6",
     "@types/node": "26.6.5",
     "axios": "^1.20.0",
@@ -49,7 +49,7 @@
     "eslint": "^10.13.0",
     "express": "^5.3.0",
     "globals": "^17.13.0",
-    "jose": "^6.2.12",
+    "jose": "^6.2.13",
     "prettier": "^3.9.10",
     "tsup": "^9.0.0",
     "typescript": "^5.6.0",
@@ -83,7 +83,8 @@
   },
   "pnpm": {
     "overrides": {
-      "esbuild": "^0.28.1"
+      "esbuild": "^0.28.1",
+      "follow-redirects": ">=1.16.1"
     }
   }
 }

package/dist/chunk-NSTH36LS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/hierarchy.ts"],"sourcesContent":["/**\n * Hierarchy Service — the single server-side source for org-hierarchy data.\n *\n * Fetches the canonical org-hierarchy from the Portal Service API\n * (GET /api/service/hierarchy, authenticated with the service key), naming the\n * caller's company with X-Enterprise-Id (#91, as Policy Deployment does since\n * PD#313). Caches it per company with a TTL, and scopes it to that company with\n * the shared isolation rule (scopeHierarchyToEnterprise from\n * @pablo2410/shared-ui) on every read, as a second check.\n *\n * One fetch, one mapper, one cache, one scope policy. Every subdomain constructs\n * this once from its env and calls getScopedHierarchy(ctx.user) in its tRPC\n * `hierarchy` procedure — no per-app fetch/scope/null-policy reinvention.\n *\n * Quick example:\n *   const hierarchy = createHierarchyService({\n *     portalApiUrl: process.env.PORTAL_API_URL ?? \"\",\n *     portalApiKey: process.env.PORTAL_API_KEY ?? \"\",\n *   });\n *   // in a tRPC router:\n *   hierarchy: protectedProcedure.query(({ ctx }) => hierarchy.getScopedHierarchy(ctx.user)),\n */\nimport type { OrgHierarchyData } from \"@pablo2410/shared-ui/hierarchy/core\";\nimport { scopeHierarchyToEnterprise } from \"@pablo2410/shared-ui/hierarchy/core\";\n\nexport interface HierarchyServiceConfig {\n  /** Portal Service API base URL, e.g. https://portal.oplyticsdigital.net */\n  portalApiUrl: string;\n  /** Platform-level X-Service-Key for the Portal Service API. */\n  portalApiKey: string;\n  /** Cache TTL in milliseconds. Default 15 minutes. Set 0 to disable caching. */\n  cacheTtlMs?: number;\n  /** Injectable fetch implementation (for tests). Defaults to global fetch. */\n  fetchImpl?: typeof fetch;\n  /** Injectable clock (for tests). Defaults to Date.now. */\n  now?: () => number;\n}\n\nexport interface HierarchyService {\n  /**\n   * The org-hierarchy scoped to the caller's enterprise, fetched with\n   * `X-Enterprise-Id: <enterpriseId>` and cached per enterprise. A user with no\n   * resolved enterprise (null/undefined, or not a positive whole number)\n   * receives an empty hierarchy without a Portal call — see\n   * scopeHierarchyToEnterprise for the policy. Never returns null.\n   */\n  getScopedHierarchy(\n    user: { enterpriseId?: number | null } | null\n  ): Promise<OrgHierarchyData>;\n  /**\n   * The full, unscoped hierarchy (every enterprise). For Portal/admin tooling\n   * only — subdomains must use getScopedHierarchy. It names no company, so the\n   * Portal may refuse it with the master key once un-named company reads are\n   * refused (subdomains#1037). null if unconfigured/unreachable.\n   */\n  getFullHierarchy(): Promise<OrgHierarchyData | null>;\n  /** Clear one enterprise's cache, or every cache with no argument. */\n  invalidate(enterpriseId?: number): void;\n  /** Config + cache status, for health endpoints. */\n  getStatus(): {\n    configured: boolean;\n    /** Whether anything is cached (any enterprise, or the full tree). */\n    cached: boolean;\n    /** Age of the oldest cached entry, in ms. */\n    ageMs: number | null;\n    /** How many enterprises have a cached hierarchy. */\n    cachedEnterprises: number;\n    /** Reason the last fetch failed (null if the last fetch succeeded). */\n    lastError: string | null;\n  };\n}\n\nconst FIFTEEN_MINUTES = 15 * 60 * 1000;\n\ntype CacheEntry = { data: OrgHierarchyData; at: number };\n\n/** The caller's enterprise if it is a positive whole number, else null. */\nfunction enterpriseIdOf(\n  user: { enterpriseId?: number | null } | null\n): number | null {\n  const id = user?.enterpriseId;\n  return typeof id === \"number\" && Number.isSafeInteger(id) && id > 0\n    ? id\n    : null;\n}\n\nexport function createHierarchyService(\n  config: HierarchyServiceConfig\n): HierarchyService {\n  const {\n    portalApiUrl,\n    portalApiKey,\n    cacheTtlMs = FIFTEEN_MINUTES,\n    fetchImpl = fetch,\n    now = Date.now,\n  } = config;\n\n  const configured = Boolean(portalApiUrl && portalApiKey);\n  // One cache per company, holding only that company's slice, so one\n  // company's hierarchy can never be served to another (#91).\n  const scopedCache = new Map<number, CacheEntry>();\n  let fullCache: CacheEntry | null = null;\n  const isFresh = (entry: CacheEntry | null | undefined): entry is CacheEntry =>\n    cacheTtlMs > 0 && !!entry && now() - entry.at < cacheTtlMs;\n  // Last fetch failure reason, surfaced via getStatus() for diagnostics. A\n  // configured service that returns an empty hierarchy is almost always a fetch\n  // failure (wrong URL/key, unreachable Portal, non-200) — without this it was\n  // swallowed to a silent null and looked like \"enterprise has no data\".\n  let lastError: string | null = null;\n\n  async function fetchRaw(\n    enterpriseId?: number\n  ): Promise<OrgHierarchyData | null> {\n    if (!configured) {\n      lastError = \"not configured (PORTAL_API_URL/PORTAL_API_KEY missing)\";\n      return null;\n    }\n    const url = `${portalApiUrl.replace(/\\/$/, \"\")}/api/service/hierarchy`;\n    let res: Response;\n    try {\n      res = await fetchImpl(url, {\n        headers: {\n          \"X-Service-Key\": portalApiKey,\n          \"Content-Type\": \"application/json\",\n          // Names the caller's company (portal#348).\n          ...(enterpriseId !== undefined\n            ? { \"X-Enterprise-Id\": String(enterpriseId) }\n            : {}),\n        },\n      });\n    } catch (err) {\n      lastError = `fetch threw: ${err instanceof Error ? err.message : String(err)}`;\n      console.error(`[HierarchyService] ${lastError} (url=${url})`);\n      return null;\n    }\n    if (!res.ok) {\n      lastError = `HTTP ${res.status} ${res.statusText} from ${url}`;\n      console.error(`[HierarchyService] ${lastError}`);\n      return null;\n    }\n    const json = await res.json().catch(() => null);\n    if (!json) {\n      lastError = `invalid/empty JSON body from ${url}`;\n      console.error(`[HierarchyService] ${lastError}`);\n      return null;\n    }\n    lastError = null;\n    return normalize(json);\n  }\n\n  async function getFullHierarchy(): Promise<OrgHierarchyData | null> {\n    if (isFresh(fullCache)) return fullCache.data;\n    const data = await fetchRaw();\n    if (data && cacheTtlMs > 0) fullCache = { data, at: now() };\n    return data;\n  }\n\n  async function getScopedHierarchy(\n    user: { enterpriseId?: number | null } | null\n  ): Promise<OrgHierarchyData> {\n    const enterpriseId = enterpriseIdOf(user);\n    // No company: nothing to show, and nothing to ask the Portal for.\n    if (enterpriseId === null) return scopeHierarchyToEnterprise(null, null);\n\n    let entry = scopedCache.get(enterpriseId);\n    if (!isFresh(entry)) {\n      const raw = await fetchRaw(enterpriseId);\n      if (!raw) return scopeHierarchyToEnterprise(null, enterpriseId);\n      // Keep only this company's slice: today's Portal ignores the header on\n      // /hierarchy and returns every company.\n      entry = {\n        data: scopeHierarchyToEnterprise(raw, enterpriseId),\n        at: now(),\n      };\n      if (cacheTtlMs > 0) scopedCache.set(enterpriseId, entry);\n    }\n    // Scoped again on every read: a fresh copy per caller, and the isolation\n    // rule stays the last word whatever the Portal returned.\n    return scopeHierarchyToEnterprise(entry.data, enterpriseId);\n  }\n\n  function invalidate(enterpriseId?: number): void {\n    if (enterpriseId !== undefined) {\n      scopedCache.delete(enterpriseId);\n      return;\n    }\n    scopedCache.clear();\n    fullCache = null;\n  }\n\n  function getStatus() {\n    const ats = [...scopedCache.values()].map(e => e.at);\n    if (fullCache) ats.push(fullCache.at);\n    return {\n      configured,\n      cached: ats.length > 0,\n      ageMs: ats.length > 0 ? now() - Math.min(...ats) : null,\n      cachedEnterprises: scopedCache.size,\n      lastError,\n    };\n  }\n\n  return { getScopedHierarchy, getFullHierarchy, invalidate, getStatus };\n}\n\n/**\n * Map the Portal Service API response to the canonical OrgHierarchyData shape.\n * Tolerant of missing arrays (defaults to []) so a partial payload never throws.\n */\nfunction normalize(data: unknown): OrgHierarchyData {\n  const d = (data ?? {}) as Record<string, any[]>;\n  return {\n    enterprises: (d.enterprises ?? []).map(e => ({\n      id: e.id,\n      name: e.name,\n      code: e.code,\n    })),\n    businessUnits: (d.businessUnits ?? []).map(bu => ({\n      id: bu.id,\n      name: bu.name,\n      code: bu.code,\n      enterpriseId: bu.enterpriseId,\n    })),\n    sites: (d.sites ?? []).map(s => ({\n      id: s.id,\n      name: s.name,\n      code: s.code,\n      enterpriseId: s.enterpriseId,\n      businessUnitId: s.businessUnitId ?? 0,\n      location: s.location,\n    })),\n    areas: (d.areas ?? []).map(a => ({\n      id: a.id,\n      name: a.name,\n      code: a.code,\n      siteId: a.siteId,\n    })),\n    assets: (d.assets ?? []).map(a => ({\n      id: a.id,\n      name: a.name,\n      code: a.code,\n      siteId: a.siteId,\n      areaId: a.areaId ?? 0,\n      assetType: a.assetType,\n    })),\n  };\n}\n"],"mappings":";AAuBA,SAAS,kCAAkC;AAiD3C,IAAM,kBAAkB,KAAK,KAAK;AAKlC,SAAS,eACP,MACe;AACf,QAAM,KAAK,MAAM;AACjB,SAAO,OAAO,OAAO,YAAY,OAAO,cAAc,EAAE,KAAK,KAAK,IAC9D,KACA;AACN;AAEO,SAAS,uBACd,QACkB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,MAAM,KAAK;AAAA,EACb,IAAI;AAEJ,QAAM,aAAa,QAAQ,gBAAgB,YAAY;AAGvD,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,YAA+B;AACnC,QAAM,UAAU,CAAC,UACf,aAAa,KAAK,CAAC,CAAC,SAAS,IAAI,IAAI,MAAM,KAAK;AAKlD,MAAI,YAA2B;AAE/B,iBAAe,SACb,cACkC;AAClC,QAAI,CAAC,YAAY;AACf,kBAAY;AACZ,aAAO;AAAA,IACT;AACA,UAAM,MAAM,GAAG,aAAa,QAAQ,OAAO,EAAE,CAAC;AAC9C,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,UAAU,KAAK;AAAA,QACzB,SAAS;AAAA,UACP,iBAAiB;AAAA,UACjB,gBAAgB;AAAA;AAAA,UAEhB,GAAI,iBAAiB,SACjB,EAAE,mBAAmB,OAAO,YAAY,EAAE,IAC1C,CAAC;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,kBAAY,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC5E,cAAQ,MAAM,sBAAsB,SAAS,SAAS,GAAG,GAAG;AAC5D,aAAO;AAAA,IACT;AACA,QAAI,CAAC,IAAI,IAAI;AACX,kBAAY,QAAQ,IAAI,MAAM,IAAI,IAAI,UAAU,SAAS,GAAG;AAC5D,cAAQ,MAAM,sBAAsB,SAAS,EAAE;AAC/C,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAI,CAAC,MAAM;AACT,kBAAY,gCAAgC,GAAG;AAC/C,cAAQ,MAAM,sBAAsB,SAAS,EAAE;AAC/C,aAAO;AAAA,IACT;AACA,gBAAY;AACZ,WAAO,UAAU,IAAI;AAAA,EACvB;AAEA,iBAAe,mBAAqD;AAClE,QAAI,QAAQ,SAAS,EAAG,QAAO,UAAU;AACzC,UAAM,OAAO,MAAM,SAAS;AAC5B,QAAI,QAAQ,aAAa,EAAG,aAAY,EAAE,MAAM,IAAI,IAAI,EAAE;AAC1D,WAAO;AAAA,EACT;AAEA,iBAAe,mBACb,MAC2B;AAC3B,UAAM,eAAe,eAAe,IAAI;AAExC,QAAI,iBAAiB,KAAM,QAAO,2BAA2B,MAAM,IAAI;AAEvE,QAAI,QAAQ,YAAY,IAAI,YAAY;AACxC,QAAI,CAAC,QAAQ,KAAK,GAAG;AACnB,YAAM,MAAM,MAAM,SAAS,YAAY;AACvC,UAAI,CAAC,IAAK,QAAO,2BAA2B,MAAM,YAAY;AAG9D,cAAQ;AAAA,QACN,MAAM,2BAA2B,KAAK,YAAY;AAAA,QAClD,IAAI,IAAI;AAAA,MACV;AACA,UAAI,aAAa,EAAG,aAAY,IAAI,cAAc,KAAK;AAAA,IACzD;AAGA,WAAO,2BAA2B,MAAM,MAAM,YAAY;AAAA,EAC5D;AAEA,WAAS,WAAW,cAA6B;AAC/C,QAAI,iBAAiB,QAAW;AAC9B,kBAAY,OAAO,YAAY;AAC/B;AAAA,IACF;AACA,gBAAY,MAAM;AAClB,gBAAY;AAAA,EACd;AAEA,WAAS,YAAY;AACnB,UAAM,MAAM,CAAC,GAAG,YAAY,OAAO,CAAC,EAAE,IAAI,OAAK,EAAE,EAAE;AACnD,QAAI,UAAW,KAAI,KAAK,UAAU,EAAE;AACpC,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,IAAI,SAAS;AAAA,MACrB,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,IAAI;AAAA,MACnD,mBAAmB,YAAY;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoB,kBAAkB,YAAY,UAAU;AACvE;AAMA,SAAS,UAAU,MAAiC;AAClD,QAAM,IAAK,QAAQ,CAAC;AACpB,SAAO;AAAA,IACL,cAAc,EAAE,eAAe,CAAC,GAAG,IAAI,QAAM;AAAA,MAC3C,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,IACV,EAAE;AAAA,IACF,gBAAgB,EAAE,iBAAiB,CAAC,GAAG,IAAI,SAAO;AAAA,MAChD,IAAI,GAAG;AAAA,MACP,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,cAAc,GAAG;AAAA,IACnB,EAAE;AAAA,IACF,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,MAC/B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,cAAc,EAAE;AAAA,MAChB,gBAAgB,EAAE,kBAAkB;AAAA,MACpC,UAAU,EAAE;AAAA,IACd,EAAE;AAAA,IACF,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,MAC/B,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,IACZ,EAAE;AAAA,IACF,SAAS,EAAE,UAAU,CAAC,GAAG,IAAI,QAAM;AAAA,MACjC,IAAI,EAAE;AAAA,MACN,MAAM,EAAE;AAAA,MACR,MAAM,EAAE;AAAA,MACR,QAAQ,EAAE;AAAA,MACV,QAAQ,EAAE,UAAU;AAAA,MACpB,WAAW,EAAE;AAAA,IACf,EAAE;AAAA,EACJ;AACF;","names":[]}