@panguard-ai/threat-cloud 1.5.5 → 1.6.0

package/dist/migrations.js

@@ -342,6 +342,96 @@ export const migrations = [
          ON migrator_telemetry(condition_hash, install_id, created_at)`);
         },
     },
+    {
+        version: 14,
+        name: 'add_client_key_tier_column',
+        up: (db) => {
+            // Workspace tier per client key. Drives the per-token rate limiter:
+            //   community = 120 req/min, pilot = 1200, enterprise = 12000.
+            // Existing rows backfill to 'community' (the safest default — anything
+            // already in production keeps the baseline budget until an admin
+            // explicitly upgrades it via POST /api/admin/client-keys/:clientId/tier).
+            const cols = db.prepare('PRAGMA table_info(client_keys)').all();
+            if (!cols.some((c) => c.name === 'tier')) {
+                db.exec("ALTER TABLE client_keys ADD COLUMN tier TEXT NOT NULL DEFAULT 'community'");
+            }
+            // Backfill any pre-existing NULL/empty values to 'community' to be safe.
+            // Cheap full-table update — client_keys is bounded by Guard install count.
+            db.exec("UPDATE client_keys SET tier = 'community' WHERE tier IS NULL OR tier = ''");
+            db.exec(`CREATE INDEX IF NOT EXISTS idx_client_keys_tier ON client_keys(tier);`);
+        },
+    },
+    {
+        version: 15,
+        name: 'add_github_identity_and_weighted_confirmations',
+        up: (db) => {
+            // ATR proposal corpus integrity: a Sybil attacker can register N anonymous
+            // client keys from rotating IPv6 addresses and self-confirm a malicious
+            // proposal past the 3-confirmation promotion threshold. This migration
+            // ties the trust tier of each confirmation vote to a verified GitHub
+            // identity. Anonymous votes count as zero weight; verified GitHub
+            // contributors count for 0.5 (new) or 1.0 (>=30 days since registration).
+            // Promotion now requires `confirmation_weight >= 3.0` rather than the
+            // raw `confirmations >= 3` count.
+            // client_keys: add github identity + trust tier
+            const ckCols = db.prepare('PRAGMA table_info(client_keys)').all();
+            if (!ckCols.some((c) => c.name === 'github_user_id')) {
+                db.exec('ALTER TABLE client_keys ADD COLUMN github_user_id INTEGER');
+            }
+            if (!ckCols.some((c) => c.name === 'github_login')) {
+                db.exec('ALTER TABLE client_keys ADD COLUMN github_login TEXT');
+            }
+            if (!ckCols.some((c) => c.name === 'trust_tier')) {
+                // Values: 'anonymous_legacy' | 'anonymous' | 'github_new' | 'github_verified'
+                // - anonymous_legacy: pre-existing key registered before v15.
+                //   Receives a non-zero vote weight (0.25) during a 90-day grace
+                //   window so ongoing community proposals do not all stall the
+                //   moment the operator deploys the Sybil-defence migration. After
+                //   the grace window ends, anonymous_legacy and anonymous behave
+                //   identically (weight 0). server.ts owns the grace-end date
+                //   constant; see LEGACY_ANONYMOUS_GRACE_END_ISO.
+                // - anonymous: registered after v15 via /api/clients/register
+                //   (no GitHub binding). Vote weight is 0 — these keys cannot
+                //   single-handedly promote a proposal. They CAN still submit;
+                //   GitHub-verified contributors must co-sign for promotion.
+                // - github_new: GitHub-verified, < 30 days since registration
+                // - github_verified: GitHub-verified, >= 30 days since registration
+                //
+                // The DEFAULT below applies to NEW rows inserted after migration.
+                // The follow-up UPDATE retroactively tags every pre-existing row
+                // as 'anonymous_legacy' so the grace window only ever benefits
+                // keys that pre-date the trust model — never future attackers.
+                db.exec("ALTER TABLE client_keys ADD COLUMN trust_tier TEXT NOT NULL DEFAULT 'anonymous'");
+                db.exec("UPDATE client_keys SET trust_tier = 'anonymous_legacy'");
+            }
+            db.exec(`CREATE INDEX IF NOT EXISTS idx_client_keys_github_user ON client_keys(github_user_id)`);
+            db.exec(`CREATE INDEX IF NOT EXISTS idx_client_keys_trust ON client_keys(trust_tier)`);
+            // atr_proposals: add weighted confirmation tracking
+            const apCols = db.prepare('PRAGMA table_info(atr_proposals)').all();
+            if (!apCols.some((c) => c.name === 'confirmation_weight')) {
+                // First submission counts as the initial vote — backfill to match
+                // the existing `confirmations` integer so legacy proposals keep the
+                // same promotion behaviour during the transition window.
+                db.exec('ALTER TABLE atr_proposals ADD COLUMN confirmation_weight REAL NOT NULL DEFAULT 0');
+                db.exec('UPDATE atr_proposals SET confirmation_weight = CAST(confirmations AS REAL)');
+            }
+            // Per-github_user_id daily proposal submission cap is enforced via a
+            // separate table to keep the constraint cheap to check (single SELECT
+            // by user_id + date). Limit defaults to 10/day in code.
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS github_proposal_submissions (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          github_user_id INTEGER NOT NULL,
+          submission_date TEXT NOT NULL,
+          count INTEGER NOT NULL DEFAULT 1,
+          updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+          UNIQUE(github_user_id, submission_date)
+        );
+        CREATE INDEX IF NOT EXISTS idx_github_proposals_user_date
+          ON github_proposal_submissions(github_user_id, submission_date);
+      `);
+        },
+    },
 ];
 /**
  * Ensure the schema_version tracking table exists.

package/dist/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,kCAAkC;QACxC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,kEAAkE;YAClE,8DAA8D;YAC9D,sDAAsD;YACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,GAAG,EAA6B,CAAC;YAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzD,MAAM,YAAY,GAA0C;gBAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/B,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,EAAE,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,qDAAqD;YACrD,iEAAiE;YACjE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,EAAE;iBAChB,OAAO,CAAC,wEAAwE,CAAC;iBACjF,GAAG,EAAkC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAA6B,CAAC;gBAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzD,wDAAwD;oBACxD,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;SAWP,CAAC,CAAC;YACL,CAAC;YAED,EAAE,CAAC,IAAI,CAAC;;;;;OAKP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,iEAAiE;YACjE,+DAA+D;YAC/D,oCAAoC;YACpC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;OAkBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,0BAA0B;QAChC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;OAiBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAEnE,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC1C,EAAE,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACzE,CAAC;YAED,qCAAqC;YACrC,EAAE,CAAC,IAAI,CACL,iGAAiG,CAClG,CAAC;QACJ,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;OAYP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,iCAAiC;QACvC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;OAgBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,qCAAqC;QAC3C,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,0BAA0B;QAChC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;OAaP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,wEAAwE;YACxE,qEAAqE;YACrE,+DAA+D;YAC/D,2BAA2B;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAA6B,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7C,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACvF,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACvF,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,kEAAkE;YAClE,EAAE;YACF,iBAAiB;YACjB,wEAAwE;YACxE,oEAAoE;YACpE,4DAA4D;YAC5D,EAAE;YACF,iEAAiE;YACjE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;OAUP,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YAC5F,EAAE,CAAC,IAAI,CACL,wHAAwH,CACzH,CAAC;QACJ,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,8BAA8B;QACpC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;OAkBP,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CACL,wFAAwF,CACzF,CAAC;YACF,EAAE,CAAC,IAAI,CACL,uFAAuF,CACxF,CAAC;YACF,EAAE,CAAC,IAAI,CACL,uFAAuF,CACxF,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC3F,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,8CAA8C;QACpD,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,qCAAqC;YACrC,2DAA2D;YAC3D,4BAA4B;YAC5B,yBAAyB;YACzB,qDAAqD;YACrD,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,mDAAmD;YACnD,EAAE,CAAC,IAAI,CACL;uEAC+D,CAChE,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAAqB;IAC/C,EAAE,CAAC,IAAI,CAAC;;;;GAIP,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAEnD,CAAC;IACd,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAAqB;IAC9C,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAE/D,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,EAAqB;IACjD,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvB,MAAM,cAAc,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACzF,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,6BAA6B,SAAS,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,sCAAsC,iBAAiB,CAAC,EAAE,CAAC,KAAK,OAAO,wBAAwB,CAChG,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAyB;IAC9C;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,kCAAkC;QACxC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,kEAAkE;YAClE,8DAA8D;YAC9D,sDAAsD;YACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,GAAG,EAA6B,CAAC;YAC3F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzD,MAAM,YAAY,GAA0C;gBAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC1C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;aAC/B,CAAC;YAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,EAAE,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,wBAAwB;QAC9B,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,qDAAqD;YACrD,iEAAiE;YACjE,mDAAmD;YACnD,MAAM,QAAQ,GAAG,EAAE;iBAChB,OAAO,CAAC,wEAAwE,CAAC;iBACjF,GAAG,EAAkC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAA6B,CAAC;gBAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBACzD,wDAAwD;oBACxD,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;SAWP,CAAC,CAAC;YACL,CAAC;YAED,EAAE,CAAC,IAAI,CAAC;;;;;OAKP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,iEAAiE;YACjE,+DAA+D;YAC/D,oCAAoC;YACpC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;OAkBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,0BAA0B;QAChC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;OAiBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAEnE,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAEzD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC1C,EAAE,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;YACzE,CAAC;YAED,qCAAqC;YACrC,EAAE,CAAC,IAAI,CACL,iGAAiG,CAClG,CAAC;QACJ,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;OAYP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,iCAAiC;QACvC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;OAgBP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,qCAAqC;QAC3C,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,0BAA0B;QAChC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;OAaP,CAAC,CAAC;QACL,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,wEAAwE;YACxE,qEAAqE;YACrE,+DAA+D;YAC/D,2BAA2B;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAA6B,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7C,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACvF,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACvF,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,kEAAkE;YAClE,EAAE;YACF,iBAAiB;YACjB,wEAAwE;YACxE,oEAAoE;YACpE,4DAA4D;YAC5D,EAAE;YACF,iEAAiE;YACjE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;OAUP,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YAC5F,EAAE,CAAC,IAAI,CACL,wHAAwH,CACzH,CAAC;QACJ,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,8BAA8B;QACpC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;OAkBP,CAAC,CAAC;YACH,EAAE,CAAC,IAAI,CACL,wFAAwF,CACzF,CAAC;YACF,EAAE,CAAC,IAAI,CACL,uFAAuF,CACxF,CAAC;YACF,EAAE,CAAC,IAAI,CACL,uFAAuF,CACxF,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC3F,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,8CAA8C;QACpD,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,qCAAqC;YACrC,2DAA2D;YAC3D,4BAA4B;YAC5B,yBAAyB;YACzB,qDAAqD;YACrD,EAAE;YACF,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,mDAAmD;YACnD,EAAE,CAAC,IAAI,CACL;uEAC+D,CAChE,CAAC;QACJ,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,4BAA4B;QAClC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,oEAAoE;YACpE,+DAA+D;YAC/D,uEAAuE;YACvE,iEAAiE;YACjE,0EAA0E;YAC1E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAE3D,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;gBACzC,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACvF,CAAC;YACD,yEAAyE;YACzE,2EAA2E;YAC3E,EAAE,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YACrF,EAAE,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACnF,CAAC;KACF;IACD;QACE,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,gDAAgD;QACtD,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;YACT,2EAA2E;YAC3E,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,0EAA0E;YAC1E,sEAAsE;YACtE,kCAAkC;YAElC,gDAAgD;YAChD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EAE7D,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBACrD,EAAE,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;gBACnD,EAAE,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACjD,8EAA8E;gBAC9E,8DAA8D;gBAC9D,iEAAiE;gBACjE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,8DAA8D;gBAC9D,kDAAkD;gBAClD,8DAA8D;gBAC9D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,oEAAoE;gBACpE,EAAE;gBACF,kEAAkE;gBAClE,iEAAiE;gBACjE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,EAAE,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;gBAC3F,EAAE,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACpE,CAAC;YACD,EAAE,CAAC,IAAI,CACL,uFAAuF,CACxF,CAAC;YACF,EAAE,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;YAEvF,oDAAoD;YACpD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,GAAG,EAE/D,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAAC,EAAE,CAAC;gBAC1D,kEAAkE;gBAClE,oEAAoE;gBACpE,yDAAyD;gBACzD,EAAE,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;gBAC5F,EAAE,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YACxF,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,wDAAwD;YACxD,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;OAWP,CAAC,CAAC;QACL,CAAC;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAAqB;IAC/C,EAAE,CAAC,IAAI,CAAC;;;;GAIP,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAEnD,CAAC;IACd,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAAqB;IAC9C,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAE/D,CAAC;IACF,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,EAAqB;IACjD,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACvB,MAAM,cAAc,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACzF,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjB,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,6BAA6B,SAAS,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,sCAAsC,iBAAiB,CAAC,EAAE,CAAC,KAAK,OAAO,wBAAwB,CAChG,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/server.d.ts

@@ -108,8 +108,28 @@ export declare class ThreatCloudServer {
      * payload and returns the generated ATR YAML. Admin or static key only.
      */
     private handleDraftProposalFromPayload;
-    /** POST /api/atr-proposals - Submit or confirm an ATR rule proposal */
+    /**
+     * POST /api/atr-proposals - Submit or confirm an ATR rule proposal.
+     *
+     * Vote weighting (defends the corpus against Sybil promotion attacks):
+     *   - anonymous client (legacy /api/clients/register)   → weight 0.0
+     *   - github_new (< 30 days since OAuth registration)   → weight 0.5
+     *   - github_verified (>= 30 days)                       → weight 1.0
+     *
+     * Promotion threshold: cumulative `confirmation_weight >= 3.0`. Anonymous
+     * submissions are still accepted (the corpus stays community-friendly) but
+     * they cannot single-handedly promote a proposal.
+     *
+     * GitHub-bound clients additionally face a per-user daily submission cap
+     * (default 10) so a single compromised contributor account cannot flood
+     * the queue.
+     */
     private handlePostATRProposal;
+    /**
+     * Extract the raw client key from the Authorization header. Returns null
+     * when no bearer token is present.
+     */
+    private extractClientKey;
     /** POST /api/atr-feedback - Submit feedback on an ATR rule */
     private handlePostATRFeedback;
     /** POST /api/rule-feedback - Submit negative feedback on a canary/active rule, auto-quarantine at threshold */
@@ -117,6 +137,28 @@ export declare class ThreatCloudServer {
     /** POST /api/skill-threats - Submit skill threat from audit */
     /** POST /api/clients/register — auto-provision client API key */
     private handleClientRegister;
+    /**
+     * POST /api/clients/register-github — issue a client key bound to a verified
+     * GitHub identity. Used to defend the ATR proposal corpus against Sybil
+     * attacks via anonymous registration spam.
+     *
+     * Flow:
+     *   1. Client sends `{ githubToken: "ghp_..." | "gho_..." }` in body
+     *   2. Server calls GitHub API `GET /user` with that token to verify
+     *   3. On success, issues a client key tied to the numeric GitHub user ID
+     *
+     * The github_user_id is GitHub's stable numeric identifier — `login` can be
+     * renamed, so we key trust off the ID. Trust tier starts at 'github_new'
+     * and matures to 'github_verified' 30 days after first registration (see
+     * promoteMatureGitHubClients).
+     *
+     * Vote weighting at ATR proposal time:
+     *   - anonymous (legacy /api/clients/register key)  → 0   (can submit, can't promote)
+     *   - github_new (< 30 days)                         → 0.5
+     *   - github_verified (>= 30 days)                   → 1.0
+     * Promotion threshold: cumulative weight >= 3.0
+     */
+    private handleClientRegisterGitHub;
     /** POST /api/admin/client-keys/revoke — revoke client keys */
     private handleClientKeyRevoke;
     /**
@@ -199,7 +241,18 @@ export declare class ThreatCloudServer {
     private serveAdminDashboard;
     /** Check admin API key for write-protected endpoints / 檢查管理員 API 金鑰 */
     private checkAdminAuth;
-    /** Rate limit check / 速率限制檢查 */
+    /**
+     * Tier-aware rate-limit check / 階層感知的速率限制檢查
+     *
+     * @param key   Bucket key — `token:<bearer>` for authenticated requests
+     *              or `ip:<addr>` for anonymous/public reads.
+     * @param tier  Workspace tier resolved from the auth gate. Drives the
+     *              requests-per-minute budget via TIER_LIMITS.
+     *
+     * Returns the bucket state for header emission + allow/deny decision.
+     * `limit` is captured at window-init time; mid-window tier changes only
+     * take effect on the next window.
+     */
     private checkRateLimit;
     /**
      * Parse JSON body and validate against a Zod schema.

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgCH,OAAO,KAAK,EACV,YAAY,EAMb,MAAM,YAAY,CAAC;AA4BpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,sBAAsB,CAA8D;IAC5F,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,UAAU,CAAqD;IAEvE,gDAAgD;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAiB;IAC9D,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAExC,MAAM,EAAE,YAAY;IAwBhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsG5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAmBb,aAAa;IAosB3B,sEAAsE;YACxD,mBAAmB;IA6CjC;;;;;;;OAOG;YACW,2BAA2B;IA0DzC,iDAAiD;YACnC,+BAA+B;IAa7C;;;;;;OAMG;YACW,0CAA0C;IAkCxD,qEAAqE;YACvD,oBAAoB;IA4BlC,0EAA0E;YAC5D,gBAAgB;IA+C9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IA6CtB,wDAAwD;YAC1C,cAAc;IAkC5B;;;;OAIG;YACW,kBAAkB;IAkDhC,kEAAkE;YACpD,qBAAqB;IAgCnC,sEAAsE;IACtE,yEAAyE;YAC3D,qBAAqB;YA+BrB,yBAAyB;IAmBvC,kCAAkC;IAClC,OAAO,CAAC,cAAc;IAYtB,+DAA+D;IAC/D,OAAO,CAAC,gBAAgB;IAcxB,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAO7B,mDAAmD;IACnD,OAAO,CAAC,qBAAqB;IAO7B;;;;OAIG;YACW,8BAA8B;IAuF5C,uEAAuE;YACzD,qBAAqB;IAoDnC,8DAA8D;YAChD,qBAAqB;IASnC,+GAA+G;YACjG,sBAAsB;IA2CpC,+DAA+D;IAC/D,iEAAiE;YACnD,oBAAoB;IAqDlC,8DAA8D;YAChD,qBAAqB;IAgCnC;;;;OAIG;YACW,qBAAqB;YA+CrB,qBAAqB;IAgCnC;;;;OAIG;YACW,gCAAgC;IAuF9C,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IA6BzB,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IA2BtC,+FAA+F;IAC/F,OAAO,CAAC,uBAAuB;IAO/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAe/B,iEAAiE;YACnD,sBAAsB;IAwBpC,wEAAwE;YAC1D,0BAA0B;IAkBxC,iEAAiE;YACnD,wBAAwB;IA2BtC,wEAAwE;YAC1D,0BAA0B;IAkBxC;;;;;;OAMG;YACW,mBAAmB;IA4NjC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;YACW,mBAAmB;IAkBjC,kEAAkE;YACpD,mBAAmB;IA8BjC,oFAAoF;YACtE,gBAAgB;IAgC9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAmBxB,sEAAsE;IACtE,OAAO,CAAC,qBAAqB;IAM7B,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAW3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IAwBtB,gCAAgC;IAChC,OAAO,CAAC,cAAc;IAWtB;;;OAGG;YACW,gBAAgB;IAqB9B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAUhB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAwExB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAyCH,OAAO,KAAK,EACV,YAAY,EAMb,MAAM,YAAY,CAAC;AAmEpB;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAgB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,cAAc,CAA+C;IACrE,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,sBAAsB,CAA8D;IAC5F,OAAO,CAAC,qBAAqB,CAA+C;IAC5E,OAAO,CAAC,UAAU,CAAqD;IAEvE,gDAAgD;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAiB;IAC9D,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAExC,MAAM,EAAE,YAAY;IAwBhC,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+I5B,8BAA8B;IACxB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAmBb,aAAa;IAsyB3B,sEAAsE;YACxD,mBAAmB;IA6CjC;;;;;;;OAOG;YACW,2BAA2B;IA0DzC,iDAAiD;YACnC,+BAA+B;IAa7C;;;;;;OAMG;YACW,0CAA0C;IAkCxD,qEAAqE;YACvD,oBAAoB;IA4BlC,0EAA0E;YAC5D,gBAAgB;IA+C9B,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IA6CtB,wDAAwD;YAC1C,cAAc;IAkC5B;;;;OAIG;YACW,kBAAkB;IAkDhC,kEAAkE;YACpD,qBAAqB;IAgCnC,sEAAsE;IACtE,yEAAyE;YAC3D,qBAAqB;YA+BrB,yBAAyB;IAmBvC,kCAAkC;IAClC,OAAO,CAAC,cAAc;IAYtB,+DAA+D;IAC/D,OAAO,CAAC,gBAAgB;IAcxB,yDAAyD;IACzD,OAAO,CAAC,qBAAqB;IAO7B,mDAAmD;IACnD,OAAO,CAAC,qBAAqB;IAO7B;;;;OAIG;YACW,8BAA8B;IAuF5C;;;;;;;;;;;;;;;OAeG;YACW,qBAAqB;IA4InC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAOxB,8DAA8D;YAChD,qBAAqB;IASnC,+GAA+G;YACjG,sBAAsB;IA2CpC,+DAA+D;IAC/D,iEAAiE;YACnD,oBAAoB;IAqDlC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,0BAA0B;IAmHxC,8DAA8D;YAChD,qBAAqB;IAgCnC;;;;OAIG;YACW,qBAAqB;YA+CrB,qBAAqB;IAgCnC;;;;OAIG;YACW,gCAAgC;IAuF9C,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAgEzB,oFAAoF;IACpF,OAAO,CAAC,oBAAoB;IAW5B,4FAA4F;IAC5F,OAAO,CAAC,wBAAwB;IAWhC,qEAAqE;YACvD,wBAAwB;IA2BtC,+FAA+F;IAC/F,OAAO,CAAC,uBAAuB;IAO/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAe/B,iEAAiE;YACnD,sBAAsB;IAwBpC,wEAAwE;YAC1D,0BAA0B;IAkBxC,iEAAiE;YACnD,wBAAwB;IA2BtC,wEAAwE;YAC1D,0BAA0B;IAkBxC;;;;;;OAMG;YACW,mBAAmB;IA4NjC,sDAAsD;IACtD,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;YACW,mBAAmB;IAkBjC,kEAAkE;YACpD,mBAAmB;IA8BjC,oFAAoF;YACtE,gBAAgB;IAgC9B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,gBAAgB;IAmBxB,sEAAsE;IACtE,OAAO,CAAC,qBAAqB;IAM7B,kDAAkD;IAClD,OAAO,CAAC,WAAW;IAiBnB,kFAAkF;IAClF,OAAO,CAAC,mBAAmB;IAwB3B,uEAAuE;IACvE,OAAO,CAAC,cAAc;IA6BtB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IA+BtB;;;OAGG;YACW,gBAAgB;IAqB9B,wDAAwD;IACxD,OAAO,CAAC,QAAQ;IAoBhB,sCAAsC;IACtC,OAAO,CAAC,QAAQ;IAUhB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAwExB"}