@pellux/goodvibes-sdk 0.33.37 → 0.34.0

package/dist/platform/daemon/http/router.js

@@ -540,11 +540,21 @@ export class DaemonHttpRouter {
             return body;
         const username = typeof body.username === 'string' ? body.username : '';
         const password = typeof body.password === 'string' ? body.password : '';
-        const user = this.context.userAuth.authenticate(username, password);
-        if (!user) {
+        const authResult = this.context.userAuth.authenticate(username, password);
+        if (!authResult.ok) {
+            if (authResult.lockedUntilMs) {
+                const retryAfterSeconds = Math.ceil((authResult.lockedUntilMs - Date.now()) / 1_000);
+                return Response.json({ error: 'Too many requests' }, { status: 429, headers: { 'Retry-After': String(Math.max(1, retryAfterSeconds)) } });
+            }
             return Response.json({ error: 'Invalid credentials' }, { status: 401 });
         }
+        const { user } = authResult;
         const session = this.context.userAuth.createSession(user.username);
+        // Auto-retire the bootstrap credential file ONLY after the first
+        // NON-bootstrap login (mirrors http-listener.ts handleLogin behaviour).
+        if (!authResult.usedBootstrapCredential && this.context.userAuth.inspect().bootstrapCredentialPresent) {
+            this.context.userAuth.clearBootstrapCredentialFile();
+        }
         return Response.json({
             authenticated: true,
             token: session.token,

package/dist/platform/daemon/http-listener.d.ts

@@ -1,6 +1,12 @@
 import { HookDispatcher } from '../hooks/dispatcher.js';
 import { UserAuthManager } from '../security/user-auth.js';
 import { ConfigManager } from '../config/manager.js';
+/**
+ * Returns true when the given IP address belongs to a Cloudflare-owned range.
+ * Used to validate CF-Connecting-IP header trust: only trust it when the
+ * connecting peer is actually a Cloudflare edge node.
+ */
+export declare function isCloudflareIp(ip: string): boolean;
 interface HttpListenerConfig {
     port?: number | undefined;
     host?: string | undefined;
@@ -28,6 +34,15 @@ interface HttpListenerConfig {
      * allowedOrigins must be configured or hostMode must be local/loopback.
      */
     enforceCors?: boolean | undefined;
+    /**
+     * When true, extract the real client IP from CF-Connecting-IP ONLY when the
+     * connecting peer address belongs to a Cloudflare-owned CIDR range.
+     * Requires trustProxy=true. Prevents header-injection bypass: a peer that is
+     * not a Cloudflare edge node cannot fake CF-Connecting-IP to manipulate rate
+     * limiting. When trustProxy=false, CF-Connecting-IP is ignored regardless.
+     * Default: false.
+     */
+    trustCloudflare?: boolean | undefined;
     /** Pre-configured UserAuthManager owned by the runtime service graph. */
     userAuth: UserAuthManager;
 }
@@ -60,6 +75,8 @@ export declare class HttpListener {
     private loginRateLimiter;
     /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
     private trustProxy;
+    /** When true, trust CF-Connecting-IP only from validated Cloudflare edge IPs. */
+    private trustCloudflare;
     private readonly configManager;
     private readonly serveFactory;
     private tlsState;

package/dist/platform/daemon/http-listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/http-listener.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAarD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;IAC5C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AAMD;;;;;;;;GAQG;AACH,qBAAa,YAAY;IA4BX,OAAO,CAAC,MAAM;IA3B1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,kEAAkE;IAClE,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,oDAAoD;IACpD,OAAO,CAAC,gBAAgB,CAAc;IACtC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAoC9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAgBb,aAAa;YAgCb,mBAAmB;YA4DnB,WAAW;YA+CX,aAAa;CAgD5B"}
+{"version":3,"file":"http-listener.d.ts","sourceRoot":"","sources":["../../../src/platform/daemon/http-listener.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA2HrD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAWlD;AAMD,UAAU,kBAAkB;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;IAC5C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,yEAAyE;IACzE,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,UAAU,gBAAgB;IACxB,YAAY,EAAE,OAAO,CAAC;CACvB;AAMD;;;;;;;;GAQG;AACH,qBAAa,YAAY;IA8BX,OAAO,CAAC,MAAM;IA7B1B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,cAAc,CAAW;IACjC,kEAAkE;IAClE,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,cAAc,CAAwB;IAC9C,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,oDAAoD;IACpD,OAAO,CAAC,gBAAgB,CAAc;IACtC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,CAAU;IAC5B,iFAAiF;IACjF,OAAO,CAAC,eAAe,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAA0C;IAC1D,4EAA4E;IAC5E,OAAO,CAAC,iBAAiB,CAA6B;IACtD,gFAAgF;IAChF,OAAO,CAAC,WAAW,CAAS;IAC5B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB,CAA8B;IACxD,0FAA0F;IAC1F,OAAO,CAAC,aAAa,CAAS;gBAEV,MAAM,EAAE,kBAAkB;IAqC9C;;;;OAIG;IACH,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;IAU/D;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAKrC;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;OAGG;IACH,OAAO,CAAC,gCAAgC;IAwDxC;;OAEG;IACH,IAAI,SAAS,IAAI,OAAO,CAEvB;IAMD,OAAO,CAAC,SAAS;YAOH,aAAa;YAgBb,aAAa;YA6Cb,mBAAmB;YA4DnB,WAAW;YAuEX,aAAa;CAgD5B"}

package/dist/platform/daemon/http-listener.js

@@ -13,6 +13,145 @@ import { createHostModeRestartWatcher } from './host-mode-watcher.js';
 import { RateLimiter } from './http/rate-limiter.js';
 import { readTextBodyWithinLimit } from '../utils/request-body.js';
 // ---------------------------------------------------------------------------
+// Cloudflare IP ranges (maintained constant; do NOT fetch at runtime by default).
+// Source: https://www.cloudflare.com/ips/
+// Last reviewed: 2026-06-11
+// ---------------------------------------------------------------------------
+/** Cloudflare published IPv4 CIDR ranges (full list). */
+const CLOUDFLARE_IPV4_CIDRS = [
+    ['103.21.244.0', 22],
+    ['103.22.200.0', 22],
+    ['103.31.4.0', 22],
+    ['104.16.0.0', 13],
+    ['104.24.0.0', 14],
+    ['108.162.192.0', 18],
+    ['131.0.72.0', 22],
+    ['141.101.64.0', 18],
+    ['162.158.0.0', 15],
+    ['172.64.0.0', 13],
+    ['173.245.48.0', 20],
+    ['188.114.96.0', 20],
+    ['190.93.240.0', 20],
+    ['197.234.240.0', 22],
+    ['198.41.128.0', 17],
+];
+/** Cloudflare published IPv6 CIDR prefixes (prefix string, prefix-length pairs). */
+const CLOUDFLARE_IPV6_PREFIXES = [
+    ['2400:cb00::', 32],
+    ['2606:4700::', 32],
+    ['2803:f800::', 32],
+    ['2405:b500::', 32],
+    ['2405:8100::', 32],
+    ['2a06:98c0::', 29],
+    ['2c0f:f248::', 32],
+];
+function ipv4ToUint32(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return undefined;
+    let n = 0;
+    for (const part of parts) {
+        const v = Number(part);
+        if (!Number.isInteger(v) || v < 0 || v > 255)
+            return undefined;
+        n = (n << 8) | v;
+    }
+    // Shift result to unsigned 32-bit
+    return n >>> 0;
+}
+function isIpInCidr4(ip, cidrNet, prefixLen) {
+    const ipInt = ipv4ToUint32(ip);
+    const netInt = ipv4ToUint32(cidrNet);
+    if (ipInt === undefined || netInt === undefined)
+        return false;
+    const mask = prefixLen === 0 ? 0 : (~0 << (32 - prefixLen)) >>> 0;
+    return (ipInt & mask) === (netInt & mask);
+}
+function isIpv6InPrefix(ip, prefix, prefixLen) {
+    try {
+        // Normalize by expanding both to full 128-bit arrays
+        const ipBytes = ipv6ToBytes(ip);
+        const prefixBytes = ipv6ToBytes(prefix);
+        if (!ipBytes || !prefixBytes)
+            return false;
+        const fullBytes = Math.floor(prefixLen / 8);
+        const remainBits = prefixLen % 8;
+        for (let i = 0; i < fullBytes; i++) {
+            if (ipBytes[i] !== prefixBytes[i])
+                return false;
+        }
+        if (remainBits > 0 && fullBytes < 16) {
+            const mask = (0xff << (8 - remainBits)) & 0xff;
+            if ((ipBytes[fullBytes] & mask) !== (prefixBytes[fullBytes] & mask))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function ipv6ToBytes(ip) {
+    try {
+        // Strip brackets if present (e.g. [::1])
+        const clean = ip.replace(/^\[|\]$/g, '');
+        // Reject zone IDs (e.g. fe80::1%eth0) — '%' is not valid in a routable address.
+        if (clean.includes('%'))
+            return undefined;
+        const halves = clean.split('::');
+        if (halves.length > 2)
+            return undefined;
+        const leftGroups = halves[0] ? halves[0].split(':') : [];
+        const rightGroups = halves[1] ? halves[1].split(':') : [];
+        const totalGroups = 8;
+        const zeroGroups = totalGroups - leftGroups.length - rightGroups.length;
+        if (zeroGroups < 0)
+            return undefined;
+        const groups = [
+            ...leftGroups,
+            ...Array(zeroGroups).fill('0'),
+            ...rightGroups,
+        ];
+        if (groups.length !== 8)
+            return undefined;
+        const bytes = new Uint8Array(16);
+        for (let i = 0; i < 8; i++) {
+            const g = groups[i];
+            // Each group must be 1-4 hex characters — no leading garbage, no zone index fragments.
+            if (!/^[0-9a-fA-F]{1,4}$/.test(g))
+                return undefined;
+            const v = parseInt(g, 16);
+            // parseInt with a valid hex pattern never exceeds 0xffff, but guard defensively.
+            if (v < 0 || v > 0xffff)
+                return undefined;
+            bytes[i * 2] = (v >> 8) & 0xff;
+            bytes[i * 2 + 1] = v & 0xff;
+        }
+        return bytes;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Returns true when the given IP address belongs to a Cloudflare-owned range.
+ * Used to validate CF-Connecting-IP header trust: only trust it when the
+ * connecting peer is actually a Cloudflare edge node.
+ */
+export function isCloudflareIp(ip) {
+    if (!ip)
+        return false;
+    // Strip IPv6-mapped IPv4 prefix (::ffff:a.b.c.d)
+    const v4mapped = ip.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    const candidate = v4mapped ? v4mapped[1] : ip;
+    // Try IPv4 ranges first
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(candidate)) {
+        return CLOUDFLARE_IPV4_CIDRS.some(([net, len]) => isIpInCidr4(candidate, net, len));
+    }
+    // Try IPv6 prefixes
+    return CLOUDFLARE_IPV6_PREFIXES.some(([prefix, len]) => isIpv6InPrefix(candidate, prefix, len));
+}
+// ---------------------------------------------------------------------------
 // HttpListener
 // ---------------------------------------------------------------------------
 /**
@@ -41,6 +180,8 @@ export class HttpListener {
     loginRateLimiter;
     /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
     trustProxy;
+    /** When true, trust CF-Connecting-IP only from validated Cloudflare edge IPs. */
+    trustCloudflare;
     configManager;
     serveFactory;
     tlsState = null;
@@ -78,6 +219,7 @@ export class HttpListener {
         // scrypt-cost-throttled online brute-force attacks.
         this.loginRateLimiter = new RateLimiter(config.loginRateLimit ?? 5);
         this.trustProxy = config.trustProxy ?? Boolean(this.configManager.get('httpListener.trustProxy'));
+        this.trustCloudflare = config.trustCloudflare ?? false;
         this.serveFactory = config.serveFactory ?? Bun.serve;
     }
     /**
@@ -254,7 +396,25 @@ export class HttpListener {
         const requestId = randomUUID();
         const startMs = Date.now();
         const url = new URL(req.url);
-        const clientIp = extractForwardedClientIp(req, this.trustProxy || (this.tlsState?.trustProxy ?? false)) ?? 'unknown';
+        const effectiveTrustProxy = this.trustProxy || (this.tlsState?.trustProxy ?? false);
+        let clientIp;
+        if (this.trustCloudflare && effectiveTrustProxy) {
+            // Extract peer IP via standard x-forwarded-for first to validate against CF ranges.
+            const peerIp = extractForwardedClientIp(req, true) ?? 'unknown';
+            const cfConnectingIp = req.headers.get('cf-connecting-ip')?.trim();
+            if (cfConnectingIp && isCloudflareIp(peerIp)) {
+                // Peer is a real Cloudflare edge node — trust the CF header.
+                clientIp = cfConnectingIp;
+            }
+            else {
+                // Not validated as a CF edge or no CF header — fall through without CF trust.
+                // Use peerIp if available (x-forwarded-for from non-CF proxy), else 'unknown'.
+                clientIp = peerIp;
+            }
+        }
+        else {
+            clientIp = extractForwardedClientIp(req, effectiveTrustProxy) ?? 'unknown';
+        }
         let response = null;
         try {
             response = await this._handleRequestInner(req, url, clientIp, requestId);
@@ -304,13 +464,13 @@ export class HttpListener {
         // x-forwarded-for is only trustworthy when running behind a trusted reverse proxy.
         if (url.pathname === '/login' && req.method === 'POST') {
             if (!this.loginRateLimiter.check(clientIp)) {
-                return Response.json({ error: 'Too many requests' }, { status: 429 });
+                return Response.json({ error: 'Too many requests' }, { status: 429, headers: { 'Retry-After': '60' } });
             }
             return this.handleLogin(req, clientIp, requestId);
         }
         // General rate limiting for all other routes.
         if (!this.rateLimiter.check(clientIp)) {
-            return Response.json({ error: 'Too many requests' }, { status: 429 });
+            return Response.json({ error: 'Too many requests' }, { status: 429, headers: { 'Retry-After': '60' } });
         }
         // Auth check
         if (!this.checkAuth(req)) {
@@ -331,19 +491,25 @@ export class HttpListener {
             return body;
         const username = typeof body.username === 'string' ? body.username : '';
         const password = typeof body.password === 'string' ? body.password : '';
-        const user = this.userAuth.authenticate(username, password);
-        if (!user) {
+        const authResult = this.userAuth.authenticate(username, password);
+        if (!authResult.ok) {
             // AUTH_FAILED — never log credential values
+            const lockedUntilMs = authResult.lockedUntilMs;
             logger.warn('AUTH_FAILED', {
                 type: 'AUTH_FAILED',
                 requestId,
-                usernameAttempted: username,
                 clientIp,
-                reason: 'invalid_credentials',
+                reason: lockedUntilMs ? 'account_locked' : 'invalid_credentials',
+                // Never log usernameAttempted to avoid associating accounts with IPs in logs
             });
             authFailureTotal.add(1);
+            if (lockedUntilMs) {
+                const retryAfterSeconds = Math.ceil((lockedUntilMs - Date.now()) / 1_000);
+                return Response.json({ error: 'Too many requests' }, { status: 429, headers: { 'Retry-After': String(Math.max(1, retryAfterSeconds)) } });
+            }
             return Response.json({ error: 'Invalid credentials' }, { status: 401 });
         }
+        const { user } = authResult;
         const session = this.userAuth.createSession(user.username);
         // AUTH_SUCCEEDED — never log credential values
         authSuccessTotal.add(1);
@@ -354,6 +520,19 @@ export class HttpListener {
             clientIp,
             method: 'password',
         });
+        // Auto-retire the bootstrap credential file ONLY after the first
+        // NON-bootstrap login. The bootstrap credential is a one-time convenience
+        // artifact; retiring it immediately on a bootstrap login would prevent the
+        // operator from logging in again if the session is lost before a real
+        // account/password is established.
+        if (!authResult.usedBootstrapCredential && this.userAuth.inspect().bootstrapCredentialPresent) {
+            const retired = this.userAuth.clearBootstrapCredentialFile();
+            if (retired) {
+                logger.info('Bootstrap credential file retired after first non-bootstrap login', {
+                    username: user.username,
+                });
+            }
+        }
         return Response.json({
             authenticated: true,
             token: session.token,

package/dist/platform/knowledge/knowledge-api.d.ts

@@ -54,7 +54,7 @@ export interface MemoryApi {
     rebuildVectors(): MemoryVectorStats;
     rebuildVectorsAsync(): Promise<MemoryVectorStats>;
     doctor(): Promise<MemoryDoctorReport>;
-    reviewQueue(limit?: number): readonly MemoryRecord[];
+    reviewQueue(limit?: number, scope?: MemoryScope): readonly MemoryRecord[];
     exportBundle(filter?: MemorySearchFilter): MemoryBundle;
     importBundle(bundle: MemoryBundle): Promise<MemoryImportResult>;
     get(id: string): MemoryRecord | null;

package/dist/platform/knowledge/knowledge-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"knowledge-api.d.ts","sourceRoot":"","sources":["../../../src/platform/knowledge/knowledge-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EACV,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,KAAK,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,KAAK,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,oBAAoB,GAAG,UAAU,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,KAAK,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,KAAK,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,KAAK,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,KAAK,UAAU,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,KAAK,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,KAAK,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,KAAK,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,KAAK,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,KAAK,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,KAAK,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,GAAG,qBAAqB,CAAC,CAAC;AAElG,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,UAAU,CAAC;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,+BAAgC,SAAQ,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,UAAU,CAAC;IAClH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,YAAY,EAAE,CAAC;IAC7D,cAAc,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,0BAA0B,EAAE,CAAC;IACnF,WAAW,IAAI,iBAAiB,CAAC;IACjC,cAAc,IAAI,iBAAiB,CAAC;IACpC,mBAAmB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,YAAY,EAAE,CAAC;IACrD,YAAY,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAAC;IACxD,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IACrC,MAAM,IAAI,SAAS,YAAY,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,CAAC;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,GAAG,IAAI,CAAC;IAC5H,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,YAAY,GAAG,IAAI,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;CAC5F;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,cAAc,EACZ,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,KAAK,GACL,QAAQ,GACR,cAAc,GACd,MAAM,GACN,UAAU,GACV,gBAAgB,GAChB,qBAAqB,GACrB,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,gBAAgB,GAChB,QAAQ,GACR,aAAa,CAChB,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE;QACf,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;KACpD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;KAC/E,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,KAAK,EAAE;YACL,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;SAC3E,CAAC;QACF,MAAM,EAAE;YACN,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;SAC9E,CAAC;QACF,WAAW,EAAE;YACX,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACzF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;YAC/D,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;SACtF,CAAC;QACF,KAAK,EAAE;YACL,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1E,SAAS,CACP,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EACrD,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,aAAa,GACpB,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC/E,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,EAAE,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;KACrE,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;KACjJ,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,GAAG,CAAC,KAAK,EAAE,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,QAAQ,CAAC,KAAK,EAAE,+BAA+B,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjG,cAAc,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAChG,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACpG,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrF,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9F,aAAa,CACX,WAAW,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EACnE,KAAK,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAC7D,SAAS,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GACjE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC7F,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,KAAK,CACH,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/C,SAAS,CACP,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,WAAW,CACT,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACrD,eAAe,CACb,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;KAC1D,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE;QACpB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvF,WAAW,CAAC,KAAK,EAAE,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;KACvG,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAClF,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,SAAS,EAAE;YACT,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACnE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;SAC9F,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACpH,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAClF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC9E,MAAM,CACJ,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,0BAA0B,GACjC,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC;KACjE,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACzC;AAgCD,wBAAgB,eAAe,CAAC,cAAc,EAAE,iBAAiB,GAAG,SAAS,CA6B5E;AAED,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,GAAE,yBAA8B,GACtC,YAAY,CAuId"}
+{"version":3,"file":"knowledge-api.d.ts","sourceRoot":"","sources":["../../../src/platform/knowledge/knowledge-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EACV,kBAAkB,GACnB,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,EAC5B,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,KAAK,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,KAAK,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,oBAAoB,GAAG,UAAU,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,KAAK,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,KAAK,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,KAAK,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,KAAK,UAAU,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,KAAK,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,KAAK,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,KAAK,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,KAAK,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,KAAK,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,KAAK,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,KAAK,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,KAAK,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,EAAE,aAAa,GAAG,qBAAqB,CAAC,CAAC;AAElG,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CAAC,cAAc,EAAE,mBAAmB,GAAG,UAAU,CAAC;IACxG,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,+BAAgC,SAAQ,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,UAAU,CAAC;IAClH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,YAAY,EAAE,CAAC;IAC7D,cAAc,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,0BAA0B,EAAE,CAAC;IACnF,WAAW,IAAI,iBAAiB,CAAC;IACjC,cAAc,IAAI,iBAAiB,CAAC;IACpC,mBAAmB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,SAAS,YAAY,EAAE,CAAC;IAC1E,YAAY,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,YAAY,CAAC;IACxD,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IACrC,MAAM,IAAI,SAAS,YAAY,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,UAAU,EAAE,CAAC;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,WAAW,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,GAAG,IAAI,CAAC;IAC5H,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,YAAY,GAAG,IAAI,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC;CAC5F;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,cAAc,EACZ,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,cAAc,GACd,KAAK,GACL,QAAQ,GACR,cAAc,GACd,MAAM,GACN,UAAU,GACV,gBAAgB,GAChB,qBAAqB,GACrB,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,gBAAgB,GAChB,QAAQ,GACR,aAAa,CAChB,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE;QACf,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;KACpD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;KAC/E,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,KAAK,EAAE;YACL,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;YAChE,KAAK,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;SAC3E,CAAC;QACF,MAAM,EAAE;YACN,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;SAC9E,CAAC;QACF,WAAW,EAAE;YACX,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACzF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;YAC/D,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;SACtF,CAAC;QACF,KAAK,EAAE;YACL,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1E,SAAS,CACP,IAAI,EAAE,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,EACrD,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,aAAa,GACpB,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC/E,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,EAAE,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;KACrE,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;KAC9E,CAAC;IACF,QAAQ,CAAC,UAAU,EAAE;QACnB,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;KACjJ,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE;QACf,GAAG,CAAC,KAAK,EAAE,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,QAAQ,CAAC,KAAK,EAAE,+BAA+B,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjG,cAAc,CAAC,KAAK,CAAC,EAAE,mBAAmB,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAChG,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,UAAU,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACpG,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACrF,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9F,aAAa,CACX,WAAW,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EACnE,KAAK,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAC7D,SAAS,CAAC,EAAE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,GACjE,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACvD,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,CAAC;KAC7F,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,KAAK,CACH,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAC/C,SAAS,CACP,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnD,WAAW,CACT,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACrD,eAAe,CACb,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,CAAC,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE,aAAa,GACtB,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;KAC1D,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE;QACpB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACvF,WAAW,CAAC,KAAK,EAAE,0BAA0B,GAAG,UAAU,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,CAAC;KACvG,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,IAAI,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;QAClF,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7E,SAAS,EAAE;YACT,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACnE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CAAC,CAAC;SAC9F,CAAC;KACH,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,UAAU,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACpH,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAClF,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC9E,MAAM,CACJ,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,0BAA0B,GACjC,UAAU,CAAC,gBAAgB,CAAC,8BAA8B,CAAC,CAAC,CAAC;KACjE,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACzC;AAgCD,wBAAgB,eAAe,CAAC,cAAc,EAAE,iBAAiB,GAAG,SAAS,CA6B5E;AAED,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,gBAAgB,EAClC,OAAO,GAAE,yBAA8B,GACtC,YAAY,CAuId"}

package/dist/platform/knowledge/knowledge-api.js

@@ -31,7 +31,7 @@ export function createMemoryApi(memoryRegistry) {
         rebuildVectors: () => memoryRegistry.rebuildVectors(),
         rebuildVectorsAsync: () => memoryRegistry.rebuildVectorsAsync(),
         doctor: () => memoryRegistry.doctor(),
-        reviewQueue: (limit = 10) => memoryRegistry.reviewQueue(limit),
+        reviewQueue: (limit = 10, scope) => memoryRegistry.reviewQueue(limit, scope),
         exportBundle: (filter = {}) => memoryRegistry.exportBundle(filter),
         importBundle: (bundle) => memoryRegistry.importBundle(bundle),
         get: (id) => memoryRegistry.get(id),

package/dist/platform/runtime/store/helpers/reducers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../src/platform/runtime/store/helpers/reducers/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,gCAAgC,CAAC;AA+BxC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,eAAe,GACrB,kBAAkB,CAyBpB;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,eAAe,GACrB,qBAAqB,CAmCvB;AAiCD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,GAAG,eAAe,CAuD1F;AAED,iBAAS,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAQ/G;AAED,iBAAS,0BAA0B,CACjC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,EACvC,MAAM,EAAE,MAAM,GACb,eAAe,CAIjB;AA2CD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,GAAG,gBAAgB,CA0F9F;AAED,iBAAS,2BAA2B,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,GACb,gBAAgB,CAgBlB;AAgBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,kBAAkB,GACxB,wBAAwB,CA4G1B;AAED,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,CAAC"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../../../src/platform/runtime/store/helpers/reducers/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,gCAAgC,CAAC;AA+BxC,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,eAAe,GACrB,kBAAkB,CAyBpB;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,KAAK,EAAE,eAAe,GACrB,qBAAqB,CAmCvB;AAiCD,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,GAAG,eAAe,CA0D1F;AAED,iBAAS,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAQ/G;AAED,iBAAS,0BAA0B,CACjC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,kBAAkB,EAC1B,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,EACvC,MAAM,EAAE,MAAM,GACb,eAAe,CAIjB;AA2CD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,GAAG,gBAAgB,CA0F9F;AAED,iBAAS,2BAA2B,CAClC,MAAM,EAAE,gBAAgB,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,SAAS,EACxC,MAAM,EAAE,MAAM,GACb,gBAAgB,CAgBlB;AAgBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,kBAAkB,GACxB,wBAAwB,CA4G1B;AAED,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,CAAC"}

package/dist/platform/runtime/store/helpers/reducers/lifecycle.js

@@ -121,6 +121,10 @@ function countTaskTransition(domain, previous, task) {
     return { totalCreated, totalCompleted, totalFailed, totalCancelled };
 }
 export function updateTaskState(domain, event) {
+    // Progress-only events (BATCH_JOB_PROGRESS, EXPORT_PROGRESS) have no taskId —
+    // they are not task lifecycle events and do not mutate the task registry.
+    if (!('taskId' in event))
+        return domain;
     const tasks = new Map(domain.tasks);
     const existing = tasks.get(event.taskId);
     const timestamp = now();

package/dist/platform/runtime/store/helpers/reducers/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../../../../src/platform/runtime/store/helpers/reducers/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAqB,MAAM,+BAA+B,CAAC;AAClH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAA8B,MAAM,gCAAgC,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAuC,MAAM,0BAA0B,CAAC;AACvG,OAAO,KAAK,EAAE,cAAc,EAA4C,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,kBAAkB,GACxB,wBAAwB,CA2C1B;AAuBD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAmDlG;AAyBD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,cAAc,CA8HtF;AA8BD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,cAAc,GACpB,IAAI,CAAC,OAAO,gBAAgB,EAAE,YAAY,EAAE,KAAK,GAAG,QAAQ,CAAC,CAoC/D;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAenJ;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAK3J;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAuBtI;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAyBtI;AAmBD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAc3I;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE9J;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAiB7J;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAMzJ;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAiBpJ;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAcnI;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAiBnI;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAExI"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../../../../src/platform/runtime/store/helpers/reducers/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAqB,MAAM,+BAA+B,CAAC;AAClH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACxG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAA8B,MAAM,gCAAgC,CAAC;AAC3G,OAAO,KAAK,EAAE,iBAAiB,EAAuC,MAAM,0BAA0B,CAAC;AACvG,OAAO,KAAK,EAAE,cAAc,EAA4C,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AACvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,EAChC,KAAK,EAAE,kBAAkB,GACxB,wBAAwB,CA2C1B;AAuBD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,GAAG,iBAAiB,CAmDlG;AAyBD,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,cAAc,CA8HtF;AAkCD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,cAAc,GACpB,IAAI,CAAC,OAAO,gBAAgB,EAAE,YAAY,EAAE,KAAK,GAAG,QAAQ,CAAC,CAoC/D;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,CAenJ;AAED,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAK3J;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAuBtI;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAyBtI;AAmBD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAc3I;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE9J;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAiB7J;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,OAAO,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,uBAAuB,CAMzJ;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAiBpJ;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAcnI;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAiBnI;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAExI"}

package/dist/platform/runtime/store/helpers/reducers/sync.js

@@ -271,6 +271,10 @@ function transportStateForEvent(event) {
         case 'TRANSPORT_RETRY_EXECUTED':
         case 'STREAM_SUBSCRIBER_CONNECTED':
         case 'STREAM_SUBSCRIBER_DISCONNECTED':
+        // UX-enhancement observability events — no transport state change.
+        case 'TRANSPORT_BACKPRESSURE':
+        case 'TRANSPORT_CONNECTION_STATE':
+        case 'TRANSPORT_RECONNECT_ATTEMPT':
             return null;
     }
 }

package/dist/platform/security/http-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../../src/platform/security/http-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEN,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3C;AAmCD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,GACX,MAAM,CAQR;AAOD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACzE,GACA,4BAA4B,GAAG,IAAI,CAqBrC;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACzE,GACA,4BAA4B,GAAG,IAAI,CAErC;AAED,wBAAgB,eAAe,CAAC,aAAa,EAAE,4BAA4B,GAAG,IAAI,GAAG,OAAO,CAG3F;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAa/F;AAED,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,UAAQ,GAAG,MAAM,CAW1F"}
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../../src/platform/security/http-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;AAEN,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3C;AAmCD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,GACX,MAAM,CAQR;AAeD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACzE,GACA,4BAA4B,GAAG,IAAI,CAqBrC;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE;IACP,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,SAAS,CAAC,CAAC;CACzE,GACA,4BAA4B,GAAG,IAAI,CAErC;AAED,wBAAgB,eAAe,CAAC,aAAa,EAAE,4BAA4B,GAAG,IAAI,GAAG,OAAO,CAG3F;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAa/F;AAED,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,UAAQ,GAAG,MAAM,CAW1F"}

package/dist/platform/security/http-auth.js

@@ -1,4 +1,4 @@
-import { timingSafeEqual } from 'node:crypto';
+import { createHash, timingSafeEqual } from 'node:crypto';
 export const OPERATOR_SESSION_COOKIE_NAME = 'goodvibes_session';
 function parseCookies(header) {
     const cookies = new Map();
@@ -47,10 +47,17 @@ export function extractOperatorAuthToken(req) {
         return sessionCookie;
     return '';
 }
+/**
+ * Compare two tokens in constant time without leaking length via early-exit.
+ * Hash both sides with SHA-256 so the Buffers are always 32 bytes before
+ * calling timingSafeEqual, eliminating the length-based side-channel that a
+ * plain Buffer.from(token).length check or early-return on length mismatch
+ * would have exposed.
+ */
 function matchesSharedToken(token, sharedToken) {
-    if (token.length !== sharedToken.length)
-        return false;
-    return timingSafeEqual(Buffer.from(token), Buffer.from(sharedToken));
+    const aHash = createHash('sha256').update(token).digest();
+    const bHash = createHash('sha256').update(sharedToken).digest();
+    return timingSafeEqual(aHash, bHash);
 }
 export function authenticateOperatorToken(token, context) {
     const normalized = token.trim();

package/dist/platform/security/user-auth.d.ts

@@ -11,10 +11,57 @@ export interface AuthSession {
 interface UserAuthConfig {
     sessionTtlMs?: number | undefined;
     maxSessions?: number | undefined;
+    /** Maximum number of per-account lock state entries. Excess entries are evicted by staleness. Default: 10000. */
+    maxAccountLocks?: number | undefined;
     users?: AuthUser[] | undefined;
     bootstrapFilePath: string;
     bootstrapCredentialPath: string;
+    /** Scrypt cost params for hashing new passwords. Existing hashes carry their own params. Default: Node defaults. */
+    scryptParams?: ScryptParams | undefined;
+    /** Injectable clock for testing. Defaults to Date.now. */
+    nowFn?: (() => number) | undefined;
 }
+/**
+ * Scrypt cost parameters. N must be a power of 2. Increasing N multiplies
+ * memory usage by 128*N*r bytes and CPU time proportionally.
+ * Safe minimums: N>=16384, r>=8, p>=1.
+ */
+export interface ScryptParams {
+    /** CPU/memory cost factor — must be a power of 2. Default: 16384. */
+    readonly N: number;
+    /** Block size. Default: 8. */
+    readonly r: number;
+    /** Parallelization factor. Default: 1. */
+    readonly p: number;
+}
+/**
+ * Per-account login failure state for escalating lockout.
+ * Independent of IP-based throttling.
+ */
+interface AccountLockState {
+    failures: number;
+    lockedUntil: number;
+}
+/**
+ * Result of authenticate() — includes lock state so callers can
+ * return Retry-After without leaking whether the username exists.
+ *
+ * The union is strict: `.user` is ONLY present (and non-undefined) on the
+ * `ok:true` branch, so TypeScript catches any caller that forgets to check `.ok`
+ * before accessing the user. `.usedBootstrapCredential` is set on the `ok:true`
+ * branch so callers can decide whether to retire the bootstrap credential file.
+ */
+export type AuthenticateResult = {
+    readonly ok: true;
+    readonly user: AuthUser;
+    readonly usedBootstrapCredential: boolean;
+    readonly lockedUntilMs?: undefined;
+} | {
+    readonly ok: false;
+    readonly user?: undefined;
+    readonly usedBootstrapCredential?: undefined;
+    readonly lockedUntilMs?: number;
+};
 export interface AuthUserRecord {
     readonly username: string;
     readonly roles: readonly string[];
@@ -37,14 +84,63 @@ export interface LocalAuthSnapshot {
 export declare class UserAuthManager {
     private users;
     private sessions;
+    /** Per-username failure counters for account-level lockout (independent of IP throttling). */
+    private accountLocks;
     private sessionTtlMs;
     private readonly maxSessions;
+    private readonly maxAccountLocks;
     private readonly userStorePath;
     private readonly bootstrapCredentialPath;
     private readonly persistUsers;
+    private readonly scryptParams;
+    /** Injectable clock — defaults to Date.now for production. */
+    private readonly nowFn;
     constructor(config: UserAuthConfig);
-    static hashPassword(password: string): string;
-    authenticate(username: string, password: string): AuthUser | null;
+    static hashPassword(password: string, params?: ScryptParams): string;
+    /**
+     * Authenticate username/password with per-account lockout.
+     * - Does NOT leak whether a username exists (same generic error path for unknown users).
+     * - Records failures against the username bucket (not IP) with escalating backoff.
+     * - Returns lockedUntilMs when the account is temporarily locked.
+     * - Returns usedBootstrapCredential=true when the matched credential originated from
+     *   the bootstrap credential file, so callers can defer retirement until a non-bootstrap
+     *   login succeeds.
+     */
+    authenticate(username: string, password: string): AuthenticateResult;
+    /**
+     * Record a login failure for the given username and apply escalating backoff.
+     *
+     * Thresholds are anchored ABOVE the per-IP login budget (default 5/min) so
+     * the first account lock cannot fire before the IP limiter has already
+     * throttled further attempts. This preserves the 401-then-429-by-IP contract
+     * for in-budget attempts.
+     *
+     *   1-5 failures:   no lock (IP budget exhaustion fires at attempt 6+)
+     *   6-9 failures:   30-second lock
+     *   10-19 failures: 5-minute lock
+     *   20+ failures:   30-minute lock
+     *
+     * Note: failures also increment during an active lock window (when the account
+     * is already locked and another attempt arrives). This means a lock can expire
+     * with a failure count already in a higher tier, causing the next lock after
+     * expiry to jump directly to that tier. This is intentional: repeated attempts
+     * during a lock are themselves failures and escalate the penalty schedule.
+     */
+    private _recordLoginFailure;
+    /**
+     * Evict account lock entries when the map is at capacity.
+     * Prefers entries with expired locks + no recent failures (stale entries).
+     * Falls back to the entry with the oldest/soonest-expired lock.
+     * Preserves no-username-enumeration: eviction policy is time-based, not
+     * user-existence-based.
+     */
+    private _evictAccountLockIfNeeded;
+    /**
+     * Expose account lock state for testing.
+     * Returns a defensive copy so callers cannot mutate internal state.
+     * Use the injected nowFn (via UserAuthManager constructor) to advance time in tests.
+     */
+    getAccountLockState(username: string): AccountLockState | undefined;
     getUser(username: string): AuthUserRecord | null;
     createSession(username: string): AuthSession;
     validateSession(token: string): AuthSession | null;

package/dist/platform/security/user-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../src/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAWD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AA4KD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,cAAc;IAsBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI7C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAMjE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IA0B5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAWrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAWnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}
+{"version":3,"file":"user-auth.d.ts","sourceRoot":"","sources":["../../../src/platform/security/user-auth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,cAAc;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,iHAAiH;IACjH,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uBAAuB,EAAE,MAAM,CAAC;IAChC,oHAAoH;IACpH,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CACpC;AAUD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,CAAA;CAAE,GAC7H;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAOrI,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD;AA0ND,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAkC;IAClD,8FAA8F;IAC9F,OAAO,CAAC,YAAY,CAAuC;IAC3D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAEzB,MAAM,EAAE,cAAc;IAyBlC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM;IAIpE;;;;;;;;OAQG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB;IAuCpE;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAuBjC;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAMnE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAShD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW;IA0B5C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI;IAUlD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAWrC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAW/C,SAAS,IAAI,cAAc,EAAE;IAS7B,YAAY,IAAI,iBAAiB,EAAE;IAWnC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAc,GAAG,cAAc;IAejG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAarC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAgB5D,OAAO,IAAI,iBAAiB;IAc5B,4BAA4B,IAAI,OAAO;IAMvC,0BAA0B,IAAI,MAAM;IAIpC,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,OAAO;CAIhB"}