@remnic/core 9.54.5 → 9.54.7

package/dist/chunk-37DZZFFM.js

@@ -0,0 +1,502 @@
+import {
+  SupportPassportError,
+  getOperation
+} from "./chunk-D3LBIUWV.js";
+import {
+  abortError,
+  isAbortError
+} from "./chunk-BTTPKDIL.js";
+
+// src/support-passport/public-http.ts
+import { createHash } from "crypto";
+import { isIP } from "net";
+var PUBLIC_RATE_LIMIT_MAX_KEYS = 2e4;
+var PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK = 8;
+var PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL = 256;
+var PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK = 8;
+var PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL = 256;
+var SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES = [
+  {
+    method: "GET",
+    pathname: "/engram/v1/support-passport/public/grants/:id",
+    operation: "support_passport_grant_read"
+  },
+  {
+    method: "POST",
+    pathname: "/engram/v1/support-passport/public/grants/:id/ask",
+    operation: "support_passport_grant_ask"
+  }
+];
+var UnreadSupportPassportRequestError = class extends Error {
+  constructor(response) {
+    super(response.message);
+    this.response = response;
+    this.name = "UnreadSupportPassportRequestError";
+  }
+  response;
+};
+var FixedWindowLimiter = class {
+  constructor(limit, windowMs, now) {
+    this.limit = limit;
+    this.windowMs = windowMs;
+    this.now = now;
+  }
+  limit;
+  windowMs;
+  now;
+  entries = /* @__PURE__ */ new Map();
+  consume(key) {
+    const reservation = this.reserve(key);
+    if (!reservation) return false;
+    reservation.commit();
+    return true;
+  }
+  reserve(key) {
+    const now = this.now();
+    let entry = this.entries.get(key);
+    if (!entry || entry.resetAt <= now) {
+      if (!entry && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {
+        this.prune(now);
+        if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return void 0;
+      }
+      entry = { count: 0, resetAt: now + this.windowMs };
+      this.entries.set(key, entry);
+    }
+    if (entry.count >= this.limit) return void 0;
+    entry.count += 1;
+    let active = true;
+    return {
+      commit: () => {
+        active = false;
+      },
+      release: () => {
+        if (!active) return;
+        active = false;
+        if (this.entries.get(key) !== entry) return;
+        entry.count -= 1;
+        if (entry.count === 0) this.entries.delete(key);
+      }
+    };
+  }
+  allows(key) {
+    const now = this.now();
+    const current = this.entries.get(key);
+    if (current && current.resetAt > now) return current.count < this.limit;
+    if (!current && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {
+      this.prune(now);
+      if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return false;
+    }
+    return true;
+  }
+  prune(now) {
+    for (const [key, entry] of this.entries) {
+      if (entry.resetAt <= now) this.entries.delete(key);
+    }
+  }
+};
+var InFlightLimiter = class {
+  constructor(perKeyLimit, totalLimit) {
+    this.perKeyLimit = perKeyLimit;
+    this.totalLimit = totalLimit;
+  }
+  perKeyLimit;
+  totalLimit;
+  counts = /* @__PURE__ */ new Map();
+  total = 0;
+  reserve(key) {
+    const current = this.counts.get(key) ?? 0;
+    if (current >= this.perKeyLimit || this.total >= this.totalLimit) return void 0;
+    this.counts.set(key, current + 1);
+    this.total += 1;
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      const count = this.counts.get(key) ?? 0;
+      if (count <= 1) this.counts.delete(key);
+      else this.counts.set(key, count - 1);
+      this.total -= 1;
+    };
+  }
+};
+function createRateLimits(now) {
+  return {
+    authentications: new InFlightLimiter(PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL),
+    modelCalls: new InFlightLimiter(PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL),
+    grantReads: new FixedWindowLimiter(60, 6e4, now),
+    networkReads: new FixedWindowLimiter(60, 6e4, now),
+    networkReadFailures: new FixedWindowLimiter(60, 6e4, now),
+    grantQuestions: new FixedWindowLimiter(20, 10 * 6e4, now),
+    networkQuestions: new FixedWindowLimiter(20, 10 * 6e4, now),
+    networkQuestionFailures: new FixedWindowLimiter(20, 10 * 6e4, now)
+  };
+}
+function rateLimited() {
+  return new SupportPassportError("rate_limited", "Too many helper requests.", 429);
+}
+async function runPublicOperation(service, name, input, signal) {
+  const operation = getOperation(name);
+  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);
+  const output = await operation.run(input, {
+    service,
+    ...signal ? { abortSignal: signal } : {}
+  });
+  return output.result;
+}
+function reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId) {
+  const network = networkLimiter.reserve(networkKey);
+  if (!network) throw rateLimited();
+  const grant = grantLimiter.reserve(grantId);
+  if (!grant) {
+    network.release();
+    throw rateLimited();
+  }
+  let active = true;
+  return {
+    commit: () => {
+      if (!active) return;
+      active = false;
+      network.commit();
+      grant.commit();
+    },
+    release: () => {
+      if (!active) return;
+      active = false;
+      grant.release();
+      network.release();
+    }
+  };
+}
+async function readGrantUnderAuthenticationReservation(service, grantId, secret, networkKey, networkLimiter, grantLimiter, failureLimiter) {
+  if (!failureLimiter.allows(networkKey)) throw rateLimited();
+  const limits = reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId);
+  let guide;
+  try {
+    guide = await runPublicOperation(service, "support_passport_grant_read", { grantId, secret });
+  } catch (error) {
+    if (error instanceof SupportPassportError) {
+      if (error.code === "grant_not_found") {
+        limits.release();
+        if (!failureLimiter.consume(networkKey)) throw rateLimited();
+      } else {
+        limits.commit();
+      }
+    } else {
+      limits.release();
+    }
+    throw error;
+  }
+  limits.commit();
+  return guide;
+}
+async function readGrantWithRateLimits(service, grantId, secret, networkKey, networkLimiter, grantLimiter, failureLimiter, authenticationLimiter) {
+  const releaseAuthentication = authenticationLimiter.reserve(networkKey);
+  if (!releaseAuthentication) throw rateLimited();
+  try {
+    return await readGrantUnderAuthenticationReservation(
+      service,
+      grantId,
+      secret,
+      networkKey,
+      networkLimiter,
+      grantLimiter,
+      failureLimiter
+    );
+  } finally {
+    releaseAuthentication();
+  }
+}
+function normalizeSupportPassportNetworkAddress(value) {
+  if (!value) return void 0;
+  const address = value.trim().toLowerCase();
+  const family = isIP(address);
+  if (family === 0) return void 0;
+  if (family === 4) return address;
+  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+  const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);
+  if (!mapped) return canonical;
+  const high = Number.parseInt(mapped[1] ?? "", 16);
+  const low = Number.parseInt(mapped[2] ?? "", 16);
+  return `${high >>> 8}.${high & 255}.${low >>> 8}.${low & 255}`;
+}
+function requestNetworkAddress(req, trustedProxyAddresses) {
+  const directAddress = normalizeSupportPassportNetworkAddress(req.socket.remoteAddress) ?? "unknown";
+  if (!trustedProxyAddresses.has(directAddress)) return directAddress;
+  const forwarded = req.headers["x-forwarded-for"];
+  if (typeof forwarded !== "string") return directAddress;
+  const rawAddresses = forwarded.split(",");
+  if (rawAddresses.length < 1 || rawAddresses.length > 32) return directAddress;
+  const addresses = rawAddresses.map((address) => normalizeSupportPassportNetworkAddress(address));
+  if (addresses.some((address) => address === void 0)) return directAddress;
+  for (let index = addresses.length - 1; index >= 0; index -= 1) {
+    const address = addresses[index];
+    if (address && !trustedProxyAddresses.has(address)) return address;
+  }
+  return addresses[0] ?? directAddress;
+}
+function networkDigest(req, trustedProxyAddresses) {
+  return createHash("sha256").update(requestNetworkAddress(req, trustedProxyAddresses)).digest("hex");
+}
+function parseSecret(req) {
+  const raw = req.headers.authorization;
+  if (typeof raw !== "string") return void 0;
+  const match = /^(\S+)[ \t]+(\S+)$/.exec(raw);
+  if (!match || match[1]?.toLowerCase() !== "supportpassport") return void 0;
+  const secret = match[2] ?? "";
+  if (!/^[A-Za-z0-9_-]{32,256}$/.test(secret)) return void 0;
+  return secret;
+}
+function requestDeclaresBody(req) {
+  const contentLength = req.headers["content-length"];
+  const transferEncoding = req.headers["transfer-encoding"];
+  return transferEncoding !== void 0 || contentLength !== void 0 && contentLength !== "0";
+}
+function respondJson(res, status, payload) {
+  const body = JSON.stringify(payload);
+  res.statusCode = status;
+  res.setHeader("cache-control", "private, no-store");
+  res.setHeader("vary", "Authorization");
+  res.setHeader("content-type", "application/json; charset=utf-8");
+  res.setHeader("content-length", String(Buffer.byteLength(body)));
+  res.end(body);
+}
+function respondJsonAndCloseUnreadRequest(req, res, status, payload) {
+  res.shouldKeepAlive = false;
+  res.setHeader("connection", "close");
+  res.once("finish", () => req.destroy());
+  respondJson(res, status, payload);
+}
+function respondBeforeReadingBody(req, res, status, payload) {
+  if (requestDeclaresBody(req)) {
+    respondJsonAndCloseUnreadRequest(req, res, status, payload);
+    return;
+  }
+  respondJson(res, status, payload);
+}
+async function readQuestionBody(req, signal) {
+  const content = await new Promise((resolve, reject) => {
+    const chunks = [];
+    let bytes = 0;
+    let settled = false;
+    const cleanup = () => {
+      req.off("data", onData);
+      req.off("end", onEnd);
+      req.off("error", onError);
+      req.off("aborted", onAborted);
+      signal.removeEventListener("abort", onSignalAbort);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    const helperLeft = () => isAbortError(signal.reason) ? signal.reason : abortError("The helper left.");
+    const onData = (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      bytes += buffer.length;
+      if (bytes > 4096) {
+        req.pause();
+        fail(
+          new UnreadSupportPassportRequestError(
+            new SupportPassportError("invalid_input", "The helper question is invalid.", 400)
+          )
+        );
+        return;
+      }
+      chunks.push(buffer);
+    };
+    const onEnd = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(Buffer.concat(chunks, bytes));
+    };
+    const onError = (error) => fail(signal.aborted || req.aborted ? helperLeft() : error);
+    const onAborted = () => fail(helperLeft());
+    const onSignalAbort = () => fail(helperLeft());
+    req.on("data", onData);
+    req.once("end", onEnd);
+    req.once("error", onError);
+    req.once("aborted", onAborted);
+    signal.addEventListener("abort", onSignalAbort, { once: true });
+    if (signal.aborted) onSignalAbort();
+  });
+  let parsed;
+  try {
+    parsed = JSON.parse(content.toString("utf8"));
+  } catch {
+    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
+  }
+  const body = parsed;
+  if (Object.keys(body).length !== 1 || typeof body.question !== "string") {
+    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
+  }
+  const question = body.question.trim();
+  if (question.length < 1 || question.length > 500) {
+    throw new SupportPassportError("invalid_input", "The helper question is invalid.", 400);
+  }
+  return question;
+}
+function requestSignal(req, res) {
+  const controller = new AbortController();
+  const abort = () => {
+    if (!res.writableFinished && !controller.signal.aborted) controller.abort(abortError("The helper left."));
+  };
+  req.once("aborted", abort);
+  res.once("close", abort);
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      req.off("aborted", abort);
+      res.off("close", abort);
+    }
+  };
+}
+function decodeGrantId(raw) {
+  try {
+    const value = decodeURIComponent(raw);
+    return /^[A-Za-z0-9_-]{1,128}$/.test(value) ? value.toLowerCase() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function buildSupportPassportPublicRequestHandler(service, options = {}) {
+  const rateLimits = createRateLimits(options.now ?? Date.now);
+  const trustedProxyAddresses = new Set(
+    (options.trustedProxyAddresses ?? []).map((address) => normalizeSupportPassportNetworkAddress(address)).filter((address) => address !== void 0)
+  );
+  return async (req, res) => {
+    let parsed;
+    try {
+      parsed = new URL(req.url ?? "/", "http://placeholder");
+    } catch {
+      return false;
+    }
+    const readMatch = /^\/engram\/v1\/support-passport\/public\/grants\/([^/]+)$/.exec(parsed.pathname);
+    const askMatch = /^\/engram\/v1\/support-passport\/public\/grants\/([^/]+)\/ask$/.exec(parsed.pathname);
+    const ownedRead = req.method === "GET" && readMatch;
+    const ownedQuestion = req.method === "POST" && askMatch;
+    if (!ownedRead && !ownedQuestion) return false;
+    res.setHeader("cache-control", "private, no-store");
+    res.setHeader("vary", "Authorization");
+    const grantId = decodeGrantId((ownedRead ? readMatch?.[1] : askMatch?.[1]) ?? "");
+    const secret = parseSecret(req);
+    if (parsed.search.length > 0) {
+      respondBeforeReadingBody(req, res, 400, {
+        error: "The share link request is invalid.",
+        code: "invalid_input"
+      });
+      return true;
+    }
+    if (ownedRead && requestDeclaresBody(req)) {
+      respondJsonAndCloseUnreadRequest(req, res, 400, {
+        error: "The share link request is invalid.",
+        code: "invalid_input"
+      });
+      return true;
+    }
+    if (!grantId || !secret) {
+      respondBeforeReadingBody(req, res, 404, {
+        error: "The share link was not found.",
+        code: "grant_not_found"
+      });
+      return true;
+    }
+    const lifecycle = requestSignal(req, res);
+    try {
+      const digest = networkDigest(req, trustedProxyAddresses);
+      if (ownedRead) {
+        const guide = await readGrantWithRateLimits(
+          service,
+          grantId,
+          secret,
+          digest,
+          rateLimits.networkReads,
+          rateLimits.grantReads,
+          rateLimits.networkReadFailures,
+          rateLimits.authentications
+        );
+        respondJson(res, 200, guide);
+      } else {
+        let releaseAuthentication = rateLimits.authentications.reserve(digest);
+        if (!releaseAuthentication) throw new UnreadSupportPassportRequestError(rateLimited());
+        try {
+          let question;
+          const bodyFailure = rateLimits.networkQuestionFailures.reserve(digest);
+          if (!bodyFailure) throw new UnreadSupportPassportRequestError(rateLimited());
+          try {
+            question = await readQuestionBody(req, lifecycle.signal);
+            bodyFailure.release();
+          } catch (error) {
+            const supportError = error instanceof UnreadSupportPassportRequestError ? error.response : error;
+            if (supportError instanceof SupportPassportError && supportError.code === "invalid_input") {
+              bodyFailure.commit();
+            } else {
+              bodyFailure.release();
+            }
+            throw error;
+          }
+          const releaseModelCall = rateLimits.modelCalls.reserve(digest);
+          if (!releaseModelCall) throw rateLimited();
+          try {
+            await readGrantUnderAuthenticationReservation(
+              service,
+              grantId,
+              secret,
+              digest,
+              rateLimits.networkQuestions,
+              rateLimits.grantQuestions,
+              rateLimits.networkQuestionFailures
+            );
+            releaseAuthentication();
+            releaseAuthentication = void 0;
+            const answer = await runPublicOperation(
+              service,
+              "support_passport_grant_ask",
+              { grantId, secret, question },
+              lifecycle.signal
+            );
+            respondJson(res, 200, answer);
+          } finally {
+            releaseModelCall();
+          }
+        } finally {
+          releaseAuthentication?.();
+        }
+      }
+    } catch (error) {
+      if (error instanceof UnreadSupportPassportRequestError) {
+        respondJsonAndCloseUnreadRequest(req, res, error.response.status, {
+          error: error.response.message,
+          code: error.response.code
+        });
+        return true;
+      }
+      if (!(error instanceof SupportPassportError)) throw error;
+      respondJson(res, error.status, { error: error.message, code: error.code });
+    } finally {
+      lifecycle.cleanup();
+    }
+    return true;
+  };
+}
+function composeSupportPassportExternalRequestHandlers(...handlers) {
+  return async (req, res, ctx) => {
+    for (const handler of handlers) {
+      if (handler && await handler(req, res, ctx)) return true;
+    }
+    return false;
+  };
+}
+
+export {
+  SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES,
+  normalizeSupportPassportNetworkAddress,
+  buildSupportPassportPublicRequestHandler,
+  composeSupportPassportExternalRequestHandlers
+};
+//# sourceMappingURL=chunk-37DZZFFM.js.map

package/dist/chunk-37DZZFFM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/support-passport/public-http.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { isIP } from \"node:net\";\n\nimport { abortError, isAbortError } from \"../abort-error.js\";\nimport { type OperationName, getOperation } from \"../access-boundary.js\";\nimport type { EngramAccessService } from \"../access-service.js\";\nimport { SupportPassportError } from \"./errors.js\";\n\nconst PUBLIC_RATE_LIMIT_MAX_KEYS = 20_000;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL = 256;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL = 256;\n\nexport const SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES = [\n  {\n    method: \"GET\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id\",\n    operation: \"support_passport_grant_read\",\n  },\n  {\n    method: \"POST\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id/ask\",\n    operation: \"support_passport_grant_ask\",\n  },\n] as const satisfies ReadonlyArray<{ method: string; pathname: string; operation: OperationName }>;\n\nexport type SupportPassportExternalRequestHandler = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  ctx: {\n    authorized: boolean;\n    tokenAuthorized: boolean;\n  }\n) => Promise<boolean>;\n\ninterface WindowEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface WindowReservation {\n  commit(): void;\n  release(): void;\n}\n\nclass UnreadSupportPassportRequestError extends Error {\n  constructor(readonly response: SupportPassportError) {\n    super(response.message);\n    this.name = \"UnreadSupportPassportRequestError\";\n  }\n}\n\nclass FixedWindowLimiter {\n  private readonly entries = new Map<string, WindowEntry>();\n\n  constructor(\n    private readonly limit: number,\n    private readonly windowMs: number,\n    private readonly now: () => number\n  ) {}\n\n  consume(key: string): boolean {\n    const reservation = this.reserve(key);\n    if (!reservation) return false;\n    reservation.commit();\n    return true;\n  }\n\n  reserve(key: string): WindowReservation | undefined {\n    const now = this.now();\n    let entry = this.entries.get(key);\n    if (!entry || entry.resetAt <= now) {\n      if (!entry && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n        this.prune(now);\n        if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return undefined;\n      }\n      entry = { count: 0, resetAt: now + this.windowMs };\n      this.entries.set(key, entry);\n    }\n    if (entry.count >= this.limit) return undefined;\n    entry.count += 1;\n    let active = true;\n    return {\n      commit: () => {\n        active = false;\n      },\n      release: () => {\n        if (!active) return;\n        active = false;\n        if (this.entries.get(key) !== entry) return;\n        entry.count -= 1;\n        if (entry.count === 0) this.entries.delete(key);\n      },\n    };\n  }\n\n  allows(key: string): boolean {\n    const now = this.now();\n    const current = this.entries.get(key);\n    if (current && current.resetAt > now) return current.count < this.limit;\n    if (!current && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n      this.prune(now);\n      if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return false;\n    }\n    return true;\n  }\n\n  private prune(now: number): void {\n    for (const [key, entry] of this.entries) {\n      if (entry.resetAt <= now) this.entries.delete(key);\n    }\n  }\n}\n\nclass InFlightLimiter {\n  private readonly counts = new Map<string, number>();\n  private total = 0;\n\n  constructor(\n    private readonly perKeyLimit: number,\n    private readonly totalLimit: number\n  ) {}\n\n  reserve(key: string): (() => void) | undefined {\n    const current = this.counts.get(key) ?? 0;\n    if (current >= this.perKeyLimit || this.total >= this.totalLimit) return undefined;\n    this.counts.set(key, current + 1);\n    this.total += 1;\n    let active = true;\n    return () => {\n      if (!active) return;\n      active = false;\n      const count = this.counts.get(key) ?? 0;\n      if (count <= 1) this.counts.delete(key);\n      else this.counts.set(key, count - 1);\n      this.total -= 1;\n    };\n  }\n}\n\ninterface PublicRateLimits {\n  authentications: InFlightLimiter;\n  modelCalls: InFlightLimiter;\n  grantReads: FixedWindowLimiter;\n  networkReads: FixedWindowLimiter;\n  networkReadFailures: FixedWindowLimiter;\n  grantQuestions: FixedWindowLimiter;\n  networkQuestions: FixedWindowLimiter;\n  networkQuestionFailures: FixedWindowLimiter;\n}\n\nexport interface SupportPassportPublicHandlerOptions {\n  now?: () => number;\n  trustedProxyAddresses?: readonly string[];\n}\n\nfunction createRateLimits(now: () => number): PublicRateLimits {\n  return {\n    authentications: new InFlightLimiter(PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL),\n    modelCalls: new InFlightLimiter(PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL),\n    grantReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReadFailures: new FixedWindowLimiter(60, 60_000, now),\n    grantQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestionFailures: new FixedWindowLimiter(20, 10 * 60_000, now),\n  };\n}\n\nfunction rateLimited(): SupportPassportError {\n  return new SupportPassportError(\"rate_limited\", \"Too many helper requests.\", 429);\n}\n\nasync function runPublicOperation(\n  service: EngramAccessService,\n  name: \"support_passport_grant_read\" | \"support_passport_grant_ask\",\n  input: Record<string, unknown>,\n  signal?: AbortSignal\n): Promise<unknown> {\n  const operation = getOperation(name);\n  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);\n  const output = (await operation.run(input, {\n    service,\n    ...(signal ? { abortSignal: signal } : {}),\n  })) as { result: unknown };\n  return output.result;\n}\n\nfunction reserveAuthenticatedLimits(\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  networkKey: string,\n  grantId: string\n): WindowReservation {\n  const network = networkLimiter.reserve(networkKey);\n  if (!network) throw rateLimited();\n  const grant = grantLimiter.reserve(grantId);\n  if (!grant) {\n    network.release();\n    throw rateLimited();\n  }\n  let active = true;\n  return {\n    commit: () => {\n      if (!active) return;\n      active = false;\n      network.commit();\n      grant.commit();\n    },\n    release: () => {\n      if (!active) return;\n      active = false;\n      grant.release();\n      network.release();\n    },\n  };\n}\n\nasync function readGrantUnderAuthenticationReservation(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter\n) {\n  if (!failureLimiter.allows(networkKey)) throw rateLimited();\n  const limits = reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId);\n  let guide: Awaited<ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>>;\n  try {\n    guide = (await runPublicOperation(service, \"support_passport_grant_read\", { grantId, secret })) as Awaited<\n      ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>\n    >;\n  } catch (error) {\n    if (error instanceof SupportPassportError) {\n      if (error.code === \"grant_not_found\") {\n        limits.release();\n        if (!failureLimiter.consume(networkKey)) throw rateLimited();\n      } else {\n        limits.commit();\n      }\n    } else {\n      limits.release();\n    }\n    throw error;\n  }\n  limits.commit();\n  return guide;\n}\n\nasync function readGrantWithRateLimits(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter,\n  authenticationLimiter: InFlightLimiter\n) {\n  const releaseAuthentication = authenticationLimiter.reserve(networkKey);\n  if (!releaseAuthentication) throw rateLimited();\n  try {\n    return await readGrantUnderAuthenticationReservation(\n      service,\n      grantId,\n      secret,\n      networkKey,\n      networkLimiter,\n      grantLimiter,\n      failureLimiter\n    );\n  } finally {\n    releaseAuthentication();\n  }\n}\n\nexport function normalizeSupportPassportNetworkAddress(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  const address = value.trim().toLowerCase();\n  const family = isIP(address);\n  if (family === 0) return undefined;\n  if (family === 4) return address;\n  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);\n  const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);\n  if (!mapped) return canonical;\n  const high = Number.parseInt(mapped[1] ?? \"\", 16);\n  const low = Number.parseInt(mapped[2] ?? \"\", 16);\n  return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;\n}\n\nfunction requestNetworkAddress(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  const directAddress = normalizeSupportPassportNetworkAddress(req.socket.remoteAddress) ?? \"unknown\";\n  if (!trustedProxyAddresses.has(directAddress)) return directAddress;\n  const forwarded = req.headers[\"x-forwarded-for\"];\n  if (typeof forwarded !== \"string\") return directAddress;\n  const rawAddresses = forwarded.split(\",\");\n  if (rawAddresses.length < 1 || rawAddresses.length > 32) return directAddress;\n  const addresses = rawAddresses.map((address) => normalizeSupportPassportNetworkAddress(address));\n  if (addresses.some((address) => address === undefined)) return directAddress;\n  for (let index = addresses.length - 1; index >= 0; index -= 1) {\n    const address = addresses[index];\n    if (address && !trustedProxyAddresses.has(address)) return address;\n  }\n  return addresses[0] ?? directAddress;\n}\n\nfunction networkDigest(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  return createHash(\"sha256\")\n    .update(requestNetworkAddress(req, trustedProxyAddresses))\n    .digest(\"hex\");\n}\n\nfunction parseSecret(req: IncomingMessage): string | undefined {\n  const raw = req.headers.authorization;\n  if (typeof raw !== \"string\") return undefined;\n  const match = /^(\\S+)[ \\t]+(\\S+)$/.exec(raw);\n  if (!match || match[1]?.toLowerCase() !== \"supportpassport\") return undefined;\n  const secret = match[2] ?? \"\";\n  if (!/^[A-Za-z0-9_-]{32,256}$/.test(secret)) return undefined;\n  return secret;\n}\n\nfunction requestDeclaresBody(req: IncomingMessage): boolean {\n  const contentLength = req.headers[\"content-length\"];\n  const transferEncoding = req.headers[\"transfer-encoding\"];\n  return transferEncoding !== undefined || (contentLength !== undefined && contentLength !== \"0\");\n}\n\nfunction respondJson(res: ServerResponse, status: number, payload: unknown): void {\n  const body = JSON.stringify(payload);\n  res.statusCode = status;\n  res.setHeader(\"cache-control\", \"private, no-store\");\n  res.setHeader(\"vary\", \"Authorization\");\n  res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n  res.setHeader(\"content-length\", String(Buffer.byteLength(body)));\n  res.end(body);\n}\n\nfunction respondJsonAndCloseUnreadRequest(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  res.shouldKeepAlive = false;\n  res.setHeader(\"connection\", \"close\");\n  res.once(\"finish\", () => req.destroy());\n  respondJson(res, status, payload);\n}\n\nfunction respondBeforeReadingBody(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  if (requestDeclaresBody(req)) {\n    respondJsonAndCloseUnreadRequest(req, res, status, payload);\n    return;\n  }\n  respondJson(res, status, payload);\n}\n\nasync function readQuestionBody(req: IncomingMessage, signal: AbortSignal): Promise<string> {\n  const content = await new Promise<Buffer>((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let bytes = 0;\n    let settled = false;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      req.off(\"aborted\", onAborted);\n      signal.removeEventListener(\"abort\", onSignalAbort);\n    };\n    const fail = (error: unknown) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      reject(error);\n    };\n    const helperLeft = () =>\n      isAbortError(signal.reason) ? signal.reason : abortError(\"The helper left.\");\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n      bytes += buffer.length;\n      if (bytes > 4_096) {\n        req.pause();\n        fail(\n          new UnreadSupportPassportRequestError(\n            new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400)\n          )\n        );\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      resolve(Buffer.concat(chunks, bytes));\n    };\n    const onError = (error: Error) => fail(signal.aborted || req.aborted ? helperLeft() : error);\n    const onAborted = () => fail(helperLeft());\n    const onSignalAbort = () => fail(helperLeft());\n    req.on(\"data\", onData);\n    req.once(\"end\", onEnd);\n    req.once(\"error\", onError);\n    req.once(\"aborted\", onAborted);\n    signal.addEventListener(\"abort\", onSignalAbort, { once: true });\n    if (signal.aborted) onSignalAbort();\n  });\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(content.toString(\"utf8\"));\n  } catch {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const body = parsed as Record<string, unknown>;\n  if (Object.keys(body).length !== 1 || typeof body.question !== \"string\") {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const question = body.question.trim();\n  if (question.length < 1 || question.length > 500) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  return question;\n}\n\nfunction requestSignal(req: IncomingMessage, res: ServerResponse): { signal: AbortSignal; cleanup(): void } {\n  const controller = new AbortController();\n  const abort = () => {\n    if (!res.writableFinished && !controller.signal.aborted) controller.abort(abortError(\"The helper left.\"));\n  };\n  req.once(\"aborted\", abort);\n  res.once(\"close\", abort);\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      req.off(\"aborted\", abort);\n      res.off(\"close\", abort);\n    },\n  };\n}\n\nfunction decodeGrantId(raw: string): string | undefined {\n  try {\n    const value = decodeURIComponent(raw);\n    return /^[A-Za-z0-9_-]{1,128}$/.test(value) ? value.toLowerCase() : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildSupportPassportPublicRequestHandler(\n  service: EngramAccessService,\n  options: SupportPassportPublicHandlerOptions = {}\n): SupportPassportExternalRequestHandler {\n  const rateLimits = createRateLimits(options.now ?? Date.now);\n  const trustedProxyAddresses = new Set(\n    (options.trustedProxyAddresses ?? [])\n      .map((address) => normalizeSupportPassportNetworkAddress(address))\n      .filter((address): address is string => address !== undefined)\n  );\n  return async (req, res) => {\n    let parsed: URL;\n    try {\n      parsed = new URL(req.url ?? \"/\", \"http://placeholder\");\n    } catch {\n      return false;\n    }\n    const readMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)$/.exec(parsed.pathname);\n    const askMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)\\/ask$/.exec(parsed.pathname);\n    const ownedRead = req.method === \"GET\" && readMatch;\n    const ownedQuestion = req.method === \"POST\" && askMatch;\n    if (!ownedRead && !ownedQuestion) return false;\n\n    res.setHeader(\"cache-control\", \"private, no-store\");\n    res.setHeader(\"vary\", \"Authorization\");\n    const grantId = decodeGrantId((ownedRead ? readMatch?.[1] : askMatch?.[1]) ?? \"\");\n    const secret = parseSecret(req);\n    if (parsed.search.length > 0) {\n      respondBeforeReadingBody(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (ownedRead && requestDeclaresBody(req)) {\n      respondJsonAndCloseUnreadRequest(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (!grantId || !secret) {\n      respondBeforeReadingBody(req, res, 404, {\n        error: \"The share link was not found.\",\n        code: \"grant_not_found\",\n      });\n      return true;\n    }\n\n    const lifecycle = requestSignal(req, res);\n    try {\n      const digest = networkDigest(req, trustedProxyAddresses);\n      if (ownedRead) {\n        const guide = await readGrantWithRateLimits(\n          service,\n          grantId,\n          secret,\n          digest,\n          rateLimits.networkReads,\n          rateLimits.grantReads,\n          rateLimits.networkReadFailures,\n          rateLimits.authentications\n        );\n        respondJson(res, 200, guide);\n      } else {\n        let releaseAuthentication = rateLimits.authentications.reserve(digest);\n        if (!releaseAuthentication) throw new UnreadSupportPassportRequestError(rateLimited());\n        try {\n          let question: string;\n          const bodyFailure = rateLimits.networkQuestionFailures.reserve(digest);\n          if (!bodyFailure) throw new UnreadSupportPassportRequestError(rateLimited());\n          try {\n            question = await readQuestionBody(req, lifecycle.signal);\n            bodyFailure.release();\n          } catch (error) {\n            const supportError =\n              error instanceof UnreadSupportPassportRequestError ? error.response : error;\n            if (supportError instanceof SupportPassportError && supportError.code === \"invalid_input\") {\n              bodyFailure.commit();\n            } else {\n              bodyFailure.release();\n            }\n            throw error;\n          }\n          const releaseModelCall = rateLimits.modelCalls.reserve(digest);\n          if (!releaseModelCall) throw rateLimited();\n          try {\n            await readGrantUnderAuthenticationReservation(\n              service,\n              grantId,\n              secret,\n              digest,\n              rateLimits.networkQuestions,\n              rateLimits.grantQuestions,\n              rateLimits.networkQuestionFailures\n            );\n            releaseAuthentication();\n            releaseAuthentication = undefined;\n            const answer = await runPublicOperation(\n              service,\n              \"support_passport_grant_ask\",\n              { grantId, secret, question },\n              lifecycle.signal\n            );\n            respondJson(res, 200, answer);\n          } finally {\n            releaseModelCall();\n          }\n        } finally {\n          releaseAuthentication?.();\n        }\n      }\n    } catch (error) {\n      if (error instanceof UnreadSupportPassportRequestError) {\n        respondJsonAndCloseUnreadRequest(req, res, error.response.status, {\n          error: error.response.message,\n          code: error.response.code,\n        });\n        return true;\n      }\n      if (!(error instanceof SupportPassportError)) throw error;\n      respondJson(res, error.status, { error: error.message, code: error.code });\n    } finally {\n      lifecycle.cleanup();\n    }\n    return true;\n  };\n}\n\nexport function composeSupportPassportExternalRequestHandlers(\n  ...handlers: Array<SupportPassportExternalRequestHandler | undefined>\n): SupportPassportExternalRequestHandler {\n  return async (req, res, ctx) => {\n    for (const handler of handlers) {\n      if (handler && (await handler(req, res, ctx))) return true;\n    }\n    return false;\n  };\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,kBAAkB;AAE3B,SAAS,YAAY;AAOrB,IAAM,6BAA6B;AACnC,IAAM,wCAAwC;AAC9C,IAAM,kCAAkC;AACxC,IAAM,yCAAyC;AAC/C,IAAM,mCAAmC;AAElC,IAAM,sCAAsC;AAAA,EACjD;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACF;AAqBA,IAAM,oCAAN,cAAgD,MAAM;AAAA,EACpD,YAAqB,UAAgC;AACnD,UAAM,SAAS,OAAO;AADH;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAEA,IAAM,qBAAN,MAAyB;AAAA,EAGvB,YACmB,OACA,UACA,KACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EALF,UAAU,oBAAI,IAAyB;AAAA,EAQxD,QAAQ,KAAsB;AAC5B,UAAM,cAAc,KAAK,QAAQ,GAAG;AACpC,QAAI,CAAC,YAAa,QAAO;AACzB,gBAAY,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,KAA4C;AAClD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAChC,QAAI,CAAC,SAAS,MAAM,WAAW,KAAK;AAClC,UAAI,CAAC,SAAS,KAAK,QAAQ,QAAQ,4BAA4B;AAC7D,aAAK,MAAM,GAAG;AACd,YAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,MAC9D;AACA,cAAQ,EAAE,OAAO,GAAG,SAAS,MAAM,KAAK,SAAS;AACjD,WAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC7B;AACA,QAAI,MAAM,SAAS,KAAK,MAAO,QAAO;AACtC,UAAM,SAAS;AACf,QAAI,SAAS;AACb,WAAO;AAAA,MACL,QAAQ,MAAM;AACZ,iBAAS;AAAA,MACX;AAAA,MACA,SAAS,MAAM;AACb,YAAI,CAAC,OAAQ;AACb,iBAAS;AACT,YAAI,KAAK,QAAQ,IAAI,GAAG,MAAM,MAAO;AACrC,cAAM,SAAS;AACf,YAAI,MAAM,UAAU,EAAG,MAAK,QAAQ,OAAO,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,KAAK,QAAQ,IAAI,GAAG;AACpC,QAAI,WAAW,QAAQ,UAAU,IAAK,QAAO,QAAQ,QAAQ,KAAK;AAClE,QAAI,CAAC,WAAW,KAAK,QAAQ,QAAQ,4BAA4B;AAC/D,WAAK,MAAM,GAAG;AACd,UAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,KAAmB;AAC/B,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,UAAI,MAAM,WAAW,IAAK,MAAK,QAAQ,OAAO,GAAG;AAAA,IACnD;AAAA,EACF;AACF;AAEA,IAAM,kBAAN,MAAsB;AAAA,EAIpB,YACmB,aACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EALF,SAAS,oBAAI,IAAoB;AAAA,EAC1C,QAAQ;AAAA,EAOhB,QAAQ,KAAuC;AAC7C,UAAM,UAAU,KAAK,OAAO,IAAI,GAAG,KAAK;AACxC,QAAI,WAAW,KAAK,eAAe,KAAK,SAAS,KAAK,WAAY,QAAO;AACzE,SAAK,OAAO,IAAI,KAAK,UAAU,CAAC;AAChC,SAAK,SAAS;AACd,QAAI,SAAS;AACb,WAAO,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ,KAAK,OAAO,IAAI,GAAG,KAAK;AACtC,UAAI,SAAS,EAAG,MAAK,OAAO,OAAO,GAAG;AAAA,UACjC,MAAK,OAAO,IAAI,KAAK,QAAQ,CAAC;AACnC,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AACF;AAkBA,SAAS,iBAAiB,KAAqC;AAC7D,SAAO;AAAA,IACL,iBAAiB,IAAI,gBAAgB,uCAAuC,+BAA+B;AAAA,IAC3G,YAAY,IAAI,gBAAgB,wCAAwC,gCAAgC;AAAA,IACxG,YAAY,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAClD,cAAc,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IACpD,qBAAqB,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAC3D,gBAAgB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC3D,kBAAkB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC7D,yBAAyB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,EACtE;AACF;AAEA,SAAS,cAAoC;AAC3C,SAAO,IAAI,qBAAqB,gBAAgB,6BAA6B,GAAG;AAClF;AAEA,eAAe,mBACb,SACA,MACA,OACA,QACkB;AAClB,QAAM,YAAY,aAAa,IAAI;AACnC,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AACpF,QAAM,SAAU,MAAM,UAAU,IAAI,OAAO;AAAA,IACzC;AAAA,IACA,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,SAAO,OAAO;AAChB;AAEA,SAAS,2BACP,gBACA,cACA,YACA,SACmB;AACnB,QAAM,UAAU,eAAe,QAAQ,UAAU;AACjD,MAAI,CAAC,QAAS,OAAM,YAAY;AAChC,QAAM,QAAQ,aAAa,QAAQ,OAAO;AAC1C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ;AAChB,UAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS;AACb,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,cAAQ,OAAO;AACf,YAAM,OAAO;AAAA,IACf;AAAA,IACA,SAAS,MAAM;AACb,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ;AACd,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AACF;AAEA,eAAe,wCACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA;AACA,MAAI,CAAC,eAAe,OAAO,UAAU,EAAG,OAAM,YAAY;AAC1D,QAAM,SAAS,2BAA2B,gBAAgB,cAAc,YAAY,OAAO;AAC3F,MAAI;AACJ,MAAI;AACF,YAAS,MAAM,mBAAmB,SAAS,+BAA+B,EAAE,SAAS,OAAO,CAAC;AAAA,EAG/F,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,UAAI,MAAM,SAAS,mBAAmB;AACpC,eAAO,QAAQ;AACf,YAAI,CAAC,eAAe,QAAQ,UAAU,EAAG,OAAM,YAAY;AAAA,MAC7D,OAAO;AACL,eAAO,OAAO;AAAA,MAChB;AAAA,IACF,OAAO;AACL,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AACA,SAAO,OAAO;AACd,SAAO;AACT;AAEA,eAAe,wBACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA,uBACA;AACA,QAAM,wBAAwB,sBAAsB,QAAQ,UAAU;AACtE,MAAI,CAAC,sBAAuB,OAAM,YAAY;AAC9C,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,0BAAsB;AAAA,EACxB;AACF;AAEO,SAAS,uCAAuC,OAA+C;AACpG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,WAAW,EAAG,QAAO;AACzB,QAAM,YAAY,IAAI,IAAI,WAAW,OAAO,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE;AACtE,QAAM,SAAS,2CAA2C,KAAK,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAChD,QAAM,MAAM,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAC/C,SAAO,GAAG,SAAS,CAAC,IAAI,OAAO,GAAI,IAAI,QAAQ,CAAC,IAAI,MAAM,GAAI;AAChE;AAEA,SAAS,sBAAsB,KAAsB,uBAAoD;AACvG,QAAM,gBAAgB,uCAAuC,IAAI,OAAO,aAAa,KAAK;AAC1F,MAAI,CAAC,sBAAsB,IAAI,aAAa,EAAG,QAAO;AACtD,QAAM,YAAY,IAAI,QAAQ,iBAAiB;AAC/C,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,QAAM,eAAe,UAAU,MAAM,GAAG;AACxC,MAAI,aAAa,SAAS,KAAK,aAAa,SAAS,GAAI,QAAO;AAChE,QAAM,YAAY,aAAa,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC;AAC/F,MAAI,UAAU,KAAK,CAAC,YAAY,YAAY,MAAS,EAAG,QAAO;AAC/D,WAAS,QAAQ,UAAU,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AAC7D,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,WAAW,CAAC,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAAA,EAC7D;AACA,SAAO,UAAU,CAAC,KAAK;AACzB;AAEA,SAAS,cAAc,KAAsB,uBAAoD;AAC/F,SAAO,WAAW,QAAQ,EACvB,OAAO,sBAAsB,KAAK,qBAAqB,CAAC,EACxD,OAAO,KAAK;AACjB;AAEA,SAAS,YAAY,KAA0C;AAC7D,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,qBAAqB,KAAK,GAAG;AAC3C,MAAI,CAAC,SAAS,MAAM,CAAC,GAAG,YAAY,MAAM,kBAAmB,QAAO;AACpE,QAAM,SAAS,MAAM,CAAC,KAAK;AAC3B,MAAI,CAAC,0BAA0B,KAAK,MAAM,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,KAA+B;AAC1D,QAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAClD,QAAM,mBAAmB,IAAI,QAAQ,mBAAmB;AACxD,SAAO,qBAAqB,UAAc,kBAAkB,UAAa,kBAAkB;AAC7F;AAEA,SAAS,YAAY,KAAqB,QAAgB,SAAwB;AAChF,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,MAAI,aAAa;AACjB,MAAI,UAAU,iBAAiB,mBAAmB;AAClD,MAAI,UAAU,QAAQ,eAAe;AACrC,MAAI,UAAU,gBAAgB,iCAAiC;AAC/D,MAAI,UAAU,kBAAkB,OAAO,OAAO,WAAW,IAAI,CAAC,CAAC;AAC/D,MAAI,IAAI,IAAI;AACd;AAEA,SAAS,iCACP,KACA,KACA,QACA,SACM;AACN,MAAI,kBAAkB;AACtB,MAAI,UAAU,cAAc,OAAO;AACnC,MAAI,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC;AACtC,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,SAAS,yBACP,KACA,KACA,QACA,SACM;AACN,MAAI,oBAAoB,GAAG,GAAG;AAC5B,qCAAiC,KAAK,KAAK,QAAQ,OAAO;AAC1D;AAAA,EACF;AACA,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,eAAe,iBAAiB,KAAsB,QAAsC;AAC1F,QAAM,UAAU,MAAM,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC7D,UAAM,SAAmB,CAAC;AAC1B,QAAI,QAAQ;AACZ,QAAI,UAAU;AACd,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,UAAI,IAAI,WAAW,SAAS;AAC5B,aAAO,oBAAoB,SAAS,aAAa;AAAA,IACnD;AACA,UAAM,OAAO,CAAC,UAAmB;AAC/B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,aAAO,KAAK;AAAA,IACd;AACA,UAAM,aAAa,MACjB,aAAa,OAAO,MAAM,IAAI,OAAO,SAAS,WAAW,kBAAkB;AAC7E,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;AACjE,eAAS,OAAO;AAChB,UAAI,QAAQ,MAAO;AACjB,YAAI,MAAM;AACV;AAAA,UACE,IAAI;AAAA,YACF,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,UAClF;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM;AAClB,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,cAAQ,OAAO,OAAO,QAAQ,KAAK,CAAC;AAAA,IACtC;AACA,UAAM,UAAU,CAAC,UAAiB,KAAK,OAAO,WAAW,IAAI,UAAU,WAAW,IAAI,KAAK;AAC3F,UAAM,YAAY,MAAM,KAAK,WAAW,CAAC;AACzC,UAAM,gBAAgB,MAAM,KAAK,WAAW,CAAC;AAC7C,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,KAAK,OAAO,KAAK;AACrB,QAAI,KAAK,SAAS,OAAO;AACzB,QAAI,KAAK,WAAW,SAAS;AAC7B,WAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;AAC9D,QAAI,OAAO,QAAS,eAAc;AAAA,EACpC,CAAC;AACD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,QAAQ,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,OAAO;AACb,MAAI,OAAO,KAAK,IAAI,EAAE,WAAW,KAAK,OAAO,KAAK,aAAa,UAAU;AACvE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,WAAW,KAAK,SAAS,KAAK;AACpC,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,KAAK;AAChD,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAsB,KAA+D;AAC1G,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,IAAI,oBAAoB,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM,WAAW,kBAAkB,CAAC;AAAA,EAC1G;AACA,MAAI,KAAK,WAAW,KAAK;AACzB,MAAI,KAAK,SAAS,KAAK;AACvB,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,SAAS,MAAM;AACb,UAAI,IAAI,WAAW,KAAK;AACxB,UAAI,IAAI,SAAS,KAAK;AAAA,IACxB;AAAA,EACF;AACF;AAEA,SAAS,cAAc,KAAiC;AACtD,MAAI;AACF,UAAM,QAAQ,mBAAmB,GAAG;AACpC,WAAO,yBAAyB,KAAK,KAAK,IAAI,MAAM,YAAY,IAAI;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yCACd,SACA,UAA+C,CAAC,GACT;AACvC,QAAM,aAAa,iBAAiB,QAAQ,OAAO,KAAK,GAAG;AAC3D,QAAM,wBAAwB,IAAI;AAAA,KAC/B,QAAQ,yBAAyB,CAAC,GAChC,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC,EAChE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAAA,EACjE;AACA,SAAO,OAAO,KAAK,QAAQ;AACzB,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB;AAAA,IACvD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,YAAY,4DAA4D,KAAK,OAAO,QAAQ;AAClG,UAAM,WAAW,iEAAiE,KAAK,OAAO,QAAQ;AACtG,UAAM,YAAY,IAAI,WAAW,SAAS;AAC1C,UAAM,gBAAgB,IAAI,WAAW,UAAU;AAC/C,QAAI,CAAC,aAAa,CAAC,cAAe,QAAO;AAEzC,QAAI,UAAU,iBAAiB,mBAAmB;AAClD,QAAI,UAAU,QAAQ,eAAe;AACrC,UAAM,UAAU,eAAe,YAAY,YAAY,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE;AAChF,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,aAAa,oBAAoB,GAAG,GAAG;AACzC,uCAAiC,KAAK,KAAK,KAAK;AAAA,QAC9C,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,cAAc,KAAK,GAAG;AACxC,QAAI;AACF,YAAM,SAAS,cAAc,KAAK,qBAAqB;AACvD,UAAI,WAAW;AACb,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AACA,oBAAY,KAAK,KAAK,KAAK;AAAA,MAC7B,OAAO;AACL,YAAI,wBAAwB,WAAW,gBAAgB,QAAQ,MAAM;AACrE,YAAI,CAAC,sBAAuB,OAAM,IAAI,kCAAkC,YAAY,CAAC;AACrF,YAAI;AACF,cAAI;AACJ,gBAAM,cAAc,WAAW,wBAAwB,QAAQ,MAAM;AACrE,cAAI,CAAC,YAAa,OAAM,IAAI,kCAAkC,YAAY,CAAC;AAC3E,cAAI;AACF,uBAAW,MAAM,iBAAiB,KAAK,UAAU,MAAM;AACvD,wBAAY,QAAQ;AAAA,UACtB,SAAS,OAAO;AACd,kBAAM,eACJ,iBAAiB,oCAAoC,MAAM,WAAW;AACxE,gBAAI,wBAAwB,wBAAwB,aAAa,SAAS,iBAAiB;AACzF,0BAAY,OAAO;AAAA,YACrB,OAAO;AACL,0BAAY,QAAQ;AAAA,YACtB;AACA,kBAAM;AAAA,UACR;AACA,gBAAM,mBAAmB,WAAW,WAAW,QAAQ,MAAM;AAC7D,cAAI,CAAC,iBAAkB,OAAM,YAAY;AACzC,cAAI;AACF,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AACA,kCAAsB;AACtB,oCAAwB;AACxB,kBAAM,SAAS,MAAM;AAAA,cACnB;AAAA,cACA;AAAA,cACA,EAAE,SAAS,QAAQ,SAAS;AAAA,cAC5B,UAAU;AAAA,YACZ;AACA,wBAAY,KAAK,KAAK,MAAM;AAAA,UAC9B,UAAE;AACA,6BAAiB;AAAA,UACnB;AAAA,QACF,UAAE;AACA,kCAAwB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,mCAAmC;AACtD,yCAAiC,KAAK,KAAK,MAAM,SAAS,QAAQ;AAAA,UAChE,OAAO,MAAM,SAAS;AAAA,UACtB,MAAM,MAAM,SAAS;AAAA,QACvB,CAAC;AACD,eAAO;AAAA,MACT;AACA,UAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,kBAAY,KAAK,MAAM,QAAQ,EAAE,OAAO,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;AAAA,IAC3E,UAAE;AACA,gBAAU,QAAQ;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iDACX,UACoC;AACvC,SAAO,OAAO,KAAK,KAAK,QAAQ;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,WAAY,MAAM,QAAQ,KAAK,KAAK,GAAG,EAAI,QAAO;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-3HSRWJTC.js

@@ -0,0 +1,9 @@
+// src/inline-script.ts
+function serializeInlineScriptValue(value) {
+  return JSON.stringify(value).replaceAll("<", "\\u003c").replaceAll("\u2028", "\\u2028").replaceAll("\u2029", "\\u2029");
+}
+
+export {
+  serializeInlineScriptValue
+};
+//# sourceMappingURL=chunk-3HSRWJTC.js.map

package/dist/chunk-3HSRWJTC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/inline-script.ts"],"sourcesContent":["export function serializeInlineScriptValue(value: string): string {\n  return JSON.stringify(value)\n    .replaceAll(\"<\", \"\\\\u003c\")\n    .replaceAll(\"\\u2028\", \"\\\\u2028\")\n    .replaceAll(\"\\u2029\", \"\\\\u2029\");\n}\n"],"mappings":";AAAO,SAAS,2BAA2B,OAAuB;AAChE,SAAO,KAAK,UAAU,KAAK,EACxB,WAAW,KAAK,SAAS,EACzB,WAAW,UAAU,SAAS,EAC9B,WAAW,UAAU,SAAS;AACnC;","names":[]}

package/dist/{chunk-TKFGFDPJ.js → chunk-3TIZPSJC.js}

@@ -7,10 +7,10 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-2DD6ZHOM.js";
+} from "./chunk-GJ776BC2.js";
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -47,7 +47,7 @@ import {
 } from "./chunk-RL6NEVXT.js";
 import {
   isSupportPassportPrivateMemory
-} from "./chunk-HNDIND7P.js";
+} from "./chunk-XX4HPFFM.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -1005,4 +1005,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-TKFGFDPJ.js.map
+//# sourceMappingURL=chunk-3TIZPSJC.js.map

package/dist/{chunk-B4T3FQMT.js → chunk-43SEBY2M.js}

@@ -279,4 +279,4 @@ async function searchHarmonicRetrieval(options) {
 export {
   searchHarmonicRetrieval
 };
-//# sourceMappingURL=chunk-B4T3FQMT.js.map
+//# sourceMappingURL=chunk-43SEBY2M.js.map

package/dist/{chunk-LVKYLMSM.js → chunk-46SZBVDS.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   copyExistingFileToBackup,
   writeFileAtomically
@@ -260,4 +260,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-LVKYLMSM.js.map
+//# sourceMappingURL=chunk-46SZBVDS.js.map

package/dist/{chunk-YKZLOPTC.js → chunk-5FD7JMTX.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-YKZLOPTC.js.map
+//# sourceMappingURL=chunk-5FD7JMTX.js.map