@revealui/core 0.13.1 → 0.14.0

package/dist/license/mint-client.js

@@ -1,12 +1,13 @@
 /**
- * License mint client (GAP-260 P4-3).
+ * License mint client (GAP-260 P4-3 + residual hosted gate).
  *
  * Single entry for online mint surfaces (Stripe webhooks, admin generate).
  * Routes to either:
  *   - remote `apps/license-signer` POST /internal/mint when
- *     REVEALUI_LICENSE_SIGN_VIA_SIGNER is truthy, or
+ *     REVEALUI_LICENSE_SIGN_VIA_SIGNER is truthy, or when
+ *     REVEALUI_DEPLOYMENT_MODE=hosted (explicit; never local private-key mint), or
  *   - local {@link generateLicenseKey} with REVEALUI_LICENSE_PRIVATE_KEY
- *     (default / fallback until P4-4 drops the private key from api).
+ *     only when MODE is not hosted and SIGN_VIA is off (tests / dogfood).
  *
  * Offline stamper (revforge) keeps calling generateLicenseKey directly.
  *
@@ -14,6 +15,7 @@
  *   REVEALUI_LICENSE_SIGN_VIA_SIGNER=1|true|yes|on
  *   REVEALUI_LICENSE_SIGNER_URL      base URL (e.g. http://127.0.0.1:8791)
  *   REVEALUI_SIGNER_INVOKE_SECRET    HMAC secret (no REVEALUI_SECRET fallback)
+ *   REVEALUI_DEPLOYMENT_MODE=hosted  forces remote-only (SIGN_VIA required)
  *
  * Env (local path):
  *   REVEALUI_LICENSE_PRIVATE_KEY     PKCS#8 Ed25519 PEM (required)
@@ -46,22 +48,43 @@ export function isSignViaSigner(env = process.env) {
     const raw = (env.REVEALUI_LICENSE_SIGN_VIA_SIGNER ?? '').trim().toLowerCase();
     return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'on';
 }
+/**
+ * Explicit hosted SaaS posture only. Does not use private-key inference
+ * (that belongs to detectDeploymentMode). Hosted online mint must never
+ * fall through to mintLocal.
+ */
+export function isExplicitHostedMintMode(env = process.env) {
+    return (env.REVEALUI_DEPLOYMENT_MODE ?? '').trim().toLowerCase() === 'hosted';
+}
+function hasRemoteMintConfig(env) {
+    const url = env.REVEALUI_LICENSE_SIGNER_URL?.trim() ?? '';
+    const secret = env.REVEALUI_SIGNER_INVOKE_SECRET?.trim() ?? '';
+    return url.length > 0 && secret.length > 0;
+}
 /**
  * Whether this process can mint a license key (local private key OR remote
  * signer fully configured). Used by call sites that used to gate only on
  * REVEALUI_LICENSE_PRIVATE_KEY presence.
+ *
+ * Explicit MODE=hosted never treats a local private key as sufficient.
  */
 export function canMintLicense(env = process.env) {
+    if (isExplicitHostedMintMode(env)) {
+        return isSignViaSigner(env) && hasRemoteMintConfig(env);
+    }
     if (isSignViaSigner(env)) {
-        const url = env.REVEALUI_LICENSE_SIGNER_URL?.trim() ?? '';
-        const secret = env.REVEALUI_SIGNER_INVOKE_SECRET?.trim() ?? '';
-        return url.length > 0 && secret.length > 0;
+        return hasRemoteMintConfig(env);
     }
     return Boolean(env.REVEALUI_LICENSE_PRIVATE_KEY?.trim());
 }
 /** Human-readable reason mint is unavailable (for CRITICAL logs). */
 export function mintConfigMissingMessage(env = process.env) {
-    if (isSignViaSigner(env)) {
+    if (isExplicitHostedMintMode(env) && !isSignViaSigner(env)) {
+        return ('REVEALUI_DEPLOYMENT_MODE=hosted requires REVEALUI_LICENSE_SIGN_VIA_SIGNER ' +
+            'with REVEALUI_LICENSE_SIGNER_URL and REVEALUI_SIGNER_INVOKE_SECRET ' +
+            '(local private-key mint is disabled on hosted)');
+    }
+    if (isSignViaSigner(env) || isExplicitHostedMintMode(env)) {
         return ('REVEALUI_LICENSE_SIGN_VIA_SIGNER is set but REVEALUI_LICENSE_SIGNER_URL ' +
             'and/or REVEALUI_SIGNER_INVOKE_SECRET are missing');
     }
@@ -180,13 +203,19 @@ async function mintLocal(input, env) {
     return generateLicenseKey(payload, privateKey, expiresInSeconds, publicKey);
 }
 /**
- * Mint a signed license JWT — remote signer when flagged, else local private key.
+ * Mint a signed license JWT — remote signer when SIGN_VIA is on or MODE is
+ * explicitly hosted; else local private key (tests / dogfood only).
  */
 export async function mintLicenseKey(input, options = {}) {
     const env = options.env ?? process.env;
     const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
     const normalized = withPerpetualSiteCaps(input);
-    if (isSignViaSigner(env)) {
+    // Hosted online mint never uses the local private-key path, even when the
+    // key is still present in env during migration.
+    if (isExplicitHostedMintMode(env) && !isSignViaSigner(env)) {
+        throw new LicenseMintConfigError(mintConfigMissingMessage(env));
+    }
+    if (isSignViaSigner(env) || isExplicitHostedMintMode(env)) {
         return mintViaSigner(normalized, env, fetchImpl);
     }
     return mintLocal(normalized, env);

package/dist/license.d.ts

@@ -48,15 +48,27 @@ export interface GracePeriodConfig {
     /** Days of cached-license grace when infra is unreachable (default: 7) */
     infraDays: number;
 }
+/**
+ * Hard cap on LICENSE_GRACE_* days. Env values above this become jwtVerify
+ * clockTolerance and must not keep an expired subscription JWT valid forever.
+ * Same spirit as {@link MAX_LICENSE_CACHE_TTL_MS}.
+ */
+export declare const MAX_LICENSE_GRACE_DAYS = 30;
+/**
+ * Parse a LICENSE_GRACE_* env value. Unset / non-numeric / negative → fallback.
+ * Values above {@link MAX_LICENSE_GRACE_DAYS} are clamped and warned.
+ */
+export declare function parseLicenseGraceDaysEnv(envValue: string | undefined, fallback: number): number;
 /**
  * Configure grace period durations. Useful for testing.
+ * Values are clamped to {@link MAX_LICENSE_GRACE_DAYS}.
  */
 export declare function configureGracePeriods(overrides: Partial<GracePeriodConfig>): void;
 /** Decoded license payload schema */
 declare const licensePayloadSchema: z.ZodObject<{
     tier: z.ZodEnum<{
-        max: "max";
         pro: "pro";
+        max: "max";
         enterprise: "enterprise";
     }>;
     customerId: z.ZodString;
@@ -179,15 +191,16 @@ export declare const REFRESH_ACCEPT_DAYS = 30;
  * `POST /api/license/refresh`, accepting a token whose `exp` is past by at most
  * `refreshAcceptDays` (default {@link REFRESH_ACCEPT_DAYS}).
  *
+ * `expectedCustomerId` is required (fail closed). A token for customer A must
+ * not verify when the caller bound customer B. An empty / missing bind returns
+ * null so an unbound refresh cannot exfil another customer's current key.
+ *
  * It reuses the SAME ordered multi-key verification (GAP-259 rotation
- * composition) and payload schema as {@link validateLicenseKey}, so a token
- * minted under the outgoing private key during a dual-key rotation window still
- * verifies. It performs NO `customerId` binding: the refresh endpoint trusts
- * the token's `customerId` claim and then independently requires an ACTIVE
- * license row for it. This function only proves possession of a recently-valid
- * signed key. It never mints and never grants entitlement on its own.
+ * composition) and payload schema as {@link validateLicenseKey}. The 30-day
+ * window stays so a recently-expired key can still fetch its own renewal after
+ * the bind succeeds. It never mints and never grants entitlement on its own.
  */
-export declare function validateLicenseKeyForRefresh(licenseKey: string, publicKey: string | readonly string[], refreshAcceptDays?: number): Promise<LicensePayload | null>;
+export declare function validateLicenseKeyForRefresh(licenseKey: string, publicKey: string | readonly string[], expectedCustomerId: string, refreshAcceptDays?: number): Promise<LicensePayload | null>;
 /**
  * Outcome of a signing-keypair self-test. See {@link selfVerifyLicenseKeypair}.
  */
@@ -229,13 +242,20 @@ export declare function selfVerifyLicenseKeypair(privateKey: string, publicKeys:
  * @returns The resolved license tier
  */
 export declare function initializeLicense(): Promise<LicenseTier>;
+/**
+ * Await an in-flight or due revalidation. Tests and async request gates use
+ * this so TTL expiry still proves licensed after the key is re-checked.
+ */
+export declare function refreshLicenseIfStale(): Promise<LicenseTier>;
 /**
  * Returns the current license tier.
- * If the license hasn't been initialized or the cache has expired, returns 'free'.
+ * Uninitialized state is free. A stale cache keeps the last validated tier
+ * and triggers revalidation of the configured key.
  */
 export declare function getCurrentTier(): LicenseTier;
 /**
- * Returns the full license payload, or null if no valid license or cache expired.
+ * Returns the full license payload, or null if no valid license is cached.
+ * Stale TTL does not clear a still-valid payload.
  */
 export declare function getLicensePayload(): LicensePayload | null;
 /**
@@ -249,15 +269,19 @@ export declare function getLicensePayload(): LicensePayload | null;
  *
  * Matching rules (no authored regex, per the fleet no-regex rule):
  * - `host` is lower-cased and stripped of any `:port` suffix
- * - `localhost` / `127.0.0.1` are always allowed, so a trial kit boots and
- *   serves on its default `http://localhost` regardless of the licensed domain
+ * - `localhost` / `127.0.0.1` match only when `allowLoopback` is true (trial /
+ *   unpublished). A published API with a `domains` claim must not accept a
+ *   spoofed Host: localhost bypass.
  * - otherwise `host` must equal a licensed domain OR be a subdomain of one
  *   (`app.example.com` matches `example.com`)
  *
  * @param host    raw Host header value or URL hostname (a `:port` suffix is tolerated)
  * @param domains the license payload's `domains` claim
+ * @param options.allowLoopback  opt-in loopback bypass (default false)
  */
-export declare function hostMatchesLicensedDomains(host: string, domains: readonly string[]): boolean;
+export declare function hostMatchesLicensedDomains(host: string, domains: readonly string[], options?: {
+    allowLoopback?: boolean;
+}): boolean;
 /**
  * Checks whether the current license is at least the given tier.
  * Also validates that the license has not expired (checks JWT exp claim).
@@ -289,7 +313,8 @@ export declare function getMaxSites(): number;
 export declare function getMaxUsers(): number;
 /**
  * Returns the maximum agent tasks per billing cycle for the current license.
- * Track B metering: free=1K, pro=10K, max=50K, enterprise=unlimited.
+ * Track B metering: free=0 (Local AI, no public agent quota), pro=10K,
+ * max=50K, enterprise=unlimited.
  */
 export declare function getMaxAgentTasks(): number;
 /**

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAmBD;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAEjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/F,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,6BAA6B;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,qBAAqB;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW/F;AAeD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAOjF;AAED,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;iBAuBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAiB,CAAC;AAEvD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAW5E;AAWD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,CAOxC;AAYD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAShC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,MAAM,EAC1B,iBAAiB,GAAE,MAA4B,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAIhC;AA+GD;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CA4D9B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CA8C9D;AAyCD;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,WAAW,CAAC,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAaT;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CA2B7D;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,GAAE,WAAmB,GAAG,kBAAkB,CAkEtF;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAE5D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,QAAqB,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,qBAAqB,QAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,SAAS,EAClC,KAAK,GAAE,MAAmB,GACzB,MAAM,CAIR;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAE5D;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,IAAI,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtF;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ/E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAuC,EAClE,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}

package/dist/license.js

@@ -22,26 +22,50 @@ async function getJose() {
 /** JWT issuer and audience for license tokens — prevents cross-environment replay */
 const LICENSE_ISSUER = process.env.REVEALUI_LICENSE_ISSUER ?? 'https://revealui.com';
 const LICENSE_AUDIENCE = process.env.REVEALUI_LICENSE_AUDIENCE ?? 'revealui-license';
-const DEFAULT_GRACE = {
-    subscriptionDays: parseEnvInt('LICENSE_GRACE_SUBSCRIPTION_DAYS', 3),
-    perpetualDays: parseEnvInt('LICENSE_GRACE_PERPETUAL_DAYS', 30),
-    infraDays: parseEnvInt('LICENSE_GRACE_INFRA_DAYS', 7),
-};
-function parseEnvInt(key, fallback) {
-    const val = process.env[key];
-    if (val) {
-        const parsed = Number.parseInt(val, 10);
-        if (Number.isFinite(parsed) && parsed >= 0)
-            return parsed;
+/**
+ * Hard cap on LICENSE_GRACE_* days. Env values above this become jwtVerify
+ * clockTolerance and must not keep an expired subscription JWT valid forever.
+ * Same spirit as {@link MAX_LICENSE_CACHE_TTL_MS}.
+ */
+export const MAX_LICENSE_GRACE_DAYS = 30;
+/**
+ * Parse a LICENSE_GRACE_* env value. Unset / non-numeric / negative → fallback.
+ * Values above {@link MAX_LICENSE_GRACE_DAYS} are clamped and warned.
+ */
+export function parseLicenseGraceDaysEnv(envValue, fallback) {
+    if (!envValue)
+        return fallback;
+    const parsed = Number.parseInt(envValue, 10);
+    if (!Number.isFinite(parsed) || parsed < 0)
+        return fallback;
+    if (parsed > MAX_LICENSE_GRACE_DAYS) {
+        logger.warn(`LICENSE_GRACE_* days=${parsed} exceeds the ${MAX_LICENSE_GRACE_DAYS}-day cap; using ${MAX_LICENSE_GRACE_DAYS}. Larger values extend jwtVerify clockTolerance so expired subscription JWTs stay valid and are not permitted.`);
+        return MAX_LICENSE_GRACE_DAYS;
     }
-    return fallback;
+    return parsed;
 }
+function clampGraceDays(days) {
+    if (!Number.isFinite(days) || days < 0)
+        return 0;
+    return Math.min(days, MAX_LICENSE_GRACE_DAYS);
+}
+const DEFAULT_GRACE = {
+    subscriptionDays: parseLicenseGraceDaysEnv(process.env.LICENSE_GRACE_SUBSCRIPTION_DAYS, 3),
+    perpetualDays: parseLicenseGraceDaysEnv(process.env.LICENSE_GRACE_PERPETUAL_DAYS, 30),
+    infraDays: parseLicenseGraceDaysEnv(process.env.LICENSE_GRACE_INFRA_DAYS, 7),
+};
 let graceConfig = { ...DEFAULT_GRACE };
 /**
  * Configure grace period durations. Useful for testing.
+ * Values are clamped to {@link MAX_LICENSE_GRACE_DAYS}.
  */
 export function configureGracePeriods(overrides) {
-    graceConfig = { ...DEFAULT_GRACE, ...overrides };
+    const merged = { ...DEFAULT_GRACE, ...overrides };
+    graceConfig = {
+        subscriptionDays: clampGraceDays(merged.subscriptionDays),
+        perpetualDays: clampGraceDays(merged.perpetualDays),
+        infraDays: clampGraceDays(merged.infraDays),
+    };
 }
 /** Decoded license payload schema */
 const licensePayloadSchema = z.object({
@@ -106,6 +130,8 @@ const DEFAULT_CACHE_CONFIG = {
 };
 let cacheConfig = { ...DEFAULT_CACHE_CONFIG };
 let cachedAt = 0;
+let refreshInFlight = null;
+let refreshEpoch = 0;
 /**
  * Configure the license cache TTL.
  * Useful for tests (short TTL) or deployments needing faster revocation detection.
@@ -240,16 +266,20 @@ export const REFRESH_ACCEPT_DAYS = 30;
  * `POST /api/license/refresh`, accepting a token whose `exp` is past by at most
  * `refreshAcceptDays` (default {@link REFRESH_ACCEPT_DAYS}).
  *
+ * `expectedCustomerId` is required (fail closed). A token for customer A must
+ * not verify when the caller bound customer B. An empty / missing bind returns
+ * null so an unbound refresh cannot exfil another customer's current key.
+ *
  * It reuses the SAME ordered multi-key verification (GAP-259 rotation
- * composition) and payload schema as {@link validateLicenseKey}, so a token
- * minted under the outgoing private key during a dual-key rotation window still
- * verifies. It performs NO `customerId` binding: the refresh endpoint trusts
- * the token's `customerId` claim and then independently requires an ACTIVE
- * license row for it. This function only proves possession of a recently-valid
- * signed key. It never mints and never grants entitlement on its own.
+ * composition) and payload schema as {@link validateLicenseKey}. The 30-day
+ * window stays so a recently-expired key can still fetch its own renewal after
+ * the bind succeeds. It never mints and never grants entitlement on its own.
  */
-export async function validateLicenseKeyForRefresh(licenseKey, publicKey, refreshAcceptDays = REFRESH_ACCEPT_DAYS) {
-    return verifyAndParseLicenseJwt(licenseKey, publicKey, refreshAcceptDays * 86_400);
+export async function validateLicenseKeyForRefresh(licenseKey, publicKey, expectedCustomerId, refreshAcceptDays = REFRESH_ACCEPT_DAYS) {
+    const bound = expectedCustomerId.trim();
+    if (bound.length === 0)
+        return null;
+    return verifyAndParseLicenseJwt(licenseKey, publicKey, refreshAcceptDays * 86_400, bound);
 }
 /**
  * Shared verify + parse path for {@link validateLicenseKey} and
@@ -468,26 +498,66 @@ export async function initializeLicense() {
     }
     return payload.tier;
 }
+function isCacheStale() {
+    return cachedAt > 0 && Date.now() - cachedAt > cacheConfig.ttlMs;
+}
+/**
+ * Re-validate the configured key. Single-flight so concurrent readers share one
+ * verify. On failure, keep the last validated state (do not flap to free).
+ */
+function scheduleLicenseRefresh() {
+    if (refreshInFlight)
+        return refreshInFlight;
+    const epoch = refreshEpoch;
+    refreshInFlight = initializeLicense()
+        .then((tier) => {
+        if (epoch !== refreshEpoch)
+            return cachedState.tier;
+        return tier;
+    })
+        .catch((err) => {
+        logger.warn('License revalidation failed; keeping last validated state', {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return cachedState.tier;
+    })
+        .finally(() => {
+        refreshInFlight = null;
+    });
+    return refreshInFlight;
+}
 /**
- * Invalidates the cached license state if it has exceeded the configured TTL.
- * After invalidation, the license defaults to 'free' until re-initialized.
+ * When the cache TTL elapses, re-validate the current key instead of dropping
+ * to free. Request-path readers keep the last validated tier until refresh
+ * completes so a live Pro process cannot flap to free while a valid key is set.
  */
 function evictStaleCache() {
-    if (cachedAt > 0 && Date.now() - cachedAt > cacheConfig.ttlMs) {
-        cachedState = { tier: 'free', payload: null, validatedAt: null, keyPresentButInvalid: false };
-        cachedAt = 0;
+    if (isCacheStale()) {
+        void scheduleLicenseRefresh();
     }
 }
+/**
+ * Await an in-flight or due revalidation. Tests and async request gates use
+ * this so TTL expiry still proves licensed after the key is re-checked.
+ */
+export async function refreshLicenseIfStale() {
+    if (isCacheStale() || refreshInFlight) {
+        return scheduleLicenseRefresh();
+    }
+    return cachedState.tier;
+}
 /**
  * Returns the current license tier.
- * If the license hasn't been initialized or the cache has expired, returns 'free'.
+ * Uninitialized state is free. A stale cache keeps the last validated tier
+ * and triggers revalidation of the configured key.
  */
 export function getCurrentTier() {
     evictStaleCache();
     return cachedState.tier;
 }
 /**
- * Returns the full license payload, or null if no valid license or cache expired.
+ * Returns the full license payload, or null if no valid license is cached.
+ * Stale TTL does not clear a still-valid payload.
  */
 export function getLicensePayload() {
     evictStaleCache();
@@ -504,20 +574,24 @@ export function getLicensePayload() {
  *
  * Matching rules (no authored regex, per the fleet no-regex rule):
  * - `host` is lower-cased and stripped of any `:port` suffix
- * - `localhost` / `127.0.0.1` are always allowed, so a trial kit boots and
- *   serves on its default `http://localhost` regardless of the licensed domain
+ * - `localhost` / `127.0.0.1` match only when `allowLoopback` is true (trial /
+ *   unpublished). A published API with a `domains` claim must not accept a
+ *   spoofed Host: localhost bypass.
  * - otherwise `host` must equal a licensed domain OR be a subdomain of one
  *   (`app.example.com` matches `example.com`)
  *
  * @param host    raw Host header value or URL hostname (a `:port` suffix is tolerated)
  * @param domains the license payload's `domains` claim
+ * @param options.allowLoopback  opt-in loopback bypass (default false)
  */
-export function hostMatchesLicensedDomains(host, domains) {
+export function hostMatchesLicensedDomains(host, domains, options = {}) {
     const normalized = (host.trim().toLowerCase().split(':')[0] ?? '').trim();
     if (!normalized)
         return false;
-    if (normalized === 'localhost' || normalized === '127.0.0.1')
+    if (options.allowLoopback === true &&
+        (normalized === 'localhost' || normalized === '127.0.0.1')) {
         return true;
+    }
     return domains.some((domain) => {
         const d = domain.trim().toLowerCase();
         return d.length > 0 && (normalized === d || normalized.endsWith(`.${d}`));
@@ -658,7 +732,8 @@ export function getMaxUsers() {
 }
 /**
  * Returns the maximum agent tasks per billing cycle for the current license.
- * Track B metering: free=1K, pro=10K, max=50K, enterprise=unlimited.
+ * Track B metering: free=0 (Local AI, no public agent quota), pro=10K,
+ * max=50K, enterprise=unlimited.
  */
 export function getMaxAgentTasks() {
     evictStaleCache();
@@ -668,7 +743,7 @@ export function getMaxAgentTasks() {
         return 50_000;
     if (cachedState.tier === 'pro')
         return 10_000;
-    return 1_000;
+    return 0;
 }
 /**
  * Default subscription license JWT lifetime (seconds) — one year. Used as the
@@ -825,6 +900,8 @@ export async function generateLicenseKey(payload, privateKey, expiresInSeconds =
  * Reset license state. Primarily for testing.
  */
 export function resetLicenseState() {
+    refreshEpoch += 1;
+    refreshInFlight = null;
     cachedState = { tier: 'free', payload: null, validatedAt: null, keyPresentButInvalid: false };
     cachedAt = 0;
 }

package/dist/margin-governor.d.ts

@@ -0,0 +1,82 @@
+/**
+ * GAP-256 PR-3 — pure margin admission decide (no DB, no I/O).
+ *
+ * Call sites: apps/server admitFreeIntake (reads snapshot, then this).
+ * HARD: never call after users insert for free_signup; pure module has no COUNT.
+ *
+ * @see docs/specs/2026-08-09-gap-256-margin-admission-layers-2-3.md
+ */
+export type AdmissionChannel = 'free_signup' | 'paid_signup' | 'paid_checkout' | 'invite_accept' | 'admin_provision' | 'waitlist_claim_free' | 'waitlist_claim_paid';
+export type PayingIntentSignal = {
+    kind: 'none';
+} | {
+    kind: 'checkout';
+    tier: 'pro' | 'max' | 'enterprise';
+} | {
+    kind: 'existing_paid';
+    accountId: string;
+    tier: string;
+    status: 'active';
+};
+export type CohortLimits = {
+    maxSites: number;
+    maxUsers: number;
+    maxAgentTasks: number;
+};
+export type SnapshotMode = 'open' | 'lean' | 'waitlist';
+/** Minimal snapshot view for pure decide (from margin_snapshots row). */
+export interface MarginSnapshotView {
+    id: string;
+    mode: SnapshotMode;
+    computedAt: Date;
+    netCents?: number;
+    freeCostRatio?: string | null;
+    projected7dCents?: number | null;
+}
+export interface GovernorFlags {
+    /** Master; off → admit always with open limits */
+    enabled: boolean;
+    /**
+     * When true (default for first enable): compute mode for logs but never
+     * waitlist / never lean-enforce on admit (always admit).
+     */
+    shadow: boolean;
+    /** Hours after which a snapshot is ignored (fail-open to open). Default 36. */
+    staleHours: number;
+}
+export type PureAdmitResult = {
+    decision: 'admit';
+    mode: SnapshotMode | 'bypass' | 'disabled' | 'shadow';
+    cohortLimits: CohortLimits;
+    snapshotId: string | null;
+    reason: string;
+    shadow: boolean;
+} | {
+    decision: 'waitlist';
+    mode: 'waitlist';
+    reason: string;
+    snapshotId: string | null;
+    shadow: false;
+    httpStatus: 202;
+    code: 'WAITLISTED';
+};
+/** Open free cohort = standard hosted free limits (caller supplies base). */
+export declare function freeCohortLimitsForMode(mode: 'open' | 'lean', openLimits: CohortLimits, leanMaxAgentTasks?: number): CohortLimits;
+/** Paid-signup pending only — never free cohort (K20). */
+export declare function paidPendingLimits(): CohortLimits;
+export declare function governorFlagsFromEnv(env?: Record<string, string | undefined>): GovernorFlags;
+/**
+ * Pure admit decision for free intake.
+ * Does not touch users table, COUNT, or waitlist I/O.
+ */
+export declare function decideFreeIntake(input: {
+    channel: AdmissionChannel;
+    deploymentMode: 'hosted' | 'forge' | 'unknown';
+    payingIntent: PayingIntentSignal;
+    snapshot: MarginSnapshotView | null;
+    flags: GovernorFlags;
+    openLimits: CohortLimits;
+    leanMaxAgentTasks?: number;
+    now?: Date;
+}): PureAdmitResult;
+//# sourceMappingURL=margin-governor.d.ts.map

package/dist/margin-governor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"margin-governor.d.ts","sourceRoot":"","sources":["../src/margin-governor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,aAAa,GACb,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,YAAY,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACtD,YAAY,EAAE,YAAY,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IACE,QAAQ,EAAE,UAAU,CAAC;IACrB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;IACd,UAAU,EAAE,GAAG,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEN,6EAA6E;AAC7E,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,UAAU,EAAE,YAAY,EACxB,iBAAiB,SAAM,GACtB,YAAY,CASd;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,IAAI,YAAY,CAEhD;AAED,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,aAAa,CAOf;AAkCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,cAAc,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,YAAY,EAAE,kBAAkB,CAAC;IACjC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,KAAK,EAAE,aAAa,CAAC;IACrB,UAAU,EAAE,YAAY,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ,GAAG,eAAe,CAyFlB"}