@snagset/server 0.0.1

package/README.md

@@ -0,0 +1,83 @@
+# `snagset` — the server
+
+One npm package: the API, the widget assets, the dashboard statics and the
+migrations, with two entry points on the same `createApp(deps)` (LOCK L5/L7).
+
+## Run it
+
+```bash
+DATABASE_URL=postgres://… npx snagset
+```
+
+That is the whole install. The bin migrates its own schema under an advisory
+lock, generates a signing key if it has none, prints a claim URL, and serves.
+Postgres is the only requirement — [A9a, LOCK L6](../../specs/00-foundations.md):
+no Redis, no S3, no queue, no extensions.
+
+| Command | What it does |
+|---|---|
+| `snagset` | migrate, then serve (the default) |
+| `snagset migrate` | migrate and exit — for a deploy step |
+| `snagset bootstrap` | mint a fresh claim URL, voiding any outstanding one |
+| `snagset origins <uid>` | what may write to a project, and what has asked to |
+| `snagset allow-origin <uid> <origin>` | approve one |
+
+Exit codes: `2` bad config, `3` database unreachable, `4` a migration refused
+(a checksum changed, or the database is ahead of this build).
+
+## First run
+
+`orgs` is empty, so the instance is **CLAIMABLE**: every route but `/healthz`,
+`/readyz`, `/api/v1/meta` and `/api/v1/setup` answers `409 instance_unclaimed`,
+and the claim URL is printed to stdout and to `<data>/bootstrap.txt`.
+
+409 and not 503 is deliberate ([08 §3.4](../../specs/08-deployment.md)): a 503
+tells every proxy in the path that a healthy instance is unhealthy, and a
+fresh container behind one would restart-loop before anyone read the URL.
+
+Opening the URL and posting to `/api/v1/setup` creates the org, the owner, the
+first project, its `production` and `preview` environments, **Round 1**, and a
+session — in one transaction. The gate lifts without a restart.
+
+Lost the URL? It is stored as a hash and cannot be re-printed. `snagset
+bootstrap` mints a new one.
+
+## Two things an operator should know
+
+**The signing key.** Generated to `<data>/secret.key` at mode 0600 on first
+boot, or supplied as `SNAGSET_SECRET_KEY`. Back it up and treat it as a
+password: without it, stored integration credentials are unrecoverable
+ciphertext and every reviewer session is dead. On serverless it is **required**
+— the filesystem is ephemeral, so a generated key would differ on every cold
+start.
+
+**Row-level security may not be in force.** Migration 0001 enables and `FORCE`s
+RLS on all 31 tenanted tables. A role with the `BYPASSRLS` attribute overrides
+all of it — and managed Postgres often grants it to the role in the connection
+string it hands you (Neon's `neondb_owner` does, and cannot drop it from
+itself). Boot says so, and `/readyz` reports it. Requests are still scoped by
+`org_id` in the application, so this is a lost safety net rather than an open
+door; to get it back, create a role without `BYPASSRLS`, grant it the tables,
+and point `DATABASE_URL` at that. See [D50](../../PRODUCT-DECISIONS.md).
+
+## Origins
+
+A project starts with an empty allow-list, and nothing is ever allow-listed
+automatically: `Origin` is attacker-controllable, so auto-allowing would be an
+attacker-controlled header granting access. Origins that fetch `/config` are
+*recorded* — `snagset origins <uid>` shows them — and `snagset allow-origin`
+is the human decision ([08 §3.5 D2](../../specs/08-deployment.md)).
+
+## Where the schema comes from
+
+`src/db/migrations/0001_init.sql` is **generated** from
+[05 §3](../../specs/05-api-data.md) — 32 tables, 15 enums, 58 indexes — plus
+the RLS block this repo adds. `pnpm gen:migration:check` fails on drift, which
+makes editing the spec the only way to change the database. Same for the
+config registry against [08 §4](../../specs/08-deployment.md).
+
+## Tests
+
+`pnpm test` runs everything that needs no database. Set
+`SNAGSET_TEST_DATABASE_URL` to also run the claim-flow tests — they **drop and
+recreate the public schema**, which is why they refuse to read `DATABASE_URL`.

package/dist/app.js

@@ -0,0 +1,453 @@
+import { Hono } from "hono";
+import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
+import { readFileSync, existsSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { tokenHash } from "./boot.js";
+import { selectMailer } from "./mail/index.js";
+import { widgetRoutes } from "./routes/widget.js";
+import { jobsRoutes } from "./routes/jobs.js";
+import { rlsStatus } from "./db/rls.js";
+import { threadRoutes } from "./routes/threads.js";
+import { commentRoutes } from "./routes/comments.js";
+import { commentEditRoutes } from "./routes/commentEdit.js";
+import { corsForProjects } from "./routes/cors.js";
+import { bearerAuth } from "./routes/auth.js";
+import { attachmentRoutes, features } from "./routes/attachments.js";
+import { sessionRoutes } from "./routes/sessions.js";
+import { reviewLinkRoutes } from "./routes/reviewLinks.js";
+import { roundRoutes } from "./routes/rounds.js";
+import { siteRoutes } from "./routes/sites.js";
+import { mcpAuth } from "./routes/mcpAuth.js";
+import { createKeyring } from "./keys.js";
+import { unsubscribeRoutes } from "./mail/unsubscribe.js";
+// `wireId` moved to `projects.ts`, beside its only consumer. Re-exported
+// because `boot.ts` imports it from here and the name is public surface.
+import { createProject, validateOrigins, wireId } from "./projects.js";
+export { wireId };
+import { createProjectCache } from "./projectCache.js";
+import { ownerAuth, ownerRoutes, requireOwner, hashPassword, setSessionCookies, } from "./routes/owner.js";
+import { ID_PREFIX, THREAD_REF_PREFIX, header } from "./vendor/types/names.js";
+/** §2.2's envelope — every status ≥ 400, always, with a code from §6.9. */
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+/** A slug from a display name, matching orgs.slug's CHECK. */
+export function slugify(name) {
+    const s = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 39);
+    return s.length >= 3 ? s : `org-${randomBytes(4).toString("hex")}`;
+}
+export function createApp(deps) {
+    const app = new Hono();
+    const { sql, cfg } = deps;
+    // One keyring and one project cache for the process. The cache is what makes
+    // `session_epoch` revocation cost nothing per request (05 §4.4).
+    const keys = createKeyring(deps.secretKey, cfg.get("SNAGSET_SECRET_KEY_PREVIOUS"));
+    const projects = createProjectCache(sql);
+    const ttls = {
+        slidingS: cfg.int("SNAGSET_SESSION_TTL_S"),
+        absoluteS: cfg.int("SNAGSET_SESSION_ABSOLUTE_TTL_S"),
+    };
+    // Declared up here because `/api/v1/setup` uses `secure` to set its cookies
+    // and is registered long before the middleware below.
+    const baseUrl = new URL(cfg.get("SNAGSET_BASE_URL") ?? "http://localhost:8080");
+    const ownerDeps = {
+        sql,
+        origin: baseUrl.origin,
+        // A `Secure` cookie is dropped on plain http, which on a first `npx
+        // snagset` run against localhost reads as "login silently does nothing".
+        secure: baseUrl.protocol === "https:",
+    };
+    // §2.2: every response carries the request id, the server version and the
+    // server clock. The clock is not decoration — §12.3 uses it to correct skew
+    // on a reviewer's machine, and a widget with a wrong clock signs identity
+    // envelopes that fail verification for reasons nobody can see.
+    app.use("*", async (c, next) => {
+        const id = c.req.header(header("request-id")) ?? randomUUID();
+        c.set("requestId", id);
+        await next();
+        c.header(header("request-id"), id);
+        c.header(header("server"), deps.version);
+        c.header(header("time"), new Date().toISOString());
+    });
+    app.onError((err, c) => {
+        console.error(`error [${c.get("requestId")}]`, err);
+        return fail(c, 500, "internal_error", "Something went wrong on the server.");
+    });
+    /**
+     * LIVENESS. Deliberately touches nothing: the question is "is this process
+     * alive", and a health check that queries the database restarts a healthy
+     * app every time the database hiccups — turning a brief outage into a
+     * restart storm that outlives it.
+     */
+    app.get("/healthz", (c) => c.json({ ok: true, version: deps.version }));
+    /**
+     * READINESS. This one IS allowed to touch the database, because "ready"
+     * means "can serve a request", and a request needs the database.
+     *
+     * An unclaimed instance is READY in the orchestrator's sense — 08 §3.4's
+     * whole argument about 409-not-503 applies here too. It is healthy; it is
+     * waiting for a human. Reporting otherwise puts it in a restart loop and the
+     * operator never gets to read the claim URL.
+     */
+    app.get("/readyz", async (c) => {
+        try {
+            await sql `SELECT 1`;
+        }
+        catch (e) {
+            return c.json({ ok: false, state: deps.state, database: "unreachable", detail: e.message }, 503);
+        }
+        const rls = await rlsStatus(sql);
+        return c.json({
+            ok: true,
+            state: deps.state,
+            database: "ok",
+            // D50: surfaced rather than assumed. An operator who has to ask whether
+            // RLS is doing anything should be able to read the answer.
+            rls: { effective: rls.effective, role: rls.role, warning: rls.warning },
+        });
+    });
+    /** 05 §6.11. Unauthenticated on purpose: `sourceUrl` is AGPL-3.0 §13's offer
+     *  of source to anyone interacting with a modified version over a network,
+     *  and an offer behind a login is not an offer. */
+    app.get("/api/v1/meta", (c) => {
+        c.header("Cache-Control", "public, max-age=60");
+        return c.json({
+            version: deps.version,
+            commit: deps.commit,
+            sourceUrl: deps.sourceUrl,
+            modified: deps.modified,
+            blockedClientVersions: [],
+            apiVersions: ["v1"],
+            serverTime: new Date().toISOString(),
+        });
+    });
+    /**
+     * 05 §6.10 — the claim. Single-use, and the transaction either creates an
+     * entire working instance or none of it.
+     */
+    app.post("/api/v1/setup", async (c) => {
+        if (deps.state === "READY") {
+            return fail(c, 409, "already_claimed", "This instance has already been claimed.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const str = (k) => (typeof body?.[k] === "string" ? body[k] : "");
+        const [token, orgName, email, password] = ["token", "orgName", "email", "password"].map(str);
+        const projectName = str("projectName");
+        for (const [k, v] of Object.entries({ token, orgName, email, password })) {
+            if (!v)
+                return fail(c, 400, "validation_failed", `${k} is required.`, { field: k });
+        }
+        if (password.length < 12) {
+            return fail(c, 400, "validation_failed", "The password must be at least 12 characters.", {
+                field: "password",
+            });
+        }
+        // Step 1 — constant-time compare. The row is found by hash rather than
+        // fetched-then-compared so a wrong token and an unknown token take the
+        // same path; `timingSafeEqual` then covers the compare itself.
+        const want = tokenHash(token);
+        const rows = await sql `
+      SELECT id, token_hash FROM setup_tokens
+      WHERE consumed_at IS NULL AND (expires_at IS NULL OR expires_at > now())
+    `;
+        const match = rows.find((r) => r.token_hash.length === want.length && timingSafeEqual(r.token_hash, want));
+        // §6.10 step 1 and 08 §3.4 step 6: unknown or consumed is 409
+        // already_claimed, NOT 403. Same code for both, so a guesser learns
+        // nothing from the difference.
+        if (!match) {
+            return fail(c, 409, "already_claimed", "That claim token is not valid. If the instance is already set up, sign in instead; " +
+                "otherwise run `npx snagset bootstrap` for a fresh one.");
+        }
+        const orgId = randomUUID();
+        const userId = randomUUID();
+        const sessionToken = randomBytes(32).toString("base64url");
+        const out = await sql.begin(async (tx) => {
+            // Every statement below runs under RLS. `app.org_id` is set FIRST and to
+            // the org we are about to create: the policies apply to INSERT through
+            // their WITH CHECK, so without this the very first insert fails on a
+            // correctly-secured deployment. (On a BYPASSRLS role it would appear to
+            // work — which is exactly why D50's probe exists.)
+            await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+            await tx `INSERT INTO orgs (id, name, slug) VALUES (${orgId}, ${orgName}, ${slugify(orgName)})`;
+            await tx `
+        INSERT INTO users (id, org_id, email, name, password_hash, email_verified)
+        VALUES (${userId}, ${orgId}, ${email}, ${orgName}, ${hashPassword(password)}, true)
+      `;
+            await tx `
+        INSERT INTO memberships (org_id, user_id, role) VALUES (${orgId}, ${userId}, 'owner')
+      `;
+            // One call, `projects.ts`. A project is a row plus two environments plus
+            // a round, and this route is the one that learned that the hard way.
+            const created = await createProject(tx, {
+                orgId,
+                name: projectName || "First project",
+                createdBy: userId,
+                graceHours: cfg.int("SNAGSET_WRITE_MODE_GRACE_HOURS"),
+            });
+            await tx `
+        INSERT INTO user_sessions (id, org_id, user_id, token_hash, expires_at)
+        VALUES (${randomUUID()}, ${orgId}, ${userId}, ${tokenHash(sessionToken)},
+                now() + interval '30 days')
+      `;
+            await tx `UPDATE setup_tokens SET consumed_at = now() WHERE id = ${match.id}`;
+            // Step 2's last clause. Any other outstanding token is now a second key
+            // to a door that has been opened; there is no reason for one to survive.
+            await tx `DELETE FROM setup_tokens WHERE id <> ${match.id} AND consumed_at IS NULL`;
+            return { projectUid: created.uid };
+        });
+        deps.state = "READY";
+        // Claiming an instance signs you in. The row was just written above; this
+        // sets the two cookies that make it usable, so the first-run flow ends on
+        // the dashboard rather than on a login form asking for the password the
+        // operator typed ten seconds ago.
+        const csrf = randomBytes(32).toString("base64url");
+        setSessionCookies(c, sessionToken, csrf, ownerDeps.secure, 30 * 24 * 60 * 60);
+        return c.json({
+            org: { name: orgName },
+            user: { email },
+            // The uid, never the row id: it is the project identity everything
+            // outside the database uses, and AC-1-9 asserts no dashboard surface
+            // carries the other one.
+            project: { uid: out.projectUid, name: projectName || "First project", keyPrefix: THREAD_REF_PREFIX.replace("-", "") },
+            csrfToken: csrf,
+        }, 201);
+    });
+    /**
+     * CREDENTIAL HYGIENE — the one place raw credentials are presented.
+     *
+     * Nothing in any spec keeps `snag_k`, a bearer or a `holderSecret` out of
+     * SERVER logs: the fragment argument covers URLs, but the token arrives in
+     * the sessions request BODY. So the rule is mechanical rather than a
+     * convention — this middleware marks the route, and no body is ever logged
+     * on it.
+     */
+    /**
+     * OWNER auth (05 §4.7), app-wide and free when absent: no dashboard cookie
+     * means an immediate `next()`, so the widget's routes — which are on another
+     * origin and can never carry it — pay nothing. Mounted here rather than per
+     * route group because the last time a credential middleware lived inside one
+     * group, the route registered before it answered without protection.
+     */
+    app.use("*", ownerAuth(ownerDeps));
+    app.route("/", ownerRoutes(ownerDeps));
+    /**
+     * MCP bearer auth (07 §8.2), app-wide for the same reason `ownerAuth` is:
+     * the credential is attached wherever it is presented and every route
+     * decides for itself what a scope permits. It costs one `startsWith` when no
+     * MCP token is present, which is every widget request.
+     *
+     * Mounted AFTER `ownerAuth` and before every route, so `c.get("mcp")` is
+     * populated by the time a handler asks. The two never collide: an owner
+     * arrives in a cookie, an agent in `Authorization: Bearer`.
+     */
+    app.use("*", mcpAuth(sql));
+    app.use("/api/v1/projects/:uid/sessions", async (c, next) => {
+        c.set("noBodyLogging", true);
+        await next();
+    });
+    // The widget's surface. Mounted after /setup so the gate below still catches
+    // it while unclaimed: a project route on an unclaimed instance is a 409, not
+    // a 404, because there is no project rather than no route.
+    /**
+     * 05 §5.1's CORS classes, at the APP level so EVERY project route is covered.
+     *
+     * Route-group middleware only covers routes registered after it IN THAT
+     * GROUP. This lived inside `threadRoutes`, and `sessionRoutes` is mounted
+     * first — so the credential exchange answered 201 with no
+     * `Access-Control-Allow-Origin`, the preflight passed (its OPTIONS handler
+     * WAS in the covered group), and the browser reported `net::ERR_FAILED` on
+     * the POST underneath a green OPTIONS. A CORS failure wearing the costume of
+     * a network fault, on the one route that hands out a credential.
+     */
+    app.use("/api/v1/projects/:uid/*", corsForProjects(sql, async (uid) => {
+        const p = await projects.get(uid).catch(() => null);
+        return p ? { id: p.id, org_id: p.org_id } : null;
+    }));
+    // After CORS, before the routes: a session is ATTACHED when one verifies and
+    // the route decides whether it needed one. `/sessions` is excluded — it is
+    // where a bearer is exchanged, not presented.
+    app.use("/api/v1/projects/:uid/threads", bearerAuth(keys, projects, ttls.absoluteS));
+    app.use("/api/v1/projects/:uid/threads/*", bearerAuth(keys, projects, ttls.absoluteS));
+    // The dashboard's unscoped form, `/api/v1/threads/{id}/comments` — no `:uid`
+    // segment for `bearerAuth` to read, so this mount is a no-op today (it
+    // returns immediately whenever its own `uid` param is absent). Added anyway
+    // so the credential-attaching middleware for this surface is declared once,
+    // per path, the same way every other one here is — not discovered missing
+    // the day a bearer-carrying caller of the unscoped form shows up.
+    app.use("/api/v1/threads/*", bearerAuth(keys, projects, ttls.absoluteS));
+    app.route("/", sessionRoutes({ sql, keys, projects, ttls }));
+    // Whether to QUEUE a notification at all — see CommentDeps.notifications.
+    // Computed once at construction: the transport cannot change without a
+    // config change, and a config change means a restart.
+    const notifications = selectMailer(cfg).kind !== "none";
+    app.route("/", threadRoutes(sql, projects, () => features(sql, keys), notifications));
+    app.route("/", commentRoutes({ sql, projects, notifications }));
+    /**
+     * Editing and deleting a comment (endpoints 12 and 13). Mounted here, beside
+     * the comment routes, and BEFORE the owner-gated block below — a reviewer
+     * session is a legitimate credential on these paths, so `requireOwner()`
+     * must not stand in front of them.
+     */
+    app.use("/api/v1/comments/*", bearerAuth(keys, projects, ttls.absoluteS));
+    app.use("/api/v1/projects/:uid/comments/*", bearerAuth(keys, projects, ttls.absoluteS));
+    app.route("/", commentEditRoutes({ sql }));
+    app.use("/api/v1/projects/:uid/attachments", bearerAuth(keys, projects, ttls.absoluteS));
+    app.route("/", attachmentRoutes({
+        sql,
+        keys,
+        projects,
+        maxImageBytes: cfg.int("SNAGSET_STORAGE_MAX_IMAGE_BYTES"),
+    }));
+    /**
+     * Dashboard-class (05 §5.1): no CORS headers, so a reviewed site cannot mint
+     * or revoke a link even holding a valid widget session.
+     *
+     * AND NOW AUTHENTICATED, which it was not. Absent CORS headers stop a
+     * BROWSER on another origin from reading the response; they stop nothing
+     * else. `curl` against the port minted a working review link with no
+     * credential at all — and under D3 the link IS the access-control system, so
+     * that was the whole of it. Found by minting one that way while measuring
+     * latency.
+     */
+    /**
+     * Adding a site (D63). Dashboard-class: owner cookie plus the CSRF pair on
+     * the mutation, both from `requireOwner()`.
+     *
+     * `/api/v1/projects` is registered UNSCOPED and therefore before the `:uid`
+     * mounts — a middleware mounted on `/api/v1/projects/:uid/*` never sees it,
+     * which is precisely how the review-link route ended up mintable by `curl`.
+     *
+     * THE UNCLAIMED CHECK COMES FIRST, and it is not decoration. §3.4 step 5's
+     * gate is the catch-all at the bottom of this file, so before this route
+     * existed an unclaimed instance answered `/api/v1/projects` with 409
+     * `instance_unclaimed` simply because nothing matched. Mounting
+     * `requireOwner()` here made it 401 "sign in to the dashboard first" — advice
+     * for an instance that has no users to sign in as, on the exact request an
+     * operator makes when they have not finished setting it up. Caught by
+     * `setup.test.ts`, which asserts the gate covers everything outside its
+     * allow-list.
+     */
+    const unclaimedFirst = async (c, next) => {
+        if (deps.state !== "READY") {
+            return fail(c, 409, "instance_unclaimed", "This instance has not been claimed yet. Open the claim URL from the server logs, " +
+                "or run `snagset bootstrap`.");
+        }
+        return next();
+    };
+    app.use("/api/v1/projects", unclaimedFirst, requireOwner());
+    app.use("/api/v1/projects/:uid/origins", unclaimedFirst);
+    app.use("/api/v1/projects/:uid/origins", requireOwner());
+    // The audience PATCH is dashboard-class too — but requireOwner cannot mount
+    // on the bare :uid path, whose GETs belong to the widget. Method-scoped.
+    app.on("PATCH", "/api/v1/projects/:uid", requireOwner());
+    /**
+     * One-click unsubscribe (B2). Mounted OUTSIDE `/api/v1`, with no auth
+     * middleware in front of it, and both facts are the design: the person
+     * clicking may hold no session and the link's HMAC is what authorises it.
+     * A route class that demanded a credential here would mean the only people
+     * who can stop the mail are the ones still able to log in.
+     */
+    app.route("/", unsubscribeRoutes({ sql, keys }));
+    app.route("/", siteRoutes({ sql, graceHours: cfg.int("SNAGSET_WRITE_MODE_GRACE_HOURS") }));
+    app.use("/api/v1/projects/:uid/review-links", requireOwner());
+    app.use("/api/v1/review-links/*", requireOwner());
+    // Rounds are a STUDIO act (D2, and `rounds.created_by` references `users`
+    // rather than `reviewers` for exactly that reason), so the whole surface is
+    // owner-gated the same way.
+    app.use("/api/v1/projects/:uid/rounds", requireOwner());
+    app.use("/api/v1/rounds/*", requireOwner());
+    app.route("/", roundRoutes({ sql, projects }));
+    app.route("/", reviewLinkRoutes({
+        sql,
+        projects,
+        ttlDays: cfg.int("SNAGSET_REVIEW_LINK_TTL_DAYS"),
+        maxTtlDays: cfg.int("SNAGSET_REVIEW_LINK_MAX_TTL_DAYS"),
+    }));
+    /**
+     * The dashboard's static assets — foundations §10 / LOCK L5: the SPA is
+     * BUNDLED INTO this package rather than deployed separately, so `npx
+     * snagset` is one process with a UI and not a server plus a hosting
+     * decision.
+     *
+     * Served here rather than by a static middleware because there is one
+     * subtlety worth being explicit about: an SPA needs every unmatched
+     * dashboard path to return `index.html` so a deep link like
+     * `/?project=…&t=SN-14` survives a reload — but that fallback must NOT
+     * swallow `/api/*`, or a typo in an API path returns 200 and a page of HTML
+     * where the caller expected an error envelope.
+     */
+    /**
+     * The jobs endpoint — 08 §3.2's cron target, and it lives HERE rather than
+     * in `serverless.ts` for one reason: everything below this line is a
+     * catch-all. The first version registered it on the app returned by this
+     * function and got a 404 on every call, because Hono matches in registration
+     * order and the dashboard fallback had already claimed `/*`. That is the
+     * same mistake the widget routes made an hour earlier, which is why both now
+     * sit above the fallback and say so.
+     *
+     * The bin gets it too. It ticks on its own interval and does not need it,
+     * but an operator with a stuck queue having a way to force a tick is worth
+     * more than the symmetry of hiding it — and it carries the same
+     * authentication either way.
+     */
+    app.route("/", jobsRoutes({ sql, cfg }));
+    /**
+     * The widget, BEFORE the dashboard's catch-all (08 §3.8, L2.3).
+     *
+     * Order is the whole of it. The fallback below answers every unmatched path
+     * with `index.html`, so mounted after it `/widget/snag.js` would return a
+     * page of HTML with a 200 — which is precisely how the absence of these
+     * routes went unnoticed until a script tag on a real site failed with a MIME
+     * type error.
+     */
+    app.route("/", widgetRoutes({ version: deps.version }));
+    const dashboardDir = join(dirname(fileURLToPath(import.meta.url)), "..", "static", "dashboard");
+    const MIME = {
+        ".html": "text/html; charset=utf-8",
+        ".js": "text/javascript; charset=utf-8",
+        ".css": "text/css; charset=utf-8",
+        ".svg": "image/svg+xml",
+        ".woff2": "font/woff2",
+        ".png": "image/png",
+    };
+    app.get("/*", async (c, next) => {
+        const path = new URL(c.req.url).pathname;
+        if (path.startsWith("/api/") || path.startsWith("/auth/") || path === "/healthz" || path === "/readyz") {
+            return next();
+        }
+        // Vite's hashed assets live under /assets/; everything else falls back to
+        // the shell. `..` cannot escape because the join is resolved and checked.
+        const wanted = path === "/" ? "index.html" : path.replace(/^\/+/, "");
+        const full = resolve(dashboardDir, wanted);
+        const file = full.startsWith(resolve(dashboardDir)) && existsSync(full) && statSync(full).isFile()
+            ? full
+            : resolve(dashboardDir, "index.html");
+        if (!existsSync(file))
+            return next();
+        const ext = file.slice(file.lastIndexOf("."));
+        c.header("Content-Type", MIME[ext] ?? "application/octet-stream");
+        // Hashed filenames are immutable; the shell must never be.
+        c.header("Cache-Control", file.includes("/assets/") ? "public, max-age=31536000, immutable" : "no-cache");
+        return c.body(readFileSync(file));
+    });
+    /**
+     * 08 §3.4 step 5 — the gate. Everything not listed above answers 409 while
+     * the instance is unclaimed, with a message that tells the operator what to
+     * do rather than that the route does not exist (05 §6.10 step 4).
+     */
+    app.all("*", (c) => {
+        if (deps.state !== "READY") {
+            return fail(c, 409, "instance_unclaimed", "This Snagset instance is running but has not been claimed yet. Open the claim URL " +
+                "printed in the server logs (or in <data>/bootstrap.txt) to create the first owner. " +
+                "Lost it? Run `npx snagset bootstrap`.");
+        }
+        return fail(c, 404, "not_found", `No route for ${c.req.method} ${new URL(c.req.url).pathname}.`);
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAwC,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAkB,SAAS,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,iBAAiB,GAElB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAwC5E,2EAA2E;AAC3E,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI;SACX,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1B,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG;QACX,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC;KACrD,CAAC;IAEF,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,uBAAuB,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG;QAChB,GAAG;QACH,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,oEAAoE;QACpE,yEAAyE;QACzE,MAAM,EAAE,OAAO,CAAC,QAAQ,KAAK,QAAQ;KACtC,CAAC;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QAC9D,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAExE;;;;;;;;OAQG;IACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,CAAA,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,EACvF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI;YACd,wEAAwE;YACxE,2DAA2D;YAC3D,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;SACxE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;uDAEmD;IACnD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,qBAAqB,EAAE,EAAE;YACzB,WAAW,EAAE,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAK1F,CAAC;QACF,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,8CAA8C,EAAE;gBACvF,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAsC;;;KAG3D,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAClF,CAAC;QACF,8DAA8D;QAC9D,oEAAoE;QACpE,+BAA+B;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,iBAAiB,EACjB,qFAAqF;gBACnF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACvC,yEAAyE;YACzE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,mDAAmD;YACnD,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;YAE1D,MAAM,EAAE,CAAA,6CAA6C,KAAK,KAAK,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;YAC/F,MAAM,EAAE,CAAA;;kBAEI,MAAM,KAAK,KAAK,KAAK,KAAK,KAAK,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC;OAC5E,CAAC;YACF,MAAM,EAAE,CAAA;kEACoD,KAAK,KAAK,MAAM;OAC3E,CAAC;YACF,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;gBACtC,KAAK;gBACL,IAAI,EAAE,WAAW,IAAI,eAAe;gBACpC,SAAS,EAAE,MAAM;gBACjB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC;aACtD,CAAC,CAAC;YACH,MAAM,EAAE,CAAA;;kBAEI,UAAU,EAAE,KAAK,KAAK,KAAK,MAAM,KAAK,SAAS,CAAC,YAAY,CAAC;;OAExE,CAAC;YACF,MAAM,EAAE,CAAA,0DAA0D,KAAK,CAAC,EAAE,EAAE,CAAC;YAC7E,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,EAAE,CAAA,wCAAwC,KAAK,CAAC,EAAE,0BAA0B,CAAC;YAEnF,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QAErB,0EAA0E;QAC1E,0EAA0E;QAC1E,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnD,iBAAiB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9E,OAAO,CAAC,CAAC,IAAI,CACX;YACE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YACtB,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,mEAAmE;YACnE,qEAAqE;YACrE,yBAAyB;YACzB,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,IAAI,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YACrH,SAAS,EAAE,IAAI;SAChB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH;;;;;;OAMG;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IAEvC;;;;;;;;;OASG;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3B,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC1D,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D;;;;;;;;;;OAUG;IACH,GAAG,CAAC,GAAG,CACL,yBAAyB,EACzB,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CACH,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,0EAA0E;IAC1E,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;IACxD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;IACtF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAChE;;;;;OAKG;IACH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE3C,GAAG,CAAC,GAAG,CAAC,mCAAmC,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,GAAG,CAAC,KAAK,CACP,GAAG,EACH,gBAAgB,CAAC;QACf,GAAG;QACH,IAAI;QACJ,QAAQ;QACR,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC;KAC1D,CAAC,CACH,CAAC;IACF;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,cAAc,GAA2B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC/D,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,oBAAoB,EACpB,mFAAmF;gBACjF,6BAA6B,CAChC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,cAAc,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,CAAC,+BAA+B,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD,4EAA4E;IAC5E,yEAAyE;IACzE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3F,GAAG,CAAC,GAAG,CAAC,oCAAoC,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,YAAY,EAAE,CAAC,CAAC;IAClD,0EAA0E;IAC1E,4EAA4E;IAC5E,4BAA4B;IAC5B,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,KAAK,CACP,GAAG,EACH,gBAAgB,CAAC;QACf,GAAG;QACH,QAAQ;QACR,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAChD,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,kCAAkC,CAAC;KACxD,CAAC,CACH,CAAC;IAEF;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAExD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChG,MAAM,IAAI,GAA2B;QACnC,OAAO,EAAE,0BAA0B;QACnC,KAAK,EAAE,gCAAgC;QACvC,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,WAAW;KACpB,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvG,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAChG,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAClE,2DAA2D;QAC3D,CAAC,CAAC,MAAM,CACN,eAAe,EACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,CAC/E,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,oBAAoB,EACpB,oFAAoF;gBAClF,qFAAqF;gBACrF,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}