@snagset/server 0.0.1

package/dist/projects.js

@@ -0,0 +1,101 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { ID_PREFIX } from "./vendor/types/names.js";
+/**
+ * `prj_` + 12 Crockford base32 characters — foundations §2.10, and §3.3's
+ * `CHECK (uid ~ '^prj_[0-9abcdefghjkmnpqrstvwxyz]{12}$')` is the enforcement.
+ * Crockford excludes I, L, O and U so a uid read aloud or copied off a screen
+ * cannot be misheard; the lowercase form is what the CHECK wants.
+ *
+ * Rejection sampling, not `% 32`: a byte modulo 32 makes the first 8 symbols
+ * of the alphabet fractionally likelier than the rest, which is 60 bits of
+ * entropy quietly becoming fewer for no reason at all.
+ */
+const CROCKFORD = "0123456789abcdefghjkmnpqrstvwxyz";
+export function wireId(prefix, length = 12) {
+    let out = "";
+    while (out.length < length) {
+        for (const byte of randomBytes(length)) {
+            if (byte >= 256 - (256 % 32))
+                continue;
+            out += CROCKFORD[byte % 32];
+            if (out.length === length)
+                break;
+        }
+    }
+    return prefix + out;
+}
+/**
+ * Validate an origin list, throwing a sentence rather than returning a filtered
+ * one.
+ *
+ * A silently-dropped origin is the worst outcome available here: the site is
+ * added, the tag is pasted, and every request from it is refused by CORS with
+ * no indication that the origin the operator typed is not the origin stored.
+ * Mirrors 0001's own CHECK so the failure arrives with a fix rather than as a
+ * constraint violation.
+ */
+export function validateOrigins(origins) {
+    const out = [];
+    for (const raw of origins) {
+        const origin = raw.trim();
+        if (!origin)
+            continue;
+        let parsed;
+        try {
+            parsed = new URL(origin);
+        }
+        catch {
+            throw new Error(`${JSON.stringify(origin)} is not an origin. It needs a scheme: https://staging.acme.com, ` +
+                `not staging.acme.com.`);
+        }
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            throw new Error(`${JSON.stringify(origin)} must be http:// or https://.`);
+        }
+        if (parsed.pathname !== "/" || parsed.search) {
+            throw new Error(`${JSON.stringify(origin)} has a path. An origin is scheme + host + port and nothing else.`);
+        }
+        // Rebuilt from the parse rather than passed through, so a trailing slash,
+        // an upper-case host or a default port cannot produce two rows that are
+        // the same origin spelled differently — `projects_origins` is UNIQUE on
+        // (project_id, pattern) and would happily hold both.
+        out.push(parsed.origin.toLowerCase());
+    }
+    return out;
+}
+export async function createProject(tx, input) {
+    const id = randomUUID();
+    const uid = wireId(ID_PREFIX.project);
+    const name = input.name.trim() || "Untitled site";
+    const origins = validateOrigins(input.origins ?? []);
+    await tx `
+    INSERT INTO projects (id, org_id, uid, name, ip_salt, config_etag, write_mode_downgrade_at)
+    VALUES (${id}, ${input.orgId}, ${uid}, ${name},
+            ${randomBytes(32)}, ${randomBytes(8).toString("hex")},
+            now() + ${input.graceHours}::int * interval '1 hour')
+  `;
+    // 05 §6.10 step 2. `threads.environment_id` is NOT NULL.
+    for (const [key, label, isDefault] of [
+        ["production", "Production", true],
+        ["preview", "Preview", false],
+    ]) {
+        await tx `
+      INSERT INTO environments (id, org_id, project_id, key, label, is_default)
+      VALUES (${randomUUID()}, ${input.orgId}, ${id}, ${key}, ${label}, ${isDefault})
+    `;
+    }
+    // Round 1. D2 makes every thread belong to exactly one round and
+    // `threads.round_id` is NOT NULL — this line is the difference between a
+    // project that works and one that appears to.
+    await tx `
+    INSERT INTO rounds (id, org_id, project_id, number, name, created_by)
+    VALUES (${randomUUID()}, ${input.orgId}, ${id}, 1, 'Round 1', ${input.createdBy})
+  `;
+    for (const origin of origins) {
+        await tx `
+      INSERT INTO project_origins (id, org_id, project_id, pattern, is_wildcard)
+      VALUES (${randomUUID()}, ${input.orgId}, ${id}, ${origin}, ${origin.includes("*.")})
+    `;
+    }
+    return { id, uid, name };
+}
+//# sourceMappingURL=projects.js.map

package/dist/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../src/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AA4CjD;;;;;;;;;GASG;AACH,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,MAAM,GAAG,EAAE;IAChD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC;gBAAE,SAAS;YACvC,GAAG,IAAI,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,GAAG,GAAG,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kEAAkE;gBACzF,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kEAAkE,CAC5F,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,qDAAqD;QACrD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAA2B,EAC3B,KAAiB;IAEjB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC;IAClD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAErD,MAAM,EAAE,CAAA;;cAEI,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,GAAG,KAAK,IAAI;cACnC,WAAW,CAAC,EAAE,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;sBAC1C,KAAK,CAAC,UAAU;GACnC,CAAC;IAEF,yDAAyD;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI;QACpC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC;QAClC,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;KACrB,EAAE,CAAC;QACX,MAAM,EAAE,CAAA;;gBAEI,UAAU,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,EAAE,KAAK,GAAG,KAAK,KAAK,KAAK,SAAS;KAC9E,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,EAAE,CAAA;;cAEI,UAAU,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,EAAE,mBAAmB,KAAK,CAAC,SAAS;GAChF,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAA;;gBAEI,UAAU,EAAE,KAAK,KAAK,CAAC,KAAK,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;KACnF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/routes/attachments.js

@@ -0,0 +1,159 @@
+import { Hono } from "hono";
+import { randomUUID, createHash } from "node:crypto";
+import { HTTP_HEADER, ID_PREFIX } from "../vendor/types/names.js";
+import { getBucket, storageStatus } from "../storage/settings.js";
+import { storageKeyFor } from "../storage/bucket.js";
+function fail(c, status, code, message) {
+    return c.json({ error: { code, message, requestId: c.get("requestId") } }, status);
+}
+const EXT = {
+    "image/webp": "webp",
+    "image/jpeg": "jpg",
+    "image/png": "png",
+};
+export function attachmentRoutes(deps) {
+    const app = new Hono();
+    const { sql, keys, projects } = deps;
+    /**
+     * Upload one image. `kind` is `screenshot` or `image` — the automatic
+     * capture and a reviewer's own picture, which differ only in provenance.
+     */
+    app.post("/api/v1/projects/:uid/attachments", async (c) => {
+        const project = await projects.get(c.req.param("uid"));
+        if (!project)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const session = c.get("session");
+        if (!session)
+            return fail(c, 401, "unauthorized", "Open your review link, or reload the page, and try again.");
+        const bucket = await getBucket(sql, keys);
+        if (!bucket) {
+            // Annotation mode. 409 rather than 500: the instance is working exactly
+            // as configured, and the fix is an operator action, not a retry.
+            return fail(c, 409, "storage_not_configured", "This instance has no bucket connected, so it does not store pictures. Comments still work.");
+        }
+        const kind = c.req.header(HTTP_HEADER.attachmentKind) ?? "screenshot";
+        if (kind !== "screenshot" && kind !== "image") {
+            return fail(c, 422, "validation_failed", `Unsupported attachment kind "${kind}" on this route.`);
+        }
+        const contentType = (c.req.header("content-type") ?? "").split(";")[0].trim();
+        const ext = EXT[contentType];
+        if (!ext) {
+            return fail(c, 415, "unsupported_media_type", `Expected an image; got "${contentType || "nothing"}".`);
+        }
+        const body = new Uint8Array(await c.req.arrayBuffer());
+        if (!body.length)
+            return fail(c, 400, "validation_failed", "The body was empty.");
+        if (body.length > deps.maxImageBytes) {
+            // The widget encodes to A9b′'s 256 KB budget; this is the check that
+            // makes the budget true rather than merely intended.
+            return fail(c, 413, "body_too_large", `That image is ${Math.round(body.length / 1024)} KB; the limit is ${Math.round(deps.maxImageBytes / 1024)} KB.`);
+        }
+        // LOCK L4's lifetime quota, counted in bucket bytes. Checked BEFORE the
+        // write, because a quota enforced after the fact is a bill.
+        if (project.id) {
+            const [p] = await sql `
+        SELECT storage_bytes_used AS used, storage_bytes_limit AS limit FROM projects WHERE id = ${project.id}
+      `;
+            const limit = Number(p?.limit ?? 0);
+            if (limit > 0 && Number(p.used) + body.length > limit) {
+                return fail(c, 413, "storage_quota_exceeded", "This project has used its picture storage. Existing comments are unaffected.");
+            }
+        }
+        // The same digest the storage key is derived from — stored so integrity can
+        // be checked without re-reading the object, and so a duplicate upload is
+        // recognisable by content rather than by key alone.
+        const digest = createHash("sha256").update(body).digest();
+        const key = storageKeyFor(project.id, body, ext);
+        const width = Number(c.req.header(HTTP_HEADER.attachmentWidth)) || null;
+        const height = Number(c.req.header(HTTP_HEADER.attachmentHeight)) || null;
+        try {
+            await bucket.put(key, body, contentType);
+        }
+        catch (e) {
+            // The bucket is the operator's, so its failure is theirs to see —
+            // and the reviewer's comment must survive it (the widget falls back
+            // to sending the thread without a picture).
+            console.error(`attachment upload failed [${c.get("requestId")}]`, e);
+            return fail(c, 502, "storage_unavailable", "The picture could not be stored. Your comment can still be sent.");
+        }
+        const id = randomUUID();
+        await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${project.org_id}, true)`;
+            await tx `
+        INSERT INTO attachments (id, org_id, project_id, kind, state, storage_key, storage_backend,
+                                 content_type, bytes, width, height, sha256, uploaded_by)
+        -- 'pending', and the schema is what taught me that. §3.6's CHECKs say
+        -- state='bound' requires bound_at AND exactly one of thread_id or
+        -- comment_id -- and at upload time the thread does not exist yet,
+        -- because the widget uploads the picture and THEN creates the thread
+        -- so the attachment ref can ride the same write. So a row is born
+        -- pending and is bound by the thread create (05 §6.6: v1's wire binds
+        -- attachments relationally after the fact).
+        VALUES (${id}, ${project.org_id}, ${project.id}, ${kind}::snag_attachment_kind, 'pending',
+                ${key}, 's3', ${contentType}, ${body.length}, ${width}, ${height},
+                ${digest}, ${session.sub})
+        ON CONFLICT (storage_key) DO NOTHING
+      `;
+            // Two reviewers screenshotting the identical viewport produce the same
+            // hash and therefore the same key — one object, and the byte count is
+            // only charged once.
+            await tx `
+        UPDATE projects SET storage_bytes_used = storage_bytes_used + ${body.length}
+        WHERE id = ${project.id}
+          AND EXISTS (SELECT 1 FROM attachments WHERE id = ${id})
+      `;
+        });
+        const [row] = await sql `
+      SELECT id FROM attachments WHERE storage_key = ${key}
+    `;
+        return c.json({
+            id: ID_PREFIX.attachment + (row?.id ?? id),
+            kind,
+            contentType,
+            byteSize: body.length,
+            ...(width ? { width } : {}),
+            ...(height ? { height } : {}),
+        }, 201);
+    });
+    /**
+     * Serve the bytes back, proxied — M2-23(b): *"images proxied through the
+     * blob route, cacheable"*.
+     *
+     * Proxied rather than redirected to a presigned URL because an image in a
+     * comment thread is fetched by an `<img>` on our own origin, and a redirect
+     * to a short-lived URL breaks the moment the page outlives the signature.
+     */
+    app.get("/api/v1/attachments/:id/blob", async (c) => {
+        const wire = c.req.param("id");
+        const id = wire.startsWith(ID_PREFIX.attachment) ? wire.slice(ID_PREFIX.attachment.length) : wire;
+        const [row] = await sql `
+      SELECT storage_key, content_type, project_id FROM attachments
+      WHERE id = ${id} AND deleted_at IS NULL
+    `;
+        if (!row)
+            return fail(c, 404, "not_found", "No such attachment.");
+        const bucket = await getBucket(sql, keys);
+        if (!bucket)
+            return fail(c, 409, "storage_not_configured", "This instance has no bucket connected.");
+        const bytes = await bucket.get(row.storage_key).catch(() => null);
+        if (!bytes)
+            return fail(c, 404, "not_found", "That picture is not in the bucket.");
+        // Immutable: the key is a content hash, so the bytes at it cannot change.
+        c.header("Cache-Control", "public, max-age=31536000, immutable");
+        c.header("Content-Type", row.content_type);
+        // Honest note: this route has NO auth. The control is that attachment ids
+        // are unguessable UUIDs (a capability URL) plus ACAO: * so an <img> on any
+        // origin can render it. A signed/expiring form is attachment_shares
+        // (M2-23c) and is not built yet.
+        c.header("Cross-Origin-Resource-Policy", "cross-origin");
+        c.header("Access-Control-Allow-Origin", "*");
+        return c.body(bytes);
+    });
+    return app;
+}
+/** A9b: derived server-side from bucket presence, never probed by the widget. */
+export async function features(sql, keys) {
+    const st = await storageStatus(sql, keys);
+    return { screenshots: st.connected, uploads: st.connected };
+}
+//# sourceMappingURL=attachments.js.map

package/dist/routes/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../src/routes/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA+BrD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,GAAG,GAA2B;IAClC,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAErC;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,2DAA2D,CAAC,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;QACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,gCAAgC,IAAI,kBAAkB,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,qEAAqE;YACrE,qDAAqD;YACrD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAChH,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAmC;mGACqC,OAAO,CAAC,EAAE;OACtG,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,CAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACvD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,8EAA8E,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kEAAkE;YAClE,oEAAoE;YACpE,4CAA4C;YAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,kEAAkE,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,OAAO,CAAC,MAAM,SAAS,CAAC;YACnE,MAAM,EAAE,CAAA;;;;;;;;;;kBAUI,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,KAAK,IAAI;kBAC7C,GAAG,WAAW,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,KAAK,MAAM;kBAC9D,MAAM,KAAK,OAAO,CAAC,GAAG;;OAEjC,CAAC;YACF,uEAAuE;YACvE,sEAAsE;YACtE,qBAAqB;YACrB,MAAM,EAAE,CAAA;wEAC0D,IAAI,CAAC,MAAM;qBAC9D,OAAO,CAAC,EAAE;6DAC8B,EAAE;OACxD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAkB;uDACU,GAAG;KACrD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI;YACJ,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAqE;;mBAE7E,EAAE;KAChB,CAAC;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,wCAAwC,CAAC,CAAC;QAErG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,CAAC,CAAC;QAEnF,0EAA0E;QAC1E,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,2EAA2E;QAC3E,oEAAoE;QACpE,iCAAiC;QACjC,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,KAA+B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAiB,EACjB,IAAa;IAEb,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/routes/auth.js

@@ -0,0 +1,55 @@
+import { verifySession } from "../session.js";
+/**
+ * Bearer auth for the widget's project routes — 05 §4.4.
+ *
+ * Verify, then compare `epo` against the 10-second project cache. That
+ * comparison is the entire revocation mechanism and it costs no query: the
+ * cache entry was already read to resolve the project.
+ *
+ * OPTIONAL BY DESIGN. This attaches a session when one is presented and
+ * verifies; it does not refuse when none is. Refusing here would make every
+ * READ require a credential, and 05 §4.2's `open` write mode exists precisely
+ * so a fresh project works before anyone has been sent a link. The ROUTES
+ * decide what they require — thread creation demands a session, listing does
+ * not — which keeps "who are you" and "what may you do" as two questions with
+ * two answers rather than one conflated gate.
+ *
+ * A presented-but-INVALID bearer is different from none at all, and is
+ * reported: a reviewer whose link was revoked mid-session needs F-19, not a
+ * silent downgrade to read-only that looks like the widget quietly breaking.
+ */
+export function bearerAuth(keys, projects, absoluteTtlS) {
+    return async (c, next) => {
+        const token = /^Bearer (.+)$/i.exec(c.req.header("Authorization") ?? "")?.[1];
+        const uid = c.req.param("uid");
+        if (!token || !uid)
+            return next();
+        const project = await projects.get(uid).catch(() => null);
+        if (!project)
+            return next();
+        const v = await verifySession(keys, token, {
+            projectUid: uid,
+            expectedEpoch: project.session_epoch,
+            absoluteTtlS,
+        });
+        if (v.ok) {
+            c.set("session", v.claims);
+            return next();
+        }
+        // Revocation is the one failure that must not be silent. `expired` is
+        // handled by the client refreshing, and a malformed or foreign token is
+        // treated as no credential — but "you were signed out" has to reach the
+        // reviewer, or a revoked link looks like a broken widget.
+        if (v.reason === "session_revoked") {
+            return c.json({
+                error: {
+                    code: "session_revoked",
+                    message: "This review link was turned off. Ask whoever sent it for a new one.",
+                    requestId: c.get("requestId"),
+                },
+            }, 401);
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAsB,MAAM,eAAe,CAAC;AAElE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,QAAsB,EAAE,YAAoB;IACpF,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,EAAE,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;YACzC,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,YAAY;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,MAAuB,CAAC,CAAC;YAC5C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,qEAAqE;oBAC9E,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;iBAC9B;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/commentEdit.js

@@ -0,0 +1,201 @@
+import { Hono } from "hono";
+import { ID_PREFIX } from "../vendor/types/names.js";
+import { csrfOk } from "./owner.js";
+/** §4.5's author window. */
+export const EDIT_WINDOW_MS = 15 * 60 * 1000;
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function rowId(wire, prefix) {
+    if (typeof wire !== "string")
+        return null;
+    const bare = wire.startsWith(prefix) ? wire.slice(prefix.length) : wire;
+    return UUID.test(bare) ? bare.toLowerCase() : null;
+}
+export function commentEditRoutes(deps) {
+    const app = new Hono();
+    const { sql } = deps;
+    const now = deps.now ?? (() => new Date());
+    /** The comment, its author and its thread's privacy, in one round trip. */
+    async function load(wire) {
+        const id = rowId(wire, ID_PREFIX.comment);
+        if (!id)
+            return null;
+        const [row] = await sql `
+      SELECT c.id, c.org_id, c.project_id, c.thread_id, c.author_id, c.body, c.private,
+             c.created_at, c.deleted_at,
+             t.private AS thread_private,
+             r.name AS author_name, r.kind AS author_kind
+        FROM comments c
+        JOIN threads t ON t.id = c.thread_id
+        JOIN reviewers r ON r.id = c.author_id
+       WHERE c.id = ${id}::uuid
+    `;
+        return row ?? null;
+    }
+    /**
+     * Can this caller act on this comment, and how?
+     *
+     * Returns the reason it cannot, or null. Deliberately one function for both
+     * routes: "who owns a comment" answered in two places is how the two answers
+     * drift, and the drift is always in the permissive direction.
+     */
+    function refuse(c, row, action) {
+        const owner = c.get("owner");
+        const session = c.get("session");
+        const asOwner = !!owner && owner.orgId === row.org_id;
+        const isAuthor = !!session && session.sub === row.author_id;
+        if (!asOwner && !session) {
+            return fail(c, 401, "unauthorized", "Sign in, or open your review link, and try again.");
+        }
+        // The owner cookie's half of `requireOwner()`, run inline — this path is
+        // also reached by a reviewer session, so the middleware cannot be mounted.
+        if (asOwner && !csrfOk(c)) {
+            return fail(c, 403, "csrf_failed", "That request could not be verified. Reload the dashboard and try again.");
+        }
+        if (asOwner) {
+            /**
+             * An owner may DELETE anything and EDIT only their own.
+             *
+             * Editing somebody else's words while their name stays on them is not a
+             * moderation power, it is a forgery — and the honest tool for a comment
+             * the studio does not want is the one next to it.
+             */
+            if (action === "delete" || isAuthor)
+                return null;
+            return fail(c, 403, "forbidden", "You can delete this comment, but not rewrite it — it would still carry its author's name.");
+        }
+        if (!isAuthor) {
+            // Not "you may not": a reviewer cannot be told which comments exist and
+            // belong to somebody else.
+            return fail(c, 403, "forbidden", "You can only change your own comments.");
+        }
+        // §4.5's window. A comment somebody has already read and acted on must not
+        // silently become a different comment.
+        const age = now().getTime() - row.created_at.getTime();
+        if (age > EDIT_WINDOW_MS) {
+            return fail(c, 403, "edit_window_expired", `Comments can be changed for ${EDIT_WINDOW_MS / 60000} minutes after they are written. ` +
+                `Add a reply instead — it keeps the conversation readable.`);
+        }
+        return null;
+    }
+    /** §3.11's wire shape, for a live comment or a tombstone. */
+    const shape = (row) => row.deleted_at
+        ? {
+            id: ID_PREFIX.comment + row.id,
+            deletedAt: row.deleted_at.toISOString(),
+            body: null,
+            // The NAME survives, so the conversation still reads. Nothing else
+            // does — and `seq` is not here, because with private replies
+            // interleaved it would let a client count what it cannot read.
+            author: { name: row.author_name },
+        }
+        : {
+            id: ID_PREFIX.comment + row.id,
+            body: row.body,
+            ...(row.created_at ? { createdAt: row.created_at.toISOString() } : {}),
+            author: {
+                id: ID_PREFIX.reviewer + row.author_id,
+                name: row.author_name,
+                kind: row.author_kind,
+            },
+        };
+    /** Endpoint 12 — `PATCH /api/v1/comments/{id}`. */
+    const patch = async (c) => {
+        const row = await load(c.req.param("id"));
+        if (!row || row.deleted_at)
+            return fail(c, 404, "comment_not_found", "No such comment.");
+        const refused = refuse(c, row, "edit");
+        if (refused)
+            return refused;
+        const body = (await c.req.json().catch(() => null));
+        const next = typeof body?.["body"] === "string" ? body["body"] : "";
+        if (!next.trim())
+            return fail(c, 400, "validation_failed", "body is required.");
+        if (next.length > 10_000) {
+            return fail(c, 400, "body_too_large", "A comment may be at most 10,000 characters.");
+        }
+        // `private` is not editable here. Changing a reply's audience after people
+        // have read it is a different decision from fixing its words, and folding
+        // them into one route means a typo correction can silently change who can
+        // see it.
+        if (body && "private" in body) {
+            return fail(c, 422, "field_not_permitted", "A comment's audience is not changed by editing it.", {
+                field: "private",
+            });
+        }
+        const [updated] = await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${row.org_id}, true)`;
+            // `version` and `updated_at` on the THREAD, so a `?since=` poll carries
+            // the edit. Without this the corrected text would reach nobody until
+            // something else touched the thread.
+            await tx `
+        UPDATE threads SET version = version + 1, updated_at = now() WHERE id = ${row.thread_id}::uuid
+      `;
+            return tx `
+        UPDATE comments SET body = ${next}, edited_at = now()
+         WHERE id = ${row.id}::uuid
+        RETURNING id, body, created_at, deleted_at,
+                  ${row.author_id}::uuid AS author_id,
+                  ${row.author_name}::text AS author_name,
+                  ${row.author_kind}::text AS author_kind
+      `;
+        });
+        return c.json({ ...shape(updated), editedAt: new Date().toISOString() });
+    };
+    /** Endpoint 13 — `DELETE /api/v1/comments/{id}`. */
+    const remove = async (c) => {
+        const row = await load(c.req.param("id"));
+        if (!row)
+            return fail(c, 404, "comment_not_found", "No such comment.");
+        // Deleting twice is the same outcome as deleting once, and a reviewer who
+        // taps twice on a slow connection should not see an error for getting what
+        // they asked for.
+        if (row.deleted_at)
+            return c.json(shape(row));
+        const refused = refuse(c, row, "delete");
+        if (refused)
+            return refused;
+        const [tombstone] = await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${row.org_id}, true)`;
+            /**
+             * The counters, in the same statement as the tombstone.
+             *
+             * `comment_count` is every reply and `comment_count_public` is the ones a
+             * client may read — so a private comment being deleted must decrement the
+             * first and not the second. Getting this wrong is invisible until a
+             * thread shows "3 replies" above two of them.
+             *
+             * `GREATEST(…, 0)` because a counter that has already drifted must not go
+             * negative and start rendering as "-1 replies" forever.
+             */
+            await tx `
+        UPDATE threads
+           SET comment_count = GREATEST(comment_count - 1, 0),
+               comment_count_public = GREATEST(comment_count_public - ${row.private ? 0 : 1}, 0),
+               version = version + 1,
+               updated_at = now()
+         WHERE id = ${row.thread_id}::uuid
+      `;
+            return tx `
+        UPDATE comments SET body = NULL, deleted_at = now()
+         WHERE id = ${row.id}::uuid
+        RETURNING id, body, created_at, deleted_at,
+                  ${row.author_id}::uuid AS author_id,
+                  ${row.author_name}::text AS author_name,
+                  ${row.author_kind}::text AS author_kind
+      `;
+        });
+        return c.json(shape(tombstone));
+    };
+    // 05's canonical unscoped form, plus the project-scoped one the widget's URL
+    // builder produces — the same pairing `comments.ts` documents, and for the
+    // same reason: the widget builds every URL as root + path.
+    app.patch("/api/v1/comments/:id", patch);
+    app.patch("/api/v1/projects/:uid/comments/:id", patch);
+    app.delete("/api/v1/comments/:id", remove);
+    app.delete("/api/v1/projects/:uid/comments/:id", remove);
+    return app;
+}
+//# sourceMappingURL=commentEdit.js.map

package/dist/routes/commentEdit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commentEdit.js","sourceRoot":"","sources":["../../src/routes/commentEdit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AA2CtD,4BAA4B;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAsBD,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,2EAA2E;IAC3E,KAAK,UAAU,IAAI,CAAC,IAAwB;QAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAO;;;;;;;;sBAQZ,EAAE;KACnB,CAAC;QACF,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACH,SAAS,MAAM,CAAC,CAAM,EAAE,GAAQ,EAAE,MAAyB;QACzD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,SAAS,CAAC;QAE5D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,mDAAmD,CAAC,CAAC;QAC3F,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,yEAAyE,CAAC,CAAC;QAChH,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ;;;;;;eAMG;YACH,IAAI,MAAM,KAAK,QAAQ,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACjD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,WAAW,EACX,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,wEAAwE;YACxE,2BAA2B;YAC3B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,wCAAwC,CAAC,CAAC;QAC7E,CAAC;QAED,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACvD,IAAI,GAAG,GAAG,cAAc,EAAE,CAAC;YACzB,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,qBAAqB,EACrB,+BAA+B,cAAc,GAAG,KAAK,mCAAmC;gBACtF,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6DAA6D;IAC7D,MAAM,KAAK,GAAG,CAAC,GACoE,EAAE,EAAE,CACrF,GAAG,CAAC,UAAU;QACZ,CAAC,CAAC;YACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,GAAG,CAAC,EAAE;YAC9B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;YACvC,IAAI,EAAE,IAAI;YACV,mEAAmE;YACnE,6DAA6D;YAC7D,+DAA+D;YAC/D,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE;SAClC;QACH,CAAC,CAAC;YACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,GAAG,CAAC,EAAE;YAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,GAAG,CAAC,SAAS;gBACtC,IAAI,EAAE,GAAG,CAAC,WAAW;gBACrB,IAAI,EAAE,GAAG,CAAC,WAAW;aACtB;SACF,CAAC;IAER,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QAEzF,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,UAAU;QACV,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,oDAAoD,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC7C,MAAM,EAAE,CAAA,mCAAmC,GAAG,CAAC,MAAM,SAAS,CAAC;YAC/D,wEAAwE;YACxE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,EAAE,CAAA;kFACoE,GAAG,CAAC,SAAS;OACxF,CAAC;YACF,OAAO,EAAE,CAAO;qCACe,IAAI;sBACnB,GAAG,CAAC,EAAE;;oBAER,GAAG,CAAC,SAAS;oBACb,GAAG,CAAC,WAAW;oBACf,GAAG,CAAC,WAAW;OAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,OAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC;IAEF,oDAAoD;IACpD,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,kBAAkB;QAClB,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,EAAE,CAAA,mCAAmC,GAAG,CAAC,MAAM,SAAS,CAAC;YAC/D;;;;;;;;;;eAUG;YACH,MAAM,EAAE,CAAA;;;wEAG0D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;;sBAGrE,GAAG,CAAC,SAAS;OAC5B,CAAC;YACF,OAAO,EAAE,CAAO;;sBAEA,GAAG,CAAC,EAAE;;oBAER,GAAG,CAAC,SAAS;oBACb,GAAG,CAAC,WAAW;oBACf,GAAG,CAAC,WAAW;OAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAU,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,2DAA2D;IAC3D,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;IACzC,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IACvD,GAAG,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC3C,GAAG,CAAC,MAAM,CAAC,oCAAoC,EAAE,MAAM,CAAC,CAAC;IAEzD,OAAO,GAAG,CAAC;AACb,CAAC"}