@snagset/server 0.0.3 → 0.1.0

package/dist/routes/anchorReports.js

@@ -0,0 +1,196 @@
+import { Hono } from "hono";
+import { randomUUID } from "node:crypto";
+import { ID_PREFIX } from "../vendor/types/names.js";
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function rowId(wire, prefix) {
+    if (typeof wire !== "string")
+        return null;
+    const bare = wire.startsWith(prefix) ? wire.slice(prefix.length) : wire;
+    return UUID.test(bare) ? bare.toLowerCase() : null;
+}
+/** 03 §5's enum, not free text. `manual` is reported by v2 repair, never by `resolve()`. */
+const STRATEGY = new Set([
+    "testid",
+    "domid",
+    "css",
+    "aria",
+    "text-exact",
+    "text-fuzzy",
+    "path-rect",
+    "none",
+    "manual",
+]);
+/**
+ * foundations §14.2's ordering. `pending` is deliberately absent — it is not a
+ * settled state, and §6.7 rejects it: a client reporting "I have not finished
+ * yet" is not reporting an outcome.
+ */
+const RANK = { orphaned: 0, approximate: 1, anchored: 2 };
+const MAX_REPORTS = 50;
+/** §6.7: idempotent within 60 s per (thread, build, strategy). */
+const DEDUPE_MS = 60_000;
+const RATE_WINDOW_MS = 60_000;
+export function anchorReportRoutes(sql, projects, perMinute) {
+    const app = new Hono();
+    app.post("/api/v1/projects/:uid/anchor-reports", async (c) => {
+        const p = await projects.get(c.req.param("uid")).catch(() => null);
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const session = c.get("session");
+        if (!session) {
+            return fail(c, 401, "unauthorized", "Open your review link, or reload the page, and try again.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const reports = Array.isArray(body?.reports) ? body.reports : null;
+        if (!reports || reports.length === 0 || reports.length > MAX_REPORTS) {
+            return fail(c, 400, "validation_failed", `reports must be an array of 1 to ${MAX_REPORTS} items.`, { field: "reports" });
+        }
+        // Validate EVERY report before writing ANY of them. A batch that is half
+        // valid should not leave half a batch in the telemetry — the client has no
+        // way to learn which half landed, since the success case is a bare 204.
+        const parsed = [];
+        for (const r of reports) {
+            const threadRow = rowId(r["threadId"], ID_PREFIX.thread);
+            if (!threadRow) {
+                return fail(c, 400, "validation_failed", "threadId must be a thread id.", { field: "threadId" });
+            }
+            const state = String(r["state"]);
+            if (!(state in RANK)) {
+                return fail(c, 400, "validation_failed", "state must be one of orphaned, approximate, anchored — 'pending' is not an outcome.", { field: "state" });
+            }
+            const strategy = String(r["strategy"]);
+            if (!STRATEGY.has(strategy)) {
+                // 422, not 400, and §6.7 says why: a telemetry table that accepts
+                // anything measures nothing.
+                return fail(c, 422, "validation_failed", `Unknown anchor strategy '${strategy}'.`, {
+                    field: "strategy",
+                });
+            }
+            const confidence = Number(r["confidence"]);
+            if (!Number.isFinite(confidence) || confidence < 0 || confidence > 1) {
+                return fail(c, 400, "validation_failed", "confidence must be between 0 and 1.", {
+                    field: "confidence",
+                });
+            }
+            const ms = Number(r["ms"]);
+            parsed.push({
+                threadRow,
+                state,
+                confidence,
+                strategy,
+                build: typeof r["build"] === "string" && r["build"] ? r["build"] : null,
+                ms: Number.isFinite(ms) ? Math.round(ms) : null,
+            });
+        }
+        /**
+         * Rate limit AFTER validation, so a malformed batch still gets its 4xx
+         * rather than being silently swallowed by a limit it also tripped — the
+         * developer integrating this needs the error more than we need the saving.
+         */
+        const now = new Date();
+        const windowStart = new Date(now.getTime() - RATE_WINDOW_MS);
+        const [counter] = await sql `
+      INSERT INTO rate_counters (org_id, bucket_key, window_start, count, expires_at)
+      VALUES (${p.org_id}, ${`anch:${session.sid}`}, ${now}, ${parsed.length},
+              ${new Date(now.getTime() + RATE_WINDOW_MS)})
+      ON CONFLICT (org_id, bucket_key) DO UPDATE
+        SET count = CASE WHEN rate_counters.window_start < ${windowStart} THEN ${parsed.length}
+                         ELSE rate_counters.count + ${parsed.length} END,
+            window_start = CASE WHEN rate_counters.window_start < ${windowStart} THEN ${now}
+                                ELSE rate_counters.window_start END,
+            expires_at = ${new Date(now.getTime() + RATE_WINDOW_MS)}
+      RETURNING count::text
+    `;
+        // Dropped, not queued, and not an error. §12.1 rule 8.
+        if (Number(counter?.count ?? 0) > perMinute())
+            return c.body(null, 204);
+        await sql.begin(async (tx) => {
+            await tx `SELECT set_config('app.org_id', ${p.org_id}, true)`;
+            for (const r of parsed) {
+                const [thread] = await tx `
+          SELECT id, anchor_state, anchor_state_build, last_anchor_check, version
+          FROM threads WHERE id = ${r.threadRow} AND project_id = ${p.id} AND deleted_at IS NULL
+        `;
+                // Not this project's thread. Skipped rather than failing the batch:
+                // the 404 case §6.7 names is a caller sending someone else's id, and
+                // by here we have already taken the rate-limit hit for it. A deleted
+                // thread is the same shape and is even less worth an error.
+                if (!thread)
+                    continue;
+                /**
+                 * §6.7's 60-second idempotency, by natural key rather than a header. A
+                 * re-rendering SPA that resolves the same pin four times in a second
+                 * is not four observations; it is one, seen four times.
+                 */
+                const [recent] = await tx `
+          SELECT count(*)::int AS n FROM anchor_events
+          WHERE thread_id = ${thread.id}
+            AND strategy = ${r.strategy}
+            AND build IS NOT DISTINCT FROM ${r.build}
+            AND at > ${new Date(now.getTime() - DEDUPE_MS)}
+        `;
+                if ((recent?.n ?? 0) > 0)
+                    continue;
+                /**
+                 * THE MONOTONIC MERGE (§6.7, foundations §14.2 normative).
+                 *
+                 * A new build is exactly when a pin is allowed to get worse — that is
+                 * what keeps this monotonic rather than a one-way ratchet that could
+                 * never report a real regression. Otherwise the maximum wins within
+                 * the scope, and when neither side knows a build the scope is a
+                 * rolling 24 hours.
+                 */
+                const newBuild = !!r.build && r.build !== thread.anchor_state_build;
+                const stale = !r.build &&
+                    !thread.anchor_state_build &&
+                    !!thread.last_anchor_check &&
+                    now.getTime() - new Date(thread.last_anchor_check).getTime() > 24 * 60 * 60 * 1000;
+                const resets = newBuild || stale;
+                const next = resets
+                    ? r.state
+                    : (RANK[r.state] ?? 0) > (RANK[thread.anchor_state] ?? 0)
+                        ? r.state
+                        : thread.anchor_state;
+                const applied = next !== thread.anchor_state || resets;
+                await tx `
+          INSERT INTO anchor_events (id, org_id, project_id, thread_id, state, confidence,
+                                     strategy, actor_kind, actor_id, build, ms, applied)
+          VALUES (${randomUUID()}, ${p.org_id}, ${p.id}, ${thread.id}, ${r.state}::snag_anchor_state,
+                  ${r.confidence}, ${r.strategy}, 'runtime', NULL, ${r.build}, ${r.ms}, ${applied})
+        `;
+                /**
+                 * `updated_at` and `version` move ONLY when the state actually
+                 * changed. Telemetry must not wake a polling client, and it must not
+                 * enqueue an outbox row for a non-event — a reviewer being emailed
+                 * because somebody's browser re-measured a pin is the kind of noise
+                 * that teaches people to filter the sender.
+                 */
+                if (next !== thread.anchor_state) {
+                    await tx `
+            UPDATE threads
+               SET anchor_state = ${next}::snag_anchor_state,
+                   anchor_state_build = ${r.build ?? thread.anchor_state_build},
+                   last_anchor_check = ${now},
+                   updated_at = ${now},
+                   version = version + 1
+             WHERE id = ${thread.id}
+          `;
+                }
+                else {
+                    await tx `
+            UPDATE threads
+               SET last_anchor_check = ${now},
+                   anchor_state_build = ${r.build ?? thread.anchor_state_build}
+             WHERE id = ${thread.id}
+          `;
+                }
+            }
+        });
+        return c.body(null, 204);
+    });
+    return app;
+}
+//# sourceMappingURL=anchorReports.js.map

package/dist/routes/anchorReports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchorReports.js","sourceRoot":"","sources":["../../src/routes/anchorReports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAgCjD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,QAAQ;IACR,OAAO;IACP,KAAK;IACL,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,IAAI,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAElF,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,kEAAkE;AAClE,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,MAAM,UAAU,kBAAkB,CAChC,GAAiB,EACjB,QAAsB,EACtB,SAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAE5B,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAE9E,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,2DAA2D,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAiC,CAAC;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAAqC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACrE,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,mBAAmB,EACnB,oCAAoC,WAAW,SAAS,EACxD,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,MAAM,GAON,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,+BAA+B,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;gBACrB,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,mBAAmB,EACnB,qFAAqF,EACrF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,kEAAkE;gBAClE,6BAA6B;gBAC7B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,4BAA4B,QAAQ,IAAI,EAAE;oBACjF,KAAK,EAAE,UAAU;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,qCAAqC,EAAE;oBAC9E,KAAK,EAAE,YAAY;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS;gBACT,KAAK;gBACL,UAAU;gBACV,QAAQ;gBACR,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;gBACvE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;aAChD,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;QAC7D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,CAAqB;;gBAEpC,CAAC,CAAC,MAAM,KAAK,QAAQ,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,KAAK,MAAM,CAAC,MAAM;gBAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;;6DAEK,WAAW,SAAS,MAAM,CAAC,MAAM;sDACxC,MAAM,CAAC,MAAM;oEACC,WAAW,SAAS,GAAG;;2BAEhE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC;;KAE9D,CAAC;QACF,uDAAuD;QACvD,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,SAAS,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,CAAC,CAAC,MAAM,SAAS,CAAC;YAE7D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAQxB;;oCAE2B,CAAC,CAAC,SAAS,qBAAqB,CAAC,CAAC,EAAE;SAC/D,CAAC;gBACF,oEAAoE;gBACpE,qEAAqE;gBACrE,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,CAAC,MAAM;oBAAE,SAAS;gBAEtB;;;;mBAIG;gBACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAiB;;8BAEpB,MAAM,CAAC,EAAE;6BACV,CAAC,CAAC,QAAQ;6CACM,CAAC,CAAC,KAAK;uBAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC;SACjD,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAEnC;;;;;;;;mBAQG;gBACH,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,kBAAkB,CAAC;gBACpE,MAAM,KAAK,GACT,CAAC,CAAC,CAAC,KAAK;oBACR,CAAC,MAAM,CAAC,kBAAkB;oBAC1B,CAAC,CAAC,MAAM,CAAC,iBAAiB;oBAC1B,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;gBAErF,MAAM,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM;oBACjB,CAAC,CAAC,CAAC,CAAC,KAAK;oBACT,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;wBACvD,CAAC,CAAC,CAAC,CAAC,KAAK;wBACT,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;gBAEvD,MAAM,EAAE,CAAA;;;oBAGI,UAAU,EAAE,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK;oBAC5D,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,sBAAsB,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,OAAO;SACxF,CAAC;gBAEF;;;;;;mBAMG;gBACH,IAAI,IAAI,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;oBACjC,MAAM,EAAE,CAAA;;oCAEkB,IAAI;0CACE,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,kBAAkB;yCACrC,GAAG;kCACV,GAAG;;0BAEX,MAAM,CAAC,EAAE;WACxB,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,CAAA;;yCAEuB,GAAG;0CACF,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,kBAAkB;0BACpD,MAAM,CAAC,EAAE;WACxB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/assignees.js

@@ -0,0 +1,139 @@
+import { Hono } from "hono";
+import { randomUUID } from "node:crypto";
+import { ID_PREFIX } from "../vendor/types/names.js";
+/**
+ * WHO IS IN THE POOL — §6.4b's predicate, in one place, over an alias `r`.
+ * Blocked and erased reviewers leave the pool but keep their existing
+ * assignments (un-assigning on block would rewrite history on threads
+ * somebody is mid-conversation on); a guest who exchanged a session but never
+ * wrote is not in it (the matrix's "be assigned: ✓ once they have written").
+ * The thread PATCH validates a candidate against the same predicate, which is
+ * why it is exported rather than inlined in the query below.
+ */
+export function inPool(t) {
+    return t `r.blocked_at IS NULL AND r.erased_at IS NULL
+           AND (r.user_id IS NOT NULL OR r.invited_by IS NOT NULL
+                OR r.thread_count > 0 OR r.comment_count > 0)`;
+}
+function fail(c, status, code, message, details) {
+    return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
+}
+/** Foundations §5's `Reviewer`, plus the two derived flags the dropdown groups by. */
+export function shapeReviewer(r, withEmail) {
+    return {
+        id: ID_PREFIX.reviewer + String(r["id"]),
+        name: String(r["name"] ?? ""),
+        kind: String(r["kind"] ?? "guest"),
+        ...(withEmail && r["email"] ? { email: String(r["email"]) } : {}),
+        ...(r["avatar_url"] ? { avatarUrl: String(r["avatar_url"]) } : {}),
+        // Derived on the wire, not stored twice — so the dropdown can put "the
+        // studio" above "people who have commented". NOT a permission.
+        isTeam: !!r["is_team"],
+        isMe: !!r["is_me"],
+    };
+}
+export function assigneeRoutes(deps) {
+    const { sql, projects } = deps;
+    const app = new Hono();
+    const inOrg = (orgId, fn) => sql.begin(async (tx) => {
+        await tx `SELECT set_config('app.org_id', ${orgId}, true)`;
+        return fn(tx);
+    });
+    app.get("/api/v1/projects/:uid/assignees", async (c) => {
+        const p = await projects.get(c.req.param("uid"));
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const owner = c.get("owner");
+        const session = c.get("session");
+        const asOwner = !!owner && owner.orgId === p.org_id;
+        if (!asOwner && !session) {
+            return fail(c, 401, "unauthorized", "Open your review link, or reload the page, and try again.");
+        }
+        // Emails are for the people who can route work, not for a client reading
+        // names: a link session sees who is in the pool, never the studio's
+        // addresses.
+        const mayAssign = asOwner || !!session?.perm.includes("thread:assign");
+        // A prefix match on name and email — the pool is single- to double-digit
+        // for this product's audience; a convenience, not a search feature.
+        const q = (c.req.query("q") ?? "").trim().slice(0, 80);
+        const limit = Math.min(Math.max(Number(c.req.query("limit")) || 100, 1), 200);
+        const rows = await inOrg(p.org_id, (tx) => tx `
+        SELECT r.id, r.name, r.email, r.kind, r.avatar_url,
+               (r.user_id IS NOT NULL) AS is_team,
+               ${asOwner ? tx `(r.user_id = ${owner.userId}::uuid)` : tx `(r.id = ${session.sub}::uuid)`} AS is_me,
+               count(*) OVER () AS total
+        FROM reviewers r
+        WHERE r.project_id = ${p.id}::uuid
+          AND ${inPool(tx)}
+          ${q ? tx `AND (r.name ILIKE ${q + "%"} OR r.email ILIKE ${q + "%"})` : tx ``}
+        -- The studio first (you assign to a colleague more often than to
+        -- anyone else), then most recently active, which puts the person who
+        -- just commented at the top of the list you opened because they did.
+        ORDER BY is_team DESC, r.last_seen_at DESC
+        LIMIT ${limit}
+      `);
+        c.header("Cache-Control", "private, max-age=30");
+        return c.json({
+            data: rows.map((r) => shapeReviewer(r, mayAssign)),
+            total: Number(rows[0]?.["total"] ?? 0),
+        });
+    });
+    /**
+     * Naming a person who has not written yet — DESIGN.md Q4's *+ Add person*,
+     * and the case D3 needs on day one: a question assigned to a client BEFORE
+     * that client has said anything.
+     *
+     * A PLACEHOLDER: `kind='guest'`, no secret, `invited_by` set. A name to
+     * assign to and not a credential — no exchange can ever authenticate as it.
+     *
+     * Dashboard only in v1. §6.4b also admits a session holding `thread:assign`,
+     * but `invited_by` is a `users.id` and a team-link session carries no user;
+     * refusing with a sentence beats inventing an inviter.
+     */
+    app.post("/api/v1/projects/:uid/assignees", async (c) => {
+        const p = await projects.get(c.req.param("uid"));
+        if (!p)
+            return fail(c, 404, "project_not_found", "No project with that uid.");
+        const owner = c.get("owner");
+        const asOwner = !!owner && owner.orgId === p.org_id;
+        if (!asOwner) {
+            return fail(c, 403, "forbidden", "Adding a person to assign to is done from the dashboard.");
+        }
+        const body = (await c.req.json().catch(() => null));
+        const name = typeof body?.name === "string" ? body.name.trim().slice(0, 80) : "";
+        if (!name)
+            return fail(c, 400, "validation_failed", "Give the person a name.", { field: "name" });
+        const emailRaw = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
+        if (emailRaw && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(emailRaw)) {
+            return fail(c, 400, "validation_failed", "That does not look like an email address.", { field: "email" });
+        }
+        const email = emailRaw || null;
+        const [row, created] = await inOrg(p.org_id, async (tx) => {
+            if (email) {
+                // The same person named twice is one person: an unerased row with
+                // that address — a placeholder, a link reviewer, a studio member —
+                // is returned rather than duplicated.
+                const [same] = await tx `
+          SELECT r.id, r.name, r.email, r.kind, r.avatar_url, (r.user_id IS NOT NULL) AS is_team,
+                 (r.user_id = ${owner.userId}::uuid) AS is_me
+          FROM reviewers r
+          WHERE r.project_id = ${p.id}::uuid AND lower(r.email) = ${email} AND r.erased_at IS NULL
+          ORDER BY r.last_seen_at DESC
+          LIMIT 1
+        `;
+                if (same)
+                    return [same, false];
+            }
+            const id = randomUUID();
+            const [made] = await tx `
+        INSERT INTO reviewers (id, org_id, project_id, kind, name, email, invited_by)
+        VALUES (${id}::uuid, ${p.org_id}::uuid, ${p.id}::uuid, 'guest', ${name}, ${email}, ${owner.userId}::uuid)
+        RETURNING id, name, email, kind, avatar_url, false AS is_team, false AS is_me
+      `;
+            return [made, true];
+        });
+        return c.json(shapeReviewer(row, true), created ? 201 : 200);
+    });
+    return app;
+}
+//# sourceMappingURL=assignees.js.map

package/dist/routes/assignees.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignees.js","sourceRoot":"","sources":["../../src/routes/assignees.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAiCjD;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,CAA0B;IAC/C,OAAO,CAAC,CAAA;;8DAEoD,CAAC;AAC/D,CAAC;AAED,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,CAA0B,EAAE,SAAkB;IAC1E,OAAO;QACL,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC;QAClC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,CAAI,KAAa,EAAE,EAA+C,EAAE,EAAE,CAClF,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACrB,MAAM,EAAE,CAAA,mCAAmC,KAAK,SAAS,CAAC;QAC1D,OAAO,EAAE,CAAC,EAA6B,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEL,GAAG,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,2DAA2D,CAAC,CAAC;QACnG,CAAC;QACD,yEAAyE;QACzE,oEAAoE;QACpE,aAAa;QACb,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAE9E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CACxC,EAAE,CAA2B;;;iBAGlB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA,gBAAgB,KAAM,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA,WAAW,OAAQ,CAAC,GAAG,SAAS;;;+BAGzE,CAAC,CAAC,EAAE;gBACnB,MAAM,CAAC,EAAE,CAAC;YACd,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA,qBAAqB,CAAC,GAAG,GAAG,qBAAqB,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA,EAAE;;;;;gBAKpE,KAAK;OACd,CACF,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,0DAA0D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACtF,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2CAA2C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,CAAC;QAE/B,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YACxD,IAAI,KAAK,EAAE,CAAC;gBACV,kEAAkE;gBAClE,mEAAmE;gBACnE,sCAAsC;gBACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAA2B;;gCAE1B,KAAM,CAAC,MAAM;;iCAEZ,CAAC,CAAC,EAAE,+BAA+B,KAAK;;;SAGhE,CAAC;gBACF,IAAI,IAAI;oBAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC;YAC1C,CAAC;YACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAA2B;;kBAEtC,EAAE,WAAW,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,oBAAoB,IAAI,KAAK,KAAK,KAAK,KAAM,CAAC,MAAM;;OAEnG,CAAC;YACF,OAAO,CAAC,IAAK,EAAE,IAAI,CAAU,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/attachments.js

@@ -152,8 +152,8 @@ export function attachmentRoutes(deps) {
     return app;
 }
 /** A9b: derived server-side from bucket presence, never probed by the widget. */
-export async function features(sql, keys) {
-    const st = await storageStatus(sql, keys);
+export async function features(sql, keys, env = process.env) {
+    const st = await storageStatus(sql, keys, env);
     return { screenshots: st.connected, uploads: st.connected };
 }
 //# sourceMappingURL=attachments.js.map

package/dist/routes/attachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../src/routes/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA+BrD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,GAAG,GAA2B;IAClC,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAErC;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,2DAA2D,CAAC,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;QACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,gCAAgC,IAAI,kBAAkB,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,qEAAqE;YACrE,qDAAqD;YACrD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAChH,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAmC;mGACqC,OAAO,CAAC,EAAE;OACtG,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,CAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACvD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,8EAA8E,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kEAAkE;YAClE,oEAAoE;YACpE,4CAA4C;YAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,kEAAkE,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,OAAO,CAAC,MAAM,SAAS,CAAC;YACnE,MAAM,EAAE,CAAA;;;;;;;;;;kBAUI,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,KAAK,IAAI;kBAC7C,GAAG,WAAW,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,KAAK,MAAM;kBAC9D,MAAM,KAAK,OAAO,CAAC,GAAG;;OAEjC,CAAC;YACF,uEAAuE;YACvE,sEAAsE;YACtE,qBAAqB;YACrB,MAAM,EAAE,CAAA;wEAC0D,IAAI,CAAC,MAAM;qBAC9D,OAAO,CAAC,EAAE;6DAC8B,EAAE;OACxD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAkB;uDACU,GAAG;KACrD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI;YACJ,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAqE;;mBAE7E,EAAE;KAChB,CAAC;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,wCAAwC,CAAC,CAAC;QAErG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,CAAC,CAAC;QAEnF,0EAA0E;QAC1E,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,2EAA2E;QAC3E,oEAAoE;QACpE,iCAAiC;QACjC,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,KAA+B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAiB,EACjB,IAAa;IAEb,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../src/routes/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA+BrD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACjE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAa,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,GAAG,GAA2B;IAClC,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAErC;;;OAGG;IACH,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,2DAA2D,CAAC,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;QACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,gCAAgC,IAAI,kBAAkB,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC/E,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,2BAA2B,WAAW,IAAI,SAAS,IAAI,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,qEAAqE;YACrE,qDAAqD;YACrD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,gBAAgB,EAChB,iBAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAChH,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,4DAA4D;QAC5D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAmC;mGACqC,OAAO,CAAC,EAAE;OACtG,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,CAAC,CAAE,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;gBACvD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,wBAAwB,EACxB,8EAA8E,CAC/E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC;QAE1E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kEAAkE;YAClE,oEAAoE;YACpE,4CAA4C;YAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,kEAAkE,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3B,MAAM,EAAE,CAAA,mCAAmC,OAAO,CAAC,MAAM,SAAS,CAAC;YACnE,MAAM,EAAE,CAAA;;;;;;;;;;kBAUI,EAAE,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,KAAK,IAAI;kBAC7C,GAAG,WAAW,WAAW,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,KAAK,MAAM;kBAC9D,MAAM,KAAK,OAAO,CAAC,GAAG;;OAEjC,CAAC;YACF,uEAAuE;YACvE,sEAAsE;YACtE,qBAAqB;YACrB,MAAM,EAAE,CAAA;wEAC0D,IAAI,CAAC,MAAM;qBAC9D,OAAO,CAAC,EAAE;6DAC8B,EAAE;OACxD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAkB;uDACU,GAAG;KACrD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,IAAI;YACJ,WAAW;YACX,QAAQ,EAAE,IAAI,CAAC,MAAM;YACrB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAqE;;mBAE7E,EAAE;KAChB,CAAC;QACF,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,wCAAwC,CAAC,CAAC;QAErG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,CAAC,CAAC;QAEnF,0EAA0E;QAC1E,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,0EAA0E;QAC1E,2EAA2E;QAC3E,oEAAoE;QACpE,iCAAiC;QACjC,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,KAA+B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAiB,EACjB,IAAa,EACb,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/routes/bodyLimit.js

@@ -0,0 +1,60 @@
+/**
+ * 05 §9.3 — the JSON body cap, which was registered and enforced by nothing.
+ *
+ * `SNAGSET_MAX_BODY_BYTES` has been in the config registry since 08 §4 with a
+ * 1 MB default, cited by name in two specs, printed by `snagset env` — and read
+ * by no code at all. So every JSON route on this server would read whatever it
+ * was sent, and the only thing standing between an instance and a body large
+ * enough to exhaust its memory was the hosting platform's own proxy, which a
+ * self-hoster on their own box does not have.
+ *
+ * ── THE TWO NUMBERS, AND WHY ONLY ONE IS TUNABLE ──
+ *
+ * 05 §9.3 caps JSON at **256 KB** and says plainly it is *"not operator-
+ * tunable"*. 08 §4 caps binary routes at `SNAGSET_MAX_BODY_BYTES` (1 MB) and
+ * that one IS tunable. They are different limits for different reasons: the
+ * JSON cap protects the parser, and every JSON body this API accepts is small
+ * by construction — a comment, an anchor, a capture context whose breadcrumbs
+ * are already truncated server-side. An operator raising it is not configuring
+ * the product, they are disabling a bound the wire format does not need.
+ *
+ * Binary is different: images are ≤ 256 KB by construction, but the ceiling is
+ * the operator's because their proxy and their bucket are.
+ *
+ * ── WHY `Content-Length` AND NOT A COUNTING STREAM ──
+ *
+ * Rejecting on the declared length is the whole point: it costs nothing and it
+ * happens BEFORE the body is read. A stream that counts as it goes has already
+ * accepted the bytes it is measuring. A liar who declares 1 KB and sends 10 MB
+ * defeats the header check — and is then bounded by the platform's own limit
+ * and by the fact that `c.req.json()` throws on a truncated body, which is the
+ * same place an unbounded read would have failed anyway. The header check is
+ * the cheap 99%, not the security boundary; it exists so an honest client with
+ * a runaway payload gets a clean `413` instead of an OOM.
+ */
+/** 05 §9.3, and deliberately not `SNAGSET_MAX_BODY_BYTES`. */
+export const JSON_BODY_CAP = 256 * 1024;
+export function bodyLimit(binaryBytes) {
+    return async (c, next) => {
+        const method = c.req.method;
+        if (method === "GET" || method === "HEAD" || method === "OPTIONS")
+            return next();
+        const declared = Number(c.req.header("content-length") ?? "");
+        if (!Number.isFinite(declared) || declared <= 0)
+            return next();
+        const type = (c.req.header("content-type") ?? "").toLowerCase();
+        const isJson = type.includes("json") || type === "";
+        const cap = isJson ? JSON_BODY_CAP : binaryBytes();
+        if (declared > cap) {
+            return c.json({
+                error: {
+                    code: "body_too_large",
+                    message: `That request body is ${Math.round(declared / 1024)} KB; the limit here is ${Math.round(cap / 1024)} KB.`,
+                    requestId: c.get("requestId"),
+                },
+            }, 413);
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=bodyLimit.js.map

package/dist/routes/bodyLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodyLimit.js","sourceRoot":"","sources":["../../src/routes/bodyLimit.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,SAAS,CAAC,WAAyB;IACjD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QAEjF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAE/D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnD,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,wBAAwB,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,0BAA0B,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM;oBAClH,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;iBAC9B;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/comments.js

@@ -3,6 +3,7 @@ import { randomUUID } from "node:crypto";
 import { ID_PREFIX } from "../vendor/types/names.js";
 import { csrfOk } from "./owner.js";
 import { mcpAllows, scopeDenied, checkWriteBudget, budgetExhausted, recordAgentWrite, agentReviewer, } from "./mcpAuth.js";
+import { studioReviewerId } from "../studioReviewers.js";
 import { queueCommentNotice } from "../mail/notify.js";
 function fail(c, status, code, message, details) {
     return c.json({ error: { code, message, ...(details ? { details } : {}), requestId: c.get("requestId") } }, status);
@@ -22,7 +23,7 @@ export function commentRoutes(deps) {
         if (!threadRow)
             return fail(c, 404, "thread_not_found", "No such thread.");
         const [thread] = await sql `
-      SELECT t.id, t.project_id, t.org_id, t.private, p.uid AS project_uid,
+      SELECT t.id, t.project_id, t.org_id, t.private, p.uid AS project_uid, p.status AS project_status,
              t.key,
              -- The page URL lives INSIDE the capture context, not in a column
              -- of its own (05 §3.5). Two arrows, not one, so it arrives as
@@ -93,6 +94,13 @@ export function commentRoutes(deps) {
         if (asAgent && !asOwner && thread.private) {
             return fail(c, 403, "forbidden", "This thread is team-only. An agent cannot reply on it.");
         }
+        // D91 — the widget switch. A paused site refuses the WIDGET's writes (05
+        // §4.9 layer 6, `project_paused`); the studio's own replies from the
+        // dashboard go on, because the switch is about the client's page, not
+        // about the team's triage of what already arrived.
+        if (asSession && !asOwner && thread.project_status !== "active") {
+            return fail(c, 403, "project_paused", "This site's widget is switched off. Its owner can switch it back on.");
+        }
         // 07 §8.4's write budget, checked before the write. §8.6 mitigation 5.
         if (asAgent && !asOwner && !asSession) {
             const spent = await checkWriteBudget(sql, mcp.tokenId);
@@ -206,22 +214,17 @@ export function commentRoutes(deps) {
                 });
             }
             else {
+                // The owner's own reviewer row in this project — materialised on
+                // project and membership create since D90, found-or-created here for
+                // anything older (studioReviewers.ts).
                 const o = owner;
-                const [existing] = await tx `
-          SELECT id FROM reviewers
-          WHERE project_id = ${thread.project_id}::uuid AND user_id = ${o.userId}::uuid AND kind = 'verified'
-        `;
-                if (existing) {
-                    reviewerId = existing.id;
-                }
-                else {
-                    reviewerId = randomUUID();
-                    await tx `
-            INSERT INTO reviewers (id, org_id, project_id, kind, name, email, user_id)
-            VALUES (${reviewerId}::uuid, ${thread.org_id}::uuid, ${thread.project_id}::uuid, 'verified',
-                    ${o.name || o.email}, ${o.email}, ${o.userId}::uuid)
-          `;
-                }
+                reviewerId = await studioReviewerId(tx, {
+                    orgId: thread.org_id,
+                    projectId: thread.project_id,
+                    userId: o.userId,
+                    name: o.name,
+                    email: o.email,
+                });
             }
             // Locked here, not read-then-trusted: `seq` and both counters are
             // derived from THIS row under the lock, so two replies landing at once
@@ -244,6 +247,13 @@ export function commentRoutes(deps) {
             version = version + 1,
             updated_at = now()
         WHERE id = ${thread.id}::uuid
+      `;
+            // The author's own counter (05 §3.4) — what puts a person who has only
+            // ever replied into the assignee pool (§6.4b), and floats whoever just
+            // wrote to the top of it.
+            await tx `
+        UPDATE reviewers SET comment_count = comment_count + 1, last_seen_at = now()
+        WHERE id = ${reviewerId}::uuid
       `;
             const [author] = await tx `
         SELECT id, name, kind FROM reviewers WHERE id = ${reviewerId}::uuid
@@ -276,7 +286,7 @@ export function commentRoutes(deps) {
              * whatever forwards, backs up or indexes it — for a comment the product
              * promises is private. Not worth the surprise for a notification.
              */
-            if (!wantPrivate && deps.notifications) {
+            if (!wantPrivate && (await deps.notifications())) {
                 await queueCommentNotice(tx, {
                     orgId: thread.org_id,
                     projectId: thread.project_id,

package/dist/routes/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/routes/comments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAEtD,OAAO,EACL,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAmCvD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAuBD,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAUzB;;;;;;;;qBAQgB,SAAS;KACzB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAExE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QAEtF,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,KAAK,sCAAsC,EAAE;oBAC1F,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE7G;;;;;WAKG;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,mDAAmD,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,WAAW,EACX,KAAK,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,wDAAwD,CAAC,CAAC;QAC7F,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAI,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,yEAAyE,CAAC,CAAC;QAChH,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7D,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,EAAE;gBACpF,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,oDAAoD,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QAChF,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,6CAA6C,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/G,CAAC;QAED;;;;;;;;;;;;;;WAcG;QACH,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,GAAG,CAAkD;;oBAElE,SAAS,0BAA0B,MAAM,CAAC,EAAE;KAC3D,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAA8C;;+DAEf,SAAS;OACjE,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,EAAE;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;gBAChD,MAAM,EAAE;oBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAO,CAAC,EAAE;oBACnC,IAAI,EAAE,MAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,MAAO,CAAC,IAAI;iBACnB;aACF;YACD,8CAA8C;YAC9C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,MAAM,EAAE,CAAA,mCAAmC,MAAM,CAAC,MAAM,SAAS,CAAC;YAElE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,UAAkB,CAAC;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,gEAAgE;gBAChE,UAAU,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;oBACnC,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,GAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,GAAI,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,KAAM,CAAC;gBACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAkB;;+BAEtB,MAAM,CAAC,UAAU,wBAAwB,CAAC,CAAC,MAAM;SACvE,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,UAAU,EAAE,CAAC;oBAC1B,MAAM,EAAE,CAAA;;sBAEI,UAAU,WAAW,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,UAAU;sBAC9D,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM;WACrD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAA2D;6EACV,MAAM,CAAC,EAAE;OAC/E,CAAC;YACF,MAAM,GAAG,GAAG,GAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAE5F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAkD;;kBAEhE,SAAS,WAAW,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,EAAE;kBACjF,GAAG,KAAK,UAAU,WAAW,WAAW,KAAK,WAAW;;OAEnE,CAAC;YAEF,MAAM,EAAE,CAAA;;;qCAGuB,WAAW;;;qBAG3B,MAAM,CAAC,EAAE;OACvB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAA8C;0DACnB,UAAU;OAC7D,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,MAAM,gBAAgB,CAAC,EAAE,EAAE;oBACzB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,UAAU;oBACV,OAAO,EAAE,GAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAED;;;;;;;;;;;;;eAaG;YACH,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,kBAAkB,CACtB,EAAE,EACF;oBACE,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;oBACrC,IAAI,EAAE,OAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;iBAC/B,EACD,UAAU,EAAE,CACb,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,MAAO,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,eAAe;QACf,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;YAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;YACnD,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC1C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;gBACzB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;aAC1B;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/routes/comments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAEtD,OAAO,EACL,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAmCvD,SAAS,IAAI,CAAC,CAAM,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;IACpF,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,EAC5F,MAAa,CACd,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,SAAS,KAAK,CAAC,IAAa,EAAE,MAAc;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAwBD,MAAM,UAAU,aAAa,CAAC,IAAiB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAErB,MAAM,MAAM,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAE3E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAWzB;;;;;;;;qBAQgB,SAAS;KACzB,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QAExE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QAEtF,qEAAqE;QACrE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE,CAAC;YACzE,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,KAAK,sCAAsC,EAAE;oBAC1F,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC;QACzD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE7G;;;;;WAKG;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAChE,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAE7D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,mDAAmD,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,IAAI,CACT,CAAC,EACD,GAAG,EACH,WAAW,EACX,KAAK,CAAC,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,0CAA0C,CACpG,CAAC;QACJ,CAAC;QAED;;;;;;;;;;WAUG;QACH,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,wDAAwD,CAAC,CAAC;QAC7F,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,mDAAmD;QACnD,IAAI,SAAS,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,sEAAsE,CAAC,CAAC;QAChH,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAI,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,yEAAyE,CAAC,CAAC;QAChH,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,iDAAiD;QACjD,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7D,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,qCAAqC;QACrC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,yCAAyC,EAAE;gBACpF,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,oDAAoD,EAAE;gBAC/F,KAAK,EAAE,SAAS;aACjB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QAChF,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,6CAA6C,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/G,CAAC;QAED;;;;;;;;;;;;;;WAcG;QACH,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,GAAG,CAAkD;;oBAElE,SAAS,0BAA0B,MAAM,CAAC,EAAE;KAC3D,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,CAA8C;;+DAEf,SAAS;OACjE,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,YAAY,CAAC,EAAE;gBACvC,IAAI,EAAE,YAAY,CAAC,IAAI;gBACvB,SAAS,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,EAAE;gBAChD,MAAM,EAAE;oBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,MAAO,CAAC,EAAE;oBACnC,IAAI,EAAE,MAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,MAAO,CAAC,IAAI;iBACnB;aACF;YACD,8CAA8C;YAC9C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC3C,MAAM,EAAE,CAAA,mCAAmC,MAAM,CAAC,MAAM,SAAS,CAAC;YAElE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,UAAkB,CAAC;YACvB,IAAI,OAAO,EAAE,CAAC;gBACZ,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,CAAC;iBAAM,IAAI,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,8DAA8D;gBAC9D,gEAAgE;gBAChE,UAAU,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE;oBACnC,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,OAAO,EAAE,GAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,GAAI,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,qEAAqE;gBACrE,uCAAuC;gBACvC,MAAM,CAAC,GAAG,KAAM,CAAC;gBACjB,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE;oBACtC,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,KAAK,EAAE,CAAC,CAAC,KAAK;iBACf,CAAC,CAAC;YACL,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,kEAAkE;YAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAA2D;6EACV,MAAM,CAAC,EAAE;OAC/E,CAAC;YACF,MAAM,GAAG,GAAG,GAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAI,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAE5F,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAkD;;kBAEhE,SAAS,WAAW,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,EAAE;kBACjF,GAAG,KAAK,UAAU,WAAW,WAAW,KAAK,WAAW;;OAEnE,CAAC;YAEF,MAAM,EAAE,CAAA;;;qCAGuB,WAAW;;;qBAG3B,MAAM,CAAC,EAAE;OACvB,CAAC;YACF,uEAAuE;YACvE,uEAAuE;YACvE,0BAA0B;YAC1B,MAAM,EAAE,CAAA;;qBAEO,UAAU;OACxB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAA8C;0DACnB,UAAU;OAC7D,CAAC;YAEF,uEAAuE;YACvE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,MAAM,gBAAgB,CAAC,EAAE,EAAE;oBACzB,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,IAAI,EAAE,iBAAiB;oBACvB,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,UAAU;oBACV,OAAO,EAAE,GAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YAED;;;;;;;;;;;;;eAaG;YACH,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,kBAAkB,CACtB,EAAE,EACF;oBACE,KAAK,EAAE,MAAM,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM,CAAC,UAAU;oBAC5B,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,SAAS,EAAE,OAAQ,CAAC,EAAE;oBACtB,SAAS,EAAE,MAAM,CAAC,GAAG;oBACrB,QAAQ,EAAE,UAAU;oBACpB,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS;oBACrC,IAAI,EAAE,OAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;iBAC/B,EACD,UAAU,EAAE,CACb,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,OAAQ,EAAE,MAAM,EAAE,MAAO,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,eAAe;QACf,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE;YAC1C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;YACnD,MAAM,EAAE;gBACN,EAAE,EAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE;gBAC1C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;gBACzB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;aAC1B;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/cors.js

@@ -1,4 +1,5 @@
 import { HTTP_HEADER } from "../vendor/types/names.js";
+import { isLocalOrigin, originMatchesDomain } from "../domain.js";
 /**
  * The request headers a widget may send — 05 §2.3's request rows, plus the two
  * standard ones. Built from the registry rather than typed out, so adding a
@@ -136,7 +137,15 @@ export function corsForProjects(sql, lookup) {
             const project = await lookup(uid).catch(() => null);
             if (project) {
                 const patterns = await patternsFor(project.id);
-                const ok = isAllowed(patterns, origin);
+                /**
+                 * Three ways in (D92, 05 §4.3 as amended): an exact or wildcard
+                 * origin from the allow-list; the site's DOMAIN — its host or any
+                 * subdomain, any scheme, any port; and the developer's own machine
+                 * (rule 4), which the spec allows by default and which had never been
+                 * implemented. The domain rides the project cache, so a change lands
+                 * within the same ten seconds as everything else about a project.
+                 */
+                const ok = isAllowed(patterns, origin) || originMatchesDomain(project.domain ?? "", origin) || isLocalOrigin(origin);
                 /**
                  * The verdict, stashed for the config route (05 §7.2's origin-aware
                  * body, D69). Computed HERE and not re-derived in the route because