@tangle-network/agent-app 0.43.24 → 0.43.26

package/dist/chunk-TKVJE63N.js

@@ -0,0 +1,304 @@
+import {
+  clearCookieHeader,
+  readCookieValue,
+  serializeCookie
+} from "./chunk-HFC4BTWJ.js";
+import {
+  isTangleBillingEnforcementDisabled
+} from "./chunk-7W5XSTUF.js";
+
+// src/platform/sso.ts
+var DEFAULT_STATE_TTL_SECONDS = 600;
+var DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
+var DEFAULT_REDIRECT_PATH = "/app";
+var DEFAULT_LOGIN_PATH = "/login";
+var DEFAULT_SESSION_COOKIE = "better-auth.session_token";
+function randomHex(bytes) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hmacBytes(secret, value) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value)));
+}
+async function hmacHex(secret, value) {
+  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function createSignedSsoState(config) {
+  if (!config.secret) throw new Error("SsoStateConfig.secret is required");
+  const now = config.now ?? Date.now;
+  const payload = `${randomHex(16)}.${now().toString(36)}`;
+  return `${payload}.${await hmacHex(config.secret, payload)}`;
+}
+async function verifySignedSsoState(state, config) {
+  if (!config.secret) throw new Error("SsoStateConfig.secret is required");
+  const parts = state.split(".");
+  if (parts.length !== 3) return false;
+  const [random, timestamp, mac] = parts;
+  if (!random || !timestamp || !mac) return false;
+  const expected = await hmacHex(config.secret, `${random}.${timestamp}`);
+  if (!constantTimeEqual(mac, expected)) return false;
+  const mintedAt = parseInt(timestamp, 36);
+  if (!Number.isFinite(mintedAt)) return false;
+  const now = config.now ?? Date.now;
+  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1e3;
+  return now() - mintedAt <= ttlMs;
+}
+var TangleSsoUserCreateError = class extends Error {
+  constructor(message = "Failed to create local user for Tangle SSO") {
+    super(message);
+    this.name = "TangleSsoUserCreateError";
+  }
+};
+async function signSessionCookieValue(token, secret) {
+  if (!secret) throw new Error("signSessionCookieValue requires a non-empty secret");
+  const sig = await hmacBytes(secret, token);
+  let bin = "";
+  for (const byte of sig) bin += String.fromCharCode(byte);
+  return `${token}.${btoa(bin)}`;
+}
+function createBetterAuthSessionCookieMinter(auth, options = {}) {
+  const warn = options.warn ?? ((message) => console.warn(message));
+  return async ({ token, ttlSeconds }) => {
+    const ctx = await auth.$context;
+    if (!ctx.secret) {
+      throw new Error("createBetterAuthSessionCookieMinter: auth context has no secret");
+    }
+    const { name, attributes } = ctx.authCookies.sessionToken;
+    if (attributes.domain) {
+      throw new Error(
+        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) \u2014 a domain-wide session cookie shadows sibling apps that share the parent domain`
+      );
+    }
+    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {
+      warn(
+        `[tangle-sso] session cookie is named "${name}" \u2014 better-auth's default. The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).`
+      );
+    }
+    const sameSite = typeof attributes.sameSite === "string" ? attributes.sameSite : "lax";
+    const cookieOptions = {
+      name,
+      path: typeof attributes.path === "string" ? attributes.path : "/",
+      httpOnly: attributes.httpOnly !== false,
+      sameSite: sameSite.charAt(0).toUpperCase() + sameSite.slice(1),
+      secure: Boolean(attributes.secure) || name.startsWith("__Secure-"),
+      maxAgeSeconds: ttlSeconds
+    };
+    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)];
+    if (name !== DEFAULT_SESSION_COOKIE) {
+      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }));
+    }
+    return cookies;
+  };
+}
+function sanitizeRedirectPath(value, fallback) {
+  if (value && value.startsWith("/") && !value.startsWith("//")) return value;
+  return fallback;
+}
+function redirectResponse(location, headers = new Headers()) {
+  headers.set("Location", location);
+  return new Response(null, { status: 302, headers });
+}
+function clientIp(request) {
+  return request.headers.get("CF-Connecting-IP") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null;
+}
+function parseStateCookiePayload(raw) {
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object") return null;
+    const { s, r } = parsed;
+    if (typeof s !== "string" || typeof r !== "string") return null;
+    return { s, r };
+  } catch {
+    return null;
+  }
+}
+function createTangleSsoHandlers(opts) {
+  if (!opts.stateSecret) throw new Error("TangleSsoHandlerOptions.stateSecret is required");
+  if (!opts.callbackUrl) throw new Error("TangleSsoHandlerOptions.callbackUrl is required");
+  if (!opts.stateCookieName) throw new Error("TangleSsoHandlerOptions.stateCookieName is required");
+  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE;
+  let mintSessionCookies;
+  if (opts.setSessionCookie) {
+    const seam = opts.setSessionCookie;
+    mintSessionCookies = async (args) => await seam(args);
+  } else if (opts.sessionCookieSecret) {
+    const secret = opts.sessionCookieSecret;
+    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [
+      serializeCookie(await signSessionCookieValue(token, secret), {
+        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,
+        secure,
+        maxAgeSeconds: ttlSeconds
+      })
+    ];
+  } else {
+    throw new Error(
+      "TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, so an unsigned default would mint sessions that read back null"
+    );
+  }
+  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;
+  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS;
+  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH;
+  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH;
+  const log = opts.log ?? (() => {
+  });
+  const now = opts.now ?? Date.now;
+  const stateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1e3, now };
+  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies };
+  function loginErrorRedirect(code) {
+    const headers = new Headers();
+    headers.append("Set-Cookie", clearCookieHeader(stateCookieOpts));
+    return redirectResponse(`${loginPath}?error=${code}`, headers);
+  }
+  return {
+    async start(request) {
+      const url = new URL(request.url);
+      const redirectPath = sanitizeRedirectPath(url.searchParams.get("redirect"), defaultRedirectPath);
+      const state = await createSignedSsoState(stateConfig);
+      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {
+        ...stateCookieOpts,
+        maxAgeSeconds: stateTtlSeconds
+      });
+      const headers = new Headers();
+      headers.append("Set-Cookie", cookie);
+      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers);
+    },
+    async callback(request) {
+      const url = new URL(request.url);
+      const code = url.searchParams.get("code");
+      const stateFromPlatform = url.searchParams.get("state");
+      if (!code || !stateFromPlatform) return loginErrorRedirect("tangle_callback_missing");
+      const payload = parseStateCookiePayload(readCookieValue(request.headers.get("cookie"), opts.stateCookieName));
+      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect("tangle_state_mismatch");
+      if (!await verifySignedSsoState(payload.s, stateConfig)) return loginErrorRedirect("tangle_state_mismatch");
+      let exchanged;
+      try {
+        exchanged = await opts.auth.exchange(code);
+      } catch (err) {
+        log("[tangle-sso] exchange failed", err);
+        return loginErrorRedirect("tangle_exchange_failed");
+      }
+      let userId;
+      try {
+        ;
+        ({ userId } = await opts.store.upsertUserByEmail({
+          email: exchanged.user.email,
+          name: exchanged.user.name ?? null,
+          tangleUserId: exchanged.user.id
+        }));
+      } catch (err) {
+        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect("tangle_user_create_failed");
+        throw err;
+      }
+      const expiresAt = new Date(now() + sessionTtlSeconds * 1e3);
+      const { token } = await opts.store.createSession({
+        userId,
+        expiresAt,
+        ipAddress: clientIp(request),
+        userAgent: request.headers.get("user-agent")
+      });
+      await opts.store.saveTangleLink({
+        userId,
+        sessionToken: token,
+        tangleUserId: exchanged.user.id,
+        email: exchanged.user.email,
+        name: exchanged.user.name ?? null,
+        apiKey: exchanged.apiKey,
+        planTier: exchanged.plan?.tier ?? null
+      });
+      const headers = new Headers();
+      headers.append("Set-Cookie", clearCookieHeader(stateCookieOpts));
+      const sessionCookies = await mintSessionCookies({
+        token,
+        expiresAt,
+        ttlSeconds: sessionTtlSeconds,
+        secure: opts.secureCookies
+      });
+      for (const cookie of sessionCookies) headers.append("Set-Cookie", cookie);
+      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers);
+    }
+  };
+}
+
+// src/platform/guards.ts
+function createAuthGuard(opts) {
+  const loginPath = opts.loginPath ?? "/login";
+  async function requireSession(request, o = {}) {
+    const session = await opts.getSession(request);
+    if (!session) {
+      if (o.apiResponse) {
+        throw Response.json({ error: "Unauthorized", code: "auth.unauthenticated" }, { status: 401 });
+      }
+      throw new Response(null, { status: 302, headers: { Location: loginPath } });
+    }
+    return session;
+  }
+  return {
+    requireSession,
+    requireUser: (request) => requireSession(request),
+    requireApiUser: (request) => requireSession(request, { apiResponse: true }),
+    getOptionalSession: async (request) => await opts.getSession(request) ?? null
+  };
+}
+async function guardResolution(run) {
+  try {
+    return { ok: true, value: await run() };
+  } catch (err) {
+    if (err instanceof Response) return { ok: false, response: err };
+    throw err;
+  }
+}
+function parseAdminEmails(raw) {
+  return (raw ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
+}
+function createAdminGuard(opts) {
+  return async (request) => {
+    const session = await opts.requireUser(request);
+    const allowed = opts.allowedEmails();
+    if (allowed.length === 0) throw new Response("Not found", { status: 404 });
+    const email = (opts.emailOf(session) ?? "").toLowerCase();
+    if (!allowed.includes(email)) throw new Response("Not found", { status: 404 });
+    return session;
+  };
+}
+function assertBillableBalance(state, opts = {}) {
+  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return;
+  if (state.overageAllowed || state.remainingBalanceUsd > 0) return;
+  throw Response.json(
+    {
+      ...opts.errorBody,
+      error: opts.errorMessage ?? "Add balance or upgrade your plan to invoke this agent.",
+      code: "billing.balance_required"
+    },
+    { status: 402 }
+  );
+}
+
+export {
+  createSignedSsoState,
+  verifySignedSsoState,
+  TangleSsoUserCreateError,
+  signSessionCookieValue,
+  createBetterAuthSessionCookieMinter,
+  createTangleSsoHandlers,
+  createAuthGuard,
+  guardResolution,
+  parseAdminEmails,
+  createAdminGuard,
+  assertBillableBalance
+};
+//# sourceMappingURL=chunk-TKVJE63N.js.map

package/dist/chunk-TKVJE63N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/platform/sso.ts","../src/platform/guards.ts"],"sourcesContent":["/**\n * Cross-site Tangle SSO for agent apps: signed-state CSRF cookies plus the\n * full start/callback orchestration against the platform's /cross-site\n * bridge. The platform wire client and account persistence are structural\n * seams (`TangleSsoAuthClient` / `TangleSsoAccountStore`), so this module\n * never imports agent-runtime, an auth framework, or a database driver.\n * WebCrypto only — runs in workerd without node compatibility flags.\n */\n\nimport { clearCookieHeader, readCookieValue, serializeCookie } from '../web/index'\n\nconst DEFAULT_STATE_TTL_SECONDS = 600\nconst DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7\nconst DEFAULT_REDIRECT_PATH = '/app'\nconst DEFAULT_LOGIN_PATH = '/login'\nconst DEFAULT_SESSION_COOKIE = 'better-auth.session_token'\n\n// ── Signed state ────────────────────────────────────────────────────────────\n\nexport interface SsoStateConfig {\n  /** HMAC-SHA256 secret (e.g. the app's auth secret). */\n  secret: string\n  /** State lifetime in ms. Default 600 000. */\n  ttlMs?: number\n  /** Injectable clock (ms since epoch). Default Date.now. */\n  now?: () => number\n}\n\nfunction randomHex(bytes: number): string {\n  const buf = new Uint8Array(bytes)\n  crypto.getRandomValues(buf)\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function hmacBytes(secret: string, value: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value)))\n}\n\nasync function hmacHex(secret: string, value: string): Promise<string> {\n  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n\n/** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp\n *  is inside the signed payload, so expiry survives cookie-attribute tampering. */\nexport async function createSignedSsoState(config: SsoStateConfig): Promise<string> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const now = config.now ?? Date.now\n  const payload = `${randomHex(16)}.${now().toString(36)}`\n  return `${payload}.${await hmacHex(config.secret, payload)}`\n}\n\n/** Verify the MAC (constant-time) and the signed TTL. */\nexport async function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const parts = state.split('.')\n  if (parts.length !== 3) return false\n  const [random, timestamp, mac] = parts\n  if (!random || !timestamp || !mac) return false\n  const expected = await hmacHex(config.secret, `${random}.${timestamp}`)\n  if (!constantTimeEqual(mac, expected)) return false\n  const mintedAt = parseInt(timestamp, 36)\n  if (!Number.isFinite(mintedAt)) return false\n  const now = config.now ?? Date.now\n  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1000\n  return now() - mintedAt <= ttlMs\n}\n\n// ── Seams ───────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoExchangeResult {\n  apiKey: string\n  user: { id: string; email: string; name?: string | null }\n  plan?: { tier: string } | null\n}\n\n/** Structural mirror of the platform auth wire client — any object with these\n *  two methods satisfies it without this module importing the concrete class. */\nexport interface TangleSsoAuthClient {\n  authorizeUrl(options: { state: string; redirectUri?: string }): string\n  exchange(code: string): Promise<TangleSsoExchangeResult>\n}\n\n/** Thrown by `upsertUserByEmail` when the app-local user row cannot be\n *  created; the callback handler maps it to `?error=tangle_user_create_failed`.\n *  Any other store error propagates. */\nexport class TangleSsoUserCreateError extends Error {\n  constructor(message = 'Failed to create local user for Tangle SSO') {\n    super(message)\n    this.name = 'TangleSsoUserCreateError'\n  }\n}\n\n/**\n * Account persistence seam. Covers both storage styles in use: link-table\n * apps (a per-user platform-link row) and session-column apps (the key on the\n * session row) — `saveTangleLink` receives both `userId` and `sessionToken`,\n * and each app persists with the key it needs. `createSession` runs first so\n * the token is always available to `saveTangleLink`.\n */\nexport interface TangleSsoAccountStore {\n  /** Find-or-create the app-local user. `tangleUserId` is the platform's\n   *  stable user id — match on it first when the app stores it (emails are\n   *  mutable on the platform; the id is not), falling back to email for\n   *  first-time logins. */\n  upsertUserByEmail(input: { email: string; name: string | null; tangleUserId: string }): Promise<{ userId: string }>\n  /** Create an app session row; returns the session-cookie token value. */\n  createSession(input: {\n    userId: string\n    expiresAt: Date\n    ipAddress: string | null\n    userAgent: string | null\n  }): Promise<{ token: string }>\n  /** Persist the platform link (API key + platform identity). */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    apiKey: string\n    planTier: string | null\n  }): Promise<void>\n}\n\n// ── Session cookie ──────────────────────────────────────────────────────────\n\n/** Successful-login context handed to the `setSessionCookie` seam. */\nexport interface TangleSsoSessionCookieArgs {\n  /** Session token returned by `store.createSession`. */\n  token: string\n  /** Session expiry (now + `sessionTtlSeconds`). */\n  expiresAt: Date\n  /** Mirrors `sessionTtlSeconds` after defaulting. */\n  ttlSeconds: number\n  /** Mirrors `TangleSsoHandlerOptions.secureCookies`. */\n  secure: boolean\n}\n\n/**\n * Sign a session token to better-call's signed-cookie contract — the value\n * better-auth's `getSignedCookie` verifies: `<token>.<signature>` where the\n * signature is the raw HMAC-SHA256 of the token under `secret`, encoded as\n * STANDARD base64 WITH padding (32 bytes → 44 chars ending `=`; better-call\n * rejects any other length or suffix, so url-safe/unpadded variants read back\n * as a null session). The joined value is percent-encoded once at cookie\n * serialization, matching better-call's `serializeSignedCookie` byte-exactly.\n */\nexport async function signSessionCookieValue(token: string, secret: string): Promise<string> {\n  if (!secret) throw new Error('signSessionCookieValue requires a non-empty secret')\n  const sig = await hmacBytes(secret, token)\n  let bin = ''\n  for (const byte of sig) bin += String.fromCharCode(byte)\n  return `${token}.${btoa(bin)}`\n}\n\n/** Structural slice of a `betterAuth()` instance — only what cookie minting\n *  reads. No better-auth import: the signing contract is implemented by\n *  `signSessionCookieValue`, byte-compatible with better-auth's own\n *  `makeSignature`. */\nexport interface BetterAuthSessionCookieSource {\n  $context: PromiseLike<{\n    secret: string\n    authCookies: {\n      sessionToken: {\n        /** Final cookie name — better-auth decides the `__Secure-` prefix\n         *  (and any `advanced.cookiePrefix`) once at `betterAuth()` init. */\n        name: string\n        attributes: {\n          secure?: boolean\n          sameSite?: string\n          path?: string\n          httpOnly?: boolean\n          domain?: string\n        }\n      }\n    }\n  }>\n}\n\nexport interface BetterAuthSessionCookieMinterOptions {\n  /** Receives the shadowed-cookie-name warning (see below). Default\n   *  console.warn. */\n  warn?: (message: string) => void\n}\n\n/**\n * Canonical `setSessionCookie` wiring for better-auth apps: mint the session\n * Set-Cookie exactly as better-auth's own login flows do — name + attributes\n * from `auth.$context.authCookies.sessionToken` (better-auth stays\n * authoritative over prefix/name/attributes) and the value signed to\n * better-call's `getSignedCookie` contract. A raw unprefixed\n * `better-auth.session_token` left by an earlier login is explicitly expired\n * so it cannot shadow the real cookie.\n *\n * Warns when the app's session cookie still has better-auth's DEFAULT name:\n * the Tangle platform (id.tangle.tools) sets a `Domain=.tangle.tools` cookie\n * under that exact name, and equal-path cookies are sent oldest-first — the\n * platform's cookie is always older (the user signs in there before the app's\n * callback runs), so the app reads the platform's token, fails its own\n * signature check, and every fresh login lands logged-out. Per-app\n * `advanced.cookiePrefix` is the fix.\n *\n * Throws on a domain-scoped session cookie for the same reason: a\n * `Domain=`-wide session cookie is exactly the shadowing footgun.\n */\nexport function createBetterAuthSessionCookieMinter(\n  auth: BetterAuthSessionCookieSource,\n  options: BetterAuthSessionCookieMinterOptions = {},\n): (args: TangleSsoSessionCookieArgs) => Promise<string[]> {\n  const warn = options.warn ?? ((message: string) => console.warn(message))\n  return async ({ token, ttlSeconds }) => {\n    const ctx = await auth.$context\n    if (!ctx.secret) {\n      throw new Error('createBetterAuthSessionCookieMinter: auth context has no secret')\n    }\n    const { name, attributes } = ctx.authCookies.sessionToken\n    if (attributes.domain) {\n      throw new Error(\n        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) — ` +\n          'a domain-wide session cookie shadows sibling apps that share the parent domain',\n      )\n    }\n    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {\n      warn(\n        `[tangle-sso] session cookie is named \"${name}\" — better-auth's default. ` +\n          'The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, ' +\n          \"and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. \" +\n          \"Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).\",\n      )\n    }\n    const sameSite = typeof attributes.sameSite === 'string' ? attributes.sameSite : 'lax'\n    const cookieOptions = {\n      name,\n      path: typeof attributes.path === 'string' ? attributes.path : '/',\n      httpOnly: attributes.httpOnly !== false,\n      sameSite: (sameSite.charAt(0).toUpperCase() + sameSite.slice(1)) as 'Lax' | 'Strict' | 'None',\n      secure: Boolean(attributes.secure) || name.startsWith('__Secure-'),\n      maxAgeSeconds: ttlSeconds,\n    }\n    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)]\n    if (name !== DEFAULT_SESSION_COOKIE) {\n      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }))\n    }\n    return cookies\n  }\n}\n\n// ── Handlers ────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoHandlerOptions {\n  auth: TangleSsoAuthClient\n  store: TangleSsoAccountStore\n  /** HMAC secret for the state cookie. */\n  stateSecret: string\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  stateCookieName: string\n  /** Default 'better-auth.session_token'. Ignored when `setSessionCookie` is\n   *  provided. The default path prepends `__Secure-` iff `secureCookies`. */\n  sessionCookieName?: string\n  /** Mint the host auth framework's own session cookie(s); return complete\n   *  Set-Cookie header values (the handler appends them verbatim and sets no\n   *  session cookie itself). Supply this when the framework should stay\n   *  authoritative over name/prefix/signing/attributes — e.g. better-auth:\n   *  `auth.$context.authCookies.sessionToken` + `makeSignature`. */\n  setSessionCookie?: (\n    args: TangleSsoSessionCookieArgs,\n  ) => readonly string[] | Promise<readonly string[]>\n  /** HMAC-SHA256 secret the host auth framework verifies session cookies with\n   *  (better-auth: its `secret`). Required when `setSessionCookie` is absent —\n   *  the default cookie is minted to better-call's signed contract via\n   *  `signSessionCookieValue`; an unsigned or mis-signed value reads back as a\n   *  null session, so there is deliberately no fallback to `stateSecret`\n   *  (which is not guaranteed to be the auth secret). */\n  sessionCookieSecret?: string\n  /** Adds `Secure` to every cookie this module sets, and (default session\n   *  cookie only) the `__Secure-` name prefix. Must match the auth\n   *  framework's own secure-cookie decision (better-auth: https `baseURL` /\n   *  `advanced.useSecureCookies`), or it will look up a different cookie name\n   *  than the one set here. */\n  secureCookies: boolean\n  /** Default 604 800 (7 days). */\n  sessionTtlSeconds?: number\n  /** Default 600. Applies to both the cookie Max-Age and the signed TTL. */\n  stateTtlSeconds?: number\n  /** Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default '/login'. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n  now?: () => number\n}\n\nexport interface TangleSsoHandlers {\n  /** GET start route: mint + sign state, set the state cookie, 302 to the\n   *  platform authorize URL. `?redirect=` carries the post-login path. */\n  start(request: Request): Promise<Response>\n  /** GET callback route: verify state, exchange the code, upsert the user,\n   *  create the session, save the platform link, set the session cookie\n   *  (via the `setSessionCookie` seam, else signed to better-call's contract\n   *  with `sessionCookieSecret`), 302 to the saved redirect. Every failure\n   *  302s to `loginPath?error=…` with the state cookie cleared. */\n  callback(request: Request): Promise<Response>\n}\n\n/** Accept only same-origin absolute paths (rejects `//host` protocol-relative URLs). */\nfunction sanitizeRedirectPath(value: string | null, fallback: string): string {\n  if (value && value.startsWith('/') && !value.startsWith('//')) return value\n  return fallback\n}\n\nfunction redirectResponse(location: string, headers = new Headers()): Response {\n  headers.set('Location', location)\n  return new Response(null, { status: 302, headers })\n}\n\n/** Real client IP: `CF-Connecting-IP` behind Cloudflare, else the first\n *  `x-forwarded-for` hop (the rest of the list is sender-controlled). */\nfunction clientIp(request: Request): string | null {\n  return (\n    request.headers.get('CF-Connecting-IP') ??\n    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n    null\n  )\n}\n\ninterface StateCookiePayload {\n  s: string\n  r: string\n}\n\nfunction parseStateCookiePayload(raw: string | null): StateCookiePayload | null {\n  if (!raw) return null\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed === null || typeof parsed !== 'object') return null\n    const { s, r } = parsed as Record<string, unknown>\n    if (typeof s !== 'string' || typeof r !== 'string') return null\n    return { s, r }\n  } catch {\n    return null\n  }\n}\n\nexport function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers {\n  if (!opts.stateSecret) throw new Error('TangleSsoHandlerOptions.stateSecret is required')\n  if (!opts.callbackUrl) throw new Error('TangleSsoHandlerOptions.callbackUrl is required')\n  if (!opts.stateCookieName) throw new Error('TangleSsoHandlerOptions.stateCookieName is required')\n\n  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE\n\n  let mintSessionCookies: (args: TangleSsoSessionCookieArgs) => Promise<readonly string[]>\n  if (opts.setSessionCookie) {\n    const seam = opts.setSessionCookie\n    mintSessionCookies = async (args) => await seam(args)\n  } else if (opts.sessionCookieSecret) {\n    const secret = opts.sessionCookieSecret\n    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [\n      serializeCookie(await signSessionCookieValue(token, secret), {\n        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,\n        secure,\n        maxAgeSeconds: ttlSeconds,\n      }),\n    ]\n  } else {\n    throw new Error(\n      'TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: ' +\n        'better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, ' +\n        'so an unsigned default would mint sessions that read back null',\n    )\n  }\n  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS\n  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH\n  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH\n  const log = opts.log ?? (() => {})\n  const now = opts.now ?? Date.now\n  const stateConfig: SsoStateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1000, now }\n\n  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies }\n\n  function loginErrorRedirect(code: string): Response {\n    const headers = new Headers()\n    headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n    return redirectResponse(`${loginPath}?error=${code}`, headers)\n  }\n\n  return {\n    async start(request) {\n      const url = new URL(request.url)\n      const redirectPath = sanitizeRedirectPath(url.searchParams.get('redirect'), defaultRedirectPath)\n      const state = await createSignedSsoState(stateConfig)\n      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {\n        ...stateCookieOpts,\n        maxAgeSeconds: stateTtlSeconds,\n      })\n      const headers = new Headers()\n      headers.append('Set-Cookie', cookie)\n      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers)\n    },\n\n    async callback(request) {\n      const url = new URL(request.url)\n      const code = url.searchParams.get('code')\n      const stateFromPlatform = url.searchParams.get('state')\n      if (!code || !stateFromPlatform) return loginErrorRedirect('tangle_callback_missing')\n\n      const payload = parseStateCookiePayload(readCookieValue(request.headers.get('cookie'), opts.stateCookieName))\n      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect('tangle_state_mismatch')\n      if (!(await verifySignedSsoState(payload.s, stateConfig))) return loginErrorRedirect('tangle_state_mismatch')\n\n      let exchanged: TangleSsoExchangeResult\n      try {\n        exchanged = await opts.auth.exchange(code)\n      } catch (err) {\n        log('[tangle-sso] exchange failed', err)\n        return loginErrorRedirect('tangle_exchange_failed')\n      }\n\n      let userId: string\n      try {\n        ;({ userId } = await opts.store.upsertUserByEmail({\n          email: exchanged.user.email,\n          name: exchanged.user.name ?? null,\n          tangleUserId: exchanged.user.id,\n        }))\n      } catch (err) {\n        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect('tangle_user_create_failed')\n        throw err\n      }\n\n      const expiresAt = new Date(now() + sessionTtlSeconds * 1000)\n      const { token } = await opts.store.createSession({\n        userId,\n        expiresAt,\n        ipAddress: clientIp(request),\n        userAgent: request.headers.get('user-agent'),\n      })\n\n      await opts.store.saveTangleLink({\n        userId,\n        sessionToken: token,\n        tangleUserId: exchanged.user.id,\n        email: exchanged.user.email,\n        name: exchanged.user.name ?? null,\n        apiKey: exchanged.apiKey,\n        planTier: exchanged.plan?.tier ?? null,\n      })\n\n      const headers = new Headers()\n      headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n      const sessionCookies = await mintSessionCookies({\n        token,\n        expiresAt,\n        ttlSeconds: sessionTtlSeconds,\n        secure: opts.secureCookies,\n      })\n      for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n    },\n  }\n}\n","/**\n * Request guards for agent-app routes: session auth (302 redirect for pages,\n * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to\n * non-admins), and the billable-balance gate (402 with a stable code).\n * Session resolution is a seam; thrown Responses follow the router convention\n * of surfacing a thrown Response as the route result.\n */\n\nimport { isTangleBillingEnforcementDisabled } from '../runtime/model'\n\nexport interface AuthGuardOptions<Session> {\n  /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */\n  getSession(request: Request): Promise<Session | null | undefined>\n  /** Default '/login'. */\n  loginPath?: string\n}\n\nexport interface AuthGuard<Session> {\n  /** Page guard — throws a 302 redirect Response to `loginPath`. */\n  requireUser(request: Request): Promise<Session>\n  /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */\n  requireApiUser(request: Request): Promise<Session>\n  /** `apiResponse` selects the 401 JSON path over the redirect. */\n  requireSession(request: Request, opts?: { apiResponse?: boolean }): Promise<Session>\n  getOptionalSession(request: Request): Promise<Session | null>\n}\n\nexport function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session> {\n  const loginPath = opts.loginPath ?? '/login'\n\n  async function requireSession(request: Request, o: { apiResponse?: boolean } = {}): Promise<Session> {\n    const session = await opts.getSession(request)\n    if (!session) {\n      if (o.apiResponse) {\n        throw Response.json({ error: 'Unauthorized', code: 'auth.unauthenticated' }, { status: 401 })\n      }\n      throw new Response(null, { status: 302, headers: { Location: loginPath } })\n    }\n    return session\n  }\n\n  return {\n    requireSession,\n    requireUser: (request) => requireSession(request),\n    requireApiUser: (request) => requireSession(request, { apiResponse: true }),\n    getOptionalSession: async (request) => (await opts.getSession(request)) ?? null,\n  }\n}\n\nexport type GuardResolution<T> = { ok: true; value: T } | { ok: false; response: Response }\n\n/**\n * Adapt a guard that THROWS a Response (the quartet above — the router\n * convention) to the `{ok: true, value} | {ok: false, response}` resolution\n * shape the route factories take (`/chat-routes` `authorize`,\n * `/interactions` `resolveConnection`, `/chat-routes` upload `authorize`).\n * Every product wrote this try/catch by hand; it lives here once.\n */\nexport async function guardResolution<T>(run: () => Promise<T>): Promise<GuardResolution<T>> {\n  try {\n    return { ok: true, value: await run() }\n  } catch (err) {\n    if (err instanceof Response) return { ok: false, response: err }\n    throw err\n  }\n}\n\n/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */\nexport function parseAdminEmails(raw: string | null | undefined): string[] {\n  return (raw ?? '')\n    .split(/[,\\s]+/)\n    .map((e) => e.trim().toLowerCase())\n    .filter(Boolean)\n}\n\nexport interface AdminGuardOptions<Session> {\n  requireUser(request: Request): Promise<Session>\n  emailOf(session: Session): string | null | undefined\n  /** Resolved per request; an EMPTY allowlist refuses everyone. */\n  allowedEmails(): string[]\n}\n\n/** Non-admins (and empty allowlists) get 404, keeping the route invisible —\n *  better than a \"forbidden\" footprint that advertises its existence. */\nexport function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session> {\n  return async (request) => {\n    const session = await opts.requireUser(request)\n    const allowed = opts.allowedEmails()\n    if (allowed.length === 0) throw new Response('Not found', { status: 404 })\n    const email = (opts.emailOf(session) ?? '').toLowerCase()\n    if (!allowed.includes(email)) throw new Response('Not found', { status: 404 })\n    return session\n  }\n}\n\nexport interface BillableBalanceState {\n  overageAllowed: boolean\n  remainingBalanceUsd: number\n}\n\nexport interface AssertBillableBalanceOptions {\n  env?: Record<string, string | undefined>\n  /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),\n   *  fed to `isTangleBillingEnforcementDisabled`. */\n  enforcementEnvVar?: string\n  /** Default 'Add balance or upgrade your plan to invoke this agent.'. */\n  errorMessage?: string\n  /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */\n  errorBody?: Record<string, unknown>\n}\n\n/**\n * Gate a billable turn: passes when enforcement is disabled (dev default),\n * the tier allows overage, or remaining balance is positive. Otherwise throws\n * a 402 Response with the stable `billing.balance_required` code so clients\n * can route to the billing screen.\n */\nexport function assertBillableBalance(state: BillableBalanceState, opts: AssertBillableBalanceOptions = {}): void {\n  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return\n  if (state.overageAllowed || state.remainingBalanceUsd > 0) return\n  // errorBody first: the stable error/code contract always wins over caller extras.\n  throw Response.json(\n    {\n      ...opts.errorBody,\n      error: opts.errorMessage ?? 'Add balance or upgrade your plan to invoke this agent.',\n      code: 'billing.balance_required',\n    },\n    { status: 402 },\n  )\n}\n"],"mappings":";;;;;;;;;;AAWA,IAAM,4BAA4B;AAClC,IAAM,8BAA8B,KAAK,KAAK,KAAK;AACnD,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAa/B,SAAS,UAAU,OAAuB;AACxC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACxE;AAEA,eAAe,UAAU,QAAgB,OAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAC9F;AAEA,eAAe,QAAQ,QAAgB,OAAgC;AACrE,SAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAIA,eAAsB,qBAAqB,QAAyC;AAClF,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,GAAG,UAAU,EAAE,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;AACtD,SAAO,GAAG,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC;AAC5D;AAGA,eAAsB,qBAAqB,OAAe,QAA0C;AAClG,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,WAAW,GAAG,IAAI;AACjC,MAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAK,QAAO;AAC1C,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,GAAG,MAAM,IAAI,SAAS,EAAE;AACtE,MAAI,CAAC,kBAAkB,KAAK,QAAQ,EAAG,QAAO;AAC9C,QAAM,WAAW,SAAS,WAAW,EAAE;AACvC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,QAAQ,OAAO,SAAS,4BAA4B;AAC1D,SAAO,IAAI,IAAI,YAAY;AAC7B;AAoBO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,8CAA8C;AAClE,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAyDA,eAAsB,uBAAuB,OAAe,QAAiC;AAC3F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjF,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK;AACzC,MAAI,MAAM;AACV,aAAW,QAAQ,IAAK,QAAO,OAAO,aAAa,IAAI;AACvD,SAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9B;AAoDO,SAAS,oCACd,MACA,UAAgD,CAAC,GACQ;AACzD,QAAM,OAAO,QAAQ,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACvE,SAAO,OAAO,EAAE,OAAO,WAAW,MAAM;AACtC,UAAM,MAAM,MAAM,KAAK;AACvB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,EAAE,MAAM,WAAW,IAAI,IAAI,YAAY;AAC7C,QAAI,WAAW,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wFAAwF,WAAW,MAAM;AAAA,MAE3G;AAAA,IACF;AACA,QAAI,SAAS,0BAA0B,SAAS,YAAY,sBAAsB,IAAI;AACpF;AAAA,QACE,yCAAyC,IAAI;AAAA,MAI/C;AAAA,IACF;AACA,UAAM,WAAW,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjF,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,MAAM,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,MAC9D,UAAU,WAAW,aAAa;AAAA,MAClC,UAAW,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC;AAAA,MAC9D,QAAQ,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,WAAW;AAAA,MACjE,eAAe;AAAA,IACjB;AACA,UAAM,UAAU,CAAC,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,MAAM,GAAG,aAAa,CAAC;AAChG,QAAI,SAAS,wBAAwB;AACnC,cAAQ,KAAK,kBAAkB,EAAE,GAAG,eAAe,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AACF;AA8DA,SAAS,qBAAqB,OAAsB,UAA0B;AAC5E,MAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,UAAU,IAAI,QAAQ,GAAa;AAC7E,UAAQ,IAAI,YAAY,QAAQ;AAChC,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAIA,SAAS,SAAS,SAAiC;AACjD,SACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC5D;AAEJ;AAOA,SAAS,wBAAwB,KAA+C;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,UAAM,EAAE,GAAG,EAAE,IAAI;AACjB,QAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,WAAO,EAAE,GAAG,EAAE;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,MAAkD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AAEhG,QAAM,oBAAoB,KAAK,qBAAqB;AAEpD,MAAI;AACJ,MAAI,KAAK,kBAAkB;AACzB,UAAM,OAAO,KAAK;AAClB,yBAAqB,OAAO,SAAS,MAAM,KAAK,IAAI;AAAA,EACtD,WAAW,KAAK,qBAAqB;AACnC,UAAM,SAAS,KAAK;AACpB,yBAAqB,OAAO,EAAE,OAAO,QAAQ,WAAW,MAAM;AAAA,MAC5D,gBAAgB,MAAM,uBAAuB,OAAO,MAAM,GAAG;AAAA,QAC3D,MAAM,SAAS,YAAY,iBAAiB,KAAK;AAAA,QACjD;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,sBAAsB,KAAK,uBAAuB;AACxD,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cAA8B,EAAE,QAAQ,KAAK,aAAa,OAAO,kBAAkB,KAAM,IAAI;AAEnG,QAAM,kBAAkB,EAAE,MAAM,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAEjF,WAAS,mBAAmB,MAAwB;AAClD,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,WAAO,iBAAiB,GAAG,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,eAAe,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,mBAAmB;AAC/F,YAAM,QAAQ,MAAM,qBAAqB,WAAW;AACpD,YAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG;AAAA,QAC5E,GAAG;AAAA,QACH,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,MAAM;AACnC,aAAO,iBAAiB,KAAK,KAAK,aAAa,EAAE,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG,OAAO;AAAA,IACnG;AAAA,IAEA,MAAM,SAAS,SAAS;AACtB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,oBAAoB,IAAI,aAAa,IAAI,OAAO;AACtD,UAAI,CAAC,QAAQ,CAAC,kBAAmB,QAAO,mBAAmB,yBAAyB;AAEpF,YAAM,UAAU,wBAAwB,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,eAAe,CAAC;AAC5G,UAAI,CAAC,WAAW,QAAQ,MAAM,kBAAmB,QAAO,mBAAmB,uBAAuB;AAClG,UAAI,CAAE,MAAM,qBAAqB,QAAQ,GAAG,WAAW,EAAI,QAAO,mBAAmB,uBAAuB;AAE5G,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,KAAK,KAAK,SAAS,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,gCAAgC,GAAG;AACvC,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AAEA,UAAI;AACJ,UAAI;AACF;AAAC,SAAC,EAAE,OAAO,IAAI,MAAM,KAAK,MAAM,kBAAkB;AAAA,UAChD,OAAO,UAAU,KAAK;AAAA,UACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,UAC7B,cAAc,UAAU,KAAK;AAAA,QAC/B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,yBAA0B,QAAO,mBAAmB,2BAA2B;AAClG,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,IAAI,KAAK,IAAI,IAAI,oBAAoB,GAAI;AAC3D,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAc;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,WAAW,SAAS,OAAO;AAAA,QAC3B,WAAW,QAAQ,QAAQ,IAAI,YAAY;AAAA,MAC7C,CAAC;AAED,YAAM,KAAK,MAAM,eAAe;AAAA,QAC9B;AAAA,QACA,cAAc;AAAA,QACd,cAAc,UAAU,KAAK;AAAA,QAC7B,OAAO,UAAU,KAAK;AAAA,QACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,QAC7B,QAAQ,UAAU;AAAA,QAClB,UAAU,UAAU,MAAM,QAAQ;AAAA,MACpC,CAAC;AAED,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,YAAM,iBAAiB,MAAM,mBAAmB;AAAA,QAC9C;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,UAAU,eAAgB,SAAQ,OAAO,cAAc,MAAM;AACxE,aAAO,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAG,OAAO;AAAA,IACvF;AAAA,EACF;AACF;;;ACjcO,SAAS,gBAAyB,MAAqD;AAC5F,QAAM,YAAY,KAAK,aAAa;AAEpC,iBAAe,eAAe,SAAkB,IAA+B,CAAC,GAAqB;AACnG,UAAM,UAAU,MAAM,KAAK,WAAW,OAAO;AAC7C,QAAI,CAAC,SAAS;AACZ,UAAI,EAAE,aAAa;AACjB,cAAM,SAAS,KAAK,EAAE,OAAO,gBAAgB,MAAM,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9F;AACA,YAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,CAAC,YAAY,eAAe,OAAO;AAAA,IAChD,gBAAgB,CAAC,YAAY,eAAe,SAAS,EAAE,aAAa,KAAK,CAAC;AAAA,IAC1E,oBAAoB,OAAO,YAAa,MAAM,KAAK,WAAW,OAAO,KAAM;AAAA,EAC7E;AACF;AAWA,eAAsB,gBAAmB,KAAoD;AAC3F,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EACxC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAU,QAAO,EAAE,IAAI,OAAO,UAAU,IAAI;AAC/D,UAAM;AAAA,EACR;AACF;AAGO,SAAS,iBAAiB,KAA0C;AACzE,UAAQ,OAAO,IACZ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;AAWO,SAAS,iBAA0B,MAA0E;AAClH,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,YAAY,OAAO;AAC9C,UAAM,UAAU,KAAK,cAAc;AACnC,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACzE,UAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,IAAI,YAAY;AACxD,QAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC7E,WAAO;AAAA,EACT;AACF;AAwBO,SAAS,sBAAsB,OAA6B,OAAqC,CAAC,GAAS;AAChH,MAAI,mCAAmC,EAAE,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB,CAAC,EAAG;AACtG,MAAI,MAAM,kBAAkB,MAAM,sBAAsB,EAAG;AAE3D,QAAM,SAAS;AAAA,IACb;AAAA,MACE,GAAG,KAAK;AAAA,MACR,OAAO,KAAK,gBAAgB;AAAA,MAC5B,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-SAOAAA3S.js → chunk-UHXQ3KNX.js}

@@ -21,15 +21,6 @@ var PRESET_TABLES = {
       createdAt: "created_at"
     }
   },
-  threads: {
-    name: "threads",
-    columns: {
-      id: "id",
-      workspaceId: "workspace_id",
-      title: "title",
-      createdAt: "created_at"
-    }
-  },
   knowledge: {
     name: "knowledge",
     columns: {
@@ -70,12 +61,6 @@ var PRESET_TABLES = {
   }
 };
 var PRESET_MIGRATION_SQL = [
-  `CREATE TABLE IF NOT EXISTS threads (
-    id TEXT PRIMARY KEY,
-    workspace_id TEXT NOT NULL,
-    title TEXT,
-    created_at INTEGER NOT NULL
-  )`,
   `CREATE TABLE IF NOT EXISTS proposals (
     id TEXT PRIMARY KEY,
     workspace_id TEXT NOT NULL,
@@ -125,12 +110,6 @@ function createPresetDrizzleSchema(d) {
   const { sqliteTable, text, integer, real } = d;
   const C = PRESET_TABLES;
   return {
-    threads: sqliteTable(C.threads.name, {
-      id: text(C.threads.columns.id).primaryKey(),
-      workspaceId: text(C.threads.columns.workspaceId).notNull(),
-      title: text(C.threads.columns.title),
-      createdAt: integer(C.threads.columns.createdAt).notNull()
-    }),
     proposals: sqliteTable(C.proposals.name, {
       id: text(C.proposals.columns.id).primaryKey(),
       workspaceId: text(C.proposals.columns.workspaceId).notNull(),
@@ -315,4 +294,4 @@ export {
   createPresetWorkspaceKeyStore,
   createPresetWorkspaceKeyManager
 };
-//# sourceMappingURL=chunk-SAOAAA3S.js.map
+//# sourceMappingURL=chunk-UHXQ3KNX.js.map

package/dist/chunk-UHXQ3KNX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/preset-cloudflare/index.ts"],"sourcesContent":["/**\n * `@tangle-network/agent-app/preset-cloudflare` — the batteries-included default\n * stack.\n *\n * Every fleet agent runs the SAME backend: Cloudflare D1 (SQLite) through\n * Drizzle for state, a KV namespace as the artifact vault, AES-GCM field crypto\n * for PII, and per-workspace budget-capped model keys. The other agent-app\n * modules are pure SEAMS — `./tools` needs an `AppToolHandlers`, `./knowledge`\n * needs a `KnowledgeStateAccessor`, `./billing` needs a `WorkspaceKeyStore` +\n * `KeyCrypto`. This module is the ONE implementation of those seams against the\n * house stack, so a consumer that runs D1 + KV stands the whole shell up with\n * config + bindings and ZERO handler code.\n *\n * Layering:\n *  - Drizzle is a PEER (the consumer installs `drizzle-orm`, never bundled). The\n *    schema is therefore expressed two ways that need no import here: the plain\n *    DDL ({@link PRESET_MIGRATION_SQL}) a consumer runs to create the tables, and\n *    a {@link createPresetDrizzleSchema} factory that takes the consumer's\n *    `drizzle-orm/sqlite-core` builder module and returns the typed tables. The\n *    column names in {@link PRESET_TABLES} are the contract the handlers,\n *    accessor, and DDL all agree on.\n *  - D1 + KV are STRUCTURAL: {@link D1Like} (Cloudflare `D1Database` satisfies it)\n *    and `KvLike` from `../web` (Cloudflare `KVNamespace` satisfies it). No\n *    `@cloudflare/workers-types` dependency.\n *  - Crypto/billing reuse `../crypto` + `../billing` exactly — this only wires\n *    them to the D1 key table.\n */\n\nimport { createFieldCrypto } from '../crypto/index'\nimport {\n  createWorkspaceKeyManager,\n  type KeyCrypto,\n  type KeyProvisioner,\n  type WorkspaceKeyManager,\n  type WorkspaceKeyRecord,\n  type WorkspaceKeyStore,\n} from '../billing/index'\nimport type { KnowledgeStateAccessor } from '../knowledge/index'\nimport type {\n  AddCitationArgs,\n  AddCitationResult,\n  AppToolContext,\n  AppToolHandlers,\n  RenderUiArgs,\n  RenderUiResult,\n  ScheduleFollowupArgs,\n  ScheduleFollowupResult,\n  SubmitProposalArgs,\n  SubmitProposalResult,\n} from '../tools/index'\nimport type { KvLike } from '../web/index'\n\n// ---------------------------------------------------------------------------\n// D1 structural seam\n//\n// The minimal surface of Cloudflare's `D1Database` the handlers + accessor use.\n// `D1Database` satisfies it structurally, so the consumer passes `env.DB`\n// directly and tests pass an in-memory fake. We keep it to the\n// prepare/bind/first/run/all shape D1 already exposes — no Drizzle here, so the\n// default handlers run on a fresh Worker with only the D1 binding.\n// ---------------------------------------------------------------------------\n\n/** A prepared, bound D1 statement. */\nexport interface D1PreparedLike {\n  bind(...values: unknown[]): D1PreparedLike\n  first<T = Record<string, unknown>>(colName?: string): Promise<T | null>\n  run(): Promise<unknown>\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>\n}\n\n/** The D1 surface the preset needs. Cloudflare `D1Database` satisfies it. */\nexport interface D1Like {\n  prepare(query: string): D1PreparedLike\n}\n\n// ---------------------------------------------------------------------------\n// Default schema\n//\n// The four tables the default handlers + accessor read/write. Column names are\n// the single source of truth shared by the DDL, the Drizzle factory, the\n// handlers, and the accessor. Every table is workspace-scoped on `workspace_id`\n// (the accessor's default `where` column) so the knowledge `count` rule and the\n// tool writes agree without per-consumer wiring.\n//\n// Deliberately NOT here: chat thread/message tables. `/chat-store` is the\n// single thread-schema owner (`createChatTables` + `createChatStore`); the\n// preset once declared an unconsumed `threads` DDL, removed so two schemas\n// can't drift.\n// ---------------------------------------------------------------------------\n\n/** The preset table + column names — the contract the DDL, Drizzle schema,\n *  handlers, and accessor share. Exposed so a consumer can reference a column\n *  without a string literal. */\nexport const PRESET_TABLES = {\n  proposals: {\n    name: 'proposals',\n    columns: {\n      id: 'id',\n      workspaceId: 'workspace_id',\n      threadId: 'thread_id',\n      type: 'type',\n      title: 'title',\n      description: 'description',\n      status: 'status',\n      createdBy: 'created_by',\n      createdAt: 'created_at',\n    },\n  },\n  knowledge: {\n    name: 'knowledge',\n    columns: {\n      id: 'id',\n      workspaceId: 'workspace_id',\n      path: 'path',\n      kind: 'kind',\n      label: 'label',\n      content: 'content',\n      createdAt: 'created_at',\n    },\n  },\n  deadlines: {\n    name: 'deadlines',\n    columns: {\n      id: 'id',\n      workspaceId: 'workspace_id',\n      threadId: 'thread_id',\n      title: 'title',\n      dueDate: 'due_date',\n      priority: 'priority',\n      status: 'status',\n      createdAt: 'created_at',\n    },\n  },\n  workspaceKeys: {\n    name: 'workspace_keys',\n    columns: {\n      id: 'id',\n      workspaceId: 'workspace_id',\n      keyId: 'key_id',\n      keyEncrypted: 'key_encrypted',\n      budgetUsd: 'budget_usd',\n      expiresAt: 'expires_at',\n      revokedAt: 'revoked_at',\n      createdAt: 'created_at',\n    },\n  },\n} as const\n\n/**\n * Plain DDL for the preset schema — run by a consumer to create the tables with\n * ZERO drizzle (`for (const sql of PRESET_MIGRATION_SQL) await db.prepare(sql).run()`,\n * or paste into a `.sql` migration). One statement per table so D1's\n * single-statement `prepare` accepts each. Matches {@link PRESET_TABLES} exactly.\n */\nexport const PRESET_MIGRATION_SQL: readonly string[] = [\n  `CREATE TABLE IF NOT EXISTS proposals (\n    id TEXT PRIMARY KEY,\n    workspace_id TEXT NOT NULL,\n    thread_id TEXT,\n    type TEXT NOT NULL,\n    title TEXT NOT NULL,\n    description TEXT,\n    status TEXT NOT NULL DEFAULT 'pending',\n    created_by TEXT,\n    created_at INTEGER NOT NULL\n  )`,\n  `CREATE TABLE IF NOT EXISTS knowledge (\n    id TEXT PRIMARY KEY,\n    workspace_id TEXT NOT NULL,\n    path TEXT NOT NULL,\n    kind TEXT NOT NULL,\n    label TEXT,\n    content TEXT,\n    created_at INTEGER NOT NULL\n  )`,\n  `CREATE TABLE IF NOT EXISTS deadlines (\n    id TEXT PRIMARY KEY,\n    workspace_id TEXT NOT NULL,\n    thread_id TEXT,\n    title TEXT NOT NULL,\n    due_date TEXT NOT NULL,\n    priority TEXT,\n    status TEXT NOT NULL DEFAULT 'scheduled',\n    created_at INTEGER NOT NULL\n  )`,\n  `CREATE TABLE IF NOT EXISTS workspace_keys (\n    id TEXT PRIMARY KEY,\n    workspace_id TEXT NOT NULL,\n    key_id TEXT NOT NULL,\n    key_encrypted TEXT NOT NULL,\n    budget_usd REAL NOT NULL,\n    expires_at INTEGER NOT NULL,\n    revoked_at INTEGER,\n    created_at INTEGER NOT NULL\n  )`,\n  `CREATE INDEX IF NOT EXISTS idx_proposals_ws ON proposals (workspace_id, status)`,\n  `CREATE INDEX IF NOT EXISTS idx_deadlines_ws ON deadlines (workspace_id, status)`,\n  `CREATE INDEX IF NOT EXISTS idx_knowledge_ws ON knowledge (workspace_id)`,\n  `CREATE INDEX IF NOT EXISTS idx_workspace_keys_ws ON workspace_keys (workspace_id, revoked_at)`,\n]\n\n/** A chainable column builder — every modifier returns the builder so calls\n *  like `.notNull().default('pending')` typecheck. The concrete drizzle builders\n *  satisfy this structurally. */\nexport interface DrizzleColumnLike {\n  primaryKey: () => DrizzleColumnLike\n  notNull: () => DrizzleColumnLike\n  default: (v: unknown) => DrizzleColumnLike\n}\n\n/** The shape of a `drizzle-orm/sqlite-core` module — the few builders the\n *  preset schema uses. The consumer passes the real module; agent-app never\n *  imports it (it stays a peer). */\nexport interface DrizzleSqliteCoreLike {\n  sqliteTable: (name: string, columns: Record<string, DrizzleColumnLike>) => unknown\n  text: (name?: string) => DrizzleColumnLike\n  integer: (name?: string, config?: unknown) => DrizzleColumnLike\n  real: (name?: string) => DrizzleColumnLike\n}\n\n/**\n * Build the typed Drizzle schema for the preset, given the consumer's\n * `drizzle-orm/sqlite-core` module. Returns one table object per\n * {@link PRESET_TABLES} entry — pass to `drizzle(db, { schema })` for typed\n * queries, or to drizzle-kit for migration generation. agent-app never imports\n * drizzle; the builder module is the seam.\n *\n * ```ts\n * import * as d from 'drizzle-orm/sqlite-core'\n * const schema = createPresetDrizzleSchema(d)\n * ```\n */\nexport function createPresetDrizzleSchema(d: DrizzleSqliteCoreLike) {\n  const { sqliteTable, text, integer, real } = d\n  const C = PRESET_TABLES\n  return {\n    proposals: sqliteTable(C.proposals.name, {\n      id: text(C.proposals.columns.id).primaryKey(),\n      workspaceId: text(C.proposals.columns.workspaceId).notNull(),\n      threadId: text(C.proposals.columns.threadId),\n      type: text(C.proposals.columns.type).notNull(),\n      title: text(C.proposals.columns.title).notNull(),\n      description: text(C.proposals.columns.description),\n      status: text(C.proposals.columns.status).notNull().default('pending'),\n      createdBy: text(C.proposals.columns.createdBy),\n      createdAt: integer(C.proposals.columns.createdAt).notNull(),\n    }),\n    knowledge: sqliteTable(C.knowledge.name, {\n      id: text(C.knowledge.columns.id).primaryKey(),\n      workspaceId: text(C.knowledge.columns.workspaceId).notNull(),\n      path: text(C.knowledge.columns.path).notNull(),\n      kind: text(C.knowledge.columns.kind).notNull(),\n      label: text(C.knowledge.columns.label),\n      content: text(C.knowledge.columns.content),\n      createdAt: integer(C.knowledge.columns.createdAt).notNull(),\n    }),\n    deadlines: sqliteTable(C.deadlines.name, {\n      id: text(C.deadlines.columns.id).primaryKey(),\n      workspaceId: text(C.deadlines.columns.workspaceId).notNull(),\n      threadId: text(C.deadlines.columns.threadId),\n      title: text(C.deadlines.columns.title).notNull(),\n      dueDate: text(C.deadlines.columns.dueDate).notNull(),\n      priority: text(C.deadlines.columns.priority),\n      status: text(C.deadlines.columns.status).notNull().default('scheduled'),\n      createdAt: integer(C.deadlines.columns.createdAt).notNull(),\n    }),\n    workspaceKeys: sqliteTable(C.workspaceKeys.name, {\n      id: text(C.workspaceKeys.columns.id).primaryKey(),\n      workspaceId: text(C.workspaceKeys.columns.workspaceId).notNull(),\n      keyId: text(C.workspaceKeys.columns.keyId).notNull(),\n      keyEncrypted: text(C.workspaceKeys.columns.keyEncrypted).notNull(),\n      budgetUsd: real(C.workspaceKeys.columns.budgetUsd).notNull(),\n      expiresAt: integer(C.workspaceKeys.columns.expiresAt).notNull(),\n      revokedAt: integer(C.workspaceKeys.columns.revokedAt),\n      createdAt: integer(C.workspaceKeys.columns.createdAt).notNull(),\n    }),\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Default AppToolHandlers over D1 + KV\n// ---------------------------------------------------------------------------\n\n/** The KV-backed vault. `KvLike` (from `../web`) is the structural KV contract;\n *  Cloudflare `KVNamespace` satisfies it. Artifacts are stored under their path. */\nexport type VaultKv = KvLike\n\nexport interface PresetToolHandlerOptions {\n  /** The D1 database (Cloudflare `D1Database` satisfies {@link D1Like}). */\n  db: D1Like\n  /** The KV namespace used as the artifact vault. */\n  vault: VaultKv\n  /** Id generator. Default `crypto.randomUUID`. Injectable for deterministic tests. */\n  newId?: () => string\n  /** Clock (epoch ms). Default `Date.now`. Injectable for deterministic tests. */\n  now?: () => number\n  /** Vault path prefix for `render_ui` artifacts. Default `'ui'`. */\n  uiPathPrefix?: string\n  /** Vault path prefix for `add_citation` artifacts. Default `'citations'`. */\n  citationPathPrefix?: string\n}\n\nfunction slug(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n    .slice(0, 64) || 'item'\n}\n\n/**\n * The default {@link AppToolHandlers} for the house stack:\n *  - `submit_proposal`   → insert a `proposals` row (`status='pending'`), deduped\n *                          on (workspace, title) so a retried turn doesn't double-queue.\n *  - `schedule_followup` → insert a `deadlines` row, deduped on (workspace, title, due_date).\n *  - `render_ui`         → write the schema JSON as a `ui/<thread>/<slug>.json`\n *                          vault artifact AND a `knowledge` row pointing at it.\n *  - `add_citation`      → write the quote as a `citations/<slug>.json` artifact AND\n *                          a `knowledge` row.\n *\n * Returns the EXACT persisted content from `render_ui` (per the seam contract) so\n * a completion oracle sees real bytes. Pure seam wiring: a consumer that runs\n * D1 + KV gets all four tools with no handler code.\n */\nexport function createPresetToolHandlers(opts: PresetToolHandlerOptions): AppToolHandlers {\n  const { db, vault } = opts\n  const newId = opts.newId ?? (() => crypto.randomUUID())\n  const now = opts.now ?? (() => Date.now())\n  const uiPrefix = opts.uiPathPrefix ?? 'ui'\n  const citationPrefix = opts.citationPathPrefix ?? 'citations'\n  const P = PRESET_TABLES.proposals\n  const D = PRESET_TABLES.deadlines\n  const K = PRESET_TABLES.knowledge\n\n  async function persistArtifact(path: string, body: string): Promise<void> {\n    await vault.put(path, body)\n  }\n\n  async function insertKnowledge(workspaceId: string, path: string, kind: string, label: string | null, content: string): Promise<void> {\n    await db\n      .prepare(\n        `INSERT INTO ${K.name} (${K.columns.id}, ${K.columns.workspaceId}, ${K.columns.path}, ${K.columns.kind}, ${K.columns.label}, ${K.columns.content}, ${K.columns.createdAt}) VALUES (?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .bind(newId(), workspaceId, path, kind, label, content, now())\n      .run()\n  }\n\n  return {\n    async submitProposal(args: SubmitProposalArgs, ctx: AppToolContext): Promise<SubmitProposalResult> {\n      const existing = await db\n        .prepare(`SELECT ${P.columns.id} AS id FROM ${P.name} WHERE ${P.columns.workspaceId} = ? AND ${P.columns.title} = ? LIMIT 1`)\n        .bind(ctx.workspaceId, args.title)\n        .first<{ id: string }>()\n      if (existing) return { proposalId: existing.id, deduped: true }\n\n      const id = newId()\n      await db\n        .prepare(\n          `INSERT INTO ${P.name} (${P.columns.id}, ${P.columns.workspaceId}, ${P.columns.threadId}, ${P.columns.type}, ${P.columns.title}, ${P.columns.description}, ${P.columns.status}, ${P.columns.createdBy}, ${P.columns.createdAt}) VALUES (?, ?, ?, ?, ?, ?, 'pending', ?, ?)`,\n        )\n        .bind(id, ctx.workspaceId, ctx.threadId, args.type, args.title, args.description ?? null, ctx.userId, now())\n        .run()\n      return { proposalId: id, deduped: false }\n    },\n\n    async scheduleFollowup(args: ScheduleFollowupArgs, ctx: AppToolContext): Promise<ScheduleFollowupResult> {\n      const existing = await db\n        .prepare(\n          `SELECT ${D.columns.id} AS id, ${D.columns.dueDate} AS dueDate FROM ${D.name} WHERE ${D.columns.workspaceId} = ? AND ${D.columns.title} = ? AND ${D.columns.dueDate} = ? LIMIT 1`,\n        )\n        .bind(ctx.workspaceId, args.title, args.dueDate)\n        .first<{ id: string; dueDate: string }>()\n      if (existing) return { id: existing.id, dueDate: existing.dueDate, deduped: true }\n\n      const id = newId()\n      await db\n        .prepare(\n          `INSERT INTO ${D.name} (${D.columns.id}, ${D.columns.workspaceId}, ${D.columns.threadId}, ${D.columns.title}, ${D.columns.dueDate}, ${D.columns.priority}, ${D.columns.status}, ${D.columns.createdAt}) VALUES (?, ?, ?, ?, ?, ?, 'scheduled', ?)`,\n        )\n        .bind(id, ctx.workspaceId, ctx.threadId, args.title, args.dueDate, args.priority ?? null, now())\n        .run()\n      return { id, dueDate: args.dueDate, deduped: false }\n    },\n\n    async renderUi(args: RenderUiArgs, ctx: AppToolContext): Promise<RenderUiResult> {\n      const content = JSON.stringify(args.schema)\n      const path = `${uiPrefix}/${ctx.threadId ?? 'global'}/${slug(args.title)}.json`\n      await persistArtifact(path, content)\n      await insertKnowledge(ctx.workspaceId, path, 'ui', args.title, content)\n      return { path, content }\n    },\n\n    async addCitation(args: AddCitationArgs, ctx: AppToolContext): Promise<AddCitationResult> {\n      const citationId = newId()\n      const path = `${citationPrefix}/${slug(args.label ?? args.path)}-${citationId.slice(0, 8)}.json`\n      const body = JSON.stringify({ sourcePath: args.path, quote: args.quote, label: args.label ?? null })\n      await persistArtifact(path, body)\n      await insertKnowledge(ctx.workspaceId, path, 'citation', args.label ?? null, body)\n      return { citationId, path }\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// D1-backed KnowledgeStateAccessor\n// ---------------------------------------------------------------------------\n\nexport interface PresetKnowledgeAccessorOptions {\n  db: D1Like\n  /** The active workspace — every `count` is scoped to it. */\n  workspaceId: string\n  /** Workspace config the `satisfiedBy: { config }` rules read. A resolved\n   *  object (dot-path lookup), or a function the accessor calls per path. */\n  config: Record<string, unknown> | ((path: string) => unknown)\n  /** The default workspace fk column a `count` rule scopes on when its rule\n   *  omits `where`. Default `'workspace_id'` (the preset schema convention). */\n  defaultWhereColumn?: string\n}\n\nfunction readDotPath(obj: Record<string, unknown>, path: string): unknown {\n  let cur: unknown = obj\n  for (const part of path.split('.')) {\n    if (cur == null || typeof cur !== 'object') return undefined\n    cur = (cur as Record<string, unknown>)[part]\n  }\n  return cur\n}\n\n/**\n * The {@link KnowledgeStateAccessor} over the preset D1 schema — the seam that\n * lets the declarative `satisfiedBy` rules resolve with ZERO consumer code:\n *  - `config(path)` reads the supplied workspace config by dot-path.\n *  - `count({ table, where, statusIn })` runs `SELECT count(*)` scoped to the\n *    active workspace (the rule's `where` column, default `workspace_id`),\n *    optionally filtered to `statusIn` via a parameterized `IN (...)`.\n *\n * Identifiers (table/column) are validated against a safe pattern before\n * interpolation — they originate from the product's own config, never model\n * input, but we fail loud rather than build a malformed/injectable query.\n */\nexport function createD1KnowledgeStateAccessor(opts: PresetKnowledgeAccessorOptions): KnowledgeStateAccessor {\n  const { db, workspaceId } = opts\n  const defaultWhere = opts.defaultWhereColumn ?? 'workspace_id'\n  const configFn = typeof opts.config === 'function' ? opts.config : (path: string) => readDotPath(opts.config as Record<string, unknown>, path)\n\n  const isIdentifier = (s: string) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(s)\n\n  return {\n    config: configFn,\n    async count(query) {\n      if (!isIdentifier(query.table)) throw new Error(`unsafe table identifier: ${query.table}`)\n      const whereCol = query.where ?? defaultWhere\n      if (!isIdentifier(whereCol)) throw new Error(`unsafe where identifier: ${whereCol}`)\n\n      let sql = `SELECT count(*) AS n FROM ${query.table} WHERE ${whereCol} = ?`\n      const binds: unknown[] = [workspaceId]\n      if (query.statusIn && query.statusIn.length > 0) {\n        sql += ` AND status IN (${query.statusIn.map(() => '?').join(', ')})`\n        binds.push(...query.statusIn)\n      }\n      const row = await db.prepare(sql).bind(...binds).first<{ n: number }>()\n      return row?.n ?? 0\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Crypto + per-workspace key wiring\n// ---------------------------------------------------------------------------\n\n/** Build the {@link KeyCrypto} the billing key store uses — AES-256-GCM field\n *  crypto bound to the product's 64-char-hex `ENCRYPTION_KEY` (or a resolver).\n *  This is the concrete impl behind the `../billing` `KeyCrypto` seam. */\nexport function createPresetFieldCrypto(key: string | (() => string)): KeyCrypto {\n  return createFieldCrypto(key)\n}\n\n/**\n * The {@link WorkspaceKeyStore} over the preset `workspace_keys` table — the\n * persistence seam the per-workspace key manager needs. \"Active\" = a row with a\n * null `revoked_at`. Pure D1 wiring; no key minting (that's the provisioner).\n */\nexport function createPresetWorkspaceKeyStore(db: D1Like): WorkspaceKeyStore {\n  const W = PRESET_TABLES.workspaceKeys\n  return {\n    async getActive(workspaceId: string): Promise<WorkspaceKeyRecord | null> {\n      const row = await db\n        .prepare(\n          `SELECT ${W.columns.id} AS id, ${W.columns.keyId} AS keyId, ${W.columns.keyEncrypted} AS keyEncrypted, ${W.columns.budgetUsd} AS budgetUsd, ${W.columns.expiresAt} AS expiresAt FROM ${W.name} WHERE ${W.columns.workspaceId} = ? AND ${W.columns.revokedAt} IS NULL ORDER BY ${W.columns.createdAt} DESC LIMIT 1`,\n        )\n        .bind(workspaceId)\n        .first<{ id: string; keyId: string; keyEncrypted: string; budgetUsd: number; expiresAt: number | null }>()\n      if (!row) return null\n      return {\n        id: row.id,\n        keyId: row.keyId,\n        keyEncrypted: row.keyEncrypted,\n        budgetUsd: row.budgetUsd,\n        expiresAt: row.expiresAt == null ? null : new Date(row.expiresAt),\n      }\n    },\n    async listActive(workspaceId: string): Promise<Array<{ id: string; keyId: string }>> {\n      const res = await db\n        .prepare(`SELECT ${W.columns.id} AS id, ${W.columns.keyId} AS keyId FROM ${W.name} WHERE ${W.columns.workspaceId} = ? AND ${W.columns.revokedAt} IS NULL`)\n        .bind(workspaceId)\n        .all<{ id: string; keyId: string }>()\n      return res.results\n    },\n    async insert(record): Promise<void> {\n      await db\n        .prepare(\n          `INSERT INTO ${W.name} (${W.columns.id}, ${W.columns.workspaceId}, ${W.columns.keyId}, ${W.columns.keyEncrypted}, ${W.columns.budgetUsd}, ${W.columns.expiresAt}, ${W.columns.revokedAt}, ${W.columns.createdAt}) VALUES (?, ?, ?, ?, ?, ?, NULL, ?)`,\n        )\n        .bind(crypto.randomUUID(), record.workspaceId, record.keyId, record.keyEncrypted, record.budgetUsd, record.expiresAt.getTime(), Date.now())\n        .run()\n    },\n    async markRevoked(id: string, now: Date): Promise<void> {\n      await db\n        .prepare(`UPDATE ${W.name} SET ${W.columns.revokedAt} = ? WHERE ${W.columns.id} = ?`)\n        .bind(now.getTime(), id)\n        .run()\n    },\n  }\n}\n\nexport interface PresetBillingOptions {\n  db: D1Like\n  /** The key provisioner (`@tangle-network/tcloud`'s client satisfies it structurally). */\n  provisioner: KeyProvisioner\n  /** Field-crypto key (64-char hex) or resolver — encrypts the minted key at rest. */\n  encryptionKey: string | (() => string)\n  /** Default monthly USD allowance when a call doesn't specify one. */\n  defaultBudgetUsd: number\n  /** Injectable clock. */\n  now?: () => Date\n  /** tcloud product the key is scoped to. Default `'router'`. */\n  product?: string\n}\n\n/**\n * Stand up the per-workspace budget-capped {@link WorkspaceKeyManager} on the\n * house stack: the preset `workspace_keys` D1 store + AES-GCM field crypto +\n * the consumer's tcloud provisioner. The mint/rotate/rollover/usage LOGIC lives\n * in `../billing`; this only binds it to the preset table + crypto.\n */\nexport function createPresetWorkspaceKeyManager(opts: PresetBillingOptions): WorkspaceKeyManager {\n  return createWorkspaceKeyManager({\n    provisioner: opts.provisioner,\n    store: createPresetWorkspaceKeyStore(opts.db),\n    crypto: createPresetFieldCrypto(opts.encryptionKey),\n    defaultBudgetUsd: opts.defaultBudgetUsd,\n    now: opts.now,\n    product: opts.product,\n  })\n}\n"],"mappings":";;;;;;;;AA6FO,IAAM,gBAAgB;AAAA,EAC3B,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,MACP,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,UAAU;AAAA,MACV,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,MACP,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,MAAM;AAAA,MACN,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,MACP,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,UAAU;AAAA,MACV,OAAO;AAAA,MACP,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,MACP,IAAI;AAAA,MACJ,aAAa;AAAA,MACb,OAAO;AAAA,MACP,cAAc;AAAA,MACd,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAQO,IAAM,uBAA0C;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAiCO,SAAS,0BAA0B,GAA0B;AAClE,QAAM,EAAE,aAAa,MAAM,SAAS,KAAK,IAAI;AAC7C,QAAM,IAAI;AACV,SAAO;AAAA,IACL,WAAW,YAAY,EAAE,UAAU,MAAM;AAAA,MACvC,IAAI,KAAK,EAAE,UAAU,QAAQ,EAAE,EAAE,WAAW;AAAA,MAC5C,aAAa,KAAK,EAAE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MAC3D,UAAU,KAAK,EAAE,UAAU,QAAQ,QAAQ;AAAA,MAC3C,MAAM,KAAK,EAAE,UAAU,QAAQ,IAAI,EAAE,QAAQ;AAAA,MAC7C,OAAO,KAAK,EAAE,UAAU,QAAQ,KAAK,EAAE,QAAQ;AAAA,MAC/C,aAAa,KAAK,EAAE,UAAU,QAAQ,WAAW;AAAA,MACjD,QAAQ,KAAK,EAAE,UAAU,QAAQ,MAAM,EAAE,QAAQ,EAAE,QAAQ,SAAS;AAAA,MACpE,WAAW,KAAK,EAAE,UAAU,QAAQ,SAAS;AAAA,MAC7C,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,EAAE,QAAQ;AAAA,IAC5D,CAAC;AAAA,IACD,WAAW,YAAY,EAAE,UAAU,MAAM;AAAA,MACvC,IAAI,KAAK,EAAE,UAAU,QAAQ,EAAE,EAAE,WAAW;AAAA,MAC5C,aAAa,KAAK,EAAE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MAC3D,MAAM,KAAK,EAAE,UAAU,QAAQ,IAAI,EAAE,QAAQ;AAAA,MAC7C,MAAM,KAAK,EAAE,UAAU,QAAQ,IAAI,EAAE,QAAQ;AAAA,MAC7C,OAAO,KAAK,EAAE,UAAU,QAAQ,KAAK;AAAA,MACrC,SAAS,KAAK,EAAE,UAAU,QAAQ,OAAO;AAAA,MACzC,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,EAAE,QAAQ;AAAA,IAC5D,CAAC;AAAA,IACD,WAAW,YAAY,EAAE,UAAU,MAAM;AAAA,MACvC,IAAI,KAAK,EAAE,UAAU,QAAQ,EAAE,EAAE,WAAW;AAAA,MAC5C,aAAa,KAAK,EAAE,UAAU,QAAQ,WAAW,EAAE,QAAQ;AAAA,MAC3D,UAAU,KAAK,EAAE,UAAU,QAAQ,QAAQ;AAAA,MAC3C,OAAO,KAAK,EAAE,UAAU,QAAQ,KAAK,EAAE,QAAQ;AAAA,MAC/C,SAAS,KAAK,EAAE,UAAU,QAAQ,OAAO,EAAE,QAAQ;AAAA,MACnD,UAAU,KAAK,EAAE,UAAU,QAAQ,QAAQ;AAAA,MAC3C,QAAQ,KAAK,EAAE,UAAU,QAAQ,MAAM,EAAE,QAAQ,EAAE,QAAQ,WAAW;AAAA,MACtE,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,EAAE,QAAQ;AAAA,IAC5D,CAAC;AAAA,IACD,eAAe,YAAY,EAAE,cAAc,MAAM;AAAA,MAC/C,IAAI,KAAK,EAAE,cAAc,QAAQ,EAAE,EAAE,WAAW;AAAA,MAChD,aAAa,KAAK,EAAE,cAAc,QAAQ,WAAW,EAAE,QAAQ;AAAA,MAC/D,OAAO,KAAK,EAAE,cAAc,QAAQ,KAAK,EAAE,QAAQ;AAAA,MACnD,cAAc,KAAK,EAAE,cAAc,QAAQ,YAAY,EAAE,QAAQ;AAAA,MACjE,WAAW,KAAK,EAAE,cAAc,QAAQ,SAAS,EAAE,QAAQ;AAAA,MAC3D,WAAW,QAAQ,EAAE,cAAc,QAAQ,SAAS,EAAE,QAAQ;AAAA,MAC9D,WAAW,QAAQ,EAAE,cAAc,QAAQ,SAAS;AAAA,MACpD,WAAW,QAAQ,EAAE,cAAc,QAAQ,SAAS,EAAE,QAAQ;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAyBA,SAAS,KAAK,OAAuB;AACnC,SAAO,MACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE,EACtB,MAAM,GAAG,EAAE,KAAK;AACrB;AAgBO,SAAS,yBAAyB,MAAiD;AACxF,QAAM,EAAE,IAAI,MAAM,IAAI;AACtB,QAAM,QAAQ,KAAK,UAAU,MAAM,OAAO,WAAW;AACrD,QAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAM,WAAW,KAAK,gBAAgB;AACtC,QAAM,iBAAiB,KAAK,sBAAsB;AAClD,QAAM,IAAI,cAAc;AACxB,QAAM,IAAI,cAAc;AACxB,QAAM,IAAI,cAAc;AAExB,iBAAe,gBAAgB,MAAc,MAA6B;AACxE,UAAM,MAAM,IAAI,MAAM,IAAI;AAAA,EAC5B;AAEA,iBAAe,gBAAgB,aAAqB,MAAc,MAAc,OAAsB,SAAgC;AACpI,UAAM,GACH;AAAA,MACC,eAAe,EAAE,IAAI,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,WAAW,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,QAAQ,OAAO,KAAK,EAAE,QAAQ,SAAS;AAAA,IAC1K,EACC,KAAK,MAAM,GAAG,aAAa,MAAM,MAAM,OAAO,SAAS,IAAI,CAAC,EAC5D,IAAI;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,eAAe,MAA0B,KAAoD;AACjG,YAAM,WAAW,MAAM,GACpB,QAAQ,UAAU,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,UAAU,EAAE,QAAQ,WAAW,YAAY,EAAE,QAAQ,KAAK,cAAc,EAC3H,KAAK,IAAI,aAAa,KAAK,KAAK,EAChC,MAAsB;AACzB,UAAI,SAAU,QAAO,EAAE,YAAY,SAAS,IAAI,SAAS,KAAK;AAE9D,YAAM,KAAK,MAAM;AACjB,YAAM,GACH;AAAA,QACC,eAAe,EAAE,IAAI,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,WAAW,KAAK,EAAE,QAAQ,QAAQ,KAAK,EAAE,QAAQ,IAAI,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,QAAQ,WAAW,KAAK,EAAE,QAAQ,MAAM,KAAK,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,SAAS;AAAA,MAC/N,EACC,KAAK,IAAI,IAAI,aAAa,IAAI,UAAU,KAAK,MAAM,KAAK,OAAO,KAAK,eAAe,MAAM,IAAI,QAAQ,IAAI,CAAC,EAC1G,IAAI;AACP,aAAO,EAAE,YAAY,IAAI,SAAS,MAAM;AAAA,IAC1C;AAAA,IAEA,MAAM,iBAAiB,MAA4B,KAAsD;AACvG,YAAM,WAAW,MAAM,GACpB;AAAA,QACC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,OAAO,oBAAoB,EAAE,IAAI,UAAU,EAAE,QAAQ,WAAW,YAAY,EAAE,QAAQ,KAAK,YAAY,EAAE,QAAQ,OAAO;AAAA,MACrK,EACC,KAAK,IAAI,aAAa,KAAK,OAAO,KAAK,OAAO,EAC9C,MAAuC;AAC1C,UAAI,SAAU,QAAO,EAAE,IAAI,SAAS,IAAI,SAAS,SAAS,SAAS,SAAS,KAAK;AAEjF,YAAM,KAAK,MAAM;AACjB,YAAM,GACH;AAAA,QACC,eAAe,EAAE,IAAI,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,WAAW,KAAK,EAAE,QAAQ,QAAQ,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,QAAQ,OAAO,KAAK,EAAE,QAAQ,QAAQ,KAAK,EAAE,QAAQ,MAAM,KAAK,EAAE,QAAQ,SAAS;AAAA,MACvM,EACC,KAAK,IAAI,IAAI,aAAa,IAAI,UAAU,KAAK,OAAO,KAAK,SAAS,KAAK,YAAY,MAAM,IAAI,CAAC,EAC9F,IAAI;AACP,aAAO,EAAE,IAAI,SAAS,KAAK,SAAS,SAAS,MAAM;AAAA,IACrD;AAAA,IAEA,MAAM,SAAS,MAAoB,KAA8C;AAC/E,YAAM,UAAU,KAAK,UAAU,KAAK,MAAM;AAC1C,YAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,YAAY,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC;AACxE,YAAM,gBAAgB,MAAM,OAAO;AACnC,YAAM,gBAAgB,IAAI,aAAa,MAAM,MAAM,KAAK,OAAO,OAAO;AACtE,aAAO,EAAE,MAAM,QAAQ;AAAA,IACzB;AAAA,IAEA,MAAM,YAAY,MAAuB,KAAiD;AACxF,YAAM,aAAa,MAAM;AACzB,YAAM,OAAO,GAAG,cAAc,IAAI,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC,IAAI,WAAW,MAAM,GAAG,CAAC,CAAC;AACzF,YAAM,OAAO,KAAK,UAAU,EAAE,YAAY,KAAK,MAAM,OAAO,KAAK,OAAO,OAAO,KAAK,SAAS,KAAK,CAAC;AACnG,YAAM,gBAAgB,MAAM,IAAI;AAChC,YAAM,gBAAgB,IAAI,aAAa,MAAM,YAAY,KAAK,SAAS,MAAM,IAAI;AACjF,aAAO,EAAE,YAAY,KAAK;AAAA,IAC5B;AAAA,EACF;AACF;AAkBA,SAAS,YAAY,KAA8B,MAAuB;AACxE,MAAI,MAAe;AACnB,aAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAClC,QAAI,OAAO,QAAQ,OAAO,QAAQ,SAAU,QAAO;AACnD,UAAO,IAAgC,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAcO,SAAS,+BAA+B,MAA8D;AAC3G,QAAM,EAAE,IAAI,YAAY,IAAI;AAC5B,QAAM,eAAe,KAAK,sBAAsB;AAChD,QAAM,WAAW,OAAO,KAAK,WAAW,aAAa,KAAK,SAAS,CAAC,SAAiB,YAAY,KAAK,QAAmC,IAAI;AAE7I,QAAM,eAAe,CAAC,MAAc,2BAA2B,KAAK,CAAC;AAErE,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,MAAM,MAAM,OAAO;AACjB,UAAI,CAAC,aAAa,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,4BAA4B,MAAM,KAAK,EAAE;AACzF,YAAM,WAAW,MAAM,SAAS;AAChC,UAAI,CAAC,aAAa,QAAQ,EAAG,OAAM,IAAI,MAAM,4BAA4B,QAAQ,EAAE;AAEnF,UAAI,MAAM,6BAA6B,MAAM,KAAK,UAAU,QAAQ;AACpE,YAAM,QAAmB,CAAC,WAAW;AACrC,UAAI,MAAM,YAAY,MAAM,SAAS,SAAS,GAAG;AAC/C,eAAO,mBAAmB,MAAM,SAAS,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC;AAClE,cAAM,KAAK,GAAG,MAAM,QAAQ;AAAA,MAC9B;AACA,YAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,EAAE,KAAK,GAAG,KAAK,EAAE,MAAqB;AACtE,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACF;AASO,SAAS,wBAAwB,KAAyC;AAC/E,SAAO,kBAAkB,GAAG;AAC9B;AAOO,SAAS,8BAA8B,IAA+B;AAC3E,QAAM,IAAI,cAAc;AACxB,SAAO;AAAA,IACL,MAAM,UAAU,aAAyD;AACvE,YAAM,MAAM,MAAM,GACf;AAAA,QACC,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,KAAK,cAAc,EAAE,QAAQ,YAAY,qBAAqB,EAAE,QAAQ,SAAS,kBAAkB,EAAE,QAAQ,SAAS,sBAAsB,EAAE,IAAI,UAAU,EAAE,QAAQ,WAAW,YAAY,EAAE,QAAQ,SAAS,qBAAqB,EAAE,QAAQ,SAAS;AAAA,MACrS,EACC,KAAK,WAAW,EAChB,MAAwG;AAC3G,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO;AAAA,QACL,IAAI,IAAI;AAAA,QACR,OAAO,IAAI;AAAA,QACX,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI,aAAa,OAAO,OAAO,IAAI,KAAK,IAAI,SAAS;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM,WAAW,aAAoE;AACnF,YAAM,MAAM,MAAM,GACf,QAAQ,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,KAAK,kBAAkB,EAAE,IAAI,UAAU,EAAE,QAAQ,WAAW,YAAY,EAAE,QAAQ,SAAS,UAAU,EACxJ,KAAK,WAAW,EAChB,IAAmC;AACtC,aAAO,IAAI;AAAA,IACb;AAAA,IACA,MAAM,OAAO,QAAuB;AAClC,YAAM,GACH;AAAA,QACC,eAAe,EAAE,IAAI,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,WAAW,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,QAAQ,YAAY,KAAK,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,SAAS,KAAK,EAAE,QAAQ,SAAS;AAAA,MACjN,EACC,KAAK,OAAO,WAAW,GAAG,OAAO,aAAa,OAAO,OAAO,OAAO,cAAc,OAAO,WAAW,OAAO,UAAU,QAAQ,GAAG,KAAK,IAAI,CAAC,EACzI,IAAI;AAAA,IACT;AAAA,IACA,MAAM,YAAY,IAAY,KAA0B;AACtD,YAAM,GACH,QAAQ,UAAU,EAAE,IAAI,QAAQ,EAAE,QAAQ,SAAS,cAAc,EAAE,QAAQ,EAAE,MAAM,EACnF,KAAK,IAAI,QAAQ,GAAG,EAAE,EACtB,IAAI;AAAA,IACT;AAAA,EACF;AACF;AAsBO,SAAS,gCAAgC,MAAiD;AAC/F,SAAO,0BAA0B;AAAA,IAC/B,aAAa,KAAK;AAAA,IAClB,OAAO,8BAA8B,KAAK,EAAE;AAAA,IAC5C,QAAQ,wBAAwB,KAAK,aAAa;AAAA,IAClD,kBAAkB,KAAK;AAAA,IACvB,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,EAChB,CAAC;AACH;","names":[]}