@vfarcic/dot-ai 1.22.0 → 1.23.0

package/dist/interfaces/mcp.js

@@ -44,6 +44,37 @@ const plugin_registry_1 = require("../core/plugin-registry");
 const SESSION_TTL_MS = 60 * 60 * 1000;
 /** How often to check for expired sessions. */
 const SESSION_GC_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * PRD #647 F1 — hard raw-body byte ceiling for the untrusted prompts source
+ * ingest endpoint (POST /api/v1/prompts/sources).
+ *
+ * parseRequestBody buffers the whole body before JSON.parse + per-file
+ * base64-decode, all of which allocate fully BEFORE the 256 KiB *decoded* cap
+ * in ingestPromptsSource — so without a raw ceiling a multi-GB authenticated
+ * POST OOMs the shared process. 512 KiB is:
+ *   - comfortably ABOVE the largest valid manifest: 256 KiB decoded ≈ ~342 KiB
+ *     base64 + JSON/path/mode overhead (~350 KiB raw), and
+ *   - testably BELOW the ~1 MiB nginx-ingress limit the integration suite
+ *     traverses, so the app returns 413 before the proxy would.
+ * The cap is scoped to the ingest route only (see parseRequestBody's maxBytes
+ * argument); every other endpoint keeps today's uncapped behavior.
+ */
+const INGEST_MAX_RAW_BODY_BYTES = 512 * 1024;
+/** Pathname of the prompts source ingest endpoint the raw-body cap is scoped to. */
+const PROMPTS_INGEST_PATHNAME = '/api/v1/prompts/sources';
+/**
+ * PRD #647 F1 — thrown by parseRequestBody when the raw request body exceeds the
+ * per-route ceiling, so the HTTP handler can map it to a 413 (matching the mock
+ * server's read-json-body.ts) instead of buffering an unbounded body.
+ */
+class RequestBodyTooLargeError extends Error {
+    limit;
+    constructor(limit) {
+        super(`Request body exceeds ${limit} bytes`);
+        this.name = 'RequestBodyTooLargeError';
+        this.limit = limit;
+    }
+}
 class MCPServer {
     dotAI;
     initialized = false;
@@ -496,12 +527,34 @@ class MCPServer {
                         // Parse request body for POST requests
                         let body = undefined;
                         if (req.method === 'POST') {
-                            body = await this.parseRequestBody(req);
+                            // PRD #647 F1: cap the raw body for the untrusted ingest route
+                            // only (default = today's uncapped behavior elsewhere) and map
+                            // an oversize body to 413 (matches the mock server).
+                            const maxBytes = this.isPromptsIngestRequest(req.url)
+                                ? INGEST_MAX_RAW_BODY_BYTES
+                                : undefined;
+                            try {
+                                body = await this.parseRequestBody(req, maxBytes);
+                            }
+                            catch (error) {
+                                if (error instanceof RequestBodyTooLargeError) {
+                                    this.logger.warn('Request body too large', {
+                                        url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
+                                        limit: error.limit,
+                                    });
+                                    (0, error_response_1.sendErrorResponse)(res, 413, 'PAYLOAD_TOO_LARGE', error.message);
+                                    endSpan(413);
+                                    return;
+                                }
+                                throw error;
+                            }
                         }
                         // Check if this is a REST API request
                         if (this.restApiRouter.isApiRequest(req.url || '')) {
                             this.logger.debug('Routing to REST API handler', {
-                                url: req.url,
+                                // PRD #647 M5 (F2): scrub credential-bearing ?repo=/?source=
+                                // values before they reach the log (matches the REST handler).
+                                url: (0, rest_api_1.sanitizeRequestUrlForLogging)(req.url),
                             });
                             // Mark span as REST API request
                             span.setAttribute('request.type', 'rest-api');
@@ -603,11 +656,49 @@ class MCPServer {
             }).on('error', reject);
         });
     }
-    async parseRequestBody(req) {
+    /**
+     * Buffer and JSON-parse the request body.
+     *
+     * PRD #647 F1: when `maxBytes` is supplied (the untrusted ingest route), the
+     * body is rejected with RequestBodyTooLargeError as soon as the declared
+     * Content-Length OR the accumulated bytes exceed the ceiling — so an
+     * authenticated multi-GB POST can't buffer unbounded and OOM the shared
+     * process. When `maxBytes` is omitted (every other endpoint), behavior is
+     * exactly as before: no cap.
+     */
+    async parseRequestBody(req, maxBytes) {
         return new Promise((resolve, reject) => {
+            // Reject up front on a declared Content-Length over the cap, so we never
+            // start buffering a body we already know is too large.
+            if (maxBytes !== undefined) {
+                const declaredLen = parseInt(req.headers['content-length'] || '0', 10);
+                if (!Number.isNaN(declaredLen) && declaredLen > maxBytes) {
+                    reject(new RequestBodyTooLargeError(maxBytes));
+                    return;
+                }
+            }
             let body = '';
-            req.on('data', chunk => (body += chunk.toString()));
+            let received = 0;
+            let aborted = false;
+            req.on('data', chunk => {
+                if (aborted)
+                    return;
+                // Defense-in-depth: enforce the cap against actual bytes in case the
+                // Content-Length header is absent or lies.
+                if (maxBytes !== undefined) {
+                    received += chunk.length;
+                    if (received > maxBytes) {
+                        aborted = true;
+                        req.destroy();
+                        reject(new RequestBodyTooLargeError(maxBytes));
+                        return;
+                    }
+                }
+                body += chunk.toString();
+            });
             req.on('end', () => {
+                if (aborted)
+                    return;
                 try {
                     resolve(body ? JSON.parse(body) : undefined);
                 }
@@ -618,6 +709,29 @@ class MCPServer {
             req.on('error', reject);
         });
     }
+    /**
+     * PRD #647 F1: true only for the prompts source ingest endpoint, the one
+     * untrusted route the raw-body cap is scoped to. Parses the pathname so a
+     * query string can't bypass (or wrongly trip) the cap.
+     *
+     * PRD #647 C2 (CodeRabbit): the cap check runs BEFORE route dispatch, so a
+     * non-canonical pathname must be normalized here or it slips past the cap and
+     * buffers an uncapped body (DoS). A strict `===` let `POST /api/v1/prompts/
+     * sources/` (trailing slash) — the same ingest surface — skip `maxBytes`.
+     * Collapse trailing slashes (keeping a bare "/" intact) before comparing.
+     */
+    isPromptsIngestRequest(url) {
+        if (!url)
+            return false;
+        try {
+            const pathname = new URL(url, 'http://internal.invalid').pathname;
+            const normalized = pathname.replace(/\/+$/, '') || '/';
+            return normalized === PROMPTS_INGEST_PATHNAME;
+        }
+        catch {
+            return false;
+        }
+    }
     async stop() {
         // Stop OAuth provider pruning timer
         if (this.oauthProvider) {

package/dist/interfaces/openapi-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../src/interfaces/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,gBAAgB,EAAY,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMhD;;GAEG;AACH,KAAK,gBAAgB,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,KAAK,eAAe,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CACF,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;YACE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC,CAAC;SACxD,CACF,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CACF,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAoB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAc;IAChC,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,WAAW,CAA4C;gBAG7D,YAAY,EAAE,gBAAgB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,aAAa,CAAC,EAAE,iBAAiB;IAiBnC;;OAEG;IACH,YAAY,IAAI,WAAW;IA4D3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA2GzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+DzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4E/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAyB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4N3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4DpB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoE5B;;OAEG;IACH,eAAe,IAAI,IAAI;IAMvB;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMrD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B"}
+{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../src/interfaces/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EAAE,gBAAgB,EAAY,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAMhD;;GAEG;AACH,KAAK,gBAAgB,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,KAAK,eAAe,GAAG;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;QACE,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,MAAM,EAAE,gBAAgB,CAAA;SAAE,CAAC,CAAC;KACxD,CACF,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;QACF,OAAO,CAAC,EAAE;YACR,IAAI,EAAE,MAAM,CAAC;YACb,GAAG,EAAE,MAAM,CAAC;SACb,CAAC;KACH,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAChB,MAAM,EACN;YACE,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC,CAAC;SACxD,CACF,CAAC;QACF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;YACE,IAAI,EAAE,MAAM,CAAC;YACb,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CACF,CAAC;KACH,CAAC;IACF,IAAI,CAAC,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,YAAY,CAAmB;IACvC,OAAO,CAAC,aAAa,CAAC,CAAoB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAC,CAAc;IAChC,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,eAAe,CAAiB;IAOxC,OAAO,CAAC,WAAW,CACH;gBAGd,YAAY,EAAE,gBAAgB,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,EACnC,aAAa,CAAC,EAAE,iBAAiB;IAiBnC;;OAEG;IACH,YAAY,IAAI,WAAW;IA4D3B;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACH,OAAO,CAAC,eAAe;IASvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA2GzB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IA+DzB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAwB1B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA4E/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAgB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAwB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA4N3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAW3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoC5B;;OAEG;IACH,OAAO,CAAC,YAAY;IA4DpB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoE5B;;OAEG;IACH,eAAe,IAAI,IAAI;IAMvB;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAMrD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B"}

package/dist/interfaces/openapi-generator.js

@@ -26,7 +26,13 @@ class OpenApiGenerator {
     specCache;
     lastCacheUpdate = 0;
     cacheValidityMs = 60000; // 1 minute
-    schemaCache = new Map();
+    // Keyed on the Zod schema OBJECT identity, not a structural stringify: two
+    // distinct schemas that differ only in their `.describe()` text serialize to
+    // the same string, so a string key would conflate them and leak one schema's
+    // descriptions into the other's endpoint (e.g. the prompts list vs. render
+    // `?source=` query). Identity keying gives each schema object its own entry
+    // while a schema reused across routes still hits the cache.
+    schemaCache = new WeakMap();
     constructor(toolRegistry, logger, config = {}, routeRegistry) {
         this.toolRegistry = toolRegistry;
         this.routeRegistry = routeRegistry;
@@ -472,6 +478,7 @@ class OpenApiGenerator {
             404: 'Not found',
             405: 'Method not allowed',
             409: 'Conflict',
+            413: 'Payload too large',
             422: 'Unprocessable entity',
             500: 'Internal server error',
             502: 'Bad gateway',
@@ -483,16 +490,15 @@ class OpenApiGenerator {
      * Convert Zod schema to JSON Schema with caching
      */
     zodSchemaToJsonSchema(schema) {
-        const cacheKey = JSON.stringify(schema);
-        if (this.schemaCache.has(cacheKey)) {
-            return this.schemaCache.get(cacheKey);
+        if (this.schemaCache.has(schema)) {
+            return this.schemaCache.get(schema);
         }
         try {
             const result = zod_1.z.toJSONSchema(schema);
             // Remove $schema and additionalProperties (not valid in OpenAPI component schemas)
             delete result.$schema;
             delete result.additionalProperties;
-            this.schemaCache.set(cacheKey, result);
+            this.schemaCache.set(schema, result);
             return result;
         }
         catch (error) {

package/dist/interfaces/rest-api.d.ts

@@ -20,9 +20,11 @@ import { PluginManager } from '../core/plugin-manager';
 export declare const UNPARSEABLE_QUERY_PLACEHOLDER = "?<redacted-unparseable>";
 /**
  * F3: req.url is logged on every request; with PRD #581 the query string may
- * carry `?repo=<user-supplied-url>` whose value can include credentials. This
- * helper rewrites the `repo` value to its credential-scrubbed form so the
- * raw token doesn't reach the log. Everything else is preserved verbatim.
+ * carry `?repo=<user-supplied-url>` whose value can include credentials, and
+ * PRD #647 adds `?source=<identifier>` which is equally credential-bearing (it
+ * may be a `https://user:tok@host` git URL). This helper rewrites BOTH values
+ * to their credential-scrubbed form so the raw token doesn't reach the log.
+ * Everything else is preserved verbatim.
  *
  * CodeRabbit Major B: on parse failure, we no longer return the input
  * verbatim — an unparseable URL is more likely than a parseable one to hide
@@ -66,7 +68,7 @@ export declare function sanitizeRequestUrlForLogging(url: string | undefined): s
  * BEFORE any clone or shared-cache mutation, so a rejected override can never
  * corrupt the env-var-configured cache.
  */
-export declare function extractPromptsOverride(repoParam: unknown, pathParam?: unknown, branchParam?: unknown, gitToken?: string): {
+export declare function extractPromptsOverride(repoParam: unknown, pathParam?: unknown, branchParam?: unknown, gitToken?: string, sourceParam?: unknown): {
     ok: true;
     override?: UserPromptsOverride;
 } | {
@@ -287,6 +289,18 @@ export declare class RestApiRouter {
      * Handle prompts cache refresh requests (PRD #386, extended PRD #581)
      */
     private handlePromptsCacheRefresh;
+    /**
+     * Handle prompts source ingestion (PRD #647 M2).
+     *
+     * Accepts a JSON manifest { source, contentHash, files:[{path, content(base64),
+     * mode}] }, base64-decodes and caches the uploaded skill source keyed by its
+     * `source` identifier in the in-memory ingested cache. A later
+     * POST /api/v1/prompts/:promptName?source=<identifier> renders it through the
+     * existing render path with no git operation. The (scrubbed) source is echoed
+     * back. Bearer-gated by the same checkBearerAuth path as every non-OpenAPI
+     * request.
+     */
+    private handlePromptsSourceIngest;
     /**
      * Handle visualization requests (PRD #317)
      * Returns structured visualization data for a query session

package/dist/interfaces/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,OAAO,EAIL,mBAAmB,EACpB,MAAM,6BAA6B,CAAC;AAuCrC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAoBpB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,MAAM,GAEf;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB,CA0DJ;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA0G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IAwEtC;;OAEG;YACW,uBAAuB;IA0FrC;;OAEG;YACW,yBAAyB;IAoFvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IAiDlC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAStB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAQtC,OAAO,EAOL,mBAAmB,EAEpB,MAAM,6BAA6B,CAAC;AAuCrC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,MAAM,GAAG,SAAS,CAyCpB;AAgDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,OAAO,EAClB,SAAS,CAAC,EAAE,OAAO,EACnB,WAAW,CAAC,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,OAAO,GAEnB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB,CA0EJ;AAED;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAsGhB;;;OAGG;YACW,aAAa;IA4G3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA8GtC;;OAEG;YACW,uBAAuB;IAgHrC;;OAEG;YACW,yBAAyB;IAkGvC;;;;;;;;;;OAUG;YACW,yBAAyB;IAmEvC;;;;OAIG;YACW,eAAe;IAwW7B;;;;OAIG;YACW,kBAAkB;IAkHhC;;;OAGG;YACW,oBAAoB;IAiDlC;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAStB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}

package/dist/interfaces/rest-api.js

@@ -74,9 +74,11 @@ const rbac_1 = require("../core/rbac");
 exports.UNPARSEABLE_QUERY_PLACEHOLDER = '?<redacted-unparseable>';
 /**
  * F3: req.url is logged on every request; with PRD #581 the query string may
- * carry `?repo=<user-supplied-url>` whose value can include credentials. This
- * helper rewrites the `repo` value to its credential-scrubbed form so the
- * raw token doesn't reach the log. Everything else is preserved verbatim.
+ * carry `?repo=<user-supplied-url>` whose value can include credentials, and
+ * PRD #647 adds `?source=<identifier>` which is equally credential-bearing (it
+ * may be a `https://user:tok@host` git URL). This helper rewrites BOTH values
+ * to their credential-scrubbed form so the raw token doesn't reach the log.
+ * Everything else is preserved verbatim.
  *
  * CodeRabbit Major B: on parse failure, we no longer return the input
  * verbatim — an unparseable URL is more likely than a parseable one to hide
@@ -88,8 +90,19 @@ exports.UNPARSEABLE_QUERY_PLACEHOLDER = '?<redacted-unparseable>';
 function sanitizeRequestUrlForLogging(url) {
     if (!url)
         return url;
-    if (!url.includes('repo='))
+    // Fast path: only walk the URL when it carries a credential-bearing param
+    // we know how to scrub (PRD #581 `repo=`, PRD #647 `source=`).
+    //
+    // CodeRabbit C3: a percent-encoded param NAME (e.g. `r%65po=`, `s%6Frce=`)
+    // decodes to `repo`/`source` once parsed, so the literal-substring fast path
+    // would early-return WITHOUT scrubbing and leak the credential into the log.
+    // Any `%` means a name could be encoded, so fall through to the full
+    // parse-and-scrub below (URLSearchParams decodes the name, catching it).
+    if (!url.includes('repo=') &&
+        !url.includes('source=') &&
+        !url.includes('%')) {
         return url;
+    }
     try {
         // req.url is path-relative; provide a dummy base for URL parsing.
         const parsed = new node_url_1.URL(url, 'http://internal.invalid');
@@ -97,6 +110,13 @@ function sanitizeRequestUrlForLogging(url) {
         if (repo) {
             parsed.searchParams.set('repo', (0, user_prompts_loader_1.sanitizeUrlForLogging)(repo));
         }
+        // PRD #647 M5 (F2): `?source=` is scrubbed with the same deep helper used
+        // for the echoed `source` (userinfo + credential-bearing query params), so
+        // `?source=https://user:tok@host` never appears unscrubbed in the log.
+        const source = parsed.searchParams.get('source');
+        if (source) {
+            parsed.searchParams.set('source', (0, user_prompts_loader_1.scrubSourceUrl)(source));
+        }
         // Return path + search only (drop the dummy base).
         return parsed.pathname + parsed.search + parsed.hash;
     }
@@ -183,7 +203,22 @@ function readGitTokenHeader(req) {
  * BEFORE any clone or shared-cache mutation, so a rejected override can never
  * corrupt the env-var-configured cache.
  */
-function extractPromptsOverride(repoParam, pathParam, branchParam, gitToken) {
+function extractPromptsOverride(repoParam, pathParam, branchParam, gitToken, sourceParam) {
+    // PRD #647 D1: an explicit `?source=<identifier>` selects an already-ingested
+    // (CLI-uploaded) source. It is the explicit ingested signal, so it takes
+    // precedence over `?repo=` and the clone-qualifying params (path/branch/token)
+    // do not apply — they only describe a git clone, which an ingested source is
+    // not. Resolution against the in-memory ingested cache (and the "never clone"
+    // guarantee) happens in loadUserPrompts via override.ingestedSource. The raw
+    // identifier doubles as repoUrl ONLY so computePromptsSource echoes the
+    // scrubbed source; it is never cloned or logged unscrubbed on this path.
+    if (typeof sourceParam === 'string' && sourceParam.trim() !== '') {
+        const identifier = sourceParam.trim();
+        return {
+            ok: true,
+            override: { repoUrl: identifier, ingestedSource: identifier },
+        };
+    }
     // Treat absent (null/undefined) repo as no override. path/branch/token only
     // qualify an override, so without a repo they are ignored (the credential
     // header is inert on the env-var path).
@@ -376,6 +411,7 @@ class RestApiRouter {
             'GET:/api/v1/logs': () => this.handleGetLogs(req, res, requestId, searchParams),
             'GET:/api/v1/prompts': () => this.handlePromptsListRequest(req, res, requestId, searchParams),
             'POST:/api/v1/prompts/refresh': () => this.handlePromptsCacheRefresh(req, res, requestId, body),
+            'POST:/api/v1/prompts/sources': () => this.handlePromptsSourceIngest(req, res, requestId, body),
             'POST:/api/v1/prompts/:promptName': () => this.handlePromptsGetRequest(req, res, requestId, params.promptName, body, searchParams),
             'GET:/api/v1/visualize/:sessionId': () => this.handleVisualize(req, res, requestId, params.sessionId, searchParams),
             'GET:/api/v1/events/remediations': () => this.handleRemediationSSE(req, res, requestId),
@@ -1227,7 +1263,11 @@ class RestApiRouter {
             // candidate.subPath / candidate.branch (absent → unchanged behavior).
             // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
             // (inert when no ?repo= override is present).
-            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req));
+            // PRD #647 list-by-source: ?source= selects an already-ingested source,
+            // resolved from the in-memory upload cache with no git operation (same
+            // signal as the render path). Absent → byte-identical to today (env-var /
+            // built-in set), so the no-?source= behavior is unchanged.
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req), searchParams.get('source'));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1249,6 +1289,24 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (?repo=) whose source can't be loaded is a
+            // bad-gateway condition, not a server fault: surface it (issue #575)
+            // instead of silently serving built-in prompts with HTTP 200. The
+            // message is already credential-scrubbed by the loader.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
+            // PRD #647 list-by-source (D2): an unknown/evicted ?source= identifier is
+            // a caller-actionable validation error — surface the re-upload guidance as
+            // a 400 (same mapping the render handler uses), NOT a generic 500 or a
+            // silent success-with-builtins. The message names POST
+            // /api/v1/prompts/sources and carries no clone/git/scheme vocabulary.
+            const listErrorMessage = error instanceof Error ? error.message : String(error);
+            if (listErrorMessage.includes('Ingested source not found')) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', listErrorMessage);
+                return;
+            }
             this.logger.error('Prompts list request failed', error instanceof Error ? error : new Error(String(error)), {
                 requestId,
             });
@@ -1268,7 +1326,11 @@ class RestApiRouter {
             // candidate.subPath / candidate.branch (absent → unchanged behavior).
             // PRD #621 M2: X-Dot-AI-Git-Token header authenticates the override clone
             // (inert when no ?repo= override is present).
-            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req));
+            // PRD #647 D1/M3: ?source= selects an already-ingested source, resolved
+            // from the in-memory upload cache with no git operation (precedence over
+            // ?repo=). Absent → unchanged behavior, so the env-var/clone paths are
+            // byte-identical to today.
+            const overrideResult = extractPromptsOverride(searchParams.get('repo'), searchParams.get('path'), searchParams.get('branch'), readGitTokenHeader(req), searchParams.get('source'));
             if (!overrideResult.ok) {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'VALIDATION_ERROR', overrideResult.message);
                 return;
@@ -1291,14 +1353,24 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (?repo=) whose source can't be loaded is a
+            // bad-gateway condition (issue #575); surface it before the generic
+            // validation/500 mapping. The message is already credential-scrubbed.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
             const errorMessage = error instanceof Error ? error.message : String(error);
             this.logger.error('Prompt get request failed', error instanceof Error ? error : new Error(String(error)), {
                 requestId,
                 promptName,
             });
-            // Check if it's a validation error (missing required arguments or prompt not found)
+            // Check if it's a validation error (missing required arguments, prompt not
+            // found, or a missing ingested ?source= identifier — PRD #647 D2, which
+            // carries re-upload guidance and must be a 400, not a 500).
             const isValidationError = errorMessage.includes('Missing required arguments') ||
-                errorMessage.includes('Prompt not found');
+                errorMessage.includes('Prompt not found') ||
+                errorMessage.includes('Ingested source not found');
             await this.sendErrorResponse(res, requestId, isValidationError
                 ? HttpStatus.BAD_REQUEST
                 : HttpStatus.INTERNAL_SERVER_ERROR, isValidationError ? 'VALIDATION_ERROR' : 'PROMPT_GET_ERROR', errorMessage);
@@ -1347,10 +1419,67 @@ class RestApiRouter {
             });
         }
         catch (error) {
+            // A per-request override (body.repo) whose source can't be loaded is a
+            // bad-gateway condition (issue #575); surface it instead of a generic
+            // 500. The message is already credential-scrubbed by the loader.
+            if (error instanceof user_prompts_loader_1.UserPromptsOverrideError) {
+                await this.sendErrorResponse(res, requestId, HttpStatus.BAD_GATEWAY, 'PROMPTS_SOURCE_ERROR', error.message);
+                return;
+            }
             this.logger.error('Prompts cache refresh failed', error instanceof Error ? error : new Error(String(error)), { requestId });
             await this.sendErrorResponse(res, requestId, HttpStatus.INTERNAL_SERVER_ERROR, 'PROMPTS_CACHE_REFRESH_ERROR', 'Failed to refresh prompts cache');
         }
     }
+    /**
+     * Handle prompts source ingestion (PRD #647 M2).
+     *
+     * Accepts a JSON manifest { source, contentHash, files:[{path, content(base64),
+     * mode}] }, base64-decodes and caches the uploaded skill source keyed by its
+     * `source` identifier in the in-memory ingested cache. A later
+     * POST /api/v1/prompts/:promptName?source=<identifier> renders it through the
+     * existing render path with no git operation. The (scrubbed) source is echoed
+     * back. Bearer-gated by the same checkBearerAuth path as every non-OpenAPI
+     * request.
+     */
+    async handlePromptsSourceIngest(req, res, requestId, body) {
+        try {
+            this.logger.info('Processing prompts source ingest request', {
+                requestId,
+            });
+            // All fields are untrusted; ingestPromptsSource validates and decodes
+            // them, throwing PromptsSourceValidationError (→ 400) on a malformed or
+            // unsafe manifest before anything is cached.
+            const manifest = body;
+            const result = (0, user_prompts_loader_1.ingestPromptsSource)({
+                source: manifest?.source,
+                contentHash: manifest?.contentHash,
+                files: manifest?.files,
+            }, this.logger);
+            const response = {
+                success: true,
+                data: result,
+                meta: {
+                    timestamp: new Date().toISOString(),
+                    requestId,
+                    version: this.config.version,
+                },
+            };
+            await this.sendJsonResponse(res, HttpStatus.OK, response);
+            this.logger.info('Prompts source ingest completed', {
+                requestId,
+                source: result.source,
+                fileCount: result.fileCount,
+            });
+        }
+        catch (error) {
+            const isValidationError = error instanceof user_prompts_loader_1.PromptsSourceValidationError;
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            this.logger.error('Prompts source ingest failed', error instanceof Error ? error : new Error(String(error)), { requestId });
+            await this.sendErrorResponse(res, requestId, isValidationError
+                ? HttpStatus.BAD_REQUEST
+                : HttpStatus.INTERNAL_SERVER_ERROR, isValidationError ? 'VALIDATION_ERROR' : 'PROMPTS_SOURCE_INGEST_ERROR', isValidationError ? errorMessage : 'Failed to ingest prompts source');
+        }
+    }
     /**
      * Handle visualization requests (PRD #317)
      * Returns structured visualization data for a query session

package/dist/interfaces/routes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/interfaces/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAuM5E;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,CAC5C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,EAyVA,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAInE;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/interfaces/routes/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAgN5E;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,eAAe,CAC5C,OAAO,EACP,OAAO,EACP,OAAO,EACP,OAAO,CACR,EA6XA,CAAC;AAEF;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAInE;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/interfaces/routes/index.js

@@ -286,8 +286,17 @@ exports.routeDefinitions = [
         method: 'GET',
         description: 'List all available prompts',
         tags: ['Prompts'],
+        // PRD #647 list-by-source: declare the per-request query params the list
+        // endpoint accepts. `?source=` enumerates a previously-ingested source (no
+        // git clone); `?repo=`/`?path=`/`?branch=` are the existing git overrides.
+        query: schemas_1.PromptsListQuerySchema,
         response: schemas_1.PromptsListResponseSchema,
         errorResponses: {
+            // PRD #647 list-by-source (D2): an unknown/evicted ?source= identifier
+            // returns 400 VALIDATION_ERROR with re-upload guidance — same contract as
+            // the render endpoint's ?source= miss.
+            400: schemas_1.PromptValidationErrorSchema,
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.InternalServerErrorSchema,
         },
     },
@@ -298,19 +307,45 @@ exports.routeDefinitions = [
         tags: ['Prompts'],
         response: schemas_1.PromptsCacheRefreshResponseSchema,
         errorResponses: {
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.PromptsCacheRefreshErrorSchema,
         },
     },
+    {
+        path: '/api/v1/prompts/sources',
+        method: 'POST',
+        description: 'Ingest (upload) a skill source the server caches and renders via POST /api/v1/prompts/:promptName?source=<identifier> with no git clone (PRD #647)',
+        tags: ['Prompts'],
+        body: schemas_1.PromptsSourceIngestRequestSchema,
+        response: schemas_1.PromptsSourceIngestResponseSchema,
+        errorResponses: {
+            400: schemas_1.PromptsSourceIngestErrorSchema,
+            // PRD #647 A7/A9 (CodeRabbit): the 512 KiB raw-body cap returns 413
+            // (PAYLOAD_TOO_LARGE) from mcp.ts before route dispatch — document it.
+            413: schemas_1.PromptsSourceIngestPayloadTooLargeErrorSchema,
+            // PRD #647 A8 (CodeRabbit): narrowed to the only 500 code this handler
+            // emits, instead of the shared broad InternalServerErrorSchema union.
+            500: schemas_1.PromptsSourceIngestServerErrorSchema,
+        },
+    },
     {
         path: '/api/v1/prompts/:promptName',
         method: 'POST',
         description: 'Get a prompt with rendered template arguments',
         tags: ['Prompts'],
         params: PromptNameParamsSchema,
+        // PRD #647 A6 (CodeRabbit): declare the per-request render query params
+        // (?source= ingest-render, plus ?repo=/?path=/?branch= overrides).
+        query: schemas_1.PromptGetQuerySchema,
         body: schemas_1.PromptGetRequestSchema,
         response: schemas_1.PromptGetResponseSchema,
         errorResponses: {
+            // PRD #647 (CodeRabbit): the render handler returns 400 VALIDATION_ERROR
+            // when ?source= resolution fails (unresolvable ingested source → D2) or
+            // required arguments are missing — document that contract.
+            400: schemas_1.PromptValidationErrorSchema,
             404: schemas_1.PromptNotFoundErrorSchema,
+            502: schemas_1.PromptsSourceErrorSchema,
             500: schemas_1.InternalServerErrorSchema,
         },
     },

package/dist/interfaces/schemas/common.d.ts

@@ -119,6 +119,23 @@ export declare const MethodNotAllowedErrorSchema: z.ZodObject<{
         code: z.ZodLiteral<"METHOD_NOT_ALLOWED">;
     }, z.core.$strip>;
 }, z.core.$strip>;
+/**
+ * 413 returned when a request body exceeds a per-route raw-body cap (PRD #647:
+ * the 512 KiB prompts source ingest cap). The handler emits PAYLOAD_TOO_LARGE.
+ */
+export declare const PayloadTooLargeErrorSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    meta: z.ZodOptional<z.ZodObject<{
+        timestamp: z.ZodString;
+        requestId: z.ZodOptional<z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodObject<{
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodAny>;
+        code: z.ZodLiteral<"PAYLOAD_TOO_LARGE">;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare const ServiceUnavailableErrorSchema: z.ZodObject<{
     success: z.ZodLiteral<false>;
     meta: z.ZodOptional<z.ZodObject<{
@@ -137,6 +154,21 @@ export declare const ServiceUnavailableErrorSchema: z.ZodObject<{
         }>;
     }, z.core.$strip>;
 }, z.core.$strip>;
+export declare const BadGatewayErrorSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    meta: z.ZodOptional<z.ZodObject<{
+        timestamp: z.ZodString;
+        requestId: z.ZodOptional<z.ZodString>;
+        version: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodObject<{
+        message: z.ZodString;
+        details: z.ZodOptional<z.ZodAny>;
+        code: z.ZodEnum<{
+            PROMPTS_SOURCE_ERROR: "PROMPTS_SOURCE_ERROR";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare const InternalServerErrorSchema: z.ZodObject<{
     success: z.ZodLiteral<false>;
     meta: z.ZodOptional<z.ZodObject<{
@@ -166,6 +198,7 @@ export declare const InternalServerErrorSchema: z.ZodObject<{
             SESSION_RETRIEVAL_ERROR: "SESSION_RETRIEVAL_ERROR";
             MIGRATION_ERROR: "MIGRATION_ERROR";
             PROMPTS_CACHE_REFRESH_ERROR: "PROMPTS_CACHE_REFRESH_ERROR";
+            PROMPTS_SOURCE_INGEST_ERROR: "PROMPTS_SOURCE_INGEST_ERROR";
             USER_MANAGEMENT_ERROR: "USER_MANAGEMENT_ERROR";
         }>;
     }, z.core.$strip>;

package/dist/interfaces/schemas/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/interfaces/schemas/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,UAAU;;;;iBAOrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChE,UAAU,EAAE,CAAC;;;;;;;;kBAOd;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;iBAUhC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;iBAItC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBASxC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwBpC,CAAC"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/interfaces/schemas/common.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,UAAU;;;;iBAOrB,CAAC;AAEH,MAAM,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChE,UAAU,EAAE,CAAC;;;;;;;;kBAOd;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;iBAUhC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;iBAItC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAIrC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;iBASxC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAQhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyBpC,CAAC"}