aimeat 3.2.0 → 3.3.0

package/dist/src/services/scheduler-extension-job.js

@@ -1,85 +1,39 @@
-import { executeExtensionAction, trackMemoryAccess } from './extension-runtime.js';
-import { buildExtensionCtx, buildExtensionNotify, buildExtensionEmail } from './extension-ctx.js';
-import { getEncryptionKey } from './encryption.js';
-import { getExtSecretKeys, getInstanceSecretKeys, decryptSecretFields } from './extension-secrets.js';
+import { runExtensionActionAsSystem } from './extension-system-run.js';
 /**
- * Execute a scheduled `extension` job: resolve the extension + action, build the sandbox context
- * (scheduler runs as a system caller), decrypt secret config (incl. an instance-scoped job's
- * bring-your-own-key config), run the action, and return the tracked memory reads/writes.
+ * Execute a scheduled `extension` job and return the tracked memory reads/writes for the run log.
+ *
+ * Every refusal throws: the scheduler records a thrown error as `lastRunResult: 'error'`, leaves the
+ * run count alone and notifies the owner, while any normal return is recorded as a successful run.
  */
 export async function runExtensionJob(storage, config, emailService, job) {
     if (!job.extensionName || !job.actionId) {
         throw new Error(`Extension job "${job.id}" missing extensionName or actionId`);
     }
-    const ext = await storage.getExtension(job.extensionName);
-    if (!ext) {
-        throw new Error(`Extension "${job.extensionName}" not found`);
+    // A schedule's `ownerScope` is the owner GHII; an extension record carries the BARE installer name
+    // (routes/extensions/crud.ts writes `req.auth!.owner` into it). Both forms are needed: the owner
+    // fence compares bare names, storage is addressed by GHII. Falling back to the extension record's
+    // own installer would make the fence compare a value against itself, so it is not done.
+    const ownerScope = job.ownerScope ?? '';
+    const ownerName = ownerScope.split('@')[0];
+    if (!ownerName) {
+        throw new Error(`Extension job "${job.id}" has no owner scope — reinstall or reactivate extension "${job.extensionName}" to re-register it`);
     }
-    if (ext.status !== 'active') {
-        throw new Error(`Extension "${job.extensionName}" is not active`);
-    }
-    const action = ext.actions.find(a => a.id === job.actionId);
-    if (!action) {
-        throw new Error(`Action "${job.actionId}" not found in extension "${job.extensionName}"`);
-    }
-    // Build the extension context — scheduler runs as a system caller
-    const extMemoryOwner = job.instanceId
-        ? `ext:${ext.name}.${job.instanceId}`
-        : `ext:${ext.name}`;
-    // For an instance-scoped job, load the instance and decrypt its secret config so a scheduled
-    // sync gets the same bring-your-own-key config a live instance action would. `type: 'secret'`
-    // fields are decrypted just before the VM (see services/extension-secrets.ts).
-    const encKey = getEncryptionKey(config);
-    let instanceCtx;
-    if (job.instanceId) {
-        const inst = await storage.getExtensionInstance(ext.name, job.instanceId);
-        instanceCtx = {
-            id: job.instanceId,
-            config: inst
-                ? decryptSecretFields(inst.config, getInstanceSecretKeys(ext), encKey)
-                : (job.input ?? {}),
-        };
-    }
-    // One builder, so this road cannot be the one that forgets a guard again. It was: until
-    // 2026-08-10 the scheduled path wrote memory without the size and key-count limits, and fetched
-    // with a bare fetch rather than safeFetch, so an extension running on a clock had neither the
-    // storage ceiling nor the SSRF check that the same extension had when a person invoked it.
-    const baseCtx = buildExtensionCtx({
-        config,
-        storage,
-        extMemoryOwner,
-        // Scheduled runs have no human present. The installer is the responsible party, and the
-        // 'operator' role is what the sandbox reads to decide it is a system run.
-        caller: {
-            gaii: `scheduler@${config.nodeId}`,
-            owner: ext.installedBy,
-            roles: ['operator'],
-        },
-        extConfig: decryptSecretFields(ext.config, getExtSecretKeys(ext), encKey),
-        instance: instanceCtx,
-        logPrefix: `[ext:${ext.name}:scheduler]`,
-        // No wallet: nobody's balance is available to spend on a schedule.
-        notify: buildExtensionNotify({
-            storage, config, extName: ext.name,
-            recipientGaii: ext.installedBy, recipientOwner: ext.installedBy,
-        }),
-        email: buildExtensionEmail({
-            storage, config, extName: ext.name, extConfig: ext.config,
-            ownerName: ext.installedBy, emailService,
-        }),
+    const ownerGhii = ownerScope.includes('@') ? ownerScope : `${ownerName}@${config.nodeId}`;
+    const out = await runExtensionActionAsSystem({ storage, config, emailService }, {
+        extensionName: job.extensionName,
+        actionId: job.actionId,
+        instanceId: job.instanceId,
+        input: job.input,
+        // Nobody is present, and the scheduler says so rather than borrowing the owner's name for it.
+        callerGaii: `scheduler@${config.nodeId}`,
+        ownerName,
+        storageOwnerGhii: ownerGhii,
+        logLabel: 'scheduler',
+        producerKind: 'extension',
+        producerRef: job.id,
+        producerSchedule: job.cron,
+        trackMemory: true,
     });
-    // Wrap with memory access tracking
-    const { ctx, accessLog } = trackMemoryAccess(baseCtx);
-    // Validate input is a plain object — reject non-serializable values
-    const rawInput = job.input ?? {};
-    let input;
-    try {
-        input = JSON.parse(JSON.stringify(rawInput));
-    }
-    catch {
-        throw new Error(`Scheduled job "${job.id}" has non-serializable input`);
-    }
-    await executeExtensionAction(action.scriptContent, ctx, input, ext.limits);
-    return { reads: accessLog.reads, writes: accessLog.writes };
+    return { reads: out.reads, writes: out.writes };
 }
 //# sourceMappingURL=scheduler-extension-job.js.map

package/dist/src/services/scheduler-extension-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"scheduler-extension-job.js","sourceRoot":"","sources":["../../../src/services/scheduler-extension-job.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGtG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,MAAoB,EACpB,YAAsC,EACtC,GAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,aAAa,iBAAiB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,QAAQ,6BAA6B,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,GAAG,CAAC,UAAU;QACnC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE;QACrC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtB,6FAA6F;IAC7F,8FAA8F;IAC9F,+EAA+E;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,WAAwE,CAAC;IAC7E,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1E,WAAW,GAAG;YACZ,EAAE,EAAE,GAAG,CAAC,UAAU;YAClB,MAAM,EAAE,IAAI;gBACV,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;gBACtE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,gGAAgG;IAChG,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,OAAO,GAAiB,iBAAiB,CAAC;QAC9C,MAAM;QACN,OAAO;QACP,cAAc;QACd,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,EAAE;YACN,IAAI,EAAE,aAAa,MAAM,CAAC,MAAM,EAAE;YAClC,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,KAAK,EAAE,CAAC,UAAU,CAAC;SACpB;QACD,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACzE,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,QAAQ,GAAG,CAAC,IAAI,aAAa;QACxC,mEAAmE;QACnE,MAAM,EAAE,oBAAoB,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI;YAClC,aAAa,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW;SAChE,CAAC;QACF,KAAK,EAAE,mBAAmB,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;YACzD,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY;SACzC,CAAC;KACH,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEtD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAA4B,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"scheduler-extension-job.js","sourceRoot":"","sources":["../../../src/services/scheduler-extension-job.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,MAAoB,EACpB,YAAsC,EACtC,GAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,6DAA6D,GAAG,CAAC,aAAa,qBAAqB,CAAC,CAAC;IAC/I,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAE1F,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC9E,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,8FAA8F;QAC9F,UAAU,EAAE,aAAa,MAAM,CAAC,MAAM,EAAE;QACxC,SAAS;QACT,gBAAgB,EAAE,SAAS;QAC3B,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,WAAW;QACzB,WAAW,EAAE,GAAG,CAAC,EAAE;QACnB,gBAAgB,EAAE,GAAG,CAAC,IAAI;QAC1B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC"}

package/dist/src/services/scope-vocabulary-migration.d.ts

@@ -72,7 +72,7 @@ import type { Storage } from '../storage/interface.js';
  * NO conditional entry for it below — a conditional grant would be dead code here, because this list
  * hands the word to every agent with a recorded scope list and `*` covers it at the door.
  */
-export declare const GRANDFATHERED_SCOPES: readonly ["agent:write", "app:write", "app:manage", "capability:write", "ext:invoke", "organism:write", "organism:invite"];
+export declare const GRANDFATHERED_SCOPES: readonly ["agent:write", "app:write", "app:manage", "capability:write", "ext:invoke", "organism:write", "organism:invite", "packages:write"];
 /**
  * Words granted only to agents that ALREADY hold the word they are replacing.
  *
@@ -94,4 +94,37 @@ export declare const CONDITIONAL_SCOPES: ReadonlyArray<{
  * nothing to do. Returns the number of agents actually updated, for the boot log.
  */
 export declare function migrateAgentScopeVocabulary(storage: Storage): Promise<number>;
+/**
+ * The same grandfathering, for the OTHER principal family a new permission word can refuse.
+ *
+ * `requireScope` waves an owner session through and deliberately does NOT wave an app grant through
+ * — it is the only middleware that stops one, which is exactly why tightening a route to a new word
+ * is the shape that broke a live app in changelog 1.33.1 and is why H-20 was reverted. Everything
+ * above was written for agents and stopped there, so for five days the node had a mechanism that
+ * made a new word safe for one family and left the family the word actually bites uncovered.
+ *
+ * A grant carries what its owner approved on the consent screen at the time it was made, and an app
+ * gains nothing from being updated. So a word added to the vocabulary today would refuse every grant
+ * approved before it existed — for an act the app was already performing, through a door that asked
+ * nothing. Writing the word onto those grants preserves the reach they have; it does not hand an app
+ * a permission it never had, because the door it names was open to them a moment ago.
+ *
+ * The rule for a NEW grant is unchanged and is where the word does its work: the consent screen
+ * lists it, the owner sees it, and they can uncheck it.
+ *
+ * Conditional words are not applied here. Their `when` is a question about what an owner granted a
+ * particular agent, and an app grant's scope list is a different conversation with a different
+ * screen; the two should not be reasoned about with one table until someone decides they mean the
+ * same thing.
+ */
+export declare function migrateAppGrantScopeVocabulary(storage: Storage): Promise<number>;
+/**
+ * Both families, one call. The boot path takes this rather than either half, so a word added to
+ * GRANDFATHERED_SCOPES cannot reach one principal family and miss the other — which is the failure
+ * this pair exists to prevent, and which it had itself.
+ */
+export declare function migrateScopeVocabulary(storage: Storage): Promise<{
+    agents: number;
+    appGrants: number;
+}>;
 //# sourceMappingURL=scope-vocabulary-migration.d.ts.map

package/dist/src/services/scope-vocabulary-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-vocabulary-migration.d.ts","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,4HAQvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAc1F,CAAC;AAEF;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DnF"}
+{"version":3,"file":"scope-vocabulary-migration.d.ts","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,8IAavB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAc1F,CAAC;AAEF;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DnF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBtF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAK7G"}

package/dist/src/services/scope-vocabulary-migration.js

@@ -29,6 +29,11 @@ export const GRANDFATHERED_SCOPES = [
     'ext:invoke',
     'organism:write',
     'organism:invite',
+    // Added 2026-08-15 with the door that now demands it (routes/instances/install.ts). Installing a
+    // package asked for nothing before, so every principal that could reach the route could install;
+    // the word describes what was already happening rather than granting anything new, which is the
+    // only condition under which a word belongs on this list.
+    'packages:write',
 ];
 /**
  * Words granted only to agents that ALREADY hold the word they are replacing.
@@ -119,4 +124,59 @@ export async function migrateAgentScopeVocabulary(storage) {
     }
     return changed;
 }
+/**
+ * The same grandfathering, for the OTHER principal family a new permission word can refuse.
+ *
+ * `requireScope` waves an owner session through and deliberately does NOT wave an app grant through
+ * — it is the only middleware that stops one, which is exactly why tightening a route to a new word
+ * is the shape that broke a live app in changelog 1.33.1 and is why H-20 was reverted. Everything
+ * above was written for agents and stopped there, so for five days the node had a mechanism that
+ * made a new word safe for one family and left the family the word actually bites uncovered.
+ *
+ * A grant carries what its owner approved on the consent screen at the time it was made, and an app
+ * gains nothing from being updated. So a word added to the vocabulary today would refuse every grant
+ * approved before it existed — for an act the app was already performing, through a door that asked
+ * nothing. Writing the word onto those grants preserves the reach they have; it does not hand an app
+ * a permission it never had, because the door it names was open to them a moment ago.
+ *
+ * The rule for a NEW grant is unchanged and is where the word does its work: the consent screen
+ * lists it, the owner sees it, and they can uncheck it.
+ *
+ * Conditional words are not applied here. Their `when` is a question about what an owner granted a
+ * particular agent, and an app grant's scope list is a different conversation with a different
+ * screen; the two should not be reasoned about with one table until someone decides they mean the
+ * same thing.
+ */
+export async function migrateAppGrantScopeVocabulary(storage) {
+    const grants = await storage.listAppGrants();
+    let changed = 0;
+    for (const grant of grants) {
+        const held = grant.scopes;
+        if (!Array.isArray(held) || held.includes('*'))
+            continue;
+        const missing = GRANDFATHERED_SCOPES.filter(s => !held.includes(s));
+        if (!missing.length)
+            continue;
+        await storage.updateAppGrant(grant.grantId, { scopes: [...held, ...missing] });
+        changed++;
+    }
+    if (changed) {
+        logger.info('Scope vocabulary migration: live app grants grandfathered onto the new words', {
+            grantsUpdated: changed,
+            scopes: GRANDFATHERED_SCOPES.join(', '),
+        });
+    }
+    return changed;
+}
+/**
+ * Both families, one call. The boot path takes this rather than either half, so a word added to
+ * GRANDFATHERED_SCOPES cannot reach one principal family and miss the other — which is the failure
+ * this pair exists to prevent, and which it had itself.
+ */
+export async function migrateScopeVocabulary(storage) {
+    return {
+        agents: await migrateAgentScopeVocabulary(storage),
+        appGrants: await migrateAppGrantScopeVocabulary(storage),
+    };
+}
 //# sourceMappingURL=scope-vocabulary-migration.js.map

package/dist/src/services/scope-vocabulary-migration.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-vocabulary-migration.js","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,aAAa;IACb,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;CACX,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgE;IAC3F;QACI,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,uFAAuF;KAC/F;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,mCAAmC,EAAE;IAC1F,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,qCAAqC,EAAE;IACzG,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,iCAAiC,EAAE;IAC3F,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,oDAAoD,EAAE;IAC9G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;QACjC,uFAAuF;QACvF,0FAA0F;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAEtD,6FAA6F;QAC7F,MAAM,OAAO,GAAa,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjC,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAE9B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACd,2FAA2F;QAC3F,2FAA2F;QAC3F,uFAAuF;QACvF,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,gFAAgF,EAAE;YAC1F,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}
+{"version":3,"file":"scope-vocabulary-migration.js","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,aAAa;IACb,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,0DAA0D;IAC1D,gBAAgB;CACV,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgE;IAC3F;QACI,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,uFAAuF;KAC/F;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,mCAAmC,EAAE;IAC1F,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,qCAAqC,EAAE;IACzG,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,iCAAiC,EAAE;IAC3F,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,oDAAoD,EAAE;IAC9G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;QACjC,uFAAuF;QACvF,0FAA0F;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAEtD,6FAA6F;QAC7F,MAAM,OAAO,GAAa,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjC,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAE9B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACd,2FAA2F;QAC3F,2FAA2F;QAC3F,uFAAuF;QACvF,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,gFAAgF,EAAE;YAC1F,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAgB;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC9B,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAgB;IACzD,OAAO;QACH,MAAM,EAAE,MAAM,2BAA2B,CAAC,OAAO,CAAC;QAClD,SAAS,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;KAC3D,CAAC;AACN,CAAC"}

package/dist/src/services/screenshot-capture.d.ts

@@ -6,8 +6,22 @@
  *   storage. No HTTP, no token, no operator action: it self-authenticates by virtue of running
  *   inside the node. Disables itself gracefully (one log line, no crash) if no browser is available.
  *   Opt-in via config.screenshotAutoCapture so nodes without a browser never try.
- * @structure startScreenshotAutoCapture() entry; launchBrowser() channel fallback; pass() one scan.
+ *
+ *   It also serves ONE app on demand (captureAppScreenshot), which is a different job wearing the
+ *   same machinery. The batch exists so a catalogue is not full of blank cards; the on-demand call
+ *   exists because an agent that has just published an app cannot otherwise see what it made. A
+ *   hosted agent has no browser and no shell, so without this it ships blind and says "done" on the
+ *   strength of a 200.
+ * @structure startScreenshotAutoCapture() entry; launchBrowser() channel fallback;
+ *   runScreenshotCapturePass() one batch scan; captureAppScreenshot() one app, with its own
+ *   per-owner throttle; renderAndStore() the shared render both paths use.
  * @version-history
+ *   v1.3.0 — 2026-08-16 — captureAppScreenshot(): one named app, on demand, answering with a reason
+ *     instead of a number. The render moved into renderAndStore() so the batch and the request run
+ *     the same code. The module-level `running` flag stays a BATCH guard only — it used to make any
+ *     second caller return 0 silently, which is the wrong answer to give someone who asked a
+ *     question. Rendering is expensive and unauthenticated rendering is a denial-of-service shape,
+ *     so the on-demand path carries a per-owner throttle of its own.
  *   v1.0.0 — 2026-06-20 — initial: interval backfill writing straight to storage; channel-fallback
  *     browser via lazy playwright-core; graceful self-disable when no browser is present.
  *   v1.1.0 — 2026-06-20 — render the app's STORED HTML directly (fulfill the main document) instead of
@@ -18,11 +32,36 @@
  */
 import type { AimeatConfig } from '../config.js';
 import type { Storage } from '../storage/interface.js';
+/** What one on-demand capture can answer. Every failure names itself, because the caller is an agent
+ *  deciding what to do next rather than a log nobody reads. */
+export type CaptureResult = {
+    ok: true;
+    sizeBytes: number;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
 /**
  * One scan: capture + store a thumbnail for every published app that still has none. Returns the
  * number captured. Exported so a manual trigger / test can run a single pass on demand.
  */
 export declare function runScreenshotCapturePass(config: AimeatConfig, storage: Storage): Promise<number>;
+/**
+ * Capture ONE app now, for a caller who asked.
+ *
+ * Separate from the batch on purpose. The batch may skip, retry next interval and answer with a
+ * count; someone who just published an app and wants to look at it needs either a picture or a
+ * reason. The batch's `running` flag is deliberately NOT consulted here: a scan in progress is no
+ * reason to refuse a person, and the two writing the same key is an upsert either way.
+ *
+ * Rendering is the most expensive thing this node does per request, so it is throttled per owner.
+ */
+export declare function captureAppScreenshot(config: AimeatConfig, storage: Storage, app: {
+    ownerName: string;
+    filename: string;
+}): Promise<CaptureResult>;
 /** Start the interval-driven auto-capture job (no-op unless config.screenshotAutoCapture is on). */
 export declare function startScreenshotAutoCapture(config: AimeatConfig, storage: Storage): void;
 //# sourceMappingURL=screenshot-capture.d.ts.map

package/dist/src/services/screenshot-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screenshot-capture.d.ts","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA8CvD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAyFtG;AAED,oGAAoG;AACpG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}
+{"version":3,"file":"screenshot-capture.d.ts","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAmBvD;+DAC+D;AAC/D,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoHjE;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnF,OAAO,CAAC,aAAa,CAAC,CAqDxB;AAED,oGAAoG;AACpG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}

package/dist/src/services/screenshot-capture.js

@@ -6,6 +6,12 @@ const FIRST_PASS_DELAY_MS = 30_000; // let the server settle (and be reachable a
 let running = false;
 let disabled = false;
 let timer = null;
+/**
+ * Owner GHII -> the moments they asked for an on-demand capture, newest last. In-process on purpose:
+ * this is throttling, not accounting, and a node restart handing out a fresh allowance costs a few
+ * seconds of rendering rather than money.
+ */
+const onDemandHistory = new Map();
 /**
  * Launch a headless browser WITHOUT a Playwright browser download: prefer the machine's installed
  * Edge/Chrome via `channel`, then a Playwright-installed Chromium. Returns null (and the caller
@@ -43,6 +49,75 @@ async function launchBrowser() {
         + '`npx playwright install --with-deps chromium`. Last error: ' + (lastErr?.message ?? 'unknown'));
     return null;
 }
+/**
+ * Render one app and store its thumbnail. The bytes come from storage and are served to the page by
+ * intercepting the main document, rather than navigating to the public URL: that URL 301-redirects
+ * to the app origin under H-2, which 404s on a node with no separate app host and would capture an
+ * error page. Sub-resources still load against the node and the page URL stays the node URL, so
+ * relative paths and API calls resolve.
+ *
+ * Throws on failure; each caller words its own answer.
+ */
+async function renderAndStore(ctx, config, storage, app) {
+    const base = config.baseUrl.replace(/\/+$/, '');
+    const page = await ctx.newPage();
+    try {
+        const full = await storage.getAppByOwnerName(app.ownerName, app.filename);
+        // storage returns `data` as a Uint8Array; a plain Uint8Array's .toString('utf8') comma-joins the
+        // byte values instead of decoding — wrap in Buffer.
+        const html = full?.data ? Buffer.from(full.data).toString('utf8') : null;
+        const url = `${base}/v1/apps/${encodeURIComponent(app.ownerName)}/${encodeURIComponent(app.filename)}?mode=inline`;
+        if (html) {
+            let fulfilled = false;
+            await page.route('**/*', (route) => {
+                if (!fulfilled && route.request().resourceType() === 'document') {
+                    fulfilled = true;
+                    route.fulfill({ status: 200, contentType: 'text/html', body: html });
+                }
+                else {
+                    route.continue();
+                }
+            });
+        }
+        // 'load' rather than networkidle: polling and SSE apps never go idle. The settle wait after it is
+        // what stops an app that fetches its data post-load from being captured blank.
+        await page.goto(url, { waitUntil: 'load', timeout: PAGE_TIMEOUT });
+        await page.waitForTimeout(Math.max(0, config.screenshotSettleMs));
+        const jpeg = await page.screenshot({ type: 'jpeg', quality: 80 });
+        await storage.createStorageFile({
+            key: `apps/screenshots/${app.filename}`,
+            ownerGaii: app.ownerGaii, // match the app row's bucket so the GET route finds it
+            visibility: 'public',
+            mimeType: 'image/jpeg',
+            size: jpeg.length,
+            data: jpeg,
+            createdAt: new Date().toISOString(),
+        });
+        return jpeg.length;
+    }
+    finally {
+        await page.close();
+    }
+}
+/** Launch, hand over a context, and always close. */
+async function withBrowser(fn) {
+    const browser = await launchBrowser();
+    if (!browser) {
+        disabled = true;
+        if (timer) {
+            clearInterval(timer);
+            timer = null;
+        }
+        return null;
+    }
+    try {
+        const ctx = await browser.newContext({ viewport: VIEWPORT, deviceScaleFactor: 1 });
+        return await fn(ctx);
+    }
+    finally {
+        await browser.close();
+    }
+}
 /**
  * One scan: capture + store a thumbnail for every published app that still has none. Returns the
  * number captured. Exported so a manual trigger / test can run a single pass on demand.
@@ -62,74 +137,20 @@ export async function runScreenshotCapturePass(config, storage) {
         }
         if (missing.length === 0)
             return 0;
-        const browser = await launchBrowser();
-        if (!browser) {
-            disabled = true;
-            if (timer) {
-                clearInterval(timer);
-                timer = null;
-            }
-            return 0;
-        }
-        try {
-            const ctx = await browser.newContext({ viewport: VIEWPORT, deviceScaleFactor: 1 });
-            const base = config.baseUrl.replace(/\/+$/, '');
+        await withBrowser(async (ctx) => {
             for (const app of missing) {
-                const page = await ctx.newPage();
                 try {
-                    // Render the app's STORED HTML directly (fulfill the main document) rather than navigating
-                    // to the public inline URL: that URL 301-redirects to the app origin under H-2, which 404s
-                    // on a node with no separate app host (e.g. local dev) and would capture an error page.
-                    // Sub-resources (libs, images, API) still load against the node and the page URL stays the
-                    // node URL so relative paths resolve. Opened anonymously; 'load' (not networkidle) since
-                    // polling/SSE apps never go idle.
-                    const full = await storage.getAppByOwnerName(app.ownerName, app.filename);
-                    // storage returns `data` as a Uint8Array (Prisma 6 Bytes); a plain Uint8Array's
-                    // .toString('utf8') comma-joins the byte values instead of decoding — wrap in Buffer.
-                    const html = full?.data ? Buffer.from(full.data).toString('utf8') : null;
-                    const url = `${base}/v1/apps/${encodeURIComponent(app.ownerName)}/${encodeURIComponent(app.filename)}?mode=inline`;
-                    if (html) {
-                        let fulfilled = false;
-                        await page.route('**/*', (route) => {
-                            if (!fulfilled && route.request().resourceType() === 'document') {
-                                fulfilled = true;
-                                route.fulfill({ status: 200, contentType: 'text/html', body: html });
-                            }
-                            else {
-                                route.continue();
-                            }
-                        });
-                    }
-                    await page.goto(url, { waitUntil: 'load', timeout: PAGE_TIMEOUT });
-                    // Settle wait: many apps fetch data / render after 'load', so capturing immediately yields a
-                    // blank page. Default 6s; tune with AIMEAT_SCREENSHOT_SETTLE_MS.
-                    await page.waitForTimeout(Math.max(0, config.screenshotSettleMs));
-                    const jpeg = await page.screenshot({ type: 'jpeg', quality: 80 });
-                    await storage.createStorageFile({
-                        key: `apps/screenshots/${app.filename}`,
-                        ownerGaii: app.ownerGaii, // match the app row's bucket so the GET route finds it
-                        visibility: 'public',
-                        mimeType: 'image/jpeg',
-                        size: jpeg.length,
-                        data: jpeg,
-                        createdAt: new Date().toISOString(),
-                    });
+                    await renderAndStore(ctx, config, storage, app);
                     captured++;
                 }
                 catch (e) {
                     logger.warn(`Screenshot auto-capture failed for ${app.ownerName}/${app.filename}: ${e.message}`);
                 }
-                finally {
-                    await page.close();
-                }
-            }
-            if (captured > 0) {
-                logger.info(`Screenshot auto-capture: ${captured}/${missing.length} app thumbnail(s) generated.`);
-                emitChange('apps');
             }
-        }
-        finally {
-            await browser.close();
+        });
+        if (captured > 0) {
+            logger.info(`Screenshot auto-capture: ${captured}/${missing.length} app thumbnail(s) generated.`);
+            emitChange('apps');
         }
     }
     catch (e) {
@@ -140,6 +161,67 @@ export async function runScreenshotCapturePass(config, storage) {
     }
     return captured;
 }
+/**
+ * Capture ONE app now, for a caller who asked.
+ *
+ * Separate from the batch on purpose. The batch may skip, retry next interval and answer with a
+ * count; someone who just published an app and wants to look at it needs either a picture or a
+ * reason. The batch's `running` flag is deliberately NOT consulted here: a scan in progress is no
+ * reason to refuse a person, and the two writing the same key is an upsert either way.
+ *
+ * Rendering is the most expensive thing this node does per request, so it is throttled per owner.
+ */
+export async function captureAppScreenshot(config, storage, app) {
+    if (disabled) {
+        return {
+            ok: false, status: 503, code: 'NO_BROWSER',
+            message: 'This node has no usable browser, so it cannot render app screenshots. An operator can '
+                + 'install one with `npx playwright install --with-deps chromium`.',
+        };
+    }
+    // The lookup lives here rather than at each door: it decides both "is there anything to render"
+    // and WHICH storage bucket the thumbnail belongs in, and a door that answered the first half for
+    // itself would be the second implementation of the same decision.
+    const live = await storage.getAppByOwnerName(app.ownerName, app.filename);
+    if (!live) {
+        return {
+            ok: false, status: 404, code: 'NOT_FOUND',
+            message: `No published app "${app.filename}" to render. Publish it first; a draft has no public `
+                + 'page to photograph.',
+        };
+    }
+    const ownerGaii = live.ownerGaii;
+    const perHour = Math.max(1, config.screenshotOnDemandPerHour);
+    const now = Date.now();
+    const recent = (onDemandHistory.get(ownerGaii) ?? []).filter((t) => now - t < 3_600_000);
+    if (recent.length >= perHour) {
+        const waitMin = Math.ceil((3_600_000 - (now - recent[0])) / 60_000);
+        return {
+            ok: false, status: 429, code: 'RATE_LIMITED',
+            message: `Screenshot limit reached (${perHour} per hour). Try again in about ${waitMin} minute(s).`,
+        };
+    }
+    recent.push(now);
+    onDemandHistory.set(ownerGaii, recent);
+    try {
+        const bytes = await withBrowser((ctx) => renderAndStore(ctx, config, storage, { ownerName: app.ownerName, ownerGaii, filename: app.filename }));
+        if (bytes === null) {
+            return {
+                ok: false, status: 503, code: 'NO_BROWSER',
+                message: 'This node has no usable browser, so it cannot render app screenshots.',
+            };
+        }
+        emitChange('apps');
+        logger.info(`Screenshot captured on demand: ${app.ownerName}/${app.filename} (${bytes} bytes)`);
+        return { ok: true, sizeBytes: bytes };
+    }
+    catch (e) {
+        return {
+            ok: false, status: 502, code: 'RENDER_FAILED',
+            message: `The page did not render: ${e.message}`,
+        };
+    }
+}
 /** Start the interval-driven auto-capture job (no-op unless config.screenshotAutoCapture is on). */
 export function startScreenshotAutoCapture(config, storage) {
     if (!config.screenshotAutoCapture)

package/dist/src/services/screenshot-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"screenshot-capture.js","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,4DAA4D;AAEhG,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,IAAI,KAAK,GAA0B,IAAI,CAAC;AAExC;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,QAA+G,CAAC;IACpH,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAA6C,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAA+C;QAC3D,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE;QAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;QAC7C,EAAE,KAAK,EAAE,qBAAqB,EAAE;KACjC,CAAC;IACF,IAAI,OAAgB,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC,CAAC,0BAA0B;QAAC,CAAC;IACzD,CAAC;IACD,+FAA+F;IAC/F,uGAAuG;IACvG,MAAM,CAAC,IAAI,CAAC,0EAA0E;UAClF,6DAA6D,GAAG,CAAE,OAAiB,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAoB,EAAE,OAAgB;IACnF,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAsE,EAAE,CAAC;QACtF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,KAAK,EAAE,CAAC;gBAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAAC,KAAK,GAAG,IAAI,CAAC;YAAC,CAAC;YAClD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAQhF,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,2FAA2F;oBAC3F,2FAA2F;oBAC3F,wFAAwF;oBACxF,2FAA2F;oBAC3F,yFAAyF;oBACzF,kCAAkC;oBAClC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC1E,gFAAgF;oBAChF,sFAAsF;oBACtF,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;oBACzE,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACnH,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,SAAS,GAAG,KAAK,CAAC;wBACtB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;4BACjC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,UAAU,EAAE,CAAC;gCAChE,SAAS,GAAG,IAAI,CAAC;gCACjB,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BACvE,CAAC;iCAAM,CAAC;gCACN,KAAK,CAAC,QAAQ,EAAE,CAAC;4BACnB,CAAC;wBACH,CAAC,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;oBACnE,6FAA6F;oBAC7F,iEAAiE;oBACjE,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;oBAClE,MAAM,OAAO,CAAC,iBAAiB,CAAC;wBAC9B,GAAG,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE;wBACvC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAI,uDAAuD;wBACnF,UAAU,EAAE,QAAQ;wBACpB,QAAQ,EAAE,YAAY;wBACtB,IAAI,EAAE,IAAI,CAAC,MAAM;wBACjB,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACpC,CAAC,CAAC;oBACH,QAAQ,EAAE,CAAC;gBACb,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9G,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,4BAA4B,QAAQ,IAAI,OAAO,CAAC,MAAM,8BAA8B,CAAC,CAAC;gBAClG,UAAU,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,uCAAwC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,0BAA0B,CAAC,MAAoB,EAAE,OAAgB;IAC/E,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3F,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8CAA8C;IAC9E,MAAM,CAAC,IAAI,CAAC,oDAAoD,OAAO,+CAA+C,CAAC,CAAC;AAC1H,CAAC"}
+{"version":3,"file":"screenshot-capture.js","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,4DAA4D;AAEhG,IAAI,OAAO,GAAG,KAAK,CAAC;AACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,IAAI,KAAK,GAA0B,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAoB,CAAC;AAQpD;;;;;GAKG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,QAA+G,CAAC;IACpH,IAAI,CAAC;QACH,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAA6C,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAA+C;QAC3D,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE;QAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;QAC7C,EAAE,KAAK,EAAE,qBAAqB,EAAE;KACjC,CAAC;IACF,IAAI,OAAgB,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC,CAAC,0BAA0B;QAAC,CAAC;IACzD,CAAC;IACD,+FAA+F;IAC/F,uGAAuG;IACvG,MAAM,CAAC,IAAI,CAAC,0EAA0E;UAClF,6DAA6D,GAAG,CAAE,OAAiB,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAc,EAAE,MAAoB,EAAE,OAAgB,EAAE,GAAc;IAEtE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1E,iGAAiG;QACjG,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,YAAY,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QACnH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,UAAU,EAAE,CAAC;oBAChE,SAAS,GAAG,IAAI,CAAC;oBACjB,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,kGAAkG;QAClG,+EAA+E;QAC/E,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,CAAC,iBAAiB,CAAC;YAC9B,GAAG,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE;YACvC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAI,uDAAuD;YACnF,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,YAAY;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,WAAW,CAAI,EAAkC;IAC9D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,KAAK,EAAE,CAAC;YAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAc,CAAC;QAChG,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAoB,EAAE,OAAgB;IACnF,IAAI,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEnC,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;oBAChD,QAAQ,EAAE,CAAC;gBACb,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9G,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,4BAA4B,QAAQ,IAAI,OAAO,CAAC,MAAM,8BAA8B,CAAC,CAAC;YAClG,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,uCAAwC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EAAE,OAAgB,EAAE,GAA4C;IAEpF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY;YAC1C,OAAO,EAAE,wFAAwF;kBAC7F,iEAAiE;SACtE,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,iGAAiG;IACjG,kEAAkE;IAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW;YACzC,OAAO,EAAE,qBAAqB,GAAG,CAAC,QAAQ,uDAAuD;kBAC7F,qBAAqB;SAC1B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc;YAC5C,OAAO,EAAE,6BAA6B,OAAO,kCAAkC,OAAO,aAAa;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAC1E,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY;gBAC1C,OAAO,EAAE,uEAAuE;aACjF,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,SAAS,CAAC,CAAC;QAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe;YAC7C,OAAO,EAAE,4BAA6B,CAAW,CAAC,OAAO,EAAE;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,0BAA0B,CAAC,MAAoB,EAAE,OAAgB;IAC/E,IAAI,CAAC,MAAM,CAAC,qBAAqB;QAAE,OAAO;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC3F,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACpG,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,8CAA8C;IAC9E,MAAM,CAAC,IAAI,CAAC,oDAAoD,OAAO,+CAA+C,CAAC,CAAC;AAC1H,CAAC"}