canopycms 0.0.55 → 0.0.56

package/dist/api/github-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-sync.d.ts","sourceRoot":"","sources":["../../src/api/github-sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAMzD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAgF3B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B/F"}
+{"version":3,"file":"github-sync.d.ts","sourceRoot":"","sources":["../../src/api/github-sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAOzD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAsG3B;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B/F"}

package/dist/api/github-sync.js

@@ -1,6 +1,7 @@
 import { enqueueTask } from '../worker/task-queue.js';
 import { getTaskQueueDir } from '../worker/task-queue-config.js';
 import { clientOperatingStrategy } from '../operating-mode/index.js';
+import { getErrorMessage } from '../utils/error.js';
 /**
  * Submit a branch: create or update a PR.
  * Uses githubService directly if available, otherwise queues a task for the worker.
@@ -21,9 +22,22 @@ export async function syncSubmitPr(ctx, context) {
                     title: prTitle,
                     body: prBody,
                 });
-                const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
-                if (pr.draft) {
-                    await githubService.convertToReady(context.branch.pullRequestNumber);
+                // Best-effort draft->ready conversion. This branch updates a known
+                // PR number directly (not through createOrUpdatePR), so it doesn't
+                // get the shared helper's built-in markReadyIfDraft handling and
+                // does its own here. Wrapped separately so a conversion failure
+                // (e.g. a fine-grained token that can update PRs but lacks this
+                // mutation's scope) can't sink the update that already succeeded —
+                // consistent with createOrUpdatePullRequest's best-effort handling
+                // in github-service.ts.
+                try {
+                    const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
+                    if (pr.draft) {
+                        await githubService.convertToReady(context.branch.pullRequestNumber);
+                    }
+                }
+                catch (err) {
+                    console.warn(`CanopyCMS: Failed to convert PR #${context.branch.pullRequestNumber} to ready for review for ${context.branch.name} (the PR update itself succeeded; continuing):`, getErrorMessage(err));
                 }
                 return {
                     prUrl: context.branch.pullRequestUrl,
@@ -39,16 +53,18 @@ export async function syncSubmitPr(ctx, context) {
                 // updates it instead of calling the non-idempotent create (which
                 // 422s on a duplicate and would leave the branch wedged in
                 // 'sync-failed' forever with no way to recover).
+                //
+                // markReadyIfDraft: true delegates draft->ready conversion to the
+                // shared createOrUpdatePullRequest helper (github-service.ts), which
+                // treats conversion as best-effort so a permissions-limited token
+                // can't fail this submit.
                 const result = await githubService.createOrUpdatePR({
                     head: context.branch.name,
                     base: context.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main',
                     title: prTitle,
                     body: prBody,
+                    markReadyIfDraft: true,
                 });
-                const pr = await githubService.getPullRequest(result.number);
-                if (pr.draft) {
-                    await githubService.convertToReady(result.number);
-                }
                 return {
                     prUrl: result.url,
                     prNumber: result.number,
@@ -82,6 +98,11 @@ export async function syncSubmitPr(ctx, context) {
             // Target the fork point recorded at branch creation when available
             baseBranch: context.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main',
             pullRequestNumber: context.branch.pullRequestNumber,
+            // Content submits are an explicit "ready for review" action — convert
+            // a pre-existing draft PR to ready, unlike the settings-branch sync
+            // path (services.ts commitToSettingsBranch), which enqueues the same
+            // action without this flag.
+            markReadyIfDraft: true,
         },
     });
 }

package/dist/api/github-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"github-sync.js","sourceRoot":"","sources":["../../src/api/github-sync.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAY3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,OAAsB;IAEtB,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAA;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAA;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,UAAU,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAA;IAE/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAA;IACX,CAAC;IAED,sDAAsD;IACtD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACrC,MAAM,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBACtE,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,MAAM;iBACb,CAAC,CAAA;gBACF,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;gBAC/E,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;oBACb,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;gBACtE,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;oBACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;oBAC1C,UAAU,EAAE,QAAQ;iBACrB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,2DAA2D;gBAC3D,iDAAiD;gBACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC;oBAClD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;oBACzB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM;oBAClF,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,MAAM;iBACb,CAAC,CAAA;gBACF,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC5D,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;oBACb,MAAM,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBACnD,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ;iBACrB,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;YACpE,OAAO,CAAC,KAAK,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;YAC3F,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;gBACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;gBAC1C,UAAU,EAAE,aAAa;aAC1B,CAAA;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE;QACrC,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAC3B,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;YACZ,mEAAmE;YACnE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM;YACxF,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;SACpD;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,OAAsB;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB;QAAE,OAAM;IAE7C,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAA;IAEtC,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;YACpE,OAAO,CAAC,KAAK,CAAC,gDAAgD,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QAChG,CAAC;QACD,OAAM;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAA;IACrC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACzD,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE;YACpC,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;gBAC3B,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;aACpD;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,OAAsB,EACtB,IAA8D;IAE9D,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAChC,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YAC1C,UAAU,EAAE,cAAc;SAC3B,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;QACpE,OAAO,CAAC,KAAK,CAAC,yCAAyC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QACvF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"github-sync.js","sourceRoot":"","sources":["../../src/api/github-sync.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAYhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,OAAsB;IAEtB,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAA;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAA;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,UAAU,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IACvE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAA;IAE/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAA;IACX,CAAC;IAED,sDAAsD;IACtD,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACrC,MAAM,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE;oBACtE,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,MAAM;iBACb,CAAC,CAAA;gBACF,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,mEAAmE;gBACnE,mEAAmE;gBACnE,wBAAwB;gBACxB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;oBAC/E,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;wBACb,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;oBACtE,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CACV,oCAAoC,OAAO,CAAC,MAAM,CAAC,iBAAiB,4BAA4B,OAAO,CAAC,MAAM,CAAC,IAAI,gDAAgD,EACnK,eAAe,CAAC,GAAG,CAAC,CACrB,CAAA;gBACH,CAAC;gBACD,OAAO;oBACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;oBACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;oBAC1C,UAAU,EAAE,QAAQ;iBACrB,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,mEAAmE;gBACnE,iEAAiE;gBACjE,2DAA2D;gBAC3D,iDAAiD;gBACjD,EAAE;gBACF,kEAAkE;gBAClE,qEAAqE;gBACrE,kEAAkE;gBAClE,0BAA0B;gBAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC;oBAClD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;oBACzB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM;oBAClF,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,MAAM;oBACZ,gBAAgB,EAAE,IAAI;iBACvB,CAAC,CAAA;gBACF,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,GAAG;oBACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ;iBACrB,CAAA;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;YACpE,OAAO,CAAC,KAAK,CAAC,6CAA6C,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;YAC3F,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;gBACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;gBAC1C,UAAU,EAAE,aAAa;aAC1B,CAAA;QACH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,2EAA2E;IAC3E,kDAAkD;IAClD,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE;QACrC,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YAC3B,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,MAAM;YACZ,mEAAmE;YACnE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM;YACxF,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,sEAAsE;YACtE,oEAAoE;YACpE,qEAAqE;YACrE,4BAA4B;YAC5B,gBAAgB,EAAE,IAAI;SACvB;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAe,EAAE,OAAsB;IAC9E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB;QAAE,OAAM;IAE7C,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAA;IAEtC,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;YACpE,OAAO,CAAC,KAAK,CAAC,gDAAgD,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QAChG,CAAC;QACD,OAAM;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAA;IACrC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACzD,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE;YACpC,MAAM,EAAE,kBAAkB;YAC1B,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;gBAC3B,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;aACpD;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,OAAsB,EACtB,IAA8D;IAE9D,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAEpD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAChC,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;YACpC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YAC1C,UAAU,EAAE,cAAc;SAC3B,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAA;QACpE,OAAO,CAAC,KAAK,CAAC,yCAAyC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,OAAO,CAAC,CAAA;QACvF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAA;IACtC,CAAC;AACH,CAAC"}

package/dist/auth/caching-auth-plugin.d.ts

@@ -31,13 +31,20 @@ export type TokenVerifier = (context: unknown) => Promise<{
  *
  * In dev mode, an optional `lazyRefresher` can be provided to auto-populate
  * the cache on first request, eliminating the need to run `worker run-once` manually.
+ *
+ * This wrapper only forwards the inner plugin's `verifiesCredentials` affirmation via the
+ * `options` constructor param — it cannot launder an insecure plugin, because
+ * createNextCanopyContext asserts the INNER plugin (before wrapping) in context-wrapper.ts.
  */
 export declare class CachingAuthPlugin implements AuthPlugin {
     private readonly verifyToken;
     private readonly cache;
     private readonly lazyRefresher?;
     private refreshPromise;
-    constructor(verifyToken: TokenVerifier, cache: AuthCacheProvider, lazyRefresher?: (() => Promise<unknown>) | undefined);
+    readonly verifiesCredentials: boolean;
+    constructor(verifyToken: TokenVerifier, cache: AuthCacheProvider, lazyRefresher?: (() => Promise<unknown>) | undefined, options?: {
+        verifiesCredentials?: boolean;
+    });
     private ensureCachePopulated;
     authenticate(context: unknown): Promise<AuthenticationResult>;
     searchUsers(query: string, limit?: number): Promise<UserSearchResult[]>;

package/dist/auth/caching-auth-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caching-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAK3D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAC/D,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACxC,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;CACtE;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAAC,CAAA;AAE1F;;;;;;;;;;GAUG;AACH,qBAAa,iBAAkB,YAAW,UAAU;IAIhD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IALjC,OAAO,CAAC,cAAc,CAA6B;gBAGhC,WAAW,EAAE,aAAa,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,CAAC,GAAE,MAAM,OAAO,CAAC,OAAO,CAAC,aAAA;YAG3C,oBAAoB;IAY5B,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsC7D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAenE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQvE,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQvE,UAAU,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAQvD"}
+{"version":3,"file":"caching-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAK3D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAC/D,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACxC,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;CACtE;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAAC,CAAA;AAE1F;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAkB,YAAW,UAAU;IAKhD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;IANjC,OAAO,CAAC,cAAc,CAA6B;IACnD,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;gBAGlB,WAAW,EAAE,aAAa,EAC1B,KAAK,EAAE,iBAAiB,EACxB,aAAa,CAAC,GAAE,MAAM,OAAO,CAAC,OAAO,CAAC,aAAA,EACvD,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE;YAK/B,oBAAoB;IAY5B,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAsC7D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAenE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQvE,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQvE,UAAU,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAQvD"}

package/dist/auth/caching-auth-plugin.js

@@ -10,13 +10,18 @@ const log = createDebugLogger({ prefix: 'CachingAuthPlugin' });
  *
  * In dev mode, an optional `lazyRefresher` can be provided to auto-populate
  * the cache on first request, eliminating the need to run `worker run-once` manually.
+ *
+ * This wrapper only forwards the inner plugin's `verifiesCredentials` affirmation via the
+ * `options` constructor param — it cannot launder an insecure plugin, because
+ * createNextCanopyContext asserts the INNER plugin (before wrapping) in context-wrapper.ts.
  */
 export class CachingAuthPlugin {
-    constructor(verifyToken, cache, lazyRefresher) {
+    constructor(verifyToken, cache, lazyRefresher, options) {
         this.verifyToken = verifyToken;
         this.cache = cache;
         this.lazyRefresher = lazyRefresher;
         this.refreshPromise = null;
+        this.verifiesCredentials = options?.verifiesCredentials === true;
     }
     async ensureCachePopulated() {
         if (!this.lazyRefresher)

package/dist/auth/caching-auth-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"caching-auth-plugin.js","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAsB9D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAG5B,YACmB,WAA0B,EAC1B,KAAwB,EACxB,aAAsC;QAFtC,gBAAW,GAAX,WAAW,CAAe;QAC1B,UAAK,GAAL,KAAK,CAAmB;QACxB,kBAAa,GAAb,aAAa,CAAyB;QALjD,mBAAc,GAAyB,IAAI,CAAA;IAMhD,CAAC;IAEI,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAM;QAC/B,4EAA4E;QAC5E,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,aAAa,EAAE;aACzC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;aAC7D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA,CAAC,2BAA2B;QACxD,CAAC,CAAC,CAAA;QACJ,MAAM,IAAI,CAAC,cAAc,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAA;QAEjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAE9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM;oBACnC,KAAK,EAAE,IAAI,EAAE,KAAK;oBAClB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,cAAc;iBACf;aACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,EAAE;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,QAAQ,CAAC,MAAM;oBACrB,cAAc,EAAE,EAAE;iBACnB;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;YACtC,OAAO,QAAQ;iBACZ,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1F;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAoB;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;YACjD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"caching-auth-plugin.js","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,iBAAiB;IAI5B,YACmB,WAA0B,EAC1B,KAAwB,EACxB,aAAsC,EACvD,OAA2C;QAH1B,gBAAW,GAAX,WAAW,CAAe;QAC1B,UAAK,GAAL,KAAK,CAAmB;QACxB,kBAAa,GAAb,aAAa,CAAyB;QANjD,mBAAc,GAAyB,IAAI,CAAA;QASjD,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAA;IAClE,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAM;QAC/B,4EAA4E;QAC5E,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,aAAa,EAAE;aACzC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;aAC7D,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAA,CAAC,2BAA2B;QACxD,CAAC,CAAC,CAAA;QACJ,MAAM,IAAI,CAAC,cAAc,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;QACnE,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAA;QAEjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAE9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM;oBACnC,KAAK,EAAE,IAAI,EAAE,KAAK;oBAClB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,cAAc;iBACf;aACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,EAAE;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,QAAQ,CAAC,MAAM;oBACrB,cAAc,EAAE,EAAE;iBACnB;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;YACtC,OAAO,QAAQ;iBACZ,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1F;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAoB;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;YACjD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/auth/plugin.d.ts

@@ -7,17 +7,24 @@ import type { OperatingMode } from '../operating-mode/types';
  */
 export interface AuthPlugin {
     /**
-     * Marker for plugins that perform NO real credential verification (e.g. the
-     * dev plugin, which trusts request headers/cookies as-is). Plugins that set
-     * this to true must never be used in production: they are rejected by
-     * assertAuthPluginAllowedForMode() whenever the operating mode is 'prod'.
-     * Never set this on a plugin that cryptographically verifies its tokens.
+     * Affirmative allowlist marker: set to true ONLY on plugins that
+     * cryptographically verify credentials (e.g. Clerk JWT verification).
+     * assertAuthPluginAllowedForMode() rejects any plugin without this marker
+     * whenever the operating mode is 'prod' — absence fails closed, so a
+     * third-party plugin that forgets the marker is rejected, not accepted.
      */
-    readonly insecureDevOnly?: boolean;
+    readonly verifiesCredentials?: boolean;
     /**
      * Authenticate user from request context.
      * Returns user identity (without final groups) - core will apply bootstrap admins.
      *
+     * Contract: CREDENTIAL failures (missing/invalid/expired token) resolve to
+     * `{ success: false }` — they map to 401s. CONFIGURATION errors (e.g. a
+     * required secret like CLERK_SECRET_KEY is absent) may THROW instead: they
+     * are operator mistakes, not user mistakes, and should surface as loud 500s
+     * rather than quiet auth denials. Callers invoking authenticate() directly
+     * (custom adapters) should be prepared for a rejection on misconfiguration.
+     *
      * @param context - Framework-specific context (CanopyRequest, headers, etc.)
      * @returns AuthenticationResult with user identity or error
      */
@@ -72,10 +79,12 @@ export interface AuthPlugin {
  */
 export type AuthPluginFactory<TConfig = unknown> = (config: TConfig) => AuthPlugin;
 /**
- * Fail closed: reject auth plugins that perform no real verification when the
- * CMS runs in production.
+ * Fail closed: only allow auth plugins that affirmatively declare real
+ * credential verification when the CMS runs in production.
  *
- * DevAuthPlugin (and any plugin marked `insecureDevOnly`) trusts request
+ * This is an allowlist, not a denylist: a plugin must set
+ * `verifiesCredentials: true` to pass this guard in prod. DevAuthPlugin (and
+ * any third-party plugin that forgets to set the marker) trusts request
  * headers/cookies without cryptographic verification, so accepting it with
  * mode 'prod' would let any caller impersonate any user — including admins —
  * by sending a header like `X-Test-User: admin`. Call this wherever an
@@ -85,7 +94,7 @@ export type AuthPluginFactory<TConfig = unknown> = (config: TConfig) => AuthPlug
  * Note: checking for the absence of verifyTokenOnly is NOT a substitute for
  * this marker — the dev plugin implements verifyTokenOnly too.
  *
- * @throws Error when mode is 'prod' and the plugin is marked insecureDevOnly
+ * @throws Error when mode is 'prod' and the plugin does not set `verifiesCredentials: true`
  */
 export declare function assertAuthPluginAllowedForMode(plugin: AuthPlugin, mode: OperatingMode | undefined): void;
 //# sourceMappingURL=plugin.d.ts.map

package/dist/auth/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAElC;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAE7D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEvE;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAEpD;;;;OAIG;IACH,oBAAoB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;IAEzF;;;;OAIG;IACH,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAE5E;;;;OAIG;IACH,oBAAoB,CAAC,CACnB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAA;CAC1E;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAA;AAElF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,IAAI,CAUN"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAE7D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEvE;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAEpD;;;;OAIG;IACH,oBAAoB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;IAEzF;;;;OAIG;IACH,eAAe,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAE5E;;;;OAIG;IACH,oBAAoB,CAAC,CACnB,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,GAAG,SAAS,CAAA;CAC1E;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAA;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,aAAa,GAAG,SAAS,GAC9B,IAAI,CAUN"}

package/dist/auth/plugin.js

@@ -1,8 +1,10 @@
 /**
- * Fail closed: reject auth plugins that perform no real verification when the
- * CMS runs in production.
+ * Fail closed: only allow auth plugins that affirmatively declare real
+ * credential verification when the CMS runs in production.
  *
- * DevAuthPlugin (and any plugin marked `insecureDevOnly`) trusts request
+ * This is an allowlist, not a denylist: a plugin must set
+ * `verifiesCredentials: true` to pass this guard in prod. DevAuthPlugin (and
+ * any third-party plugin that forgets to set the marker) trusts request
  * headers/cookies without cryptographic verification, so accepting it with
  * mode 'prod' would let any caller impersonate any user — including admins —
  * by sending a header like `X-Test-User: admin`. Call this wherever an
@@ -12,15 +14,15 @@
  * Note: checking for the absence of verifyTokenOnly is NOT a substitute for
  * this marker — the dev plugin implements verifyTokenOnly too.
  *
- * @throws Error when mode is 'prod' and the plugin is marked insecureDevOnly
+ * @throws Error when mode is 'prod' and the plugin does not set `verifiesCredentials: true`
  */
 export function assertAuthPluginAllowedForMode(plugin, mode) {
-    if (mode === 'prod' && plugin.insecureDevOnly === true) {
-        throw new Error("CanopyCMS: a dev/insecure auth plugin was configured with mode: 'prod'. " +
-            'This plugin performs no real credential verification, so anyone could impersonate ' +
-            'any user (including admins). Configure a verifying auth plugin for production ' +
-            "(e.g. createClerkAuthPlugin from 'canopycms-auth-clerk' with CLERK_SECRET_KEY set), " +
-            "or run with mode: 'dev' for local development.");
+    if (mode === 'prod' && plugin.verifiesCredentials !== true) {
+        throw new Error("CanopyCMS: an auth plugin was configured with mode: 'prod' but does not affirm " +
+            '`verifiesCredentials: true`. This plugin performs no real credential verification, ' +
+            'so anyone could impersonate any user (including admins). Configure a verifying auth ' +
+            "plugin for production (e.g. createClerkAuthPlugin from 'canopycms-auth-clerk' with " +
+            "CLERK_SECRET_KEY set), or run with mode: 'dev' for local development.");
     }
 }
 //# sourceMappingURL=plugin.js.map

package/dist/auth/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AA8EA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAkB,EAClB,IAA+B;IAE/B,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,oFAAoF;YACpF,gFAAgF;YAChF,sFAAsF;YACtF,gDAAgD,CACnD,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAqFA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAkB,EAClB,IAA+B;IAE/B,IAAI,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,qFAAqF;YACrF,sFAAsF;YACtF,qFAAqF;YACrF,uEAAuE,CAC1E,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/build/generate-ai-content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-ai-content.d.ts","sourceRoot":"","sources":["../../src/build/generate-ai-content.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAG1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,YAAY,CAAA;IACpB,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;CACnC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA2CnD"}
+{"version":3,"file":"generate-ai-content.d.ts","sourceRoot":"","sources":["../../src/build/generate-ai-content.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAG1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAIlD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,YAAY,CAAA;IACpB,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,2EAA2E;IAC3E,eAAe,CAAC,EAAE,cAAc,EAAE,CAAA;CACnC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAiDnD"}

package/dist/build/generate-ai-content.js

@@ -10,6 +10,8 @@ import { ContentStore } from '../content-store.js';
 import { BranchSchemaCache } from '../branch-schema-cache.js';
 import { generateAIContent } from '../ai/generate.js';
 import { resolveBranchRoot } from '../ai/resolve-branch.js';
+import { listEntries } from '../content-listing.js';
+import { assertBuildEntriesValid } from '../static/index.js';
 /**
  * Generate AI content files and write them to disk.
  *
@@ -30,6 +32,11 @@ export async function generateAIContentFiles(options) {
         const cached = await schemaCache.getSchema(branchRoot, entrySchemaRegistry, contentRootName);
         flatSchema = cached.flatSchema;
     }
+    // Fail the build on abandoned create-scaffolds (schema-invalid entries) rather than baking them
+    // into generated AI content. Unconditional (no isBuildMode gate): this is an explicit build
+    // command, not something `next dev` runs incidentally.
+    const entriesForValidation = await listEntries(branchRoot, flatSchema, contentRootName);
+    assertBuildEntriesValid(entriesForValidation, 'AI content generation');
     // Create store and generate
     const store = new ContentStore(branchRoot, flatSchema);
     const result = await generateAIContent({

package/dist/build/generate-ai-content.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-ai-content.js","sourceRoot":"","sources":["../../src/build/generate-ai-content.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAaxD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAsC;IAEtC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAA;IACrF,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,IAAI,SAAS,CAAA;IAEvD,sBAAsB;IACtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAElD,cAAc;IACd,IAAI,UAA4B,CAAA;IAChC,IAAI,eAAe,EAAE,CAAC;QACpB,UAAU,GAAG,eAAe,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAA;QAC5F,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,KAAK;QACL,UAAU;QACV,WAAW,EAAE,eAAe;QAC5B,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;IAEF,sBAAsB;IACtB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;IAC5D,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAA;QACzE,4EAA4E;QAC5E,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,SAAS,EAAE,CAAA;IACb,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;AACpD,CAAC"}
+{"version":3,"file":"generate-ai-content.js","sourceRoot":"","sources":["../../src/build/generate-ai-content.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAYnD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAsC;IAEtC,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAA;IACrF,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,IAAI,SAAS,CAAA;IAEvD,sBAAsB;IACtB,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAElD,cAAc;IACd,IAAI,UAA4B,CAAA;IAChC,IAAI,eAAe,EAAE,CAAC;QACpB,UAAU,GAAG,eAAe,CAAA;IAC9B,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAA;QAC5F,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,gGAAgG;IAChG,4FAA4F;IAC5F,uDAAuD;IACvD,MAAM,oBAAoB,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,CAAC,CAAA;IACvF,uBAAuB,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,CAAA;IAEtE,4BAA4B;IAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,KAAK;QACL,UAAU;QACV,WAAW,EAAE,eAAe;QAC5B,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;IAEF,sBAAsB;IACtB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAA;IAC5D,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAA;QACzE,4EAA4E;QAC5E,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,SAAS,EAAE,CAAA;IACb,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;AACpD,CAAC"}