canopycms 0.0.61 → 0.0.62

package/dist/http/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAenD;;;;;;;;GAQG;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAA;AAEhG;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;IACnD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B,OAAO,EAAE,aAAa,CAAA;IAEtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KACtE;QACE,EAAE,EAAE,IAAI,CAAA;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,GACD;QACE,EAAE,EAAE,KAAK,CAAA;QACT,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACL;;;;;OAKG;IACH,UAAU,CAAC,EAAE,WAAW,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE9B,QAAQ,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACtC,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAA;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,CAAA;IAElC,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAAA;CAC7D;AA0HD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GACjB,UAAU,GAAG,IAAI,CA0BnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CAOjD"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAenD;;;;;;;;GAQG;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAA;AAEhG;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;IACnD,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1B,OAAO,EAAE,aAAa,CAAA;IAEtB,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KACtE;QACE,EAAE,EAAE,IAAI,CAAA;QACR,MAAM,CAAC,EAAE,OAAO,CAAA;QAChB,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,GACD;QACE,EAAE,EAAE,KAAK,CAAA;QACT,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;IACL;;;;;OAKG;IACH,UAAU,CAAC,EAAE,WAAW,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAA;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAE9B,QAAQ,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACtC,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAA;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,EAAE,CAAA;IAElC,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,IAAI,CAAA;CAC7D;AA+ID;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAAE,GACjB,UAAU,GAAG,IAAI,CA6CnB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CAOjD"}

package/dist/http/router.js

@@ -47,6 +47,15 @@ function buildCanopyRoutes() {
 /**
  * Match a route pattern against actual path segments.
  * Supports :param for single-segment params and ...slug for catch-all.
+ *
+ * Params are returned RAW (undecoded) here on purpose (C5): matching is
+ * purely structural (segment counts, static-segment equality) and must never
+ * throw. Decoding happens exactly once, uniformly for :param and catch-all
+ * alike, in matchRoute() below - after the winning route has been picked, so
+ * a malformed `%` escape is handled in a single place instead of aborting
+ * mid-match (which previously let a URIError from a bad :param escape to
+ * `decodeURIComponent` bubble all the way to http/handler.ts's top-level
+ * catch and surface as a 500).
  */
 const matchPattern = (pattern, actual) => {
     const params = {};
@@ -63,8 +72,8 @@ const matchPattern = (pattern, actual) => {
         if (!next)
             return null;
         if (part.startsWith(':')) {
-            // Dynamic segment - extract param
-            params[part.slice(1)] = decodeURIComponent(next);
+            // Dynamic segment - extract param (still raw; see decode note above)
+            params[part.slice(1)] = next;
         }
         else if (part !== next) {
             // Static segment - must match exactly
@@ -76,6 +85,17 @@ const matchPattern = (pattern, actual) => {
         return null;
     return { params };
 };
+/**
+ * Synthetic handler for a request whose matched route params contain a
+ * malformed `%` escape sequence (C5) - e.g. a lone `%` or `%zz`. Reported as
+ * a 400 (the request is malformed), never registered in the real route
+ * table, and only ever reachable via matchRoute()'s decode step below.
+ */
+const malformedPathHandler = async () => ({
+    ok: false,
+    status: 400,
+    error: 'Malformed URL-encoded path segment',
+});
 /**
  * Specificity rank of a pattern segment. Higher wins.
  * A literal ("static") segment is more specific than a `:param`, which is
@@ -149,9 +169,26 @@ export function matchRoute(routes, method, segments) {
     }
     if (!best)
         return null;
+    // Decode every matched param exactly once, here - uniformly for :param and
+    // catch-all values alike (C5). A malformed escape must produce a 400, not
+    // an uncaught URIError that would otherwise reach http/handler.ts's
+    // top-level catch and get reported as a 500. Downstream consumers
+    // (Zod's logicalPathSchema/branchNameSchema etc. in each route's
+    // `validate`, and any handler-local re-check such as entries.ts's
+    // parseLogicalPath call) still run their own traversal validation against
+    // this same final decoded value - decoding centrally here does not skip
+    // that, it just removes the redundant second decode that used to run
+    // alongside it in a few handlers.
+    let decodedParams;
+    try {
+        decodedParams = Object.fromEntries(Object.entries(best.params).map(([key, value]) => [key, decodeURIComponent(value)]));
+    }
+    catch {
+        return { handler: malformedPathHandler, params: {} };
+    }
     return {
         handler: best.route.handler,
-        params: best.params,
+        params: decodedParams,
         validate: best.route.validate, // Include validation function if present
         bodyFormat: best.route.bodyFormat,
     };

package/dist/http/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAgE3C;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACjC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAChC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAChC,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAC1C,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;QAC3C,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,aAAa;QACb,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;KAC/B,CAAC,GAAG,CACH,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gFAAgF;QAChF,QAAQ,EAAE,UAAU,IAAI,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,QAAwC,CAAC,CAAC,CAAC,SAAS;QAC3F,UAAU,EACR,YAAY,IAAI,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,UAA4C,CAAC,CAAC,CAAC,SAAS;KAC1F,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,CACnB,OAA0B,EAC1B,MAAgB,EAC2B,EAAE;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,wCAAwC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,sBAAsB;YACtD,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;YACrB,MAAK;QACP,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAA;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,kCAAkC;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAClD,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,sCAAsC;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtC,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAE,KAAa,EAAU,EAAE;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,aAAa,CAAA;IACxD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,aAAa,CAAA;IACjD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;AACpE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAoB,EAAE,CAAoB,EAAU,EAAE;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAA;QACzC,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,KAAK,KAAK,aAAa;YAAE,MAAK;IACpC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,MAAkC,EAClC,MAAc,EACd,QAAkB;IAElB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAExC,IAAI,IAAI,GAAsE,IAAI,CAAA;IAElF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,SAAQ;QAE1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;QACxC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,yCAAyC;QACxE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;KAClC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAElC,OAAO;QACL,MAAM;QACN,KAAK,EAAE,CAAC,MAAc,EAAE,QAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpF,CAAA;AACH,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAgE3C;;;;;;;GAOG;AACH,SAAS,iBAAiB;IACxB,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;QACjC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAChC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAChC,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAC1C,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC;QAC3C,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,aAAa;QACb,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9B,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7B,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;KAC/B,CAAC,GAAG,CACH,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,gFAAgF;QAChF,QAAQ,EAAE,UAAU,IAAI,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,QAAwC,CAAC,CAAC,CAAC,SAAS;QAC3F,UAAU,EACR,YAAY,IAAI,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,UAA4C,CAAC,CAAC,CAAC,SAAS;KAC1F,CAAC,CACH,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,CACnB,OAA0B,EAC1B,MAAgB,EAC2B,EAAE;IAC7C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,wCAAwC;QACxC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,sBAAsB;YACtD,MAAM,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;YACrB,MAAK;QACP,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAA;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,qEAAqE;YACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;QAC9B,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACzB,sCAAsC;YACtC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEtC,OAAO,EAAE,MAAM,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,oBAAoB,GAAkB,KAAK,IAAI,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,GAAG;IACX,KAAK,EAAE,oCAAoC;CAC5C,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,aAAa,GAAG,CAAC,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,OAA0B,EAAE,KAAa,EAAU,EAAE;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,aAAa,CAAA;IACxD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,aAAa,CAAA;IACjD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;AACpE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAoB,EAAE,CAAoB,EAAU,EAAE;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAA;QACzC,wEAAwE;QACxE,oBAAoB;QACpB,IAAI,KAAK,KAAK,aAAa;YAAE,MAAK;IACpC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,MAAkC,EAClC,MAAc,EACd,QAAkB;IAElB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAA;IAExC,IAAI,IAAI,GAAsE,IAAI,CAAA;IAElF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;YAAE,SAAQ;QAE1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK;YAAE,SAAQ;QAEpB,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;QACxC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,kEAAkE;IAClE,0EAA0E;IAC1E,wEAAwE;IACxE,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,aAAqC,CAAA;IACzC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CACpF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC3B,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,yCAAyC;QACxE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;KAClC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAElC,OAAO;QACL,MAAM;QACN,KAAK,EAAE,CAAC,MAAc,EAAE,QAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpF,CAAA;AACH,CAAC"}

package/dist/operating-mode/deployment-name-fixtures.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared deployment-name test fixture.
+ *
+ * The rule that decides whether a `deploymentName` is usable exists TWICE, by
+ * necessity: once at runtime (`deployment-name.ts`'s `isValidDeploymentName`)
+ * and once at synth time (`canopycms-cdk`'s `constructs/cms-service.ts`).
+ * `canopycms-cdk` publishes without a runtime dependency on `canopycms`, so
+ * the construct cannot import the real thing.
+ *
+ * The dangerous drift is asymmetric: a rule TIGHTENED at runtime but not at
+ * synth produces a stack that synths clean and then crash-loops the Lambda at
+ * boot — precisely what the synth guard exists to prevent. So both packages'
+ * suites assert against this one list, and `canopycms-cdk`'s suite additionally
+ * asserts that the construct's verdict matches this package's predicate for
+ * every name here. Add a case here when you change either copy of the rule.
+ *
+ * Deliberately dependency-free (plain arrays, no vitest import) so the CDK
+ * suite can import it across the package boundary without dragging anything
+ * along.
+ */
+/** Names both copies of the rule must ACCEPT. */
+export declare const VALID_DEPLOYMENT_NAMES: readonly ["prod", "staging", "acme-prod_2.1", "a", "9lives", "team.prod", "PROD", "x.locked"];
+/**
+ * Names both copies of the rule must REJECT, each with the reason it exists —
+ * every entry is a value git itself would refuse as a ref component, or one
+ * that would corrupt the worker's `.env` heredoc.
+ */
+export declare const INVALID_DEPLOYMENT_NAMES: readonly [readonly ["a slash (would add a ref hierarchy level)", "team/prod"], readonly ["whitespace", "my prod"], readonly ["a leading dash (parses as a git option)", "-prod"], readonly ["a git-forbidden character", "prod:1"], readonly ["dot-dot", "a..b"], readonly ["a leading dot", ".prod"], readonly ["a trailing dot", "prod."], readonly ["a .lock suffix", "prod.lock"], readonly ["a tilde", "prod~1"], readonly ["a caret", "prod^1"], readonly ["a question mark", "prod?"], readonly ["an asterisk", "prod*"], readonly ["an open bracket", "prod["], readonly ["a backslash", "prod\\1"], readonly ["the empty string", ""], readonly ["a newline (would inject a line into the worker .env)", "prod\nEVIL=1"]];
+//# sourceMappingURL=deployment-name-fixtures.d.ts.map

package/dist/operating-mode/deployment-name-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-name-fixtures.d.ts","sourceRoot":"","sources":["../../src/operating-mode/deployment-name-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,+FASzB,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,osBAiB3B,CAAA"}

package/dist/operating-mode/deployment-name-fixtures.js

@@ -0,0 +1,55 @@
+/**
+ * Shared deployment-name test fixture.
+ *
+ * The rule that decides whether a `deploymentName` is usable exists TWICE, by
+ * necessity: once at runtime (`deployment-name.ts`'s `isValidDeploymentName`)
+ * and once at synth time (`canopycms-cdk`'s `constructs/cms-service.ts`).
+ * `canopycms-cdk` publishes without a runtime dependency on `canopycms`, so
+ * the construct cannot import the real thing.
+ *
+ * The dangerous drift is asymmetric: a rule TIGHTENED at runtime but not at
+ * synth produces a stack that synths clean and then crash-loops the Lambda at
+ * boot — precisely what the synth guard exists to prevent. So both packages'
+ * suites assert against this one list, and `canopycms-cdk`'s suite additionally
+ * asserts that the construct's verdict matches this package's predicate for
+ * every name here. Add a case here when you change either copy of the rule.
+ *
+ * Deliberately dependency-free (plain arrays, no vitest import) so the CDK
+ * suite can import it across the package boundary without dragging anything
+ * along.
+ */
+/** Names both copies of the rule must ACCEPT. */
+export const VALID_DEPLOYMENT_NAMES = [
+    'prod',
+    'staging',
+    'acme-prod_2.1',
+    'a',
+    '9lives',
+    'team.prod',
+    'PROD',
+    'x.locked',
+];
+/**
+ * Names both copies of the rule must REJECT, each with the reason it exists —
+ * every entry is a value git itself would refuse as a ref component, or one
+ * that would corrupt the worker's `.env` heredoc.
+ */
+export const INVALID_DEPLOYMENT_NAMES = [
+    ['a slash (would add a ref hierarchy level)', 'team/prod'],
+    ['whitespace', 'my prod'],
+    ['a leading dash (parses as a git option)', '-prod'],
+    ['a git-forbidden character', 'prod:1'],
+    ['dot-dot', 'a..b'],
+    ['a leading dot', '.prod'],
+    ['a trailing dot', 'prod.'],
+    ['a .lock suffix', 'prod.lock'],
+    ['a tilde', 'prod~1'],
+    ['a caret', 'prod^1'],
+    ['a question mark', 'prod?'],
+    ['an asterisk', 'prod*'],
+    ['an open bracket', 'prod['],
+    ['a backslash', 'prod\\1'],
+    ['the empty string', ''],
+    ['a newline (would inject a line into the worker .env)', 'prod\nEVIL=1'],
+];
+//# sourceMappingURL=deployment-name-fixtures.js.map

package/dist/operating-mode/deployment-name-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-name-fixtures.js","sourceRoot":"","sources":["../../src/operating-mode/deployment-name-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,MAAM;IACN,SAAS;IACT,eAAe;IACf,GAAG;IACH,QAAQ;IACR,WAAW;IACX,MAAM;IACN,UAAU;CACF,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,CAAC,2CAA2C,EAAE,WAAW,CAAC;IAC1D,CAAC,YAAY,EAAE,SAAS,CAAC;IACzB,CAAC,yCAAyC,EAAE,OAAO,CAAC;IACpD,CAAC,2BAA2B,EAAE,QAAQ,CAAC;IACvC,CAAC,SAAS,EAAE,MAAM,CAAC;IACnB,CAAC,eAAe,EAAE,OAAO,CAAC;IAC1B,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAC3B,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC/B,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,aAAa,EAAE,OAAO,CAAC;IACxB,CAAC,iBAAiB,EAAE,OAAO,CAAC;IAC5B,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,kBAAkB,EAAE,EAAE,CAAC;IACxB,CAAC,sDAAsD,EAAE,cAAc,CAAC;CAChE,CAAA"}

package/dist/operating-mode/deployment-name.d.ts

@@ -22,6 +22,15 @@
  * `deploymentName` prop silently doing nothing — exactly the two-stacks-one-repo
  * case this feature exists to fix.
  */
+/**
+ * Exported so `canopycms-cdk`'s suite can assert that its own synth-time copy
+ * of this rule (constructs/cms-service.ts) still agrees with this one. The
+ * construct itself must NOT import this: `canopycms-cdk` publishes without a
+ * runtime dependency on `canopycms`, so a source-level import would break the
+ * published construct. The drift check is therefore test-only — see
+ * `deployment-name-fixtures.ts`.
+ */
+export declare const isValidDeploymentName: (name: string) => boolean;
 export declare function resolveDeploymentName(config: {
     deploymentName?: string;
 }, modeDefault: string): string;

package/dist/operating-mode/deployment-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-name.d.ts","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA4BH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EACnC,WAAW,EAAE,MAAM,GAClB,MAAM,CAqCR"}
+{"version":3,"file":"deployment-name.d.ts","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAsBH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAI5B,CAAA;AAEzB,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EACnC,WAAW,EAAE,MAAM,GAClB,MAAM,CAqCR"}

package/dist/operating-mode/deployment-name.js

@@ -39,7 +39,15 @@ let warned = false;
  * git's own ref rules (git-check-ref-format), so they are excluded separately.
  */
 const VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-const isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) &&
+/**
+ * Exported so `canopycms-cdk`'s suite can assert that its own synth-time copy
+ * of this rule (constructs/cms-service.ts) still agrees with this one. The
+ * construct itself must NOT import this: `canopycms-cdk` publishes without a
+ * runtime dependency on `canopycms`, so a source-level import would break the
+ * published construct. The drift check is therefore test-only — see
+ * `deployment-name-fixtures.ts`.
+ */
+export const isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) &&
     !name.includes('..') &&
     !name.endsWith('.') &&
     !name.endsWith('.lock');

package/dist/operating-mode/deployment-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-name.js","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AAE5D,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAEzB,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,WAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAA;IAEzC,IAAI,QAAQ,IAAI,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,4EAA4E;QAC5E,yEAAyE;QACzE,sBAAsB;QACtB,aAAa,CACX,0CAA0C,QAAQ,wCAAwC;YACxF,KAAK,WAAW,yEAAyE;YACzF,uFAAuF;YACvF,2CAA2C,CAC9C,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,IAAI,WAAW,CAAA;IACvD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,kBAAkB,CAAA;QACxB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,MAAM,KAAK;YAChF,0FAA0F;YAC1F,0FAA0F;YAC1F,uDAAuD,CAC1D,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"deployment-name.js","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CAC7D,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAEzB,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,WAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAA;IAEzC,IAAI,QAAQ,IAAI,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,4EAA4E;QAC5E,yEAAyE;QACzE,sBAAsB;QACtB,aAAa,CACX,0CAA0C,QAAQ,wCAAwC;YACxF,KAAK,WAAW,yEAAyE;YACzF,uFAAuF;YACvF,2CAA2C,CAC9C,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,IAAI,WAAW,CAAA;IACvD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,kBAAkB,CAAA;QACxB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,MAAM,KAAK;YAChF,0FAA0F;YAC1F,0FAA0F;YAC1F,uDAAuD,CAC1D,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/operating-mode/index.d.ts

@@ -26,7 +26,8 @@
  */
 export { clientOperatingStrategy, clearClientStrategyCache } from './client-safe-strategy';
 export { operatingStrategy, clearStrategyCache } from './client-unsafe-strategy';
-export { resolveDeploymentName } from './deployment-name';
+export { resolveDeploymentName, isValidDeploymentName } from './deployment-name';
+export { resolveOperatingMode, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR } from './mode-env';
 export type OperatingMode = 'prod' | 'dev';
 export type { ClientSafeStrategy, ClientUnsafeStrategy, ResolveRemoteUrlOptions } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/operating-mode/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAG1F,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAIhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAA;AAG1C,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAG1F,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAIhF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAIhF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE5F,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAA;AAG1C,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA"}

package/dist/operating-mode/index.js

@@ -30,5 +30,8 @@ export { clientOperatingStrategy, clearClientStrategyCache } from './client-safe
 export { operatingStrategy, clearStrategyCache } from './client-unsafe-strategy.js';
 // Single resolution point for deploymentName (env > config > mode default) —
 // server-only (reads process.env), used by the strategies' getSettingsBranchName.
-export { resolveDeploymentName } from './deployment-name.js';
+export { resolveDeploymentName, isValidDeploymentName } from './deployment-name.js';
+// Single resolution point for `mode` (env > config.mode) — isomorphic, applied
+// inside validateCanopyConfig so every config-authoring path gets it.
+export { resolveOperatingMode, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR } from './mode-env.js';
 //# sourceMappingURL=index.js.map

package/dist/operating-mode/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6DAA6D;AAC7D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAE1F,wDAAwD;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6DAA6D;AAC7D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAE1F,wDAAwD;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEhF,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA"}

package/dist/operating-mode/mode-env.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Single resolution point for the operating `mode`.
+ *
+ * `mode` is required in `canopycms.config.ts` (SEC-C1) and that file lives in
+ * the adopter's repo — the SAME file is loaded by `next dev` locally, by
+ * `next build` inside the image builder, and by the deployed Lambda. Those
+ * three want different answers, so a literal in the config file cannot be
+ * right for all of them:
+ *
+ *   - `next dev` must be `dev` (workspace at `<cwd>/.canopy-dev`).
+ *   - `next build` must be `dev` too: prod-mode build reads would try to open
+ *     a branch workspace on EFS that cannot exist in an image builder (see
+ *     the note in `cli/template-files/Dockerfile.cms.template`).
+ *   - The deployed Lambda must be `prod`: dev mode resolves the workspace to
+ *     `<cwd>/.canopy-dev`, and Lambda's filesystem is read-only outside /tmp,
+ *     so the first write fails with EROFS.
+ *
+ * Only a value resolved at RUN time can satisfy all three, which is why this
+ * is an environment override rather than a flag baked into the generated
+ * config file. `CANOPY_MODE` is the name the deployment templates already
+ * referred to; before this module existed nothing read it.
+ *
+ * Precedence (highest wins):
+ *   1. the environment value for the current runtime (see `readModeEnv`)
+ *   2. `config.mode` (the literal in `canopycms.config.ts`)
+ *
+ * ## Two variable names, on purpose
+ *
+ * Server code reads `CANOPY_MODE`, which the CDK construct stamps onto the
+ * Lambda (`CanopyCmsService` sets `CANOPY_MODE=prod`). It is deliberately NOT
+ * set during `next build`, so build-time content reads stay in dev mode.
+ *
+ * Browser code cannot read a runtime environment at all — the editor page
+ * imports `canopycms.config.ts` directly (`config.client()`), so the browser's
+ * copy of `mode` is whatever was inlined when the bundle was built. Next.js
+ * only inlines `NEXT_PUBLIC_*`, so the browser reads
+ * `NEXT_PUBLIC_CANOPY_MODE`, which the generated CDK stack passes as a Docker
+ * build arg. Both names must be spelled as literal `process.env.X` member
+ * expressions here or the bundler cannot substitute them.
+ *
+ * An unrecognized value throws rather than falling back. Falling back would
+ * turn a typo (`CANOPY_MODE=production`) into a silent dev-mode deployment
+ * running header-trusting dev auth semantics — the exact failure SEC-C1 made
+ * `mode` required to prevent.
+ */
+import type { OperatingMode } from './types';
+export declare const SERVER_MODE_ENV_VAR = "CANOPY_MODE";
+export declare const BROWSER_MODE_ENV_VAR = "NEXT_PUBLIC_CANOPY_MODE";
+/** Reset the once-per-process warning latch. Test-only. */
+export declare function resetModeWarning(): void;
+/**
+ * Resolve the effective operating mode from the environment and the config
+ * literal. Called from `validateCanopyConfig`, the one point every documented
+ * config-authoring path (`defineCanopyConfig`, `composeCanopyConfig`) funnels
+ * through.
+ */
+export declare function resolveOperatingMode(configMode: OperatingMode): OperatingMode;
+//# sourceMappingURL=mode-env.d.ts.map

package/dist/operating-mode/mode-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-env.d.ts","sourceRoot":"","sources":["../../src/operating-mode/mode-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,mBAAmB,gBAAgB,CAAA;AAChD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAI7D,2DAA2D;AAC3D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAkBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,GAAG,aAAa,CA0B7E"}

package/dist/operating-mode/mode-env.js

@@ -0,0 +1,97 @@
+/**
+ * Single resolution point for the operating `mode`.
+ *
+ * `mode` is required in `canopycms.config.ts` (SEC-C1) and that file lives in
+ * the adopter's repo — the SAME file is loaded by `next dev` locally, by
+ * `next build` inside the image builder, and by the deployed Lambda. Those
+ * three want different answers, so a literal in the config file cannot be
+ * right for all of them:
+ *
+ *   - `next dev` must be `dev` (workspace at `<cwd>/.canopy-dev`).
+ *   - `next build` must be `dev` too: prod-mode build reads would try to open
+ *     a branch workspace on EFS that cannot exist in an image builder (see
+ *     the note in `cli/template-files/Dockerfile.cms.template`).
+ *   - The deployed Lambda must be `prod`: dev mode resolves the workspace to
+ *     `<cwd>/.canopy-dev`, and Lambda's filesystem is read-only outside /tmp,
+ *     so the first write fails with EROFS.
+ *
+ * Only a value resolved at RUN time can satisfy all three, which is why this
+ * is an environment override rather than a flag baked into the generated
+ * config file. `CANOPY_MODE` is the name the deployment templates already
+ * referred to; before this module existed nothing read it.
+ *
+ * Precedence (highest wins):
+ *   1. the environment value for the current runtime (see `readModeEnv`)
+ *   2. `config.mode` (the literal in `canopycms.config.ts`)
+ *
+ * ## Two variable names, on purpose
+ *
+ * Server code reads `CANOPY_MODE`, which the CDK construct stamps onto the
+ * Lambda (`CanopyCmsService` sets `CANOPY_MODE=prod`). It is deliberately NOT
+ * set during `next build`, so build-time content reads stay in dev mode.
+ *
+ * Browser code cannot read a runtime environment at all — the editor page
+ * imports `canopycms.config.ts` directly (`config.client()`), so the browser's
+ * copy of `mode` is whatever was inlined when the bundle was built. Next.js
+ * only inlines `NEXT_PUBLIC_*`, so the browser reads
+ * `NEXT_PUBLIC_CANOPY_MODE`, which the generated CDK stack passes as a Docker
+ * build arg. Both names must be spelled as literal `process.env.X` member
+ * expressions here or the bundler cannot substitute them.
+ *
+ * An unrecognized value throws rather than falling back. Falling back would
+ * turn a typo (`CANOPY_MODE=production`) into a silent dev-mode deployment
+ * running header-trusting dev auth semantics — the exact failure SEC-C1 made
+ * `mode` required to prevent.
+ */
+import { canopyLogWarn } from '../utils/logger.js';
+export const SERVER_MODE_ENV_VAR = 'CANOPY_MODE';
+export const BROWSER_MODE_ENV_VAR = 'NEXT_PUBLIC_CANOPY_MODE';
+let warned = false;
+/** Reset the once-per-process warning latch. Test-only. */
+export function resetModeWarning() {
+    warned = false;
+}
+/**
+ * The environment value for the current runtime, or undefined when unset.
+ *
+ * Guarded with `typeof process` because a non-Next bundler may leave no
+ * `process` shim in the browser at all; the member expressions themselves stay
+ * literal so Next's DefinePlugin substitution still applies.
+ */
+function readModeEnv() {
+    if (typeof process === 'undefined' || typeof process.env === 'undefined')
+        return undefined;
+    const inBrowser = typeof window !== 'undefined';
+    const name = inBrowser ? BROWSER_MODE_ENV_VAR : SERVER_MODE_ENV_VAR;
+    const raw = inBrowser ? process.env.NEXT_PUBLIC_CANOPY_MODE : process.env.CANOPY_MODE;
+    const value = raw?.trim();
+    return value ? { name, value } : undefined;
+}
+/**
+ * Resolve the effective operating mode from the environment and the config
+ * literal. Called from `validateCanopyConfig`, the one point every documented
+ * config-authoring path (`defineCanopyConfig`, `composeCanopyConfig`) funnels
+ * through.
+ */
+export function resolveOperatingMode(configMode) {
+    const env = readModeEnv();
+    if (!env)
+        return configMode;
+    if (env.value !== 'prod' && env.value !== 'dev') {
+        throw new Error(`CanopyCMS: invalid ${env.name}=${JSON.stringify(env.value)}. ` +
+            `It must be exactly "prod" or "dev". Refusing to fall back to the configured mode ` +
+            `(${JSON.stringify(configMode)}): a typo here would silently deploy dev auth semantics.`);
+    }
+    if (env.value !== configMode && !warned) {
+        // canopyLogWarn, not console.warn: shared modules can run inside the
+        // worker daemon, where an unprefixed line is folded into the previous
+        // CloudWatch event (see utils/logger.ts).
+        canopyLogWarn(`CanopyCMS: ${env.name}="${env.value}" overrides config.mode="${configMode}". ` +
+            `The environment wins by design — it is the per-deployment value, while ` +
+            `canopycms.config.ts is shared by local dev, the image build and the deployment. ` +
+            `See operating-mode/mode-env.ts.`);
+        warned = true;
+    }
+    return env.value;
+}
+//# sourceMappingURL=mode-env.js.map

package/dist/operating-mode/mode-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-env.js","sourceRoot":"","sources":["../../src/operating-mode/mode-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAG/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAA;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,KAAK,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACrF,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAC5D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAA;IAE3B,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI;YAC7D,mFAAmF;YACnF,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,0DAA0D,CAC3F,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,qEAAqE;QACrE,sEAAsE;QACtE,0CAA0C;QAC1C,aAAa,CACX,cAAc,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,4BAA4B,UAAU,KAAK;YAC7E,yEAAyE;YACzE,kFAAkF;YAClF,iCAAiC,CACpC,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC"}

package/dist/resolve-canopy-user.d.ts

@@ -0,0 +1,34 @@
+import type { AuthenticationResult } from './auth/types';
+import type { CanopyUser } from './user';
+import type { OperatingMode } from './operating-mode';
+/** Test-only: reset the once-per-process "no admins configured" warning latch. */
+export declare function resetResolveCanopyUserWarningForTests(): void;
+export interface ResolveCanopyUserDeps {
+    /**
+     * Resolves (and ensures) the settings workspace root. Internal groups are
+     * the single source of truth for group-based privileges and MUST be
+     * loaded from here — the same root `createContentAccessChecker`
+     * (authorization/content.ts) uses for path permissions — never from a
+     * content branch clone.
+     *
+     * Must THROW if the settings workspace cannot be ensured, matching
+     * `createContentAccessChecker`'s fail-loud contract: a caught error here
+     * and a silent fallback to an empty group list would read as "no
+     * privileges", which is a silent authorization change, not a safe
+     * degradation.
+     */
+    getSettingsBranchRoot: () => Promise<string>;
+    mode: OperatingMode;
+    bootstrapAdminIds: Set<string>;
+}
+/**
+ * Resolve the CanopyUser for a request: load internal groups from the
+ * settings workspace and merge them (plus bootstrap admins) into an
+ * authentication result via `authResultToCanopyUser`.
+ *
+ * Framework-agnostic: callers supply the already-computed `authResult` (from
+ * whatever auth-plugin invocation their transport uses) and a small deps
+ * bag drawn from `CanopyServices`.
+ */
+export declare function resolveCanopyUser(authResult: AuthenticationResult, deps: ResolveCanopyUserDeps): Promise<CanopyUser>;
+//# sourceMappingURL=resolve-canopy-user.d.ts.map

package/dist/resolve-canopy-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-canopy-user.d.ts","sourceRoot":"","sources":["../src/resolve-canopy-user.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAKrD,kFAAkF;AAClF,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,EAAE,aAAa,CAAA;IACnB,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC/B;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAOrB"}

package/dist/resolve-canopy-user.js

@@ -0,0 +1,55 @@
+/**
+ * Shared "authenticate -> resolve internal groups -> merge into CanopyUser"
+ * pipeline.
+ *
+ * This used to be duplicated between `http/handler.ts` (the core API
+ * handler) and `canopycms-next`'s `context-wrapper.ts` (Next.js SSR user
+ * extraction) - including a module-level `warnedNoAdmins` flag in each copy.
+ * The duplication let the two drift: `http/handler.ts` loaded internal
+ * groups from the BASE BRANCH content clone's `groups.json`, which nothing
+ * in the product ever writes (writes go to the settings workspace via
+ * `mutateGroupsFile` - `api/groups.ts`), so group-based privileges never
+ * actually took effect. Consolidating the pipeline here means both callers
+ * read from the same place and cannot silently diverge again.
+ *
+ * canopyLogWarn, not console.warn: this module has no worker-specific logic,
+ * but nothing prevents it from becoming reachable from the worker's runtime
+ * import closure later, and the existing "no admins configured" warning is
+ * exactly the kind of operationally interesting line that must not be
+ * silently folded into an unrelated worker.log event (see utils/logger.ts).
+ */
+import { canopyLogWarn } from './utils/logger.js';
+import { authResultToCanopyUser } from './user.js';
+import { loadInternalGroups, RESERVED_GROUPS } from './authorization/index.js';
+/** Module-level, matching the pre-extraction behavior: warn at most once per process. */
+let warnedNoAdmins = false;
+/** Test-only: reset the once-per-process "no admins configured" warning latch. */
+export function resetResolveCanopyUserWarningForTests() {
+    warnedNoAdmins = false;
+}
+function warnIfNoAdmins(internalGroups, bootstrapAdminIds) {
+    if (warnedNoAdmins)
+        return;
+    const adminsGroup = internalGroups.find((g) => g.id === RESERVED_GROUPS.ADMINS);
+    const hasAdmins = (adminsGroup?.members.length ?? 0) > 0 || bootstrapAdminIds.size > 0;
+    if (!hasAdmins) {
+        canopyLogWarn('CanopyCMS: No admin users configured. Set CANOPY_BOOTSTRAP_ADMIN_IDS or add members to the Admins group.');
+    }
+    warnedNoAdmins = true;
+}
+/**
+ * Resolve the CanopyUser for a request: load internal groups from the
+ * settings workspace and merge them (plus bootstrap admins) into an
+ * authentication result via `authResultToCanopyUser`.
+ *
+ * Framework-agnostic: callers supply the already-computed `authResult` (from
+ * whatever auth-plugin invocation their transport uses) and a small deps
+ * bag drawn from `CanopyServices`.
+ */
+export async function resolveCanopyUser(authResult, deps) {
+    const settingsRoot = await deps.getSettingsBranchRoot();
+    const internalGroups = await loadInternalGroups(settingsRoot, deps.mode, deps.bootstrapAdminIds);
+    warnIfNoAdmins(internalGroups, deps.bootstrapAdminIds);
+    return authResultToCanopyUser(authResult, deps.bootstrapAdminIds, internalGroups);
+}
+//# sourceMappingURL=resolve-canopy-user.js.map

package/dist/resolve-canopy-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-canopy-user.js","sourceRoot":"","sources":["../src/resolve-canopy-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAA;AAGzF,yFAAyF;AACzF,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B,kFAAkF;AAClF,MAAM,UAAU,qCAAqC;IACnD,cAAc,GAAG,KAAK,CAAA;AACxB,CAAC;AAqBD,SAAS,cAAc,CAAC,cAA+B,EAAE,iBAA8B;IACrF,IAAI,cAAc;QAAE,OAAM;IAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IAC/E,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,CACX,0GAA0G,CAC3G,CAAA;IACH,CAAC;IACD,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAgC,EAChC,IAA2B;IAE3B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;IACvD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEhG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEtD,OAAO,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AACnF,CAAC"}