cursedbelt 2.7.0 → 3.0.0

package/dist/server/mixins/types.d.ts

@@ -1,153 +0,0 @@
-/**
- * The server-side functional mixin vocabulary (03 §2.1).
- *
- * The ruling this file encodes is R-3: **the server tier is not
- * plugin-oriented.** There is no dynamic Hono middleware registry, no
- * "which plugins are installed" lookup on the request path — a mixin is a plain
- * function `(app, ctx) => void`, statically imported, and `composeServer` calls
- * exactly the ones named in `engines[]`. The consequence that makes it worth
- * doing: the route table is derivable from the config alone, so an engine absent
- * from `engines[]` contributes **zero** routes and probing it yields 404 rather
- * than 403 — the surface does not merely deny, it does not exist.
- *
- * Two context types, not one. `exec` lives only on {@link DevMixinContext}
- * (J3-4): passing an `ExecutionDriver` to every mixin would hand OS execution to
- * public-facing media and knowledge routes, and a comment asking people not to
- * use it is not a boundary. Type construction is.
- */
-import type { StorageProvider } from 'cwip/storage';
-import type { TelemetryWriter } from 'cwip/telemetry';
-import type { Context, Hono } from 'hono';
-import type { CCUserClaims } from '../../core/session/claims';
-import type { EffectiveInstance, EffectiveManifest } from '../../verify/types';
-import type { CursedbeltVariables } from '../context';
-import type { CognitiveGateway, ExecutionDriver, JobBroker } from '../drivers';
-import type { ServerPushHub } from '../stream/serverPush';
-/**
- * One instance's resolved server-side config. This is the V2 output shape — the
- * same object the client's manifest carries — so there is exactly one notion of
- * "what is this instance configured to do" across both layers.
- */
-export type EngineConfigInstance = EffectiveInstance;
-/** Why a presented session token was refused. Mapped to status by `guardVerify`. */
-export type GuardFailure = 'missing' | 'malformed' | 'invalid-signature' | 'expired' | 'revoked';
-export type GuardVerification = {
-    ok: true;
-    claims: CCUserClaims;
-} | {
-    ok: false;
-    failure: GuardFailure;
-};
-/**
- * Per-request token verification (02 §4.2). The wire only signals; this is what
- * decides. `verify` is called on every private or mutating route — a pane's
- * unlock is never cached for another pane's request.
- */
-export interface GuardVerifier {
-    verify(token: string | undefined): GuardVerification;
-    /** Revoke a jti until its `exp` — what lock does, across every tab. */
-    revoke(jti: string): void;
-    isRevoked(jti: string): boolean;
-}
-/**
- * The billing pre-gate (11 §4, 03 §7.4). A metered route asks this — BEFORE it
- * does the metered work — whether `cost` more of `metric` would cross the
- * tenant's plan ceiling; if so it throws the typed `USAGE_LIMIT_EXCEEDED` (402).
- *
- * It is a context capability, not a service body call, for the same reason
- * `GuardVerifier` is: the check has to be composable onto a sub-block at mount
- * time (`requireWithinPlan`, mirroring `guardVerify`) so "did we remember to
- * enforce this metered feature?" stops being a per-engine question. Present ONLY
- * under the saas profile — a local single-user app is unlimited, so the mixins
- * simply do not compose the gate when it is absent (`ctx.enforcer === undefined`).
- */
-export interface PlanEnforcer {
-    /**
-     * Read the tenant's live usage and throw if `cost` more of `metric` would
-     * exceed the plan. `cost` is what the pending operation is ABOUT to consume,
-     * so the request that would cross the line is the one refused — never the one
-     * after it has already spent (billingService.ts, §4).
-     */
-    assert(tenantId: string, metric: string, cost?: number): Promise<void>;
-    /**
-     * The ENTITLEMENT half (P2): throw the typed 402 `PLAN_FEATURE_NOT_INCLUDED`
-     * when the tenant's plan carries a feature allowlist that excludes
-     * `engine.feature`. Deployment config decides what is mounted; this decides
-     * which tenants may call it — the seam the plan grid (Explorer/Alchemist/
-     * Guild) needs to be enforceable at all.
-     */
-    assertFeature(tenantId: string, engine: string, feature: string): Promise<void>;
-}
-/**
- * Hono context variables the mixins set, on top of cursedbelt's plumbing ones.
- * Extending `CursedbeltVariables` rather than replacing it is what lets the
- * composed app reuse the existing correlation-id middleware and the one
- * canonical `errorEnvelope` handler instead of forking either.
- */
-export interface CCVariables extends CursedbeltVariables {
-    instance: EngineConfigInstance;
-    claims: CCUserClaims;
-}
-export interface CCEnv {
-    Variables: CCVariables;
-}
-export type CCHono = Hono<CCEnv>;
-/** A handler/middleware context in a composed cc server. */
-export type CCContext = Context<CCEnv>;
-export interface MixinContext {
-    /** V2 output: instances + effective features/ports. The single source of truth. */
-    manifest: EffectiveManifest;
-    /**
-     * J3-1: frozen at boot, O(1) per request forever. The array scan it replaces
-     * was an O(N) hot-path cost that also tempted `instances[0]` shortcuts — which
-     * is exactly the first-instance-wins bug C28 pinned.
-     */
-    instanceIndex: ReadonlyMap<string, EngineConfigInstance>;
-    storage: StorageProvider;
-    guard: GuardVerifier;
-    /** The ONLY AI boundary (03 §7.2). */
-    gateway: CognitiveGateway;
-    broker: JobBroker;
-    telemetry: TelemetryWriter;
-    /** Origins `ccCorsPolicy` admits — registered local ports, or the tenant's origins. */
-    allowedOrigins: readonly string[];
-    /**
-     * Server→client push fan-out (03 §3.2). Optional: a composed server with no
-     * hub still serves `/stream` as a live, heartbeating channel — it simply
-     * carries no CDC or job records, which is the correct behavior for a manifest
-     * with no storage tap rather than a reason to refuse to boot.
-     */
-    push?: ServerPushHub;
-    /**
-     * The billing pre-gate (11 §4). Present ONLY under the saas profile —
-     * `composeServer` builds it from the injected `BillingService`. When absent
-     * (local), metered mixins compose no gate: a single-user machine is unlimited.
-     */
-    enforcer?: PlanEnforcer;
-}
-export interface DevMixinContext extends MixinContext {
-    /**
-     * J3-4: DevStudio ONLY. No other mixin ever sees this.
-     *
-     * OPTIONAL since 03 §2c, and the reason is worth stating: this field's job is
-     * to make OS execution *unreachable by type* from every other mixin, not to
-     * assert that execution is available. A dev engine mounting only the app
-     * registry or the docs surface shells out nowhere, and requiring a driver it
-     * would never call made that app unbootable. `composeServer` requires it iff
-     * an exec-backed dev feature is effective.
-     */
-    exec?: ExecutionDriver;
-}
-export type ServerMixin = (app: CCHono, ctx: MixinContext) => void;
-export type DevServerMixin = (app: CCHono, ctx: DevMixinContext) => void;
-/** Is a feature effective-on for ANY instance of this engine? Route-mount predicate. */
-export declare const featureOnAnyInstance: (ctx: MixinContext, engine: string, feature: string) => boolean;
-/** Every instance of one engine — mixins iterate these to mount per-instance blocks. */
-export declare const instancesOfEngine: (ctx: MixinContext, engine: string) => readonly EngineConfigInstance[];
-/**
- * RBAC is on when the profile is saas or a guard instance sets `rbac:true`
- * (02 §2.2e forces the former to imply the latter, so this is belt-and-braces
- * for a manifest assembled outside the parser).
- */
-export declare const rbacEnabled: (ctx: MixinContext) => boolean;
-//# sourceMappingURL=types.d.ts.map

package/dist/server/mixins/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAErD,oFAAoF;AACpF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,mBAAmB,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjG,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC;IACrD,uEAAuE;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE;;;;;;OAMG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,mBAAmB;IACtD,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,KAAK;IACpB,SAAS,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;AAEjC,4DAA4D;AAC5D,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,QAAQ,EAAE,iBAAiB,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACzD,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,aAAa,CAAC;IACrB,sCAAsC;IACtC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,uFAAuF;IACvF,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,KAAK,IAAI,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,KAAK,IAAI,CAAC;AAIzE,wFAAwF;AACxF,eAAO,MAAM,oBAAoB,GAC/B,KAAK,YAAY,EACjB,QAAQ,MAAM,EACd,SAAS,MAAM,KACd,OACuF,CAAC;AAE3F,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,GAAI,KAAK,YAAY,EAAE,QAAQ,MAAM,KAAG,SAAS,oBAAoB,EACxC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,YAAY,KAAG,OAEuC,CAAC"}

package/dist/server/mixins/types.js

@@ -1,13 +0,0 @@
-/* ------------------------------------------------------------- helpers */
-/** Is a feature effective-on for ANY instance of this engine? Route-mount predicate. */
-export const featureOnAnyInstance = (ctx, engine, feature) => ctx.manifest.instances.some((i) => i.engine === engine && i.effective[feature] === true);
-/** Every instance of one engine — mixins iterate these to mount per-instance blocks. */
-export const instancesOfEngine = (ctx, engine) => ctx.manifest.instances.filter((i) => i.engine === engine);
-/**
- * RBAC is on when the profile is saas or a guard instance sets `rbac:true`
- * (02 §2.2e forces the former to imply the latter, so this is belt-and-braces
- * for a manifest assembled outside the parser).
- */
-export const rbacEnabled = (ctx) => ctx.manifest.profile === 'saas' ||
-    ctx.manifest.instances.some((i) => i.engine === 'guard' && i.effective.rbac === true);
-//# sourceMappingURL=types.js.map

package/dist/server/mixins/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/mixins/types.ts"],"names":[],"mappings":"AAuJA,2EAA2E;AAE3E,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,GAAiB,EACjB,MAAc,EACd,OAAe,EACN,EAAE,CACX,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;AAE3F,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAiB,EAAE,MAAc,EAAmC,EAAE,CACtG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAiB,EAAW,EAAE,CACxD,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM;IAC/B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC"}

package/dist/server/net/outboundGuard.d.ts

@@ -1,31 +0,0 @@
-export declare const OUTBOUND_URL_BLOCKED = "OUTBOUND_URL_BLOCKED";
-export interface OutboundGuardOptions {
-    /**
-     * Exact hostnames (case-insensitive) explicitly permitted even if they would
-     * otherwise be blocked — for a deliberately-configured internal integration.
-     * Empty by default: nothing internal is reachable unless a host opts in.
-     */
-    allowHosts?: readonly string[];
-    /** Permitted URL schemes. Default `['http:', 'https:']`. */
-    allowSchemes?: readonly string[];
-}
-/**
- * Structural SSRF guard: parse `rawUrl`, enforce scheme, reject credentials, and
- * refuse any host that is a private/loopback/link-local/reserved IP literal (in
- * any encoding) or a well-known internal hostname. Returns the parsed URL.
- *
- * @throws {AppError} `OUTBOUND_URL_BLOCKED` on any violation.
- */
-export declare const assertPublicOutboundUrl: (rawUrl: string, options?: OutboundGuardOptions) => URL;
-/**
- * DNS-aware SSRF guard: the structural checks of {@link assertPublicOutboundUrl}
- * PLUS a resolution pass — every address the hostname resolves to is re-checked,
- * so a public name pointing at a private IP is refused. Still racy against an
- * attacker who rebinds between this lookup and the actual connect, which is why
- * the SaaS profile must also enforce network-layer egress; but it closes the
- * naive `evil.example → 169.254.169.254` vector the structural pass cannot see.
- *
- * @throws {AppError} `OUTBOUND_URL_BLOCKED` on any violation.
- */
-export declare const assertResolvedPublicUrl: (rawUrl: string, options?: OutboundGuardOptions) => Promise<URL>;
-//# sourceMappingURL=outboundGuard.d.ts.map

package/dist/server/net/outboundGuard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"outboundGuard.d.ts","sourceRoot":"","sources":["../../../src/server/net/outboundGuard.ts"],"names":[],"mappings":"AAqCA,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,4DAA4D;IAC5D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAoFD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,EAAE,UAAS,oBAAyB,KAAG,GAiC5F,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAAU,QAAQ,MAAM,EAAE,UAAS,oBAAyB,KAAG,OAAO,CAAC,GAAG,CAoB7G,CAAC"}

package/dist/server/net/outboundGuard.js

@@ -1,200 +0,0 @@
-/**
- * SSRF guard for server-side outbound HTTP (03 §2.4 H-4 adjudication).
- *
- * The Request Builder send (`/api/system/http`) is server-side BY DESIGN: the
- * pinned CSP's `connect-src` would block a browser-side request to an arbitrary
- * host, so the send is performed by the server to keep the tool working without
- * widening a single header. But moving the send server-side creates a
- * server-side request forgery surface the CSP argument never addressed — an
- * authenticated caller can now make the SERVER fetch:
- *
- *   - `http://169.254.169.254/latest/meta-data/…`  → cloud metadata → credentials
- *   - `http://localhost:4747/…` / `http://127.0.0.1` → the station and sibling apps
- *   - `http://10.x` / `172.16.x` / `192.168.x`      → anything on the private network
- *   - `http://<internal-rds-or-redis-or-admin>`      → internal-only services
- *
- * This module is the boundary that refuses those. It is fail-CLOSED and lives in
- * the framework (not in a leaf `sendHttp` impl) so no implementation can forget
- * it: the mixin runs {@link assertPublicOutboundUrl} on the caller-supplied URL
- * BEFORE any impl sees it.
- *
- * Two layers, because neither alone is sufficient:
- *   1. {@link assertPublicOutboundUrl} — synchronous, structural: scheme +
- *      credential + literal-IP-range + dangerous-hostname checks. Catches every
- *      IP-literal vector (including the decimal/hex/octal encodings that
- *      `new URL()` preserves and `fetch` still resolves) and the well-known
- *      internal hostnames. This is what the request path calls on every send.
- *   2. {@link assertResolvedPublicUrl} — async, DNS-aware: additionally resolves
- *      the hostname and re-checks every resolved address, which is the only
- *      defense against a public name that resolves to a private IP (DNS
- *      rebinding). Opt-in for impls that can afford the lookup; the SaaS profile
- *      must ALSO enforce egress at the network layer, since even this races a
- *      rebinding attacker between resolve and connect.
- */
-import { isIP } from 'node:net';
-import { lookup } from 'node:dns/promises';
-import { AppError } from '../errors';
-export const OUTBOUND_URL_BLOCKED = 'OUTBOUND_URL_BLOCKED';
-const blocked = (reason, context) => new AppError(`Outbound request refused: ${reason}.`, {
-    code: OUTBOUND_URL_BLOCKED,
-    status: 400,
-    category: 'security',
-    // Deliberately terse context — do not echo internal topology back.
-    context,
-});
-/** Hostnames and suffixes that always resolve to a non-public / internal target. */
-const BLOCKED_HOST_EXACT = new Set(['localhost', 'metadata.google.internal', 'metadata']);
-const BLOCKED_HOST_SUFFIXES = ['.localhost', '.local', '.internal', '.intranet', '.cluster.local', '.svc'];
-/**
- * Parse a hostname into an IPv4 the way a permissive resolver would, covering
- * the encodings SSRF filters classically miss: dotted-decimal (`127.0.0.1`), a
- * bare 32-bit integer (`2130706433`), and hex (`0x7f000001`). Returns the four
- * octets, or `null` when the host is not an IPv4 literal in any of these forms.
- */
-const looseIpv4Octets = (host) => {
-    if (isIP(host) === 4) {
-        const parts = host.split('.').map(Number);
-        return [parts[0], parts[1], parts[2], parts[3]];
-    }
-    // Bare integer or hex integer → a single 32-bit value.
-    const asInt = /^0x[0-9a-f]+$/i.test(host)
-        ? Number.parseInt(host, 16)
-        : /^[0-9]+$/.test(host)
-            ? Number.parseInt(host, 10)
-            : Number.NaN;
-    if (Number.isInteger(asInt) && asInt >= 0 && asInt <= 0xffffffff)
-        return [(asInt >>> 24) & 0xff, (asInt >>> 16) & 0xff, (asInt >>> 8) & 0xff, asInt & 0xff];
-    return null;
-};
-/** Whether an IPv4 (as octets) is in a private, loopback, link-local or reserved range. */
-const isBlockedIpv4 = ([a, b]) => {
-    if (a === 0 || a === 10 || a === 127)
-        return true; // this-host, private, loopback
-    if (a === 169 && b === 254)
-        return true; // link-local — INCLUDES 169.254.169.254 metadata
-    if (a === 172 && b >= 16 && b <= 31)
-        return true; // private
-    if (a === 192 && b === 168)
-        return true; // private
-    if (a === 100 && b >= 64 && b <= 127)
-        return true; // CGNAT (100.64/10)
-    if (a === 198 && (b === 18 || b === 19))
-        return true; // benchmarking
-    if (a >= 224)
-        return true; // multicast (224/4) + reserved (240/4) + 255.255.255.255
-    return false;
-};
-/**
- * Extract the embedded IPv4 of an IPv4-mapped IPv6 address. `new URL` normalizes
- * `::ffff:127.0.0.1` to the HEX form `::ffff:7f00:1`, so both the dotted and the
- * two-hextet forms have to be handled.
- */
-const mappedV4Octets = (head) => {
-    const rest = /^::ffff:(.+)$/i.exec(head)?.[1];
-    if (!rest)
-        return null;
-    if (rest.includes('.'))
-        return looseIpv4Octets(rest);
-    const groups = rest.split(':');
-    if (groups.length !== 2)
-        return null;
-    const hi = Number.parseInt(groups[0], 16);
-    const lo = Number.parseInt(groups[1], 16);
-    if (!Number.isInteger(hi) || !Number.isInteger(lo))
-        return null;
-    return [(hi >> 8) & 0xff, hi & 0xff, (lo >> 8) & 0xff, lo & 0xff];
-};
-/** Whether an IPv6 literal (already `net.isIP`-classified) is non-public. */
-const isBlockedIpv6 = (raw) => {
-    const head = raw.toLowerCase().replace(/^\[|\]$/g, '');
-    if (head === '::1' || head === '::')
-        return true; // loopback, unspecified
-    const mapped = mappedV4Octets(head);
-    if (mapped && isBlockedIpv4(mapped))
-        return true; // IPv4-mapped (`::ffff:…`)
-    // fe80::/10 link-local (fe80–febf) and fec0::/10 deprecated site-local (fec0–feff).
-    if (/^fe[89ab]/.test(head) || /^fe[c-f]/.test(head))
-        return true;
-    if (head.startsWith('fc') || head.startsWith('fd'))
-        return true; // fc00::/7 unique-local (incl. fd00:ec2::254 metadata)
-    if (head.startsWith('ff'))
-        return true; // ff00::/8 multicast
-    return false;
-};
-const isBlockedHostname = (host) => {
-    if (BLOCKED_HOST_EXACT.has(host))
-        return true;
-    return BLOCKED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
-};
-/**
- * Structural SSRF guard: parse `rawUrl`, enforce scheme, reject credentials, and
- * refuse any host that is a private/loopback/link-local/reserved IP literal (in
- * any encoding) or a well-known internal hostname. Returns the parsed URL.
- *
- * @throws {AppError} `OUTBOUND_URL_BLOCKED` on any violation.
- */
-export const assertPublicOutboundUrl = (rawUrl, options = {}) => {
-    const allowSchemes = options.allowSchemes ?? ['http:', 'https:'];
-    const allowHosts = new Set((options.allowHosts ?? []).map((h) => h.toLowerCase()));
-    let url;
-    try {
-        url = new URL(rawUrl);
-    }
-    catch {
-        throw blocked('not a valid absolute URL', {});
-    }
-    if (!allowSchemes.includes(url.protocol))
-        throw blocked(`scheme '${url.protocol}' is not allowed`, { scheme: url.protocol });
-    // Credentials in the URL are a redirect/parsing-confusion vector and never
-    // legitimate for a tool send.
-    if (url.username !== '' || url.password !== '')
-        throw blocked('credentials in URL are not allowed', {});
-    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
-    if (allowHosts.has(host))
-        return url; // explicit host opt-in bypasses the blocks
-    const v4 = looseIpv4Octets(host);
-    if (v4) {
-        if (isBlockedIpv4(v4))
-            throw blocked('target resolves to a private or reserved address', { host });
-        return url;
-    }
-    if (isIP(host) === 6) {
-        if (isBlockedIpv6(host))
-            throw blocked('target resolves to a private or reserved address', { host });
-        return url;
-    }
-    if (isBlockedHostname(host))
-        throw blocked('target host is internal-only', { host });
-    return url;
-};
-/**
- * DNS-aware SSRF guard: the structural checks of {@link assertPublicOutboundUrl}
- * PLUS a resolution pass — every address the hostname resolves to is re-checked,
- * so a public name pointing at a private IP is refused. Still racy against an
- * attacker who rebinds between this lookup and the actual connect, which is why
- * the SaaS profile must also enforce network-layer egress; but it closes the
- * naive `evil.example → 169.254.169.254` vector the structural pass cannot see.
- *
- * @throws {AppError} `OUTBOUND_URL_BLOCKED` on any violation.
- */
-export const assertResolvedPublicUrl = async (rawUrl, options = {}) => {
-    const url = assertPublicOutboundUrl(rawUrl, options);
-    const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, '');
-    // A literal IP or an explicitly-allowed host needs no resolution recheck.
-    if (isIP(host) !== 0 || looseIpv4Octets(host) || (options.allowHosts ?? []).some((h) => h.toLowerCase() === host))
-        return url;
-    let addresses;
-    try {
-        addresses = await lookup(host, { all: true });
-    }
-    catch {
-        throw blocked('target hostname did not resolve', { host });
-    }
-    for (const { address } of addresses) {
-        const octets = looseIpv4Octets(address);
-        if (octets ? isBlockedIpv4(octets) : isIP(address) === 6 && isBlockedIpv6(address))
-            throw blocked('target hostname resolves to a private or reserved address', { host });
-    }
-    return url;
-};
-//# sourceMappingURL=outboundGuard.js.map

package/dist/server/net/outboundGuard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"outboundGuard.js","sourceRoot":"","sources":["../../../src/server/net/outboundGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAa3D,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,OAAgC,EAAY,EAAE,CAC7E,IAAI,QAAQ,CAAC,6BAA6B,MAAM,GAAG,EAAE;IACnD,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,UAAU;IACpB,mEAAmE;IACnE,OAAO;CACR,CAAC,CAAC;AAEL,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,0BAA0B,EAAE,UAAU,CAAC,CAAC,CAAC;AAC1F,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAE3G;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,IAAY,EAA2C,EAAE;IAChF,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,CAAC;IACD,uDAAuD;IACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACjB,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,UAAU;QAC9D,OAAO,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAmC,EAAW,EAAE;IAC1E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAClF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;IAC1F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IACrE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACpF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAA2C,EAAE;IAC/E,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,aAAa,GAAG,CAAC,GAAW,EAAW,EAAE;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IAC7E,oFAAoF;IACpF,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uDAAuD;IACxH,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAW,EAAE;IAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,UAAgC,EAAE,EAAO,EAAE;IACjG,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEnF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACtC,MAAM,OAAO,CAAC,WAAW,GAAG,CAAC,QAAQ,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAErF,2EAA2E;IAC3E,8BAA8B;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE;QAAE,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,2CAA2C;IAEjF,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,aAAa,CAAC,EAAE,CAAC;YAAE,MAAM,OAAO,CAAC,kDAAkD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,CAAC,kDAAkD,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrG,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAErF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,MAAc,EAAE,UAAgC,EAAE,EAAgB,EAAE;IAChH,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEhE,0EAA0E;IAC1E,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QAC/G,OAAO,GAAG,CAAC;IAEb,IAAI,SAAgD,CAAC;IACrD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC;YAChF,MAAM,OAAO,CAAC,2DAA2D,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}

package/dist/server/notifications/hub.d.ts

@@ -1,68 +0,0 @@
-/**
- * Live delivery for the notification center — the half that makes a bell badge
- * change without anybody clicking anything.
- *
- * The center already has the seam (`NotificationSink`); what was missing was a
- * transport behind it. This is that transport, as **SSE** rather than a
- * WebSocket, and the reason is the shape of the traffic: notifications are
- * server→client only, they must survive a laptop lid closing, and a browser
- * reconnects an `EventSource` by itself. A WebSocket would mean writing the
- * reconnect loop, the heartbeat and the backoff that `EventSource` already has
- * — and `cursedbelt/server/ws` remains the right answer for anything the client
- * needs to send back up.
- *
- * 🔴 **A hub is a cache of who is listening, never a queue.** A notification is
- * already durable (it is a row) before a sink is called, so a subscriber that
- * is asleep, disconnected or behind a proxy that ate the stream loses nothing:
- * the next list/poll returns the same row. That is why every emit here is
- * fire-and-forget and a failing subscriber is dropped rather than retried — the
- * poll transport in `cursedbelt/react/notifications` is the backstop, and it is
- * not optional.
- */
-import type { AppNotification, NotificationSink } from "cwip/notifications";
-/** What a subscriber receives. `unread` rides alongside so a bell badge never
- *  has to make a second request to learn its own number. */
-export type NotificationHubEvent = {
-    kind: "notification";
-    notification: AppNotification;
-} | {
-    kind: "unread";
-    userId: string;
-    count: number;
-};
-export type NotificationHubListener = (event: NotificationHubEvent) => void;
-export interface NotificationHubOptions {
-    /**
-     * Comment-line heartbeat cadence, in ms. Default 25s — under the 30s idle
-     * timeout nginx and Cloudflare both default to, which is what silently kills
-     * an otherwise healthy SSE stream. 0 disables it (tests).
-     */
-    heartbeatMs?: number;
-    /**
-     * Max concurrent streams per user. Default 8. A tab is a stream, and a
-     * browser left open for a week accumulates them; without a cap one person's
-     * tab habit is an unbounded server-side array.
-     */
-    maxStreamsPerUser?: number;
-    /** Reported when a listener throws. Never rethrown — see the module doc. */
-    onError?: (error: unknown, context: string) => void;
-}
-export interface NotificationHub {
-    /**
-     * Hand this to `createNotificationCenter({ sink })`. Every `notify*` then
-     * reaches the connected tabs of exactly the addressed user.
-     */
-    readonly sink: NotificationSink;
-    /** Register a listener for one user's events. Returns an unsubscribe fn. */
-    subscribe(userId: string, listener: NotificationHubListener): () => void;
-    /** An SSE `Response` for one user — the thing a route returns. */
-    stream(userId: string, options?: {
-        signal?: AbortSignal;
-    }): Response;
-    /** How many live subscribers a user has (all users when omitted). */
-    subscriberCount(userId?: string): number;
-    /** Drop every subscriber and stop every heartbeat (shutdown, and tests). */
-    close(): void;
-}
-export declare function createNotificationHub(options?: NotificationHubOptions): NotificationHub;
-//# sourceMappingURL=hub.d.ts.map

package/dist/server/notifications/hub.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hub.d.ts","sourceRoot":"","sources":["../../../src/server/notifications/hub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE5E;4DAC4D;AAC5D,MAAM,MAAM,oBAAoB,GAC7B;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,eAAe,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;AAE5E,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,eAAe;IAC/B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,4EAA4E;IAC5E,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI,CAAC;IACzE,kEAAkE;IAClE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,QAAQ,CAAC;IACrE,qEAAqE;IACrE,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,4EAA4E;IAC5E,KAAK,IAAI,IAAI,CAAC;CACd;AAkBD,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAoK3F"}