cursedbelt 2.7.0 → 3.0.0

package/dist/server/mixins/asset.mixin.js

@@ -1,419 +0,0 @@
-/**
- * AssetStudio's server block — `/api/asset/*` (03 §1).
- *
- * Every sub-block below is mounted **conditionally at composition time**, never
- * guarded per request. That distinction is the point of R-3: with `hls:false`
- * the HLS route does not exist, so probing it yields 404. A per-request `if
- * (!features.hls) return 403` would instead confirm the route exists and is
- * merely disabled, which both leaks configuration and leaves a live handler one
- * bug away from serving.
- *
- * Private bytes carry the dual-enforcement law (02 §4.2): the
- * `session:private-mode` wire only signals that some pane unlocked, and this
- * route re-verifies the signed token per request behind `requirePrivateScope`.
- */
-import { AppError } from '../errors';
-import { declaredContentLength, requirePlanFeature, requireWithinPlan } from './enforcement';
-import { claimsOrNull, guardFor, optionalSessionFor } from './security';
-import { featureOnAnyInstance, rbacEnabled } from './types';
-/**
- * Content types stored user content may be served INLINE as (05 §A4).
- *
- * Everything else is forced to `application/octet-stream` +
- * `Content-Disposition: attachment`. The reason is narrow and specific: the app
- * CSP is `script-src 'self'` (`core.mixin.ts`), and a signed object URL is
- * same-origin — so an uploaded `.js` or `.html` served inline with its STORED
- * content type executes inside the app's own origin, with the app's own CSP
- * blessing it. `nosniff` does not help: it makes the browser HONOR the declared
- * type, and the declared type is the attacker's.
- *
- * An allowlist, not a denylist, and of PREFIXES only. A denylist of dangerous
- * types is a list of the ones somebody thought of; the inert set is small,
- * enumerable, and does not grow behind your back. `image/svg+xml` is
- * deliberately NOT here — SVG is a script-bearing document that happens to start
- * with `image/`, which is exactly why prefix matching alone would be wrong.
- */
-const INLINE_SAFE_TYPES = ['image/', 'video/', 'audio/', 'application/pdf'];
-/** `image/*` types that carry script and must never be inline. */
-const INLINE_UNSAFE_EXCEPTIONS = ['image/svg+xml', 'image/svg'];
-/** The base type, lowercased, with any `; charset=…` parameters dropped. */
-const baseContentType = (value) => (value ?? '').split(';')[0]?.trim().toLowerCase() ?? '';
-/**
- * The headers a stored object is served with. Returns the type to declare and
- * the disposition to force — exported so the rule is testable on its own and so
- * a second bytes route cannot re-derive it slightly differently.
- */
-export const storedObjectHeaders = (contentType) => {
-    const base = baseContentType(contentType);
-    const inlineSafe = base.length > 0 &&
-        !INLINE_UNSAFE_EXCEPTIONS.includes(base) &&
-        INLINE_SAFE_TYPES.some((prefix) => (prefix.endsWith('/') ? base.startsWith(prefix) : base === prefix));
-    // Not merely `Content-Disposition: attachment` on a preserved type: a browser
-    // that ignored the disposition would still be handed `text/html`. The type is
-    // rewritten too, so BOTH signals have to fail before anything renders.
-    return inlineSafe ? { type: base, disposition: 'inline' } : { type: 'application/octet-stream', disposition: 'attachment' };
-};
-export function createAssetMixin(service) {
-    return (app, ctx) => {
-        const rbacOn = rbacEnabled(ctx);
-        const session = guardFor(ctx, rbacOn);
-        const scopeOf = (c) => ({ claims: c.get('claims') });
-        // The storage meter-gate (11 §4). Present only under saas (`ctx.enforcer`);
-        // it refuses an upload that would cross the tenant's `storage.bytes` ceiling
-        // BEFORE the stream is consumed, using the declared Content-Length as the
-        // cost — so an over-plan upload is a 402 up front, not after the bytes land.
-        const meterUpload = ctx.enforcer
-            ? [requireWithinPlan(ctx.enforcer, 'storage.bytes', declaredContentLength)]
-            : [];
-        const galleryOn = featureOnAnyInstance(ctx, 'asset', 'gallery');
-        const videoOn = featureOnAnyInstance(ctx, 'asset', 'video');
-        const hlsOn = featureOnAnyInstance(ctx, 'asset', 'hls');
-        const privateOn = featureOnAnyInstance(ctx, 'asset', 'privateMedia');
-        const ocrOn = featureOnAnyInstance(ctx, 'asset', 'ocr');
-        const vaultOn = featureOnAnyInstance(ctx, 'asset', 'vaultSource');
-        app.get('/api/asset/health', (c) => c.json({ success: true, engine: 'asset' }));
-        if (galleryOn || videoOn) {
-            /**
-             * The listing itself is public — a locked app still renders its gallery.
-             * What changes with a session is CONTENT: `revealPrivate` is derived from
-             * the VERIFIED token, never from a query parameter, because a
-             * client-supplied "show private" flag is exactly how a locked listing
-             * leaks private ids.
-             */
-            app.get('/api/asset/items', optionalSessionFor(ctx), async (c) => {
-                const claims = claimsOrNull(c);
-                // The `ANONYMOUS` sentinel is a LOCAL-profile convenience: it stands in
-                // for the single-user machine's `t_local` tenant so the listing query is
-                // still tenant-scoped. Under `saas` there is no `t_local`, and silently
-                // mapping an unauthenticated caller onto a fabricated tenant is wrong —
-                // the multi-tenant listing must come from a verified session (tenant
-                // resolution is the session's job, never a hardcoded sentinel). So a
-                // saas request with no session is rejected, not anonymized.
-                if (!claims && ctx.manifest.profile === 'saas')
-                    throw new AppError('This listing requires an authenticated session.', {
-                        code: 'SESSION_REQUIRED',
-                        status: 401,
-                        context: { reason: 'no-anonymous-tenant-under-saas' },
-                    });
-                const page = await service.list({ claims: claims ?? ANONYMOUS }, { revealPrivate: privateOn && claims?.privateScope === true, cursor: c.req.query('cursor') });
-                return c.json({ success: true, ...page });
-            });
-            /**
-             * The detail read (03 §1e). Behind the plain `session` — the SAME door as
-             * the bytes route below, because it describes exactly the items that route
-             * will serve. A private id answers 404 here (the service's union cannot
-             * return one), so this endpoint never confirms that a sealed asset exists.
-             */
-            app.get('/api/asset/items/:id', session, async (c) => {
-                const item = await service.get(scopeOf(c), c.req.param('id'));
-                if (!item)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, item });
-            });
-            app.get('/api/asset/items/:id/bytes', session, async (c) => {
-                const stream = await service.read(scopeOf(c), c.req.param('id'));
-                if (!stream)
-                    throw notFound(c.req.param('id'));
-                return new Response(stream, { headers: { 'Content-Type': 'application/octet-stream' } });
-            });
-            /**
-             * The local profile's signed-URL reader (08 §1a).
-             *
-             * Mounted only when the service can verify a signature — i.e. when the
-             * host wired the fs store. Under saas `signedUrl` returns a bucket
-             * presign and the bytes never touch this process, so the route does not
-             * exist there (composition-time absence, R-3, not a per-request 403).
-             *
-             * No session middleware, deliberately: the HMAC IS the authorization,
-             * because this URL is consumed by an `<img>`/`<video>` element that
-             * cannot attach one. Everything that makes that safe lives in the
-             * signature — it is bound to the exact key and carries a short expiry, so
-             * a leaked URL grants one object for a few minutes rather than a session.
-             */
-            if (service.readSignedObject) {
-                app.get('/api/asset/objects/*', async (c) => {
-                    const path = new URL(c.req.url).pathname;
-                    const raw = path.slice('/api/asset/objects/'.length);
-                    const key = raw
-                        .split('/')
-                        .map((segment) => decodeURIComponent(segment))
-                        .join('/');
-                    const found = await service.readSignedObject?.({
-                        key,
-                        expiresAt: Number(c.req.query('exp')),
-                        signature: c.req.query('sig') ?? '',
-                    });
-                    // One answer for "no such object", "bad signature" and "expired": the
-                    // endpoint must not tell an attacker which of the three it was.
-                    if (!found)
-                        throw notFound(key);
-                    // 05 §A4: the stored content type is USER-CONTROLLED, and this route is
-                    // same-origin under a `script-src 'self'` CSP — so an uploaded `.html`
-                    // or `.js` served inline with its own type executes as first-party
-                    // code. Anything outside the inert allowlist is downloaded, never
-                    // rendered in the app origin.
-                    const served = storedObjectHeaders(found.contentType);
-                    return new Response(found.body, {
-                        headers: {
-                            'Content-Type': served.type,
-                            'Content-Disposition': served.disposition,
-                            // The URL already carries an expiry; letting a shared cache keep
-                            // the bytes past it would outlive the grant.
-                            'Cache-Control': 'private, max-age=60',
-                        },
-                    });
-                });
-            }
-            app.post('/api/asset/upload', session, ...meterUpload, async (c) => {
-                // The request is handed through un-buffered: large uploads stream as
-                // chunked multipart to the ObjectStore, never into request RAM (01 §2.5).
-                const result = await service.upload(scopeOf(c), c.req.raw);
-                return c.json({ success: true, ...result }, 201);
-            });
-            /**
-             * The delete. `AssetService.remove` shipped with NO route — its own
-             * docstring described the 404 mapping this handler performs, and nothing
-             * performed it, so a soft-delete was reachable only from code (found while
-             * proving the 04 §4 meter reconciliation).
-             *
-             * That is not merely a missing verb. `remove` is what posts the NEGATIVE
-             * `storage.bytes` credit, so without it the storage meter was a monotonic
-             * gross counter for every deployment: a tenant who uploaded and deleted the
-             * same file all month kept paying for it, and the "meter nets to zero"
-             * property the vault-leak fix relies on (05 §A2) had no way to be true in a
-             * running app.
-             *
-             * `false` (unknown / foreign / already-trashed) is a typed 404, exactly as
-             * the service says: the id's existence stays undisclosed and a double
-             * delete is a safe no-op that posts no second credit.
-             */
-            app.delete('/api/asset/items/:id', session, async (c) => {
-                const removed = await service.remove(scopeOf(c), c.req.param('id'));
-                if (!removed)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, removed: true });
-            });
-        }
-        // Vault albums (§2a / §4): page-backed CRUD + ordered membership. Mounted
-        // with the gallery — an album is a way to organize the gallery. The reorder
-        // ACTION is the `asset:reorder-album-member` op, not a route (§4). Membership
-        // writes return `false` for a foreign album/asset → typed 404, existence
-        // undisclosed (the same law the bytes read path follows).
-        if (galleryOn) {
-            const albums = service.albums;
-            app.get('/api/asset/albums', session, async (c) => {
-                return c.json({ success: true, albums: await albums.list(scopeOf(c)) });
-            });
-            app.post('/api/asset/albums', session, async (c) => {
-                const body = await readBody(c);
-                const created = await albums.create(scopeOf(c), { title: requireAlbumTitle(body) });
-                return c.json({ success: true, album: created }, 201);
-            });
-            app.get('/api/asset/albums/:id', session, async (c) => {
-                const album = await albums.get(scopeOf(c), c.req.param('id'));
-                if (!album)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, album });
-            });
-            app.patch('/api/asset/albums/:id', session, async (c) => {
-                const body = await readBody(c);
-                const updated = await albums.update(scopeOf(c), c.req.param('id'), {
-                    title: typeof body.title === 'string' ? body.title : undefined,
-                    coverId: body.coverId === null ? null : typeof body.coverId === 'string' ? body.coverId : undefined,
-                });
-                if (!updated)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, album: updated });
-            });
-            app.delete('/api/asset/albums/:id', session, async (c) => {
-                const deleted = await albums.remove(scopeOf(c), c.req.param('id'));
-                if (!deleted)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true });
-            });
-            app.get('/api/asset/albums/:id/assets', session, async (c) => {
-                return c.json({ success: true, assets: await albums.listAssets(scopeOf(c), c.req.param('id')) });
-            });
-            app.post('/api/asset/albums/:id/assets', session, async (c) => {
-                const body = await readBody(c);
-                if (typeof body.assetId !== 'string' || body.assetId.length === 0)
-                    throw new AppError("Adding an asset to an album requires an 'assetId'.", {
-                        code: 'ALBUM_MEMBER_FIELDS_MISSING',
-                        status: 400,
-                        context: { required: ['assetId'] },
-                    });
-                const position = typeof body.position === 'number' && Number.isFinite(body.position) ? body.position : 0;
-                const added = await albums.addAsset(scopeOf(c), c.req.param('id'), body.assetId, position);
-                // false ⇒ the album OR the asset is not this caller's — 404.
-                if (!added)
-                    throw notFound(`${c.req.param('id')}/${body.assetId}`);
-                return c.json({ success: true }, 201);
-            });
-            app.delete('/api/asset/albums/:id/assets/:assetId', session, async (c) => {
-                const removed = await albums.removeAsset(scopeOf(c), c.req.param('id'), c.req.param('assetId'));
-                if (!removed)
-                    throw notFound(`${c.req.param('id')}/${c.req.param('assetId')}`);
-                return c.json({ success: true });
-            });
-        }
-        if (hlsOn) {
-            // The feature-presence endpoint V7.1 probes: it exists iff `hls` is
-            // effective-on for some instance, so a 404 here IS the fail-closed answer.
-            app.get('/api/asset/hls', (c) => c.json({ success: true, feature: 'hls', enabled: true }));
-            app.get('/api/asset/hls/:id/master.m3u8', session, async (c) => {
-                const playlist = await service.hlsPlaylist(scopeOf(c), c.req.param('id'));
-                if (playlist === null)
-                    throw notFound(c.req.param('id'));
-                return c.body(playlist, 200, { 'Content-Type': 'application/vnd.apple.mpegurl' });
-            });
-        }
-        if (privateOn) {
-            const privateSession = guardFor(ctx, rbacOn, { requirePrivateScope: true });
-            app.get('/api/asset/private/:id', privateSession, async (c) => {
-                const stream = await service.readPrivate(scopeOf(c), c.req.param('id'));
-                // A private item that does not exist for this caller is a 404, not a
-                // 403 — existence is not disclosed (J3-2).
-                if (!stream)
-                    throw notFound(c.req.param('id'));
-                return new Response(stream, { headers: { 'Content-Type': 'application/octet-stream' } });
-            });
-        }
-        // Content-addressed vault upload staging (§2a / §4), mounted behind the
-        // `vaultSource` feature — the write path that feeds `mv_assets`, which is what
-        // `createVaultMediaSource` unions into the asset listing so AssetStudio
-        // replaces Media Vault. Feature-off ⇒ the routes do not exist (R-3, not a
-        // per-request 403). The `meterUpload` gate rides here too: under saas an
-        // over-plan upload is a 402 up front, before a byte streams. The bytes are
-        // hashed WHILE streaming to the ObjectStore in the service (01 §2.5), so a
-        // re-upload of identical bytes dedupes onto the existing asset.
-        if (vaultOn) {
-            // The ENTITLEMENT gate (P2): the vault is a paid-tier feature in the plan
-            // grid, so the WRITE path refuses tenants whose plan excludes it (402 →
-            // upgrade dialog). Reads stay open: a downgraded tenant keeps seeing what
-            // it already stored — taking existing data hostage is not a pricing tier.
-            const vaultEntitled = ctx.enforcer ? [requirePlanFeature(ctx.enforcer, 'asset', 'vaultSource')] : [];
-            app.post('/api/asset/vault/upload', session, ...vaultEntitled, ...meterUpload, async (c) => {
-                const result = await service.vaultUpload(scopeOf(c), c.req.raw);
-                return c.json({ success: true, ...result }, 201);
-            });
-            app.get('/api/asset/vault/uploads/:id', session, async (c) => {
-                // A staging row that is not this caller's is a 404, existence undisclosed.
-                const upload = await service.vaultUploadStatus(scopeOf(c), c.req.param('id'));
-                if (!upload)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, upload });
-            });
-            /*
-             * Vault SOURCE CRUD (`mv_sources`, §2a / §4).
-             *
-             * The repository ops have existed since the vault landed and nothing called
-             * them: a customer could not see, name or retire a source through any
-             * surface, so the table that exists precisely to keep source configuration
-             * OUT of a config file could only be written by a migration or by hand.
-             * That is Law #1's amended first arm (E8) — orphaned because unfinished.
-             *
-             * `PATCH` takes a title and a read-only flag and nothing else. `rootKey` is
-             * the source's security boundary and is fixed at creation: accepting a new
-             * one here would restore, one request away, exactly the re-point-at-`/`
-             * escape that moving this out of config removed. Re-rooting is
-             * delete-and-recreate, which the CDC stream records as what it is.
-             *
-             * A foreign id is a 404 on every verb — existence undisclosed, the same law
-             * the album and bytes paths follow.
-             */
-            const sources = service.sources;
-            app.get('/api/asset/sources', session, async (c) => {
-                return c.json({ success: true, sources: await sources.list(scopeOf(c)) });
-            });
-            app.post('/api/asset/sources', session, async (c) => {
-                const body = await readBody(c);
-                const title = typeof body.title === 'string' ? body.title.trim() : '';
-                const rootKey = typeof body.rootKey === 'string' ? body.rootKey.trim() : '';
-                const kind = typeof body.kind === 'string' ? body.kind : '';
-                // All three together, in ONE error: a caller fixing a form field at a time
-                // pays a round trip per field, and the last one it learns about is the one
-                // it will ship broken.
-                const missing = [
-                    ...(kind === '' ? ['kind'] : []),
-                    ...(title === '' ? ['title'] : []),
-                    ...(rootKey === '' ? ['rootKey'] : []),
-                ];
-                if (missing.length > 0)
-                    throw new AppError(`Creating a source requires ${missing.join(', ')}.`, {
-                        code: 'SOURCE_FIELDS_MISSING',
-                        status: 400,
-                        context: { required: ['kind', 'title', 'rootKey'], missing },
-                    });
-                const created = await sources.create(scopeOf(c), {
-                    kind,
-                    title,
-                    rootKey,
-                    readOnly: body.readOnly === true,
-                });
-                return c.json({ success: true, source: created }, 201);
-            });
-            app.get('/api/asset/sources/:id', session, async (c) => {
-                const source = await sources.get(scopeOf(c), c.req.param('id'));
-                if (!source)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, source });
-            });
-            app.patch('/api/asset/sources/:id', session, async (c) => {
-                const body = await readBody(c);
-                const updated = await sources.update(scopeOf(c), c.req.param('id'), {
-                    title: typeof body.title === 'string' ? body.title : undefined,
-                    readOnly: typeof body.readOnly === 'boolean' ? body.readOnly : undefined,
-                });
-                if (!updated)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true, source: updated });
-            });
-            app.delete('/api/asset/sources/:id', session, async (c) => {
-                const deleted = await sources.remove(scopeOf(c), c.req.param('id'));
-                if (!deleted)
-                    throw notFound(c.req.param('id'));
-                return c.json({ success: true });
-            });
-        }
-        if (ocrOn) {
-            app.post('/api/asset/ocr/:id', session, async (c) => {
-                const result = await service.requestOcr(scopeOf(c), c.req.param('id'));
-                return c.json({ success: true, ...result }, 202);
-            });
-        }
-    };
-}
-/**
- * The scope an unauthenticated listing runs under — LOCAL PROFILE ONLY. The
- * single-user machine's sentinel tenant/user (01 §2), so a repository query is
- * still tenant-scoped rather than unscoped, which is what keeps "public" from
- * meaning "every tenant's rows". Never used under `saas`: the listing route
- * rejects an anonymous saas request rather than binding it to this sentinel,
- * because `t_local` does not exist there.
- */
-const ANONYMOUS = {
-    tenantId: 't_local',
-    userId: 'u_local',
-    role: 'VIEWER',
-    permissions: [],
-    privateScope: false,
-    exp: 0,
-    jti: 'anonymous',
-};
-const notFound = (id) => new AppError(`No asset '${id}' for this tenant.`, {
-    code: 'ENTITY_NOT_FOUND',
-    status: 404,
-    context: { id },
-});
-/** Parse a JSON body, tolerating an empty/absent one as `{}`. */
-const readBody = async (c) => (await c.req.json().catch(() => ({}))) ?? {};
-const requireAlbumTitle = (body) => {
-    if (typeof body.title !== 'string' || body.title.length === 0)
-        throw new AppError("An album requires a non-empty 'title'.", {
-            code: 'ALBUM_FIELDS_MISSING',
-            status: 400,
-            context: { required: ['title'] },
-        });
-    return body.title;
-};
-//# sourceMappingURL=asset.mixin.js.map

package/dist/server/mixins/asset.mixin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"asset.mixin.js","sourceRoot":"","sources":["../../../src/server/mixins/asset.mixin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAA+B,oBAAoB,EAAqB,WAAW,EAAE,MAAM,SAAS,CAAC;AAE5G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,iBAAiB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;AAE/F,kEAAkE;AAClE,MAAM,wBAAwB,GAAsB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;AAEnF,4EAA4E;AAC5E,MAAM,eAAe,GAAG,CAAC,KAAyB,EAAU,EAAE,CAC5D,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,WAA+B,EAAyC,EAAE;IAC5G,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC;IACzG,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAC9H,CAAC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,OAAO,CAAC,GAAW,EAAE,GAAiB,EAAQ,EAAE;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEhE,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,6EAA6E;QAC7E,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ;YAC9B,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;YAC3E,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAElE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAEhF,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;YACzB;;;;;;eAMG;YACH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC/B,wEAAwE;gBACxE,yEAAyE;gBACzE,wEAAwE;gBACxE,wEAAwE;gBACxE,qEAAqE;gBACrE,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,MAAM;oBAC5C,MAAM,IAAI,QAAQ,CAAC,iDAAiD,EAAE;wBACpE,IAAI,EAAE,kBAAkB;wBACxB,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;qBACtD,CAAC,CAAC;gBACL,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAC7B,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,EAC/B,EAAE,aAAa,EAAE,SAAS,IAAI,MAAM,EAAE,YAAY,KAAK,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAC7F,CAAC;gBACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH;;;;;eAKG;YACH,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,IAAI;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC7C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,IAAI,CAAC,MAAM;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;YAEH;;;;;;;;;;;;;eAaG;YACH,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBAC7B,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;oBAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;oBACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,GAAG;yBACZ,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;yBAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;oBACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;wBAC7C,GAAG;wBACH,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;qBACpC,CAAC,CAAC;oBACH,sEAAsE;oBACtE,gEAAgE;oBAChE,IAAI,CAAC,KAAK;wBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAChC,wEAAwE;oBACxE,uEAAuE;oBACvE,mEAAmE;oBACnE,kEAAkE;oBAClE,8BAA8B;oBAC9B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBACtD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE;wBAC9B,OAAO,EAAE;4BACP,cAAc,EAAE,MAAM,CAAC,IAAI;4BAC3B,qBAAqB,EAAE,MAAM,CAAC,WAAW;4BACzC,iEAAiE;4BACjE,6CAA6C;4BAC7C,eAAe,EAAE,qBAAqB;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjE,qEAAqE;gBACrE,0EAA0E;gBAC1E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH;;;;;;;;;;;;;;;;eAgBG;YACH,GAAG,CAAC,MAAM,CAAC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACtD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,8EAA8E;QAC9E,yEAAyE;QACzE,0DAA0D;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAE9B,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACpD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9D,IAAI,CAAC,KAAK;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;oBACjE,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBAC9D,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACpG,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnE,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;oBAC/D,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE;wBACvE,IAAI,EAAE,6BAA6B;wBACnC,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE;qBACnC,CAAC,CAAC;gBACL,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC3F,6DAA6D;gBAC7D,IAAI,CAAC,KAAK;oBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,uCAAuC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAChG,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,oEAAoE;YACpE,2EAA2E;YAC3E,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAE3F,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1E,IAAI,QAAQ,KAAK,IAAI;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxE,qEAAqE;gBACrE,2CAA2C;gBAC3C,IAAI,CAAC,MAAM;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,+EAA+E;QAC/E,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,OAAO,EAAE,CAAC;YACZ,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACzF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3D,2EAA2E;gBAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9E,IAAI,CAAC,MAAM;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH;;;;;;;;;;;;;;;;;eAiBG;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAEhC,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAClD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,2EAA2E;gBAC3E,2EAA2E;gBAC3E,uBAAuB;gBACvB,MAAM,OAAO,GAAG;oBACd,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvC,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBACpB,MAAM,IAAI,QAAQ,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;wBACtE,IAAI,EAAE,uBAAuB;wBAC7B,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE;qBAC7D,CAAC,CAAC;gBACL,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;oBAC/C,IAAI;oBACJ,KAAK;oBACL,OAAO;oBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI;iBACjC,CAAC,CAAC;gBACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACrD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,MAAM;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC/B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;oBAClE,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBAC9D,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;iBACzE,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpE,IAAI,CAAC,OAAO;oBAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAClD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG;IAChB,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,EAAc;IAC3B,YAAY,EAAE,KAAK;IACnB,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,WAAW;CACR,CAAC;AAEX,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAY,EAAE,CACxC,IAAI,QAAQ,CAAC,aAAa,EAAE,oBAAoB,EAAE;IAChD,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,EAAE,EAAE,EAAE;CAChB,CAAC,CAAC;AAEL,iEAAiE;AACjE,MAAM,QAAQ,GAAG,KAAK,EAAE,CAA4C,EAAoC,EAAE,CACvG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA6B,IAAI,EAAE,CAAC;AAE5E,MAAM,iBAAiB,GAAG,CAAC,IAA6B,EAAU,EAAE;IAClE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE;YAC3D,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;SACjC,CAAC,CAAC;IACL,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC,CAAC"}

package/dist/server/mixins/billing.mixin.d.ts

@@ -1,49 +0,0 @@
-/**
- * `billingMixin` (03 §7.4) — composed only under the saas profile.
- *
- * Engines contain **zero** billing logic. The `CognitiveGateway` and metered
- * repositories emit `meter_events` (01 §4); this mixin reads plan limits and
- * raises `USAGE_LIMIT_EXCEEDED`, which the shell renders as the upgrade dialog
- * in the `overlay` band via Slot & Fill. Keeping the check here rather than
- * inside each engine is what stops "did we remember to meter this feature?" from
- * becoming a per-engine question.
- */
-import type { PlanDefinition } from '../services/billingService';
-import { type CCHono, type MixinContext } from './types';
-export interface PlanUsage {
-    metric: string;
-    used: number;
-    limit: number;
-}
-export interface BillingService {
-    usage(tenantId: string): Promise<readonly PlanUsage[]>;
-    /** The tenant's FULL plan — id/title for the upgrade dialog, `features` for
-     *  the entitlement gate (`requirePlanFeature`), `limits` for completeness.
-     *  (Type-only import from the service module; no runtime cycle.) */
-    plan(tenantId: string): Promise<PlanDefinition>;
-}
-export declare const USAGE_LIMIT_EXCEEDED = "USAGE_LIMIT_EXCEEDED";
-/**
- * **`assertWithinPlan` was DELETED here (05 §B3, 2026-07-26).** It checked every
- * metric in a usage view at once and threw `USAGE_LIMIT_EXCEEDED` for the first
- * one at its ceiling. It never had a call site, and it is not an unfinished seam
- * — it is a WEAKER duplicate of two landed, wired checks, which is why it is a
- * deletion under amended Law #1 Arm 2 rather than a keep-and-finish:
- *
- *   * `assertMetricWithinPlan(usage, metric, cost)` (`services/billingService.ts`)
- *     is the same check done RIGHT: it takes the cost the operation is about to
- *     consume, so a request that WOULD cross the ceiling is refused instead of
- *     being the one that crosses it. `assertWithinPlan` could only ever notice
- *     after the tokens were already spent.
- *   * `requireWithinPlan(enforcer, metric)` (`mixins/enforcement.ts`) is the
- *     route-level middleware that actually runs in the product, composed at
- *     mixin-composition time so "did we remember to check" is answered
- *     structurally rather than per handler.
- *
- * An aggregate "is this tenant over on anything" question is a READ, not a
- * throw: `GET /api/billing/usage` already answers it, and the upgrade dialog is
- * that answer's surface. Reviving a whole-view assertion would re-introduce a
- * post-hoc gate beside a pre-check that supersedes it.
- */
-export declare function createBillingMixin(service: BillingService): (app: CCHono, ctx: MixinContext) => void;
-//# sourceMappingURL=billing.mixin.d.ts.map

package/dist/server/mixins/billing.mixin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"billing.mixin.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/billing.mixin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAe,MAAM,SAAS,CAAC;AAEtE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACvD;;wEAEoE;IACpE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACjD;AAED,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,IAChD,KAAK,MAAM,EAAE,KAAK,YAAY,KAAG,IAAI,CAS9C"}

package/dist/server/mixins/billing.mixin.js

@@ -1,36 +0,0 @@
-import { guardFor } from './security';
-import { rbacEnabled } from './types';
-export const USAGE_LIMIT_EXCEEDED = 'USAGE_LIMIT_EXCEEDED';
-/**
- * **`assertWithinPlan` was DELETED here (05 §B3, 2026-07-26).** It checked every
- * metric in a usage view at once and threw `USAGE_LIMIT_EXCEEDED` for the first
- * one at its ceiling. It never had a call site, and it is not an unfinished seam
- * — it is a WEAKER duplicate of two landed, wired checks, which is why it is a
- * deletion under amended Law #1 Arm 2 rather than a keep-and-finish:
- *
- *   * `assertMetricWithinPlan(usage, metric, cost)` (`services/billingService.ts`)
- *     is the same check done RIGHT: it takes the cost the operation is about to
- *     consume, so a request that WOULD cross the ceiling is refused instead of
- *     being the one that crosses it. `assertWithinPlan` could only ever notice
- *     after the tokens were already spent.
- *   * `requireWithinPlan(enforcer, metric)` (`mixins/enforcement.ts`) is the
- *     route-level middleware that actually runs in the product, composed at
- *     mixin-composition time so "did we remember to check" is answered
- *     structurally rather than per handler.
- *
- * An aggregate "is this tenant over on anything" question is a READ, not a
- * throw: `GET /api/billing/usage` already answers it, and the upgrade dialog is
- * that answer's surface. Reviving a whole-view assertion would re-introduce a
- * post-hoc gate beside a pre-check that supersedes it.
- */
-export function createBillingMixin(service) {
-    return (app, ctx) => {
-        const session = guardFor(ctx, rbacEnabled(ctx));
-        app.get('/api/billing/usage', session, async (c) => {
-            const { tenantId } = c.get('claims');
-            const [usage, plan] = await Promise.all([service.usage(tenantId), service.plan(tenantId)]);
-            return c.json({ success: true, plan, usage });
-        });
-    };
-}
-//# sourceMappingURL=billing.mixin.js.map

package/dist/server/mixins/billing.mixin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"billing.mixin.js","sourceRoot":"","sources":["../../../src/server/mixins/billing.mixin.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAkC,WAAW,EAAE,MAAM,SAAS,CAAC;AAgBtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,CAAC,GAAW,EAAE,GAAiB,EAAQ,EAAE;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAEhD,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/mixins/core.mixin.d.ts

@@ -1,14 +0,0 @@
-import type { EffectiveManifest } from '../../verify/types';
-import type { ServerMixin } from './types';
-/**
- * Build the pinned policy. Exported so the V7 probe and the generated app's
- * static asset server assert against the SAME string rather than a copy that can
- * drift.
- */
-export declare function buildCsp(manifest: EffectiveManifest): string;
-export declare const SECURITY_HEADERS: {
-    readonly 'X-Content-Type-Options': "nosniff";
-    readonly 'Referrer-Policy': "same-origin";
-};
-export declare const coreMixin: ServerMixin;
-//# sourceMappingURL=core.mixin.d.ts.map

package/dist/server/mixins/core.mixin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"core.mixin.d.ts","sourceRoot":"","sources":["../../../src/server/mixins/core.mixin.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,OAAO,KAAK,EAAwB,WAAW,EAAE,MAAM,SAAS,CAAC;AA2BjE;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAgB5D;AAED,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAEX,eAAO,MAAM,SAAS,EAAE,WAyHvB,CAAC"}