@aglyn/aglyn 1.0.0-beta.143

package/src/lib/app-utils/media-cdn-scope.js

@@ -0,0 +1,75 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The media CDN's scope grammar and the verdict it reaches under it
+ * (AGL-1043), as pure functions.
+ *
+ * `serveMediaCdn` enforces them and re-exports them, so the handler remains
+ * the authority. They live here, in a module with no server dependency,
+ * because two other readers have to reach the verdict the handler reaches
+ * before it serves a file:
+ *
+ * - the tenant composition, which lays a placed asset's current facts over its
+ *   node only when the page's own URL would be served
+ *   (`libs/tenant/runtime/src/lib/get-media-asset-facts.ts`);
+ * - the besigner canvas and Preview, which read the same document in the
+ *   browser so an author is shown what a visitor gets.
+ *
+ * Both reach it through `mediaAssetFactsFromDocument` in
+ * `media-asset-facts.ts`. A copy in either would be a second rule, free to
+ * disagree with the one that refuses the bytes.
+ *
+ * Out of every barrel: the handler, the composition and the editor import it
+ * by path, and nothing here has a reason to reach a published page's bundle.
+ */ import { isOrgWideScope, visibleToHost } from "./scope-tokens.js";
+/** One CDN path segment: a host id, an org id, a media id or a content hash. */ export const MEDIA_CDN_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/;
+export function parseMediaCdnScope(scopeSegment) {
+    if (!scopeSegment.startsWith('org:')) {
+        return MEDIA_CDN_SEGMENT.test(scopeSegment) ? {
+            isOrg: false,
+            scopeId: scopeSegment
+        } : null;
+    }
+    const parts = scopeSegment.slice('org:'.length).split(':');
+    if (parts.length > 2) return null;
+    const [scopeId, contextHostId] = parts;
+    if (!MEDIA_CDN_SEGMENT.test(scopeId != null ? scopeId : '')) return null;
+    if (contextHostId !== undefined && !MEDIA_CDN_SEGMENT.test(contextHostId)) {
+        return null;
+    }
+    return _extends({
+        isOrg: true,
+        scopeId
+    }, contextHostId ? {
+        contextHostId
+    } : {});
+}
+/** Why the asset is refused under this URL; `null` when it is not. */ export function mediaCdnScopeRefusal(scope, visibleTo) {
+    // Host-library assets are private by construction and carry no
+    // `visibleTo`, so only the org branch is scoped at all.
+    if (!scope.isOrg) return null;
+    if (!Array.isArray(visibleTo)) return 'unscoped';
+    if (!visibleTo.length) return 'no-sites';
+    const scoped = visibleTo;
+    const allowed = scope.contextHostId ? visibleToHost(scoped, scope.contextHostId) : isOrgWideScope(scoped);
+    return allowed ? null : 'restricted';
+}
+/** Whether the asset may be served under this URL. */ export function mediaCdnAllows(scope, visibleTo) {
+    return mediaCdnScopeRefusal(scope, visibleTo) === null;
+}
+
+//# sourceMappingURL=media-cdn-scope.js.map

package/src/lib/app-utils/media-cdn-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/media-cdn-scope.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The media CDN's scope grammar and the verdict it reaches under it\n * (AGL-1043), as pure functions.\n *\n * `serveMediaCdn` enforces them and re-exports them, so the handler remains\n * the authority. They live here, in a module with no server dependency,\n * because two other readers have to reach the verdict the handler reaches\n * before it serves a file:\n *\n * - the tenant composition, which lays a placed asset's current facts over its\n *   node only when the page's own URL would be served\n *   (`libs/tenant/runtime/src/lib/get-media-asset-facts.ts`);\n * - the besigner canvas and Preview, which read the same document in the\n *   browser so an author is shown what a visitor gets.\n *\n * Both reach it through `mediaAssetFactsFromDocument` in\n * `media-asset-facts.ts`. A copy in either would be a second rule, free to\n * disagree with the one that refuses the bytes.\n *\n * Out of every barrel: the handler, the composition and the editor import it\n * by path, and nothing here has a reason to reach a published page's bundle.\n */\n\nimport { isOrgWideScope, visibleToHost } from './scope-tokens'\n\n/** One CDN path segment: a host id, an org id, a media id or a content hash. */\nexport const MEDIA_CDN_SEGMENT = /^[A-Za-z0-9_-]{1,64}$/\n\n/**\n * The parsed CDN scope segment (AGL-1043). Shapes:\n *\n * - `{hostId}` — that host's own library\n * - `org:{orgId}` — the org library, ORG-WIDE assets only\n * - `org:{orgId}:{hostId}` — an org asset in one site's context\n *\n * The host is in the URL rather than sniffed from the `Host` header on\n * purpose. A header is the requester's CHOICE: anyone holding a restricted\n * asset's id could fetch it through a domain that IS permitted and get the\n * bytes, so header-based enforcement stops accidents while looking like a\n * boundary. Here the decision is a pure function of (URL, doc), and since\n * the cache key IS the URL, one host's answer can never reach another.\n */\nexport interface MediaCdnScope {\n  isOrg: boolean\n  scopeId: string\n  /** Only on the `org:{orgId}:{hostId}` form. */\n  contextHostId?: string\n}\n\nexport function parseMediaCdnScope(\n  scopeSegment: string,\n): MediaCdnScope | null {\n  if (!scopeSegment.startsWith('org:')) {\n    return MEDIA_CDN_SEGMENT.test(scopeSegment)\n      ? { isOrg: false, scopeId: scopeSegment }\n      : null\n  }\n  const parts = scopeSegment.slice('org:'.length).split(':')\n  if (parts.length > 2) return null\n  const [scopeId, contextHostId] = parts\n  if (!MEDIA_CDN_SEGMENT.test(scopeId ?? '')) return null\n  if (contextHostId !== undefined && !MEDIA_CDN_SEGMENT.test(contextHostId)) {\n    return null\n  }\n  return {\n    isOrg: true,\n    scopeId,\n    ...(contextHostId ? { contextHostId } : {}),\n  }\n}\n\n/**\n * The three ways an org asset can be refused under a CDN URL.\n *\n * They are one 404 on the wire — whether a restricted asset exists is not\n * something an anonymous caller has standing to learn — and three different\n * faults to whoever is looking at the broken page:\n *\n * - `restricted` — the asset carries a scope and this URL is not in it. The\n *   URL is what is wrong: a restricted asset has to be requested through the\n *   form that names the site (`hostQualifiedCdnPath`), and the same asset\n *   serves normally from the site it is shared with.\n * - `unscoped` — no `visibleTo` at all, so the asset is undeliverable under\n *   EVERY URL form there is. The document is what is wrong, and it means a\n *   creation path wrote it without a scope: `newResourceScopeFields` is what\n *   stops that at compile time, and the scope backfill is what repairs the\n *   documents already written (`docs/SCOPE_DRIFT.md`).\n * - `no-sites` — a stored empty array: somebody chose nobody. Equally\n *   undeliverable, and NOT repairable by the backfill, which leaves an empty\n *   array alone rather than widening a resource nobody asked to widen — so\n *   this one needs a person either way.\n */\nexport type MediaCdnScopeRefusal = 'restricted' | 'unscoped' | 'no-sites'\n\n/** Why the asset is refused under this URL; `null` when it is not. */\nexport function mediaCdnScopeRefusal(\n  scope: MediaCdnScope,\n  visibleTo: unknown,\n): MediaCdnScopeRefusal | null {\n  // Host-library assets are private by construction and carry no\n  // `visibleTo`, so only the org branch is scoped at all.\n  if (!scope.isOrg) return null\n  if (!Array.isArray(visibleTo)) return 'unscoped'\n  if (!visibleTo.length) return 'no-sites'\n  const scoped = visibleTo as string[]\n  const allowed = scope.contextHostId\n    ? visibleToHost(scoped, scope.contextHostId)\n    : isOrgWideScope(scoped)\n  return allowed ? null : 'restricted'\n}\n\n/** Whether the asset may be served under this URL. */\nexport function mediaCdnAllows(\n  scope: MediaCdnScope,\n  visibleTo: unknown,\n): boolean {\n  return mediaCdnScopeRefusal(scope, visibleTo) === null\n}\n"],"names":["isOrgWideScope","visibleToHost","MEDIA_CDN_SEGMENT","parseMediaCdnScope","scopeSegment","startsWith","test","isOrg","scopeId","parts","slice","length","split","contextHostId","undefined","mediaCdnScopeRefusal","scope","visibleTo","Array","isArray","scoped","allowed","mediaCdnAllows"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;CAqBC,GAED,SAASA,cAAc,EAAEC,aAAa,QAAQ,oBAAgB;AAE9D,8EAA8E,GAC9E,OAAO,MAAMC,oBAAoB,wBAAuB;AAuBxD,OAAO,SAASC,mBACdC,YAAoB;IAEpB,IAAI,CAACA,aAAaC,UAAU,CAAC,SAAS;QACpC,OAAOH,kBAAkBI,IAAI,CAACF,gBAC1B;YAAEG,OAAO;YAAOC,SAASJ;QAAa,IACtC;IACN;IACA,MAAMK,QAAQL,aAAaM,KAAK,CAAC,OAAOC,MAAM,EAAEC,KAAK,CAAC;IACtD,IAAIH,MAAME,MAAM,GAAG,GAAG,OAAO;IAC7B,MAAM,CAACH,SAASK,cAAc,GAAGJ;IACjC,IAAI,CAACP,kBAAkBI,IAAI,CAACE,kBAAAA,UAAW,KAAK,OAAO;IACnD,IAAIK,kBAAkBC,aAAa,CAACZ,kBAAkBI,IAAI,CAACO,gBAAgB;QACzE,OAAO;IACT;IACA,OAAO;QACLN,OAAO;QACPC;OACIK,gBAAgB;QAAEA;IAAc,IAAI,CAAC;AAE7C;AAyBA,oEAAoE,GACpE,OAAO,SAASE,qBACdC,KAAoB,EACpBC,SAAkB;IAElB,+DAA+D;IAC/D,wDAAwD;IACxD,IAAI,CAACD,MAAMT,KAAK,EAAE,OAAO;IACzB,IAAI,CAACW,MAAMC,OAAO,CAACF,YAAY,OAAO;IACtC,IAAI,CAACA,UAAUN,MAAM,EAAE,OAAO;IAC9B,MAAMS,SAASH;IACf,MAAMI,UAAUL,MAAMH,aAAa,GAC/BZ,cAAcmB,QAAQJ,MAAMH,aAAa,IACzCb,eAAeoB;IACnB,OAAOC,UAAU,OAAO;AAC1B;AAEA,oDAAoD,GACpD,OAAO,SAASC,eACdN,KAAoB,EACpBC,SAAkB;IAElB,OAAOF,qBAAqBC,OAAOC,eAAe;AACpD"}

package/src/lib/app-utils/media-folders.d.ts

@@ -0,0 +1,161 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Media folder hierarchy (AGL-171): first-class folders at
+ * `hosts/{hostId}/mediaFolders/{folderId}` replacing the AGL-124 free-text
+ * `folder` string on media docs. Console UI and any future API share these
+ * helpers so depth/cycle/name rules can't disagree.
+ *
+ * Delete policy (documented per the issue): deleting a folder re-parents
+ * its child folders and assets to the deleted folder's parent — nothing is
+ * ever orphaned and no delete is blocked.
+ */
+import type { ScopeToken } from './scope-tokens';
+export interface AglynMediaFolder {
+    name: string;
+    /** Parent folder id; null/undefined = root. */
+    parentId?: string | null;
+    /** Sibling sort position. */
+    order?: number;
+}
+export interface NewMediaFolderInput {
+    name: string;
+    parentId: string | null;
+    /**
+     * `serverTimestamp()` from whichever SDK the caller holds — this module
+     * stays free of both the client and admin Firestore packages.
+     */
+    createdAt: unknown;
+    /**
+     * Who may see the folder (AGL-1037). **Required**, with no default: the
+     * whole of AGL-1466 was two call sites that each built the document
+     * inline and each forgot the field, so the type is what stops a third.
+     *
+     * `null` means a SITE library — `hosts/{hostId}/mediaFolders` is private
+     * by construction and stores no scope, the same rule the site-export
+     * import path follows and the reason `scopedToHost` refuses a host ref.
+     */
+    visibleTo: readonly ScopeToken[] | null;
+}
+/**
+ * The document a media folder is created with (AGL-1466).
+ *
+ * Every `mediaFolders` create goes through here. Before it, the console
+ * wrote `{ name, parentId, createdAt }` from the NEW FOLDER button and from
+ * the legacy-string migration, so a folder in an ORG library landed with no
+ * `visibleTo` — and both enforcement layers fail closed on a missing field
+ * (`array-contains-any` matches nothing, the rules' `hasAny` errors). The
+ * result was a library that looked right on the org page and collapsed into
+ * "No folder" the moment it was opened for a site, because the folders were
+ * gone and only their files remained.
+ */
+export declare function newMediaFolderDoc(input: NewMediaFolderInput): Record<string, unknown>;
+/** What separates the segments of a folder path in a picker row. */
+export declare const MEDIA_FOLDER_PATH_SEPARATOR = " / ";
+/** One row of a folder picker (AGL-1470). */
+export interface MediaFolderChoice {
+    $id: string;
+    /** The folder's own name, for a caller that indents instead. */
+    name: string;
+    /** Ancestors then self: `['Blog', 'Covers']`. */
+    path: string[];
+    /** `Blog / Covers` — what a picker row must show. */
+    label: string;
+    /** 0 for a root folder; an indent level. */
+    depth: number;
+}
+/**
+ * The folder list a PICKER may show (AGL-1470).
+ *
+ * A picker that shows bare names is not merely terse. Duplicate names across
+ * parents are normal — `Covers`, `Images`, `Archive`, `2026` — and with
+ * `Blog/Covers` and `Press/Covers` both present, MOVE TO FOLDER… drew two
+ * rows reading exactly `Covers`. Choosing the wrong one is **silent**: a move
+ * is copy-then-delete, so the object is rewritten under a different prefix,
+ * and because every reference to it is by id, nothing breaks. No error, no
+ * missing image — the file is simply filed where nobody will look for it, and
+ * the mistake is undetectable from the site.
+ *
+ * So the label carries the whole path, and the order is the sidebar's:
+ * depth-first, each child directly under its parent, siblings by `order` then
+ * name. The rail computed that hierarchy correctly the whole time; the
+ * pickers beside it threw it away.
+ *
+ * Two robustness rules, both chosen to keep a destination REACHABLE rather
+ * than tidy:
+ *
+ * - **A folder whose parent is missing is kept, at the root.** A scoped
+ *   collaborator's read set can admit a child and refuse its parent
+ *   (AGL-1466), and dropping the child would remove a real destination from
+ *   the menu — a worse failure than an unindented row.
+ * - **A cycle terminates.** This runs on every render of an open picker.
+ */
+export declare function mediaFolderChoices(folders: ReadonlyArray<AglynMediaFolder & {
+    $id: string;
+}>): MediaFolderChoice[];
+/** Nesting cap, enforced in UI and validation (root children = depth 1). */
+export declare const MEDIA_FOLDER_MAX_DEPTH = 5;
+export declare const MEDIA_FOLDER_NAME_MAX_LENGTH = 60;
+/**
+ * Trims and collapses whitespace; null when empty or over the length cap
+ * so callers reject rather than store junk.
+ */
+export declare function normalizeFolderName(input: string): string | null;
+/**
+ * Depth of a folder (root children = 1). Broken parent links and cycles
+ * both terminate: unknown parents count as root, and a revisited id stops
+ * the walk (treated as max depth so validation refuses to make it worse).
+ */
+export declare function folderDepth(folderId: string, foldersById: Record<string, AglynMediaFolder>): number;
+/**
+ * True when re-parenting `folderId` under `newParentId` would create a
+ * cycle — i.e. the new parent is the folder itself or one of its
+ * descendants (the parent chain from `newParentId` reaches `folderId`).
+ */
+export declare function wouldCreateCycle(folderId: string, newParentId: string | null | undefined, foldersById: Record<string, AglynMediaFolder>): boolean;
+/**
+ * Case-insensitive sibling-name uniqueness per parent. `excludeId` skips
+ * the folder being renamed/moved itself.
+ */
+export declare function isSiblingNameTaken(name: string, parentId: string | null | undefined, folders: Array<AglynMediaFolder & {
+    $id: string;
+}>, excludeId?: string): boolean;
+export interface LegacyFolderMigrationPlan {
+    /** Root-level folder names that must be created (deduped, ordered). */
+    foldersToCreate: string[];
+    /**
+     * Media doc id → legacy folder name (lower-cased key match against
+     * created/existing root folders happens at execution time).
+     */
+    assignments: Array<{
+        mediaId: string;
+        folderName: string;
+    }>;
+}
+/**
+ * Migration plan from flat AGL-124 `folder` strings: one root folder per
+ * distinct legacy string (case-insensitive; existing root folders with a
+ * matching name are reused, not duplicated), and a `folderId` stamp for
+ * every media doc that still carries a legacy string but no `folderId`.
+ */
+export declare function planLegacyFolderMigration(mediaDocs: Array<{
+    $id: string;
+    folder?: string;
+    folderId?: string | null;
+}>, existingFolders: Array<AglynMediaFolder & {
+    $id: string;
+}>): LegacyFolderMigrationPlan;

package/src/lib/app-utils/media-folders.js

@@ -0,0 +1,230 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Media folder hierarchy (AGL-171): first-class folders at
+ * `hosts/{hostId}/mediaFolders/{folderId}` replacing the AGL-124 free-text
+ * `folder` string on media docs. Console UI and any future API share these
+ * helpers so depth/cycle/name rules can't disagree.
+ *
+ * Delete policy (documented per the issue): deleting a folder re-parents
+ * its child folders and assets to the deleted folder's parent — nothing is
+ * ever orphaned and no delete is blocked.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * The document a media folder is created with (AGL-1466).
+ *
+ * Every `mediaFolders` create goes through here. Before it, the console
+ * wrote `{ name, parentId, createdAt }` from the NEW FOLDER button and from
+ * the legacy-string migration, so a folder in an ORG library landed with no
+ * `visibleTo` — and both enforcement layers fail closed on a missing field
+ * (`array-contains-any` matches nothing, the rules' `hasAny` errors). The
+ * result was a library that looked right on the org page and collapsed into
+ * "No folder" the moment it was opened for a site, because the folders were
+ * gone and only their files remained.
+ */ export function newMediaFolderDoc(input) {
+    const { name, parentId, createdAt, visibleTo } = input;
+    // An EMPTY array is the one value that must never be stored. Unlike a
+    // missing field it is a written "visible to nobody" — the backfill leaves
+    // it alone by design and no read path treats it as legacy — so it is
+    // permanent rather than repairable. Getting here means a caller computed
+    // a scope and came back with nothing, which is a bug worth a stack trace
+    // rather than a folder nobody will ever see again.
+    if (visibleTo && !visibleTo.length) {
+        throw new Error('A media folder cannot be created with an empty scope');
+    }
+    return _extends({
+        name,
+        parentId,
+        createdAt
+    }, visibleTo ? {
+        visibleTo: [
+            ...visibleTo
+        ]
+    } : {});
+}
+/** What separates the segments of a folder path in a picker row. */ export const MEDIA_FOLDER_PATH_SEPARATOR = ' / ';
+/**
+ * The folder list a PICKER may show (AGL-1470).
+ *
+ * A picker that shows bare names is not merely terse. Duplicate names across
+ * parents are normal — `Covers`, `Images`, `Archive`, `2026` — and with
+ * `Blog/Covers` and `Press/Covers` both present, MOVE TO FOLDER… drew two
+ * rows reading exactly `Covers`. Choosing the wrong one is **silent**: a move
+ * is copy-then-delete, so the object is rewritten under a different prefix,
+ * and because every reference to it is by id, nothing breaks. No error, no
+ * missing image — the file is simply filed where nobody will look for it, and
+ * the mistake is undetectable from the site.
+ *
+ * So the label carries the whole path, and the order is the sidebar's:
+ * depth-first, each child directly under its parent, siblings by `order` then
+ * name. The rail computed that hierarchy correctly the whole time; the
+ * pickers beside it threw it away.
+ *
+ * Two robustness rules, both chosen to keep a destination REACHABLE rather
+ * than tidy:
+ *
+ * - **A folder whose parent is missing is kept, at the root.** A scoped
+ *   collaborator's read set can admit a child and refuse its parent
+ *   (AGL-1466), and dropping the child would remove a real destination from
+ *   the menu — a worse failure than an unindented row.
+ * - **A cycle terminates.** This runs on every render of an open picker.
+ */ export function mediaFolderChoices(folders) {
+    const byId = new Map(folders.map((folder)=>[
+            folder.$id,
+            folder
+        ]));
+    /** True when the parent link leads somewhere real and does not loop back. */ const hasUsableParent = (folder)=>{
+        var _folder_parentId;
+        const seen = new Set([
+            folder.$id
+        ]);
+        let cursor = (_folder_parentId = folder.parentId) != null ? _folder_parentId : null;
+        while(cursor){
+            var _parent_parentId;
+            if (seen.has(cursor)) return false;
+            const parent = byId.get(cursor);
+            if (!parent) return false;
+            seen.add(cursor);
+            cursor = (_parent_parentId = parent.parentId) != null ? _parent_parentId : null;
+        }
+        return Boolean(folder.parentId);
+    };
+    const childrenOf = new Map();
+    for (const folder of folders){
+        var _childrenOf_get;
+        // Same normalisation the rail applies: anything without a resolvable
+        // parent chain is drawn as a root rather than dropped.
+        const parent = hasUsableParent(folder) ? folder.parentId : null;
+        childrenOf.set(parent, [
+            ...(_childrenOf_get = childrenOf.get(parent)) != null ? _childrenOf_get : [],
+            folder
+        ]);
+    }
+    for (const siblings of childrenOf.values()){
+        siblings.sort((a, b)=>{
+            var _a_order, _b_order;
+            return ((_a_order = a.order) != null ? _a_order : 0) - ((_b_order = b.order) != null ? _b_order : 0) || String(a.name).localeCompare(String(b.name));
+        });
+    }
+    const choices = [];
+    const walk = (parentId, path)=>{
+        var _childrenOf_get;
+        for (const folder of (_childrenOf_get = childrenOf.get(parentId)) != null ? _childrenOf_get : []){
+            const nextPath = [
+                ...path,
+                folder.name
+            ];
+            choices.push({
+                $id: folder.$id,
+                name: folder.name,
+                path: nextPath,
+                label: nextPath.join(MEDIA_FOLDER_PATH_SEPARATOR),
+                depth: nextPath.length - 1
+            });
+            walk(folder.$id, nextPath);
+        }
+    };
+    walk(null, []);
+    return choices;
+}
+/** Nesting cap, enforced in UI and validation (root children = depth 1). */ export const MEDIA_FOLDER_MAX_DEPTH = 5;
+export const MEDIA_FOLDER_NAME_MAX_LENGTH = 60;
+/**
+ * Trims and collapses whitespace; null when empty or over the length cap
+ * so callers reject rather than store junk.
+ */ export function normalizeFolderName(input) {
+    const name = String(input != null ? input : '').replace(/\s+/g, ' ').trim();
+    if (!name || name.length > MEDIA_FOLDER_NAME_MAX_LENGTH) return null;
+    return name;
+}
+/**
+ * Depth of a folder (root children = 1). Broken parent links and cycles
+ * both terminate: unknown parents count as root, and a revisited id stops
+ * the walk (treated as max depth so validation refuses to make it worse).
+ */ export function folderDepth(folderId, foldersById) {
+    let depth = 0;
+    const seen = new Set();
+    let current = folderId;
+    while(current && foldersById[current]){
+        if (seen.has(current)) return MEDIA_FOLDER_MAX_DEPTH;
+        seen.add(current);
+        depth += 1;
+        current = foldersById[current].parentId;
+    }
+    return depth;
+}
+/**
+ * True when re-parenting `folderId` under `newParentId` would create a
+ * cycle — i.e. the new parent is the folder itself or one of its
+ * descendants (the parent chain from `newParentId` reaches `folderId`).
+ */ export function wouldCreateCycle(folderId, newParentId, foldersById) {
+    const seen = new Set();
+    let current = newParentId;
+    while(current){
+        var _foldersById_current;
+        if (current === folderId) return true;
+        if (seen.has(current)) return true;
+        seen.add(current);
+        current = (_foldersById_current = foldersById[current]) == null ? void 0 : _foldersById_current.parentId;
+    }
+    return false;
+}
+/**
+ * Case-insensitive sibling-name uniqueness per parent. `excludeId` skips
+ * the folder being renamed/moved itself.
+ */ export function isSiblingNameTaken(name, parentId, folders, excludeId) {
+    const target = name.trim().toLowerCase();
+    const parent = parentId != null ? parentId : null;
+    return folders.some((folder)=>{
+        var _folder_parentId;
+        return folder.$id !== excludeId && ((_folder_parentId = folder.parentId) != null ? _folder_parentId : null) === parent && folder.name.trim().toLowerCase() === target;
+    });
+}
+/**
+ * Migration plan from flat AGL-124 `folder` strings: one root folder per
+ * distinct legacy string (case-insensitive; existing root folders with a
+ * matching name are reused, not duplicated), and a `folderId` stamp for
+ * every media doc that still carries a legacy string but no `folderId`.
+ */ export function planLegacyFolderMigration(mediaDocs, existingFolders) {
+    const existingRootNames = new Set(existingFolders.filter((folder)=>{
+        var _folder_parentId;
+        return ((_folder_parentId = folder.parentId) != null ? _folder_parentId : null) === null;
+    }).map((folder)=>folder.name.trim().toLowerCase()));
+    const toCreate = new Map();
+    const assignments = [];
+    for (const media of mediaDocs){
+        var _media_folder;
+        if (media.folderId) continue;
+        const name = normalizeFolderName((_media_folder = media.folder) != null ? _media_folder : '');
+        if (!name) continue;
+        const key = name.toLowerCase();
+        if (!existingRootNames.has(key) && !toCreate.has(key)) {
+            toCreate.set(key, name);
+        }
+        assignments.push({
+            mediaId: media.$id,
+            folderName: name
+        });
+    }
+    return {
+        foldersToCreate: [
+            ...toCreate.values()
+        ].sort(),
+        assignments
+    };
+}
+
+//# sourceMappingURL=media-folders.js.map

package/src/lib/app-utils/media-folders.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/media-folders.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Media folder hierarchy (AGL-171): first-class folders at\n * `hosts/{hostId}/mediaFolders/{folderId}` replacing the AGL-124 free-text\n * `folder` string on media docs. Console UI and any future API share these\n * helpers so depth/cycle/name rules can't disagree.\n *\n * Delete policy (documented per the issue): deleting a folder re-parents\n * its child folders and assets to the deleted folder's parent — nothing is\n * ever orphaned and no delete is blocked.\n */\n\nimport type { ScopeToken } from './scope-tokens'\n\nexport interface AglynMediaFolder {\n  name: string\n  /** Parent folder id; null/undefined = root. */\n  parentId?: string | null\n  /** Sibling sort position. */\n  order?: number\n}\n\nexport interface NewMediaFolderInput {\n  name: string\n  parentId: string | null\n  /**\n   * `serverTimestamp()` from whichever SDK the caller holds — this module\n   * stays free of both the client and admin Firestore packages.\n   */\n  createdAt: unknown\n  /**\n   * Who may see the folder (AGL-1037). **Required**, with no default: the\n   * whole of AGL-1466 was two call sites that each built the document\n   * inline and each forgot the field, so the type is what stops a third.\n   *\n   * `null` means a SITE library — `hosts/{hostId}/mediaFolders` is private\n   * by construction and stores no scope, the same rule the site-export\n   * import path follows and the reason `scopedToHost` refuses a host ref.\n   */\n  visibleTo: readonly ScopeToken[] | null\n}\n\n/**\n * The document a media folder is created with (AGL-1466).\n *\n * Every `mediaFolders` create goes through here. Before it, the console\n * wrote `{ name, parentId, createdAt }` from the NEW FOLDER button and from\n * the legacy-string migration, so a folder in an ORG library landed with no\n * `visibleTo` — and both enforcement layers fail closed on a missing field\n * (`array-contains-any` matches nothing, the rules' `hasAny` errors). The\n * result was a library that looked right on the org page and collapsed into\n * \"No folder\" the moment it was opened for a site, because the folders were\n * gone and only their files remained.\n */\nexport function newMediaFolderDoc(\n  input: NewMediaFolderInput,\n): Record<string, unknown> {\n  const { name, parentId, createdAt, visibleTo } = input\n  // An EMPTY array is the one value that must never be stored. Unlike a\n  // missing field it is a written \"visible to nobody\" — the backfill leaves\n  // it alone by design and no read path treats it as legacy — so it is\n  // permanent rather than repairable. Getting here means a caller computed\n  // a scope and came back with nothing, which is a bug worth a stack trace\n  // rather than a folder nobody will ever see again.\n  if (visibleTo && !visibleTo.length) {\n    throw new Error('A media folder cannot be created with an empty scope')\n  }\n  return {\n    name,\n    parentId,\n    createdAt,\n    ...(visibleTo ? { visibleTo: [...visibleTo] } : {}),\n  }\n}\n\n/** What separates the segments of a folder path in a picker row. */\nexport const MEDIA_FOLDER_PATH_SEPARATOR = ' / '\n\n/** One row of a folder picker (AGL-1470). */\nexport interface MediaFolderChoice {\n  $id: string\n  /** The folder's own name, for a caller that indents instead. */\n  name: string\n  /** Ancestors then self: `['Blog', 'Covers']`. */\n  path: string[]\n  /** `Blog / Covers` — what a picker row must show. */\n  label: string\n  /** 0 for a root folder; an indent level. */\n  depth: number\n}\n\n/**\n * The folder list a PICKER may show (AGL-1470).\n *\n * A picker that shows bare names is not merely terse. Duplicate names across\n * parents are normal — `Covers`, `Images`, `Archive`, `2026` — and with\n * `Blog/Covers` and `Press/Covers` both present, MOVE TO FOLDER… drew two\n * rows reading exactly `Covers`. Choosing the wrong one is **silent**: a move\n * is copy-then-delete, so the object is rewritten under a different prefix,\n * and because every reference to it is by id, nothing breaks. No error, no\n * missing image — the file is simply filed where nobody will look for it, and\n * the mistake is undetectable from the site.\n *\n * So the label carries the whole path, and the order is the sidebar's:\n * depth-first, each child directly under its parent, siblings by `order` then\n * name. The rail computed that hierarchy correctly the whole time; the\n * pickers beside it threw it away.\n *\n * Two robustness rules, both chosen to keep a destination REACHABLE rather\n * than tidy:\n *\n * - **A folder whose parent is missing is kept, at the root.** A scoped\n *   collaborator's read set can admit a child and refuse its parent\n *   (AGL-1466), and dropping the child would remove a real destination from\n *   the menu — a worse failure than an unindented row.\n * - **A cycle terminates.** This runs on every render of an open picker.\n */\nexport function mediaFolderChoices(\n  folders: ReadonlyArray<AglynMediaFolder & { $id: string }>,\n): MediaFolderChoice[] {\n  const byId = new Map(folders.map((folder) => [folder.$id, folder]))\n  /** True when the parent link leads somewhere real and does not loop back. */\n  const hasUsableParent = (folder: AglynMediaFolder & { $id: string }) => {\n    const seen = new Set<string>([folder.$id])\n    let cursor = folder.parentId ?? null\n    while (cursor) {\n      if (seen.has(cursor)) return false\n      const parent = byId.get(cursor)\n      if (!parent) return false\n      seen.add(cursor)\n      cursor = parent.parentId ?? null\n    }\n    return Boolean(folder.parentId)\n  }\n  const childrenOf = new Map<string | null, Array<AglynMediaFolder & { $id: string }>>()\n  for (const folder of folders) {\n    // Same normalisation the rail applies: anything without a resolvable\n    // parent chain is drawn as a root rather than dropped.\n    const parent = hasUsableParent(folder) ? (folder.parentId as string) : null\n    childrenOf.set(parent, [...(childrenOf.get(parent) ?? []), folder])\n  }\n  for (const siblings of childrenOf.values()) {\n    siblings.sort(\n      (a, b) =>\n        (a.order ?? 0) - (b.order ?? 0) ||\n        String(a.name).localeCompare(String(b.name)),\n    )\n  }\n  const choices: MediaFolderChoice[] = []\n  const walk = (parentId: string | null, path: string[]) => {\n    for (const folder of childrenOf.get(parentId) ?? []) {\n      const nextPath = [...path, folder.name]\n      choices.push({\n        $id: folder.$id,\n        name: folder.name,\n        path: nextPath,\n        label: nextPath.join(MEDIA_FOLDER_PATH_SEPARATOR),\n        depth: nextPath.length - 1,\n      })\n      walk(folder.$id, nextPath)\n    }\n  }\n  walk(null, [])\n  return choices\n}\n\n/** Nesting cap, enforced in UI and validation (root children = depth 1). */\nexport const MEDIA_FOLDER_MAX_DEPTH = 5\n\nexport const MEDIA_FOLDER_NAME_MAX_LENGTH = 60\n\n/**\n * Trims and collapses whitespace; null when empty or over the length cap\n * so callers reject rather than store junk.\n */\nexport function normalizeFolderName(input: string): string | null {\n  const name = String(input ?? '')\n    .replace(/\\s+/g, ' ')\n    .trim()\n  if (!name || name.length > MEDIA_FOLDER_NAME_MAX_LENGTH) return null\n  return name\n}\n\n/**\n * Depth of a folder (root children = 1). Broken parent links and cycles\n * both terminate: unknown parents count as root, and a revisited id stops\n * the walk (treated as max depth so validation refuses to make it worse).\n */\nexport function folderDepth(\n  folderId: string,\n  foldersById: Record<string, AglynMediaFolder>,\n): number {\n  let depth = 0\n  const seen = new Set<string>()\n  let current: string | null | undefined = folderId\n  while (current && foldersById[current]) {\n    if (seen.has(current)) return MEDIA_FOLDER_MAX_DEPTH\n    seen.add(current)\n    depth += 1\n    current = foldersById[current].parentId\n  }\n  return depth\n}\n\n/**\n * True when re-parenting `folderId` under `newParentId` would create a\n * cycle — i.e. the new parent is the folder itself or one of its\n * descendants (the parent chain from `newParentId` reaches `folderId`).\n */\nexport function wouldCreateCycle(\n  folderId: string,\n  newParentId: string | null | undefined,\n  foldersById: Record<string, AglynMediaFolder>,\n): boolean {\n  const seen = new Set<string>()\n  let current: string | null | undefined = newParentId\n  while (current) {\n    if (current === folderId) return true\n    if (seen.has(current)) return true\n    seen.add(current)\n    current = foldersById[current]?.parentId\n  }\n  return false\n}\n\n/**\n * Case-insensitive sibling-name uniqueness per parent. `excludeId` skips\n * the folder being renamed/moved itself.\n */\nexport function isSiblingNameTaken(\n  name: string,\n  parentId: string | null | undefined,\n  folders: Array<AglynMediaFolder & { $id: string }>,\n  excludeId?: string,\n): boolean {\n  const target = name.trim().toLowerCase()\n  const parent = parentId ?? null\n  return folders.some(\n    (folder) =>\n      folder.$id !== excludeId &&\n      (folder.parentId ?? null) === parent &&\n      folder.name.trim().toLowerCase() === target,\n  )\n}\n\nexport interface LegacyFolderMigrationPlan {\n  /** Root-level folder names that must be created (deduped, ordered). */\n  foldersToCreate: string[]\n  /**\n   * Media doc id → legacy folder name (lower-cased key match against\n   * created/existing root folders happens at execution time).\n   */\n  assignments: Array<{ mediaId: string; folderName: string }>\n}\n\n/**\n * Migration plan from flat AGL-124 `folder` strings: one root folder per\n * distinct legacy string (case-insensitive; existing root folders with a\n * matching name are reused, not duplicated), and a `folderId` stamp for\n * every media doc that still carries a legacy string but no `folderId`.\n */\nexport function planLegacyFolderMigration(\n  mediaDocs: Array<{ $id: string; folder?: string; folderId?: string | null }>,\n  existingFolders: Array<AglynMediaFolder & { $id: string }>,\n): LegacyFolderMigrationPlan {\n  const existingRootNames = new Set(\n    existingFolders\n      .filter((folder) => (folder.parentId ?? null) === null)\n      .map((folder) => folder.name.trim().toLowerCase()),\n  )\n  const toCreate = new Map<string, string>()\n  const assignments: LegacyFolderMigrationPlan['assignments'] = []\n  for (const media of mediaDocs) {\n    if (media.folderId) continue\n    const name = normalizeFolderName(media.folder ?? '')\n    if (!name) continue\n    const key = name.toLowerCase()\n    if (!existingRootNames.has(key) && !toCreate.has(key)) {\n      toCreate.set(key, name)\n    }\n    assignments.push({ mediaId: media.$id, folderName: name })\n  }\n  return {\n    foldersToCreate: [...toCreate.values()].sort(),\n    assignments,\n  }\n}\n"],"names":["newMediaFolderDoc","input","name","parentId","createdAt","visibleTo","length","Error","MEDIA_FOLDER_PATH_SEPARATOR","mediaFolderChoices","folders","byId","Map","map","folder","$id","hasUsableParent","seen","Set","cursor","parent","has","get","add","Boolean","childrenOf","set","siblings","values","sort","a","b","order","String","localeCompare","choices","walk","path","nextPath","push","label","join","depth","MEDIA_FOLDER_MAX_DEPTH","MEDIA_FOLDER_NAME_MAX_LENGTH","normalizeFolderName","replace","trim","folderDepth","folderId","foldersById","current","wouldCreateCycle","newParentId","isSiblingNameTaken","excludeId","target","toLowerCase","some","planLegacyFolderMigration","mediaDocs","existingFolders","existingRootNames","filter","toCreate","assignments","media","key","mediaId","folderName","foldersToCreate"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC;AAgCD;;;;;;;;;;;CAWC,GACD,OAAO,SAASA,kBACdC,KAA0B;IAE1B,MAAM,EAAEC,IAAI,EAAEC,QAAQ,EAAEC,SAAS,EAAEC,SAAS,EAAE,GAAGJ;IACjD,sEAAsE;IACtE,0EAA0E;IAC1E,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,mDAAmD;IACnD,IAAII,aAAa,CAACA,UAAUC,MAAM,EAAE;QAClC,MAAM,IAAIC,MAAM;IAClB;IACA,OAAO;QACLL;QACAC;QACAC;OACIC,YAAY;QAAEA,WAAW;eAAIA;SAAU;IAAC,IAAI,CAAC;AAErD;AAEA,kEAAkE,GAClE,OAAO,MAAMG,8BAA8B,MAAK;AAehD;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,OAAO,SAASC,mBACdC,OAA0D;IAE1D,MAAMC,OAAO,IAAIC,IAAIF,QAAQG,GAAG,CAAC,CAACC,SAAW;YAACA,OAAOC,GAAG;YAAED;SAAO;IACjE,2EAA2E,GAC3E,MAAME,kBAAkB,CAACF;YAEVA;QADb,MAAMG,OAAO,IAAIC,IAAY;YAACJ,OAAOC,GAAG;SAAC;QACzC,IAAII,UAASL,mBAAAA,OAAOX,QAAQ,YAAfW,mBAAmB;QAChC,MAAOK,OAAQ;gBAKJC;YAJT,IAAIH,KAAKI,GAAG,CAACF,SAAS,OAAO;YAC7B,MAAMC,SAAST,KAAKW,GAAG,CAACH;YACxB,IAAI,CAACC,QAAQ,OAAO;YACpBH,KAAKM,GAAG,CAACJ;YACTA,UAASC,mBAAAA,OAAOjB,QAAQ,YAAfiB,mBAAmB;QAC9B;QACA,OAAOI,QAAQV,OAAOX,QAAQ;IAChC;IACA,MAAMsB,aAAa,IAAIb;IACvB,KAAK,MAAME,UAAUJ,QAAS;YAIAe;QAH5B,qEAAqE;QACrE,uDAAuD;QACvD,MAAML,SAASJ,gBAAgBF,UAAWA,OAAOX,QAAQ,GAAc;QACvEsB,WAAWC,GAAG,CAACN,QAAQ;gBAAKK,kBAAAA,WAAWH,GAAG,CAACF,mBAAfK,kBAA0B,EAAE;YAAGX;SAAO;IACpE;IACA,KAAK,MAAMa,YAAYF,WAAWG,MAAM,GAAI;QAC1CD,SAASE,IAAI,CACX,CAACC,GAAGC;gBACDD,UAAiBC;mBAAlB,EAACD,WAAAA,EAAEE,KAAK,YAAPF,WAAW,OAAMC,WAAAA,EAAEC,KAAK,YAAPD,WAAW,MAC7BE,OAAOH,EAAE5B,IAAI,EAAEgC,aAAa,CAACD,OAAOF,EAAE7B,IAAI;;IAEhD;IACA,MAAMiC,UAA+B,EAAE;IACvC,MAAMC,OAAO,CAACjC,UAAyBkC;YAChBZ;QAArB,KAAK,MAAMX,WAAUW,kBAAAA,WAAWH,GAAG,CAACnB,qBAAfsB,kBAA4B,EAAE,CAAE;YACnD,MAAMa,WAAW;mBAAID;gBAAMvB,OAAOZ,IAAI;aAAC;YACvCiC,QAAQI,IAAI,CAAC;gBACXxB,KAAKD,OAAOC,GAAG;gBACfb,MAAMY,OAAOZ,IAAI;gBACjBmC,MAAMC;gBACNE,OAAOF,SAASG,IAAI,CAACjC;gBACrBkC,OAAOJ,SAAShC,MAAM,GAAG;YAC3B;YACA8B,KAAKtB,OAAOC,GAAG,EAAEuB;QACnB;IACF;IACAF,KAAK,MAAM,EAAE;IACb,OAAOD;AACT;AAEA,0EAA0E,GAC1E,OAAO,MAAMQ,yBAAyB,EAAC;AAEvC,OAAO,MAAMC,+BAA+B,GAAE;AAE9C;;;CAGC,GACD,OAAO,SAASC,oBAAoB5C,KAAa;IAC/C,MAAMC,OAAO+B,OAAOhC,gBAAAA,QAAS,IAC1B6C,OAAO,CAAC,QAAQ,KAChBC,IAAI;IACP,IAAI,CAAC7C,QAAQA,KAAKI,MAAM,GAAGsC,8BAA8B,OAAO;IAChE,OAAO1C;AACT;AAEA;;;;CAIC,GACD,OAAO,SAAS8C,YACdC,QAAgB,EAChBC,WAA6C;IAE7C,IAAIR,QAAQ;IACZ,MAAMzB,OAAO,IAAIC;IACjB,IAAIiC,UAAqCF;IACzC,MAAOE,WAAWD,WAAW,CAACC,QAAQ,CAAE;QACtC,IAAIlC,KAAKI,GAAG,CAAC8B,UAAU,OAAOR;QAC9B1B,KAAKM,GAAG,CAAC4B;QACTT,SAAS;QACTS,UAAUD,WAAW,CAACC,QAAQ,CAAChD,QAAQ;IACzC;IACA,OAAOuC;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASU,iBACdH,QAAgB,EAChBI,WAAsC,EACtCH,WAA6C;IAE7C,MAAMjC,OAAO,IAAIC;IACjB,IAAIiC,UAAqCE;IACzC,MAAOF,QAAS;YAIJD;QAHV,IAAIC,YAAYF,UAAU,OAAO;QACjC,IAAIhC,KAAKI,GAAG,CAAC8B,UAAU,OAAO;QAC9BlC,KAAKM,GAAG,CAAC4B;QACTA,WAAUD,uBAAAA,WAAW,CAACC,QAAQ,qBAApBD,qBAAsB/C,QAAQ;IAC1C;IACA,OAAO;AACT;AAEA;;;CAGC,GACD,OAAO,SAASmD,mBACdpD,IAAY,EACZC,QAAmC,EACnCO,OAAkD,EAClD6C,SAAkB;IAElB,MAAMC,SAAStD,KAAK6C,IAAI,GAAGU,WAAW;IACtC,MAAMrC,SAASjB,mBAAAA,WAAY;IAC3B,OAAOO,QAAQgD,IAAI,CACjB,CAAC5C;YAEEA;eADDA,OAAOC,GAAG,KAAKwC,aACf,EAACzC,mBAAAA,OAAOX,QAAQ,YAAfW,mBAAmB,UAAUM,UAC9BN,OAAOZ,IAAI,CAAC6C,IAAI,GAAGU,WAAW,OAAOD;;AAE3C;AAYA;;;;;CAKC,GACD,OAAO,SAASG,0BACdC,SAA4E,EAC5EC,eAA0D;IAE1D,MAAMC,oBAAoB,IAAI5C,IAC5B2C,gBACGE,MAAM,CAAC,CAACjD;YAAYA;eAAD,EAACA,mBAAAA,OAAOX,QAAQ,YAAfW,mBAAmB,UAAU;OACjDD,GAAG,CAAC,CAACC,SAAWA,OAAOZ,IAAI,CAAC6C,IAAI,GAAGU,WAAW;IAEnD,MAAMO,WAAW,IAAIpD;IACrB,MAAMqD,cAAwD,EAAE;IAChE,KAAK,MAAMC,SAASN,UAAW;YAEIM;QADjC,IAAIA,MAAMjB,QAAQ,EAAE;QACpB,MAAM/C,OAAO2C,qBAAoBqB,gBAAAA,MAAMpD,MAAM,YAAZoD,gBAAgB;QACjD,IAAI,CAAChE,MAAM;QACX,MAAMiE,MAAMjE,KAAKuD,WAAW;QAC5B,IAAI,CAACK,kBAAkBzC,GAAG,CAAC8C,QAAQ,CAACH,SAAS3C,GAAG,CAAC8C,MAAM;YACrDH,SAAStC,GAAG,CAACyC,KAAKjE;QACpB;QACA+D,YAAY1B,IAAI,CAAC;YAAE6B,SAASF,MAAMnD,GAAG;YAAEsD,YAAYnE;QAAK;IAC1D;IACA,OAAO;QACLoE,iBAAiB;eAAIN,SAASpC,MAAM;SAAG,CAACC,IAAI;QAC5CoC;IACF;AACF"}