@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/auth-pools.js

@@ -0,0 +1,551 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Cross-pool Firebase Auth lookups (AGL-1122).
+ *
+ * Enterprise SSO (AGL-1101) signs users into a per-org **GCIP tenant**, and a
+ * tenant has its OWN user pool. A project-level `getUserByEmail` /
+ * `listUsers` does not see those users at all — measured on aglyn-main:
+ * the owner of aglyn-org returned `auth/user-not-found` at project level and
+ * was present only under tenant `aglyn-org-y5v14`.
+ *
+ * That silently broke five separate things: staff could not find, view,
+ * disable or grant staff to an SSO user; adding one to an org or a site by
+ * email 404'd into "send them an invite" for an account that already exists;
+ * and `notifyStaff` skipped SSO staff entirely. Fixing those one route at a
+ * time would guarantee the next new route reintroduces the bug, so every
+ * caller goes through here instead.
+ *
+ * Custom claims are per-pool too: `setCustomUserClaims` on the project pool
+ * cannot grant staff to a tenant user. `authForPool` hands back the right
+ * `BaseAuth` so a mutation lands in the pool the user actually lives in.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import firebaseAdmin from "./firebase-admin.js";
+const auth = ()=>firebaseAdmin.app().auth();
+/**
+ * Does this record show that a human ever authenticated as it? (AGL-2005)
+ *
+ * An address or a provider entry is the evidence. `signInWithCustomToken`
+ * mints an account out of nothing when the uid is absent from the pool the
+ * token was minted in, and the record it manufactures has neither: measured
+ * on production, a project-pool twin of a tenant uid had `email: null` and
+ * `providerData: []` while the real SSO record carried both an address and
+ * `saml.aglyn-workspace`.
+ *
+ * `displayName` and custom claims deliberately do NOT count. Both can be
+ * written onto any record after the fact — `updateProfile` and `grantStaff`
+ * in the staff console do exactly that — so a shadow that a staff action had
+ * already landed on would start qualifying as an identity and go on winning
+ * the lookups it should be losing. The bar has to be a signal the forgery
+ * cannot acquire by being acted upon.
+ */ export function isIdentifiedUserRecord(record) {
+    var _ref;
+    var _record_providerData;
+    if (!record) return false;
+    return Boolean(record.email) || ((_ref = (_record_providerData = record.providerData) == null ? void 0 : _record_providerData.length) != null ? _ref : 0) > 0;
+}
+/**
+ * How strongly a record identifies its human, for choosing between two that
+ * share a uid (AGL-2005). Ordering only — the numbers have no other meaning.
+ *
+ * Email and provider data lead because they are what `isIdentifiedUserRecord`
+ * trusts; the rest break ties between records that both qualify.
+ */ export function identityStrength(record) {
+    var _ref, _record_customClaims;
+    var _record_providerData;
+    if (!record) return 0;
+    let score = 0;
+    if (record.email) score += 8;
+    if (((_ref = (_record_providerData = record.providerData) == null ? void 0 : _record_providerData.length) != null ? _ref : 0) > 0) score += 4;
+    if (record.phoneNumber) score += 2;
+    if (record.displayName) score += 1;
+    if (Object.keys((_record_customClaims = record.customClaims) != null ? _record_customClaims : {}).length > 0) score += 1;
+    return score;
+}
+/**
+ * Collapse rows sharing a uid to ONE row apiece (AGL-2005).
+ *
+ * **decided:** "We still have two users list in this list with the
+ * same uid but one without an email attached, this needs fixed we should only
+ * see one user, even if they are sso."
+ *
+ * AGL-1962 deliberately refused to merge, on the grounds that collapsing two
+ * accounts could hide an identity split. That reasoning still stands for two
+ * DISTINCT accounts — which is why this keys on **uid** and never on email.
+ * Two people who happen to share an address are two accounts with two uids
+ * and stay two rows; merging them on email would delete a real user from the
+ * staff console, a worse bug than the one being fixed and an invisible one.
+ *
+ * A repeated uid is different in kind: a uid is unique WITHIN a pool, so the
+ * same uid in two pools is not two people, it is one person plus an artifact
+ * of a cross-pool custom-token mint. Those merge.
+ *
+ * Two rules make the merge safe:
+ *
+ *  - **The identified record wins.** Ranked by `identityStrength`, so an
+ *    emailless, providerless artifact can never be the row staff see — the
+ *    exact inversion that let the shadow win every uid lookup.
+ *  - **The collision is not discarded.** `markCrossPoolUidCollisions` runs
+ *    here rather than being left to the caller, so the surviving row always
+ *    carries `uidAlsoInPools` naming the pools that were folded into it. One
+ *    row, and it still says it was two.
+ *
+ * The survivor takes the FIRST occurrence's position so list ordering does
+ * not shuffle, and ties keep the earlier row so the result is deterministic.
+ */ export function collapseCrossPoolUidRows(users) {
+    // Marked here, not by the caller. A caller that forgot would silently turn
+    // this into the cover-up the merge is explicitly not allowed to be.
+    const marked = markCrossPoolUidCollisions(users);
+    const winnerByUid = new Map();
+    for (const user of marked){
+        const incumbent = winnerByUid.get(user.record.uid);
+        if (!incumbent || identityStrength(user.record) > identityStrength(incumbent.record)) {
+            winnerByUid.set(user.record.uid, user);
+        }
+    }
+    const emitted = new Set();
+    const collapsed = [];
+    for (const user of marked){
+        var _winnerByUid_get;
+        const uid = user.record.uid;
+        if (emitted.has(uid)) continue;
+        emitted.add(uid);
+        collapsed.push((_winnerByUid_get = winnerByUid.get(uid)) != null ? _winnerByUid_get : user);
+    }
+    return collapsed;
+}
+/**
+ * Flag every uid that appears in more than one pool, in place of hiding it.
+ *
+ * Pure and total, so a spec can drive it without Firebase. Callers must pass
+ * the rows they intend to show together — a collision it cannot see is one
+ * it cannot report.
+ */ export function markCrossPoolUidCollisions(users) {
+    const poolsByUid = new Map();
+    for (const user of users){
+        var _poolsByUid_get;
+        const pools = (_poolsByUid_get = poolsByUid.get(user.record.uid)) != null ? _poolsByUid_get : [];
+        pools.push(user.tenantId);
+        poolsByUid.set(user.record.uid, pools);
+    }
+    return users.map((user)=>{
+        var _poolsByUid_get;
+        const pools = (_poolsByUid_get = poolsByUid.get(user.record.uid)) != null ? _poolsByUid_get : [];
+        if (pools.length < 2) return user;
+        // Everyone holding this uid EXCEPT this row's own pool. Compared by
+        // index, not by value: two rows from the same pool would be a Firebase
+        // impossibility, but filtering by value would silently drop a real one.
+        const others = pools.filter((_, index)=>index !== pools.indexOf(user.tenantId));
+        return _extends({}, user, {
+            uidAlsoInPools: others
+        });
+    });
+}
+/**
+ * Every GCIP tenant on the project. Cached briefly: this is asked once per
+ * lookup and the set changes only when an enterprise org is onboarded.
+ * Fails soft to an empty list — a tenant-listing outage must degrade to
+ * today's project-only behaviour rather than break sign-in-adjacent routes.
+ */ let tenantCache = null;
+const TENANT_CACHE_MS = 60000;
+export async function listAuthTenantIds() {
+    const now = Date.now();
+    if (tenantCache && now - tenantCache.at < TENANT_CACHE_MS) {
+        return tenantCache.ids;
+    }
+    try {
+        const ids = [];
+        let pageToken;
+        do {
+            const page = await auth().tenantManager().listTenants(100, pageToken);
+            ids.push(...page.tenants.map((tenant)=>tenant.tenantId));
+            pageToken = page.pageToken;
+        }while (pageToken)
+        tenantCache = {
+            ids,
+            at: now
+        };
+        return ids;
+    } catch (error) {
+        var _ref;
+        console.error('tenant listing failed; falling back to project pool', error);
+        return (_ref = tenantCache == null ? void 0 : tenantCache.ids) != null ? _ref : [];
+    }
+}
+/** Test seam — drops the tenant cache so a spec can vary the tenant set. */ export function resetAuthTenantCache() {
+    tenantCache = null;
+}
+/** The `BaseAuth` for a pool: the project pool for null, else the tenant's. */ export function authForPool(tenantId) {
+    return tenantId ? auth().tenantManager().authForTenant(tenantId) : auth();
+}
+/**
+ * Find a user by email across the project pool and every GCIP tenant.
+ *
+ * The project pool is tried first — it holds every non-SSO user, which is
+ * almost all of them, so the common case stays a single call. Returns null
+ * when no pool has the address, which is the only honest answer for "this
+ * person has no Aglyn account".
+ */ export async function findUserByEmailAcrossPools(email) {
+    const address = email.trim().toLowerCase();
+    if (!address) return null;
+    try {
+        return {
+            record: await auth().getUserByEmail(address),
+            tenantId: null
+        };
+    } catch (unused) {
+    // Not in the project pool — fall through to the tenants.
+    }
+    for (const tenantId of (await listAuthTenantIds())){
+        try {
+            const record = await authForPool(tenantId).getUserByEmail(address);
+            return {
+                record,
+                tenantId
+            };
+        } catch (unused) {
+        // Not in this tenant; keep looking.
+        }
+    }
+    return null;
+}
+/**
+ * Find a user by uid across the project pool and every GCIP tenant. Same
+ * shape as the email lookup — a uid is only unique WITHIN a pool, so the
+ * caller needs to know which pool answered before it mutates anything.
+ *
+ * **First pool to answer is NOT good enough** (AGL-2005). This used to return
+ * the project pool's record the moment it existed, which is how a forged
+ * emailless twin won every uid lookup for a real SSO user: `grantStaff`,
+ * `disable`, `setRole`, `updateProfile`, `revokeRefreshTokens`, impersonate,
+ * usage-email, resolve-people, org-lockdown and erasure all landed on a
+ * record nobody can sign in as. Two of those were caught having happened —
+ * a `revokeRefreshTokens` dated 2026-08-14 sat on the twin while the real
+ * account's `tokensValidAfterTime` never moved, so "sign out everywhere" did
+ * nothing at all.
+ *
+ * So a pool's answer is accepted only when the record it returns actually
+ * identifies someone, and the winner is chosen by the SAME rule the staff
+ * list collapses rows with. That equivalence is the point: the row staff
+ * click is the record the action mutates, by construction rather than by
+ * coincidence.
+ *
+ * The fast path survives intact — a project account with an address or a
+ * provider is returned without any tenant call, which is nearly every
+ * account. Only a record carrying no identity at all pays for the sweep.
+ */ export async function findUserByUidAcrossPools(uid) {
+    var _collapseCrossPoolUidRows_;
+    if (!uid) return null;
+    const matches = [];
+    try {
+        const record = await auth().getUser(uid);
+        if (isIdentifiedUserRecord(record)) return {
+            record,
+            tenantId: null
+        };
+        // Held, not returned. It is still the answer if nothing better exists —
+        // an anonymous or half-created account legitimately looks like this, and
+        // refusing it here would break every caller that handles those.
+        matches.push({
+            record,
+            tenantId: null
+        });
+    } catch (unused) {
+    // Not in the project pool.
+    }
+    for (const tenantId of (await listAuthTenantIds())){
+        try {
+            const record = await authForPool(tenantId).getUser(uid);
+            matches.push({
+                record,
+                tenantId
+            });
+            // Stop at the first pool that knows who this is. Scanning the rest
+            // would cost a call per enterprise tenant on a path that runs during
+            // sign-in and billing, and a uid identified in two tenant pools is not
+            // a shape Firebase can produce — tenant uids are minted per pool.
+            if (isIdentifiedUserRecord(record)) break;
+        } catch (unused) {
+        // Keep looking.
+        }
+    }
+    if (!matches.length) return null;
+    return (_collapseCrossPoolUidRows_ = collapseCrossPoolUidRows(matches)[0]) != null ? _collapseCrossPoolUidRows_ : null;
+}
+/** How many tenant users a single page will carry before reporting a cut. */ const TENANT_USER_CAP = 500;
+/**
+ * How many pools may have a call in flight at once.
+ *
+ * Every sweep below asks each GCIP tenant pool the same question, and the
+ * pools are independent: one tenant's answer never informs another's. Asked in
+ * series that costs `N` round trips for `N` enterprise customers, so the staff
+ * list gets slower every time one is signed — the wrong direction for the
+ * feature that adds them. Asked together it costs one.
+ *
+ * The number of CALLS is identical either way, so this buys latency and the
+ * Cloud Run seconds spent waiting on it, not Auth quota. That is also why it
+ * is bounded rather than an unbounded `Promise.all`: Identity Platform rate
+ * limits `listUsers` per project, and firing one call per tenant simultaneously
+ * would convert a latency problem into a `RESOURCE_EXHAUSTED` one at exactly
+ * the customer count where the latency stopped mattering.
+ */ const POOL_FETCH_CONCURRENCY = 8;
+/**
+ * Run `work` over every pool id, at most {@link POOL_FETCH_CONCURRENCY} at a
+ * time, and return the results **in the order the ids were given**.
+ *
+ * Order is not cosmetic here. Callers concatenate these results into a user
+ * list and then trim it to a cap, so a result order that varied with which
+ * pool answered first would make the rows a staff member sees depend on
+ * network timing — the same query returning different people on a refresh.
+ */ async function mapPoolsConcurrently(tenantIds, work) {
+    const results = new Array(tenantIds.length);
+    let next = 0;
+    const workers = Array.from({
+        length: Math.min(POOL_FETCH_CONCURRENCY, tenantIds.length)
+    }, async ()=>{
+        for(;;){
+            const index = next++;
+            if (index >= tenantIds.length) return;
+            results[index] = await work(tenantIds[index]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * One page of users across every pool: the project pool paginates as before,
+ * and tenant users are appended on the LAST page so they can never be lost
+ * between cursors. Callers render `tenantId` so an SSO account is
+ * recognisable — it is not editable the same way a project user is.
+ */ export async function listUsersAcrossPools(pageSize, pageToken) {
+    const page = await auth().listUsers(pageSize, pageToken);
+    const users = page.users.map((record)=>({
+            record,
+            tenantId: null
+        }));
+    if (page.pageToken) {
+        return {
+            users,
+            nextPageToken: page.pageToken,
+            tenantsIncluded: false,
+            tenantTruncated: []
+        };
+    }
+    const tenantTruncated = [];
+    // Every tenant asks for the same fixed page, so no pool's request depends on
+    // another's answer and they can all be in flight at once. A failed pool
+    // contributes no rows and does not stop the others: one enterprise tenant
+    // being unreachable must not blank the whole staff list.
+    //
+    // The id list is read ONCE and reused. It is cached on a 60s TTL, so asking
+    // twice can hand back two different lists, and pairing a page from one list
+    // with an id from the other would label a user with the wrong tenant.
+    const tenantIds = await listAuthTenantIds();
+    const tenantPages = await mapPoolsConcurrently(tenantIds, async (tenantId)=>{
+        try {
+            return await authForPool(tenantId).listUsers(TENANT_USER_CAP);
+        } catch (error) {
+            console.error(`listing users for tenant ${tenantId} failed`, error);
+            return null;
+        }
+    });
+    tenantPages.forEach((tenantPage, index)=>{
+        if (!tenantPage) return;
+        const tenantId = tenantIds[index];
+        users.push(...tenantPage.users.map((record)=>({
+                record,
+                tenantId
+            })));
+        if (tenantPage.pageToken) tenantTruncated.push(tenantId);
+    });
+    return {
+        // Marked only here, where every pool's rows are in hand (AGL-1962). The
+        // earlier return above carries project rows alone, and a uid cannot
+        // collide with itself inside one pool, so there is nothing to find there.
+        users: markCrossPoolUidCollisions(users),
+        nextPageToken: null,
+        tenantsIncluded: true,
+        tenantTruncated
+    };
+}
+/**
+ * Every account across every pool, up to a cap — the only way to FILTER them.
+ *
+ * Firebase Auth's `listUsers` takes a page size and a cursor and nothing else:
+ * no predicate, no ordering, no search. So a staff filter on anything but an
+ * exact email, uid or phone number (which have their own O(1) lookups) can
+ * only be answered by reading the accounts and matching them.
+ *
+ * That is an expensive read, so it happens on an ASK and never on a mount —
+ * the route calls this only when a request carries a filter, and pages the
+ * cheap way otherwise.
+ *
+ * `truncated` is true when the cap was reached, and it must be shown rather
+ * than swallowed: a staff list that searched part of the directory and said
+ * "no matches" is worse than one that admits where it stopped.
+ */ export async function scanUsersAcrossPools(cap) {
+    const users = [];
+    let truncated = false;
+    let pageToken;
+    do {
+        const remaining = cap - users.length;
+        if (remaining <= 0) {
+            truncated = true;
+            break;
+        }
+        // `listUsers` caps a page at 1000 whatever it is asked for.
+        const page = await auth().listUsers(Math.min(remaining, 1000), pageToken);
+        users.push(...page.users.map((record)=>({
+                record,
+                tenantId: null
+            })));
+        pageToken = page.pageToken;
+        if (pageToken && users.length >= cap) truncated = true;
+    }while (pageToken && users.length < cap)
+    const tenantTruncated = [];
+    const tenantIds = await listAuthTenantIds();
+    /*
+   * The remaining budget is fixed BEFORE any pool is asked.
+   *
+   * Sizing each pool's page from the running total is what forced these calls
+   * into a series — pool `k`'s page size could not be known until pool `k-1`
+   * had answered. Nothing needs that: a page sized to the whole remaining
+   * budget is always at least as large as the shrinking one, so the first
+   * `cap` rows in tenant order are the same users either way, and the pools
+   * can be asked together.
+   *
+   * The trade is bandwidth, not quota: `listUsers` is billed per CALL, and the
+   * call count is unchanged. Only when the cap actually binds does this carry
+   * rows that are then trimmed.
+   */ const budget = cap - users.length;
+    if (budget <= 0) {
+        truncated = true;
+    } else {
+        const pageSize = Math.min(budget, TENANT_USER_CAP);
+        const pages = await mapPoolsConcurrently(tenantIds, async (tenantId)=>{
+            try {
+                return await authForPool(tenantId).listUsers(pageSize);
+            } catch (error) {
+                console.error(`listing users for tenant ${tenantId} failed`, error);
+                return null;
+            }
+        });
+        pages.forEach((page, index)=>{
+            if (!page) return;
+            const tenantId = tenantIds[index];
+            const room = cap - users.length;
+            const rows = page.users.map((record)=>({
+                    record,
+                    tenantId
+                }));
+            // A pool whose rows will not fit is still a pool that was cut short, and
+            // it has to say so. A scan that silently dropped one would answer "no
+            // such account" for everyone in it — the exact failure this module
+            // exists to prevent, wearing the shape of a complete result.
+            if (rows.length > room) {
+                truncated = true;
+                tenantTruncated.push(tenantId);
+            } else if (page.pageToken) {
+                tenantTruncated.push(tenantId);
+            }
+            if (room > 0) users.push(...rows.slice(0, room));
+        });
+    }
+    return {
+        users: markCrossPoolUidCollisions(users),
+        truncated,
+        tenantTruncated
+    };
+}
+/**
+ * Write custom claims to the pool the uid ACTUALLY lives in (AGL-1993).
+ *
+ * The hazard this exists to remove: `setCustomUserClaims` is per-pool, and a
+ * grant aimed at the wrong pool does not error — on the project pool it
+ * either throws `user-not-found` (loud, fine) or, when a phantom shadow record
+ * shares the uid, silently succeeds against the WRONG record. That is not
+ * hypothetical: on 2026-08-18 a staff account's uid existed in both the
+ * project pool and `aglyn-org-y5v14` at once. That phantom won every lookup
+ * until AGL-2005 made {@link findUserByUidAcrossPools} rank an IDENTIFIED
+ * record above an unidentified one rather than taking the first pool to
+ * answer.
+ *
+ * So resolution and mutation are bound together here rather than left to each
+ * caller to pair correctly, and the resolved pool is RETURNED so the audit row
+ * can record which pool was written — "granted staff to uid X" is not a
+ * complete record when a uid can name two accounts.
+ *
+ * Never assumes a pool. Staff may live in the project pool, in Aglyn's own
+ * tenant, or in a CUSTOMER org's tenant, and hard-coding any of them would
+ * silently fail the moment a third exists.
+ */ export async function setClaimsInOwningPool(uid, claims) {
+    var _found_record_email;
+    const found = await findUserByUidAcrossPools(uid);
+    if (!found) return null;
+    await authForPool(found.tenantId).setCustomUserClaims(uid, claims);
+    return {
+        uid,
+        tenantId: found.tenantId,
+        email: (_found_record_email = found.record.email) != null ? _found_record_email : null,
+        claims
+    };
+}
+/**
+ * Every uid carrying the `staff` claim, across all pools. Staff is a custom
+ * claim, which is not queryable, so this scans — the caller caches it.
+ */ export async function listStaffUidsAcrossPools() {
+    /*
+   * Paging WITHIN a pool stays serial — each page's cursor comes out of the
+   * one before it, so there is nothing to overlap. Across pools there is: the
+   * pools are independent, and a staff notification waiting on them one after
+   * another gets slower with every enterprise customer signed.
+   *
+   * Each scan collects into its own array rather than a shared one, so the
+   * result is ordered by POOL rather than by which pool happened to answer
+   * first. A caller diffing this list against a stored copy would otherwise
+   * see phantom changes on every run.
+   */ const scan = async (pool)=>{
+        const found = [];
+        let pageToken;
+        do {
+            const page = await pool.listUsers(1000, pageToken);
+            for (const record of page.users){
+                var _record_customClaims;
+                if ((_record_customClaims = record.customClaims) == null ? void 0 : _record_customClaims['staff']) found.push(record.uid);
+            }
+            pageToken = page.pageToken;
+        }while (pageToken)
+        return found;
+    };
+    const tenantIds = await listAuthTenantIds();
+    const [projectUids, tenantUidLists] = await Promise.all([
+        scan(auth()),
+        mapPoolsConcurrently(tenantIds, async (tenantId)=>{
+            try {
+                return await scan(authForPool(tenantId));
+            } catch (error) {
+                console.error(`staff scan for tenant ${tenantId} failed`, error);
+                return [];
+            }
+        })
+    ]);
+    return [
+        ...projectUids,
+        ...tenantUidLists.flat()
+    ];
+}
+
+//# sourceMappingURL=auth-pools.js.map

package/src/lib/server/auth-pools.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/auth-pools.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Cross-pool Firebase Auth lookups (AGL-1122).\n *\n * Enterprise SSO (AGL-1101) signs users into a per-org **GCIP tenant**, and a\n * tenant has its OWN user pool. A project-level `getUserByEmail` /\n * `listUsers` does not see those users at all — measured on aglyn-main:\n * the owner of aglyn-org returned `auth/user-not-found` at project level and\n * was present only under tenant `aglyn-org-y5v14`.\n *\n * That silently broke five separate things: staff could not find, view,\n * disable or grant staff to an SSO user; adding one to an org or a site by\n * email 404'd into \"send them an invite\" for an account that already exists;\n * and `notifyStaff` skipped SSO staff entirely. Fixing those one route at a\n * time would guarantee the next new route reintroduces the bug, so every\n * caller goes through here instead.\n *\n * Custom claims are per-pool too: `setCustomUserClaims` on the project pool\n * cannot grant staff to a tenant user. `authForPool` hands back the right\n * `BaseAuth` so a mutation lands in the pool the user actually lives in.\n */\n\nimport type { BaseAuth, UserRecord } from 'firebase-admin/auth'\nimport firebaseAdmin from './firebase-admin'\n\nconst auth = () => firebaseAdmin.app().auth()\n\n/** A user plus the pool they were found in (`null` = the project pool). */\nexport interface PooledUserRecord {\n  record: UserRecord\n  /** GCIP tenant id, or null when the user is in the project-level pool. */\n  tenantId: string | null\n  /**\n   * Other pools that ALSO hold this uid (AGL-1962). Normally absent: a uid is\n   * unique within a pool, and the pools are meant to hold different people.\n   *\n   * It is populated when the same uid turns up in more than one pool, which\n   * means something minted a custom token for one pool's uid against another\n   * pool — `signInWithCustomToken` CREATES the account when the uid is absent,\n   * so the mistake manufactures an empty shadow account rather than failing.\n   * Measured on production: `QQ7fixtureUid0000000000000001` existed in both the\n   * project pool and `aglyn-org-y5v14`, the project copy created by\n   * `/api/presence/token` minting an SSO user's tenant uid at project level.\n   *\n   * This is the marker, not a deletion: `listUsersAcrossPools` still returns\n   * every record, and `collapseCrossPoolUidRows` — which is what a display\n   * uses — keeps this field on the row it keeps, so a collision is still\n   * legible after the rows are merged (AGL-2005).\n   */\n  uidAlsoInPools?: (string | null)[]\n}\n\n/**\n * Does this record show that a human ever authenticated as it? (AGL-2005)\n *\n * An address or a provider entry is the evidence. `signInWithCustomToken`\n * mints an account out of nothing when the uid is absent from the pool the\n * token was minted in, and the record it manufactures has neither: measured\n * on production, a project-pool twin of a tenant uid had `email: null` and\n * `providerData: []` while the real SSO record carried both an address and\n * `saml.aglyn-workspace`.\n *\n * `displayName` and custom claims deliberately do NOT count. Both can be\n * written onto any record after the fact — `updateProfile` and `grantStaff`\n * in the staff console do exactly that — so a shadow that a staff action had\n * already landed on would start qualifying as an identity and go on winning\n * the lookups it should be losing. The bar has to be a signal the forgery\n * cannot acquire by being acted upon.\n */\nexport function isIdentifiedUserRecord(record: UserRecord): boolean {\n  if (!record) return false\n  return Boolean(record.email) || (record.providerData?.length ?? 0) > 0\n}\n\n/**\n * How strongly a record identifies its human, for choosing between two that\n * share a uid (AGL-2005). Ordering only — the numbers have no other meaning.\n *\n * Email and provider data lead because they are what `isIdentifiedUserRecord`\n * trusts; the rest break ties between records that both qualify.\n */\nexport function identityStrength(record: UserRecord): number {\n  if (!record) return 0\n  let score = 0\n  if (record.email) score += 8\n  if ((record.providerData?.length ?? 0) > 0) score += 4\n  if (record.phoneNumber) score += 2\n  if (record.displayName) score += 1\n  if (Object.keys(record.customClaims ?? {}).length > 0) score += 1\n  return score\n}\n\n/**\n * Collapse rows sharing a uid to ONE row apiece (AGL-2005).\n *\n * **decided:** \"We still have two users list in this list with the\n * same uid but one without an email attached, this needs fixed we should only\n * see one user, even if they are sso.\"\n *\n * AGL-1962 deliberately refused to merge, on the grounds that collapsing two\n * accounts could hide an identity split. That reasoning still stands for two\n * DISTINCT accounts — which is why this keys on **uid** and never on email.\n * Two people who happen to share an address are two accounts with two uids\n * and stay two rows; merging them on email would delete a real user from the\n * staff console, a worse bug than the one being fixed and an invisible one.\n *\n * A repeated uid is different in kind: a uid is unique WITHIN a pool, so the\n * same uid in two pools is not two people, it is one person plus an artifact\n * of a cross-pool custom-token mint. Those merge.\n *\n * Two rules make the merge safe:\n *\n *  - **The identified record wins.** Ranked by `identityStrength`, so an\n *    emailless, providerless artifact can never be the row staff see — the\n *    exact inversion that let the shadow win every uid lookup.\n *  - **The collision is not discarded.** `markCrossPoolUidCollisions` runs\n *    here rather than being left to the caller, so the surviving row always\n *    carries `uidAlsoInPools` naming the pools that were folded into it. One\n *    row, and it still says it was two.\n *\n * The survivor takes the FIRST occurrence's position so list ordering does\n * not shuffle, and ties keep the earlier row so the result is deterministic.\n */\nexport function collapseCrossPoolUidRows(\n  users: PooledUserRecord[],\n): PooledUserRecord[] {\n  // Marked here, not by the caller. A caller that forgot would silently turn\n  // this into the cover-up the merge is explicitly not allowed to be.\n  const marked = markCrossPoolUidCollisions(users)\n  const winnerByUid = new Map<string, PooledUserRecord>()\n  for (const user of marked) {\n    const incumbent = winnerByUid.get(user.record.uid)\n    if (\n      !incumbent ||\n      identityStrength(user.record) > identityStrength(incumbent.record)\n    ) {\n      winnerByUid.set(user.record.uid, user)\n    }\n  }\n  const emitted = new Set<string>()\n  const collapsed: PooledUserRecord[] = []\n  for (const user of marked) {\n    const uid = user.record.uid\n    if (emitted.has(uid)) continue\n    emitted.add(uid)\n    collapsed.push(winnerByUid.get(uid) ?? user)\n  }\n  return collapsed\n}\n\n/**\n * Flag every uid that appears in more than one pool, in place of hiding it.\n *\n * Pure and total, so a spec can drive it without Firebase. Callers must pass\n * the rows they intend to show together — a collision it cannot see is one\n * it cannot report.\n */\nexport function markCrossPoolUidCollisions(\n  users: PooledUserRecord[],\n): PooledUserRecord[] {\n  const poolsByUid = new Map<string, (string | null)[]>()\n  for (const user of users) {\n    const pools = poolsByUid.get(user.record.uid) ?? []\n    pools.push(user.tenantId)\n    poolsByUid.set(user.record.uid, pools)\n  }\n  return users.map((user) => {\n    const pools = poolsByUid.get(user.record.uid) ?? []\n    if (pools.length < 2) return user\n    // Everyone holding this uid EXCEPT this row's own pool. Compared by\n    // index, not by value: two rows from the same pool would be a Firebase\n    // impossibility, but filtering by value would silently drop a real one.\n    const others = pools.filter((_, index) => index !== pools.indexOf(user.tenantId))\n    return { ...user, uidAlsoInPools: others }\n  })\n}\n\n/**\n * Every GCIP tenant on the project. Cached briefly: this is asked once per\n * lookup and the set changes only when an enterprise org is onboarded.\n * Fails soft to an empty list — a tenant-listing outage must degrade to\n * today's project-only behaviour rather than break sign-in-adjacent routes.\n */\nlet tenantCache: { ids: string[]; at: number } | null = null\nconst TENANT_CACHE_MS = 60_000\n\nexport async function listAuthTenantIds(): Promise<string[]> {\n  const now = Date.now()\n  if (tenantCache && now - tenantCache.at < TENANT_CACHE_MS) {\n    return tenantCache.ids\n  }\n  try {\n    const ids: string[] = []\n    let pageToken: string | undefined\n    do {\n      const page = await auth().tenantManager().listTenants(100, pageToken)\n      ids.push(...page.tenants.map((tenant) => tenant.tenantId))\n      pageToken = page.pageToken\n    } while (pageToken)\n    tenantCache = { ids, at: now }\n    return ids\n  } catch (error) {\n    console.error('tenant listing failed; falling back to project pool', error)\n    return tenantCache?.ids ?? []\n  }\n}\n\n/** Test seam — drops the tenant cache so a spec can vary the tenant set. */\nexport function resetAuthTenantCache(): void {\n  tenantCache = null\n}\n\n/** The `BaseAuth` for a pool: the project pool for null, else the tenant's. */\nexport function authForPool(tenantId: string | null | undefined): BaseAuth {\n  return tenantId\n    ? auth().tenantManager().authForTenant(tenantId)\n    : auth()\n}\n\n/**\n * Find a user by email across the project pool and every GCIP tenant.\n *\n * The project pool is tried first — it holds every non-SSO user, which is\n * almost all of them, so the common case stays a single call. Returns null\n * when no pool has the address, which is the only honest answer for \"this\n * person has no Aglyn account\".\n */\nexport async function findUserByEmailAcrossPools(\n  email: string,\n): Promise<PooledUserRecord | null> {\n  const address = email.trim().toLowerCase()\n  if (!address) return null\n  try {\n    return { record: await auth().getUserByEmail(address), tenantId: null }\n  } catch {\n    // Not in the project pool — fall through to the tenants.\n  }\n  for (const tenantId of await listAuthTenantIds()) {\n    try {\n      const record = await authForPool(tenantId).getUserByEmail(address)\n      return { record, tenantId }\n    } catch {\n      // Not in this tenant; keep looking.\n    }\n  }\n  return null\n}\n\n/**\n * Find a user by uid across the project pool and every GCIP tenant. Same\n * shape as the email lookup — a uid is only unique WITHIN a pool, so the\n * caller needs to know which pool answered before it mutates anything.\n *\n * **First pool to answer is NOT good enough** (AGL-2005). This used to return\n * the project pool's record the moment it existed, which is how a forged\n * emailless twin won every uid lookup for a real SSO user: `grantStaff`,\n * `disable`, `setRole`, `updateProfile`, `revokeRefreshTokens`, impersonate,\n * usage-email, resolve-people, org-lockdown and erasure all landed on a\n * record nobody can sign in as. Two of those were caught having happened —\n * a `revokeRefreshTokens` dated 2026-08-14 sat on the twin while the real\n * account's `tokensValidAfterTime` never moved, so \"sign out everywhere\" did\n * nothing at all.\n *\n * So a pool's answer is accepted only when the record it returns actually\n * identifies someone, and the winner is chosen by the SAME rule the staff\n * list collapses rows with. That equivalence is the point: the row staff\n * click is the record the action mutates, by construction rather than by\n * coincidence.\n *\n * The fast path survives intact — a project account with an address or a\n * provider is returned without any tenant call, which is nearly every\n * account. Only a record carrying no identity at all pays for the sweep.\n */\nexport async function findUserByUidAcrossPools(\n  uid: string,\n): Promise<PooledUserRecord | null> {\n  if (!uid) return null\n  const matches: PooledUserRecord[] = []\n  try {\n    const record = await auth().getUser(uid)\n    if (isIdentifiedUserRecord(record)) return { record, tenantId: null }\n    // Held, not returned. It is still the answer if nothing better exists —\n    // an anonymous or half-created account legitimately looks like this, and\n    // refusing it here would break every caller that handles those.\n    matches.push({ record, tenantId: null })\n  } catch {\n    // Not in the project pool.\n  }\n  for (const tenantId of await listAuthTenantIds()) {\n    try {\n      const record = await authForPool(tenantId).getUser(uid)\n      matches.push({ record, tenantId })\n      // Stop at the first pool that knows who this is. Scanning the rest\n      // would cost a call per enterprise tenant on a path that runs during\n      // sign-in and billing, and a uid identified in two tenant pools is not\n      // a shape Firebase can produce — tenant uids are minted per pool.\n      if (isIdentifiedUserRecord(record)) break\n    } catch {\n      // Keep looking.\n    }\n  }\n  if (!matches.length) return null\n  return collapseCrossPoolUidRows(matches)[0] ?? null\n}\n\nexport interface PooledUserPage {\n  users: PooledUserRecord[]\n  /** Project-pool cursor; null when the project pool is exhausted. */\n  nextPageToken: string | null\n  /**\n   * True once the project pool is exhausted and the tenant users have been\n   * appended. Tenant pools are NOT paginated here — enterprise SSO pools are\n   * small, and silently dropping their tail would recreate exactly the\n   * invisibility this module exists to fix. `tenantTruncated` says when that\n   * assumption stopped holding rather than letting it fail quietly.\n   */\n  tenantsIncluded: boolean\n  /** Tenants whose users hit the cap and were cut short. */\n  tenantTruncated: string[]\n}\n\n/** How many tenant users a single page will carry before reporting a cut. */\nconst TENANT_USER_CAP = 500\n\n/**\n * How many pools may have a call in flight at once.\n *\n * Every sweep below asks each GCIP tenant pool the same question, and the\n * pools are independent: one tenant's answer never informs another's. Asked in\n * series that costs `N` round trips for `N` enterprise customers, so the staff\n * list gets slower every time one is signed — the wrong direction for the\n * feature that adds them. Asked together it costs one.\n *\n * The number of CALLS is identical either way, so this buys latency and the\n * Cloud Run seconds spent waiting on it, not Auth quota. That is also why it\n * is bounded rather than an unbounded `Promise.all`: Identity Platform rate\n * limits `listUsers` per project, and firing one call per tenant simultaneously\n * would convert a latency problem into a `RESOURCE_EXHAUSTED` one at exactly\n * the customer count where the latency stopped mattering.\n */\nconst POOL_FETCH_CONCURRENCY = 8\n\n/**\n * Run `work` over every pool id, at most {@link POOL_FETCH_CONCURRENCY} at a\n * time, and return the results **in the order the ids were given**.\n *\n * Order is not cosmetic here. Callers concatenate these results into a user\n * list and then trim it to a cap, so a result order that varied with which\n * pool answered first would make the rows a staff member sees depend on\n * network timing — the same query returning different people on a refresh.\n */\nasync function mapPoolsConcurrently<T>(\n  tenantIds: string[],\n  work: (tenantId: string) => Promise<T>,\n): Promise<T[]> {\n  const results = new Array<T>(tenantIds.length)\n  let next = 0\n  const workers = Array.from(\n    { length: Math.min(POOL_FETCH_CONCURRENCY, tenantIds.length) },\n    async () => {\n      for (;;) {\n        const index = next++\n        if (index >= tenantIds.length) return\n        results[index] = await work(tenantIds[index])\n      }\n    },\n  )\n  await Promise.all(workers)\n  return results\n}\n\n/**\n * One page of users across every pool: the project pool paginates as before,\n * and tenant users are appended on the LAST page so they can never be lost\n * between cursors. Callers render `tenantId` so an SSO account is\n * recognisable — it is not editable the same way a project user is.\n */\nexport async function listUsersAcrossPools(\n  pageSize: number,\n  pageToken?: string,\n): Promise<PooledUserPage> {\n  const page = await auth().listUsers(pageSize, pageToken)\n  const users: PooledUserRecord[] = page.users.map((record) => ({\n    record,\n    tenantId: null,\n  }))\n  if (page.pageToken) {\n    return {\n      users,\n      nextPageToken: page.pageToken,\n      tenantsIncluded: false,\n      tenantTruncated: [],\n    }\n  }\n  const tenantTruncated: string[] = []\n  // Every tenant asks for the same fixed page, so no pool's request depends on\n  // another's answer and they can all be in flight at once. A failed pool\n  // contributes no rows and does not stop the others: one enterprise tenant\n  // being unreachable must not blank the whole staff list.\n  //\n  // The id list is read ONCE and reused. It is cached on a 60s TTL, so asking\n  // twice can hand back two different lists, and pairing a page from one list\n  // with an id from the other would label a user with the wrong tenant.\n  const tenantIds = await listAuthTenantIds()\n  const tenantPages = await mapPoolsConcurrently(tenantIds, async (tenantId) => {\n    try {\n      return await authForPool(tenantId).listUsers(TENANT_USER_CAP)\n    } catch (error) {\n      console.error(`listing users for tenant ${tenantId} failed`, error)\n      return null\n    }\n  })\n  tenantPages.forEach((tenantPage, index) => {\n    if (!tenantPage) return\n    const tenantId = tenantIds[index]\n    users.push(...tenantPage.users.map((record) => ({ record, tenantId })))\n    if (tenantPage.pageToken) tenantTruncated.push(tenantId)\n  })\n  return {\n    // Marked only here, where every pool's rows are in hand (AGL-1962). The\n    // earlier return above carries project rows alone, and a uid cannot\n    // collide with itself inside one pool, so there is nothing to find there.\n    users: markCrossPoolUidCollisions(users),\n    nextPageToken: null,\n    tenantsIncluded: true,\n    tenantTruncated,\n  }\n}\n\n/**\n * Every account across every pool, up to a cap — the only way to FILTER them.\n *\n * Firebase Auth's `listUsers` takes a page size and a cursor and nothing else:\n * no predicate, no ordering, no search. So a staff filter on anything but an\n * exact email, uid or phone number (which have their own O(1) lookups) can\n * only be answered by reading the accounts and matching them.\n *\n * That is an expensive read, so it happens on an ASK and never on a mount —\n * the route calls this only when a request carries a filter, and pages the\n * cheap way otherwise.\n *\n * `truncated` is true when the cap was reached, and it must be shown rather\n * than swallowed: a staff list that searched part of the directory and said\n * \"no matches\" is worse than one that admits where it stopped.\n */\nexport async function scanUsersAcrossPools(\n  cap: number,\n): Promise<{\n  users: PooledUserRecord[]\n  truncated: boolean\n  tenantTruncated: string[]\n}> {\n  const users: PooledUserRecord[] = []\n  let truncated = false\n  let pageToken: string | undefined\n\n  do {\n    const remaining = cap - users.length\n    if (remaining <= 0) {\n      truncated = true\n      break\n    }\n    // `listUsers` caps a page at 1000 whatever it is asked for.\n    const page = await auth().listUsers(Math.min(remaining, 1000), pageToken)\n    users.push(...page.users.map((record) => ({ record, tenantId: null })))\n    pageToken = page.pageToken\n    if (pageToken && users.length >= cap) truncated = true\n  } while (pageToken && users.length < cap)\n\n  const tenantTruncated: string[] = []\n  const tenantIds = await listAuthTenantIds()\n  /*\n   * The remaining budget is fixed BEFORE any pool is asked.\n   *\n   * Sizing each pool's page from the running total is what forced these calls\n   * into a series — pool `k`'s page size could not be known until pool `k-1`\n   * had answered. Nothing needs that: a page sized to the whole remaining\n   * budget is always at least as large as the shrinking one, so the first\n   * `cap` rows in tenant order are the same users either way, and the pools\n   * can be asked together.\n   *\n   * The trade is bandwidth, not quota: `listUsers` is billed per CALL, and the\n   * call count is unchanged. Only when the cap actually binds does this carry\n   * rows that are then trimmed.\n   */\n  const budget = cap - users.length\n  if (budget <= 0) {\n    truncated = true\n  } else {\n    const pageSize = Math.min(budget, TENANT_USER_CAP)\n    const pages = await mapPoolsConcurrently(tenantIds, async (tenantId) => {\n      try {\n        return await authForPool(tenantId).listUsers(pageSize)\n      } catch (error) {\n        console.error(`listing users for tenant ${tenantId} failed`, error)\n        return null\n      }\n    })\n    pages.forEach((page, index) => {\n      if (!page) return\n      const tenantId = tenantIds[index]\n      const room = cap - users.length\n      const rows = page.users.map((record) => ({ record, tenantId }))\n      // A pool whose rows will not fit is still a pool that was cut short, and\n      // it has to say so. A scan that silently dropped one would answer \"no\n      // such account\" for everyone in it — the exact failure this module\n      // exists to prevent, wearing the shape of a complete result.\n      if (rows.length > room) {\n        truncated = true\n        tenantTruncated.push(tenantId)\n      } else if (page.pageToken) {\n        tenantTruncated.push(tenantId)\n      }\n      if (room > 0) users.push(...rows.slice(0, room))\n    })\n  }\n\n  return {\n    users: markCrossPoolUidCollisions(users),\n    truncated,\n    tenantTruncated,\n  }\n}\n\n/** Where a claim mutation landed, so a caller can audit the POOL as well. */\nexport interface StaffClaimWrite {\n  uid: string\n  /** The pool the claim was written to; null = the project pool. */\n  tenantId: string | null\n  email: string | null\n  claims: Record<string, unknown>\n}\n\n/**\n * Write custom claims to the pool the uid ACTUALLY lives in (AGL-1993).\n *\n * The hazard this exists to remove: `setCustomUserClaims` is per-pool, and a\n * grant aimed at the wrong pool does not error — on the project pool it\n * either throws `user-not-found` (loud, fine) or, when a phantom shadow record\n * shares the uid, silently succeeds against the WRONG record. That is not\n * hypothetical: on 2026-08-18 a staff account's uid existed in both the\n * project pool and `aglyn-org-y5v14` at once. That phantom won every lookup\n * until AGL-2005 made {@link findUserByUidAcrossPools} rank an IDENTIFIED\n * record above an unidentified one rather than taking the first pool to\n * answer.\n *\n * So resolution and mutation are bound together here rather than left to each\n * caller to pair correctly, and the resolved pool is RETURNED so the audit row\n * can record which pool was written — \"granted staff to uid X\" is not a\n * complete record when a uid can name two accounts.\n *\n * Never assumes a pool. Staff may live in the project pool, in Aglyn's own\n * tenant, or in a CUSTOMER org's tenant, and hard-coding any of them would\n * silently fail the moment a third exists.\n */\nexport async function setClaimsInOwningPool(\n  uid: string,\n  claims: Record<string, unknown>,\n): Promise<StaffClaimWrite | null> {\n  const found = await findUserByUidAcrossPools(uid)\n  if (!found) return null\n  await authForPool(found.tenantId).setCustomUserClaims(uid, claims)\n  return {\n    uid,\n    tenantId: found.tenantId,\n    email: found.record.email ?? null,\n    claims,\n  }\n}\n\n/**\n * Every uid carrying the `staff` claim, across all pools. Staff is a custom\n * claim, which is not queryable, so this scans — the caller caches it.\n */\nexport async function listStaffUidsAcrossPools(): Promise<string[]> {\n  /*\n   * Paging WITHIN a pool stays serial — each page's cursor comes out of the\n   * one before it, so there is nothing to overlap. Across pools there is: the\n   * pools are independent, and a staff notification waiting on them one after\n   * another gets slower with every enterprise customer signed.\n   *\n   * Each scan collects into its own array rather than a shared one, so the\n   * result is ordered by POOL rather than by which pool happened to answer\n   * first. A caller diffing this list against a stored copy would otherwise\n   * see phantom changes on every run.\n   */\n  const scan = async (pool: BaseAuth): Promise<string[]> => {\n    const found: string[] = []\n    let pageToken: string | undefined\n    do {\n      const page = await pool.listUsers(1000, pageToken)\n      for (const record of page.users) {\n        if (record.customClaims?.['staff']) found.push(record.uid)\n      }\n      pageToken = page.pageToken\n    } while (pageToken)\n    return found\n  }\n  const tenantIds = await listAuthTenantIds()\n  const [projectUids, tenantUidLists] = await Promise.all([\n    scan(auth()),\n    mapPoolsConcurrently(tenantIds, async (tenantId) => {\n      try {\n        return await scan(authForPool(tenantId))\n      } catch (error) {\n        console.error(`staff scan for tenant ${tenantId} failed`, error)\n        return [] as string[]\n      }\n    }),\n  ])\n  return [...projectUids, ...tenantUidLists.flat()]\n}\n"],"names":["firebaseAdmin","auth","app","isIdentifiedUserRecord","record","Boolean","email","providerData","length","identityStrength","score","phoneNumber","displayName","Object","keys","customClaims","collapseCrossPoolUidRows","users","marked","markCrossPoolUidCollisions","winnerByUid","Map","user","incumbent","get","uid","set","emitted","Set","collapsed","has","add","push","poolsByUid","pools","tenantId","map","others","filter","_","index","indexOf","uidAlsoInPools","tenantCache","TENANT_CACHE_MS","listAuthTenantIds","now","Date","at","ids","pageToken","page","tenantManager","listTenants","tenants","tenant","error","console","resetAuthTenantCache","authForPool","authForTenant","findUserByEmailAcrossPools","address","trim","toLowerCase","getUserByEmail","findUserByUidAcrossPools","matches","getUser","TENANT_USER_CAP","POOL_FETCH_CONCURRENCY","mapPoolsConcurrently","tenantIds","work","results","Array","next","workers","from","Math","min","Promise","all","listUsersAcrossPools","pageSize","listUsers","nextPageToken","tenantsIncluded","tenantTruncated","tenantPages","forEach","tenantPage","scanUsersAcrossPools","cap","truncated","remaining","budget","pages","room","rows","slice","setClaimsInOwningPool","claims","found","setCustomUserClaims","listStaffUidsAcrossPools","scan","pool","projectUids","tenantUidLists","flat"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;CAmBC;AAGD,OAAOA,mBAAmB,sBAAkB;AAE5C,MAAMC,OAAO,IAAMD,cAAcE,GAAG,GAAGD,IAAI;AA2B3C;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASE,uBAAuBC,MAAkB;;QAEtBA;IADjC,IAAI,CAACA,QAAQ,OAAO;IACpB,OAAOC,QAAQD,OAAOE,KAAK,KAAK,UAACF,uBAAAA,OAAOG,YAAY,qBAAnBH,qBAAqBI,MAAM,mBAAI,KAAK;AACvE;AAEA;;;;;;CAMC,GACD,OAAO,SAASC,iBAAiBL,MAAkB;cAOjCA;QAHXA;IAHL,IAAI,CAACA,QAAQ,OAAO;IACpB,IAAIM,QAAQ;IACZ,IAAIN,OAAOE,KAAK,EAAEI,SAAS;IAC3B,IAAI,UAACN,uBAAAA,OAAOG,YAAY,qBAAnBH,qBAAqBI,MAAM,mBAAI,KAAK,GAAGE,SAAS;IACrD,IAAIN,OAAOO,WAAW,EAAED,SAAS;IACjC,IAAIN,OAAOQ,WAAW,EAAEF,SAAS;IACjC,IAAIG,OAAOC,IAAI,EAACV,uBAAAA,OAAOW,YAAY,YAAnBX,uBAAuB,CAAC,GAAGI,MAAM,GAAG,GAAGE,SAAS;IAChE,OAAOA;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BC,GACD,OAAO,SAASM,yBACdC,KAAyB;IAEzB,2EAA2E;IAC3E,oEAAoE;IACpE,MAAMC,SAASC,2BAA2BF;IAC1C,MAAMG,cAAc,IAAIC;IACxB,KAAK,MAAMC,QAAQJ,OAAQ;QACzB,MAAMK,YAAYH,YAAYI,GAAG,CAACF,KAAKlB,MAAM,CAACqB,GAAG;QACjD,IACE,CAACF,aACDd,iBAAiBa,KAAKlB,MAAM,IAAIK,iBAAiBc,UAAUnB,MAAM,GACjE;YACAgB,YAAYM,GAAG,CAACJ,KAAKlB,MAAM,CAACqB,GAAG,EAAEH;QACnC;IACF;IACA,MAAMK,UAAU,IAAIC;IACpB,MAAMC,YAAgC,EAAE;IACxC,KAAK,MAAMP,QAAQJ,OAAQ;YAIVE;QAHf,MAAMK,MAAMH,KAAKlB,MAAM,CAACqB,GAAG;QAC3B,IAAIE,QAAQG,GAAG,CAACL,MAAM;QACtBE,QAAQI,GAAG,CAACN;QACZI,UAAUG,IAAI,EAACZ,mBAAAA,YAAYI,GAAG,CAACC,gBAAhBL,mBAAwBE;IACzC;IACA,OAAOO;AACT;AAEA;;;;;;CAMC,GACD,OAAO,SAASV,2BACdF,KAAyB;IAEzB,MAAMgB,aAAa,IAAIZ;IACvB,KAAK,MAAMC,QAAQL,MAAO;YACVgB;QAAd,MAAMC,SAAQD,kBAAAA,WAAWT,GAAG,CAACF,KAAKlB,MAAM,CAACqB,GAAG,aAA9BQ,kBAAmC,EAAE;QACnDC,MAAMF,IAAI,CAACV,KAAKa,QAAQ;QACxBF,WAAWP,GAAG,CAACJ,KAAKlB,MAAM,CAACqB,GAAG,EAAES;IAClC;IACA,OAAOjB,MAAMmB,GAAG,CAAC,CAACd;YACFW;QAAd,MAAMC,SAAQD,kBAAAA,WAAWT,GAAG,CAACF,KAAKlB,MAAM,CAACqB,GAAG,aAA9BQ,kBAAmC,EAAE;QACnD,IAAIC,MAAM1B,MAAM,GAAG,GAAG,OAAOc;QAC7B,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,MAAMe,SAASH,MAAMI,MAAM,CAAC,CAACC,GAAGC,QAAUA,UAAUN,MAAMO,OAAO,CAACnB,KAAKa,QAAQ;QAC/E,OAAO,aAAKb;YAAMoB,gBAAgBL;;IACpC;AACF;AAEA;;;;;CAKC,GACD,IAAIM,cAAoD;AACxD,MAAMC,kBAAkB;AAExB,OAAO,eAAeC;IACpB,MAAMC,MAAMC,KAAKD,GAAG;IACpB,IAAIH,eAAeG,MAAMH,YAAYK,EAAE,GAAGJ,iBAAiB;QACzD,OAAOD,YAAYM,GAAG;IACxB;IACA,IAAI;QACF,MAAMA,MAAgB,EAAE;QACxB,IAAIC;QACJ,GAAG;YACD,MAAMC,OAAO,MAAMlD,OAAOmD,aAAa,GAAGC,WAAW,CAAC,KAAKH;YAC3DD,IAAIjB,IAAI,IAAImB,KAAKG,OAAO,CAAClB,GAAG,CAAC,CAACmB,SAAWA,OAAOpB,QAAQ;YACxDe,YAAYC,KAAKD,SAAS;QAC5B,QAASA,UAAU;QACnBP,cAAc;YAAEM;YAAKD,IAAIF;QAAI;QAC7B,OAAOG;IACT,EAAE,OAAOO,OAAO;;QACdC,QAAQD,KAAK,CAAC,uDAAuDA;QACrE,eAAOb,+BAAAA,YAAaM,GAAG,mBAAI,EAAE;IAC/B;AACF;AAEA,0EAA0E,GAC1E,OAAO,SAASS;IACdf,cAAc;AAChB;AAEA,6EAA6E,GAC7E,OAAO,SAASgB,YAAYxB,QAAmC;IAC7D,OAAOA,WACHlC,OAAOmD,aAAa,GAAGQ,aAAa,CAACzB,YACrClC;AACN;AAEA;;;;;;;CAOC,GACD,OAAO,eAAe4D,2BACpBvD,KAAa;IAEb,MAAMwD,UAAUxD,MAAMyD,IAAI,GAAGC,WAAW;IACxC,IAAI,CAACF,SAAS,OAAO;IACrB,IAAI;QACF,OAAO;YAAE1D,QAAQ,MAAMH,OAAOgE,cAAc,CAACH;YAAU3B,UAAU;QAAK;IACxE,EAAE,eAAM;IACN,yDAAyD;IAC3D;IACA,KAAK,MAAMA,YAAY,CAAA,MAAMU,mBAAkB,EAAG;QAChD,IAAI;YACF,MAAMzC,SAAS,MAAMuD,YAAYxB,UAAU8B,cAAc,CAACH;YAC1D,OAAO;gBAAE1D;gBAAQ+B;YAAS;QAC5B,EAAE,eAAM;QACN,oCAAoC;QACtC;IACF;IACA,OAAO;AACT;AAEA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,eAAe+B,yBACpBzC,GAAW;QA4BJT;IA1BP,IAAI,CAACS,KAAK,OAAO;IACjB,MAAM0C,UAA8B,EAAE;IACtC,IAAI;QACF,MAAM/D,SAAS,MAAMH,OAAOmE,OAAO,CAAC3C;QACpC,IAAItB,uBAAuBC,SAAS,OAAO;YAAEA;YAAQ+B,UAAU;QAAK;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChEgC,QAAQnC,IAAI,CAAC;YAAE5B;YAAQ+B,UAAU;QAAK;IACxC,EAAE,eAAM;IACN,2BAA2B;IAC7B;IACA,KAAK,MAAMA,YAAY,CAAA,MAAMU,mBAAkB,EAAG;QAChD,IAAI;YACF,MAAMzC,SAAS,MAAMuD,YAAYxB,UAAUiC,OAAO,CAAC3C;YACnD0C,QAAQnC,IAAI,CAAC;gBAAE5B;gBAAQ+B;YAAS;YAChC,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,IAAIhC,uBAAuBC,SAAS;QACtC,EAAE,eAAM;QACN,gBAAgB;QAClB;IACF;IACA,IAAI,CAAC+D,QAAQ3D,MAAM,EAAE,OAAO;IAC5B,QAAOQ,6BAAAA,yBAAyBmD,QAAQ,CAAC,EAAE,YAApCnD,6BAAwC;AACjD;AAkBA,2EAA2E,GAC3E,MAAMqD,kBAAkB;AAExB;;;;;;;;;;;;;;;CAeC,GACD,MAAMC,yBAAyB;AAE/B;;;;;;;;CAQC,GACD,eAAeC,qBACbC,SAAmB,EACnBC,IAAsC;IAEtC,MAAMC,UAAU,IAAIC,MAASH,UAAUhE,MAAM;IAC7C,IAAIoE,OAAO;IACX,MAAMC,UAAUF,MAAMG,IAAI,CACxB;QAAEtE,QAAQuE,KAAKC,GAAG,CAACV,wBAAwBE,UAAUhE,MAAM;IAAE,GAC7D;QACE,OAAS;YACP,MAAMgC,QAAQoC;YACd,IAAIpC,SAASgC,UAAUhE,MAAM,EAAE;YAC/BkE,OAAO,CAAClC,MAAM,GAAG,MAAMiC,KAAKD,SAAS,CAAChC,MAAM;QAC9C;IACF;IAEF,MAAMyC,QAAQC,GAAG,CAACL;IAClB,OAAOH;AACT;AAEA;;;;;CAKC,GACD,OAAO,eAAeS,qBACpBC,QAAgB,EAChBlC,SAAkB;IAElB,MAAMC,OAAO,MAAMlD,OAAOoF,SAAS,CAACD,UAAUlC;IAC9C,MAAMjC,QAA4BkC,KAAKlC,KAAK,CAACmB,GAAG,CAAC,CAAChC,SAAY,CAAA;YAC5DA;YACA+B,UAAU;QACZ,CAAA;IACA,IAAIgB,KAAKD,SAAS,EAAE;QAClB,OAAO;YACLjC;YACAqE,eAAenC,KAAKD,SAAS;YAC7BqC,iBAAiB;YACjBC,iBAAiB,EAAE;QACrB;IACF;IACA,MAAMA,kBAA4B,EAAE;IACpC,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAMhB,YAAY,MAAM3B;IACxB,MAAM4C,cAAc,MAAMlB,qBAAqBC,WAAW,OAAOrC;QAC/D,IAAI;YACF,OAAO,MAAMwB,YAAYxB,UAAUkD,SAAS,CAAChB;QAC/C,EAAE,OAAOb,OAAO;YACdC,QAAQD,KAAK,CAAC,CAAC,yBAAyB,EAAErB,SAAS,OAAO,CAAC,EAAEqB;YAC7D,OAAO;QACT;IACF;IACAiC,YAAYC,OAAO,CAAC,CAACC,YAAYnD;QAC/B,IAAI,CAACmD,YAAY;QACjB,MAAMxD,WAAWqC,SAAS,CAAChC,MAAM;QACjCvB,MAAMe,IAAI,IAAI2D,WAAW1E,KAAK,CAACmB,GAAG,CAAC,CAAChC,SAAY,CAAA;gBAAEA;gBAAQ+B;YAAS,CAAA;QACnE,IAAIwD,WAAWzC,SAAS,EAAEsC,gBAAgBxD,IAAI,CAACG;IACjD;IACA,OAAO;QACL,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1ElB,OAAOE,2BAA2BF;QAClCqE,eAAe;QACfC,iBAAiB;QACjBC;IACF;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAeI,qBACpBC,GAAW;IAMX,MAAM5E,QAA4B,EAAE;IACpC,IAAI6E,YAAY;IAChB,IAAI5C;IAEJ,GAAG;QACD,MAAM6C,YAAYF,MAAM5E,MAAMT,MAAM;QACpC,IAAIuF,aAAa,GAAG;YAClBD,YAAY;YACZ;QACF;QACA,4DAA4D;QAC5D,MAAM3C,OAAO,MAAMlD,OAAOoF,SAAS,CAACN,KAAKC,GAAG,CAACe,WAAW,OAAO7C;QAC/DjC,MAAMe,IAAI,IAAImB,KAAKlC,KAAK,CAACmB,GAAG,CAAC,CAAChC,SAAY,CAAA;gBAAEA;gBAAQ+B,UAAU;YAAK,CAAA;QACnEe,YAAYC,KAAKD,SAAS;QAC1B,IAAIA,aAAajC,MAAMT,MAAM,IAAIqF,KAAKC,YAAY;IACpD,QAAS5C,aAAajC,MAAMT,MAAM,GAAGqF,IAAI;IAEzC,MAAML,kBAA4B,EAAE;IACpC,MAAMhB,YAAY,MAAM3B;IACxB;;;;;;;;;;;;;GAaC,GACD,MAAMmD,SAASH,MAAM5E,MAAMT,MAAM;IACjC,IAAIwF,UAAU,GAAG;QACfF,YAAY;IACd,OAAO;QACL,MAAMV,WAAWL,KAAKC,GAAG,CAACgB,QAAQ3B;QAClC,MAAM4B,QAAQ,MAAM1B,qBAAqBC,WAAW,OAAOrC;YACzD,IAAI;gBACF,OAAO,MAAMwB,YAAYxB,UAAUkD,SAAS,CAACD;YAC/C,EAAE,OAAO5B,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,yBAAyB,EAAErB,SAAS,OAAO,CAAC,EAAEqB;gBAC7D,OAAO;YACT;QACF;QACAyC,MAAMP,OAAO,CAAC,CAACvC,MAAMX;YACnB,IAAI,CAACW,MAAM;YACX,MAAMhB,WAAWqC,SAAS,CAAChC,MAAM;YACjC,MAAM0D,OAAOL,MAAM5E,MAAMT,MAAM;YAC/B,MAAM2F,OAAOhD,KAAKlC,KAAK,CAACmB,GAAG,CAAC,CAAChC,SAAY,CAAA;oBAAEA;oBAAQ+B;gBAAS,CAAA;YAC5D,yEAAyE;YACzE,sEAAsE;YACtE,mEAAmE;YACnE,6DAA6D;YAC7D,IAAIgE,KAAK3F,MAAM,GAAG0F,MAAM;gBACtBJ,YAAY;gBACZN,gBAAgBxD,IAAI,CAACG;YACvB,OAAO,IAAIgB,KAAKD,SAAS,EAAE;gBACzBsC,gBAAgBxD,IAAI,CAACG;YACvB;YACA,IAAI+D,OAAO,GAAGjF,MAAMe,IAAI,IAAImE,KAAKC,KAAK,CAAC,GAAGF;QAC5C;IACF;IAEA,OAAO;QACLjF,OAAOE,2BAA2BF;QAClC6E;QACAN;IACF;AACF;AAWA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,OAAO,eAAea,sBACpB5E,GAAW,EACX6E,MAA+B;QAQtBC;IANT,MAAMA,QAAQ,MAAMrC,yBAAyBzC;IAC7C,IAAI,CAAC8E,OAAO,OAAO;IACnB,MAAM5C,YAAY4C,MAAMpE,QAAQ,EAAEqE,mBAAmB,CAAC/E,KAAK6E;IAC3D,OAAO;QACL7E;QACAU,UAAUoE,MAAMpE,QAAQ;QACxB7B,KAAK,GAAEiG,sBAAAA,MAAMnG,MAAM,CAACE,KAAK,YAAlBiG,sBAAsB;QAC7BD;IACF;AACF;AAEA;;;CAGC,GACD,OAAO,eAAeG;IACpB;;;;;;;;;;GAUC,GACD,MAAMC,OAAO,OAAOC;QAClB,MAAMJ,QAAkB,EAAE;QAC1B,IAAIrD;QACJ,GAAG;YACD,MAAMC,OAAO,MAAMwD,KAAKtB,SAAS,CAAC,MAAMnC;YACxC,KAAK,MAAM9C,UAAU+C,KAAKlC,KAAK,CAAE;oBAC3Bb;gBAAJ,KAAIA,uBAAAA,OAAOW,YAAY,qBAAnBX,oBAAqB,CAAC,QAAQ,EAAEmG,MAAMvE,IAAI,CAAC5B,OAAOqB,GAAG;YAC3D;YACAyB,YAAYC,KAAKD,SAAS;QAC5B,QAASA,UAAU;QACnB,OAAOqD;IACT;IACA,MAAM/B,YAAY,MAAM3B;IACxB,MAAM,CAAC+D,aAAaC,eAAe,GAAG,MAAM5B,QAAQC,GAAG,CAAC;QACtDwB,KAAKzG;QACLsE,qBAAqBC,WAAW,OAAOrC;YACrC,IAAI;gBACF,OAAO,MAAMuE,KAAK/C,YAAYxB;YAChC,EAAE,OAAOqB,OAAO;gBACdC,QAAQD,KAAK,CAAC,CAAC,sBAAsB,EAAErB,SAAS,OAAO,CAAC,EAAEqB;gBAC1D,OAAO,EAAE;YACX;QACF;KACD;IACD,OAAO;WAAIoD;WAAgBC,eAAeC,IAAI;KAAG;AACnD"}