@antasphere/chassis-server 1.0.0

package/LICENSE

@@ -0,0 +1,82 @@
+# License
+
+The Antasphere chassis
+Copyright (c) 2026 Antasphere
+
+The Antasphere chassis is made available by Antasphere, the licensor, under the "Sustainable Use License" as
+defined below. All third party components incorporated into the Antasphere chassis are licensed under the
+original license provided by the owner of the applicable component.
+
+## Sustainable Use License
+
+Version 1.0
+
+### Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+### Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide, non-sublicensable, non-transferable license
+to use, copy, distribute, make available, and prepare derivative works of the software, in each case subject
+to the limitations below.
+
+### Limitations
+
+You may use or modify the software only for your own internal business purposes or for non-commercial or
+personal use. You may distribute the software or provide it to others only if you do so free of charge for
+non-commercial purposes. You may not alter, remove, or obscure any licensing, copyright, or other notices of
+the licensor in the software. Any use of the licensor’s trademarks is subject to applicable law.
+
+### Patents
+
+The licensor grants you a license, under any patent claims the licensor can license, or becomes able to
+license, to make, have made, use, sell, offer for sale, import and have imported the software, in each case
+subject to the limitations and conditions in this license. This license does not cover any patent claims that
+you cause to be infringed by modifications or additions to the software. If you or your company make any
+written claim that the software infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company makes such a claim, your patent
+license ends immediately for work on behalf of your company.
+
+### Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these
+terms. If you modify the software, you must include in any modified copies of the software a prominent notice
+stating that you have modified the software.
+
+### No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in these terms.
+
+### Termination
+
+If you use the software in violation of these terms, such use is not licensed, and your license will
+automatically terminate. If the licensor provides you with a notice of your violation, and you cease all
+violation of this license no later than 30 days after you receive that notice, your license will be reinstated
+retroactively. However, if you violate these terms after such reinstatement, any additional violation of these
+terms will cause your license to terminate automatically and permanently.
+
+### No Liability
+
+As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will
+not be liable to you for any damages arising out of these terms or the use or nature of the software, under
+any kind of legal claim.
+
+### Definitions
+
+The “licensor” is the entity offering these terms.
+
+The “software” is the software the licensor makes available under these terms, including any portion of it.
+
+“You” refers to the individual or entity agreeing to these terms.
+
+“Your company” is any legal entity, sole proprietorship, or other kind of organization that you work for, plus
+all organizations that have control over, are under the control of, or are under common control with that
+organization. Control means ownership of substantially all the assets of an entity, or the power to direct its
+management and policies by vote, contract, or otherwise. Control can be direct or indirect.
+
+“Your license” is the license granted to you for the software under these terms.
+
+“Use” means anything you do with the software requiring your license.
+
+“Trademark” means trademarks, service marks, and similar rights.

package/dist/accounts/deletion.d.ts

@@ -0,0 +1,163 @@
+import { type Db } from '@antasphere/chassis-db';
+import type { AuditService } from '../audit/service.js';
+import type { Logger } from '../logger.js';
+import type { ErasureLog } from './erasure-log.js';
+/**
+ * Account deletion (GDPR erasure), shared by both delete surfaces: the
+ * self-service Better Auth `/delete-user` route (via the boot-wired
+ * before/after hooks) and the admin `DELETE /members/{id}` endpoint.
+ *
+ * Deliberately NO storage dependency: files are WORKSPACE data, not the
+ * uploader's personal data — they survive the delete with `created_by`
+ * nulled by the FK (migration 0008, ADR 006). Blobs are never touched here.
+ *
+ * Multi-workspace (ADR 014): a user owning N workspaces has N last-owner
+ * obligations — the guard runs for EVERY workspace where they are an
+ * active owner, with the per-workspace locks acquired in deterministic
+ * order (sorted workspace id) so two concurrent deletes of co-owners can
+ * never deadlock. The completion audit row lands in every workspace the
+ * user belonged to.
+ *
+ * Projection exemption (D11, the cloud-binding plan): the guard
+ * applies ONLY to workspaces this instance owns (centralAccountId IS
+ * NULL). A projected (hub-origin) workspace asserts ownership hub-side —
+ * its local membership rows are a re-syncable projection, so a
+ * zero-local-owner state is legal there and the guard (app layer AND the
+ * 0009 trigger, migration 0019) stands aside. Structured now, inert until
+ * the cloud edition creates the first projection (Phase 3).
+ *
+ * Last-owner race hardening (ADR 006, M9): a zero-active-owner workspace is
+ * unrecoverable (setup is one-shot), so the guard is enforced in two layers:
+ *
+ *  1. A `BEFORE DELETE OR UPDATE` trigger on workspace_members (migration
+ *     0009) raises SQLSTATE {@link LAST_OWNER_SQLSTATE} whenever an operation
+ *     would drop the workspace's ACTIVE owners to zero — serialized inside
+ *     the trigger by a per-workspace `pg_advisory_xact_lock`, so it holds
+ *     under ANY concurrency and on any code path. This is the guarantee.
+ *  2. A per-workspace session-scoped advisory lock (dedicated `pg.Client`,
+ *     mirroring the migration-lock pattern) serializes the HTTP surfaces
+ *     around their guard re-check, so the LOSER of a race is rejected at the
+ *     guard with a clean `LastOwnerError` (→ 400) instead of tripping the
+ *     trigger mid-cascade (→ 500).
+ */
+/** Deleting this account would leave the workspace without an active owner. */
+export declare class LastOwnerError extends Error {
+    constructor();
+}
+/** SQLSTATE raised by the workspace_members last-owner trigger (migration 0009). */
+export declare const LAST_OWNER_SQLSTATE = "P0409";
+/**
+ * True when `cause` (or anything on its `cause` chain — drizzle wraps pg's
+ * DatabaseError) is the last-owner trigger rejection.
+ */
+export declare function isLastOwnerDbError(cause: unknown): boolean;
+/** True when the workspace keeps ≥1 ACTIVE owner besides excludeUserId. */
+export declare function hasOtherActiveOwner(db: Db, workspaceId: string, excludeUserId: string): Promise<boolean>;
+export declare class AccountDeletionService {
+    private readonly db;
+    private readonly audit;
+    private readonly logger;
+    /** Dedicated advisory-lock connections (mirrors packages/chassis-db migrate.ts). */
+    private readonly connectionString;
+    /** The append-only erasure tombstone (OPS-3): every completed erasure lands a line. */
+    private readonly erasureLog?;
+    /**
+     * before/after stash: beforeUserDelete runs with the user row still
+     * present (memberships + email are readable); afterUserDelete runs after
+     * the FK cascade, when neither is — so the system-actor audit rows pop
+     * their context from here. In-process by design: both hooks run in the
+     * same request on the same replica.
+     */
+    private readonly stash;
+    /** Locks parked across Better Auth's cascade (beforeUserDelete → afterUserDelete). */
+    private readonly heldLocks;
+    constructor(db: Db, audit: AuditService, logger: Logger, 
+    /** Dedicated advisory-lock connections (mirrors packages/chassis-db migrate.ts). */
+    connectionString: string, 
+    /** The append-only erasure tombstone (OPS-3): every completed erasure lands a line. */
+    erasureLog?: ErasureLog | undefined);
+    /**
+     * Throws LastOwnerError when the user is the last ACTIVE owner of ANY of
+     * their non-projected workspaces (ADR 014: N owned workspaces = N
+     * obligations; projected ones are exempt, D11). Unlocked fast-path check —
+     * the race-free enforcement is withLastOwnerGuard + the 0009/0019 trigger.
+     */
+    assertDeletable(userId: string): Promise<void>;
+    /**
+     * Serialize an owner-removing operation and enforce the last-owner rule
+     * race-free: the per-workspace advisory lock makes the guard re-check see
+     * every previously committed removal (the loser of a race rejects with
+     * LastOwnerError → 400), and the migration-0009 trigger — surfaced here as
+     * LastOwnerError too — backstops anything that slips past. The lock is
+     * released on EVERY path (finally). Projected workspaces skip the guard
+     * entirely (D11): ownership is asserted hub-side and the trigger stands
+     * aside there too (migration 0019).
+     */
+    withLastOwnerGuard<T>(workspaceId: string, excludeUserId: string, op: () => Promise<T>): Promise<T>;
+    /**
+     * Guard + stash. Runs while the user row still exists. For EVERY
+     * non-projected workspace where the user is an ACTIVE OWNER the guard
+     * re-check runs under that workspace's lock — locks acquired in
+     * deterministic order (sorted workspace id) so concurrent deletes never
+     * deadlock — and the locks are parked across Better Auth's cascade
+     * (released by afterUserDelete, or by the watchdog if the cascade dies in
+     * between). Of two concurrent last-owner self-deletes, the loser blocks
+     * here until the winner's cascade commits, re-checks, and rejects with a
+     * clean LastOwnerError.
+     */
+    beforeUserDelete(userId: string): Promise<void>;
+    /**
+     * Run an erasure under EVERY last-owner guard the user is subject to, with
+     * nothing touched when any guard refuses (PRDCT-1809). The boot-time
+     * tombstone replay uses this: Better Auth's cascade deletes the account
+     * rows BEFORE the user row, so a delete the 0009 trigger refuses mid-way
+     * leaves a half-erased owner (no credential, PII intact, membership
+     * intact). The locks are acquired in sorted order (as beforeUserDelete)
+     * and released on every path; a refusal surfaces as LastOwnerError before
+     * `op` runs, and a trigger refusal inside `op` is mapped to the same.
+     */
+    withAllLastOwnerGuards<T>(userId: string, op: () => Promise<T>): Promise<T>;
+    /**
+     * Land the erasure tombstone (OPS-3) for a deletion that did NOT run
+     * through Better Auth's deleteUser hooks — the admin DELETE /members/{id}
+     * cascade calls the internal adapter directly, so afterUserDelete never
+     * fires there. Every GDPR surface must end here or in afterUserDelete.
+     */
+    recordErasure(user: {
+        id: string;
+        email: string;
+    }): Promise<void>;
+    /** Pop the stash and record the system-actor completion rows (FK-safe: the user is gone). */
+    afterUserDelete(user: {
+        id: string;
+        email: string;
+    }): Promise<void>;
+    /**
+     * Acquire the per-workspace lock and run the guard re-check for EVERY
+     * non-projected workspace where the user is an active owner, in sorted
+     * order (deterministic → no deadlock between concurrent deletes). On a
+     * refusal every lock taken so far is released and LastOwnerError is
+     * thrown; on success the caller owns the locks.
+     */
+    private acquireOwnerLocks;
+    /**
+     * Session-scoped pg_advisory_lock on a dedicated client — never the pool:
+     * a session lock parked on a pooled connection would poison the pool.
+     */
+    private acquireOwnerLock;
+    /** Idempotent; closing the client guarantees the session lock dies with it. */
+    private releaseOwnerLock;
+    /** Park the locks across the cascade, each watchdogged against a hook-gap leak. */
+    private parkLocks;
+    /** Every membership row the user holds, active or not. */
+    private membershipsOf;
+    /**
+     * Workspaces where the user is an ACTIVE OWNER and the last-owner guard
+     * applies — i.e. NON-PROJECTED ones (centralAccountId IS NULL, D11).
+     * Sorted for deterministic lock ordering.
+     */
+    private ownedGuardedWorkspaceIds;
+    /** True when the workspace is a hub projection (ownership asserted hub-side, D11). */
+    private isProjectedWorkspace;
+}
+//# sourceMappingURL=deletion.d.ts.map

package/dist/accounts/deletion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deletion.d.ts","sourceRoot":"","sources":["../../src/accounts/deletion.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmD,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAClG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,+EAA+E;AAC/E,qBAAa,cAAe,SAAQ,KAAK;;CAKxC;AAED,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAE3C;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAK1D;AA0BD,2EAA2E;AAC3E,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,EAAE,EACN,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED,qBAAa,sBAAsB;IAc/B,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAnB9B;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgE;IAEtF,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;gBAGzC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM;IAC/B,oFAAoF;IACnE,gBAAgB,EAAE,MAAM;IACzC,uFAAuF;IACtE,UAAU,CAAC,EAAE,UAAU,YAAA;IAG1C;;;;;OAKG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAkBzG;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrD;;;;;;;;;OASG;IACG,sBAAsB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAYjF;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE,6FAA6F;IACvF,eAAe,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BzE;;;;;;OAMG;YACW,iBAAiB;IAgB/B;;;OAGG;YACW,gBAAgB;IAa9B,+EAA+E;YACjE,gBAAgB;IAe9B,mFAAmF;IACnF,OAAO,CAAC,SAAS;IAmBjB,0DAA0D;YAC5C,aAAa;IAa3B;;;;OAIG;YACW,wBAAwB;IAgBtC,sFAAsF;YACxE,oBAAoB;CAQnC"}

package/dist/accounts/deletion.js

@@ -0,0 +1,360 @@
+import pg from 'pg';
+import { and, eq, isNull, ne } from 'drizzle-orm';
+import { user as userTable, workspaceMembers, workspaces } from '@antasphere/chassis-db';
+/**
+ * Account deletion (GDPR erasure), shared by both delete surfaces: the
+ * self-service Better Auth `/delete-user` route (via the boot-wired
+ * before/after hooks) and the admin `DELETE /members/{id}` endpoint.
+ *
+ * Deliberately NO storage dependency: files are WORKSPACE data, not the
+ * uploader's personal data — they survive the delete with `created_by`
+ * nulled by the FK (migration 0008, ADR 006). Blobs are never touched here.
+ *
+ * Multi-workspace (ADR 014): a user owning N workspaces has N last-owner
+ * obligations — the guard runs for EVERY workspace where they are an
+ * active owner, with the per-workspace locks acquired in deterministic
+ * order (sorted workspace id) so two concurrent deletes of co-owners can
+ * never deadlock. The completion audit row lands in every workspace the
+ * user belonged to.
+ *
+ * Projection exemption (D11, the cloud-binding plan): the guard
+ * applies ONLY to workspaces this instance owns (centralAccountId IS
+ * NULL). A projected (hub-origin) workspace asserts ownership hub-side —
+ * its local membership rows are a re-syncable projection, so a
+ * zero-local-owner state is legal there and the guard (app layer AND the
+ * 0009 trigger, migration 0019) stands aside. Structured now, inert until
+ * the cloud edition creates the first projection (Phase 3).
+ *
+ * Last-owner race hardening (ADR 006, M9): a zero-active-owner workspace is
+ * unrecoverable (setup is one-shot), so the guard is enforced in two layers:
+ *
+ *  1. A `BEFORE DELETE OR UPDATE` trigger on workspace_members (migration
+ *     0009) raises SQLSTATE {@link LAST_OWNER_SQLSTATE} whenever an operation
+ *     would drop the workspace's ACTIVE owners to zero — serialized inside
+ *     the trigger by a per-workspace `pg_advisory_xact_lock`, so it holds
+ *     under ANY concurrency and on any code path. This is the guarantee.
+ *  2. A per-workspace session-scoped advisory lock (dedicated `pg.Client`,
+ *     mirroring the migration-lock pattern) serializes the HTTP surfaces
+ *     around their guard re-check, so the LOSER of a race is rejected at the
+ *     guard with a clean `LastOwnerError` (→ 400) instead of tripping the
+ *     trigger mid-cascade (→ 500).
+ */
+/** Deleting this account would leave the workspace without an active owner. */
+export class LastOwnerError extends Error {
+    constructor() {
+        super('The workspace must keep at least one active owner');
+        this.name = 'LastOwnerError';
+    }
+}
+/** SQLSTATE raised by the workspace_members last-owner trigger (migration 0009). */
+export const LAST_OWNER_SQLSTATE = 'P0409';
+/**
+ * True when `cause` (or anything on its `cause` chain — drizzle wraps pg's
+ * DatabaseError) is the last-owner trigger rejection.
+ */
+export function isLastOwnerDbError(cause) {
+    for (let err = cause; err instanceof Error; err = err.cause) {
+        if (err.code === LAST_OWNER_SQLSTATE)
+            return true;
+    }
+    return false;
+}
+/**
+ * Advisory-lock namespace for serializing owner-removing operations
+ * (two-int form: classid 7432003, objid = hashtext(workspace id)). Distinct
+ * from the migration lock (7432001) and the trigger's own xact lock
+ * (7432002) — the session lock is held ACROSS the cascade while the trigger
+ * lock is taken INSIDE it, so sharing a key would self-deadlock.
+ */
+const OWNER_GUARD_LOCK_KEY = 7_432_003;
+/**
+ * The self-service path parks the lock between Better Auth's before/after
+ * hooks; if the cascade dies in between, afterDelete never runs. The
+ * watchdog then cuts the dedicated connection (a session lock dies with its
+ * session), so a leaked lock can stall owner removals for at most this long.
+ */
+const LOCK_WATCHDOG_MS = 60_000;
+/** True when the workspace keeps ≥1 ACTIVE owner besides excludeUserId. */
+export async function hasOtherActiveOwner(db, workspaceId, excludeUserId) {
+    const [row] = await db
+        .select({ id: workspaceMembers.id })
+        .from(workspaceMembers)
+        .where(and(eq(workspaceMembers.workspaceId, workspaceId), eq(workspaceMembers.role, 'owner'), eq(workspaceMembers.isActive, true), ne(workspaceMembers.userId, excludeUserId)))
+        .limit(1);
+    return Boolean(row);
+}
+export class AccountDeletionService {
+    db;
+    audit;
+    logger;
+    connectionString;
+    erasureLog;
+    /**
+     * before/after stash: beforeUserDelete runs with the user row still
+     * present (memberships + email are readable); afterUserDelete runs after
+     * the FK cascade, when neither is — so the system-actor audit rows pop
+     * their context from here. In-process by design: both hooks run in the
+     * same request on the same replica.
+     */
+    stash = new Map();
+    /** Locks parked across Better Auth's cascade (beforeUserDelete → afterUserDelete). */
+    heldLocks = new Map();
+    constructor(db, audit, logger, 
+    /** Dedicated advisory-lock connections (mirrors packages/chassis-db migrate.ts). */
+    connectionString, 
+    /** The append-only erasure tombstone (OPS-3): every completed erasure lands a line. */
+    erasureLog) {
+        this.db = db;
+        this.audit = audit;
+        this.logger = logger;
+        this.connectionString = connectionString;
+        this.erasureLog = erasureLog;
+    }
+    /**
+     * Throws LastOwnerError when the user is the last ACTIVE owner of ANY of
+     * their non-projected workspaces (ADR 014: N owned workspaces = N
+     * obligations; projected ones are exempt, D11). Unlocked fast-path check —
+     * the race-free enforcement is withLastOwnerGuard + the 0009/0019 trigger.
+     */
+    async assertDeletable(userId) {
+        for (const workspaceId of await this.ownedGuardedWorkspaceIds(userId)) {
+            if (!(await hasOtherActiveOwner(this.db, workspaceId, userId))) {
+                throw new LastOwnerError();
+            }
+        }
+    }
+    /**
+     * Serialize an owner-removing operation and enforce the last-owner rule
+     * race-free: the per-workspace advisory lock makes the guard re-check see
+     * every previously committed removal (the loser of a race rejects with
+     * LastOwnerError → 400), and the migration-0009 trigger — surfaced here as
+     * LastOwnerError too — backstops anything that slips past. The lock is
+     * released on EVERY path (finally). Projected workspaces skip the guard
+     * entirely (D11): ownership is asserted hub-side and the trigger stands
+     * aside there too (migration 0019).
+     */
+    async withLastOwnerGuard(workspaceId, excludeUserId, op) {
+        if (await this.isProjectedWorkspace(workspaceId)) {
+            return op();
+        }
+        const lock = await this.acquireOwnerLock(workspaceId);
+        try {
+            if (!(await hasOtherActiveOwner(this.db, workspaceId, excludeUserId))) {
+                throw new LastOwnerError();
+            }
+            return await op();
+        }
+        catch (cause) {
+            if (isLastOwnerDbError(cause))
+                throw new LastOwnerError();
+            throw cause;
+        }
+        finally {
+            await this.releaseOwnerLock(lock);
+        }
+    }
+    /**
+     * Guard + stash. Runs while the user row still exists. For EVERY
+     * non-projected workspace where the user is an ACTIVE OWNER the guard
+     * re-check runs under that workspace's lock — locks acquired in
+     * deterministic order (sorted workspace id) so concurrent deletes never
+     * deadlock — and the locks are parked across Better Auth's cascade
+     * (released by afterUserDelete, or by the watchdog if the cascade dies in
+     * between). Of two concurrent last-owner self-deletes, the loser blocks
+     * here until the winner's cascade commits, re-checks, and rejects with a
+     * clean LastOwnerError.
+     */
+    async beforeUserDelete(userId) {
+        const memberships = await this.membershipsOf(userId);
+        if (memberships.length === 0)
+            return; // no workspace to guard or audit against
+        const locks = await this.acquireOwnerLocks(userId);
+        if (locks.length > 0)
+            this.parkLocks(userId, locks);
+        const [u] = await this.db
+            .select({ email: userTable.email })
+            .from(userTable)
+            .where(eq(userTable.id, userId))
+            .limit(1);
+        this.stash.set(userId, {
+            workspaceIds: memberships.map((m) => m.workspaceId),
+            email: u?.email ?? ''
+        });
+    }
+    /**
+     * Run an erasure under EVERY last-owner guard the user is subject to, with
+     * nothing touched when any guard refuses (PRDCT-1809). The boot-time
+     * tombstone replay uses this: Better Auth's cascade deletes the account
+     * rows BEFORE the user row, so a delete the 0009 trigger refuses mid-way
+     * leaves a half-erased owner (no credential, PII intact, membership
+     * intact). The locks are acquired in sorted order (as beforeUserDelete)
+     * and released on every path; a refusal surfaces as LastOwnerError before
+     * `op` runs, and a trigger refusal inside `op` is mapped to the same.
+     */
+    async withAllLastOwnerGuards(userId, op) {
+        const locks = await this.acquireOwnerLocks(userId);
+        try {
+            return await op();
+        }
+        catch (cause) {
+            if (isLastOwnerDbError(cause))
+                throw new LastOwnerError();
+            throw cause;
+        }
+        finally {
+            for (const lock of locks)
+                await this.releaseOwnerLock(lock);
+        }
+    }
+    /**
+     * Land the erasure tombstone (OPS-3) for a deletion that did NOT run
+     * through Better Auth's deleteUser hooks — the admin DELETE /members/{id}
+     * cascade calls the internal adapter directly, so afterUserDelete never
+     * fires there. Every GDPR surface must end here or in afterUserDelete.
+     */
+    async recordErasure(user) {
+        await this.erasureLog?.append(user);
+    }
+    /** Pop the stash and record the system-actor completion rows (FK-safe: the user is gone). */
+    async afterUserDelete(user) {
+        const locks = this.heldLocks.get(user.id);
+        if (locks) {
+            this.heldLocks.delete(user.id);
+            for (const lock of locks)
+                await this.releaseOwnerLock(lock);
+        }
+        // The tombstone is written for EVERY completed erasure, stashed context
+        // or not: the audit rows below are what a restore rolls back; this line
+        // is what makes the erasure hold across one (OPS-3).
+        await this.erasureLog?.append(user);
+        const stashed = this.stash.get(user.id);
+        this.stash.delete(user.id);
+        if (!stashed) {
+            this.logger.warn({ userId: user.id }, 'account delete completed without a stashed context');
+            return;
+        }
+        // One row per workspace the user belonged to: every workspace's audit
+        // trail records that its member's account was erased (ADR 014).
+        for (const workspaceId of stashed.workspaceIds) {
+            await this.audit.write({
+                workspaceId,
+                principal: null, // → actorVia 'system'
+                action: 'user.account_delete',
+                resourceType: 'user',
+                resourceId: user.id,
+                metadata: { deletedUserId: user.id, email: stashed.email || user.email }
+            });
+        }
+    }
+    /**
+     * Acquire the per-workspace lock and run the guard re-check for EVERY
+     * non-projected workspace where the user is an active owner, in sorted
+     * order (deterministic → no deadlock between concurrent deletes). On a
+     * refusal every lock taken so far is released and LastOwnerError is
+     * thrown; on success the caller owns the locks.
+     */
+    async acquireOwnerLocks(userId) {
+        const locks = [];
+        try {
+            for (const workspaceId of await this.ownedGuardedWorkspaceIds(userId)) {
+                locks.push(await this.acquireOwnerLock(workspaceId));
+                if (!(await hasOtherActiveOwner(this.db, workspaceId, userId))) {
+                    throw new LastOwnerError();
+                }
+            }
+            return locks;
+        }
+        catch (cause) {
+            for (const lock of locks)
+                await this.releaseOwnerLock(lock);
+            throw cause;
+        }
+    }
+    /**
+     * Session-scoped pg_advisory_lock on a dedicated client — never the pool:
+     * a session lock parked on a pooled connection would poison the pool.
+     */
+    async acquireOwnerLock(workspaceId) {
+        const client = new pg.Client({ connectionString: this.connectionString });
+        await client.connect();
+        const lock = { client, workspaceId, released: false };
+        try {
+            await client.query('SELECT pg_advisory_lock($1, hashtext($2))', [OWNER_GUARD_LOCK_KEY, workspaceId]);
+        }
+        catch (cause) {
+            await this.releaseOwnerLock(lock);
+            throw cause;
+        }
+        return lock;
+    }
+    /** Idempotent; closing the client guarantees the session lock dies with it. */
+    async releaseOwnerLock(lock) {
+        if (lock.released)
+            return;
+        lock.released = true;
+        if (lock.watchdog)
+            clearTimeout(lock.watchdog);
+        try {
+            await lock.client.query('SELECT pg_advisory_unlock($1, hashtext($2))', [
+                OWNER_GUARD_LOCK_KEY,
+                lock.workspaceId
+            ]);
+        }
+        catch {
+            // client.end() below still drops the session-scoped lock
+        }
+        await lock.client.end().catch(() => { });
+    }
+    /** Park the locks across the cascade, each watchdogged against a hook-gap leak. */
+    parkLocks(userId, locks) {
+        for (const lock of locks) {
+            lock.watchdog = setTimeout(() => {
+                const held = this.heldLocks.get(userId)?.filter((l) => l !== lock);
+                if (held !== undefined) {
+                    if (held.length === 0)
+                        this.heldLocks.delete(userId);
+                    else
+                        this.heldLocks.set(userId, held);
+                }
+                this.logger.warn({ userId, workspaceId: lock.workspaceId }, 'owner-delete lock watchdog fired — a delete died between the hooks; releasing the lock');
+                void this.releaseOwnerLock(lock);
+            }, LOCK_WATCHDOG_MS);
+            lock.watchdog.unref();
+        }
+        this.heldLocks.set(userId, locks);
+    }
+    /** Every membership row the user holds, active or not. */
+    async membershipsOf(userId) {
+        return this.db
+            .select({
+            workspaceId: workspaceMembers.workspaceId,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .where(eq(workspaceMembers.userId, userId));
+    }
+    /**
+     * Workspaces where the user is an ACTIVE OWNER and the last-owner guard
+     * applies — i.e. NON-PROJECTED ones (centralAccountId IS NULL, D11).
+     * Sorted for deterministic lock ordering.
+     */
+    async ownedGuardedWorkspaceIds(userId) {
+        const rows = await this.db
+            .select({ workspaceId: workspaceMembers.workspaceId })
+            .from(workspaceMembers)
+            .innerJoin(workspaces, eq(workspaceMembers.workspaceId, workspaces.id))
+            .where(and(eq(workspaceMembers.userId, userId), eq(workspaceMembers.role, 'owner'), eq(workspaceMembers.isActive, true), isNull(workspaces.centralAccountId)));
+        return rows.map((r) => r.workspaceId).sort();
+    }
+    /** True when the workspace is a hub projection (ownership asserted hub-side, D11). */
+    async isProjectedWorkspace(workspaceId) {
+        const [row] = await this.db
+            .select({ centralAccountId: workspaces.centralAccountId })
+            .from(workspaces)
+            .where(eq(workspaces.id, workspaceId))
+            .limit(1);
+        return Boolean(row?.centralAccountId);
+    }
+}
+//# sourceMappingURL=deletion.js.map

package/dist/accounts/deletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deletion.js","sourceRoot":"","sources":["../../src/accounts/deletion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAW,MAAM,wBAAwB,CAAC;AAKlG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,+EAA+E;AAC/E,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC;QACE,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,KAAK,IAAI,GAAG,GAAY,KAAK,EAAE,GAAG,YAAY,KAAK,EAAE,GAAG,GAAI,GAA2B,CAAC,KAAK,EAAE,CAAC;QAC9F,IAAK,GAA0B,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAShC,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAM,EACN,WAAmB,EACnB,aAAqB;IAErB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;SACnC,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAClC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,OAAO,sBAAsB;IAcd;IACA;IACA;IAEA;IAEA;IAnBnB;;;;;;OAMG;IACc,KAAK,GAAG,IAAI,GAAG,EAAqD,CAAC;IAEtF,sFAAsF;IACrE,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE5D,YACmB,EAAM,EACN,KAAmB,EACnB,MAAc;IAC/B,oFAAoF;IACnE,gBAAwB;IACzC,uFAAuF;IACtE,UAAuB;QANvB,OAAE,GAAF,EAAE,CAAI;QACN,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAQ;QAEd,qBAAgB,GAAhB,gBAAgB,CAAQ;QAExB,eAAU,GAAV,UAAU,CAAa;IACvC,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,KAAK,MAAM,WAAW,IAAI,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,cAAc,EAAE,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,kBAAkB,CAAI,WAAmB,EAAE,aAAqB,EAAE,EAAoB;QAC1F,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,cAAc,EAAE,CAAC;YAC7B,CAAC;YACD,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,yCAAyC;QAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;aAClC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;YACrB,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;YACnD,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,sBAAsB,CAAI,MAAc,EAAE,EAAoB;QAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,cAAc,EAAE,CAAC;YAC1D,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAmC;QACrD,MAAM,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,eAAe,CAAC,IAAmC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,oDAAoD,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBACrB,WAAW;gBACX,SAAS,EAAE,IAAI,EAAE,sBAAsB;gBACvC,MAAM,EAAE,qBAAqB;gBAC7B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC5C,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,MAAM,WAAW,IAAI,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtE,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;oBAC/D,MAAM,IAAI,cAAc,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAc,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+EAA+E;IACvE,KAAK,CAAC,gBAAgB,CAAC,IAAe;QAC5C,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;gBACrE,oBAAoB;gBACpB,IAAI,CAAC,WAAW;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,mFAAmF;IAC3E,SAAS,CAAC,MAAc,EAAE,KAAkB;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;gBACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;wBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;;wBAChD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EACzC,wFAAwF,CACzF,CAAC;gBACF,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,0DAA0D;IAClD,KAAK,CAAC,aAAa,CACzB,MAAc;QAEd,OAAO,IAAI,CAAC,EAAE;aACX,MAAM,CAAC;YACN,WAAW,EAAE,gBAAgB,CAAC,WAAW;YACzC,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,wBAAwB,CAAC,MAAc;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC;aACrD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,EAClC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CACpC,CACF,CAAC;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,oBAAoB,CAAC,WAAmB;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,EAAE,CAAC;aACzD,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC;CACF"}