@antasphere/chassis-server 1.0.0

package/dist/api/teams.js

@@ -0,0 +1,447 @@
+import { and, desc, eq, inArray, isNull, sql } from 'drizzle-orm';
+import { teamSlugSchema } from '@antasphere/chassis-contract';
+import { teamCreateRoute, teamDeleteRoute, teamGetRoute, teamMemberAddRoute, teamMemberRemoveRoute, teamMembersListRoute, teamsListRoute, teamUpdateRoute } from '@antasphere/chassis-contract/routes';
+import { user as userTable, workspaceMembers, workspaceTeamMembers, workspaceTeams } from '@antasphere/chassis-db';
+import { requireAuth, requireNonGuest } from '../middleware/auth-context.js';
+import { HUB_MANAGED_TEAMS_MESSAGE, hubManagedMembershipGate } from '../middleware/hub-managed.js';
+import { holdLiveMembership } from '../members/removal.js';
+import { createdAtText, decodeKeysetCursor, encodeKeysetCursor, keysetBeforeValue } from '../pagination.js';
+const err = (code, message) => ({ error: { code, message } });
+const canManage = (principal) => principal.role === 'owner' || principal.role === 'admin';
+const FORBIDDEN = err('forbidden', 'Only an owner or an admin manages teams');
+const SLUG_TAKEN = err('slug_taken', 'Another team of this workspace already uses that slug');
+const TEAM_NOT_FOUND = err('not_found', 'Team not found');
+const MEMBER_NOT_FOUND = err('member_not_found', 'No active member of this workspace matches');
+const NOT_SEATED = err('member_not_found', 'This person is not a member of the team');
+/** The partial unique index of a local team's slug (Postgres reports the INDEX name as the constraint). */
+const LOCAL_SLUG_INDEX = 'workspace_teams_workspace_slug_local_uniq';
+/**
+ * The slug a name yields when none is given: lowercased, accents folded,
+ * every run of other characters one dash, no dash at either end, at most 60
+ * characters. Null when nothing of the name survives (a name of symbols).
+ */
+export function slugFromName(name) {
+    const slug = name
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '') // the combining marks NFKD split off
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 60)
+        .replace(/-+$/g, '');
+    return teamSlugSchema.safeParse(slug).success ? slug : null;
+}
+/** The driver's error down drizzle's `cause` chain (the first link carrying a SQLSTATE), at most ten deep. */
+function pgLink(e) {
+    for (let cur = e, depth = 0; cur instanceof Error && depth < 10; cur = cur.cause, depth++) {
+        const code = cur.code;
+        if (typeof code === 'string' && /^[0-9A-Z]{5}$/.test(code)) {
+            return cur;
+        }
+    }
+    return undefined;
+}
+/** A Postgres unique violation on the given constraint or unique index. */
+const isUniqueViolation = (e, constraint) => {
+    const link = pgLink(e);
+    return link?.code === '23505' && link.constraint === constraint;
+};
+/** A Postgres foreign-key violation (a parent removed mid-flight). */
+const isForeignKeyViolation = (e) => pgLink(e)?.code === '23503';
+const teamToWire = (t) => ({
+    id: t.id,
+    slug: t.slug,
+    name: t.name,
+    membersCount: Number(t.membersCount),
+    isMember: Boolean(t.isMember),
+    hubTeamId: t.hubTeamId,
+    createdAt: t.createdAt.toISOString(),
+    updatedAt: t.updatedAt.toISOString()
+});
+const memberToWire = (m) => ({
+    userId: m.userId,
+    email: m.email,
+    name: m.name,
+    role: m.role,
+    isActive: m.isActive,
+    addedAt: m.addedAt.toISOString()
+});
+/**
+ * The team's wire columns, with its member count and whether the caller sits
+ * in it. The correlated subqueries spell their columns table-qualified by
+ * hand: drizzle renders a one-table select's columns bare, and a bare "id"
+ * inside the subquery would bind to the subquery's own table.
+ */
+const teamColumns = (principal) => ({
+    id: workspaceTeams.id,
+    slug: workspaceTeams.slug,
+    name: workspaceTeams.name,
+    hubTeamId: workspaceTeams.hubTeamId,
+    membersCount: sql `(SELECT count(*)::int FROM "workspace_team_members" "wtm_count" WHERE "wtm_count"."team_id" = "workspace_teams"."id")`,
+    isMember: sql `EXISTS (SELECT 1 FROM "workspace_team_members" "wtm_me" INNER JOIN "workspace_members" "wm_me" ON "wm_me"."id" = "wtm_me"."member_id" WHERE "wtm_me"."team_id" = "workspace_teams"."id" AND "wm_me"."user_id" = ${principal.userId} AND "wm_me"."workspace_id" = ${principal.workspaceId})`,
+    createdAt: workspaceTeams.createdAt,
+    updatedAt: workspaceTeams.updatedAt
+});
+// The members list pages with the value-carrying cursor (`keysetBeforeValue`):
+// workspace_team_members HARD-deletes rows, so a cursor naming a seat removed
+// between two pages must not end the roster early.
+const memberSelection = {
+    id: workspaceTeamMembers.id,
+    createdAtText: createdAtText(workspaceTeamMembers.createdAt),
+    userId: workspaceMembers.userId,
+    email: userTable.email,
+    name: userTable.name,
+    role: workspaceMembers.role,
+    isActive: workspaceMembers.isActive,
+    addedAt: workspaceTeamMembers.createdAt
+};
+export function registerTeamRoutes(api, deps) {
+    const { db, hubManaged } = deps;
+    // The members' mount order: the hub-managed gate first (cloud only), so any
+    // authenticated caller of a hub-origin workspace gets the truthful refusal
+    // on a write; then the auth gate; then the guest refusal (teams are a
+    // workspace-level surface, refused to a guest flat, on both editions).
+    for (const path of ['/teams', '/teams/*']) {
+        if (hubManaged)
+            api.use(path, hubManagedMembershipGate(hubManaged.manageUrl, HUB_MANAGED_TEAMS_MESSAGE));
+        api.use(path, requireAuth());
+        api.use(path, requireNonGuest());
+    }
+    /** The refusal a write meets on a projected team (the second lock, beside the gate). */
+    const PROJECTED = {
+        error: {
+            code: 'hub_managed',
+            message: HUB_MANAGED_TEAMS_MESSAGE,
+            details: { manageUrl: hubManaged?.manageUrl ?? null }
+        }
+    };
+    /** One team of the principal's workspace, or undefined (another workspace's team reads as absent). */
+    const loadTeam = async (principal, id) => {
+        const [row] = await db
+            .select(teamColumns(principal))
+            .from(workspaceTeams)
+            .where(and(eq(workspaceTeams.id, id), eq(workspaceTeams.workspaceId, principal.workspaceId)))
+            .limit(1);
+        return row;
+    };
+    /** The team's id and source when it belongs to the principal's workspace. */
+    const teamInWorkspace = async (principal, id) => {
+        const [row] = await db
+            .select({ id: workspaceTeams.id, hubTeamId: workspaceTeams.hubTeamId })
+            .from(workspaceTeams)
+            .where(and(eq(workspaceTeams.id, id), eq(workspaceTeams.workspaceId, principal.workspaceId)))
+            .limit(1);
+        return row;
+    };
+    // ── List ─────────────────────────────────────────────────────────────────
+    // The list pages with the value-carrying cursor, like the seats and the
+    // project members: workspace_teams HARD-deletes rows, so an id-only cursor
+    // naming a team deleted between two pages would end the list early
+    // (verifier round 1, F3).
+    api.openapi(teamsListRoute, async (c) => {
+        const principal = c.get('principal');
+        const { cursor, limit } = c.req.valid('query');
+        const after = decodeKeysetCursor(cursor);
+        const rows = await db
+            .select({ ...teamColumns(principal), createdAtText: createdAtText(workspaceTeams.createdAt) })
+            .from(workspaceTeams)
+            .where(and(eq(workspaceTeams.workspaceId, principal.workspaceId), ...(after
+            ? [
+                keysetBeforeValue({
+                    id: workspaceTeams.id,
+                    createdAt: workspaceTeams.createdAt,
+                    cursor: after
+                })
+            ]
+            : [])))
+            .orderBy(desc(workspaceTeams.createdAt), desc(workspaceTeams.id))
+            .limit(limit + 1);
+        const page = rows.slice(0, limit);
+        const last = rows.length > limit ? page[page.length - 1] : undefined;
+        return c.json({ teams: page.map(teamToWire), nextCursor: last ? encodeKeysetCursor(last) : null }, 200);
+    });
+    // ── Get ──────────────────────────────────────────────────────────────────
+    api.openapi(teamGetRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const team = await loadTeam(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404);
+        return c.json(teamToWire(team), 200);
+    });
+    // ── Create ───────────────────────────────────────────────────────────────
+    api.openapi(teamCreateRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!canManage(principal))
+            return c.json(FORBIDDEN, 403);
+        const body = c.req.valid('json');
+        const slug = body.slug ?? slugFromName(body.name);
+        if (!slug) {
+            return c.json(err('validation_error', 'The name yields no slug: give the team a slug'), 400);
+        }
+        let id;
+        try {
+            const [inserted] = await db
+                .insert(workspaceTeams)
+                .values({
+                workspaceId: principal.workspaceId,
+                hubTeamId: null,
+                slug,
+                name: body.name,
+                createdBy: principal.userId
+            })
+                .returning({ id: workspaceTeams.id });
+            id = inserted.id;
+        }
+        catch (cause) {
+            if (isUniqueViolation(cause, LOCAL_SLUG_INDEX))
+                return c.json(SLUG_TAKEN, 409);
+            throw cause;
+        }
+        const team = await loadTeam(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404); // deleted between the two statements
+        c.set('audit', {
+            action: 'team.create',
+            resourceType: 'team',
+            resourceId: id,
+            metadata: { slug, name: body.name }
+        });
+        return c.json(teamToWire(team), 201);
+    });
+    // ── Update ───────────────────────────────────────────────────────────────
+    api.openapi(teamUpdateRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!canManage(principal))
+            return c.json(FORBIDDEN, 403);
+        const { id } = c.req.valid('param');
+        const patch = c.req.valid('json');
+        const found = await teamInWorkspace(principal, id);
+        if (!found)
+            return c.json(TEAM_NOT_FOUND, 404);
+        if (found.hubTeamId !== null)
+            return c.json(PROJECTED, 403);
+        let updated;
+        try {
+            [updated] = await db
+                .update(workspaceTeams)
+                .set({
+                ...(patch.name !== undefined ? { name: patch.name } : {}),
+                ...(patch.slug !== undefined ? { slug: patch.slug } : {}),
+                updatedAt: sql `now()`
+            })
+                .where(and(eq(workspaceTeams.id, id), eq(workspaceTeams.workspaceId, principal.workspaceId), isNull(workspaceTeams.hubTeamId)))
+                .returning({ id: workspaceTeams.id });
+        }
+        catch (cause) {
+            if (isUniqueViolation(cause, LOCAL_SLUG_INDEX))
+                return c.json(SLUG_TAKEN, 409);
+            throw cause;
+        }
+        if (!updated)
+            return c.json(TEAM_NOT_FOUND, 404); // deleted between the two statements
+        const team = await loadTeam(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404);
+        c.set('audit', {
+            action: 'team.update',
+            resourceType: 'team',
+            resourceId: id,
+            metadata: { ...patch }
+        });
+        return c.json(teamToWire(team), 200);
+    });
+    // ── Delete ───────────────────────────────────────────────────────────────
+    // Seats and project entries go by the foreign keys' cascade.
+    api.openapi(teamDeleteRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!canManage(principal))
+            return c.json(FORBIDDEN, 403);
+        const { id } = c.req.valid('param');
+        // Snapshot first: the count needs the seat rows the cascade removes.
+        const snapshot = await loadTeam(principal, id);
+        if (!snapshot)
+            return c.json(TEAM_NOT_FOUND, 404);
+        if (snapshot.hubTeamId !== null)
+            return c.json(PROJECTED, 403);
+        const [deleted] = await db
+            .delete(workspaceTeams)
+            .where(and(eq(workspaceTeams.id, id), eq(workspaceTeams.workspaceId, principal.workspaceId), isNull(workspaceTeams.hubTeamId)))
+            .returning({ id: workspaceTeams.id });
+        if (!deleted)
+            return c.json(TEAM_NOT_FOUND, 404);
+        c.set('audit', {
+            action: 'team.delete',
+            resourceType: 'team',
+            resourceId: id,
+            metadata: { slug: snapshot.slug, name: snapshot.name, membersCount: Number(snapshot.membersCount) }
+        });
+        return c.json(teamToWire(snapshot), 200);
+    });
+    // ── Members ──────────────────────────────────────────────────────────────
+    // Every member of the workspace reads a team's members: no role check.
+    api.openapi(teamMembersListRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        const { cursor, limit } = c.req.valid('query');
+        const team = await teamInWorkspace(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404);
+        const after = decodeKeysetCursor(cursor);
+        const rows = await db
+            .select(memberSelection)
+            .from(workspaceTeamMembers)
+            .innerJoin(workspaceMembers, eq(workspaceMembers.id, workspaceTeamMembers.memberId))
+            .innerJoin(userTable, eq(userTable.id, workspaceMembers.userId))
+            .where(and(eq(workspaceTeamMembers.teamId, team.id), eq(workspaceMembers.workspaceId, principal.workspaceId), ...(after
+            ? [
+                keysetBeforeValue({
+                    id: workspaceTeamMembers.id,
+                    createdAt: workspaceTeamMembers.createdAt,
+                    cursor: after
+                })
+            ]
+            : [])))
+            .orderBy(desc(workspaceTeamMembers.createdAt), desc(workspaceTeamMembers.id))
+            .limit(limit + 1);
+        const page = rows.slice(0, limit);
+        const last = rows.length > limit ? page[page.length - 1] : undefined;
+        return c.json({ members: page.map(memberToWire), nextCursor: last ? encodeKeysetCursor(last) : null }, 200);
+    });
+    api.openapi(teamMemberAddRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!canManage(principal))
+            return c.json(FORBIDDEN, 403);
+        const { id } = c.req.valid('param');
+        const body = c.req.valid('json');
+        const team = await teamInWorkspace(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404);
+        if (team.hubTeamId !== null)
+            return c.json(PROJECTED, 403);
+        // The target comes from THIS workspace's own roster, by user id or by
+        // email, and nowhere else.
+        const [target] = await db
+            .select({
+            id: workspaceMembers.id,
+            userId: workspaceMembers.userId,
+            email: userTable.email,
+            name: userTable.name,
+            role: workspaceMembers.role,
+            origin: workspaceMembers.origin,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+            .where(and(eq(workspaceMembers.workspaceId, principal.workspaceId), body.userId !== undefined
+            ? eq(workspaceMembers.userId, body.userId)
+            : sql `lower(${userTable.email}) = ${body.email.toLowerCase()}`))
+            .limit(1);
+        if (!target || !target.isActive)
+            return c.json(MEMBER_NOT_FOUND, 404);
+        // A guest membership exists for principal resolution only (D2): it never
+        // sits in a team.
+        if (target.origin === 'guest') {
+            return c.json(err('guest_target', 'A guest cannot sit in a team: invite them to the workspace as a member first'), 403);
+        }
+        // The insert runs while the team row is held FOR SHARE and re-read as the
+        // tool's own: a team that turned out projected, or went, is never seated.
+        let outcome;
+        try {
+            outcome = await db.transaction(async (tx) => {
+                const [live] = await tx
+                    .select({ id: workspaceTeams.id })
+                    .from(workspaceTeams)
+                    .where(and(eq(workspaceTeams.id, team.id), eq(workspaceTeams.workspaceId, principal.workspaceId), isNull(workspaceTeams.hubTeamId)))
+                    .for('share')
+                    .limit(1);
+                if (!live)
+                    return 'gone';
+                // The read above builds the answer; this locked re-read is the one
+                // that counts (`holdLiveMembership`): a removal that landed since is
+                // seen here, one still running waits and takes the seat in its second pass.
+                if (!(await holdLiveMembership(tx, principal.workspaceId, { memberId: target.id }))) {
+                    return 'member_gone';
+                }
+                // A seat already there answers the repeat WITHOUT an insert (the
+                // verifier's F4: 14 of 40 removals answered 500). Under the membership
+                // share lock, a removal's uncommitted delete of this seat keeps the row
+                // visible to a plain read, so the add answers 409 and never waits on
+                // that delete, while the removal's update waits on the add's share
+                // lock: an insert here would wait on the delete, a cycle.
+                const [existing] = await tx
+                    .select({ id: workspaceTeamMembers.id })
+                    .from(workspaceTeamMembers)
+                    .where(and(eq(workspaceTeamMembers.teamId, team.id), eq(workspaceTeamMembers.memberId, target.id)))
+                    .limit(1);
+                if (existing)
+                    return 'repeat';
+                const [row] = await tx
+                    .insert(workspaceTeamMembers)
+                    .values({ teamId: team.id, memberId: target.id, addedBy: principal.userId })
+                    .onConflictDoNothing({ target: [workspaceTeamMembers.teamId, workspaceTeamMembers.memberId] })
+                    .returning({ createdAt: workspaceTeamMembers.createdAt });
+                return row ?? 'repeat';
+            });
+        }
+        catch (cause) {
+            // The membership was removed between the check and the insert.
+            if (isForeignKeyViolation(cause))
+                return c.json(MEMBER_NOT_FOUND, 404);
+            throw cause;
+        }
+        if (outcome === 'gone')
+            return c.json(TEAM_NOT_FOUND, 404);
+        if (outcome === 'member_gone')
+            return c.json(MEMBER_NOT_FOUND, 404);
+        if (outcome === 'repeat') {
+            return c.json(err('already_member', 'This person is already a member of the team'), 409);
+        }
+        // Built from the target row and the insert's own `createdAt`, never from a
+        // re-read outside the transaction (a removal in between would 500 it).
+        c.set('audit', {
+            action: 'team.member_add',
+            resourceType: 'team',
+            resourceId: team.id,
+            metadata: { targetUserId: target.userId }
+        });
+        return c.json(memberToWire({ ...target, addedAt: outcome.createdAt }), 201);
+    });
+    api.openapi(teamMemberRemoveRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!canManage(principal))
+            return c.json(FORBIDDEN, 403);
+        const { id, userId } = c.req.valid('param');
+        const team = await teamInWorkspace(principal, id);
+        if (!team)
+            return c.json(TEAM_NOT_FOUND, 404);
+        if (team.hubTeamId !== null)
+            return c.json(PROJECTED, 403);
+        const [seat] = await db
+            .select({ ...memberSelection, memberId: workspaceMembers.id })
+            .from(workspaceTeamMembers)
+            .innerJoin(workspaceMembers, eq(workspaceMembers.id, workspaceTeamMembers.memberId))
+            .innerJoin(userTable, eq(userTable.id, workspaceMembers.userId))
+            .where(and(eq(workspaceTeamMembers.teamId, team.id), eq(workspaceMembers.workspaceId, principal.workspaceId), eq(workspaceMembers.userId, userId)))
+            .limit(1);
+        if (!seat)
+            return c.json(NOT_SEATED, 404);
+        const [removed] = await db
+            .delete(workspaceTeamMembers)
+            .where(and(eq(workspaceTeamMembers.id, seat.id), inArray(workspaceTeamMembers.teamId, db
+            .select({ id: workspaceTeams.id })
+            .from(workspaceTeams)
+            .where(and(eq(workspaceTeams.id, team.id), isNull(workspaceTeams.hubTeamId))))))
+            .returning({ id: workspaceTeamMembers.id });
+        if (!removed)
+            return c.json(NOT_SEATED, 404);
+        c.set('audit', {
+            action: 'team.member_remove',
+            resourceType: 'team',
+            resourceId: team.id,
+            metadata: { targetUserId: userId }
+        });
+        return c.json(memberToWire(seat), 200);
+    });
+}
+//# sourceMappingURL=teams.js.map

package/dist/api/teams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.js","sourceRoot":"","sources":["../../src/api/teams.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAkB,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,eAAe,EAChB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,IAAI,IAAI,SAAS,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EAEf,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAkC5G,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAE9E,MAAM,SAAS,GAAG,CAAC,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;AACrG,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,yCAAyC,CAAC,CAAC;AAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,uDAAuD,CAAC,CAAC;AAC9F,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;AAC/F,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,EAAE,yCAAyC,CAAC,CAAC;AAEtF,2GAA2G;AAC3G,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI;SACd,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,qCAAqC;SACrE,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,8GAA8G;AAC9G,SAAS,MAAM,CAAC,CAAU;IACxB,KAAK,IAAI,GAAG,GAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,YAAY,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACnG,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,GAAwD,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,CAAC,CAAU,EAAE,UAAkB,EAAW,EAAE;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC;AAClE,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;AAanF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;IACpC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAWH,MAAM,YAAY,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;IAChB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE;CACjC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,GAAG,CAAC,SAAoB,EAAE,EAAE,CAAC,CAAC;IAC7C,EAAE,EAAE,cAAc,CAAC,EAAE;IACrB,IAAI,EAAE,cAAc,CAAC,IAAI;IACzB,IAAI,EAAE,cAAc,CAAC,IAAI;IACzB,SAAS,EAAE,cAAc,CAAC,SAAS;IACnC,YAAY,EAAE,GAAG,CAAQ,uHAAuH;IAChJ,QAAQ,EAAE,GAAG,CAAS,mNAAmN,SAAS,CAAC,MAAM,iCAAiC,SAAS,CAAC,WAAW,GAAG;IAClT,SAAS,EAAE,cAAc,CAAC,SAAS;IACnC,SAAS,EAAE,cAAc,CAAC,SAAS;CACpC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,8EAA8E;AAC9E,mDAAmD;AACnD,MAAM,eAAe,GAAG;IACtB,EAAE,EAAE,oBAAoB,CAAC,EAAE;IAC3B,aAAa,EAAE,aAAa,CAAC,oBAAoB,CAAC,SAAS,CAAC;IAC5D,MAAM,EAAE,gBAAgB,CAAC,MAAM;IAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;IACtB,IAAI,EAAE,SAAS,CAAC,IAAI;IACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;IAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;IACnC,OAAO,EAAE,oBAAoB,CAAC,SAAS;CACxC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,GAAgB,EAAE,IAAmB;IACtE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAEhC,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACzG,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,wFAAwF;IACxF,MAAM,SAAS,GAAG;QAChB,KAAK,EAAE;YACL,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,IAAI,EAAE;SACtD;KACF,CAAC;IAEF,sGAAsG;IACtG,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAoB,EAAE,EAAU,EAAgC,EAAE;QACxF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;aAC9B,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAC5F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,eAAe,GAAG,KAAK,EAAE,SAAoB,EAAE,EAAU,EAAE,EAAE;QACjE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,CAAC;aACtE,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;aAC5F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,mEAAmE;IACnE,0BAA0B;IAC1B,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;aAC7F,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACrD,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,cAAc,CAAC,EAAE;oBACrB,SAAS,EAAE,cAAc,CAAC,SAAS;oBACnC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;aAChE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;iBACxB,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC;gBACN,WAAW,EAAE,SAAS,CAAC,WAAW;gBAClC,SAAS,EAAE,IAAI;gBACf,IAAI;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,SAAS,CAAC,MAAM;aAC5B,CAAC;iBACD,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YACxC,EAAE,GAAG,QAAS,CAAC,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,qCAAqC;QACpF,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,aAAa;YACrB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE5D,IAAI,OAAmC,CAAC;QACxC,IAAI,CAAC;YACH,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,cAAc,CAAC;iBACtB,GAAG,CAAC;gBACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB,CAAC;iBACD,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EACzB,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;iBACA,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,qCAAqC;QAEvF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,aAAa;YACrB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,GAAG,KAAK,EAAE;SACvB,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6DAA6D;IAC7D,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpC,qEAAqE;QACrE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC,EACzB,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEjD,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,aAAa;YACrB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;SACpG,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,uEAAuE;IACvE,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAE9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,eAAe,CAAC;aACvB,IAAI,CAAC,oBAAoB,CAAC;aAC1B,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;aACnF,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;aAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,iBAAiB,CAAC;oBAChB,EAAE,EAAE,oBAAoB,CAAC,EAAE;oBAC3B,SAAS,EAAE,oBAAoB,CAAC,SAAS;oBACzC,MAAM,EAAE,KAAK;iBACd,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;aAC5E,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EACvF,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE3D,sEAAsE;QACtE,2BAA2B;QAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;YAC/B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,IAAI,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAA,SAAS,SAAS,CAAC,KAAK,OAAO,IAAI,CAAC,KAAM,CAAC,WAAW,EAAE,EAAE,CAClE,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACtE,yEAAyE;QACzE,kBAAkB;QAClB,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,cAAc,EAAE,8EAA8E,CAAC,EACnG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,OAAgE,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;qBACjC,IAAI,CAAC,cAAc,CAAC;qBACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAC9B,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACrD,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;qBACA,GAAG,CAAC,OAAO,CAAC;qBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,CAAC,IAAI;oBAAE,OAAO,MAAe,CAAC;gBAClC,mEAAmE;gBACnE,qEAAqE;gBACrE,4EAA4E;gBAC5E,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;oBACpF,OAAO,aAAsB,CAAC;gBAChC,CAAC;gBACD,iEAAiE;gBACjE,uEAAuE;gBACvE,wEAAwE;gBACxE,qEAAqE;gBACrE,mEAAmE;gBACnE,0DAA0D;gBAC1D,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;qBACvC,IAAI,CAAC,oBAAoB,CAAC;qBAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;qBAClG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,QAAQ;oBAAE,OAAO,QAAiB,CAAC;gBACvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,CAAC,oBAAoB,CAAC;qBAC5B,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;qBAC3E,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;qBAC7F,SAAS,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5D,OAAO,GAAG,IAAK,QAAkB,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+DAA+D;YAC/D,IAAI,qBAAqB,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,OAAO,KAAK,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,aAAa;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,2EAA2E;QAC3E,uEAAuE;QACvE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,iBAAiB;YACzB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE;SAC1C,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAE3D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,EAAE,GAAG,eAAe,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;aAC7D,IAAI,CAAC,oBAAoB,CAAC;aAC1B,SAAS,CAAC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;aACnF,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;aAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EACxC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,EACvD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CACpC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE1C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,oBAAoB,CAAC;aAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EACpC,OAAO,CACL,oBAAoB,CAAC,MAAM,EAC3B,EAAE;aACC,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAChF,CACF,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE7C,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,oBAAoB;YAC5B,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,IAAI,CAAC,EAAE;YACnB,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/workspaces.d.ts

@@ -0,0 +1,114 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { type Db, type DbConn } from '@antasphere/chassis-db';
+import type { AuditService } from '../audit/service.js';
+import type { Auth } from '../identity/better-auth.js';
+import type { ReconcilePassOutcome } from '../identity/hub-reconcile.js';
+import type { HubOrgCreator } from '../identity/hub-user-client.js';
+import type { Logger } from '../logger.js';
+import type { RateLimiterAbstract } from 'rate-limiter-flexible';
+import type { ClientIpFn } from '../middleware/rate-limit.js';
+import type { PlatformRegistry } from '../platform/registry.js';
+/** Why this caller may not create a workspace right now — also the wire error code. */
+export type WorkspaceCreationRefusal = 'session_required' | 'workspace_creation_disabled' | 'guest_forbidden' | 'workspace_limit_reached' | 'hub_link_required' | 'restricted_tool';
+export interface WorkspaceCreationPolicy {
+    /** `MAX_WORKSPACES_PER_USER`. 0 closes creation for everyone, on both editions. */
+    maxPerUser: number;
+    /**
+     * `TOOL_RESTRICTED` (PRDCT-2947): on cloud, organizations that open this
+     * tool are granted by Antasphere, so nobody creates one from here. Judged
+     * only where `hasHubLink` is set (the cloud edition); inert on self-hosted,
+     * where a workspace is local and the switch means nothing.
+     */
+    restricted?: boolean | undefined;
+    /**
+     * Cloud only: whether the user holds a LIVE hub link (a stored grant) —
+     * the organization is created at the hub AS THEM, so without one there is
+     * nothing to create it with. undefined on oss.
+     */
+    hasHubLink?: ((userId: string) => Promise<boolean>) | undefined;
+}
+/**
+ * THE ONE eligibility rule, shared by the route (inside its locked
+ * transaction) and by `/me.canCreateWorkspace` — so the flag can never
+ * promise what the route refuses. Order = the order the refusals are
+ * reported in.
+ *
+ *  - sessions only;
+ *  - the operator's dial at 0 closes the door on both editions;
+ *  - a GUEST-ONLY user (every active membership is `origin='guest'`) is an
+ *    outsider invited to single resources (D2): refused like every other
+ *    workspace-level act. One non-guest active membership anywhere lifts it
+ *    — it is a fact about the PERSON, not about the workspace they are in;
+ *  - oss: fewer ACTIVE OWNER memberships than the cap (setup's counts);
+ *  - cloud: the tool not restricted (TOOL_RESTRICTED), then a live hub link.
+ *    The count is the hub's own cap, asked there.
+ */
+export declare function workspaceCreationRefusal(conn: DbConn, policy: WorkspaceCreationPolicy, caller: {
+    userId: string;
+    via: 'session' | 'api_key' | 'oauth';
+}): Promise<WorkspaceCreationRefusal | null>;
+/**
+ * The restricted tool's refusal (PRDCT-2947), tool-neutral through the
+ * identity: who opens an organization to the tool, and whom to ask.
+ */
+export declare const restrictedToolMessage: (displayName: string) => string;
+/**
+ * The creation rate wall. Two buckets, spent IN THE HANDLER once the caller
+ * is identified — deliberately not a path-mounted middleware:
+ *
+ *  - a path mount counts every method (OPTIONS/HEAD/PUT on a path whose only
+ *    handler is the POST) and every unauthenticated request, so anyone could
+ *    spend an address's budget without a session and lock the people behind
+ *    it out of a route they had never used;
+ *  - here only an IDENTIFIED caller's POST costs anything. The person bucket
+ *    is judged FIRST, and a person it refuses never reaches the address
+ *    bucket — so one person can take at most their own share (a tenth) of
+ *    the address's budget, and an office behind one NAT address is not
+ *    locked out by one colleague. A single person still cannot hammer the
+ *    hub: 60 attempts an hour, refused ones included, zero-membership cloud
+ *    sessions included (they are identified by their session here, which a
+ *    principal-keyed middleware could not do).
+ *
+ * An Idempotency-Key replay never reaches the handler and costs nothing.
+ */
+export interface WorkspaceCreateWall {
+    /** Per person, key `u:<userId>`. */
+    person: RateLimiterAbstract;
+    /** Per address — larger than the person bucket, identified callers only. */
+    address: RateLimiterAbstract;
+}
+/**
+ * Read-only: would the wall refuse this person at this address right now?
+ * `/me.canCreateWorkspace` asks it so the flag stays honest about the wall.
+ */
+export declare function workspaceCreateWallClosed(wall: WorkspaceCreateWall, address: string, userId: string): Promise<boolean>;
+/** Cloud-only collaborators. Absent on oss: the route carries zero hub surface there. */
+export interface WorkspaceCloudDeps {
+    /** The ONE hub call, isolated (identity/hub-user-client.ts `createOrg`). */
+    createOrg: HubOrgCreator;
+    /** The login-grade, TTL-bypassing reconcile pass (identity/hub-reconcile.ts). */
+    forceReconcile: (userId: string) => Promise<ReconcilePassOutcome>;
+    hasHubLink: (userId: string) => Promise<boolean>;
+    /** The hub console: where a hub-origin workspace is renamed (P7's pointer). */
+    manageUrl: string;
+}
+export interface WorkspaceRouteDeps {
+    db: Db;
+    auth: Auth;
+    audit: AuditService;
+    registry: PlatformRegistry;
+    logger: Logger;
+    clientIp: ClientIpFn;
+    wall: WorkspaceCreateWall;
+    maxPerUser: number;
+    /** `TOOL_RESTRICTED` (see `WorkspaceCreationPolicy.restricted`). */
+    restricted: boolean;
+    cloud?: WorkspaceCloudDeps | undefined;
+    /** The tool's `guest_forbidden` sentence (`copy.guestForbidden`), the same one the route guard answers with. */
+    guestForbiddenMessage: string;
+    /** The tool's name in the restricted refusal (`identity.displayName`). */
+    displayName: string;
+}
+export declare function workspaceCreationPolicy(deps: Pick<WorkspaceRouteDeps, 'maxPerUser' | 'restricted' | 'cloud'>): WorkspaceCreationPolicy;
+export declare function registerWorkspaceRoutes(api: OpenAPIHono, deps: WorkspaceRouteDeps): void;
+//# sourceMappingURL=workspaces.d.ts.map

package/dist/api/workspaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspaces.d.ts","sourceRoot":"","sources":["../../src/api/workspaces.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,OAAO,EAAyC,KAAK,EAAE,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAyChE,uFAAuF;AACvF,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,6BAA6B,GAC7B,iBAAiB,GACjB,yBAAyB,GACzB,mBAAmB,GACnB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,uBAAuB;IACtC,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,uBAAuB,EAC/B,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;CAAE,GAC/D,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C;AAiBD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,MAC6C,CAAC;AAE1G;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,4EAA4E;IAC5E,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAUD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAIlB;AA8BD,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,SAAS,EAAE,aAAa,CAAC;IACzB,iFAAiF;IACjF,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClE,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,CAAC;IACrB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACvC,gHAAgH;IAChH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,YAAY,GAAG,YAAY,GAAG,OAAO,CAAC,GACpE,uBAAuB,CAEzB;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAwYxF"}