@bevel-software/platform-core-backend 0.1.0

package/dist/modules/access/roles-admin.service.js

@@ -0,0 +1,630 @@
+/**
+ * Admin Roles & Members service — full CRUD on the default-branch `roles.yaml`.
+ *
+ * This is the deferred "Slice 2" of `manage-access-grant-revoke`: the in-product
+ * surface for creating/deleting roles, adding/removing members, and renaming a
+ * role. It is the ONLY writer of `roles.yaml` outside a hand-edit, and it is
+ * built around one non-negotiable safety property:
+ *
+ *   roles.yaml has NO admin-rescue (canWrite('roles.yaml') is a pure isAdmin
+ *   check) and loadModel HARD-THROWS on a parse failure (which isAdmin swallows
+ *   into false for EVERYONE). So a single malformed write = a permanent,
+ *   app-wide, in-app-unrecoverable admin lockout. Every mutation therefore runs
+ *   the candidate text through the resolver's OWN parser (validateRolesYaml)
+ *   before a byte hits disk; on any error it writes nothing.
+ *
+ * Two write paths, both gated by the same friendly pre-checks + validate gate:
+ *
+ *   Single-file ops (create/delete role, add/remove member) — `runEdit`:
+ *     pre-check roles.yaml isn't locked  → RolesAdminError 409
+ *     read CURRENT roles.yaml → parse → edit-in-memory → re-emit candidate
+ *     validateRolesYaml(candidate)       → RolesAdminError 422, write nothing
+ *     LockingFilesystem.writeFile(roles.yaml)  ← acquire → write → release;
+ *       release IS the commit + push (default per-file summary), so the commit
+ *       lands a beat after the write — same pipeline the human editor + agent
+ *       use. The HTTP roster reads the (synchronously written) working tree.
+ *
+ *   Rename (`renameRole`) — keeps an ATOMIC multi-file special case because it
+ *   rewrites roles.yaml + every reference in ONE commit (a partial rewrite =
+ *   silent access drop):
+ *     pre-check roles.yaml isn't locked  → RolesAdminError 409
+ *     parse + rewrite refs (fail-closed) → validate gate
+ *     LockingFilesystem.writeFiles(roles.yaml + refs)  ← acquires every path's
+ *       lock, commits the curated set as ONE change (via the workflow service's
+ *       commitChanges), then releases without a per-file commit.
+ *
+ * All reads and writes target the DEFAULT branch — the file admin status itself
+ * derives from. Editing any other branch's copy would show a roster that
+ * doesn't match who is actually an admin.
+ */
+import path from 'node:path';
+import { promises as fs } from 'node:fs';
+import { workspaceIdForBranch } from '../workspace/workspace.service.js';
+import { LockingFilesystem } from '../workflow/locking-filesystem.js';
+import { WorkflowDomainError } from '../workflow/workflow.errors.js';
+import { ADMIN_CANONICAL, canonicalRoleName, canonicalEmail, parseAccessEntry, } from './access-control.service.js';
+import { makeRolesYamlWriteValidator } from './roles-yaml-guard.js';
+import { parseRolesModel, createRole as editCreateRole, deleteRole as editDeleteRole, addMember as editAddMember, removeMember as editRemoveMember, renameRoleDisplay as editRenameRoleDisplay, RolesEditError, } from './roles-edit.js';
+/** A mutation that cannot proceed (invariant violation, contention, not found). */
+export class RolesAdminError extends WorkflowDomainError {
+    constructor(message, status = 422, payload) {
+        super(message, status, payload);
+        this.name = 'RolesAdminError';
+    }
+}
+const ROLES_YAML = 'roles.yaml';
+/** Where {@link RolesAdminService.recover} parks the corrupted file. */
+const OLD_ROLES_YAML = 'old-roles.yaml';
+/**
+ * The known-good `roles.yaml` the break-glass recovery restores. Mirrors the
+ * canonical Bevel roster — it is the ONLY content recovery ever writes, so it
+ * MUST parse (the post-recovery resolver loads it immediately). Keep the Admin
+ * list in sync with the canonical `osapiens-kb/roles.yaml`.
+ */
+const RECOVERY_DEFAULT_ROLES_YAML = `# Identity → role mapping for access control.
+# Role names are case- and whitespace-insensitive. The \`Admin\` role is special:
+# only Admins may edit this file, and at least one Admin must always exist.
+roles:
+  Admin:
+    - razvan.radulescu@bevel.software
+    - ali.raza@bevel.software
+    - juan@bevel.software
+`;
+export class RolesAdminService {
+    workspaceService;
+    workflowService;
+    accessControl;
+    kbDirName;
+    defaultBranch;
+    eventBus;
+    constructor(workspaceService, workflowService, accessControl, kbDirName, 
+    /** The branch whose roles.yaml is authoritative for admin status. */
+    defaultBranch, 
+    /**
+     * Optional so existing tests can construct the service without an event
+     * bus. When present, every committed write announces itself so already-open
+     * clients re-fetch the changed files and re-evaluate their permissions —
+     * a roles.yaml / access.md change is an access change, and without this an
+     * open tab keeps a now-stale read verdict until a manual reload.
+     */
+    eventBus) {
+        this.workspaceService = workspaceService;
+        this.workflowService = workflowService;
+        this.accessControl = accessControl;
+        this.kbDirName = kbDirName;
+        this.defaultBranch = defaultBranch;
+        this.eventBus = eventBus;
+    }
+    get workspaceId() {
+        return workspaceIdForBranch(this.defaultBranch);
+    }
+    /**
+     * Announce committed writes so watching clients refresh. Emits one
+     * `file-changed` per written file (workspace-relative path — the form the
+     * frontend keys tabs on, NOT the bare repo-relative path `commitChanges` takes)
+     * plus a single `fs-tree-changed`. `newSha: null` — the roster response is the
+     * authoritative post-commit state; clients only need the "go refetch" nudge.
+     */
+    emitWrites(workspaceId, actor, repoRelPaths) {
+        if (!this.eventBus || repoRelPaths.length === 0)
+            return;
+        for (const repoRel of repoRelPaths) {
+            this.eventBus.emit({
+                kind: 'file-changed',
+                workspaceId,
+                branch: this.defaultBranch,
+                path: `${this.kbDirName}/${repoRel}`,
+                newSha: null,
+                byUserId: actor.id,
+                byUserName: actor.name,
+            });
+        }
+        this.eventBus.emit({ kind: 'fs-tree-changed', workspaceId, branch: this.defaultBranch });
+    }
+    /** Ensure the authoritative clone exists, then return its workspace id. */
+    async ensureWorkspace() {
+        await this.workspaceService.getOrCreateForBranch(this.defaultBranch);
+        return this.workspaceId;
+    }
+    async repoDir(workspaceId) {
+        const wsDir = await this.workspaceService.getWorkspacePath(workspaceId);
+        return path.join(wsDir, this.kbDirName);
+    }
+    /**
+     * A lock-aware filesystem scoped to `actor` — writes auto-commit + push as the
+     * actor on release, through the same pipeline as the human editor and agent.
+     * Built per-op because the lock context captures the acting user.
+     */
+    async lockingFsForActor(workspaceId, actor) {
+        const basePath = await this.workspaceService.getWorkspacePath(workspaceId);
+        return new LockingFilesystem({ basePath, contained: true }, {
+            workflow: this.workflowService,
+            workspaceId,
+            branch: this.defaultBranch,
+            user: actor,
+            // Defence in depth: this surface already validates candidates before
+            // writing, but the same pre-disk gate the editor/agent use guarantees a
+            // malformed roles.yaml can never land through here either.
+            validateWrite: makeRolesYamlWriteValidator(this.kbDirName),
+        });
+    }
+    /**
+     * Fail fast with a friendly 409 if roles.yaml is already locked by someone
+     * else. The actual lock is taken by the LockingFilesystem write that follows;
+     * this only preserves the explicit "being edited by X" contract (the raw
+     * LockingFilesystem contention error is status-less and would surface as 500).
+     */
+    async assertRolesUnlocked(workspaceId, actor) {
+        const held = await this.workflowService.getLock(workspaceId, this.defaultBranch, `${this.kbDirName}/${ROLES_YAML}`);
+        if (held && held.holderUserId !== actor.id) {
+            throw new RolesAdminError(`Roles are being edited by ${held.holderName || 'another admin'}. Try again in a moment.`, 409);
+        }
+    }
+    /**
+     * Run a lock-aware filesystem write, mapping its status-less contention error
+     * ("Skipped editing … — locked by …") to the friendly 409. {@link
+     * assertRolesUnlocked} pre-checks the common case (and names the holder), but
+     * it's a TOCTOU check — another admin can grab the lock between it and the
+     * actual acquire inside the write. This catches that race so contention always
+     * surfaces as a 409, never an unhandled 500.
+     */
+    async mapLockContention(write) {
+        try {
+            return await write();
+        }
+        catch (err) {
+            if (err instanceof Error && /locked by /.test(err.message)) {
+                throw new RolesAdminError('Roles are being edited by another admin. Try again in a moment.', 409);
+            }
+            throw err;
+        }
+    }
+    async readRolesYaml(workspaceId) {
+        try {
+            return await this.workspaceService.readFile(workspaceId, path.posix.join(this.kbDirName, ROLES_YAML));
+        }
+        catch (err) {
+            const code = err?.code;
+            if (code === 'ENOENT' || code === 'ENOTDIR')
+                return '';
+            throw err;
+        }
+    }
+    // ---- Read -------------------------------------------------------------
+    /** The roster: every role on the default branch with members + references. */
+    async getRoster() {
+        const workspaceId = await this.ensureWorkspace();
+        const text = await this.readRolesYaml(workspaceId);
+        const model = parseRolesModel(text);
+        // ONE sound scan of every `.md` (folder access.md + node
+        // frontmatter), then index the references by canonical role. This is the
+        // SAME candidate set + parse the rename rewrite uses, so the delete warning
+        // can never undercount what the rename would actually touch.
+        const referencesByRole = await this.scanRoleReferences(workspaceId);
+        const out = [];
+        for (const role of model) {
+            const canonical = canonicalRoleName(role.displayName);
+            out.push({
+                canonical,
+                displayName: role.displayName,
+                members: role.members,
+                isAdmin: canonical === ADMIN_CANONICAL,
+                referencedBy: referencesByRole.get(canonical) ?? [],
+            });
+        }
+        return out;
+    }
+    /**
+     * Whether the default-branch roles.yaml parses. Drives the "roles file
+     * corrupted" banner. Auth-only (never admin-gated): a corrupted file resolves
+     * NOBODY as admin, so an admin-gated health check could never report the very
+     * state it exists to detect. A missing/empty file counts as corrupted —
+     * loadModel hard-throws on it exactly as it does on malformed YAML.
+     */
+    async getHealth() {
+        const workspaceId = await this.ensureWorkspace();
+        const text = await this.readRolesYaml(workspaceId);
+        const v = this.accessControl.validateRolesYaml(text);
+        return v.ok ? { ok: true, errors: [] } : { ok: false, errors: v.errors };
+    }
+    /**
+     * Break-glass recovery for a corrupted roles.yaml (the "Bevel Recovery"
+     * button). Copies the corrupted file to `old-roles.yaml` and restores the
+     * known-good default in ONE atomic commit, then returns the fresh roster.
+     *
+     * Authorization: this is the ONE roles mutation that is NOT admin-gated —
+     * by construction a corrupted roles.yaml resolves nobody as admin, so an
+     * admin gate would make recovery impossible (the lockout the user reported).
+     * Instead it is gated on the file ACTUALLY being unparseable: if roles.yaml
+     * is valid, recovery is refused (409) so it can never be used as an
+     * unauthenticated roster reset. The "only press if you are from Bevel" UI
+     * copy is the honour-system layer on top of that hard gate.
+     *
+     * This works on the protected default branch because the commit/push access
+     * gate reads roles.yaml AT-REF and fails OPEN when it can't parse (treating a
+     * broken config as "no rules in force") — so the restoring write is allowed
+     * through precisely when the file is broken.
+     */
+    async recover(actor) {
+        const workspaceId = await this.ensureWorkspace();
+        // Start from EXACTLY origin's state before deciding/writing. This (a) pulls
+        // in commits the clone was behind on so the restoring commit fast-forwards
+        // on push instead of being rejected non-fast-forward, and (b) discards any
+        // half-finished recovery commit a prior failed push left behind (which would
+        // otherwise make the LOCAL file look healthy while origin stays broken and
+        // the fix never reaches it). Best-effort: if origin is unreachable we fall
+        // back to the local state and still attempt the local fix.
+        try {
+            await this.workflowService.resetToRemote(workspaceId, this.defaultBranch);
+            this.accessControl.invalidate(workspaceId);
+        }
+        catch (err) {
+            console.warn('[roles.recover] could not sync with origin before recovery; proceeding with local state:', err instanceof Error ? err.message : err);
+        }
+        const current = await this.readRolesYaml(workspaceId);
+        // Hard gate: refuse unless the file is genuinely corrupted.
+        if (this.accessControl.validateRolesYaml(current).ok) {
+            throw new RolesAdminError('roles.yaml is valid — recovery is only available when the file is corrupted.', 409, { kind: 'not-corrupted' });
+        }
+        await this.assertRolesUnlocked(workspaceId, actor);
+        // Back up the corrupted bytes and restore the good default atomically. The
+        // default is valid, so the resolver loads immediately after this commit.
+        const fsys = await this.lockingFsForActor(workspaceId, actor);
+        await this.mapLockContention(() => fsys.writeFiles([
+            { path: `${this.kbDirName}/${OLD_ROLES_YAML}`, content: current },
+            { path: `${this.kbDirName}/${ROLES_YAML}`, content: RECOVERY_DEFAULT_ROLES_YAML },
+        ], 'Bevel recovery: reset corrupted roles.yaml'));
+        this.accessControl.invalidate(workspaceId);
+        this.emitWrites(workspaceId, actor, [OLD_ROLES_YAML, ROLES_YAML]);
+        return this.getRoster();
+    }
+    // ---- Mutations --------------------------------------------------------
+    async createRole(actor, displayName) {
+        await this.runEdit(actor, (text) => editCreateRole(text, displayName));
+        return this.getRoster();
+    }
+    async deleteRole(actor, canonical) {
+        if (canonical === ADMIN_CANONICAL) {
+            throw new RolesAdminError('The Admin role cannot be deleted', 422);
+        }
+        await this.runEdit(actor, (text) => editDeleteRole(text, canonical));
+        return this.getRoster();
+    }
+    async addMember(actor, canonical, email) {
+        await this.runEdit(actor, (text) => editAddMember(text, canonical, email));
+        return this.getRoster();
+    }
+    /**
+     * Remove a member. Refuses to empty the Admin role (422). Removing the
+     * caller's OWN last Admin membership requires `confirm` (409 otherwise) — no
+     * silent self-lockout, since admin status is read live from this file.
+     */
+    async removeMember(actor, canonical, email, confirm) {
+        await this.runEdit(actor, (text) => {
+            const target = canonicalEmail(email);
+            if (canonical === ADMIN_CANONICAL) {
+                const admin = parseRolesModel(text).find((r) => canonicalRoleName(r.displayName) === ADMIN_CANONICAL);
+                const members = admin?.members ?? [];
+                if (members.includes(target) && members.length <= 1) {
+                    throw new RolesAdminError('The Admin role must keep at least one member', 422);
+                }
+                if (target === canonicalEmail(actor.email) && members.includes(target) && !confirm) {
+                    throw new RolesAdminError('You are about to remove your own admin access', 409, {
+                        kind: 'self-admin-removal',
+                    });
+                }
+            }
+            return editRemoveMember(text, canonical, email);
+        });
+        return this.getRoster();
+    }
+    /**
+     * Rename a role's display name.
+     *   - canonical UNCHANGED (casing/whitespace) → single roles.yaml edit.
+     *   - canonical CHANGES → rewrite every genuine role reference in access.md +
+     *     node frontmatter AND roles.yaml in ONE atomic commit.
+     *   - Admin canonical → non-admin canonical is refused (400): it would break
+     *     isAdminEmail's roles.has('admin') lookup. Casing-only Admin OK.
+     */
+    async renameRole(actor, canonical, newDisplayName) {
+        const newCanonical = canonicalRoleName(newDisplayName);
+        if (canonical === ADMIN_CANONICAL && newCanonical !== ADMIN_CANONICAL) {
+            throw new RolesAdminError('The Admin role cannot be renamed to a different name', 400);
+        }
+        const workspaceId = await this.ensureWorkspace();
+        // Preserve the friendly 409 on contention: writeFiles throws a status-less
+        // lock-skip error (→ 500), so pre-check the roles.yaml lock.
+        await this.assertRolesUnlocked(workspaceId, actor);
+        const text = await this.readRolesYaml(workspaceId);
+        const before = parseRolesModel(text);
+        if (!before.some((r) => canonicalRoleName(r.displayName) === canonical)) {
+            throw new RolesAdminError(`role not found: ${canonical}`, 404);
+        }
+        const rolesEdit = this.guardEdit(() => editRenameRoleDisplay(text, canonical, newDisplayName));
+        const writes = [];
+        // The roles.yaml change itself (skip if the re-emit was a no-op).
+        // REPO-relative path (bare); the kbDirName prefix is added below.
+        if (rolesEdit.changed) {
+            writes.push({ repoRelativePath: ROLES_YAML, content: rolesEdit.text });
+        }
+        // Identity change → rewrite every genuine role reference, atomically.
+        // (Fail-closed: an unreadable candidate throws here, BEFORE any write.)
+        if (newCanonical !== canonical) {
+            const repoDir = await this.repoDir(workspaceId);
+            const refWrites = await this.rewriteRoleReferences(workspaceId, repoDir, canonical, newDisplayName.trim());
+            writes.push(...refWrites);
+        }
+        if (writes.length === 0)
+            return this.getRoster(); // nothing changed
+        // The validate-gate: any roles.yaml write must parse via the resolver —
+        // runs BEFORE the atomic write so a bad candidate never reaches disk.
+        const rolesWrite = writes.find((w) => w.repoRelativePath === ROLES_YAML);
+        if (rolesWrite)
+            this.assertLoadable(rolesWrite.content);
+        // Rename keeps the ATOMIC multi-file commit (roles.yaml + every rewritten
+        // reference land as ONE commit, or none): a partial rewrite would leave a
+        // renamed role with references still pointing at the old name = silent
+        // access drop. The lock-aware filesystem owns this — it acquires every
+        // path's lock, writes them, and commits the curated set as one change.
+        const fsys = await this.lockingFsForActor(workspaceId, actor);
+        await this.mapLockContention(() => fsys.writeFiles(writes.map((w) => ({ path: `${this.kbDirName}/${w.repoRelativePath}`, content: w.content })), `Rename role ${canonical} → ${newDisplayName.trim()}`));
+        this.accessControl.invalidate(workspaceId);
+        this.emitWrites(workspaceId, actor, writes.map((w) => w.repoRelativePath));
+        return this.getRoster();
+    }
+    // ---- Internals --------------------------------------------------------
+    /** Map a RolesEditError to a RolesAdminError (preserving status). */
+    guardEdit(fn) {
+        try {
+            return fn();
+        }
+        catch (err) {
+            if (err instanceof RolesEditError)
+                throw new RolesAdminError(err.message, err.status);
+            throw err;
+        }
+    }
+    assertLoadable(candidate) {
+        const v = this.accessControl.validateRolesYaml(candidate);
+        if (!v.ok) {
+            throw new RolesAdminError(`roles.yaml would be invalid: ${v.errors.join('; ')}`, 422);
+        }
+    }
+    /**
+     * Single-file roles.yaml mutation. `pre` produces the candidate (and may throw
+     * RolesAdminError for invariant violations before any write). Skips on a no-op.
+     *
+     * The write goes through a {@link LockingFilesystem}: acquiring the per-file
+     * lock, writing, then releasing — and release IS the commit + push (attributed
+     * to `actor`), the same pipeline the human editor and agent use. So unlike the
+     * rename's synchronous atomic commit, the git commit here lands on release
+     * (a beat after the write); the HTTP response reads the working tree, which is
+     * already on disk, so the returned roster is correct.
+     */
+    async runEdit(actor, pre) {
+        const workspaceId = await this.ensureWorkspace();
+        await this.assertRolesUnlocked(workspaceId, actor);
+        const text = await this.readRolesYaml(workspaceId);
+        const result = this.guardEdit(() => pre(text));
+        if (!result.changed)
+            return;
+        this.assertLoadable(result.text);
+        // LockingFilesystem paths are WORKSPACE-relative, so carry the kbDirName
+        // prefix (unlike commitChanges' bare repo-relative paths). The release
+        // pipeline writes a default per-file commit summary ("Update roles.yaml");
+        // a bespoke summary isn't threadable through this path, which is fine for a
+        // single-file roles edit. The rename keeps its descriptive summary because
+        // it commits atomically via writeFiles.
+        const fsys = await this.lockingFsForActor(workspaceId, actor);
+        await this.mapLockContention(() => fsys.writeFile(`${this.kbDirName}/${ROLES_YAML}`, result.text));
+        this.accessControl.invalidate(workspaceId);
+        this.emitWrites(workspaceId, actor, [ROLES_YAML]);
+    }
+    /**
+     * Find every genuine role reference to `oldCanonical` across folder access.md
+     * AND node frontmatter, and rewrite each to `newDisplayName`. Reference-aware:
+     * a line is rewritten ONLY if it PARSES as a role entry whose canonical name
+     * == oldCanonical. Prose, comments, `Name <email>` user entries, other keys,
+     * and substrings never match. Returns the repo-relative writes to commit.
+     */
+    async rewriteRoleReferences(workspaceId, repoDir, oldCanonical, newDisplayName) {
+        const writes = [];
+        const candidates = await this.collectCandidateFiles(workspaceId);
+        for (const repoRel of candidates) {
+            const abs = path.join(repoDir, repoRel);
+            let text;
+            try {
+                text = await fs.readFile(abs, 'utf-8');
+            }
+            catch (err) {
+                // Fail closed: a candidate we cannot read might reference the
+                // old role. Skipping it would commit a partial rewrite (a half-renamed
+                // role pointing at the old name) and silently drop access. Abort the
+                // whole atomic rename instead so the admin can retry cleanly.
+                throw new RolesAdminError(`Cannot read ${repoRel} while rewriting role references; rename aborted with no changes`, 422, { cause: err?.message });
+            }
+            const rewritten = rewriteRoleTokensInText(text, oldCanonical, newDisplayName);
+            if (rewritten !== text) {
+                // REPO-relative (bare repoRel) for commitChanges — repoDir already points
+                // at <workspaceDir>/<kbDirName>.
+                writes.push({ repoRelativePath: repoRel, content: rewritten });
+            }
+        }
+        return writes;
+    }
+    /**
+     * Repo-relative paths of every file that could carry a role reference: all
+     * `access.md` files plus every `.md` node (its own frontmatter). Sourced from
+     * the workspace file tree (which already skips `.git` and honours
+     * `.bevelignore`), filtered to `.md` under the KB dir and returned bare
+     * repo-relative. (`roles.yaml` isn't `.md`, so it's excluded; the rename
+     * commits it separately.) Under save=share the working tree matches the
+     * committed set, so this is the same candidate list git-tracking would give.
+     */
+    async collectCandidateFiles(workspaceId) {
+        const tree = await this.workspaceService.listFiles(workspaceId);
+        const prefix = `${this.kbDirName}/`;
+        const out = [];
+        const visit = (node) => {
+            if (node.type === 'file') {
+                if (node.relativePath.startsWith(prefix) && node.relativePath.endsWith('.md')) {
+                    out.push(node.relativePath.slice(prefix.length));
+                }
+                return;
+            }
+            for (const child of node.children ?? [])
+                visit(child);
+        };
+        visit(tree);
+        return out;
+    }
+    /**
+     * Sound scan of EVERY `.md` (folder `access.md` + node frontmatter)
+     * for genuine role references, indexed by canonical role name. Shares the
+     * candidate set and the config-region role-entry parse with the rename
+     * rewrite (`findRoleRefsInText` / `rewriteRoleTokensInText`), so the delete
+     * warning and the rename rewrite see the SAME references — the warning can no
+     * longer undercount frontmatter the rename would touch. A file we cannot read
+     * is skipped (this is an advisory read, not the atomic write path): missing a
+     * reference here only weakens the warning, it cannot drop access.
+     */
+    async scanRoleReferences(workspaceId) {
+        const repoDir = await this.repoDir(workspaceId);
+        const candidates = await this.collectCandidateFiles(workspaceId);
+        const byRole = new Map();
+        for (const repoRel of candidates) {
+            let text;
+            try {
+                text = await fs.readFile(path.join(repoDir, repoRel), 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            for (const ref of findRoleRefsInText(text)) {
+                const list = byRole.get(ref.role);
+                if (list)
+                    list.push({ path: repoRel, verb: ref.verb });
+                else
+                    byRole.set(ref.role, [{ path: repoRel, verb: ref.verb }]);
+            }
+        }
+        return byRole;
+    }
+}
+/**
+ * Resolve the [start, end) line range that role rewrites may touch — the YAML
+ * config region only, NEVER the markdown body (CodeRabbit: a body line like
+ * `- Sales` or `owner: Sales` must not be rewritten).
+ *
+ *   - A file with leading `---` frontmatter (folder `access.md`, node `.md`):
+ *     only the lines BETWEEN the opening and closing `---` are eligible.
+ *   - A fence-less file (e.g. a bare `roles.yaml`-style access config with no
+ *     `---`): the whole file is config, so all lines are eligible.
+ *   - A `.md` file with no frontmatter fence: no config region → empty range,
+ *     nothing is rewritten.
+ */
+function configLineRange(lines, isMarkdown) {
+    if (lines.length > 0 && lines[0].trim() === '---') {
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === '---')
+                return { start: 1, end: i };
+        }
+        // Unterminated frontmatter — treat nothing as eligible (don't risk the body).
+        return { start: 0, end: 0 };
+    }
+    // No fence: a markdown file has no config region; a non-markdown access file
+    // (no body) is entirely config.
+    return isMarkdown ? { start: 0, end: 0 } : { start: 0, end: lines.length };
+}
+/** A known access verb key: heads a block list or holds a scalar role value. */
+const VERB_KEY_RE = /^(\s*)(read|write|download|owner)(:\s*)(.*)$/;
+/** A block-list item: `  - <token>` (token may carry a leading `deny `). */
+const LIST_ITEM_RE = /^(\s*-\s+)(.*)$/;
+/**
+ * Walk the CONFIG-REGION lines of `text`, invoking `onRoleRef` for every line
+ * that PARSES as a genuine role entry — both the block-list form (`- <token>`
+ * under a `read:`/`write:`/… key) and the inline scalar form (`owner: <token>`).
+ * `verb` is the access verb the reference sits under; for a block list it is the
+ * nearest enclosing verb key (lines before any verb key, or under an unknown
+ * key, are skipped). This is the SINGLE source of truth for "what is a role
+ * reference" — both the delete-warning scan and the rename rewrite drive off it,
+ * so they cannot disagree. The callback may mutate `lines[i]` (the rewrite does;
+ * the scan does not). User entries, other keys, comments and substrings never
+ * fire it.
+ */
+function walkRoleRefs(lines, start, end, onRoleRef) {
+    let currentVerb = null;
+    /** A role-entry value → its parsed role entry, else null (user/empty/other). */
+    const roleEntry = (rawValue) => {
+        const parsed = parseAccessEntry(rawValue.replace(/\s+$/, ''));
+        return parsed.ok && parsed.entry.kind === 'role'
+            ? { role: parsed.entry.role, deny: parsed.entry.deny }
+            : null;
+    };
+    for (let i = start; i < end; i++) {
+        const line = lines[i];
+        // A verb key resets the block context. Its inline value (scalar form,
+        // `owner: Sales`) is itself a candidate reference under that same verb.
+        const kvM = line.match(VERB_KEY_RE);
+        if (kvM) {
+            currentVerb = kvM[2];
+            const inlineValue = kvM[4];
+            if (inlineValue.trim() !== '') {
+                const entry = roleEntry(inlineValue);
+                if (entry)
+                    onRoleRef({ i, verb: currentVerb, entry, indent: `${kvM[1]}${kvM[2]}${kvM[3]}`, prefix: '' });
+            }
+            continue;
+        }
+        // Block-list item — belongs to the nearest enclosing verb key. A list item
+        // with no verb in scope is not a resolvable access rule; skip it.
+        const listM = line.match(LIST_ITEM_RE);
+        if (listM && currentVerb !== null) {
+            const entry = roleEntry(listM[2]);
+            if (entry)
+                onRoleRef({ i, verb: currentVerb, entry, indent: '', prefix: listM[1] });
+            continue;
+        }
+        // A non-empty, non-list, non-kv line ends the current block (e.g. a new
+        // top-level key whose value isn't a verb, or stray prose in config).
+        if (line.trim() !== '' && !listM)
+            currentVerb = null;
+    }
+}
+/** Every genuine role reference in `text`'s config region, as {role, verb}. */
+export function findRoleRefsInText(text, isMarkdown = true) {
+    const lines = text.split('\n');
+    const { start, end } = configLineRange(lines, isMarkdown);
+    const out = [];
+    if (start >= end)
+        return out;
+    walkRoleRefs(lines, start, end, ({ verb, entry }) => out.push({ role: entry.role, verb }));
+    return out;
+}
+/**
+ * Rewrite every CONFIG-REGION line that PARSES as a role reference whose
+ * canonical name == `oldCanonical`, replacing the role token with
+ * `newDisplayName` (preserving any leading `deny ` and indentation). Only the
+ * frontmatter block of a markdown file is touched — the body is left
+ * byte-for-byte intact, so a prose line like `- Sales` is never corrupted.
+ * Lines that don't parse as a matching role entry (user entries, other keys,
+ * substrings) are also untouched. Exported for test.
+ *
+ * `isMarkdown` (default true) marks files that carry a markdown body below the
+ * frontmatter; pass false only for a pure-config file with no body.
+ */
+export function rewriteRoleTokensInText(text, oldCanonical, newDisplayName, isMarkdown = true) {
+    const lines = text.split('\n');
+    const { start, end } = configLineRange(lines, isMarkdown);
+    if (start >= end)
+        return text;
+    let changed = false;
+    walkRoleRefs(lines, start, end, ({ i, entry, indent, prefix }) => {
+        if (entry.role !== oldCanonical)
+            return;
+        lines[i] = `${indent}${prefix}${entry.deny ? 'deny ' : ''}${newDisplayName}`;
+        changed = true;
+    });
+    return changed ? lines.join('\n') : text;
+}
+//# sourceMappingURL=roles-admin.service.js.map

package/dist/modules/access/roles-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles-admin.service.js","sourceRoot":"","sources":["../../../src/modules/access/roles-admin.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EACL,eAAe,EACf,UAAU,IAAI,cAAc,EAC5B,UAAU,IAAI,cAAc,EAC5B,SAAS,IAAI,aAAa,EAC1B,YAAY,IAAI,gBAAgB,EAChC,iBAAiB,IAAI,qBAAqB,EAC1C,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAEzB,mFAAmF;AACnF,MAAM,OAAO,eAAgB,SAAQ,mBAAmB;IACtD,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAiC;QAC1E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAgBD,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,wEAAwE;AACxE,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG;;;;;;;;CAQnC,CAAC;AAQF,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IAEA;IAQA;IAdnB,YACmB,gBAAmC,EACnC,eAAiC,EACjC,aAA6B,EAC7B,SAAiB;IAClC,qEAAqE;IACpD,aAAqB;IACtC;;;;;;OAMG;IACc,QAA2B;QAb3B,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,oBAAe,GAAf,eAAe,CAAkB;QACjC,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QAEjB,kBAAa,GAAb,aAAa,CAAQ;QAQrB,aAAQ,GAAR,QAAQ,CAAmB;IAC3C,CAAC;IAEJ,IAAY,WAAW;QACrB,OAAO,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,WAAmB,EAAE,KAAe,EAAE,YAAsB;QAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,cAAc;gBACpB,WAAW;gBACX,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE;gBACpC,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,UAAU,EAAE,KAAK,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,WAAmB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,KAAe;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,IAAI,iBAAiB,CAC1B,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAC7B;YACE,QAAQ,EAAE,IAAI,CAAC,eAAe;YAC9B,WAAW;YACX,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B,IAAI,EAAE,KAAK;YACX,qEAAqE;YACrE,wEAAwE;YACxE,2DAA2D;YAC3D,aAAa,EAAE,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;SAC3D,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,KAAe;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAC7C,WAAW,EACX,IAAI,CAAC,aAAa,EAClB,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,CAClC,CAAC;QACF,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CACvB,6BAA6B,IAAI,CAAC,UAAU,IAAI,eAAe,0BAA0B,EACzF,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,iBAAiB,CAAI,KAAuB;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,eAAe,CAAC,iEAAiE,EAAE,GAAG,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACxG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAoC,EAAE,IAAI,CAAC;YACzD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,0EAA0E;IAE1E,8EAA8E;IAC9E,KAAK,CAAC,SAAS;QACb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACpC,yDAAyD;QACzD,yEAAyE;QACzE,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,GAAG,GAAsB,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS;gBACT,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,SAAS,KAAK,eAAe;gBACtC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,OAAO,CAAC,KAAe;QAC3B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEjD,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1E,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,0FAA0F,EAC1F,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAEtD,4DAA4D;QAC5D,IAAI,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CACvB,8EAA8E,EAC9E,GAAG,EACH,EAAE,IAAI,EAAE,eAAe,EAAE,CAC1B,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAEnD,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAChC,IAAI,CAAC,UAAU,CACb;YACE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,cAAc,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YACjE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE;SAClF,EACD,4CAA4C,CAC7C,CACF,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAE1E,KAAK,CAAC,UAAU,CAAC,KAAe,EAAE,WAAmB;QACnD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAe,EAAE,SAAiB;QACjD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAe,EAAE,SAAiB,EAAE,KAAa;QAC/D,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,KAAe,EACf,SAAiB,EACjB,KAAa,EACb,OAAgB;QAEhB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,eAAe,CAAC,CAAC;gBACtG,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;gBACjF,CAAC;gBACD,IAAI,MAAM,KAAK,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnF,MAAM,IAAI,eAAe,CAAC,+CAA+C,EAAE,GAAG,EAAE;wBAC9E,IAAI,EAAE,oBAAoB;qBAC3B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,KAAe,EAAE,SAAiB,EAAE,cAAsB;QACzE,MAAM,YAAY,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,eAAe,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,2EAA2E;QAC3E,6DAA6D;QAC7D,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,eAAe,CAAC,mBAAmB,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAoD,EAAE,CAAC;QAEnE,kEAAkE;QAClE,kEAAkE;QAClE,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3G,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,kBAAkB;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,UAAU,CAAC,CAAC;QACzE,IAAI,UAAU;YAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAExD,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAChC,IAAI,CAAC,UAAU,CACb,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAC5F,eAAe,SAAS,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,CACtD,CACF,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,0EAA0E;IAE1E,qEAAqE;IAC7D,SAAS,CAAC,EAAoB;QACpC,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc;gBAAE,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,OAAO,CACnB,KAAe,EACf,GAAwC;QAExC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,qBAAqB,CACjC,WAAmB,EACnB,OAAe,EACf,YAAoB,EACpB,cAAsB;QAEtB,MAAM,MAAM,GAAoD,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACjE,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,8DAA8D;gBAC9D,uEAAuE;gBACvE,qEAAqE;gBACrE,8DAA8D;gBAC9D,MAAM,IAAI,eAAe,CACvB,eAAe,OAAO,kEAAkE,EACxF,GAAG,EACH,EAAE,KAAK,EAAG,GAAa,EAAE,OAAO,EAAE,CACnC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;YAC9E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,0EAA0E;gBAC1E,iCAAiC;gBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,qBAAqB,CAAC,WAAmB;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;QACpC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,OAAO;YACT,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,kBAAkB,CAC9B,WAAmB;QAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;QACnE,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;;oBAClD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,KAAe,EAAE,UAAmB;IAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,8EAA8E;QAC9E,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,6EAA6E;IAC7E,gCAAgC;IAChC,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,MAAM,WAAW,GAAG,8CAA8C,CAAC;AACnE,4EAA4E;AAC5E,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAEvC;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CACnB,KAAe,EACf,KAAa,EACb,GAAW,EACX,SAA6H;IAE7H,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,gFAAgF;IAChF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAA0C,EAAE;QAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;YAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACtD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;gBACrC,IAAI,KAAK;oBAAE,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpF,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;YAAE,WAAW,GAAG,IAAI,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,UAAU,GAAG,IAAI;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,YAAoB,EACpB,cAAsB,EACtB,UAAU,GAAG,IAAI;IAEjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1D,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QACxC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC;QAC7E,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC"}