@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/plugins/plugin-provision.service.js

@@ -25,17 +25,39 @@
  *     reads `everyone` — anyone may open the FILE, see the plugin listed, and
  *     ask to join — while the BODY (the folder's actual rules) names only
  *     the creator under read, write and owner.
- *   - A PERSONAL folder (`personal-<user-id>`): private by design. No
- *     frontmatter grant at all, so nobody else can even see it exists; the
- *     body names its owner. Created lazily (ensure semantics) on the first
- *     personal skill.
+ *   - A PERSONAL folder (`personal-<user-id>`): private by design, in both
+ *     blocks. The frontmatter denies `everyone` and names only the owner,
+ *     so nobody else can even see it exists; the body says the same of the
+ *     folder. Created lazily (ensure semantics) on the first personal skill.
  */
+import { randomUUID } from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { DEFAULT_BRANCH, PLUGINS_DIR, PLUGIN_MANIFEST_FILE, pluginManifestName, renderPluginManifest, PERSONAL_PLUGIN_PREFIX, isPersonalPluginFolder, personalPluginFolderName, } from '@bevel-software/platform-shared';
+import { DEFAULT_BRANCH, PLUGINS_DIR, PLUGIN_MANIFEST_FILE, PLUGIN_SKILLS_DIR, pluginDisplayNameOf, pluginManifestName, renderPluginManifest, PERSONAL_PLUGIN_PREFIX, isPersonalPluginDir, isPersonalPluginFolder, personalPluginFolderName, validateFilename, } from '@bevel-software/platform-shared';
 import { creatorPrincipal } from '../access-model/creator.js';
 import { spliceGrant } from '../access-model/access-splice.js';
 import { WorkspaceMutex } from '../kb-fs/mutex.js';
+/**
+ * A directory's entries, or null when there is no such directory. ONLY
+ * absence reads as "nothing there": a listing that fails for any other
+ * reason (permissions, I/O) throws, because "the folder is not there" and
+ * "the folder could not be read" must never collapse into one answer — the
+ * first is a 404 to a caller, the second an outage an operator must see.
+ */
+async function listDirOrIncomplete(disk, dir, repoRel) {
+    try {
+        return await disk.listDir(dir);
+    }
+    catch {
+        // The same refusal a hole in discovery gets: this listing is one more
+        // read the operation needed and could not have.
+        throw incompleteDiscovery([repoRel]);
+    }
+}
+/** The refusal for a discovery with a hole in it: a name cannot be checked, an identity cannot be known. */
+function incompleteDiscovery(unreadable) {
+    return new PluginProvisionError(`Some of the knowledge base could not be read (${unreadable.join(', ')}), so the plugin cannot be checked against every other. Try again, or ask an admin.`, 503);
+}
 /** A refusal the route can pass through: message + HTTP status. */
 export class PluginProvisionError extends Error {
     status;
@@ -45,12 +67,19 @@ export class PluginProvisionError extends Error {
         this.name = 'PluginProvisionError';
     }
 }
+/** The one shape every provisioning answer has: the folder in both spellings, and where its skills go. */
+function provisioned(folder, name, displayName, created) {
+    const path = `${PLUGINS_DIR}/${folder}`;
+    return { folder, path, skillsDir: `${path}/${PLUGIN_SKILLS_DIR}`, name, displayName, created };
+}
 export class PluginProvisionService {
     workspaceService;
     commits;
     accessControl;
     kbDirName;
     events;
+    source;
+    disk;
     /**
      * Serialises creations and deletions by MANIFEST SLUG
      * (`pluginManifestName(name)`). The wx write arbitrates same-path races,
@@ -60,26 +89,37 @@ export class PluginProvisionService {
      * name can hold the lock at once.
      */
     creations = new WorkspaceMutex();
-    constructor(workspaceService, commits, accessControl, kbDirName, events) {
+    constructor(workspaceService, commits, accessControl, kbDirName, events, 
+    /** Which names are TAKEN is discovery's answer — the same one every catalog gets. */
+    source, disk) {
         this.workspaceService = workspaceService;
         this.commits = commits;
         this.accessControl = accessControl;
         this.kbDirName = kbDirName;
         this.events = events;
+        this.source = source;
+        this.disk = disk;
     }
     /**
-     * Create `Plugins/<name>/` for `user`. Throws `PluginProvisionError` 422 on a
-     * name the filesystem or the model cannot carry, 409 when the name is taken
-     * (case-insensitively — the workspaces live on case-insensitive
-     * filesystems too, where `GTM` and `gtm` are one folder).
+     * Create `Plugins/<name>/` — or `Plugins/<parent>/<name>/` — for `user`.
+     * Throws `PluginProvisionError` 422 on a name the filesystem or the model
+     * cannot carry, 409 when the name is taken (case-insensitively — the
+     * workspaces live on case-insensitive filesystems too, where `GTM` and
+     * `gtm` are one folder), 404 when `parent` names no folder.
+     *
+     * `parent` is a GROUPING folder below the plugins root (`Teams`,
+     * `Teams/EU`): it must exist, and it must not be a plugin or sit inside
+     * one — discovery claims a plugin's whole subtree, so a plugin made there
+     * would be invisible to every catalog. The identity checks are the same at
+     * any depth: a nested plugin claims its slug as fully as a top-level one.
      */
-    async createPlugin(user, rawName) {
+    async createPlugin(user, rawName, rawParent) {
         const name = rawName.trim();
         if (!name)
             throw new PluginProvisionError('A plugin needs a name.', 422);
-        // eslint-disable-next-line no-control-regex -- NUL and control chars are
-        // exactly what a filesystem path cannot carry; refusing them here keeps
-        // the refusal a 422 instead of the fs layer's 500.
+        // NUL and control chars are exactly what a filesystem path cannot carry;
+        // refusing them here keeps the refusal a 422 instead of the fs layer's 500.
+        // eslint-disable-next-line no-control-regex
         if (/[/\\\u0000-\u001f\u007f]/.test(name) || name === '.' || name === '..' || name.startsWith('.')) {
             throw new PluginProvisionError('A plugin name can\'t contain / or \\ or control characters, or start with a dot.', 422);
         }
@@ -94,6 +134,9 @@ export class PluginProvisionService {
             throw new PluginProvisionError(`"${name}" would publish the manifest name "${pluginManifestName(name)}" — ` +
                 `the "${PERSONAL_PLUGIN_PREFIX}" namespace is reserved for personal folders. Pick another name.`, 422);
         }
+        // The name is judged before the parent: a name that can never be created
+        // is refused as such, not as "no such folder" or "discovery incomplete".
+        const parent = await this.resolveParent(rawParent);
         // Locked on the manifest SLUG, not the lowercased folder: the slug is the
         // identity the twin check below defends, and two spellings that collide
         // on it ("Sales Team" / "Sales-Team") must take the SAME lock or both
@@ -101,7 +144,7 @@ export class PluginProvisionService {
         // key subsumes the old lowercase one — and deletion (below) derives its
         // key the same way, keeping delete/re-create of one name serialized.
         return this.creations.run(`plugin:${pluginManifestName(name)}`, async () => {
-            const existing = await this.existingFolder(name);
+            const existing = await this.existingFolder(name, parent);
             if (existing !== null) {
                 throw new PluginProvisionError(`A plugin named "${existing}" already exists.`, 409);
             }
@@ -115,33 +158,83 @@ export class PluginProvisionService {
                 throw new PluginProvisionError(`"${name}" and the existing plugin "${slugTwin}" would share the manifest name ` +
                     `"${pluginManifestName(name)}" — pick a more distinct name.`, 409);
             }
-            await this.provision(user, name, pluginAccessMd(user));
-            return { folder: name, created: true };
+            const folder = parent ? `${parent}/${name}` : name;
+            // `name` is the creator's own spelling, trimmed — the folder's leaf AND
+            // the display name persisted for it, whether or not it equals either.
+            await this.provision(user, folder, name, pluginAccessMd(user));
+            return provisioned(folder, pluginManifestName(name), name, true);
         });
     }
+    /**
+     * The grouping folder a creation goes into, as its path below the plugins
+     * root — `''` for the root itself. Validated AS GIVEN, segment by segment,
+     * with the one rule every path here obeys (`validateFilename`, no
+     * dot-prefix); it must exist with every component spelled as on disk; and
+     * it must be a GROUPING folder — not a personal space, not a plugin, not
+     * inside one, since discovery claims a plugin's subtree and a plugin made
+     * there would be listed nowhere. A hole in discovery refuses, as for every
+     * other provisioning write.
+     */
+    async resolveParent(rawParent) {
+        if (rawParent === undefined || rawParent === '')
+            return '';
+        const segments = rawParent.split('/');
+        if (segments.some((s) => validateFilename(s) !== null || s.startsWith('.'))) {
+            throw new PluginProvisionError(`"${rawParent}" is not a folder name the knowledge base can carry.`, 422);
+        }
+        const rel = `${PLUGINS_DIR}/${rawParent}`;
+        // The personal namespace is the FIRST segment below the root — the same
+        // structural rule as `isPersonalPluginDir`, applied to the parent and
+        // everything under it. A `personal-*` folder there is a personal space
+        // whether it was provisioned yet or not: the prefix is reserved at that
+        // depth (creation refuses the slug, rename refuses the name).
+        if (isPersonalPluginFolder(segments[0])) {
+            throw new PluginProvisionError('A plugin cannot be made inside a personal space.', 422);
+        }
+        const wsId = await this.readyWorkspaceId();
+        const wsDir = await this.workspaceService.getWorkspacePath(wsId);
+        if (!(await this.exactFolderExists(path.join(wsDir, this.kbDirName, PLUGINS_DIR), segments))) {
+            throw new PluginProvisionError(`There is no folder "${rawParent}" under ${PLUGINS_DIR}/.`, 404);
+        }
+        // Judged against every folder discovery CLAIMS, not only the plugins it
+        // lists: a twin skipped for its slug still owns its subtree, and a
+        // plugin made in there would be listed by no catalog.
+        const { claimed, unreadable } = await this.discovered();
+        if (unreadable.length > 0)
+            throw incompleteDiscovery(unreadable);
+        const inside = claimed.find((c) => rel === c || rel.startsWith(`${c}/`));
+        if (inside) {
+            throw new PluginProvisionError(`"${rawParent}" is inside the plugin at ${inside} — a plugin cannot hold another plugin.`, 422);
+        }
+        return rawParent;
+    }
     /**
      * Ensure the caller's personal folder exists — idempotent, keyed to the
-     * stable user id. Returns `created: false` when it is already there.
+     * stable user id. Returns `created: false` when it is already there, and
+     * with it the display name the existing manifest carries (see
+     * {@link persistedDisplayName}): the answer is what the file says, so the
+     * call that made the folder and every call after it agree.
      */
     async ensurePersonalPlugin(user) {
         const folder = personalPluginFolderName(user.id);
         return this.creations.run(`plugin:${pluginManifestName(folder)}`, async () => {
-            if ((await this.existingFolder(folder)) !== null) {
-                return { folder, created: false };
+            const existing = await this.existingFolder(folder);
+            if (existing !== null) {
+                return provisioned(folder, pluginManifestName(folder), await this.persistedDisplayName(existing, folder), false);
             }
             try {
-                await this.provision(user, folder, personalAccessMd(user));
+                await this.provision(user, folder, folder, personalAccessMd(user));
             }
             catch (err) {
                 // ENSURE semantics even under a race the lock cannot see (another
                 // process, a checkout that appeared between check and write): the
                 // folder existing is this method's success case, never its error.
                 if (err instanceof PluginProvisionError && err.status === 409) {
-                    return { folder, created: false };
+                    return provisioned(folder, pluginManifestName(folder), await this.persistedDisplayName(folder, folder), false);
                 }
                 throw err;
             }
-            return { folder, created: true };
+            return provisioned(folder, pluginManifestName(folder), folder, true);
         });
     }
     /**
@@ -163,29 +256,63 @@ export class PluginProvisionService {
      * never interleave with a re-creation of the same name (the key derives
      * from the name, so both spell it identically).
      */
-    async deletePlugin(user, rawName) {
-        const name = rawName.trim();
-        if (!name)
+    async deletePlugin(user, rawFolder) {
+        // The folder's path BELOW the plugins root — `GTM`, or `teams/deep` for a
+        // plugin nested where discovery found it. Segments only: nothing that
+        // could climb out of the root, and no backslash — `/` is the one
+        // separator the repository speaks, and a `\` would read as a second one
+        // on Windows and as a name character everywhere else.
+        // Validated AS GIVEN, never trimmed first: a folder spelled with a
+        // leading or trailing space names no folder the catalog handed out, and
+        // trimming it would delete a different one. (`validateFilename` refuses
+        // the whitespace.)
+        const name = rawFolder;
+        const segments = name.split('/');
+        // Every segment must be a name the filesystem carries (the ONE rule
+        // creation applies, `validateFilename`: no control characters, no `\`,
+        // no `.`/`..`, no reserved names) and none may be dot-prefixed (a parked
+        // delete, invisible to every scanner) — refused here as a 422, never
+        // discovered by the fs layer as a 500.
+        if (!name || segments.some((s) => validateFilename(s) !== null || s.startsWith('.'))) {
             throw new PluginProvisionError('A plugin needs a name.', 422);
-        if (isPersonalPluginFolder(name)) {
+        }
+        if (isPersonalPluginDir(`${PLUGINS_DIR}/${name}`)) {
             // Personal folders are not plugins (the catalog never lists them), and
             // nobody deletes somebody's private shelf through the plugin door.
             throw new PluginProvisionError('Unknown plugin', 404);
         }
-        return this.creations.run(`plugin:${pluginManifestName(name)}`, async () => {
-            const existing = await this.existingFolder(name);
-            // Exact match only — the catalog hands the route the on-disk casing,
-            // so a mismatch means the plugin is gone (or was never there).
-            if (existing !== name)
+        const wsId = await this.readyWorkspaceId();
+        const wsDir = await this.workspaceService.getWorkspacePath(wsId);
+        const pluginsDir = path.join(wsDir, this.kbDirName, PLUGINS_DIR);
+        const folderDir = path.join(pluginsDir, ...segments);
+        // Locked on the plugin's IDENTITY — the same key a creation of that name
+        // takes — not on a slug of the folder path, which for a nested plugin is a
+        // different string and would let a creation of the same identity run
+        // inside the delete's window. The identity is DISCOVERY's answer, in
+        // either file shape (a bundle's name as much as a manifest's), so delete
+        // and create can never key on two spellings of one plugin; a hole in
+        // discovery refuses, as it does for creation. A folder discovery does not
+        // list (no manifest at all) locks on its own slug — nothing else can
+        // claim that identity either.
+        const identity = await this.discoveredIdentity(`${PLUGINS_DIR}/${name}`, segments[segments.length - 1]);
+        return this.creations.run(`plugin:${identity}`, async () => {
+            // Exact spelling of EVERY component — the catalog hands the route the
+            // on-disk spelling, so a mismatch means the plugin is gone (or was
+            // never there). Checked against directory listings, never `stat`: on a
+            // case-insensitive filesystem a stale spelling would stat a replacement
+            // plugin at the same location and park THAT.
+            if (!(await this.exactFolderExists(pluginsDir, segments))) {
                 throw new PluginProvisionError('Unknown plugin', 404);
-            const wsId = await this.readyWorkspaceId();
-            const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-            const pluginsDir = path.join(wsDir, this.kbDirName, PLUGINS_DIR);
-            const folderDir = path.join(pluginsDir, name);
+            }
             // Dot-prefixed ⇒ invisible to the plugin scanner and the collision
-            // check for the whole window the commit is in flight.
-            const parkedDir = path.join(pluginsDir, `.${name}.deleting`);
-            await fs.rm(parkedDir, { recursive: true, force: true }); // a stale park from a crashed run
+            // check for the whole window the commit is in flight. UNIQUE, so the
+            // park never lands on — and never removes — a path that was already
+            // there: a sibling somebody named that way, or the residue of a run
+            // that crashed mid-delete (which stays, invisible, for a person to
+            // clear; a delete must never destroy anything but the plugin it names).
+            // FIXED LENGTH: the plugin's own name is not part of it, so a name near
+            // the filesystem's component limit parks as well as a short one.
+            const parkedDir = path.join(path.dirname(folderDir), `.deleting-${randomUUID()}`);
             await fs.rename(folderDir, parkedDir);
             try {
                 // Inline and `systemAuthorized`, for `provision`'s reasons in
@@ -215,44 +342,104 @@ export class PluginProvisionService {
             this.events?.emit({ kind: 'fs-tree-changed', workspaceId: wsId, branch: DEFAULT_BRANCH });
         });
     }
-    /** The taken name (in its on-disk casing) colliding with `name`, or null. */
-    async existingFolder(name) {
+    /**
+     * Whether `segments` names a directory below `root` with every component
+     * spelled exactly as on disk — by listing each level, which is the one
+     * question a case-insensitive filesystem answers honestly.
+     */
+    async exactFolderExists(root, segments) {
+        let dir = root;
+        let rel = PLUGINS_DIR;
+        for (const segment of segments) {
+            const entries = await listDirOrIncomplete(this.disk, dir, rel);
+            if (!entries?.some((e) => e.isDirectory() && e.name === segment))
+                return false;
+            dir = path.join(dir, segment);
+            rel = `${rel}/${segment}`;
+        }
+        return true;
+    }
+    /**
+     * The taken name (in its on-disk casing) colliding with `name` in `parent`
+     * (`''` = the plugins root), or null.
+     */
+    async existingFolder(name, parent = '') {
         const wsId = await this.readyWorkspaceId();
         const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-        let children;
-        try {
-            children = await fs.readdir(path.join(wsDir, this.kbDirName, PLUGINS_DIR));
-        }
-        catch {
-            return null; // no Plugins/ root yet — nothing can collide
-        }
+        const rel = parent ? `${PLUGINS_DIR}/${parent}` : PLUGINS_DIR;
+        // No Plugins/ root yet — nothing can collide.
+        const children = await listDirOrIncomplete(this.disk, path.join(wsDir, this.kbDirName, rel), rel);
+        if (!children)
+            return null;
         const lower = name.toLowerCase();
-        return children.find((c) => c.toLowerCase() === lower) ?? null;
+        return children.find((c) => c.name.toLowerCase() === lower)?.name ?? null;
     }
-    /** An existing PLUGIN FOLDER whose derived manifest name equals `name`'s, or null. */
-    async manifestNameTwin(name) {
+    /**
+     * What the plugin at `folder` is ALREADY called, read from its manifest by
+     * the one shared rule — `fallback` only when there is no manifest to read
+     * (a folder mid-creation, a `plugin.json` that is not an object).
+     *
+     * An ensure that found the folder already there answers with the FILE's
+     * answer, never the folder's spelling: the folder is an input to no name,
+     * and an idempotent call whose second answer differed from its first would
+     * be this service telling the caller a plugin had been renamed.
+     */
+    async persistedDisplayName(folder, fallback) {
         const wsId = await this.readyWorkspaceId();
         const wsDir = await this.workspaceService.getWorkspacePath(wsId);
-        let children;
-        try {
-            children = await fs.readdir(path.join(wsDir, this.kbDirName, PLUGINS_DIR), {
-                withFileTypes: true,
-            });
-        }
-        catch {
-            return null; // no Plugins/ root yet — nothing can collide
-        }
+        const manifest = await this.disk.readJsonObject(path.join(wsDir, this.kbDirName, PLUGINS_DIR, ...folder.split('/'), PLUGIN_MANIFEST_FILE));
+        return pluginDisplayNameOf(manifest) || fallback;
+    }
+    /**
+     * The identity discovery gives the plugin at `folder`, or the folder's own
+     * slug when it lists none there. ONE rule for every write provisioning
+     * makes — create, delete — as for the rename: no write over a discovery
+     * with a hole in it, whether or not the hole is where this plugin lives.
+     * An operation that parks and commits against an identity set it could
+     * not fully see is the class of mistake the rule exists to make impossible.
+     */
+    async discoveredIdentity(folder, leaf) {
+        const { plugins, unreadable } = await this.discovered();
+        if (unreadable.length > 0)
+            throw incompleteDiscovery(unreadable);
+        const found = plugins.find((p) => p.folder === folder);
+        // The lock key is the SLUG — what the marketplace publishes and what a
+        // creation of the name locks on — so a bundle declaring "Sales Team"
+        // and a creation of `sales-team` take one lock. Not listed and nothing
+        // unreadable: no manifest, no bundle — the folder is its own identity.
+        return pluginManifestName(found ? found.name : leaf);
+    }
+    /** One discovery over the knowledge base checkout. */
+    async discovered() {
+        const wsId = await this.readyWorkspaceId();
+        const wsDir = await this.workspaceService.getWorkspacePath(wsId);
+        return this.source.discover(path.join(wsDir, this.kbDirName));
+    }
+    /**
+     * An existing plugin — at ANY depth, in either file shape — whose identity
+     * folds to the same slug as `name`'s, as its repo-relative folder; or null.
+     * Discovery's answer, so creation and every catalog agree on what is taken:
+     * a nested plugin claims its identity as fully as a top-level one, and a
+     * parked delete (dot-prefixed, invisible to the walk) claims nothing.
+     * Personal folders count — they publish a plugin.json like any plugin
+     * (though the reservation above means a named plugin never reaches this
+     * check with a personal slug). A loose file at the root is not a plugin.
+     *
+     * Refuses on a HOLE: a listing that could not see part of the tree cannot
+     * prove a name free.
+     */
+    async manifestNameTwin(name) {
+        const { plugins, unreadable } = await this.discovered();
+        if (unreadable.length > 0)
+            throw incompleteDiscovery(unreadable);
         const slug = pluginManifestName(name);
-        // Only what actually publishes a manifest claims a slug: a DIRECTORY
-        // that is not dot-prefixed (a parked delete — invisible to every
-        // scanner). Personal folders count — they publish a plugin.json like
-        // any plugin (though the reservation above means a named plugin can
-        // never reach this check with a personal slug). A loose file at the
-        // root (`Plugins/slack.tool`) is not a plugin and must not 409 a
-        // legitimate "Slack Tool".
-        return (children.find((c) => c.isDirectory() && !c.name.startsWith('.') && pluginManifestName(c.name) === slug)?.name ?? null);
+        return plugins.find((p) => pluginManifestName(p.name) === slug)?.folder ?? null;
     }
-    async provision(user, folder, accessMd) {
+    /**
+     * Seed `Plugins/<folder>/` — `folder` being the path below the root, `leaf`
+     * its last segment, which names the manifest — and commit it.
+     */
+    async provision(user, folder, leaf, accessMd) {
         const wsId = await this.readyWorkspaceId();
         const folderPath = `${this.kbDirName}/${PLUGINS_DIR}/${folder}`;
         const wsRelPath = `${folderPath}/access.md`;
@@ -274,7 +461,14 @@ export class PluginProvisionService {
             // this app, so it lands in the same commit as the access rules — and
             // INSIDE the rollback scope: a manifest write that fails must clean up
             // the access.md it would otherwise strand as a half-made plugin.
-            await this.workspaceService.writeFile(wsId, `${folderPath}/${PLUGIN_MANIFEST_FILE}`, renderPluginManifest(folder));
+            //
+            // `leaf` is the name its creator typed, trimmed — the folder's last
+            // segment and, as the renderer's `displayName`, what people will see it
+            // called, persisted whether or not it equals the identifier the name
+            // folds to. Every door into here (the dialog's route, the
+            // `create_plugin` tool, the personal-folder ensure) arrives through
+            // this one write, so no two of them can derive a different name.
+            await this.workspaceService.writeFile(wsId, `${folderPath}/${PLUGIN_MANIFEST_FILE}`, renderPluginManifest(leaf));
             // Inline, not enqueued: the gate reads rules at HEAD, so the folder is
             // only real once this commit lands. `runPendingCommit` is the same
             // commit+push (with pull-rebase recovery) the queue worker runs.
@@ -321,17 +515,68 @@ export class PluginProvisionService {
  * (body read/write/owner name the creator). The `read: []` placeholder makes
  * the body parse as rules from the first byte, so every later splice targets
  * the body rather than the frontmatter.
+ *
+ * The comments are part of the template on purpose. The file is what an
+ * administrator opens to widen a plugin, and the two blocks look alike: a
+ * person who finds `everyone` already under the top `read:` and adds nothing
+ * concludes that "everyone" does nothing. Each block says what it governs,
+ * and the body says how to admit people, right where they would type it.
+ * `spliceGrant` preserves comments, so every later edit keeps them.
  */
 export function pluginAccessMd(creator) {
-    return withCreatorGrants('---\nread:\n  - everyone\n---\nread: []\n', creator);
+    return withCreatorGrants([
+        '---',
+        '# THIS BLOCK (the frontmatter) governs this access.md FILE only: who may',
+        '# see it and who may change it. `read: everyone` here means every signed-in',
+        '# person can see that the plugin exists and ask to join. It admits nobody.',
+        'read:',
+        '  - everyone',
+        '---',
+        '# THIS BLOCK (the body) governs the PLUGIN FOLDER — its skills, tools and',
+        '# manifest. To admit people, add them under `read:` (use it) or `write:`',
+        '# (change it): a role from roles.yaml, a group from groups.yaml, or a person',
+        '# as `Name <email>`. `everyone` under `read:` HERE opens the plugin to all',
+        '# signed-in users. Keep this block pure YAML; explanations go in `#` lines.',
+        'read: []',
+        '',
+    ].join('\n'), creator);
 }
 /**
- * A personal folder's access.md: PRIVATE — no frontmatter grant, so the
- * folder is invisible to everyone but its owner; the body names the owner
- * under read, write and owner.
+ * A personal folder's access.md: PRIVATE, in both blocks. The body DENIES
+ * `everyone` read outright, so a `read: everyone` an administrator later
+ * adds at the repo root (the usual way to open the knowledge base up) cannot
+ * open every person's private space with it, and names the owner directly,
+ * which outranks the denial. The frontmatter says the same of the FILE — so
+ * the folder's listing is invisible to everyone but the owner, and so the
+ * file states its own privacy where a reader (and the Library's "Private"
+ * mark, see `isPrivateAccessMd`) looks for it, rather than leaving it to
+ * what an empty block happens to inherit. Nobody else is named — not even
+ * Admin: a private space is private from the people who run the deployment
+ * too. (An administrator can still write this file, through the resolver's
+ * access.md rescue, and so grant themselves in; that is a visible act in
+ * the history, not a default.)
+ *
+ * The frontmatter is also what marks the file as body-governed. Without it
+ * the splicer (and the resolver) read the older single-block format, where
+ * the frontmatter IS the folder's rules.
  */
 export function personalAccessMd(creator) {
-    return withCreatorGrants('read: []\n', creator);
+    const seeded = withCreatorGrants([
+        '---',
+        '# THIS BLOCK (the frontmatter) governs this access.md FILE only. Only the',
+        '# owner is named: a personal space is not listed for anyone else.',
+        'read:',
+        '  - deny everyone',
+        '---',
+        '# THIS BLOCK (the body) governs the FOLDER — one person\'s private space.',
+        '# `deny everyone` keeps it closed even when the repository root grants',
+        '# `read: everyone`; only the owner is named — not even Admin reads it.',
+        '# To share it, add a person as `Name <email>` or a role under `read:`.',
+        'read:',
+        '  - deny everyone',
+        '',
+    ].join('\n'), creator);
+    return spliceGrant(seeded, 'read', creatorPrincipal(creator), { allowScalar: false, target: 'node' }).text;
 }
 function withCreatorGrants(base, creator) {
     const principal = creatorPrincipal(creator);

package/dist/modules/plugins/plugin-provision.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-provision.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-provision.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoBnD,mEAAmE;AACnE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGlC;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IAYd;IACA;IACA;IACA;IACA;IAfnB;;;;;;;OAOG;IACc,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;IAElD,YACmB,gBAAkC,EAClC,OAA8B,EAC9B,aAA6B,EAC7B,SAAiB,EACjB,MAAgG;QAJhG,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,YAAO,GAAP,OAAO,CAAuB;QAC9B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAA0F;IAChH,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,IAAc,EAAE,OAAe;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,EAClF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChE,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,IAAI,oBAAoB,CAC5B,IAAI,IAAI,sCAAsC,kBAAkB,CAAC,IAAI,CAAC,MAAM;gBAC1E,QAAQ,sBAAsB,kEAAkE,EAClG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,QAAQ,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAoB,CAC5B,IAAI,IAAI,8BAA8B,QAAQ,kCAAkC;oBAC9E,IAAI,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAc;QACvC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC3E,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACpC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACpC,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAc,EAAE,OAAe;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACjD,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAE7E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAC9C,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,WAAW,CAAC,CAAC;YAE7D,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,kCAAkC;YAC5F,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,8DAA8D;gBAC9D,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,oEAAoE;gBACpE,qDAAqD;gBACrD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjC,IAAI,EACJ,cAAc,EACd,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,IAAI,EAAE,EAC1C,IAAI,EACJ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,iFAAiF;gBACnF,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;IACjE,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAyD,CAAC;QAC9D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;gBACzE,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,2BAA2B;QAC3B,OAAO,CACL,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CACzF,EAAE,IAAI,IAAI,IAAI,CAChB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,MAAc,EAAE,QAAgB;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,GAAG,UAAU,YAAY,CAAC;QAC5C,IAAI,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,+BAA+B;YAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA2B,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChD,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,MAAM,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,IAAI,EACJ,GAAG,UAAU,IAAI,oBAAoB,EAAE,EACvC,oBAAoB,CAAC,MAAM,CAAC,CAC7B,CAAC;YACF,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE;gBAC1E,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC5E,OAAO,EAAE,CAAC,EAAE,CAAC;IACf,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwC;IACrE,OAAO,iBAAiB,CAAC,2CAA2C,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwC;IACvE,OAAO,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAwC;IAC/E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACvD,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"plugin-provision.service.js","sourceRoot":"","sources":["../../../src/modules/plugins/plugin-provision.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EACL,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,gBAAgB,GAEjB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAanD;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAc,EACd,GAAW,EACX,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,gDAAgD;QAChD,MAAM,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAS,mBAAmB,CAAC,UAAoB;IAC/C,OAAO,IAAI,oBAAoB,CAC7B,iDAAiD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,qFAAqF,EAC3J,GAAG,CACJ,CAAC;AACJ,CAAC;AAqBD,mEAAmE;AACnE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAGlC;IAFX,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,0GAA0G;AAC1G,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,WAAmB,EAAE,OAAgB;IACtF,MAAM,IAAI,GAAG,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,iBAAiB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,OAAO,sBAAsB;IAYd;IACA;IACA;IACA;IACA;IAEA;IACA;IAlBnB;;;;;;;OAOG;IACc,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;IAElD,YACmB,gBAAkC,EAClC,OAA8B,EAC9B,aAA6B,EAC7B,SAAiB,EACjB,MAA2G;IAC5H,qFAAqF;IACpE,MAAoB,EACpB,IAAc;QAPd,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,YAAO,GAAP,OAAO,CAAuB;QAC9B,kBAAa,GAAb,aAAa,CAAgB;QAC7B,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAqG;QAE3G,WAAM,GAAN,MAAM,CAAc;QACpB,SAAI,GAAJ,IAAI,CAAU;IAC9B,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,IAAc,EAAE,OAAe,EAAE,SAAkB;QACpE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,4CAA4C;QAC5C,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,oBAAoB,CAC5B,kFAAkF,EAClF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YAChE,oEAAoE;YACpE,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,IAAI,oBAAoB,CAC5B,IAAI,IAAI,sCAAsC,kBAAkB,CAAC,IAAI,CAAC,MAAM;gBAC1E,QAAQ,sBAAsB,kEAAkE,EAClG,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnD,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,QAAQ,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACtF,CAAC;YACD,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,oBAAoB,CAC5B,IAAI,IAAI,8BAA8B,QAAQ,kCAAkC;oBAC9E,IAAI,kBAAkB,CAAC,IAAI,CAAC,gCAAgC,EAC9D,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACnD,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,OAAO,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,aAAa,CAAC,SAA6B;QACvD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,oBAAoB,CAAC,IAAI,SAAS,sDAAsD,EAAE,GAAG,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;QAC1C,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,oBAAoB,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,SAAS,WAAW,WAAW,IAAI,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,wEAAwE;QACxE,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,oBAAoB,CAC5B,IAAI,SAAS,6BAA6B,MAAM,yCAAyC,EACzF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAc;QACvC,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACnH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,kEAAkE;gBAClE,kEAAkE;gBAClE,IAAI,GAAG,YAAY,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC9D,OAAO,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;gBACjH,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAc,EAAE,SAAiB;QAClD,0EAA0E;QAC1E,sEAAsE;QACtE,iEAAiE;QACjE,wEAAwE;QACxE,sDAAsD;QACtD,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,mBAAmB;QACnB,MAAM,IAAI,GAAG,SAAS,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,mBAAmB,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,CAAC;QACrD,yEAAyE;QACzE,2EAA2E;QAC3E,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;QACzG,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE;YACzD,sEAAsE;YACtE,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,6CAA6C;YAC7C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YAED,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC,CAAC;YAClF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,8DAA8D;gBAC9D,iEAAiE;gBACjE,gEAAgE;gBAChE,gEAAgE;gBAChE,oEAAoE;gBACpE,qDAAqD;gBACrD,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjC,IAAI,EACJ,cAAc,EACd,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,IAAI,EAAE,EAC1C,IAAI,EACJ,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAC3B,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,mEAAmE;gBACnE,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,iFAAiF;gBACnF,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAkB;QAC9D,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,IAAI,GAAG,GAAG,WAAW,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/E,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9B,GAAG,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,MAAM,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9D,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,QAAgB;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC,CAC1F,CAAC;QACF,OAAO,mBAAmB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC3D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvD,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,sDAAsD;IAC9C,KAAK,CAAC,UAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,SAAS,CAAC,IAAc,EAAE,MAAc,EAAE,IAAY,EAAE,QAAgB;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,GAAG,UAAU,YAAY,CAAC;QAC5C,IAAI,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,+BAA+B;YAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA2B,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChD,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,MAAM,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,qEAAqE;YACrE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,oEAAoE;YACpE,wEAAwE;YACxE,qEAAqE;YACrE,0DAA0D;YAC1D,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CACnC,IAAI,EACJ,GAAG,UAAU,IAAI,oBAAoB,EAAE,EACvC,oBAAoB,CAAC,IAAI,CAAC,CAC3B,CAAC;YACF,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,EAAE;gBAC1E,gBAAgB,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACjE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;gBACxE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,sFAAsF;YACxF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC5E,OAAO,EAAE,CAAC,EAAE,CAAC;IACf,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwC;IACrE,OAAO,iBAAiB,CACtB;QACE,KAAK;QACL,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,OAAO;QACP,cAAc;QACd,KAAK;QACL,2EAA2E;QAC3E,0EAA0E;QAC1E,8EAA8E;QAC9E,4EAA4E;QAC5E,6EAA6E;QAC7E,UAAU;QACV,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwC;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAC9B;QACE,KAAK;QACL,2EAA2E;QAC3E,mEAAmE;QACnE,OAAO;QACP,mBAAmB;QACnB,KAAK;QACL,2EAA2E;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,OAAO;QACP,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,OAAO,CACR,CAAC;IACF,OAAO,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7G,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAAwC;IAC/E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACvD,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}