@estifanos-sh/convex-auth 0.0.2 → 0.0.3

package/dist/component/connection/scim/identity.js

@@ -3,6 +3,7 @@ import { vGroupConnectionScimIdentityDoc, vPaginated, vScimResourceType } from "
 import schema_default from "../../schema.js";
 import { mutation, query } from "../../_generated/server.js";
 import "../../functions.js";
+import { revokeSessionState } from "../../session.js";
 import { ConvexError, v } from "convex/values";
 import { paginationOptsValidator } from "convex/server";
 import { paginator } from "convex-helpers/server/pagination";
@@ -18,6 +19,7 @@ import { paginator } from "convex-helpers/server/pagination";
 * @module
 */
 const vScimUserData = v.object(schema_default.tables.User.validator.fields);
+const vProfileUpdate = v.union(v.literal("never"), v.literal("missing"), v.literal("always"));
 /**
 * Read SCIM identities, overloaded by the args supplied. With
 * `{ connectionId, userIds }` it batch-resolves and returns an array aligned to
@@ -62,43 +64,29 @@ const list = query({
 		return await paginator(ctx.db, schema_default).query("GroupConnectionScimIdentity").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).paginate(paginationOpts);
 	}
 });
-/** Insert a SCIM identity, or patch it when it already exists (keyed by `(connectionId, resourceType, externalId)`). */
-const upsert = mutation({
-	args: {
-		connectionId: v.id("GroupConnection"),
-		groupId: v.id("Group"),
-		resourceType: vScimResourceType,
-		externalId: v.string(),
-		userId: v.optional(v.id("User")),
-		mappedGroupId: v.optional(v.id("Group")),
-		lastProvisionedAt: v.optional(v.number()),
-		active: v.optional(v.boolean()),
-		raw: v.optional(v.any())
-	},
-	returns: v.id("GroupConnectionScimIdentity"),
-	handler: async (ctx, args) => {
-		const existing = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
-		if (existing) {
-			await ctx.db.patch("GroupConnectionScimIdentity", existing._id, args);
-			return existing._id;
-		}
-		return await ctx.db.insert("GroupConnectionScimIdentity", args);
-	}
-});
+function providerForConnection(connection) {
+	if (connection.protocol === "oidc") return `oidc:${connection._id}`;
+	if (connection.protocol === "saml") return `saml:${connection._id}`;
+	throw new ConvexError({
+		code: ErrorCode.PROVIDER_NOT_CONFIGURED,
+		message: "SCIM requires an OIDC or SAML connection."
+	});
+}
+function patchProfile(current, next, mode) {
+	if (mode === "never") return {};
+	return Object.fromEntries(Object.entries(next).filter(([key, value]) => value === void 0 ? false : mode === "always" || current[key] === void 0 || current[key] === null || current[key] === ""));
+}
 /**
-* Atomically provision or resolve a SCIM user by both of its durable natural
-* keys: the connection-scoped SCIM external id and the provider Account id.
-* A concurrent retry cannot commit a losing User because the identity and
-* Account index reads participate in the same OCC transaction as the inserts.
-* Existing ownership is preserved; conflicting owners are rejected.
+* Atomically provision a directory-managed user, account, SCIM identity, and
+* membership. Group and provider ownership are derived from the connection.
 */
 const provision = mutation({
 	args: {
 		connectionId: v.id("GroupConnection"),
-		groupId: v.id("Group"),
-		externalId: v.string(),
-		provider: v.string(),
+		externalId: v.optional(v.string()),
 		userData: vScimUserData,
+		profileUpdate: vProfileUpdate,
+		roleIds: v.array(v.string()),
 		lastProvisionedAt: v.optional(v.number()),
 		active: v.optional(v.boolean()),
 		raw: v.optional(v.any())
@@ -108,56 +96,369 @@ const provision = mutation({
 		created: v.boolean()
 	}),
 	handler: async (ctx, args) => {
-		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", args.externalId)).unique();
-		const account = await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", args.provider).eq("providerAccountId", args.externalId)).unique();
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const provider = providerForConnection(connection);
+		const externalId = args.externalId;
+		const identity = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", externalId)).unique();
+		const account = externalId === void 0 ? null : await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique();
 		if (identity?.userId !== void 0 && account !== null && identity.userId !== account.userId) throw new ConvexError({
 			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
-			message: "The SCIM identity and provider account belong to different users."
+			message: "SCIM account ownership conflicts."
 		});
 		let userId = identity?.userId ?? account?.userId;
 		let created = false;
-		if (userId !== void 0) {
-			if (await ctx.db.get("User", userId) === null) throw new ConvexError({
-				code: ErrorCode.ACCOUNT_NOT_FOUND,
-				message: "The SCIM identity references a user that no longer exists."
-			});
-		} else {
+		if (userId === void 0) {
 			userId = await ctx.db.insert("User", args.userData);
 			created = true;
+		} else {
+			const user = await ctx.db.get("User", userId);
+			if (user === null) throw new ConvexError({
+				code: ErrorCode.ACCOUNT_NOT_FOUND,
+				message: "SCIM user not found."
+			});
+			if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+				code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+				message: "User is managed by another SCIM connection."
+			});
+			const patch = patchProfile(user, args.userData, args.profileUpdate);
+			if (Object.keys(patch).length > 0) await ctx.db.patch("User", userId, patch);
 		}
-		if (account === null) await ctx.db.insert("Account", {
+		if (externalId !== void 0 && account === null) await ctx.db.insert("Account", {
 			userId,
-			provider: args.provider,
-			providerAccountId: args.externalId
+			provider,
+			providerAccountId: externalId
 		});
 		const identityData = {
 			connectionId: args.connectionId,
-			groupId: args.groupId,
+			groupId: connection.groupId,
 			resourceType: "user",
-			externalId: args.externalId,
-			userId
+			...externalId === void 0 ? {} : { externalId },
+			userId,
+			active: args.active !== false,
+			...args.lastProvisionedAt === void 0 ? {} : { lastProvisionedAt: args.lastProvisionedAt },
+			...args.raw === void 0 ? {} : { raw: args.raw }
 		};
-		if (args.lastProvisionedAt !== void 0) identityData.lastProvisionedAt = args.lastProvisionedAt;
-		if (args.active !== void 0) identityData.active = args.active;
-		if (args.raw !== void 0) identityData.raw = args.raw;
 		if (identity === null) await ctx.db.insert("GroupConnectionScimIdentity", identityData);
-		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		else {
+			if (identity.groupId !== connection.groupId) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "SCIM identity group mismatch."
+			});
+			await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		}
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", userId)).unique();
+		const membershipPatch = {
+			roleIds: args.roleIds,
+			status: args.active === false ? "inactive" : "active"
+		};
+		if (membership === null) await ctx.db.insert("GroupMember", {
+			groupId: connection.groupId,
+			userId,
+			...membershipPatch
+		});
+		else await ctx.db.patch("GroupMember", membership._id, membershipPatch);
+		return {
+			userId,
+			created
+		};
+	}
+});
+/** Atomically update a directory-managed user and its connection membership. */
+const update = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		userId: v.id("User"),
+		externalId: v.optional(v.string()),
+		userData: vScimUserData,
+		profileUpdate: vProfileUpdate,
+		roleIds: v.array(v.string()),
+		active: v.boolean(),
+		lastProvisionedAt: v.optional(v.number()),
+		raw: v.optional(v.any())
+	},
+	returns: v.null(),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const externalId = args.externalId;
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", args.connectionId).eq("userId", args.userId)).unique();
+		if (identity === null || identity.resourceType !== "user" || identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM user not found."
+		});
+		if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", args.userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "User is managed by another SCIM connection."
+		});
+		const conflicting = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "user").eq("externalId", externalId)).unique();
+		if (conflicting !== null && conflicting._id !== identity._id) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "SCIM external id is already linked."
+		});
+		const user = await ctx.db.get("User", args.userId);
+		if (user === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "User not found."
+		});
+		const provider = providerForConnection(connection);
+		const currentExternalId = identity.externalId;
+		const [currentAccount, nextAccount] = await Promise.all([currentExternalId === void 0 ? Promise.resolve(null) : ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", currentExternalId)).unique(), externalId === void 0 || currentExternalId === externalId ? Promise.resolve(null) : ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique()]);
+		if (nextAccount !== null && nextAccount.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The replacement SCIM external id is already linked."
+		});
+		if (currentAccount !== null && currentAccount.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The SCIM account belongs to another user."
+		});
+		const patch = patchProfile(user, args.userData, args.profileUpdate);
+		if (Object.keys(patch).length > 0) await ctx.db.patch("User", args.userId, patch);
+		if (currentExternalId === externalId) {
+			if (externalId !== void 0 && currentAccount === null) await ctx.db.insert("Account", {
+				userId: args.userId,
+				provider,
+				providerAccountId: externalId
+			});
+		} else if (currentAccount !== null) if (externalId === void 0) await ctx.db.delete("Account", currentAccount._id);
+		else if (nextAccount === null) await ctx.db.patch("Account", currentAccount._id, { providerAccountId: externalId });
+		else await ctx.db.delete("Account", currentAccount._id);
+		else if (externalId !== void 0 && nextAccount === null) await ctx.db.insert("Account", {
+			userId: args.userId,
+			provider,
+			providerAccountId: externalId
+		});
+		await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			externalId,
+			active: args.active,
+			lastProvisionedAt: args.lastProvisionedAt,
+			raw: args.raw
+		});
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", args.userId)).unique();
+		const membershipPatch = {
+			roleIds: args.roleIds,
+			status: args.active ? "active" : "inactive"
+		};
+		if (membership === null) await ctx.db.insert("GroupMember", {
+			groupId: connection.groupId,
+			userId: args.userId,
+			...membershipPatch
+		});
+		else await ctx.db.patch("GroupMember", membership._id, membershipPatch);
+		return null;
+	}
+});
+/** Atomically revoke a directory-managed user's membership, sessions, and identity. */
+const revoke = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		userId: v.id("User"),
+		mode: v.union(v.literal("soft"), v.literal("hard"))
+	},
+	returns: v.object({
+		epoch: v.number(),
+		cleanedSessions: v.number(),
+		cleanupPending: v.boolean()
+	}),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", args.connectionId).eq("userId", args.userId)).unique();
+		if (identity === null || identity.resourceType !== "user" || identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM user not found."
+		});
+		if (await ctx.db.query("GroupConnectionScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", args.userId)).filter((query$1) => query$1.neq(query$1.field("connectionId"), args.connectionId)).first() !== null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "User is managed by another SCIM connection."
+		});
+		const provider = providerForConnection(connection);
+		const externalId = identity.externalId;
+		const account = externalId === void 0 ? null : await ctx.db.query("Account").withIndex("provider_account_id", (idx) => idx.eq("provider", provider).eq("providerAccountId", externalId)).unique();
+		if (account !== null && account.userId !== args.userId) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_ALREADY_LINKED,
+			message: "The SCIM account belongs to another user."
+		});
+		const membership = await ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", args.userId)).unique();
+		if (membership !== null) await ctx.db.delete("GroupMember", membership._id);
+		if (account !== null) await ctx.db.delete("Account", account._id);
+		const { epoch, cleanedSessions, cleanupPending } = await revokeSessionState(ctx, args.userId);
+		if (args.mode === "hard") await ctx.db.delete("GroupConnectionScimIdentity", identity._id);
+		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			active: false,
+			lastProvisionedAt: Date.now()
+		});
 		return {
+			epoch,
+			cleanedSessions,
+			cleanupPending
+		};
+	}
+});
+async function activeScimConnection(ctx, connectionId) {
+	const connection = await ctx.db.get("GroupConnection", connectionId);
+	const scim = connection === null ? null : await ctx.db.query("GroupConnectionScimConfig").withIndex("group_connection_id", (idx) => idx.eq("connectionId", connectionId)).unique();
+	if (connection === null || connection.status !== "active" || scim === null || scim.status !== "active" || scim.groupId !== connection.groupId) throw new ConvexError({
+		code: ErrorCode.INVALID_PARAMETERS,
+		message: "SCIM connection is not active."
+	});
+	return connection;
+}
+async function assertScimMembers(ctx, connection, userIds) {
+	for (const userId of new Set(userIds)) {
+		const [user, identity, membership] = await Promise.all([
+			ctx.db.get("User", userId),
+			ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_user_id", (idx) => idx.eq("connectionId", connection._id).eq("userId", userId)).first(),
+			ctx.db.query("GroupMember").withIndex("group_id_user_id", (idx) => idx.eq("groupId", connection.groupId).eq("userId", userId)).first()
+		]);
+		if (user === null || identity === null && membership === null) throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "A SCIM group member is not available through this connection."
+		});
+	}
+}
+async function replaceScimGroupMembers(ctx, groupId, memberIds, roleIds) {
+	const current = await ctx.db.query("GroupMember").withIndex("group_id", (idx) => idx.eq("groupId", groupId)).collect();
+	const wanted = new Set(memberIds);
+	for (const member of current) if (!wanted.has(member.userId)) await ctx.db.delete("GroupMember", member._id);
+	for (const userId of wanted) {
+		const member = current.find((candidate) => candidate.userId === userId);
+		const patch = {
+			roleIds,
+			status: "active"
+		};
+		if (member === void 0) await ctx.db.insert("GroupMember", {
+			groupId,
 			userId,
+			...patch
+		});
+		else await ctx.db.patch("GroupMember", member._id, patch);
+	}
+}
+/** Atomically provision a SCIM group, its identity, and its complete membership. */
+const provisionGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		externalId: v.optional(v.string()),
+		name: v.string(),
+		memberIds: v.array(v.id("User")),
+		roleIds: v.array(v.string()),
+		raw: v.optional(v.any())
+	},
+	returns: v.object({
+		groupId: v.id("Group"),
+		created: v.boolean()
+	}),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const externalId = args.externalId;
+		await assertScimMembers(ctx, connection, args.memberIds);
+		const identity = externalId === void 0 ? null : await ctx.db.query("GroupConnectionScimIdentity").withIndex("group_connection_id_resource_type_external_id", (idx) => idx.eq("connectionId", args.connectionId).eq("resourceType", "group").eq("externalId", externalId)).unique();
+		if (identity !== null && identity.groupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM identity group mismatch."
+		});
+		let groupId = identity?.mappedGroupId;
+		let created = false;
+		if (groupId === void 0) {
+			const parent = await ctx.db.get("Group", connection.groupId);
+			if (parent === null) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "Connection group not found."
+			});
+			groupId = await ctx.db.insert("Group", {
+				name: args.name,
+				type: "organization",
+				parentGroupId: connection.groupId,
+				rootGroupId: parent.rootGroupId ?? parent._id,
+				isRoot: false
+			});
+			created = true;
+		} else {
+			const group = await ctx.db.get("Group", groupId);
+			if (group === null || group.parentGroupId !== connection.groupId) throw new ConvexError({
+				code: ErrorCode.INVALID_PARAMETERS,
+				message: "SCIM group ownership mismatch."
+			});
+			await ctx.db.patch("Group", groupId, { name: args.name });
+		}
+		const identityData = {
+			connectionId: args.connectionId,
+			groupId: connection.groupId,
+			resourceType: "group",
+			...externalId === void 0 ? {} : { externalId },
+			mappedGroupId: groupId,
+			active: true,
+			lastProvisionedAt: Date.now(),
+			...args.raw === void 0 ? {} : { raw: args.raw }
+		};
+		if (identity === null) await ctx.db.insert("GroupConnectionScimIdentity", identityData);
+		else await ctx.db.patch("GroupConnectionScimIdentity", identity._id, identityData);
+		await replaceScimGroupMembers(ctx, groupId, args.memberIds, args.roleIds);
+		return {
+			groupId,
 			created
 		};
 	}
 });
-/** Delete a SCIM identity by id. */
-const remove = mutation({
-	args: { id: v.id("GroupConnectionScimIdentity") },
+/** Atomically update a SCIM group and replace its complete membership. */
+const updateGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group"),
+		name: v.optional(v.string()),
+		memberIds: v.array(v.id("User")),
+		roleIds: v.array(v.string()),
+		raw: v.optional(v.any())
+	},
 	returns: v.null(),
-	handler: async (ctx, { id: identityId }) => {
-		await ctx.db.delete("GroupConnectionScimIdentity", identityId);
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", args.groupId)).unique();
+		if (identity === null || identity.connectionId !== args.connectionId || identity.groupId !== connection.groupId || identity.resourceType !== "group") throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM group not found."
+		});
+		const group = await ctx.db.get("Group", args.groupId);
+		if (group === null || group.parentGroupId !== connection.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM group ownership mismatch."
+		});
+		await assertScimMembers(ctx, connection, args.memberIds);
+		if (args.name !== void 0) await ctx.db.patch("Group", args.groupId, { name: args.name });
+		await ctx.db.patch("GroupConnectionScimIdentity", identity._id, {
+			active: true,
+			lastProvisionedAt: Date.now(),
+			...args.raw === void 0 ? {} : { raw: args.raw }
+		});
+		await replaceScimGroupMembers(ctx, args.groupId, args.memberIds, args.roleIds);
+		return null;
+	}
+});
+/** Atomically revoke a SCIM group and its identity after verifying connection ownership. */
+const revokeGroup = mutation({
+	args: {
+		connectionId: v.id("GroupConnection"),
+		groupId: v.id("Group")
+	},
+	returns: v.null(),
+	handler: async (ctx, args) => {
+		const connection = await activeScimConnection(ctx, args.connectionId);
+		const identity = await ctx.db.query("GroupConnectionScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", args.groupId)).unique();
+		if (identity === null || identity.connectionId !== args.connectionId || identity.groupId !== connection.groupId || identity.resourceType !== "group") throw new ConvexError({
+			code: ErrorCode.ACCOUNT_NOT_FOUND,
+			message: "SCIM group not found."
+		});
+		const group = await ctx.db.get("Group", args.groupId);
+		if (group === null || group.parentGroupId !== identity.groupId) throw new ConvexError({
+			code: ErrorCode.INVALID_PARAMETERS,
+			message: "SCIM group ownership mismatch."
+		});
+		const members = await ctx.db.query("GroupMember").withIndex("group_id", (idx) => idx.eq("groupId", args.groupId)).collect();
+		for (const member of members) await ctx.db.delete("GroupMember", member._id);
+		await ctx.db.delete("GroupConnectionScimIdentity", identity._id);
+		await ctx.db.delete("Group", args.groupId);
 		return null;
 	}
 });
 
 //#endregion
-export { get, list, provision, remove, upsert };
+export { get, list, provision, provisionGroup, revoke, revokeGroup, update, updateGroup };
 //# sourceMappingURL=identity.js.map

package/dist/component/connection/scim/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","names":["schema"],"sources":["../../../../src/component/connection/scim/identity.ts"],"sourcesContent":["/**\n * `component.connection.scim.identity.*` — SCIM-provisioned\n * identities for an Connection connection (sub-resource of connection).\n *\n * `get` is overloaded — single lookup or, with `{ connectionId,\n * userIds }`, a batched resolve aligned to input order.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, type Infer, v } from \"convex/values\";\nimport { paginator } from \"convex-helpers/server/pagination\";\n\nimport { ErrorCode } from \"../../../shared/codes\";\nimport { mutation, query } from \"../../functions\";\nimport { vGroupConnectionScimIdentityDoc, vPaginated, vScimResourceType } from \"../../model\";\nimport schema from \"../../schema\";\n\nconst vScimUserData = v.object(schema.tables.User.validator.fields);\n\ntype ScimUserIdentity = Pick<\n  Infer<typeof vGroupConnectionScimIdentityDoc>,\n  \"connectionId\" | \"groupId\" | \"externalId\" | \"lastProvisionedAt\" | \"active\" | \"raw\"\n> & {\n  resourceType: \"user\";\n  userId: NonNullable<Infer<typeof vGroupConnectionScimIdentityDoc>[\"userId\"]>;\n};\n\n/**\n * Read SCIM identities, overloaded by the args supplied. With\n * `{ connectionId, userIds }` it batch-resolves and returns an array aligned to\n * the input order (`null` per missing user). Otherwise it resolves a single\n * identity by `(connectionId, resourceType, externalId)`, `(connectionId,\n * userId)`, `userId`, or `mappedGroupId`. Returns `null` when nothing matches.\n */\nexport const get = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    resourceType: v.optional(vScimResourceType),\n    externalId: v.optional(v.string()),\n    userId: v.optional(v.id(\"User\")),\n    userIds: v.optional(v.array(v.id(\"User\"))),\n    mappedGroupId: v.optional(v.id(\"Group\")),\n  },\n  returns: v.union(\n    vGroupConnectionScimIdentityDoc,\n    v.null(),\n    v.array(v.union(vGroupConnectionScimIdentityDoc, v.null())),\n  ),\n  handler: async (ctx, args) => {\n    if (args.connectionId !== undefined && args.userIds !== undefined) {\n      const userIds = args.userIds;\n      if (userIds.length === 0) return [];\n      const unique = Array.from(new Set(userIds));\n      const docs = await Promise.all(\n        unique.map((userId) =>\n          ctx.db\n            .query(\"GroupConnectionScimIdentity\")\n            .withIndex(\"group_connection_id_user_id\", (idx) =>\n              idx.eq(\"connectionId\", args.connectionId!).eq(\"userId\", userId),\n            )\n            .first(),\n        ),\n      );\n      const byUserId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));\n      return userIds.map((userId) => byUserId.get(userId) ?? null);\n    }\n    if (\n      args.connectionId !== undefined &&\n      args.resourceType !== undefined &&\n      args.externalId !== undefined\n    ) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n          idx\n            .eq(\"connectionId\", args.connectionId!)\n            .eq(\"resourceType\", args.resourceType!)\n            .eq(\"externalId\", args.externalId!),\n        )\n        .first();\n    }\n    if (args.connectionId !== undefined && args.userId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"group_connection_id_user_id\", (idx) =>\n          idx.eq(\"connectionId\", args.connectionId!).eq(\"userId\", args.userId!),\n        )\n        .first();\n    }\n    if (args.userId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", args.userId!))\n        .first();\n    }\n    if (args.mappedGroupId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"mapped_group_id\", (idx) => idx.eq(\"mappedGroupId\", args.mappedGroupId!))\n        .first();\n    }\n    return null;\n  },\n});\n\n/** List a connection's SCIM identities, paginated. */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vGroupConnectionScimIdentityDoc),\n  handler: async (ctx, { connectionId, paginationOpts }) => {\n    return await paginator(ctx.db, schema)\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .paginate(paginationOpts);\n  },\n});\n\n/** Insert a SCIM identity, or patch it when it already exists (keyed by `(connectionId, resourceType, externalId)`). */\nexport const upsert = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    resourceType: vScimResourceType,\n    externalId: v.string(),\n    userId: v.optional(v.id(\"User\")),\n    mappedGroupId: v.optional(v.id(\"Group\")),\n    lastProvisionedAt: v.optional(v.number()),\n    active: v.optional(v.boolean()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.id(\"GroupConnectionScimIdentity\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n        idx\n          .eq(\"connectionId\", args.connectionId)\n          .eq(\"resourceType\", args.resourceType)\n          .eq(\"externalId\", args.externalId),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.patch(\"GroupConnectionScimIdentity\", existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"GroupConnectionScimIdentity\", args);\n  },\n});\n\n/**\n * Atomically provision or resolve a SCIM user by both of its durable natural\n * keys: the connection-scoped SCIM external id and the provider Account id.\n * A concurrent retry cannot commit a losing User because the identity and\n * Account index reads participate in the same OCC transaction as the inserts.\n * Existing ownership is preserved; conflicting owners are rejected.\n */\nexport const provision = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    externalId: v.string(),\n    provider: v.string(),\n    userData: vScimUserData,\n    lastProvisionedAt: v.optional(v.number()),\n    active: v.optional(v.boolean()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.object({\n    userId: v.id(\"User\"),\n    created: v.boolean(),\n  }),\n  handler: async (ctx, args) => {\n    const identity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n        idx\n          .eq(\"connectionId\", args.connectionId)\n          .eq(\"resourceType\", \"user\")\n          .eq(\"externalId\", args.externalId),\n      )\n      .unique();\n    const account = await ctx.db\n      .query(\"Account\")\n      .withIndex(\"provider_account_id\", (idx) =>\n        idx.eq(\"provider\", args.provider).eq(\"providerAccountId\", args.externalId),\n      )\n      .unique();\n\n    if (identity?.userId !== undefined && account !== null && identity.userId !== account.userId) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"The SCIM identity and provider account belong to different users.\",\n      });\n    }\n\n    const existingUserId = identity?.userId ?? account?.userId;\n    let userId = existingUserId;\n    let created = false;\n    if (userId !== undefined) {\n      const user = await ctx.db.get(\"User\", userId);\n      if (user === null) {\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_NOT_FOUND,\n          message: \"The SCIM identity references a user that no longer exists.\",\n        });\n      }\n    } else {\n      userId = await ctx.db.insert(\"User\", args.userData);\n      created = true;\n    }\n\n    if (account === null) {\n      await ctx.db.insert(\"Account\", {\n        userId,\n        provider: args.provider,\n        providerAccountId: args.externalId,\n      });\n    }\n\n    const identityData: ScimUserIdentity = {\n      connectionId: args.connectionId,\n      groupId: args.groupId,\n      resourceType: \"user\" as const,\n      externalId: args.externalId,\n      userId,\n    };\n    if (args.lastProvisionedAt !== undefined) {\n      identityData.lastProvisionedAt = args.lastProvisionedAt;\n    }\n    if (args.active !== undefined) identityData.active = args.active;\n    if (args.raw !== undefined) identityData.raw = args.raw;\n    if (identity === null) {\n      await ctx.db.insert(\"GroupConnectionScimIdentity\", identityData);\n    } else {\n      await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, identityData);\n    }\n\n    return { userId, created };\n  },\n});\n\n/** Delete a SCIM identity by id. */\nconst remove = mutation({\n  args: { id: v.id(\"GroupConnectionScimIdentity\") },\n  returns: v.null(),\n  handler: async (ctx, { id: identityId }) => {\n    await ctx.db.delete(\"GroupConnectionScimIdentity\", identityId);\n    return null;\n  },\n});\n\nexport { remove };\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmBA,MAAM,gBAAgB,EAAE,OAAOA,eAAO,OAAO,KAAK,UAAU,OAAO;;;;;;;;AAiBnE,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,cAAc,EAAE,SAAS,kBAAkB;EAC3C,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EAC1C,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACzC;CACD,SAAS,EAAE,MACT,iCACA,EAAE,MAAM,EACR,EAAE,MAAM,EAAE,MAAM,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAC5D;CACD,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,iBAAiB,UAAa,KAAK,YAAY,QAAW;GACjE,MAAM,UAAU,KAAK;AACrB,OAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;GACnC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;GAC3C,MAAM,OAAO,MAAM,QAAQ,IACzB,OAAO,KAAK,WACV,IAAI,GACD,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,GAAG,UAAU,OAAO,CAChE,CACA,OAAO,CACX,CACF;GACD,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AACtE,UAAO,QAAQ,KAAK,WAAW,SAAS,IAAI,OAAO,IAAI,KAAK;;AAE9D,MACE,KAAK,iBAAiB,UACtB,KAAK,iBAAiB,UACtB,KAAK,eAAe,OAEpB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAc,CACtC,GAAG,gBAAgB,KAAK,aAAc,CACtC,GAAG,cAAc,KAAK,WAAY,CACtC,CACA,OAAO;AAEZ,MAAI,KAAK,iBAAiB,UAAa,KAAK,WAAW,OACrD,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,GAAG,UAAU,KAAK,OAAQ,CACtE,CACA,OAAO;AAEZ,MAAI,KAAK,WAAW,OAClB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAQ,CAAC,CAC7D,OAAO;AAEZ,MAAI,KAAK,kBAAkB,OACzB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,oBAAoB,QAAQ,IAAI,GAAG,iBAAiB,KAAK,cAAe,CAAC,CACnF,OAAO;AAEZ,SAAO;;CAEV,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,gBAAgB;EACjB;CACD,SAAS,WAAW,gCAAgC;CACpD,SAAS,OAAO,KAAK,EAAE,cAAc,qBAAqB;AACxD,SAAO,MAAM,UAAU,IAAI,IAAIA,eAAO,CACnC,MAAM,8BAA8B,CACpC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CAC/E,SAAS,eAAe;;CAE9B,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,cAAc;EACd,YAAY,EAAE,QAAQ;EACtB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACxC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,GAAG,8BAA8B;CAC5C,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,cAAc,KAAK,WAAW,CACrC,CACA,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK,KAAK;AACrE,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,+BAA+B,KAAK;;CAElE,CAAC;;;;;;;;AASF,MAAa,YAAY,SAAS;CAChC,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,YAAY,EAAE,QAAQ;EACtB,UAAU,EAAE,QAAQ;EACpB,UAAU;EACV,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,OAAO;EAChB,QAAQ,EAAE,GAAG,OAAO;EACpB,SAAS,EAAE,SAAS;EACrB,CAAC;CACF,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,OAAO,CAC1B,GAAG,cAAc,KAAK,WAAW,CACrC,CACA,QAAQ;EACX,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,UAAU,CAChB,UAAU,wBAAwB,QACjC,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,GAAG,qBAAqB,KAAK,WAAW,CAC3E,CACA,QAAQ;AAEX,MAAI,UAAU,WAAW,UAAa,YAAY,QAAQ,SAAS,WAAW,QAAQ,OACpF,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAIJ,IAAI,SADmB,UAAU,UAAU,SAAS;EAEpD,IAAI,UAAU;AACd,MAAI,WAAW,QAEb;OADa,MAAM,IAAI,GAAG,IAAI,QAAQ,OAAO,KAChC,KACX,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;SAEC;AACL,YAAS,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,SAAS;AACnD,aAAU;;AAGZ,MAAI,YAAY,KACd,OAAM,IAAI,GAAG,OAAO,WAAW;GAC7B;GACA,UAAU,KAAK;GACf,mBAAmB,KAAK;GACzB,CAAC;EAGJ,MAAM,eAAiC;GACrC,cAAc,KAAK;GACnB,SAAS,KAAK;GACd,cAAc;GACd,YAAY,KAAK;GACjB;GACD;AACD,MAAI,KAAK,sBAAsB,OAC7B,cAAa,oBAAoB,KAAK;AAExC,MAAI,KAAK,WAAW,OAAW,cAAa,SAAS,KAAK;AAC1D,MAAI,KAAK,QAAQ,OAAW,cAAa,MAAM,KAAK;AACpD,MAAI,aAAa,KACf,OAAM,IAAI,GAAG,OAAO,+BAA+B,aAAa;MAEhE,OAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK,aAAa;AAG/E,SAAO;GAAE;GAAQ;GAAS;;CAE7B,CAAC;;AAGF,MAAM,SAAS,SAAS;CACtB,MAAM,EAAE,IAAI,EAAE,GAAG,8BAA8B,EAAE;CACjD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,IAAI,iBAAiB;AAC1C,QAAM,IAAI,GAAG,OAAO,+BAA+B,WAAW;AAC9D,SAAO;;CAEV,CAAC"}
+{"version":3,"file":"identity.js","names":["schema","query"],"sources":["../../../../src/component/connection/scim/identity.ts"],"sourcesContent":["/**\n * `component.connection.scim.identity.*` — SCIM-provisioned\n * identities for an Connection connection (sub-resource of connection).\n *\n * `get` is overloaded — single lookup or, with `{ connectionId,\n * userIds }`, a batched resolve aligned to input order.\n *\n * @module\n */\n\nimport { paginationOptsValidator } from \"convex/server\";\nimport { ConvexError, type Infer, v } from \"convex/values\";\nimport { paginator } from \"convex-helpers/server/pagination\";\n\nimport { ErrorCode } from \"../../../shared/codes\";\nimport type { Id } from \"../../_generated/dataModel\";\nimport type { MutationCtx } from \"../../_generated/server\";\nimport { mutation, query } from \"../../functions\";\nimport { vGroupConnectionScimIdentityDoc, vPaginated, vScimResourceType } from \"../../model\";\nimport schema from \"../../schema\";\nimport { revokeSessionState } from \"../../session\";\n\nconst vScimUserData = v.object(schema.tables.User.validator.fields);\nconst vProfileUpdate = v.union(v.literal(\"never\"), v.literal(\"missing\"), v.literal(\"always\"));\n\ntype ScimUserData = Infer<typeof vScimUserData>;\ntype ProfileUpdate = Infer<typeof vProfileUpdate>;\n\ntype ScimUserIdentity = Pick<\n  Infer<typeof vGroupConnectionScimIdentityDoc>,\n  \"connectionId\" | \"groupId\" | \"externalId\" | \"lastProvisionedAt\" | \"active\" | \"raw\"\n> & {\n  resourceType: \"user\";\n  userId: NonNullable<Infer<typeof vGroupConnectionScimIdentityDoc>[\"userId\"]>;\n};\n\n/**\n * Read SCIM identities, overloaded by the args supplied. With\n * `{ connectionId, userIds }` it batch-resolves and returns an array aligned to\n * the input order (`null` per missing user). Otherwise it resolves a single\n * identity by `(connectionId, resourceType, externalId)`, `(connectionId,\n * userId)`, `userId`, or `mappedGroupId`. Returns `null` when nothing matches.\n */\nexport const get = query({\n  args: {\n    connectionId: v.optional(v.id(\"GroupConnection\")),\n    resourceType: v.optional(vScimResourceType),\n    externalId: v.optional(v.string()),\n    userId: v.optional(v.id(\"User\")),\n    userIds: v.optional(v.array(v.id(\"User\"))),\n    mappedGroupId: v.optional(v.id(\"Group\")),\n  },\n  returns: v.union(\n    vGroupConnectionScimIdentityDoc,\n    v.null(),\n    v.array(v.union(vGroupConnectionScimIdentityDoc, v.null())),\n  ),\n  handler: async (ctx, args) => {\n    if (args.connectionId !== undefined && args.userIds !== undefined) {\n      const userIds = args.userIds;\n      if (userIds.length === 0) return [];\n      const unique = Array.from(new Set(userIds));\n      const docs = await Promise.all(\n        unique.map((userId) =>\n          ctx.db\n            .query(\"GroupConnectionScimIdentity\")\n            .withIndex(\"group_connection_id_user_id\", (idx) =>\n              idx.eq(\"connectionId\", args.connectionId!).eq(\"userId\", userId),\n            )\n            .first(),\n        ),\n      );\n      const byUserId = new Map(unique.map((id, i) => [id, docs[i] ?? null]));\n      return userIds.map((userId) => byUserId.get(userId) ?? null);\n    }\n    if (\n      args.connectionId !== undefined &&\n      args.resourceType !== undefined &&\n      args.externalId !== undefined\n    ) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n          idx\n            .eq(\"connectionId\", args.connectionId!)\n            .eq(\"resourceType\", args.resourceType!)\n            .eq(\"externalId\", args.externalId!),\n        )\n        .first();\n    }\n    if (args.connectionId !== undefined && args.userId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"group_connection_id_user_id\", (idx) =>\n          idx.eq(\"connectionId\", args.connectionId!).eq(\"userId\", args.userId!),\n        )\n        .first();\n    }\n    if (args.userId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", args.userId!))\n        .first();\n    }\n    if (args.mappedGroupId !== undefined) {\n      return await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"mapped_group_id\", (idx) => idx.eq(\"mappedGroupId\", args.mappedGroupId!))\n        .first();\n    }\n    return null;\n  },\n});\n\n/** List a connection's SCIM identities, paginated. */\nexport const list = query({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    paginationOpts: paginationOptsValidator,\n  },\n  returns: vPaginated(vGroupConnectionScimIdentityDoc),\n  handler: async (ctx, { connectionId, paginationOpts }) => {\n    return await paginator(ctx.db, schema)\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n      .paginate(paginationOpts);\n  },\n});\n\nfunction providerForConnection(connection: { _id: string; protocol: string }) {\n  if (connection.protocol === \"oidc\") return `oidc:${connection._id}`;\n  if (connection.protocol === \"saml\") return `saml:${connection._id}`;\n  throw new ConvexError({\n    code: ErrorCode.PROVIDER_NOT_CONFIGURED,\n    message: \"SCIM requires an OIDC or SAML connection.\",\n  });\n}\n\nfunction patchProfile(current: Record<string, unknown>, next: ScimUserData, mode: ProfileUpdate) {\n  if (mode === \"never\") return {};\n  return Object.fromEntries(\n    Object.entries(next).filter(([key, value]) =>\n      value === undefined\n        ? false\n        : mode === \"always\" ||\n          current[key] === undefined ||\n          current[key] === null ||\n          current[key] === \"\",\n    ),\n  );\n}\n\n/**\n * Atomically provision a directory-managed user, account, SCIM identity, and\n * membership. Group and provider ownership are derived from the connection.\n */\nexport const provision = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    externalId: v.optional(v.string()),\n    userData: vScimUserData,\n    profileUpdate: vProfileUpdate,\n    roleIds: v.array(v.string()),\n    lastProvisionedAt: v.optional(v.number()),\n    active: v.optional(v.boolean()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.object({ userId: v.id(\"User\"), created: v.boolean() }),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const provider = providerForConnection(connection);\n    const externalId = args.externalId;\n    const identity =\n      externalId === undefined\n        ? null\n        : await ctx.db\n            .query(\"GroupConnectionScimIdentity\")\n            .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n              idx\n                .eq(\"connectionId\", args.connectionId)\n                .eq(\"resourceType\", \"user\")\n                .eq(\"externalId\", externalId),\n            )\n            .unique();\n    const account =\n      externalId === undefined\n        ? null\n        : await ctx.db\n            .query(\"Account\")\n            .withIndex(\"provider_account_id\", (idx) =>\n              idx.eq(\"provider\", provider).eq(\"providerAccountId\", externalId),\n            )\n            .unique();\n    if (identity?.userId !== undefined && account !== null && identity.userId !== account.userId) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"SCIM account ownership conflicts.\",\n      });\n    }\n    let userId = identity?.userId ?? account?.userId;\n    let created = false;\n    if (userId === undefined) {\n      userId = await ctx.db.insert(\"User\", args.userData);\n      created = true;\n    } else {\n      const user = await ctx.db.get(\"User\", userId);\n      if (user === null)\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_NOT_FOUND,\n          message: \"SCIM user not found.\",\n        });\n      const conflictingIdentity = await ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", userId))\n        .filter((query) => query.neq(query.field(\"connectionId\"), args.connectionId))\n        .first();\n      if (conflictingIdentity !== null) {\n        throw new ConvexError({\n          code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n          message: \"User is managed by another SCIM connection.\",\n        });\n      }\n      const patch = patchProfile(\n        user as Record<string, unknown>,\n        args.userData,\n        args.profileUpdate,\n      );\n      if (Object.keys(patch).length > 0) await ctx.db.patch(\"User\", userId, patch);\n    }\n    if (externalId !== undefined && account === null)\n      await ctx.db.insert(\"Account\", { userId, provider, providerAccountId: externalId });\n    const identityData: ScimUserIdentity = {\n      connectionId: args.connectionId,\n      groupId: connection.groupId,\n      resourceType: \"user\",\n      ...(externalId === undefined ? {} : { externalId }),\n      userId,\n      active: args.active !== false,\n      ...(args.lastProvisionedAt === undefined\n        ? {}\n        : { lastProvisionedAt: args.lastProvisionedAt }),\n      ...(args.raw === undefined ? {} : { raw: args.raw }),\n    };\n    if (identity === null) await ctx.db.insert(\"GroupConnectionScimIdentity\", identityData);\n    else {\n      if (identity.groupId !== connection.groupId)\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"SCIM identity group mismatch.\",\n        });\n      await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, identityData);\n    }\n    const membership = await ctx.db\n      .query(\"GroupMember\")\n      .withIndex(\"group_id_user_id\", (idx) =>\n        idx.eq(\"groupId\", connection.groupId).eq(\"userId\", userId),\n      )\n      .unique();\n    const membershipPatch = {\n      roleIds: args.roleIds,\n      status: args.active === false ? \"inactive\" : \"active\",\n    };\n    if (membership === null)\n      await ctx.db.insert(\"GroupMember\", {\n        groupId: connection.groupId,\n        userId,\n        ...membershipPatch,\n      });\n    else await ctx.db.patch(\"GroupMember\", membership._id, membershipPatch);\n    return { userId, created };\n  },\n});\n\n/** Atomically update a directory-managed user and its connection membership. */\nexport const update = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    userId: v.id(\"User\"),\n    externalId: v.optional(v.string()),\n    userData: vScimUserData,\n    profileUpdate: vProfileUpdate,\n    roleIds: v.array(v.string()),\n    active: v.boolean(),\n    lastProvisionedAt: v.optional(v.number()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const externalId = args.externalId;\n    const identity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id_user_id\", (idx) =>\n        idx.eq(\"connectionId\", args.connectionId).eq(\"userId\", args.userId),\n      )\n      .unique();\n    if (\n      identity === null ||\n      identity.resourceType !== \"user\" ||\n      identity.groupId !== connection.groupId\n    )\n      throw new ConvexError({ code: ErrorCode.ACCOUNT_NOT_FOUND, message: \"SCIM user not found.\" });\n    const conflictingIdentity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", args.userId))\n      .filter((query) => query.neq(query.field(\"connectionId\"), args.connectionId))\n      .first();\n    if (conflictingIdentity !== null) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"User is managed by another SCIM connection.\",\n      });\n    }\n    const conflicting =\n      externalId === undefined\n        ? null\n        : await ctx.db\n            .query(\"GroupConnectionScimIdentity\")\n            .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n              idx\n                .eq(\"connectionId\", args.connectionId)\n                .eq(\"resourceType\", \"user\")\n                .eq(\"externalId\", externalId),\n            )\n            .unique();\n    if (conflicting !== null && conflicting._id !== identity._id)\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"SCIM external id is already linked.\",\n      });\n    const user = await ctx.db.get(\"User\", args.userId);\n    if (user === null)\n      throw new ConvexError({ code: ErrorCode.ACCOUNT_NOT_FOUND, message: \"User not found.\" });\n    const provider = providerForConnection(connection);\n    const currentExternalId = identity.externalId;\n    const [currentAccount, nextAccount] = await Promise.all([\n      currentExternalId === undefined\n        ? Promise.resolve(null)\n        : ctx.db\n            .query(\"Account\")\n            .withIndex(\"provider_account_id\", (idx) =>\n              idx.eq(\"provider\", provider).eq(\"providerAccountId\", currentExternalId),\n            )\n            .unique(),\n      externalId === undefined || currentExternalId === externalId\n        ? Promise.resolve(null)\n        : ctx.db\n            .query(\"Account\")\n            .withIndex(\"provider_account_id\", (idx) =>\n              idx.eq(\"provider\", provider).eq(\"providerAccountId\", externalId),\n            )\n            .unique(),\n    ]);\n    if (nextAccount !== null && nextAccount.userId !== args.userId) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"The replacement SCIM external id is already linked.\",\n      });\n    }\n    if (currentAccount !== null && currentAccount.userId !== args.userId) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"The SCIM account belongs to another user.\",\n      });\n    }\n    const patch = patchProfile(user as Record<string, unknown>, args.userData, args.profileUpdate);\n    if (Object.keys(patch).length > 0) await ctx.db.patch(\"User\", args.userId, patch);\n    if (currentExternalId === externalId) {\n      if (externalId !== undefined && currentAccount === null) {\n        await ctx.db.insert(\"Account\", {\n          userId: args.userId,\n          provider,\n          providerAccountId: externalId,\n        });\n      }\n    } else if (currentAccount !== null) {\n      if (externalId === undefined) {\n        await ctx.db.delete(\"Account\", currentAccount._id);\n      } else if (nextAccount === null) {\n        await ctx.db.patch(\"Account\", currentAccount._id, { providerAccountId: externalId });\n      } else {\n        await ctx.db.delete(\"Account\", currentAccount._id);\n      }\n    } else if (externalId !== undefined && nextAccount === null) {\n      await ctx.db.insert(\"Account\", {\n        userId: args.userId,\n        provider,\n        providerAccountId: externalId,\n      });\n    }\n    await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, {\n      externalId,\n      active: args.active,\n      lastProvisionedAt: args.lastProvisionedAt,\n      raw: args.raw,\n    });\n    const membership = await ctx.db\n      .query(\"GroupMember\")\n      .withIndex(\"group_id_user_id\", (idx) =>\n        idx.eq(\"groupId\", connection.groupId).eq(\"userId\", args.userId),\n      )\n      .unique();\n    const membershipPatch = { roleIds: args.roleIds, status: args.active ? \"active\" : \"inactive\" };\n    if (membership === null)\n      await ctx.db.insert(\"GroupMember\", {\n        groupId: connection.groupId,\n        userId: args.userId,\n        ...membershipPatch,\n      });\n    else await ctx.db.patch(\"GroupMember\", membership._id, membershipPatch);\n    return null;\n  },\n});\n\n/** Atomically revoke a directory-managed user's membership, sessions, and identity. */\nexport const revoke = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    userId: v.id(\"User\"),\n    mode: v.union(v.literal(\"soft\"), v.literal(\"hard\")),\n  },\n  returns: v.object({\n    epoch: v.number(),\n    cleanedSessions: v.number(),\n    cleanupPending: v.boolean(),\n  }),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const identity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"group_connection_id_user_id\", (idx) =>\n        idx.eq(\"connectionId\", args.connectionId).eq(\"userId\", args.userId),\n      )\n      .unique();\n    if (\n      identity === null ||\n      identity.resourceType !== \"user\" ||\n      identity.groupId !== connection.groupId\n    )\n      throw new ConvexError({ code: ErrorCode.ACCOUNT_NOT_FOUND, message: \"SCIM user not found.\" });\n    const conflictingIdentity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", args.userId))\n      .filter((query) => query.neq(query.field(\"connectionId\"), args.connectionId))\n      .first();\n    if (conflictingIdentity !== null) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"User is managed by another SCIM connection.\",\n      });\n    }\n    const provider = providerForConnection(connection);\n    const externalId = identity.externalId;\n    const account =\n      externalId === undefined\n        ? null\n        : await ctx.db\n            .query(\"Account\")\n            .withIndex(\"provider_account_id\", (idx) =>\n              idx.eq(\"provider\", provider).eq(\"providerAccountId\", externalId),\n            )\n            .unique();\n    if (account !== null && account.userId !== args.userId) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_ALREADY_LINKED,\n        message: \"The SCIM account belongs to another user.\",\n      });\n    }\n    const membership = await ctx.db\n      .query(\"GroupMember\")\n      .withIndex(\"group_id_user_id\", (idx) =>\n        idx.eq(\"groupId\", connection.groupId).eq(\"userId\", args.userId),\n      )\n      .unique();\n    if (membership !== null) await ctx.db.delete(\"GroupMember\", membership._id);\n    if (account !== null) await ctx.db.delete(\"Account\", account._id);\n    const { epoch, cleanedSessions, cleanupPending } = await revokeSessionState(ctx, args.userId);\n    if (args.mode === \"hard\") await ctx.db.delete(\"GroupConnectionScimIdentity\", identity._id);\n    else\n      await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, {\n        active: false,\n        lastProvisionedAt: Date.now(),\n      });\n    return { epoch, cleanedSessions, cleanupPending };\n  },\n});\n\nasync function activeScimConnection(ctx: MutationCtx, connectionId: Id<\"GroupConnection\">) {\n  const connection = await ctx.db.get(\"GroupConnection\", connectionId);\n  const scim =\n    connection === null\n      ? null\n      : await ctx.db\n          .query(\"GroupConnectionScimConfig\")\n          .withIndex(\"group_connection_id\", (idx) => idx.eq(\"connectionId\", connectionId))\n          .unique();\n  if (\n    connection === null ||\n    connection.status !== \"active\" ||\n    scim === null ||\n    scim.status !== \"active\" ||\n    scim.groupId !== connection.groupId\n  ) {\n    throw new ConvexError({\n      code: ErrorCode.INVALID_PARAMETERS,\n      message: \"SCIM connection is not active.\",\n    });\n  }\n  return connection;\n}\n\nasync function assertScimMembers(\n  ctx: MutationCtx,\n  connection: { _id: Id<\"GroupConnection\">; groupId: Id<\"Group\"> },\n  userIds: Array<Id<\"User\">>,\n) {\n  for (const userId of new Set(userIds)) {\n    const [user, identity, membership] = await Promise.all([\n      ctx.db.get(\"User\", userId),\n      ctx.db\n        .query(\"GroupConnectionScimIdentity\")\n        .withIndex(\"group_connection_id_user_id\", (idx) =>\n          idx.eq(\"connectionId\", connection._id).eq(\"userId\", userId),\n        )\n        .first(),\n      ctx.db\n        .query(\"GroupMember\")\n        .withIndex(\"group_id_user_id\", (idx) =>\n          idx.eq(\"groupId\", connection.groupId).eq(\"userId\", userId),\n        )\n        .first(),\n    ]);\n    if (user === null || (identity === null && membership === null)) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"A SCIM group member is not available through this connection.\",\n      });\n    }\n  }\n}\n\nasync function replaceScimGroupMembers(\n  ctx: MutationCtx,\n  groupId: Id<\"Group\">,\n  memberIds: Array<Id<\"User\">>,\n  roleIds: Array<string>,\n) {\n  const current = await ctx.db\n    .query(\"GroupMember\")\n    .withIndex(\"group_id\", (idx) => idx.eq(\"groupId\", groupId))\n    .collect();\n  const wanted = new Set(memberIds);\n  for (const member of current) {\n    if (!wanted.has(member.userId)) await ctx.db.delete(\"GroupMember\", member._id);\n  }\n  for (const userId of wanted) {\n    const member = current.find((candidate) => candidate.userId === userId);\n    const patch = { roleIds, status: \"active\" as const };\n    if (member === undefined) await ctx.db.insert(\"GroupMember\", { groupId, userId, ...patch });\n    else await ctx.db.patch(\"GroupMember\", member._id, patch);\n  }\n}\n\n/** Atomically provision a SCIM group, its identity, and its complete membership. */\nexport const provisionGroup = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    externalId: v.optional(v.string()),\n    name: v.string(),\n    memberIds: v.array(v.id(\"User\")),\n    roleIds: v.array(v.string()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.object({ groupId: v.id(\"Group\"), created: v.boolean() }),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const externalId = args.externalId;\n    await assertScimMembers(ctx, connection, args.memberIds);\n    const identity =\n      externalId === undefined\n        ? null\n        : await ctx.db\n            .query(\"GroupConnectionScimIdentity\")\n            .withIndex(\"group_connection_id_resource_type_external_id\", (idx) =>\n              idx\n                .eq(\"connectionId\", args.connectionId)\n                .eq(\"resourceType\", \"group\")\n                .eq(\"externalId\", externalId),\n            )\n            .unique();\n    if (identity !== null && identity.groupId !== connection.groupId) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: \"SCIM identity group mismatch.\",\n      });\n    }\n    let groupId = identity?.mappedGroupId;\n    let created = false;\n    if (groupId === undefined) {\n      const parent = await ctx.db.get(\"Group\", connection.groupId);\n      if (parent === null)\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"Connection group not found.\",\n        });\n      groupId = await ctx.db.insert(\"Group\", {\n        name: args.name,\n        type: \"organization\",\n        parentGroupId: connection.groupId,\n        rootGroupId: parent.rootGroupId ?? parent._id,\n        isRoot: false,\n      });\n      created = true;\n    } else {\n      const group = await ctx.db.get(\"Group\", groupId);\n      if (group === null || group.parentGroupId !== connection.groupId) {\n        throw new ConvexError({\n          code: ErrorCode.INVALID_PARAMETERS,\n          message: \"SCIM group ownership mismatch.\",\n        });\n      }\n      await ctx.db.patch(\"Group\", groupId, { name: args.name });\n    }\n    const identityData = {\n      connectionId: args.connectionId,\n      groupId: connection.groupId,\n      resourceType: \"group\" as const,\n      ...(externalId === undefined ? {} : { externalId }),\n      mappedGroupId: groupId,\n      active: true,\n      lastProvisionedAt: Date.now(),\n      ...(args.raw === undefined ? {} : { raw: args.raw }),\n    };\n    if (identity === null) await ctx.db.insert(\"GroupConnectionScimIdentity\", identityData);\n    else await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, identityData);\n    await replaceScimGroupMembers(ctx, groupId, args.memberIds, args.roleIds);\n    return { groupId, created };\n  },\n});\n\n/** Atomically update a SCIM group and replace its complete membership. */\nexport const updateGroup = mutation({\n  args: {\n    connectionId: v.id(\"GroupConnection\"),\n    groupId: v.id(\"Group\"),\n    name: v.optional(v.string()),\n    memberIds: v.array(v.id(\"User\")),\n    roleIds: v.array(v.string()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const identity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"mapped_group_id\", (idx) => idx.eq(\"mappedGroupId\", args.groupId))\n      .unique();\n    if (\n      identity === null ||\n      identity.connectionId !== args.connectionId ||\n      identity.groupId !== connection.groupId ||\n      identity.resourceType !== \"group\"\n    ) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"SCIM group not found.\",\n      });\n    }\n    const group = await ctx.db.get(\"Group\", args.groupId);\n    if (group === null || group.parentGroupId !== connection.groupId) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: \"SCIM group ownership mismatch.\",\n      });\n    }\n    await assertScimMembers(ctx, connection, args.memberIds);\n    if (args.name !== undefined) await ctx.db.patch(\"Group\", args.groupId, { name: args.name });\n    await ctx.db.patch(\"GroupConnectionScimIdentity\", identity._id, {\n      active: true,\n      lastProvisionedAt: Date.now(),\n      ...(args.raw === undefined ? {} : { raw: args.raw }),\n    });\n    await replaceScimGroupMembers(ctx, args.groupId, args.memberIds, args.roleIds);\n    return null;\n  },\n});\n\n/** Atomically revoke a SCIM group and its identity after verifying connection ownership. */\nexport const revokeGroup = mutation({\n  args: { connectionId: v.id(\"GroupConnection\"), groupId: v.id(\"Group\") },\n  returns: v.null(),\n  handler: async (ctx, args) => {\n    const connection = await activeScimConnection(ctx, args.connectionId);\n    const identity = await ctx.db\n      .query(\"GroupConnectionScimIdentity\")\n      .withIndex(\"mapped_group_id\", (idx) => idx.eq(\"mappedGroupId\", args.groupId))\n      .unique();\n    if (\n      identity === null ||\n      identity.connectionId !== args.connectionId ||\n      identity.groupId !== connection.groupId ||\n      identity.resourceType !== \"group\"\n    ) {\n      throw new ConvexError({\n        code: ErrorCode.ACCOUNT_NOT_FOUND,\n        message: \"SCIM group not found.\",\n      });\n    }\n    const group = await ctx.db.get(\"Group\", args.groupId);\n    if (group === null || group.parentGroupId !== identity.groupId) {\n      throw new ConvexError({\n        code: ErrorCode.INVALID_PARAMETERS,\n        message: \"SCIM group ownership mismatch.\",\n      });\n    }\n    const members = await ctx.db\n      .query(\"GroupMember\")\n      .withIndex(\"group_id\", (idx) => idx.eq(\"groupId\", args.groupId))\n      .collect();\n    for (const member of members) await ctx.db.delete(\"GroupMember\", member._id);\n    await ctx.db.delete(\"GroupConnectionScimIdentity\", identity._id);\n    await ctx.db.delete(\"Group\", args.groupId);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,MAAM,gBAAgB,EAAE,OAAOA,eAAO,OAAO,KAAK,UAAU,OAAO;AACnE,MAAM,iBAAiB,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,EAAE,QAAQ,UAAU,EAAE,EAAE,QAAQ,SAAS,CAAC;;;;;;;;AAoB7F,MAAa,MAAM,MAAM;CACvB,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC;EACjD,cAAc,EAAE,SAAS,kBAAkB;EAC3C,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;EAC1C,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACzC;CACD,SAAS,EAAE,MACT,iCACA,EAAE,MAAM,EACR,EAAE,MAAM,EAAE,MAAM,iCAAiC,EAAE,MAAM,CAAC,CAAC,CAC5D;CACD,SAAS,OAAO,KAAK,SAAS;AAC5B,MAAI,KAAK,iBAAiB,UAAa,KAAK,YAAY,QAAW;GACjE,MAAM,UAAU,KAAK;AACrB,OAAI,QAAQ,WAAW,EAAG,QAAO,EAAE;GACnC,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;GAC3C,MAAM,OAAO,MAAM,QAAQ,IACzB,OAAO,KAAK,WACV,IAAI,GACD,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,GAAG,UAAU,OAAO,CAChE,CACA,OAAO,CACX,CACF;GACD,MAAM,WAAW,IAAI,IAAI,OAAO,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AACtE,UAAO,QAAQ,KAAK,WAAW,SAAS,IAAI,OAAO,IAAI,KAAK;;AAE9D,MACE,KAAK,iBAAiB,UACtB,KAAK,iBAAiB,UACtB,KAAK,eAAe,OAEpB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAc,CACtC,GAAG,gBAAgB,KAAK,aAAc,CACtC,GAAG,cAAc,KAAK,WAAY,CACtC,CACA,OAAO;AAEZ,MAAI,KAAK,iBAAiB,UAAa,KAAK,WAAW,OACrD,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAAC,GAAG,UAAU,KAAK,OAAQ,CACtE,CACA,OAAO;AAEZ,MAAI,KAAK,WAAW,OAClB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAQ,CAAC,CAC7D,OAAO;AAEZ,MAAI,KAAK,kBAAkB,OACzB,QAAO,MAAM,IAAI,GACd,MAAM,8BAA8B,CACpC,UAAU,oBAAoB,QAAQ,IAAI,GAAG,iBAAiB,KAAK,cAAe,CAAC,CACnF,OAAO;AAEZ,SAAO;;CAEV,CAAC;;AAGF,MAAa,OAAO,MAAM;CACxB,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,gBAAgB;EACjB;CACD,SAAS,WAAW,gCAAgC;CACpD,SAAS,OAAO,KAAK,EAAE,cAAc,qBAAqB;AACxD,SAAO,MAAM,UAAU,IAAI,IAAIA,eAAO,CACnC,MAAM,8BAA8B,CACpC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CAC/E,SAAS,eAAe;;CAE9B,CAAC;AAEF,SAAS,sBAAsB,YAA+C;AAC5E,KAAI,WAAW,aAAa,OAAQ,QAAO,QAAQ,WAAW;AAC9D,KAAI,WAAW,aAAa,OAAQ,QAAO,QAAQ,WAAW;AAC9D,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;;AAGJ,SAAS,aAAa,SAAkC,MAAoB,MAAqB;AAC/F,KAAI,SAAS,QAAS,QAAO,EAAE;AAC/B,QAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,QAAQ,CAAC,KAAK,WACjC,UAAU,SACN,QACA,SAAS,YACT,QAAQ,SAAS,UACjB,QAAQ,SAAS,QACjB,QAAQ,SAAS,GACtB,CACF;;;;;;AAOH,MAAa,YAAY,SAAS;CAChC,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,UAAU;EACV,eAAe;EACf,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC5B,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,OAAO;EAAE,QAAQ,EAAE,GAAG,OAAO;EAAE,SAAS,EAAE,SAAS;EAAE,CAAC;CACjE,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,WAAW,sBAAsB,WAAW;EAClD,MAAM,aAAa,KAAK;EACxB,MAAM,WACJ,eAAe,SACX,OACA,MAAM,IAAI,GACP,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,OAAO,CAC1B,GAAG,cAAc,WAAW,CAChC,CACA,QAAQ;EACjB,MAAM,UACJ,eAAe,SACX,OACA,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,wBAAwB,QACjC,IAAI,GAAG,YAAY,SAAS,CAAC,GAAG,qBAAqB,WAAW,CACjE,CACA,QAAQ;AACjB,MAAI,UAAU,WAAW,UAAa,YAAY,QAAQ,SAAS,WAAW,QAAQ,OACpF,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,IAAI,SAAS,UAAU,UAAU,SAAS;EAC1C,IAAI,UAAU;AACd,MAAI,WAAW,QAAW;AACxB,YAAS,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,SAAS;AACnD,aAAU;SACL;GACL,MAAM,OAAO,MAAM,IAAI,GAAG,IAAI,QAAQ,OAAO;AAC7C,OAAI,SAAS,KACX,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAMJ,OAL4B,MAAM,IAAI,GACnC,MAAM,8BAA8B,CACpC,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,OAAO,CAAC,CACvD,QAAQ,YAAUC,QAAM,IAAIA,QAAM,MAAM,eAAe,EAAE,KAAK,aAAa,CAAC,CAC5E,OAAO,KACkB,KAC1B,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;GAEJ,MAAM,QAAQ,aACZ,MACA,KAAK,UACL,KAAK,cACN;AACD,OAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EAAG,OAAM,IAAI,GAAG,MAAM,QAAQ,QAAQ,MAAM;;AAE9E,MAAI,eAAe,UAAa,YAAY,KAC1C,OAAM,IAAI,GAAG,OAAO,WAAW;GAAE;GAAQ;GAAU,mBAAmB;GAAY,CAAC;EACrF,MAAM,eAAiC;GACrC,cAAc,KAAK;GACnB,SAAS,WAAW;GACpB,cAAc;GACd,GAAI,eAAe,SAAY,EAAE,GAAG,EAAE,YAAY;GAClD;GACA,QAAQ,KAAK,WAAW;GACxB,GAAI,KAAK,sBAAsB,SAC3B,EAAE,GACF,EAAE,mBAAmB,KAAK,mBAAmB;GACjD,GAAI,KAAK,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK,KAAK,KAAK;GACpD;AACD,MAAI,aAAa,KAAM,OAAM,IAAI,GAAG,OAAO,+BAA+B,aAAa;OAClF;AACH,OAAI,SAAS,YAAY,WAAW,QAClC,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AACJ,SAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK,aAAa;;EAE/E,MAAM,aAAa,MAAM,IAAI,GAC1B,MAAM,cAAc,CACpB,UAAU,qBAAqB,QAC9B,IAAI,GAAG,WAAW,WAAW,QAAQ,CAAC,GAAG,UAAU,OAAO,CAC3D,CACA,QAAQ;EACX,MAAM,kBAAkB;GACtB,SAAS,KAAK;GACd,QAAQ,KAAK,WAAW,QAAQ,aAAa;GAC9C;AACD,MAAI,eAAe,KACjB,OAAM,IAAI,GAAG,OAAO,eAAe;GACjC,SAAS,WAAW;GACpB;GACA,GAAG;GACJ,CAAC;MACC,OAAM,IAAI,GAAG,MAAM,eAAe,WAAW,KAAK,gBAAgB;AACvE,SAAO;GAAE;GAAQ;GAAS;;CAE7B,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,QAAQ,EAAE,GAAG,OAAO;EACpB,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,UAAU;EACV,eAAe;EACf,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC5B,QAAQ,EAAE,SAAS;EACnB,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,aAAa,KAAK;EACxB,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,GAAG,UAAU,KAAK,OAAO,CACpE,CACA,QAAQ;AACX,MACE,aAAa,QACb,SAAS,iBAAiB,UAC1B,SAAS,YAAY,WAAW,QAEhC,OAAM,IAAI,YAAY;GAAE,MAAM,UAAU;GAAmB,SAAS;GAAwB,CAAC;AAM/F,MAL4B,MAAM,IAAI,GACnC,MAAM,8BAA8B,CACpC,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAC5D,QAAQ,YAAUA,QAAM,IAAIA,QAAM,MAAM,eAAe,EAAE,KAAK,aAAa,CAAC,CAC5E,OAAO,KACkB,KAC1B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,cACJ,eAAe,SACX,OACA,MAAM,IAAI,GACP,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,OAAO,CAC1B,GAAG,cAAc,WAAW,CAChC,CACA,QAAQ;AACjB,MAAI,gBAAgB,QAAQ,YAAY,QAAQ,SAAS,IACvD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EACJ,MAAM,OAAO,MAAM,IAAI,GAAG,IAAI,QAAQ,KAAK,OAAO;AAClD,MAAI,SAAS,KACX,OAAM,IAAI,YAAY;GAAE,MAAM,UAAU;GAAmB,SAAS;GAAmB,CAAC;EAC1F,MAAM,WAAW,sBAAsB,WAAW;EAClD,MAAM,oBAAoB,SAAS;EACnC,MAAM,CAAC,gBAAgB,eAAe,MAAM,QAAQ,IAAI,CACtD,sBAAsB,SAClB,QAAQ,QAAQ,KAAK,GACrB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,wBAAwB,QACjC,IAAI,GAAG,YAAY,SAAS,CAAC,GAAG,qBAAqB,kBAAkB,CACxE,CACA,QAAQ,EACf,eAAe,UAAa,sBAAsB,aAC9C,QAAQ,QAAQ,KAAK,GACrB,IAAI,GACD,MAAM,UAAU,CAChB,UAAU,wBAAwB,QACjC,IAAI,GAAG,YAAY,SAAS,CAAC,GAAG,qBAAqB,WAAW,CACjE,CACA,QAAQ,CAChB,CAAC;AACF,MAAI,gBAAgB,QAAQ,YAAY,WAAW,KAAK,OACtD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,MAAI,mBAAmB,QAAQ,eAAe,WAAW,KAAK,OAC5D,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,QAAQ,aAAa,MAAiC,KAAK,UAAU,KAAK,cAAc;AAC9F,MAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EAAG,OAAM,IAAI,GAAG,MAAM,QAAQ,KAAK,QAAQ,MAAM;AACjF,MAAI,sBAAsB,YACxB;OAAI,eAAe,UAAa,mBAAmB,KACjD,OAAM,IAAI,GAAG,OAAO,WAAW;IAC7B,QAAQ,KAAK;IACb;IACA,mBAAmB;IACpB,CAAC;aAEK,mBAAmB,KAC5B,KAAI,eAAe,OACjB,OAAM,IAAI,GAAG,OAAO,WAAW,eAAe,IAAI;WACzC,gBAAgB,KACzB,OAAM,IAAI,GAAG,MAAM,WAAW,eAAe,KAAK,EAAE,mBAAmB,YAAY,CAAC;MAEpF,OAAM,IAAI,GAAG,OAAO,WAAW,eAAe,IAAI;WAE3C,eAAe,UAAa,gBAAgB,KACrD,OAAM,IAAI,GAAG,OAAO,WAAW;GAC7B,QAAQ,KAAK;GACb;GACA,mBAAmB;GACpB,CAAC;AAEJ,QAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK;GAC9D;GACA,QAAQ,KAAK;GACb,mBAAmB,KAAK;GACxB,KAAK,KAAK;GACX,CAAC;EACF,MAAM,aAAa,MAAM,IAAI,GAC1B,MAAM,cAAc,CACpB,UAAU,qBAAqB,QAC9B,IAAI,GAAG,WAAW,WAAW,QAAQ,CAAC,GAAG,UAAU,KAAK,OAAO,CAChE,CACA,QAAQ;EACX,MAAM,kBAAkB;GAAE,SAAS,KAAK;GAAS,QAAQ,KAAK,SAAS,WAAW;GAAY;AAC9F,MAAI,eAAe,KACjB,OAAM,IAAI,GAAG,OAAO,eAAe;GACjC,SAAS,WAAW;GACpB,QAAQ,KAAK;GACb,GAAG;GACJ,CAAC;MACC,OAAM,IAAI,GAAG,MAAM,eAAe,WAAW,KAAK,gBAAgB;AACvE,SAAO;;CAEV,CAAC;;AAGF,MAAa,SAAS,SAAS;CAC7B,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,QAAQ,EAAE,GAAG,OAAO;EACpB,MAAM,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,EAAE,QAAQ,OAAO,CAAC;EACpD;CACD,SAAS,EAAE,OAAO;EAChB,OAAO,EAAE,QAAQ;EACjB,iBAAiB,EAAE,QAAQ;EAC3B,gBAAgB,EAAE,SAAS;EAC5B,CAAC;CACF,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,GAAG,UAAU,KAAK,OAAO,CACpE,CACA,QAAQ;AACX,MACE,aAAa,QACb,SAAS,iBAAiB,UAC1B,SAAS,YAAY,WAAW,QAEhC,OAAM,IAAI,YAAY;GAAE,MAAM,UAAU;GAAmB,SAAS;GAAwB,CAAC;AAM/F,MAL4B,MAAM,IAAI,GACnC,MAAM,8BAA8B,CACpC,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAC5D,QAAQ,YAAUA,QAAM,IAAIA,QAAM,MAAM,eAAe,EAAE,KAAK,aAAa,CAAC,CAC5E,OAAO,KACkB,KAC1B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,WAAW,sBAAsB,WAAW;EAClD,MAAM,aAAa,SAAS;EAC5B,MAAM,UACJ,eAAe,SACX,OACA,MAAM,IAAI,GACP,MAAM,UAAU,CAChB,UAAU,wBAAwB,QACjC,IAAI,GAAG,YAAY,SAAS,CAAC,GAAG,qBAAqB,WAAW,CACjE,CACA,QAAQ;AACjB,MAAI,YAAY,QAAQ,QAAQ,WAAW,KAAK,OAC9C,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,aAAa,MAAM,IAAI,GAC1B,MAAM,cAAc,CACpB,UAAU,qBAAqB,QAC9B,IAAI,GAAG,WAAW,WAAW,QAAQ,CAAC,GAAG,UAAU,KAAK,OAAO,CAChE,CACA,QAAQ;AACX,MAAI,eAAe,KAAM,OAAM,IAAI,GAAG,OAAO,eAAe,WAAW,IAAI;AAC3E,MAAI,YAAY,KAAM,OAAM,IAAI,GAAG,OAAO,WAAW,QAAQ,IAAI;EACjE,MAAM,EAAE,OAAO,iBAAiB,mBAAmB,MAAM,mBAAmB,KAAK,KAAK,OAAO;AAC7F,MAAI,KAAK,SAAS,OAAQ,OAAM,IAAI,GAAG,OAAO,+BAA+B,SAAS,IAAI;MAExF,OAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK;GAC9D,QAAQ;GACR,mBAAmB,KAAK,KAAK;GAC9B,CAAC;AACJ,SAAO;GAAE;GAAO;GAAiB;GAAgB;;CAEpD,CAAC;AAEF,eAAe,qBAAqB,KAAkB,cAAqC;CACzF,MAAM,aAAa,MAAM,IAAI,GAAG,IAAI,mBAAmB,aAAa;CACpE,MAAM,OACJ,eAAe,OACX,OACA,MAAM,IAAI,GACP,MAAM,4BAA4B,CAClC,UAAU,wBAAwB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CAC/E,QAAQ;AACjB,KACE,eAAe,QACf,WAAW,WAAW,YACtB,SAAS,QACT,KAAK,WAAW,YAChB,KAAK,YAAY,WAAW,QAE5B,OAAM,IAAI,YAAY;EACpB,MAAM,UAAU;EAChB,SAAS;EACV,CAAC;AAEJ,QAAO;;AAGT,eAAe,kBACb,KACA,YACA,SACA;AACA,MAAK,MAAM,UAAU,IAAI,IAAI,QAAQ,EAAE;EACrC,MAAM,CAAC,MAAM,UAAU,cAAc,MAAM,QAAQ,IAAI;GACrD,IAAI,GAAG,IAAI,QAAQ,OAAO;GAC1B,IAAI,GACD,MAAM,8BAA8B,CACpC,UAAU,gCAAgC,QACzC,IAAI,GAAG,gBAAgB,WAAW,IAAI,CAAC,GAAG,UAAU,OAAO,CAC5D,CACA,OAAO;GACV,IAAI,GACD,MAAM,cAAc,CACpB,UAAU,qBAAqB,QAC9B,IAAI,GAAG,WAAW,WAAW,QAAQ,CAAC,GAAG,UAAU,OAAO,CAC3D,CACA,OAAO;GACX,CAAC;AACF,MAAI,SAAS,QAAS,aAAa,QAAQ,eAAe,KACxD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;;;AAKR,eAAe,wBACb,KACA,SACA,WACA,SACA;CACA,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,cAAc,CACpB,UAAU,aAAa,QAAQ,IAAI,GAAG,WAAW,QAAQ,CAAC,CAC1D,SAAS;CACZ,MAAM,SAAS,IAAI,IAAI,UAAU;AACjC,MAAK,MAAM,UAAU,QACnB,KAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAE,OAAM,IAAI,GAAG,OAAO,eAAe,OAAO,IAAI;AAEhF,MAAK,MAAM,UAAU,QAAQ;EAC3B,MAAM,SAAS,QAAQ,MAAM,cAAc,UAAU,WAAW,OAAO;EACvE,MAAM,QAAQ;GAAE;GAAS,QAAQ;GAAmB;AACpD,MAAI,WAAW,OAAW,OAAM,IAAI,GAAG,OAAO,eAAe;GAAE;GAAS;GAAQ,GAAG;GAAO,CAAC;MACtF,OAAM,IAAI,GAAG,MAAM,eAAe,OAAO,KAAK,MAAM;;;;AAK7D,MAAa,iBAAiB,SAAS;CACrC,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;EAClC,MAAM,EAAE,QAAQ;EAChB,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC5B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,OAAO;EAAE,SAAS,EAAE,GAAG,QAAQ;EAAE,SAAS,EAAE,SAAS;EAAE,CAAC;CACnE,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,aAAa,KAAK;AACxB,QAAM,kBAAkB,KAAK,YAAY,KAAK,UAAU;EACxD,MAAM,WACJ,eAAe,SACX,OACA,MAAM,IAAI,GACP,MAAM,8BAA8B,CACpC,UAAU,kDAAkD,QAC3D,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,QAAQ,CAC3B,GAAG,cAAc,WAAW,CAChC,CACA,QAAQ;AACjB,MAAI,aAAa,QAAQ,SAAS,YAAY,WAAW,QACvD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,IAAI,UAAU,UAAU;EACxB,IAAI,UAAU;AACd,MAAI,YAAY,QAAW;GACzB,MAAM,SAAS,MAAM,IAAI,GAAG,IAAI,SAAS,WAAW,QAAQ;AAC5D,OAAI,WAAW,KACb,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AACJ,aAAU,MAAM,IAAI,GAAG,OAAO,SAAS;IACrC,MAAM,KAAK;IACX,MAAM;IACN,eAAe,WAAW;IAC1B,aAAa,OAAO,eAAe,OAAO;IAC1C,QAAQ;IACT,CAAC;AACF,aAAU;SACL;GACL,MAAM,QAAQ,MAAM,IAAI,GAAG,IAAI,SAAS,QAAQ;AAChD,OAAI,UAAU,QAAQ,MAAM,kBAAkB,WAAW,QACvD,OAAM,IAAI,YAAY;IACpB,MAAM,UAAU;IAChB,SAAS;IACV,CAAC;AAEJ,SAAM,IAAI,GAAG,MAAM,SAAS,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;;EAE3D,MAAM,eAAe;GACnB,cAAc,KAAK;GACnB,SAAS,WAAW;GACpB,cAAc;GACd,GAAI,eAAe,SAAY,EAAE,GAAG,EAAE,YAAY;GAClD,eAAe;GACf,QAAQ;GACR,mBAAmB,KAAK,KAAK;GAC7B,GAAI,KAAK,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK,KAAK,KAAK;GACpD;AACD,MAAI,aAAa,KAAM,OAAM,IAAI,GAAG,OAAO,+BAA+B,aAAa;MAClF,OAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK,aAAa;AAClF,QAAM,wBAAwB,KAAK,SAAS,KAAK,WAAW,KAAK,QAAQ;AACzE,SAAO;GAAE;GAAS;GAAS;;CAE9B,CAAC;;AAGF,MAAa,cAAc,SAAS;CAClC,MAAM;EACJ,cAAc,EAAE,GAAG,kBAAkB;EACrC,SAAS,EAAE,GAAG,QAAQ;EACtB,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC5B,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;EAChC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;EAC5B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,oBAAoB,QAAQ,IAAI,GAAG,iBAAiB,KAAK,QAAQ,CAAC,CAC5E,QAAQ;AACX,MACE,aAAa,QACb,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,YAAY,WAAW,WAChC,SAAS,iBAAiB,QAE1B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,QAAQ,MAAM,IAAI,GAAG,IAAI,SAAS,KAAK,QAAQ;AACrD,MAAI,UAAU,QAAQ,MAAM,kBAAkB,WAAW,QACvD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;AAEJ,QAAM,kBAAkB,KAAK,YAAY,KAAK,UAAU;AACxD,MAAI,KAAK,SAAS,OAAW,OAAM,IAAI,GAAG,MAAM,SAAS,KAAK,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;AAC3F,QAAM,IAAI,GAAG,MAAM,+BAA+B,SAAS,KAAK;GAC9D,QAAQ;GACR,mBAAmB,KAAK,KAAK;GAC7B,GAAI,KAAK,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK,KAAK,KAAK;GACpD,CAAC;AACF,QAAM,wBAAwB,KAAK,KAAK,SAAS,KAAK,WAAW,KAAK,QAAQ;AAC9E,SAAO;;CAEV,CAAC;;AAGF,MAAa,cAAc,SAAS;CAClC,MAAM;EAAE,cAAc,EAAE,GAAG,kBAAkB;EAAE,SAAS,EAAE,GAAG,QAAQ;EAAE;CACvE,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,aAAa,MAAM,qBAAqB,KAAK,KAAK,aAAa;EACrE,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,8BAA8B,CACpC,UAAU,oBAAoB,QAAQ,IAAI,GAAG,iBAAiB,KAAK,QAAQ,CAAC,CAC5E,QAAQ;AACX,MACE,aAAa,QACb,SAAS,iBAAiB,KAAK,gBAC/B,SAAS,YAAY,WAAW,WAChC,SAAS,iBAAiB,QAE1B,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,QAAQ,MAAM,IAAI,GAAG,IAAI,SAAS,KAAK,QAAQ;AACrD,MAAI,UAAU,QAAQ,MAAM,kBAAkB,SAAS,QACrD,OAAM,IAAI,YAAY;GACpB,MAAM,UAAU;GAChB,SAAS;GACV,CAAC;EAEJ,MAAM,UAAU,MAAM,IAAI,GACvB,MAAM,cAAc,CACpB,UAAU,aAAa,QAAQ,IAAI,GAAG,WAAW,KAAK,QAAQ,CAAC,CAC/D,SAAS;AACZ,OAAK,MAAM,UAAU,QAAS,OAAM,IAAI,GAAG,OAAO,eAAe,OAAO,IAAI;AAC5E,QAAM,IAAI,GAAG,OAAO,+BAA+B,SAAS,IAAI;AAChE,QAAM,IAAI,GAAG,OAAO,SAAS,KAAK,QAAQ;AAC1C,SAAO;;CAEV,CAAC"}