@massa-ai/core 1.2.1

package/dist/services/project-identity/identity-guard-installer.js

@@ -0,0 +1,116 @@
+import { getPgPool } from "../../data/db-connection.js";
+import { STATIC_DIRECT_STORES } from "./registry.js";
+/**
+ * Install (or replace — the SQL fn is DROP IF EXISTS + CREATE) the project
+ * identity guard trigger on a single table.column. Idempotent and safe to call
+ * from runtime table-initialization sites (keyword/search/vector init).
+ *
+ * Returns the sanitized code on failure, or undefined on success. NEVER throws.
+ */
+export async function installGuardOnTable(client, schema, table, column) {
+    try {
+        await client.query(`SELECT project_identity_install_guard($1::regclass, $2)`, [`${schema}.${table}`, column]);
+        return undefined;
+    }
+    catch (error) {
+        return sanitizeErrorCode(error);
+    }
+}
+/**
+ * Iterate the static direct-store registry plus runtime vector_documents* tables
+ * and install the project identity guard on every mutable identity column.
+ *
+ * The SQL function `project_identity_install_guard(target_table REGCLASS,
+ * column_name TEXT)` (T1) is idempotent: it DROPs any existing trigger and
+ * CREATEs a fresh BEFORE INSERT OR UPDATE OF column OR DELETE row-level trigger
+ * that resolves aliases on INSERT/UPDATE and takes a shared advisory lock on
+ * DELETE. So every guarded-table write is already safe — async writers need no
+ * draining.
+ *
+ * Failure isolation (spec req 8): a single install failure is recorded in
+ * `failures` with a SANITIZED code and NEVER aborts the loop or throws. Failure
+ * codes are PG SQLSTATE strings only (e.g. "42703"); error.message, row data,
+ * and SQL are never captured.
+ */
+export async function installProjectIdentityGuards(client, schema = "public") {
+    const installed = [];
+    const skipped = [];
+    const runtimeTablesGuarded = [];
+    const failures = [];
+    // 1. Static catalog. Mutable rows get a guard trigger. Immutable-by-rewrite
+    //    rows split two ways: operation_log is GUARDED so NEW audit rows written
+    //    with a retired id resolve to the live target (historical rows are never
+    //    rewritten — that is what registry `mutable: false` means); the
+    //    project_identity_operations table is skipped (no project_id column; it
+    //    is the operation authority itself).
+    for (const [table, policy] of Object.entries(STATIC_DIRECT_STORES)) {
+        if (!policy.mutable && table !== "operation_log") {
+            skipped.push(table);
+            continue;
+        }
+        const code = await installGuardOnTable(client, schema, table, policy.identityColumn);
+        if (code === undefined) {
+            installed.push(table);
+        }
+        else {
+            failures.push({ table, code });
+        }
+    }
+    // 2. Runtime vector_documents[_Nd] tables. These are created at runtime when a
+    //    new embedding dimension is detected; discovery picks them up, but the
+    //    guard must be installed too so writers cannot bypass the contract.
+    //    The probe itself is failure-isolated (req 8): a discovery error is one
+    //    sanitized failure entry, never a rejected report.
+    let runtimeTables = [];
+    try {
+        const probe = await client.query(`SELECT tablename FROM pg_tables WHERE schemaname = $1 AND tablename ~ '^vector_documents(_[0-9]+d)?$'`, [schema]);
+        runtimeTables = probe.rows.map((row) => row.tablename).filter(Boolean);
+    }
+    catch (error) {
+        failures.push({ table: "<runtime-discovery:vector_documents>", code: sanitizeErrorCode(error) });
+    }
+    for (const table of runtimeTables) {
+        const code = await installGuardOnTable(client, schema, table, "project_id");
+        if (code === undefined) {
+            runtimeTablesGuarded.push(table);
+        }
+        else {
+            failures.push({ table, code });
+        }
+    }
+    return { installed, skipped, runtimeTablesGuarded, failures };
+}
+/**
+ * Production startup path: acquire the shared pg pool, install guards on the
+ * static catalog plus runtime vector tables, then release the client. Keeps
+ * the data layer inside core — transport apps call this instead of touching
+ * `pg` pools themselves.
+ *
+ * Throws ONLY on pool acquisition/connect failure (the caller warn-logs with
+ * a sanitized shape and continues startup). Per-table install failures are
+ * already captured inside the report with sanitized SQLSTATE codes.
+ */
+export async function installProjectIdentityGuardsFromPool(schema = "public") {
+    const pool = await getPgPool();
+    const client = await pool.connect();
+    try {
+        return await installProjectIdentityGuards(client, schema);
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * Extract a sanitized error code from a caught value. Prefers the PG SQLSTATE
+ * (`err.code`, e.g. "42703"); falls back to "UNKNOWN". NEVER returns err.message
+ * or any other potentially-sensitive field — spec req 8.
+ */
+function sanitizeErrorCode(error) {
+    if (error && typeof error === "object" && "code" in error) {
+        const code = error.code;
+        if (typeof code === "string" && code.length > 0)
+            return code;
+    }
+    return "UNKNOWN";
+}
+//# sourceMappingURL=identity-guard-installer.js.map

package/dist/services/project-identity/identity-guard-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-guard-installer.js","sourceRoot":"","sources":["../../../src/services/project-identity/identity-guard-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAyBrD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAoC,EACpC,MAAc,EACd,KAAa,EACb,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAChB,yDAAyD,EACzD,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,EAAE,MAAM,CAAC,CAC/B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,MAAoC,EACpC,MAAM,GAAG,QAAQ;IAEjB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAsC,EAAE,CAAC;IAEvD,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,oEAAoE;IACpE,4EAA4E;IAC5E,yCAAyC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACrF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,4EAA4E;IAC5E,uDAAuD;IACvD,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B,uGAAuG,EACvG,CAAC,MAAM,CAAC,CACT,CAAC;QACF,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,MAAM,GAAG,QAAQ;IAEjB,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/services/project-identity/index.d.ts

@@ -0,0 +1,25 @@
+export { PROJECT_IDENTITY_MAX_PROJECT_ID_LENGTH, PROJECT_IDENTITY_PLAN_VERSION, ProjectIdentityApplyRequestSchema, ProjectIdentityModeSchema, ProjectIdentityPreviewRequestSchema, parseProjectIdentityApplyRequest, parseProjectIdentityPreviewRequest, } from "./contracts.js";
+export type { ProjectIdentityApplyInput, ProjectIdentityApplyRequest, ProjectIdentityApplyResult, ProjectIdentityConflict, ProjectIdentityMode, ProjectIdentityPlanMaterial, ProjectIdentityPreview, ProjectIdentityPreviewInput, ProjectIdentityPreviewRequest, ProjectIdentityService, ProjectIdentityStoreCount, ProjectIdentityTransactionClient, } from "./contracts.js";
+export { canonicalProjectIdentityJson, hashProjectIdentityPlan, hashProjectIdentityRequest, } from "./hash.js";
+export { parsePgArrayLiteral, toPgArrayLiteral, } from "./pg-array-codec.js";
+export { ProjectIdentityError } from "./errors.js";
+export type { ProjectIdentityErrorCode } from "./errors.js";
+export { discoverProjectIdentityStorage, fingerprintProjectIdentityRows, inspectIdentityPayload, quoteDiscoveredIdentifier, } from "./discovery.js";
+export type { DiscoveredDirectStore, DiscoveredPayloadStore, ProjectIdentityInventory, ProjectIdentityQueryClient, ProjectIdentityQueryResult, } from "./discovery.js";
+export { ProjectIdentityPreviewPlanner, computeIdentityPlan } from "./planner.js";
+export type { ProjectIdentityPlan } from "./planner.js";
+export { ProjectIdentityApplyService, createProjectIdentityApplyService, } from "./apply.js";
+export type { ProjectIdentityChangedPayload, ProjectIdentityChangedPublisher, ProjectIdentityTransactionRunner, } from "./apply.js";
+export { PROJECT_IDENTITY_REGISTRY_VERSION, STATIC_DIRECT_STORES, directStorePolicy, isKnownRegistryTable, payloadStorePolicies, } from "./registry.js";
+export type { DirectStorePolicy, IdentityColumn, PayloadStorePolicy } from "./registry.js";
+export { installGuardOnTable, installProjectIdentityGuards, installProjectIdentityGuardsFromPool, } from "./identity-guard-installer.js";
+export type { IdentityGuardInstallerClient, ProjectIdentityGuardInstallReport, } from "./identity-guard-installer.js";
+export { EMPTY_INVALIDATION_REPORT, ProjectIdentityInvalidatorRegistry, } from "./invalidator-registry.js";
+export type { ProjectIdentityInvalidationReport, ProjectIdentityInvalidator, } from "./invalidator-registry.js";
+export { createEventBusProjectIdentityChangedPublisher, createProductionProjectIdentityInvalidatorRegistry, } from "./production-wiring.js";
+export type { ProductionInvalidatorTargetResolver, ProductionInvalidatorTargets, } from "./production-wiring.js";
+export { createProjectIdentityService, } from "./service.js";
+export type { CreateProjectIdentityServiceOptions, } from "./service.js";
+export { ProjectIdentityAliasResolver, getProjectIdentityAliasResolver, setProjectIdentityAliasResolverForTests, } from "./alias-resolver.js";
+export type { AliasResolverQuerier, ProjectIdentityAliasResolverOptions, } from "./alias-resolver.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/services/project-identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/project-identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,GACjC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAClF,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iCAAiC,EACjC,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,GACnD,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,mCAAmC,GACpC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,oBAAoB,EACpB,mCAAmC,GACpC,MAAM,qBAAqB,CAAC"}

package/dist/services/project-identity/index.js

@@ -0,0 +1,14 @@
+export { PROJECT_IDENTITY_MAX_PROJECT_ID_LENGTH, PROJECT_IDENTITY_PLAN_VERSION, ProjectIdentityApplyRequestSchema, ProjectIdentityModeSchema, ProjectIdentityPreviewRequestSchema, parseProjectIdentityApplyRequest, parseProjectIdentityPreviewRequest, } from "./contracts.js";
+export { canonicalProjectIdentityJson, hashProjectIdentityPlan, hashProjectIdentityRequest, } from "./hash.js";
+export { parsePgArrayLiteral, toPgArrayLiteral, } from "./pg-array-codec.js";
+export { ProjectIdentityError } from "./errors.js";
+export { discoverProjectIdentityStorage, fingerprintProjectIdentityRows, inspectIdentityPayload, quoteDiscoveredIdentifier, } from "./discovery.js";
+export { ProjectIdentityPreviewPlanner, computeIdentityPlan } from "./planner.js";
+export { ProjectIdentityApplyService, createProjectIdentityApplyService, } from "./apply.js";
+export { PROJECT_IDENTITY_REGISTRY_VERSION, STATIC_DIRECT_STORES, directStorePolicy, isKnownRegistryTable, payloadStorePolicies, } from "./registry.js";
+export { installGuardOnTable, installProjectIdentityGuards, installProjectIdentityGuardsFromPool, } from "./identity-guard-installer.js";
+export { EMPTY_INVALIDATION_REPORT, ProjectIdentityInvalidatorRegistry, } from "./invalidator-registry.js";
+export { createEventBusProjectIdentityChangedPublisher, createProductionProjectIdentityInvalidatorRegistry, } from "./production-wiring.js";
+export { createProjectIdentityService, } from "./service.js";
+export { ProjectIdentityAliasResolver, getProjectIdentityAliasResolver, setProjectIdentityAliasResolverForTests, } from "./alias-resolver.js";
+//# sourceMappingURL=index.js.map

package/dist/services/project-identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/project-identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,iCAAiC,EACjC,yBAAyB,EACzB,mCAAmC,EACnC,gCAAgC,EAChC,kCAAkC,GACnC,MAAM,gBAAgB,CAAC;AAexB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EACL,8BAA8B,EAC9B,8BAA8B,EAC9B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAElF,OAAO,EACL,2BAA2B,EAC3B,iCAAiC,GAClC,MAAM,YAAY,CAAC;AAMpB,OAAO,EACL,iCAAiC,EACjC,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,+BAA+B,CAAC;AAKvC,OAAO,EACL,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,6CAA6C,EAC7C,kDAAkD,GACnD,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EACL,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,uCAAuC,GACxC,MAAM,qBAAqB,CAAC"}

package/dist/services/project-identity/invalidator-registry.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Per-project in-memory cache invalidator. Apply invokes every registered
+ * invalidator for BOTH the source and target project IDs after commit so a
+ * rename/merge cannot serve stale project-scoped state (search caches, project
+ * root caches, file filters, index managers).
+ *
+ * Spec req 8: invalidation failures MUST NEVER flip a committed operation to
+ * failure. They are captured as sanitized diagnostics in the report.
+ */
+export interface ProjectIdentityInvalidator {
+    /** Stable identifier surfaced in the sanitized failure report. */
+    readonly id: string;
+    /** Drop only entries scoped to this projectId. Must not throw (but if it does,
+     *  the registry catches and records a sanitized code). */
+    invalidateProject(projectId: string): Promise<void> | void;
+}
+export interface ProjectIdentityInvalidationReport {
+    readonly invalidated: readonly {
+        invalidatorId: string;
+        projectId: string;
+    }[];
+    readonly failures: readonly {
+        invalidatorId: string;
+        code: string;
+    }[];
+}
+export declare const EMPTY_INVALIDATION_REPORT: ProjectIdentityInvalidationReport;
+/**
+ * Registry of process-local invalidators. Apply owns one instance and invokes
+ * `invalidateBoth(source, target)` post-commit. Production registers invalidators
+ * for QueryUnderstandingCache, SymbolGraphService.projectRootCache, and any other
+ * in-memory projectId-scoped state.
+ *
+ * L1MemoryCache and the read_file tool cache are deliberately NOT registered:
+ * both are TTL-bounded, so a stale entry self-evicts within the TTL window
+ * without a per-project hook.
+ */
+export declare class ProjectIdentityInvalidatorRegistry {
+    private readonly invalidators;
+    register(invalidator: ProjectIdentityInvalidator): void;
+    /**
+     * Run every registered invalidator for BOTH source and target. Each call is
+     * wrapped in try/catch: success → push to `invalidated`; failure → push the
+     * SANITIZED code to `failures`. NEVER throws — even if a registrant throws.
+     *
+     * The report's failure.code contains only a PG SQLSTATE-style code or
+     * "UNKNOWN"; it never contains err.message, row data, or project IDs that
+     * could leak sensitive material.
+     */
+    invalidateBoth(source: string, target: string): Promise<ProjectIdentityInvalidationReport>;
+}
+//# sourceMappingURL=invalidator-registry.d.ts.map

package/dist/services/project-identity/invalidator-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalidator-registry.d.ts","sourceRoot":"","sources":["../../../src/services/project-identity/invalidator-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;8DAC0D;IAC1D,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvE;AAED,eAAO,MAAM,yBAAyB,EAAE,iCAGD,CAAC;AAExC;;;;;;;;;GASG;AACH,qBAAa,kCAAkC;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,QAAQ,CAAC,WAAW,EAAE,0BAA0B,GAAG,IAAI;IAIvD;;;;;;;;OAQG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,iCAAiC,CAAC;CAoC9C"}

package/dist/services/project-identity/invalidator-registry.js

@@ -0,0 +1,73 @@
+export const EMPTY_INVALIDATION_REPORT = Object.freeze({
+    invalidated: Object.freeze([]),
+    failures: Object.freeze([]),
+});
+/**
+ * Registry of process-local invalidators. Apply owns one instance and invokes
+ * `invalidateBoth(source, target)` post-commit. Production registers invalidators
+ * for QueryUnderstandingCache, SymbolGraphService.projectRootCache, and any other
+ * in-memory projectId-scoped state.
+ *
+ * L1MemoryCache and the read_file tool cache are deliberately NOT registered:
+ * both are TTL-bounded, so a stale entry self-evicts within the TTL window
+ * without a per-project hook.
+ */
+export class ProjectIdentityInvalidatorRegistry {
+    invalidators = [];
+    register(invalidator) {
+        this.invalidators.push(invalidator);
+    }
+    /**
+     * Run every registered invalidator for BOTH source and target. Each call is
+     * wrapped in try/catch: success → push to `invalidated`; failure → push the
+     * SANITIZED code to `failures`. NEVER throws — even if a registrant throws.
+     *
+     * The report's failure.code contains only a PG SQLSTATE-style code or
+     * "UNKNOWN"; it never contains err.message, row data, or project IDs that
+     * could leak sensitive material.
+     */
+    async invalidateBoth(source, target) {
+        if (this.invalidators.length === 0) {
+            // Return the frozen shared instance so callers can use reference
+            // equality (apply leaves `result.invalidation` absent in this case,
+            // keeping the T1–T3 result shape byte-identical).
+            return EMPTY_INVALIDATION_REPORT;
+        }
+        const invalidated = [];
+        const failures = [];
+        // Parallel fan-out across (invalidator × projectId). Each cell is isolated;
+        // a throw in one never short-circuits the others. Promise.allSettled keeps
+        // the {invalidatorId, projectId} binding so the report can attribute each
+        // outcome without losing the cell identity on rejection.
+        const cells = [];
+        for (const invalidator of this.invalidators) {
+            cells.push({ invalidator, projectId: source });
+            cells.push({ invalidator, projectId: target });
+        }
+        const settled = await Promise.allSettled(
+        // Promise.resolve().then(...) converts a SYNCHRONOUS throw from a
+        // registrant into a rejection, so one bad invalidator cannot abort the
+        // remaining cells before allSettled even sees them.
+        cells.map((c) => Promise.resolve().then(() => c.invalidator.invalidateProject(c.projectId))));
+        for (let i = 0; i < cells.length; i++) {
+            const cell = cells[i];
+            const outcome = settled[i];
+            if (outcome.status === "fulfilled") {
+                invalidated.push({ invalidatorId: cell.invalidator.id, projectId: cell.projectId });
+            }
+            else {
+                failures.push({ invalidatorId: cell.invalidator.id, code: sanitizeErrorCode(outcome.reason) });
+            }
+        }
+        return { invalidated, failures };
+    }
+}
+function sanitizeErrorCode(reason) {
+    if (reason && typeof reason === "object" && "code" in reason) {
+        const code = reason.code;
+        if (typeof code === "string" && code.length > 0)
+            return code;
+    }
+    return "UNKNOWN";
+}
+//# sourceMappingURL=invalidator-registry.js.map

package/dist/services/project-identity/invalidator-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalidator-registry.js","sourceRoot":"","sources":["../../../src/services/project-identity/invalidator-registry.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,MAAM,yBAAyB,GAAsC,MAAM,CAAC,MAAM,CAAC;IACxF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAA6D,CAAC;IACzF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAwD,CAAC;CAClF,CAAsC,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,OAAO,kCAAkC;IAC5B,YAAY,GAAiC,EAAE,CAAC;IAEjE,QAAQ,CAAC,WAAuC;QAC9C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,MAAc;QAEd,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,iEAAiE;YACjE,oEAAoE;YACpE,kDAAkD;YAClD,OAAO,yBAAyB,CAAC;QACnC,CAAC;QACD,MAAM,WAAW,GAAmD,EAAE,CAAC;QACvE,MAAM,QAAQ,GAA8C,EAAE,CAAC;QAE/D,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,KAAK,GAAqE,EAAE,CAAC;QACnF,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU;QACtC,kEAAkE;QAClE,uEAAuE;QACvE,oDAAoD;QACpD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAC7F,CAAC;QACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACnC,WAAW,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAI,MAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/services/project-identity/pg-array-codec.d.ts

@@ -0,0 +1,24 @@
+/**
+ * pg-array-codec — canonical handling of PostgreSQL text-array identity
+ * payloads. Production reality (pinned by the T6 owned-PG gate): the
+ * `memories.tags` identity payload column is TEXT holding a PG array LITERAL
+ * (`{alpha,beta}`), because the Prisma adapter does not map OID 1009 to a
+ * native type (see memory-repository-pg.ts). A genuine text[] column arrives
+ * from the driver as a JS array instead. Both representations must parse,
+ * rewrite, and serialize round-trip — or the planner flags false
+ * `malformed_payload` conflicts and apply silently skips the rewrite.
+ */
+/**
+ * Parse a text-array value: JS array (text[] driver) or PG array literal
+ * string (TEXT column). Returns undefined when the value is NEITHER — that is
+ * the only malformed case; empty literal `{}` is a valid empty array.
+ */
+export declare function parsePgArrayLiteral(value: unknown): string[] | undefined;
+/**
+ * Serialize string items to a PG array literal for TEXT columns. Elements
+ * that are empty, contain separators/quotes/braces/backslashes/whitespace, or
+ * look like the NULL token are quoted (and escaped) so the literal round-
+ * trips through the parser unchanged.
+ */
+export declare function toPgArrayLiteral(items: readonly string[]): string;
+//# sourceMappingURL=pg-array-codec.d.ts.map

package/dist/services/project-identity/pg-array-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-array-codec.d.ts","sourceRoot":"","sources":["../../../src/services/project-identity/pg-array-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CA2CxE;AAOD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAUjE"}

package/dist/services/project-identity/pg-array-codec.js

@@ -0,0 +1,85 @@
+/**
+ * pg-array-codec — canonical handling of PostgreSQL text-array identity
+ * payloads. Production reality (pinned by the T6 owned-PG gate): the
+ * `memories.tags` identity payload column is TEXT holding a PG array LITERAL
+ * (`{alpha,beta}`), because the Prisma adapter does not map OID 1009 to a
+ * native type (see memory-repository-pg.ts). A genuine text[] column arrives
+ * from the driver as a JS array instead. Both representations must parse,
+ * rewrite, and serialize round-trip — or the planner flags false
+ * `malformed_payload` conflicts and apply silently skips the rewrite.
+ */
+/**
+ * Parse a text-array value: JS array (text[] driver) or PG array literal
+ * string (TEXT column). Returns undefined when the value is NEITHER — that is
+ * the only malformed case; empty literal `{}` is a valid empty array.
+ */
+export function parsePgArrayLiteral(value) {
+    if (Array.isArray(value)) {
+        return value.every((item) => typeof item === "string") ? [...value] : undefined;
+    }
+    if (typeof value !== "string")
+        return undefined;
+    const s = value.trim();
+    if (s === "{}" || s === "")
+        return [];
+    if (!(s.startsWith("{") && s.endsWith("}")))
+        return undefined;
+    const inner = s.slice(1, -1);
+    if (inner === "")
+        return [];
+    const out = [];
+    let cur = "";
+    let inQuotes = false;
+    let escape = false;
+    let tokenQuoted = false;
+    for (let i = 0; i < inner.length; i++) {
+        const ch = inner[i];
+        if (escape) {
+            cur += ch;
+            escape = false;
+            continue;
+        }
+        if (ch === "\\") {
+            escape = true;
+            continue;
+        }
+        if (ch === '"') {
+            inQuotes = !inQuotes;
+            tokenQuoted = true;
+            continue;
+        }
+        if (ch === "," && !inQuotes) {
+            out.push(normalizeToken(cur, tokenQuoted));
+            cur = "";
+            tokenQuoted = false;
+            continue;
+        }
+        cur += ch;
+    }
+    if (inQuotes)
+        return undefined; // unterminated quoted element
+    out.push(normalizeToken(cur, tokenQuoted));
+    return out;
+}
+/** Unquoted `NULL` (case-insensitive) is the SQL null element → empty string. */
+function normalizeToken(token, wasQuoted) {
+    return !wasQuoted && token.toUpperCase() === "NULL" ? "" : token;
+}
+/**
+ * Serialize string items to a PG array literal for TEXT columns. Elements
+ * that are empty, contain separators/quotes/braces/backslashes/whitespace, or
+ * look like the NULL token are quoted (and escaped) so the literal round-
+ * trips through the parser unchanged.
+ */
+export function toPgArrayLiteral(items) {
+    const encode = (item) => {
+        const needsQuotes = item === "" ||
+            /[",{}\\\s]/.test(item) ||
+            item.toUpperCase() === "NULL";
+        if (!needsQuotes)
+            return item;
+        return `"${item.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    };
+    return `{${items.map(encode).join(",")}}`;
+}
+//# sourceMappingURL=pg-array-codec.js.map

package/dist/services/project-identity/pg-array-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-array-codec.js","sourceRoot":"","sources":["../../../src/services/project-identity/pg-array-codec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAE9D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,IAAI,EAAE,CAAC;YACV,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,WAAW,GAAG,IAAI,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YAC3C,GAAG,GAAG,EAAE,CAAC;YACT,WAAW,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC,CAAC,8BAA8B;IAC9D,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAa,EAAE,SAAkB;IACvD,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE;QACtC,MAAM,WAAW,GACf,IAAI,KAAK,EAAE;YACX,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QAChC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IACjE,CAAC,CAAC;IACF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5C,CAAC"}

package/dist/services/project-identity/planner.d.ts

@@ -0,0 +1,39 @@
+import { type ProjectIdentityConflict, type ProjectIdentityMode, type ProjectIdentityPreview, type ProjectIdentityPreviewInput, type ProjectIdentityStoreCount } from "./contracts.js";
+import { type ProjectIdentityQueryClient } from "./discovery.js";
+/**
+ * Authoritative identity plan for a request, computed against `client`.
+ * Shared by preview (dryRun:true, wraps with planHash) and apply (inside the
+ * write transaction so the in-tx plan hash matches the externally observed
+ * preview hash).
+ *
+ * The returned `planHash` is the hash of the material excluding `dryRun` — it
+ * is identical for the same storage snapshot whether computed by preview or by
+ * apply. Callers that only need the material (apply) may ignore `planHash`.
+ */
+export interface ProjectIdentityPlan {
+    mode: ProjectIdentityMode;
+    sourceProjectId: string;
+    targetProjectId: string;
+    sourceCanonicalRoot: string;
+    /** Empty string when target is absent (rename). Used for the apply record. */
+    targetCanonicalRoot: string;
+    /** True when a live target workspace exists (merge). */
+    hasTarget: boolean;
+    stores: readonly ProjectIdentityStoreCount[];
+    conflicts: readonly ProjectIdentityConflict[];
+    unknownStores: readonly string[];
+    storageFingerprint: string;
+    planHash: string;
+}
+export declare function computeIdentityPlan(client: ProjectIdentityQueryClient, request: {
+    mode: ProjectIdentityMode;
+    sourceProjectId: string;
+    targetProjectId: string;
+}, schema?: string): Promise<ProjectIdentityPlan>;
+export declare class ProjectIdentityPreviewPlanner {
+    private readonly client;
+    private readonly schema;
+    constructor(client: ProjectIdentityQueryClient, schema?: string);
+    preview(input: ProjectIdentityPreviewInput): Promise<ProjectIdentityPreview>;
+}
+//# sourceMappingURL=planner.d.ts.map

package/dist/services/project-identity/planner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.d.ts","sourceRoot":"","sources":["../../../src/services/project-identity/planner.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAML,KAAK,0BAA0B,EAChC,MAAM,gBAAgB,CAAC;AAuDxB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC7C,SAAS,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC9C,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,EACxF,MAAM,SAAW,GAChB,OAAO,CAAC,mBAAmB,CAAC,CA0I9B;AAED,qBAAa,6BAA6B;IAEtC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,0BAA0B,EAClC,MAAM,SAAW;IAG9B,OAAO,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAuBnF"}