@memberjunction/server 6.1.4 → 6.1.6

package/dist/postgresqlCompat.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Translates SQL Server bracket-quoted identifiers (`[Name]`) to PostgreSQL double-quoted ones
+ * (`"Name"`), for SQL written in SQL Server syntax that runs on PostgreSQL. Only identifiers
+ * change: brackets inside string literals and comments are left as written. A `]]` in a name
+ * becomes `]`, and a `"` in a name is doubled.
+ */
+export declare function TranslateBracketsToPG(sql: string): string;
+//# sourceMappingURL=postgresqlCompat.d.ts.map

package/dist/postgresqlCompat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlCompat.d.ts","sourceRoot":"","sources":["../src/postgresqlCompat.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIzD"}

package/dist/postgresqlCompat.js

@@ -0,0 +1,19 @@
+import { LexSQL } from '@memberjunction/sql-parser';
+import { SQLServerDialect } from '@memberjunction/sql-dialect';
+const sqlServer = new SQLServerDialect();
+/**
+ * Translates SQL Server bracket-quoted identifiers (`[Name]`) to PostgreSQL double-quoted ones
+ * (`"Name"`), for SQL written in SQL Server syntax that runs on PostgreSQL. Only identifiers
+ * change: brackets inside string literals and comments are left as written. A `]]` in a name
+ * becomes `]`, and a `"` in a name is doubled.
+ */
+export function TranslateBracketsToPG(sql) {
+    return LexSQL(sql, sqlServer)
+        .map(t => t.Kind === 'identifier' && t.Text.startsWith('[') ? toDoubleQuoted(t.Text) : t.Text)
+        .join('');
+}
+function toDoubleQuoted(bracketed) {
+    const name = bracketed.slice(1, bracketed.endsWith(']') ? -1 : undefined).replace(/]]/g, ']');
+    return `"${name.replace(/"/g, '""')}"`;
+}
+//# sourceMappingURL=postgresqlCompat.js.map

package/dist/postgresqlCompat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlCompat.js","sourceRoot":"","sources":["../src/postgresqlCompat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,SAAS,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC7C,OAAO,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;SAC7F,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9F,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC3C,CAAC"}

package/dist/postgresqlPoolSettings.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Connection settings for MJAPI's PostgreSQL pools, derived from the same `databaseSettings`
+ * values SQL Server reads, with the same defaults.
+ *
+ * | Setting                              | SQL Server                       | PostgreSQL                                   |
+ * |--------------------------------------|----------------------------------|----------------------------------------------|
+ * | `requestTimeout`                     | driver request timeout           | `statement_timeout` on every backend         |
+ * | `connectionPool.max` / `min`         | pool size                        | pool size                                    |
+ * | `connectionPool.idleTimeoutMillis`   | idle connection eviction         | idle connection eviction                     |
+ * | `connectionPool.acquireTimeoutMillis`| wait for a pooled connection     | `connectionTimeoutMillis` (see below)        |
+ * | `connectionTimeout`                  | time to open a connection        | not used                                     |
+ *
+ * Where the two cannot match exactly:
+ * - The `pg` pool has one timeout covering both waiting for a free slot and opening a connection.
+ *   It is fed from `acquireTimeoutMillis`; `connectionTimeout` is not used on PostgreSQL.
+ * - SQL Server's `requestTimeout` is a client-side timer over the whole request, including reading
+ *   rows. PostgreSQL's `statement_timeout` is server-side execution time per statement, so a query
+ *   that executes quickly and returns its rows slowly is not cut off on PostgreSQL.
+ * - `idle_in_transaction_session_timeout` has no SQL Server counterpart. It is derived as twice the
+ *   statement timeout, so a transaction left open by an abandoned request is ended and its locks
+ *   released.
+ * - MJAPI opens a raw compatibility pool and a provider pool, each up to `connectionPool.max`, plus
+ *   a CodeGen pool of 10 and, when a read-only login is configured, a read-only pool of at most 10,
+ *   where SQL Server opens one pool (and a read-only one). PostgreSQL's default `max_connections`
+ *   is 100, so the read-only and CodeGen pools are kept small.
+ */
+import type { PGConnectionConfig } from '@memberjunction/postgresql-dataprovider';
+import type { Pool, PoolConfig } from 'pg';
+import { BaseSingleton } from '@memberjunction/global';
+import type { DatabaseSettingsInfo } from './config.js';
+/** Statement timeout for the CodeGen/DDL pool, matching the SQL Server CodeGen pool. */
+export declare const CODEGEN_STATEMENT_TIMEOUT_MS = 600000;
+/**
+ * Which pool the settings are for: API traffic, the read-only pool for caller-supplied SQL, or
+ * CodeGen and DDL work.
+ */
+export type PostgreSQLPoolPurpose = 'api' | 'read-only' | 'codegen';
+/** Where a PostgreSQL pool connects and as whom. */
+export interface PostgreSQLEndpoint {
+    Host: string;
+    Port: number;
+    Database: string;
+    User: string;
+    Password: string;
+}
+/** Reads the PostgreSQL endpoint from `PG_*` environment variables, then `DB_*` ones. */
+export declare function ResolvePostgreSQLEndpoint(env?: NodeJS.ProcessEnv): PostgreSQLEndpoint;
+/** The idle-in-transaction limit for a given statement timeout; 0 means none. */
+export declare function IdleInTransactionTimeoutFor(statementTimeoutMs: number): number;
+/** Builds the provider connection config for one of MJAPI's PostgreSQL pools. */
+export declare function BuildPostgreSQLConnectionConfig(endpoint: PostgreSQLEndpoint, settings: DatabaseSettingsInfo, purpose: PostgreSQLPoolPurpose): PGConnectionConfig;
+/**
+ * Maps a provider connection config onto `pg.Pool` options, for the pools MJAPI creates directly
+ * rather than through the provider. Timeouts that are unset or 0 are left out.
+ */
+export declare function ToPGPoolConfig(config: PGConnectionConfig): PoolConfig;
+/** Credentials for a read-only database login. */
+export interface ReadOnlyCredentials {
+    User: string;
+    Password: string;
+}
+/**
+ * The read-only login for PostgreSQL: the `dbReadOnlyUsername` / `dbReadOnlyPassword` settings
+ * SQL Server uses (which default from `DB_READ_ONLY_USERNAME` / `DB_READ_ONLY_PASSWORD`), then
+ * `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD`. `null` when neither pair is complete.
+ */
+export declare function ResolvePostgreSQLReadOnlyCredentials(configured: {
+    dbReadOnlyUsername?: string;
+    dbReadOnlyPassword?: string;
+}, env?: NodeJS.ProcessEnv): ReadOnlyCredentials | null;
+/**
+ * Holds MJAPI's PostgreSQL read-only pool, opened once at startup with the read-only login.
+ * Per-request read-only providers share it, so they connect as the read-only user rather than
+ * through the read-write pool.
+ */
+export declare class PostgreSQLReadOnlyPool extends BaseSingleton<PostgreSQLReadOnlyPool> {
+    private _pool;
+    /** Use {@link PostgreSQLReadOnlyPool.Instance}. */
+    constructor();
+    static get Instance(): PostgreSQLReadOnlyPool;
+    /** The read-only pool, or `null` when no read-only login is configured. */
+    get Pool(): Pool | null;
+    set Pool(pool: Pool | null);
+}
+/** What {@link DescribeReadOnlyLoginOverreach} reads about the read-only login. */
+export interface ReadOnlyLoginGrants {
+    ReadsServerFiles: boolean;
+    ReadableBaseTables: number;
+}
+/** The one method {@link DescribeReadOnlyLoginOverreach} needs from a connection; a `pg` client has it. */
+export interface ReadOnlyLoginCheckClient {
+    query(sql: string, params: unknown[]): Promise<{
+        rows: ReadOnlyLoginGrants[];
+    }>;
+}
+/**
+ * What the PostgreSQL read-only login can do beyond reading entity base views, as warnings to log at
+ * startup. Ad-hoc SQL and `TestQuerySQL` run as this login, and SQL can reach data through functions
+ * that no check of its table references sees (`query_to_xml`, file readers), so the login's own
+ * grants are the only complete limit. It should hold `SELECT` on the entity base views and nothing
+ * else: not on the base tables, and not membership of `pg_read_server_files`. Empty when the login
+ * is that narrow.
+ *
+ * @param client - A connection opened as the read-only login.
+ * @param coreSchema - The MJ core schema, whose base tables the login should not read.
+ */
+export declare function DescribeReadOnlyLoginOverreach(client: ReadOnlyLoginCheckClient, coreSchema: string): Promise<string[]>;
+//# sourceMappingURL=postgresqlPoolSettings.d.ts.map

package/dist/postgresqlPoolSettings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlPoolSettings.d.ts","sourceRoot":"","sources":["../src/postgresqlPoolSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,wFAAwF;AACxF,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAQnD;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,kBAAkB,CAQlG;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,iFAAiF;AACjF,wBAAgB,+BAA+B,CAC3C,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,EAAE,qBAAqB,GAC/B,kBAAkB,CAuBpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,UAAU,CAerE;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAChD,UAAU,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,EACxE,GAAG,GAAE,MAAM,CAAC,UAAwB,GACrC,mBAAmB,GAAG,IAAI,CAQ5B;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,sBAAsB,CAAC;IAC7E,OAAO,CAAC,KAAK,CAAqB;IAElC,mDAAmD;;IAKnD,WAAkB,QAAQ,IAAI,sBAAsB,CAEnD;IAED,2EAA2E;IAC3E,IAAW,IAAI,IAAI,IAAI,GAAG,IAAI,CAE7B;IAED,IAAW,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAEhC;CACJ;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;CAC9B;AAED,2GAA2G;AAC3G,MAAM,WAAW,wBAAwB;IACrC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAC;CACnF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiB5H"}

package/dist/postgresqlPoolSettings.js

@@ -0,0 +1,134 @@
+import { BaseSingleton } from '@memberjunction/global';
+/** Statement timeout for the CodeGen/DDL pool, matching the SQL Server CodeGen pool. */
+export const CODEGEN_STATEMENT_TIMEOUT_MS = 600000;
+/** Pool size for the CodeGen/DDL pool. */
+const CODEGEN_MAX_CONNECTIONS = 10;
+/** Largest pool size for the read-only pool, which serves only caller-supplied SQL. */
+const READ_ONLY_MAX_CONNECTIONS = 10;
+/** Reads the PostgreSQL endpoint from `PG_*` environment variables, then `DB_*` ones. */
+export function ResolvePostgreSQLEndpoint(env = process.env) {
+    return {
+        Host: env.PG_HOST || env.DB_HOST || 'localhost',
+        Port: parseInt(env.PG_PORT || env.DB_PORT || '5432', 10),
+        Database: env.PG_DATABASE || env.DB_DATABASE || '',
+        User: env.PG_USERNAME || env.DB_USERNAME || 'postgres',
+        Password: env.PG_PASSWORD || env.DB_PASSWORD || ''
+    };
+}
+/** The idle-in-transaction limit for a given statement timeout; 0 means none. */
+export function IdleInTransactionTimeoutFor(statementTimeoutMs) {
+    return statementTimeoutMs > 0 ? statementTimeoutMs * 2 : 0;
+}
+/** Builds the provider connection config for one of MJAPI's PostgreSQL pools. */
+export function BuildPostgreSQLConnectionConfig(endpoint, settings, purpose) {
+    const pool = settings.connectionPool;
+    if (purpose === 'codegen') {
+        return {
+            ...endpoint,
+            MaxConnections: CODEGEN_MAX_CONNECTIONS,
+            StatementTimeoutMs: CODEGEN_STATEMENT_TIMEOUT_MS,
+            IdleInTransactionSessionTimeoutMs: 0
+        };
+    }
+    const statementTimeoutMs = Math.max(0, settings.requestTimeout);
+    const apiMax = pool?.max ?? 50;
+    const apiMin = pool?.min ?? 5;
+    const readOnly = purpose === 'read-only';
+    return {
+        ...endpoint,
+        MaxConnections: readOnly ? Math.min(READ_ONLY_MAX_CONNECTIONS, apiMax) : apiMax,
+        MinConnections: readOnly ? 0 : apiMin,
+        IdleTimeoutMillis: pool?.idleTimeoutMillis ?? 30000,
+        ConnectionTimeoutMillis: pool?.acquireTimeoutMillis ?? 30000,
+        StatementTimeoutMs: statementTimeoutMs,
+        IdleInTransactionSessionTimeoutMs: IdleInTransactionTimeoutFor(statementTimeoutMs)
+    };
+}
+/**
+ * Maps a provider connection config onto `pg.Pool` options, for the pools MJAPI creates directly
+ * rather than through the provider. Timeouts that are unset or 0 are left out.
+ */
+export function ToPGPoolConfig(config) {
+    const pool = {
+        host: config.Host,
+        port: config.Port,
+        database: config.Database,
+        user: config.User,
+        password: config.Password,
+        max: config.MaxConnections
+    };
+    if (config.MinConnections !== undefined)
+        pool.min = config.MinConnections;
+    if (config.IdleTimeoutMillis !== undefined)
+        pool.idleTimeoutMillis = config.IdleTimeoutMillis;
+    if (config.ConnectionTimeoutMillis !== undefined)
+        pool.connectionTimeoutMillis = config.ConnectionTimeoutMillis;
+    if (config.StatementTimeoutMs)
+        pool.statement_timeout = config.StatementTimeoutMs;
+    if (config.IdleInTransactionSessionTimeoutMs)
+        pool.idle_in_transaction_session_timeout = config.IdleInTransactionSessionTimeoutMs;
+    return pool;
+}
+/**
+ * The read-only login for PostgreSQL: the `dbReadOnlyUsername` / `dbReadOnlyPassword` settings
+ * SQL Server uses (which default from `DB_READ_ONLY_USERNAME` / `DB_READ_ONLY_PASSWORD`), then
+ * `PG_READ_ONLY_USERNAME` / `PG_READ_ONLY_PASSWORD`. `null` when neither pair is complete.
+ */
+export function ResolvePostgreSQLReadOnlyCredentials(configured, env = process.env) {
+    if (configured.dbReadOnlyUsername && configured.dbReadOnlyPassword) {
+        return { User: configured.dbReadOnlyUsername, Password: configured.dbReadOnlyPassword };
+    }
+    if (env.PG_READ_ONLY_USERNAME && env.PG_READ_ONLY_PASSWORD) {
+        return { User: env.PG_READ_ONLY_USERNAME, Password: env.PG_READ_ONLY_PASSWORD };
+    }
+    return null;
+}
+/**
+ * Holds MJAPI's PostgreSQL read-only pool, opened once at startup with the read-only login.
+ * Per-request read-only providers share it, so they connect as the read-only user rather than
+ * through the read-write pool.
+ */
+export class PostgreSQLReadOnlyPool extends BaseSingleton {
+    /** Use {@link PostgreSQLReadOnlyPool.Instance}. */
+    constructor() {
+        super();
+        this._pool = null;
+    }
+    static get Instance() {
+        return PostgreSQLReadOnlyPool.getInstance();
+    }
+    /** The read-only pool, or `null` when no read-only login is configured. */
+    get Pool() {
+        return this._pool;
+    }
+    set Pool(pool) {
+        this._pool = pool;
+    }
+}
+/**
+ * What the PostgreSQL read-only login can do beyond reading entity base views, as warnings to log at
+ * startup. Ad-hoc SQL and `TestQuerySQL` run as this login, and SQL can reach data through functions
+ * that no check of its table references sees (`query_to_xml`, file readers), so the login's own
+ * grants are the only complete limit. It should hold `SELECT` on the entity base views and nothing
+ * else: not on the base tables, and not membership of `pg_read_server_files`. Empty when the login
+ * is that narrow.
+ *
+ * @param client - A connection opened as the read-only login.
+ * @param coreSchema - The MJ core schema, whose base tables the login should not read.
+ */
+export async function DescribeReadOnlyLoginOverreach(client, coreSchema) {
+    const result = await client.query(`SELECT pg_has_role(current_user, 'pg_read_server_files', 'MEMBER') AS "ReadsServerFiles",
+                (SELECT count(*)::int FROM pg_catalog.pg_tables t
+                  WHERE t.schemaname = $1
+                    AND has_table_privilege(current_user, quote_ident(t.schemaname) || '.' || quote_ident(t.tablename), 'SELECT')) AS "ReadableBaseTables"`, [coreSchema]);
+    const row = result.rows[0];
+    const warnings = [];
+    if (row?.ReadableBaseTables > 0) {
+        warnings.push(`The PostgreSQL read-only login can read ${row.ReadableBaseTables} base table(s) in schema "${coreSchema}". Ad-hoc SQL and TestQuerySQL run as this login; grant it SELECT on the entity base views only.`);
+    }
+    if (row?.ReadsServerFiles) {
+        warnings.push('The PostgreSQL read-only login is a member of pg_read_server_files, so SQL run as it can read files on the database server. Revoke that membership.');
+    }
+    return warnings;
+}
+//# sourceMappingURL=postgresqlPoolSettings.js.map

package/dist/postgresqlPoolSettings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgresqlPoolSettings.js","sourceRoot":"","sources":["../src/postgresqlPoolSettings.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,wFAAwF;AACxF,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,0CAA0C;AAC1C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,uFAAuF;AACvF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAiBrC,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO;QACH,IAAI,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,WAAW;QAC/C,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,CAAC;QACxD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;QAClD,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,UAAU;QACtD,QAAQ,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE;KACrD,CAAC;AACN,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,kBAA0B;IAClE,OAAO,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,+BAA+B,CAC3C,QAA4B,EAC5B,QAA8B,EAC9B,OAA8B;IAE9B,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACH,GAAG,QAAQ;YACX,cAAc,EAAE,uBAAuB;YACvC,kBAAkB,EAAE,4BAA4B;YAChD,iCAAiC,EAAE,CAAC;SACvC,CAAC;IACN,CAAC;IACD,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,KAAK,WAAW,CAAC;IACzC,OAAO;QACH,GAAG,QAAQ;QACX,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM;QAC/E,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;QACrC,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,IAAI,KAAK;QACnD,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,IAAI,KAAK;QAC5D,kBAAkB,EAAE,kBAAkB;QACtC,iCAAiC,EAAE,2BAA2B,CAAC,kBAAkB,CAAC;KACrF,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0B;IACrD,MAAM,IAAI,GAAe;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,MAAM,CAAC,cAAc;KAC7B,CAAC;IACF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1E,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC9F,IAAI,MAAM,CAAC,uBAAuB,KAAK,SAAS;QAAE,IAAI,CAAC,uBAAuB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAChH,IAAI,MAAM,CAAC,kBAAkB;QAAE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAClF,IAAI,MAAM,CAAC,iCAAiC;QAAE,IAAI,CAAC,mCAAmC,GAAG,MAAM,CAAC,iCAAiC,CAAC;IAClI,OAAO,IAAI,CAAC;AAChB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAChD,UAAwE,EACxE,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,UAAU,CAAC,kBAAkB,IAAI,UAAU,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,kBAAkB,EAAE,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,qBAAqB,EAAE,QAAQ,EAAE,GAAG,CAAC,qBAAqB,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,aAAqC;IAG7E,mDAAmD;IACnD;QACI,KAAK,EAAE,CAAC;QAJJ,UAAK,GAAgB,IAAI,CAAC;IAKlC,CAAC;IAEM,MAAM,KAAK,QAAQ;QACtB,OAAO,sBAAsB,CAAC,WAAW,EAA0B,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,IAAW,IAAI;QACX,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,IAAW,IAAI,CAAC,IAAiB;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACtB,CAAC;CACJ;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAAgC,EAAE,UAAkB;IACrG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7B;;;2JAGmJ,EACnJ,CAAC,UAAU,CAAC,CACf,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,GAAG,EAAE,kBAAkB,GAAG,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,kBAAkB,6BAA6B,UAAU,kGAAkG,CAAC,CAAC;IAC9N,CAAC;IACD,IAAI,GAAG,EAAE,gBAAgB,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,qJAAqJ,CAAC,CAAC;IACzK,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC"}

package/dist/realtimeWidget/widgetGuestElevation.d.ts

@@ -50,8 +50,10 @@ export declare function resolveWidgetGuestRunContext(userPayload: UserPayload, p
  * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
  * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
  * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
- * required: on the realtime path the agent authority is already server-side (the session config's
- * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ * required: the realtime target is the session config's `targetAgentID`, which the owner can edit, so
+ * the relay re-checks `CanRun` on it for the CALLER before this elevation. Direct actions are refused
+ * for these callers before elevation, so only the delegated agent run and the run-entity writes
+ * execute as the system user.
  *
  * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
  * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter

package/dist/realtimeWidget/widgetGuestElevation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG"}
+{"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG"}

package/dist/realtimeWidget/widgetGuestElevation.js

@@ -56,8 +56,10 @@ export async function resolveWidgetGuestRunContext(userPayload, provider) {
  * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
  * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
  * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
- * required: on the realtime path the agent authority is already server-side (the session config's
- * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ * required: the realtime target is the session config's `targetAgentID`, which the owner can edit, so
+ * the relay re-checks `CanRun` on it for the CALLER before this elevation. Direct actions are refused
+ * for these callers before elevation, so only the delegated agent run and the run-entity writes
+ * execute as the system user.
  *
  * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
  * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter

package/dist/realtimeWidget/widgetGuestElevation.js.map

@@ -1 +1 @@
-{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}
+{"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAGtE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}

package/dist/resolvers/ActionResolver.d.ts

@@ -34,8 +34,8 @@ export declare class RunActionInput {
      */
     Params?: ActionParamInput[];
     /**
-     * Whether to skip logging the action execution
-     * Defaults to false
+     * Ignored. A run started through this API always writes an action execution log row; the field
+     * remains so that clients which send it still validate.
      */
     SkipActionLog?: boolean;
 }
@@ -121,12 +121,39 @@ export declare class ActionResultOutput {
  */
 export declare class ActionResolver extends ResolverBase {
     /**
-     * Mutation for running an action
+     * Mutation for running an action.
+     *
+     * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+     * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+     * action has no such link, an action class that authorizes its caller itself. The run is always
+     * logged.
      * @param input The input parameters for running the action
      * @param ctx The GraphQL context containing user authentication information
      * @returns The result of running the action
      */
     RunAction(input: RunActionInput, ctx: AppContext): Promise<ActionResultOutput>;
+    /**
+     * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+     * only as row-level-security filters, and an action can reach data and services those filters never
+     * cover.
+     * @throws Error when there is no user or the session is scope-limited
+     */
+    private getRunActionPrincipal;
+    /**
+     * Refuses the run unless the caller is authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+     * tree and the role grants all come from the request's provider, or all from the global provider
+     * when the request carries none.
+     * @throws Error when the caller may not run the action
+     */
+    private assertCanRunAction;
+    /**
+     * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+     * user: this is the server's own authorization decision, so it must not depend on whether the
+     * caller can read that entity.
+     */
+    private loadActionAuthorizationIDs;
     /**
      * Finds an action by its ID
      * @param actionID The ID of the action to find
@@ -143,11 +170,10 @@ export declare class ActionResolver extends ResolverBase {
      */
     private parseActionParameters;
     /**
-     * Executes an action
+     * Executes an action. The run is always logged: a client cannot switch off the action execution log.
      * @param action The action to execute
      * @param user The user context
      * @param params The action parameters
-     * @param skipActionLog Whether to skip action logging
      * @returns The action result
      * @private
      */

package/dist/resolvers/ActionResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AACH,qBACa,gBAAgB;IAC3B;;OAEG;IAEH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IAEH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IAEH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBACa,cAAc;IACzB;;OAEG;IAEH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IAEH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,aAAa,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IAEH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAE/B;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,qBACa,kBAAkB;IAC7B;;OAEG;IAEH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBACa,cAAe,SAAQ,YAAY;IAC9C;;;;;OAKG;IAEG,SAAS,CACC,KAAK,EAAE,cAAc,EAC5B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAgC9B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA2B7B;;;;;;;;OAQG;YACW,aAAa;IAqB3B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;OAKG;IAEG,eAAe,CACL,KAAK,EAAE,iBAAiB,EAC/B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAsD9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;YACW,eAAe;IA4B7B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAUhC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;CAQpB"}
+{"version":3,"file":"ActionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI1D;;;GAGG;AACH,qBACa,gBAAgB;IAC3B;;OAEG;IAEH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IAEH,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IAEH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBACa,cAAc;IACzB;;OAEG;IAEH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAE5B;;;OAGG;IAEH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,aAAa,EAAE,iBAAiB,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,qBACa,iBAAiB;IAC5B;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IAEH,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IAEH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAE/B;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,qBACa,kBAAkB;IAC7B;;OAEG;IAEH,OAAO,EAAE,OAAO,CAAC;IAEjB;;OAEG;IAEH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IAEH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,qBACa,cAAe,SAAQ,YAAY;IAC9C;;;;;;;;;;;OAWG;IAEG,SAAS,CACC,KAAK,EAAE,cAAc,EAC5B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IA4B9B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAW7B;;;;;;OAMG;YACW,kBAAkB;IAchC;;;;OAIG;YACW,0BAA0B;IAiBxC;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA2B7B;;;;;;;OAOG;YACW,aAAa;IAoB3B;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IASzB;;;;;OAKG;IAEG,eAAe,CACL,KAAK,EAAE,iBAAiB,EAC/B,GAAG,EAAE,UAAU,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAsD9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;OAMG;YACW,eAAe;IA4B7B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAuB1B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IAUhC;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAiBzB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;CAQpB"}

package/dist/resolvers/ActionResolver.js

@@ -13,12 +13,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Resolver, Mutation, Arg, Ctx } from "type-graphql";
 import { ActionEngineServer } from "@memberjunction/actions";
 import { EntityActionEngineServer } from "@memberjunction/actions";
-import { CompositeKey, KeyValuePair, LogError } from "@memberjunction/core";
+import { Metadata, CompositeKey, KeyValuePair, LogError, RunView } from "@memberjunction/core";
+import { UserCache } from "@memberjunction/generic-database-provider";
 import { Field, InputType, ObjectType } from "type-graphql";
 import { KeyValuePairInput } from "../generic/KeyValuePairInput.js";
-import { CopyScalarsAndArrays, UUIDsEqual } from "@memberjunction/global";
+import { CopyScalarsAndArrays, EscapeSQLString, UUIDsEqual } from "@memberjunction/global";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
+import { EvaluateActionRunAuthorization, IsOwner } from "../auth/actionAuthorization.js";
 /**
  * Input type for action parameters
  * Used to pass parameters to actions when invoking them
@@ -149,30 +152,32 @@ export { ActionResultOutput };
  */
 let ActionResolver = class ActionResolver extends ResolverBase {
     /**
-     * Mutation for running an action
+     * Mutation for running an action.
+     *
+     * Scope-limited sessions are refused. Any other caller must be authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}: an Owner may run any action; anyone else needs a role that
+     * holds an authorization linked to the action through `MJ: Action Authorizations`, or, when the
+     * action has no such link, an action class that authorizes its caller itself. The run is always
+     * logged.
      * @param input The input parameters for running the action
      * @param ctx The GraphQL context containing user authentication information
      * @returns The result of running the action
      */
     async RunAction(input, ctx) {
         try {
+            const user = this.getRunActionPrincipal(ctx);
             // Check API key scope authorization for action execution
             await this.CheckAPIKeyScopeAuthorization('action:execute', input.ActionID, ctx.userPayload);
-            // Get the user from context
-            const user = ctx.userPayload.userRecord;
-            if (!user) {
-                throw new Error("User is not authenticated");
-            }
             // Initialize the action engine
             await ActionEngineServer.Instance.Config(false, user);
-            // Get the action by ID
             const action = this.findActionById(input.ActionID);
+            await this.assertCanRunAction(action, user, ctx.providers);
             // Parse the parameters
             const params = this.parseActionParameters(input.Params);
             // Run the action — thread the request-scoped provider so provider-bound
             // actions (e.g. the semantic find-* / Search Entity actions, which call
             // params.Provider.SearchEntity) run against the caller's metadata layer.
-            const result = await this.executeAction(action, user, params, ctx.providers, input.SkipActionLog);
+            const result = await this.executeAction(action, user, params, ctx.providers);
             // Return the result
             return this.createActionResult(result);
         }
@@ -180,6 +185,63 @@ let ActionResolver = class ActionResolver extends ResolverBase {
             return this.handleActionError(e);
         }
     }
+    /**
+     * The authenticated caller of RunAction. A scope-limited session is refused: its confinement exists
+     * only as row-level-security filters, and an action can reach data and services those filters never
+     * cover.
+     * @throws Error when there is no user or the session is scope-limited
+     */
+    getRunActionPrincipal(ctx) {
+        const user = ctx.userPayload?.userRecord;
+        if (!user) {
+            throw new Error("User is not authenticated");
+        }
+        if (IsScopeLimitedPrincipal(user)) {
+            throw new Error("RunAction is not permitted for scope-limited sessions");
+        }
+        return user;
+    }
+    /**
+     * Refuses the run unless the caller is authorized for the action — see
+     * {@link EvaluateActionRunAuthorization}. The `MJ: Action Authorizations` rows, the authorization
+     * tree and the role grants all come from the request's provider, or all from the global provider
+     * when the request carries none.
+     * @throws Error when the caller may not run the action
+     */
+    async assertCanRunAction(action, user, providers) {
+        if (IsOwner(user)) {
+            return; // an Owner may run any action, so nothing needs to be read
+        }
+        const provider = GetReadOnlyProvider(providers, { allowFallbackToReadWrite: true });
+        const actionAuthorizationIDs = await this.loadActionAuthorizationIDs(action.ID, provider);
+        const metadata = provider ?? Metadata.Provider; // global-provider-ok: fallback only when the request carries no provider
+        const actionAuthorizesCaller = ActionEngineServer.Instance.ActionAuthorizesCaller(action);
+        const decision = EvaluateActionRunAuthorization(user, actionAuthorizationIDs, metadata, actionAuthorizesCaller);
+        if (!decision.Allowed) {
+            throw new Error(`Not authorized to run action ${action.ID}: ${decision.Reason}`);
+        }
+    }
+    /**
+     * The AuthorizationID of each `MJ: Action Authorizations` row for the action. Read as the system
+     * user: this is the server's own authorization decision, so it must not depend on whether the
+     * caller can read that entity.
+     */
+    async loadActionAuthorizationIDs(actionID, provider) {
+        const systemUser = UserCache.Instance.GetSystemUser();
+        if (!systemUser) {
+            throw new Error("System user not found");
+        }
+        const result = await new RunView(provider).RunView({
+            EntityName: 'MJ: Action Authorizations',
+            ExtraFilter: `ActionID='${EscapeSQLString(actionID)}'`,
+            Fields: ['AuthorizationID'],
+            ResultType: 'simple'
+        }, systemUser);
+        if (!result.Success) {
+            throw new Error(`Could not read the authorizations for action ${actionID}: ${result.ErrorMessage}`);
+        }
+        return result.Results.map(row => row.AuthorizationID);
+    }
     /**
      * Finds an action by its ID
      * @param actionID The ID of the action to find
@@ -225,15 +287,14 @@ let ActionResolver = class ActionResolver extends ResolverBase {
         });
     }
     /**
-     * Executes an action
+     * Executes an action. The run is always logged: a client cannot switch off the action execution log.
      * @param action The action to execute
      * @param user The user context
      * @param params The action parameters
-     * @param skipActionLog Whether to skip action logging
      * @returns The action result
      * @private
      */
-    async executeAction(action, user, params, providers, skipActionLog) {
+    async executeAction(action, user, params, providers) {
         // Resolve the request-scoped provider. Prefer read-write (actions may mutate);
         // fall back to read-only, then to the engine's global-Metadata default when no
         // request providers are present (preserves prior behavior).
@@ -242,7 +303,7 @@ let ActionResolver = class ActionResolver extends ResolverBase {
             Action: action,
             ContextUser: user,
             Params: params,
-            SkipActionLog: skipActionLog,
+            SkipActionLog: false,
             Filters: [],
             Provider: provider
         });

package/dist/resolvers/ActionResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActionResolver.js","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAkC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAoB5B,CAAA;AAfC;IADC,KAAK,EAAE;;8CACK;AAOb;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACZ;AAOd;IADC,KAAK,EAAE;;8CACK;AAnBF,gBAAgB;IAD5B,SAAS,EAAE;GACC,gBAAgB,CAoB5B;;AAED;;GAEG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;CAmB1B,CAAA;AAdC;IADC,KAAK,EAAE;;gDACS;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACxB;AAO5B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACjB;AAlBb,cAAc;IAD1B,SAAS,EAAE;GACC,cAAc,CAmB1B;;AAED;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;;wDACE;AALxB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAM7B;;AAED;;GAEG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAsD7B,CAAA;AAjDC;IADC,KAAK,EAAE;;yDACe;AAMvB;IADC,KAAK,EAAE;;yDACe;AAOvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpB;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACtB;AAOlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACtC,iBAAiB;qDAAC;AAO/B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAOhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAMhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AArDjB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAsD7B;;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAyB9B,CAAA;AApBC;IADC,KAAK,EAAE;;mDACS;AAMjB;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACT;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAOpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAxBT,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAyB9B;;AAED;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,YAAY;IAC9C;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,SAAS,CACC,KAAqB,EAC5B,GAAe;QAEtB,IAAI,CAAC;YACH,yDAAyD;YACzD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAE5F,4BAA4B;YAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,+BAA+B;YAC/B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEtD,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEnD,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAExD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAElG,oBAAoB;YACpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,QAAgB;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAAgC;QAC5D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;YAEzB,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;oBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,4CAA4C;gBAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;gBACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;aACtE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CACzB,MAAW,EACX,IAAc,EACd,MAAqB,EACrB,SAA8B,EAC9B,aAAuB;QAEvB,+EAA+E;QAC/E,+EAA+E;QAC/E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QACjG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC;YACjD,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,aAAa;YAC5B,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,MAAoB;QAC7C,MAAM,CAAC,GAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAM;QACpE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU;YACrC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,CAAU;QAClC,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2BAA2B,KAAK,CAAC,OAAO,EAAE;SACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,eAAe,CACL,KAAwB,EAC/B,GAAe;QAEtB,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAElG,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,sCAAsC;YACtC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAE5D,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEhE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAE/E,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEtC,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2FAA2F;gBAC3F,4FAA4F;gBAC5F,uFAAuF;gBACvF,2FAA2F;gBAC3F,iDAAiD;gBACjD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,4EAA4E;oBACrF,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YAED,oBAAoB;YACpB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,QAAgB;QACtC,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,YAAiB,EAAE,kBAA0B,EAAE,IAAc;QACpF,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5C,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,SAA8B,EAAE,MAAW,EAAE,KAAwB,EAAE,IAAc;QACjH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE1C,gCAAgC;QAChC,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,oDAAoD;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,MAAW,EAAE,UAA6B;QACnE,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC3C,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAQ,GAAG,CAAC,KAAK,CAAC;YAE3B,uDAAuD;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;YAC3B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,KAAU,EAAE,KAAU;QACrD,uDAAuD;QACvD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAW,EAAE,KAAwB;QAC7D,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,CAAmB;QAC/C,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;QAEzB,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;YACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;SACtE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,CAAU;QAC5B,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kCAAkC,KAAK,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;CACF,CAAA;AApYO;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,cAAc;;+CAgCpC;AAwHK;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,iBAAiB;;qDAsDvC;AAxNU,cAAc;IAD1B,QAAQ,EAAE;GACE,cAAc,CA4Y1B"}
+{"version":3,"file":"ActionResolver.js","sourceRoot":"","sources":["../../src/resolvers/ActionResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAwB,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAwB,MAAM,sBAAsB,CAAC;AAE3I,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAEzF;;;GAGG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAoB5B,CAAA;AAfC;IADC,KAAK,EAAE;;8CACK;AAOb;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACZ;AAOd;IADC,KAAK,EAAE;;8CACK;AAnBF,gBAAgB;IAD5B,SAAS,EAAE;GACC,gBAAgB,CAoB5B;;AAED;;GAEG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;CAmB1B,CAAA;AAdC;IADC,KAAK,EAAE;;gDACS;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CACxB;AAO5B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACjB;AAlBb,cAAc;IAD1B,SAAS,EAAE;GACC,cAAc,CAmB1B;;AAED;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AADC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;;wDACE;AALxB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAM7B;;AAED;;GAEG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAsD7B,CAAA;AAjDC;IADC,KAAK,EAAE;;yDACe;AAMvB;IADC,KAAK,EAAE;;yDACe;AAOvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpB;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACtB;AAOlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BACtC,iBAAiB;qDAAC;AAO/B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAOhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AAMhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACxB;AArDjB,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAsD7B;;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAyB9B,CAAA;AApBC;IADC,KAAK,EAAE;;mDACS;AAMjB;IADC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACT;AAMjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAOpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACpB;AAxBT,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAyB9B;;AAED;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,YAAY;IAC9C;;;;;;;;;;;OAWG;IAEG,AAAN,KAAK,CAAC,SAAS,CACC,KAAqB,EAC5B,GAAe;QAEtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAE7C,yDAAyD;YACzD,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAE5F,+BAA+B;YAC/B,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAE3D,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAExD,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAE7E,oBAAoB;YACpB,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,GAAe;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAA8B,EAAE,IAAc,EAAE,SAA8B;QAC7G,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,2DAA2D;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,yEAAyE;QACzH,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,8BAA8B,CAAC,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAChH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,0BAA0B,CAAC,QAAgB,EAAE,QAAqC;QAC9F,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAA8B;YAC9E,UAAU,EAAE,2BAA2B;YACvC,WAAW,EAAE,aAAa,eAAe,CAAC,QAAQ,CAAC,GAAG;YACtD,MAAM,EAAE,CAAC,iBAAiB,CAAC;YAC3B,UAAU,EAAE,QAAQ;SACrB,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,gDAAgD,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,QAAgB;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAAgC;QAC5D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACzB,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;YAEzB,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;oBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,4CAA4C;gBAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;gBACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;aACtE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,MAA8B,EAC9B,IAAc,EACd,MAAqB,EACrB,SAA8B;QAE9B,+EAA+E;QAC/E,+EAA+E;QAC/E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;QACjG,OAAO,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC;YACjD,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,MAAoB;QAC7C,MAAM,CAAC,GAAE,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ;YACxC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAM;QACpE,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU;YACrC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,CAAU;QAClC,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2BAA2B,KAAK,CAAC,OAAO,EAAE;SACpD,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,eAAe,CACL,KAAwB,EAC/B,GAAe;QAEtB,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,IAAI,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAElG,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,sCAAsC;YACtC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAE5D,8BAA8B;YAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YAEhE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAE/E,kEAAkE;YAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1G,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjE,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAEtC,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2FAA2F;gBAC3F,4FAA4F;gBAC5F,uFAAuF;gBACvF,2FAA2F;gBAC3F,iDAAiD;gBACjD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,4EAA4E;oBACrF,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YAED,oBAAoB;YACpB,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,QAAgB;QACtC,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,YAAY,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,YAAiB,EAAE,kBAA0B,EAAE,IAAc;QACpF,OAAO;YACL,YAAY,EAAE,YAAY;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;YAC5C,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,eAAe,CAAC,SAA8B,EAAE,MAAW,EAAE,KAAwB,EAAE,IAAc;QACjH,MAAM,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAE1C,gCAAgC;QAChC,IAAI,MAAM,CAAC;QACX,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,QAAQ,YAAY,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QAED,oDAAoD;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,YAAY,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;IACxC,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,MAAW,EAAE,UAA6B;QACnE,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;QAExC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC3C,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAQ,GAAG,CAAC,KAAK,CAAC;YAE3B,uDAAuD;YACvD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;YAC3B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACK,wBAAwB,CAAC,KAAU,EAAE,KAAU;QACrD,uDAAuD;QACvD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpG,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAW,EAAE,KAAwB;QAC7D,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,0BAA0B;QAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,wCAAwC;QACxC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,CAAmB;QAC/C,IAAI,KAAK,GAAQ,CAAC,CAAC,KAAK,CAAC;QAEzB,uCAAuC;QACvC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC3D,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,4CAA4C;YAC5C,MAAM,KAAK,GAAG,CAAU,CAAC;YACzB,QAAQ,CAAC,4CAA4C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,OAAO,CAAC,uDAAuD;SACtE,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,CAAU;QAC5B,MAAM,KAAK,GAAG,CAAU,CAAC;QACzB,QAAQ,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kCAAkC,KAAK,CAAC,OAAO,EAAE;SAC3D,CAAC;IACJ,CAAC;CACF,CAAA;AA1bO;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,cAAc;;+CA4BpC;AAkLK;IADL,QAAQ,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC;IAEhC,WAAA,GAAG,CAAC,OAAO,CAAC,CAAA;IACZ,WAAA,GAAG,EAAE,CAAA;;qCADe,iBAAiB;;qDAsDvC;AApRU,cAAc;IAD1B,QAAQ,EAAE;GACE,cAAc,CAwc1B"}