@open-mercato/core 0.7.1-develop.7154.1.981330c924 → 0.7.1-develop.7171.1.9b31dbba45

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4388 entry points
+[build:core] found 4409 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/AGENTS.md

@@ -657,7 +657,7 @@ Run `yarn generate` or rely on `predev`/`prebuild`.
 
 ## Response Enrichers
 
-Response enrichers let a module add computed fields to another module's CRUD API responses (similar to GraphQL Federation).
+Response enrichers add computed fields to other modules' CRUD API responses.
 
 ### Creating an Enricher
 
@@ -668,7 +668,7 @@ import type { ResponseEnricher } from '@open-mercato/shared/lib/crud/response-en
 
 const myEnricher: ResponseEnricher = {
   id: 'mymodule.customer-metrics',
-  targetEntity: 'customers.person',     // entity to enrich
+  targetEntity: 'customers.person',     // use '*' for all; context.targetEntity stays concrete
   features: ['mymodule.view'],           // required ACL features
   priority: 10,                          // higher runs first
   timeout: 2000,                         // ms, default 2000

package/dist/modules/auth/commands/users.js

@@ -10,7 +10,16 @@ import {
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { UniqueConstraintViolationException, LockMode } from "@mikro-orm/core";
-import { User, UserRole, Role, UserAcl, Session, PasswordReset } from "@open-mercato/core/modules/auth/data/entities";
+import {
+  User,
+  UserRole,
+  Role,
+  UserAcl,
+  Session,
+  PasswordReset,
+  UserSidebarPreference,
+  SidebarVariant
+} from "@open-mercato/core/modules/auth/data/entities";
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { resolveOrganizationScope } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { E } from "../../../generated/entities.ids.generated.js";
@@ -271,6 +280,8 @@ const createUserCommand = {
         await em.nativeDelete(UserRole, { user: userId });
         await em.nativeDelete(Session, { user: userId });
         await em.nativeDelete(PasswordReset, { user: userId });
+        await em.nativeDelete(UserSidebarPreference, { user: userId });
+        await em.nativeDelete(SidebarVariant, { user: userId });
         if (snapshot?.custom && Object.keys(snapshot.custom).length) {
           const reset = buildCustomFieldResetMap(void 0, snapshot.custom);
           if (Object.keys(reset).length) {
@@ -774,6 +785,8 @@ const deleteUserCommand = {
         await em.nativeDelete(UserRole, { user: id });
         await em.nativeDelete(Session, { user: id });
         await em.nativeDelete(PasswordReset, { user: id });
+        await em.nativeDelete(UserSidebarPreference, { user: id });
+        await em.nativeDelete(SidebarVariant, { user: id });
         const removed = await de.deleteOrmEntity({
           entity: User,
           where: deleteWhere,

package/dist/modules/auth/commands/users.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/commands/users.ts"],
-  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { UniqueConstraintViolationException, LockMode } from '@mikro-orm/core'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { User, UserRole, Role, UserAcl, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { resolveOrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { E } from '#generated/entities.ids.generated'\nimport { z } from 'zod'\nimport {\n  loadCustomFieldSnapshot,\n  buildCustomFieldResetMap,\n  diffCustomFieldChanges,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport InviteUserEmail from '@open-mercato/core/modules/auth/emails/InviteUserEmail'\nimport { INVITE_TOKEN_TTL_MS } from '@open-mercato/core/modules/auth/lib/inviteToken'\nimport { getSecurityEmailBaseUrl } from '@open-mercato/shared/lib/url'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  assertActorCanAssignUserDestination,\n  resolveUserDestinationRoles,\n  throwUserDestinationOrganizationNotFound,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\nconst logger = createLogger('auth').child({ component: 'users-commands' })\n\ntype SerializedUser = {\n  email: string\n  organizationId: string | null\n  tenantId: string | null\n  roles: string[]\n  name: string | null\n  isConfirmed: boolean\n  custom?: Record<string, unknown>\n}\n\ntype UserAclSnapshot = {\n  tenantId: string\n  features: string[] | null\n  isSuperAdmin: boolean\n  organizations: string[] | null\n}\n\ntype UserUndoSnapshot = {\n  id: string\n  email: string\n  organizationId: string | null\n  tenantId: string | null\n  passwordHash: string | null\n  name: string | null\n  isConfirmed: boolean\n  roles: string[]\n  acls: UserAclSnapshot[]\n  custom?: Record<string, unknown>\n}\n\ntype UserSnapshots = {\n  view: SerializedUser\n  undo: UserUndoSnapshot\n}\n\nfunction resolveActorTenantScope(ctx: CommandRuntimeContext): string | null {\n  if (ctx.systemActor === true) return null\n  const auth = ctx.auth\n  if (!auth) return null\n  if ((auth as { isSuperAdmin?: boolean }).isSuperAdmin === true) return null\n  const actorTenantId = normalizeTenantId(auth.tenantId ?? null) ?? null\n  return actorTenantId\n}\n\nfunction assertTargetTenantInScope(actorTenantScope: string | null, targetTenantId: unknown, notFoundError: string): void {\n  if (!actorTenantScope) return\n  const targetTenant = normalizeTenantId(targetTenantId) ?? null\n  if (!targetTenant || targetTenant !== actorTenantScope) {\n    throw new CrudHttpError(404, { error: notFoundError })\n  }\n}\n\nconst passwordSchema = buildPasswordSchema()\n\nconst displayNameSchema = z.preprocess(\n  normalizeDisplayNameInput,\n  z.string().trim().min(1).max(120).nullable().optional(),\n)\n\nconst createSchema = z.object({\n  email: z.string().email(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  organizationId: z.string().uuid(),\n  roles: z.array(z.string()).optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nconst updateSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email().optional(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  organizationId: z.string().uuid().optional(),\n  roles: z.array(z.string()).optional(),\n  isConfirmed: z.boolean().optional(),\n})\n\nexport const userCrudEvents: CrudEventsConfig = {\n  module: 'auth',\n  entity: 'user',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nexport const userCrudIndexer: CrudIndexerConfig = {\n  entityType: E.auth.user,\n  buildUpsertPayload: (ctx) => ({\n    entityType: E.auth.user,\n    recordId: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n  buildDeletePayload: (ctx) => ({\n    entityType: E.auth.user,\n    recordId: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nasync function notifyRoleChanges(\n  ctx: CommandRuntimeContext,\n  user: User,\n  assignedRoles: string[],\n  revokedRoles: string[],\n): Promise<void> {\n  const tenantId = user.tenantId ? String(user.tenantId) : null\n  if (!tenantId) return\n  const organizationId = user.organizationId ? String(user.organizationId) : null\n\n  try {\n    const notificationService = resolveNotificationService(ctx.container)\n    if (assignedRoles.length) {\n      const assignedType = notificationTypes.find((type) => type.type === 'auth.role.assigned')\n      if (assignedType) {\n        const notificationInput = buildNotificationFromType(assignedType, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, { tenantId, organizationId })\n      }\n    }\n\n    if (revokedRoles.length) {\n      const revokedType = notificationTypes.find((type) => type.type === 'auth.role.revoked')\n      if (revokedType) {\n        const notificationInput = buildNotificationFromType(revokedType, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, { tenantId, organizationId })\n      }\n    }\n  } catch (err) {\n    logger.error('Failed to create notification', { err })\n  }\n}\n\ntype CreateUserResult = { user: User; warning?: 'invite_email_failed' }\n\nconst createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResult> = {\n  id: 'auth.users.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n\n    const organization = await findOneWithDecryption(\n      em,\n      Organization,\n      { id: parsed.organizationId },\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId: parsed.organizationId },\n    )\n    if (!organization) throw new CrudHttpError(400, { error: 'Organization not found' })\n    const tenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n    assertTargetTenantInScope(resolveActorTenantScope(ctx), tenantId, 'Organization not found')\n\n    const emailHash = computeEmailHash(parsed.email)\n    // Email is unique per-tenant, not globally (see Migration20260610120000:\n    // users_tenant_email_hash_uniq). Scope the duplicate check to the target tenant so the same\n    // email may legitimately exist in other tenants without blocking creation or leaking\n    // cross-tenant account existence (#2934).\n    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }], deletedAt: null, tenantId } as any, {}, { tenantId: null, organizationId: null })\n    if (duplicate) await throwDuplicateEmailError()\n\n    let passwordHash: string | null = null\n    if (parsed.password) {\n      const { hash } = await import('bcryptjs')\n      passwordHash = await hash(parsed.password, 10)\n    }\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let user: User\n    try {\n      user = await de.createOrmEntity({\n        entity: User,\n        data: {\n          email: parsed.email,\n          name: parsed.name,\n          emailHash,\n          passwordHash,\n          isConfirmed: true,\n          organizationId: parsed.organizationId,\n          tenantId,\n        },\n      })\n    } catch (error) {\n      if (isUniqueViolation(error)) await throwDuplicateEmailError()\n      throw error\n    }\n\n    let assignedRoles: string[] = []\n    if (Array.isArray(parsed.roles) && parsed.roles.length) {\n      await syncUserRoles(em, user, parsed.roles, tenantId)\n      assignedRoles = await loadUserRoleNames(em, String(user.id))\n    }\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.user,\n      recordId: String(user.id),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: tenantId,\n      values: custom,\n    })\n\n    let inviteEmailSent = false\n    if (parsed.sendInviteEmail) {\n      const inviteResult = await sendInviteToUser(em, user)\n      inviteEmailSent = inviteResult.emailSent\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: user,\n      identifiers: {\n        id: String(user.id),\n        organizationId: user.organizationId ? String(user.organizationId) : null,\n        tenantId,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    if (assignedRoles.length && !parsed.sendInviteEmail) {\n      await notifyRoleChanges(ctx, user, assignedRoles, [])\n    }\n\n    const warning = (parsed.sendInviteEmail && !inviteEmailSent) ? 'invite_email_failed' as const : undefined\n\n    return { user, warning }\n  },\n  captureAfter: async (_input, { user }, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(user.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(user.id),\n      user.tenantId ? String(user.tenantId) : null,\n      user.organizationId ? String(user.organizationId) : null\n    )\n    return serializeUser(user, roles, custom)\n  },\n  buildLog: async ({ result: { user }, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(user.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(user.id),\n      user.tenantId ? String(user.tenantId) : null,\n      user.organizationId ? String(user.organizationId) : null\n    )\n    const snapshot = captureUserSnapshots(user, roles, undefined, custom)\n    return {\n      actionLabel: translate('auth.audit.users.create', 'Create user'),\n      resourceKind: 'auth.user',\n      resourceId: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      snapshotAfter: snapshot.view,\n      payload: {\n        undo: {\n          after: snapshot.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const userId = typeof logEntry?.resourceId === 'string' ? logEntry.resourceId : null\n    if (!userId) return\n    const snapshot = logEntry?.snapshotAfter as SerializedUser | undefined\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    // Evaluate the floor against the user's CURRENT tenant, not the one recorded at\n    // creation. A user moved to another tenant after being created would otherwise be\n    // checked against the origin tenant \u2014 where they no longer hold anything \u2014 and the\n    // undo would hard-delete the destination tenant's last administrator unchecked.\n    // The create snapshot is only a fallback for a row that is already gone.\n    let removed: User | null = null\n    await withAtomicFlush(em, [\n      async () => {\n        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n        const floorTenantId = current?.tenantId ? String(current.tenantId) : (snapshot?.tenantId ?? null)\n\n        // Undoing a create hard-deletes the user, so it can strip a tenant's last active\n        // admin exactly like `auth.users.delete` can \u2014 promote a second admin, delete the\n        // first, then undo the promotion's create. Same guard applies.\n        await enforceProtectedRoleFloor(em, floorTenantId, userId, { deleting: true }, ctx)\n\n        await em.nativeDelete(UserAcl, { user: userId })\n        await em.nativeDelete(UserRole, { user: userId })\n        await em.nativeDelete(Session, { user: userId })\n        await em.nativeDelete(PasswordReset, { user: userId })\n\n        if (snapshot?.custom && Object.keys(snapshot.custom).length) {\n          const reset = buildCustomFieldResetMap(undefined, snapshot.custom)\n          if (Object.keys(reset).length) {\n            await setCustomFieldsIfAny({\n              dataEngine: de,\n              entityId: E.auth.user,\n              recordId: userId,\n              organizationId: snapshot.organizationId,\n              tenantId: snapshot.tenantId,\n              values: reset,\n              notify: false,\n            })\n          }\n        }\n        removed = await de.deleteOrmEntity({\n          entity: User,\n          where: { id: userId, deletedAt: null } as FilterQuery<User>,\n          soft: false,\n        })\n      },\n    ], { transaction: true, label: 'auth.users.create.undo' })\n\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: removed,\n      identifiers: {\n        id: userId,\n        organizationId: snapshot?.organizationId ?? null,\n        tenantId: snapshot?.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, userId)\n  },\n  // The create-undo hard-deletes the user, but the after-snapshot persists the\n  // original passwordHash (see captureUserSnapshots), so redo restores the row\n  // with the SAME id and the SAME hash \u2014 never fabricating credentials (#2506).\n  redo: async ({ logEntry, ctx }) => {\n    const after = resolveRedoSnapshot<UserUndoSnapshot>(logEntry)\n    if (!after) throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for user create' })\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const emailHash = computeEmailHash(after.email)\n\n    let user = await findOneWithDecryption(em, User, { id: after.id }, {}, { tenantId: null, organizationId: null })\n    await withAtomicFlush(em, [\n      async () => {\n        if (user) {\n          user.deletedAt = null\n          user.email = after.email\n          user.emailHash = emailHash\n          user.organizationId = after.organizationId ?? null\n          user.tenantId = after.tenantId ?? null\n          user.passwordHash = after.passwordHash ?? null\n          user.name = after.name ?? null\n          user.isConfirmed = after.isConfirmed\n          await em.flush()\n        } else {\n          user = await de.createOrmEntity({\n            entity: User,\n            data: {\n              id: after.id,\n              email: after.email,\n              emailHash,\n              organizationId: after.organizationId ?? null,\n              tenantId: after.tenantId ?? null,\n              passwordHash: after.passwordHash ?? null,\n              name: after.name ?? null,\n              isConfirmed: after.isConfirmed,\n            },\n          })\n        }\n\n        if (!user) return\n\n        await em.nativeDelete(UserRole, { user: after.id })\n        await syncUserRoles(em, user, after.roles, after.tenantId)\n        await restoreUserAcls(em, user, after.acls)\n\n        if (after.custom && Object.keys(after.custom).length) {\n          const reset = buildCustomFieldResetMap(after.custom, undefined)\n          if (Object.keys(reset).length) {\n            await setCustomFieldsIfAny({\n              dataEngine: de,\n              entityId: E.auth.user,\n              recordId: after.id,\n              organizationId: after.organizationId ?? null,\n              tenantId: after.tenantId ?? null,\n              values: reset,\n              notify: false,\n            })\n          }\n        }\n      },\n    ], { transaction: true })\n\n    if (!user) throw new CrudHttpError(400, { error: '[internal] redo failed to restore user row' })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: user,\n      identifiers: {\n        id: after.id,\n        organizationId: after.organizationId ?? null,\n        tenantId: after.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, after.id)\n\n    return { user }\n  },\n}\n\nasync function sendInviteToUser(\n  em: EntityManager,\n  user: User,\n): Promise<{ emailSent: boolean }> {\n  const rawToken = generateAuthToken()\n  const tokenHash = hashAuthToken(rawToken)\n  const expiresAt = new Date(Date.now() + INVITE_TOKEN_TTL_MS)\n  const row = em.create(PasswordReset, { user, token: tokenHash, expiresAt, createdAt: new Date() })\n  await em.persist(row).flush()\n\n  const base = getSecurityEmailBaseUrl()\n  const inviteUrl = `${base}/reset/${rawToken}`\n\n  const { translate } = await resolveTranslations()\n  const subject = translate('auth.email.invite.subject', 'You have been invited')\n  const copy = {\n    preview: translate('auth.email.invite.preview', 'Set up your account'),\n    title: translate('auth.email.invite.title', 'You have been invited'),\n    body: translate('auth.email.invite.body', 'An administrator has created an account for you. Click the link below to set your password. This link will expire in 48 hours.'),\n    cta: translate('auth.email.invite.cta', 'Set up your password'),\n    hint: translate('auth.email.invite.hint', 'If you did not expect this invitation, you can safely ignore this email.'),\n  }\n\n  let emailSent = true\n  try {\n    await sendEmail({\n      to: user.email,\n      subject,\n      react: InviteUserEmail({ inviteUrl, copy }),\n      tenantId: user.tenantId ? String(user.tenantId) : undefined,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    })\n  } catch (err) {\n    logger.error('Failed to send invitation email', { err })\n    emailSent = false\n  }\n\n  return { emailSent }\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  if (error instanceof UniqueConstraintViolationException) return true\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: string }).code\n  if (code === '23505') return true\n  const messageRaw = (error as { message?: string })?.message\n  const message = typeof messageRaw === 'string' ? messageRaw : ''\n  return message.toLowerCase().includes('duplicate key')\n}\n\nconst updateUserCommand: CommandHandler<Record<string, unknown>, User> = {\n  id: 'auth.users.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    assertTargetTenantInScope(resolveActorTenantScope(ctx), existing.tenantId, 'User not found')\n    const roles = await loadUserRoleNames(em, parsed.id)\n    const acls = await loadUserAclSnapshots(em, parsed.id)\n    const custom = await loadUserCustomSnapshot(\n      em,\n      parsed.id,\n      existing.tenantId ? String(existing.tenantId) : null,\n      existing.organizationId ? String(existing.organizationId) : null\n    )\n    return { before: captureUserSnapshots(existing, roles, acls, custom) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const actorTenantScope = resolveActorTenantScope(ctx)\n    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {\n      throw new CrudHttpError(404, { error: 'User not found' })\n    }\n\n    const rolesBefore = Array.isArray(parsed.roles)\n      ? await loadUserRoleNames(em, parsed.id)\n      : null\n\n    let tenantId: string | null | undefined\n    let destinationChanged = false\n    if (parsed.organizationId !== undefined) {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: parsed.organizationId },\n        { populate: ['tenant'] },\n        { tenantId: null, organizationId: parsed.organizationId ?? null },\n      )\n      if (!organization) return throwUserDestinationOrganizationNotFound(400)\n      tenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n      if (!tenantId) return throwUserDestinationOrganizationNotFound(400)\n      const currentUser = await findOneWithDecryption(\n        em,\n        User,\n        { id: parsed.id, deletedAt: null },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!currentUser) throw new CrudHttpError(404, { error: 'User not found' })\n      const currentOrganizationId = currentUser.organizationId ? String(currentUser.organizationId) : null\n      const currentTenantId = currentUser.tenantId ? String(currentUser.tenantId) : null\n      destinationChanged = currentOrganizationId !== parsed.organizationId || currentTenantId !== tenantId\n      if (destinationChanged) {\n        const rbacService = ctx.container.resolve('rbacService') as RbacService\n        const destinationRoles = await resolveUserDestinationRoles({\n          em,\n          targetUserId: parsed.id,\n          destinationTenantId: tenantId,\n          roleTokens: parsed.roles,\n        })\n        const actorIsSuperAdmin = ctx.systemActor === true || ctx.auth?.isSuperAdmin === true\n        const organizationScope = ctx.organizationScope?.tenantId === tenantId\n          ? ctx.organizationScope\n          : !actorIsSuperAdmin && ctx.auth?.sub\n            ? await resolveOrganizationScope({\n                em,\n                rbac: rbacService,\n                auth: ctx.auth,\n                tenantId,\n              })\n            : null\n        await assertActorCanAssignUserDestination({\n          em,\n          rbacService,\n          actorUserId: ctx.auth?.sub,\n          actorIsSuperAdmin,\n          tenantId: ctx.auth?.tenantId ?? null,\n          organizationId: ctx.auth?.orgId ?? null,\n          allowedOrganizationIds: organizationScope?.allowedIds,\n          destinationTenantId: tenantId,\n          destinationOrganizationId: parsed.organizationId,\n          roles: destinationRoles,\n        })\n      }\n    }\n\n    const userTenantId = existing.tenantId ? String(existing.tenantId) : null\n    const targetTenantId = tenantId !== undefined ? tenantId : userTenantId\n    const isTenantChanging = targetTenantId !== userTenantId\n\n    // Hash password BEFORE transaction begins to avoid holding locks during CPU-heavy tasks\n    let hashed: string | null = null\n    let emailHash: string | null = null\n    if (parsed.password) {\n      const { hash } = await import('bcryptjs')\n      hashed = await hash(parsed.password, 10)\n    }\n    if (parsed.email !== undefined) {\n      emailHash = computeEmailHash(parsed.email)\n    }\n\n    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }\n    if (actorTenantScope) updateWhere.tenantId = actorTenantScope\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let user!: User\n\n    await withAtomicFlush(em, [\n      async () => {\n        // Floor check must run inside the transaction so that LockMode.PESSIMISTIC_WRITE locks Role rows properly\n        await enforceProtectedRoleFloor(em, userTenantId, parsed.id, {\n          deactivating: parsed.isConfirmed === false || isTenantChanging,\n          newRoles: parsed.roles,\n        }, ctx)\n\n        // Email is unique per-tenant, not globally (see Migration20260610120000:\n        // users_tenant_email_hash_uniq) \u2014 a matching email in another tenant must not block\n        // the update or leak cross-tenant account existence (#2934). `targetTenantId` is the\n        // tenant the user will belong to after this update, so the check follows a move.\n        if (parsed.email !== undefined) {\n          const duplicate = await findOneWithDecryption(\n            em,\n            User,\n            {\n              $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],\n              deletedAt: null,\n              tenantId: targetTenantId,\n              id: { $ne: parsed.id } as any,\n            } as FilterQuery<User>,\n            {},\n            { tenantId: null, organizationId: null },\n          )\n          if (duplicate) await throwDuplicateEmailError()\n        }\n\n        try {\n          const updated = await de.updateOrmEntity({\n            entity: User,\n            where: updateWhere as FilterQuery<User>,\n            apply: (entity) => {\n              if (parsed.email !== undefined) {\n                entity.email = parsed.email\n                entity.emailHash = emailHash\n              }\n              if (parsed.name !== undefined) {\n                entity.name = parsed.name\n              }\n              if (parsed.organizationId !== undefined) {\n                entity.organizationId = parsed.organizationId\n                entity.tenantId = tenantId ?? null\n              }\n              if (parsed.isConfirmed !== undefined) {\n                entity.isConfirmed = parsed.isConfirmed\n              }\n              if (hashed) entity.passwordHash = hashed\n            },\n          })\n          if (updated) user = updated\n        } catch (error) {\n          if (isUniqueViolation(error)) await throwDuplicateEmailError()\n          throw error\n        }\n        if (!user) throw new CrudHttpError(404, { error: 'User not found' })\n\n        if (hashed || parsed.isConfirmed === false) {\n          await em.nativeDelete(Session, { user: parsed.id })\n        }\n\n        if (Array.isArray(parsed.roles)) {\n          await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null)\n        }\n\n        await setCustomFieldsIfAny({\n          dataEngine: de,\n          entityId: E.auth.user,\n          recordId: String(user.id),\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n          tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,\n          values: custom,\n        })\n      }\n    ], { transaction: true, label: destinationChanged ? 'auth.users.update.destination' : 'auth.users.update' })\n\n    const identifiers = {\n      id: String(user.id),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: user,\n      identifiers,\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    if (hashed) {\n      const actorId = ctx.auth?.sub ? String(ctx.auth.sub) : null\n      // `system` covers a command invocation with no auth context and one running under\n      // `ctx.systemActor`. Without it those writes would be indistinguishable from an\n      // administrator setting someone else's password, which is exactly the case security\n      // alerting escalates on. Password writes that never reach this command \u2014 `mercato\n      // auth set-password`, tenant provisioning \u2014 set `passwordHash` directly and emit\n      // nothing, so a subscriber cannot treat this event as covering every credential change.\n      const changedBy = ctx.systemActor === true || !actorId\n        ? 'system'\n        : actorId === identifiers.id ? 'self' : 'admin'\n      void emitAuthEvent('auth.password.changed', {\n        id: identifiers.id,\n        tenantId: identifiers.tenantId,\n        organizationId: identifiers.organizationId,\n        changedBy,\n        changedById: actorId,\n        at: new Date().toISOString(),\n      }, { persistent: true }).catch(() => undefined)\n    }\n\n    if (Array.isArray(parsed.roles) && rolesBefore) {\n      const rolesAfter = await loadUserRoleNames(em, String(user.id))\n      const { assigned, revoked } = diffRoleChanges(rolesBefore, rolesAfter)\n      if (assigned.length || revoked.length) {\n        await notifyRoleChanges(ctx, user, assigned, revoked)\n      }\n    }\n\n    await invalidateUserCache(ctx, parsed.id)\n\n    return user\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(result.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(result.id),\n      result.tenantId ? String(result.tenantId) : null,\n      result.organizationId ? String(result.organizationId) : null\n    )\n    return serializeUser(result, roles, custom)\n  },\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as UserSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterRoles = await loadUserRoleNames(em, String(result.id))\n    const afterCustom = await loadUserCustomSnapshot(\n      em,\n      String(result.id),\n      result.tenantId ? String(result.tenantId) : null,\n      result.organizationId ? String(result.organizationId) : null\n    )\n    const afterSnapshots = captureUserSnapshots(result, afterRoles, undefined, afterCustom)\n    const after = afterSnapshots.view\n    const changes = buildChanges(before ?? null, after as Record<string, unknown>, ['email', 'organizationId', 'tenantId', 'name', 'isConfirmed'])\n    if (before && !arrayEquals(before.roles, afterRoles)) {\n      changes.roles = { from: before.roles, to: afterRoles }\n    }\n    const customDiff = diffCustomFieldChanges(before?.custom, afterCustom)\n    for (const [key, diff] of Object.entries(customDiff)) {\n      changes[`cf_${key}`] = diff\n    }\n    return {\n      actionLabel: translate('auth.audit.users.update', 'Update user'),\n      resourceKind: 'auth.user',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      organizationId: result.organizationId ? String(result.organizationId) : null,\n      changes,\n      snapshotBefore: before ?? null,\n      snapshotAfter: after,\n      payload: {\n        undo: {\n          before: beforeUndo,\n          after: afterSnapshots.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<UndoPayload<UserUndoSnapshot>>(logEntry)\n    const before = payload?.before\n    const after = payload?.after\n    if (!before) return\n    const userId = before.id\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    // Reverting an update can drop the tenant below a protected role's floor just as the\n    // forward path can \u2014 restoring an empty `before.roles` on what is now the last admin,\n    // or restoring `isConfirmed: false`. Undo is reachable from the audit-log UI, so the\n    // guard has to run here too, inside a transaction so the row lock is valid.\n    const restoredTenantId = before.tenantId ? String(before.tenantId) : null\n\n    let updated: User | null = null\n    await withAtomicFlush(em, [\n      async () => {\n        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n        const currentTenantId = current?.tenantId ? String(current.tenantId) : null\n\n        await enforceProtectedRoleFloor(em, currentTenantId, userId, {\n          deactivating: before.isConfirmed === false || restoredTenantId !== currentTenantId,\n          newRoles: before.roles,\n        }, ctx)\n\n        updated = await de.updateOrmEntity({\n          entity: User,\n          where: { id: userId, deletedAt: null } as FilterQuery<User>,\n          apply: (entity) => {\n            entity.email = before.email\n            entity.organizationId = before.organizationId ?? null\n            entity.tenantId = before.tenantId ?? null\n            entity.passwordHash = before.passwordHash ?? null\n            entity.name = before.name ?? null\n            entity.isConfirmed = before.isConfirmed\n          },\n        })\n\n        if (updated) {\n          await syncUserRoles(em, updated, before.roles, before.tenantId)\n        }\n      },\n    ], { transaction: true, label: 'auth.users.update.undo' })\n\n    const reset = buildCustomFieldResetMap(before.custom, after?.custom)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.user,\n        recordId: before.id,\n        organizationId: before.organizationId ?? null,\n        tenantId: before.tenantId ?? null,\n        values: reset,\n        notify: false,\n      })\n    }\n\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: updated,\n      identifiers: {\n        id: before.id,\n        organizationId: before.organizationId ?? null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, userId)\n  },\n}\n\nconst deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, User> = {\n  id: 'auth.users.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'User id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) return {}\n    const actorTenantScope = resolveActorTenantScope(ctx)\n    if (actorTenantScope) {\n      const targetTenant = normalizeTenantId(existing.tenantId) ?? null\n      if (!targetTenant || targetTenant !== actorTenantScope) return {}\n    }\n    const roles = await loadUserRoleNames(em, id)\n    const acls = await loadUserAclSnapshots(em, id)\n    const custom = await loadUserCustomSnapshot(\n      em,\n      id,\n      existing.tenantId ? String(existing.tenantId) : null,\n      existing.organizationId ? String(existing.organizationId) : null\n    )\n    return { before: captureUserSnapshots(existing, roles, acls, custom) }\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'User id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const actorTenantScope = resolveActorTenantScope(ctx)\n\n    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {\n      throw new CrudHttpError(404, { error: 'User not found' })\n    }\n\n    const deleteWhere: Record<string, unknown> = { id, deletedAt: null }\n    if (actorTenantScope) deleteWhere.tenantId = actorTenantScope\n\n    let user!: User\n    await withAtomicFlush(em, [\n      async () => {\n        const userTenantId = existing.tenantId ? String(existing.tenantId) : null\n        await enforceProtectedRoleFloor(em, userTenantId, id, { deleting: true }, ctx)\n\n        await em.nativeDelete(UserAcl, { user: id })\n        await em.nativeDelete(UserRole, { user: id })\n        await em.nativeDelete(Session, { user: id })\n        await em.nativeDelete(PasswordReset, { user: id })\n        const removed = await de.deleteOrmEntity({\n          entity: User,\n          where: deleteWhere as FilterQuery<User>,\n          soft: false,\n        })\n        if (!removed) throw new CrudHttpError(404, { error: 'User not found' })\n        user = removed\n      },\n    ], { transaction: true })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: user,\n      identifiers: {\n        id: String(id),\n        organizationId: user.organizationId ? String(user.organizationId) : null,\n        tenantId: user.tenantId ? String(user.tenantId) : null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, id)\n\n    return user\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as UserSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const id = requireId(input, 'User id required')\n    return {\n      actionLabel: translate('auth.audit.users.delete', 'Delete user'),\n      resourceKind: 'auth.user',\n      resourceId: id,\n      snapshotBefore: before ?? null,\n      tenantId: before?.tenantId ?? null,\n      organizationId: before?.organizationId ?? null,\n      payload: {\n        undo: {\n          before: beforeUndo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<UndoPayload<UserUndoSnapshot>>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    let user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null })\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    await withAtomicFlush(em, [\n      async () => {\n        if (user) {\n          if (user.deletedAt) {\n            user.deletedAt = null\n          }\n          user.email = before.email\n          user.organizationId = before.organizationId ?? null\n          user.tenantId = before.tenantId ?? null\n          user.passwordHash = before.passwordHash ?? null\n          user.name = before.name ?? null\n          user.isConfirmed = before.isConfirmed\n          await em.flush()\n        } else {\n          user = await de.createOrmEntity({\n            entity: User,\n            data: {\n              id: before.id,\n              email: before.email,\n              organizationId: before.organizationId ?? null,\n              tenantId: before.tenantId ?? null,\n              passwordHash: before.passwordHash ?? null,\n              name: before.name ?? null,\n              isConfirmed: before.isConfirmed,\n            },\n          })\n        }\n\n        if (!user) return\n\n        await em.nativeDelete(UserRole, { user: before.id })\n        await syncUserRoles(em, user, before.roles, before.tenantId)\n\n        await restoreUserAcls(em, user, before.acls)\n\n        const reset = buildCustomFieldResetMap(before.custom, undefined)\n        if (Object.keys(reset).length) {\n          await setCustomFieldsIfAny({\n            dataEngine: de,\n            entityId: E.auth.user,\n            recordId: before.id,\n            organizationId: before.organizationId ?? null,\n            tenantId: before.tenantId ?? null,\n            values: reset,\n            notify: false,\n          })\n        }\n      },\n    ], { transaction: true })\n\n    await invalidateUserCache(ctx, before.id)\n  },\n}\n\nregisterCommand(createUserCommand)\nregisterCommand(updateUserCommand)\nregisterCommand(deleteUserCommand)\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nasync function resolveRole(\n  em: EntityManager,\n  value: string,\n  normalizedTenantId: string | null,\n): Promise<Role | null> {\n  if (UUID_RE.test(value)) {\n    const where: Record<string, unknown> = { id: value }\n    if (normalizedTenantId !== null) {\n      where.tenantId = normalizedTenantId\n    }\n    return findOneWithDecryption(em, Role, where as any, {}, { tenantId: normalizedTenantId, organizationId: null })\n  }\n  return findOneWithDecryption(em, Role, { name: value, tenantId: normalizedTenantId }, {}, { tenantId: normalizedTenantId, organizationId: null })\n}\n\nasync function syncUserRoles(em: EntityManager, user: User, desiredRoles: string[], tenantId: string | null) {\n  const unique = Array.from(new Set(desiredRoles.map((role) => role.trim()).filter(Boolean)))\n  const normalizedTenantId = normalizeTenantId(tenantId ?? null) ?? null\n\n  const resolvedRoles: Role[] = []\n  const missingRoles: string[] = []\n  for (const value of unique) {\n    const role = await resolveRole(em, value, normalizedTenantId)\n    if (!role) {\n      missingRoles.push(value)\n    } else {\n      resolvedRoles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((n) => `\"${n}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  const desiredIds = new Set(resolvedRoles.map((r) => String(r.id)))\n  const currentLinks = await findWithDecryption(em, UserRole, { user }, {}, { tenantId: null, organizationId: null })\n  const currentRoleIds = new Map(\n    currentLinks.map((link) => {\n      const roleId = String(link.role?.id ?? (link.role as unknown as string) ?? '')\n      return [roleId, link] as const\n    }),\n  )\n\n  for (const [roleId, link] of currentRoleIds.entries()) {\n    if (!desiredIds.has(roleId) && link) {\n      em.remove(link)\n    }\n  }\n\n  for (const role of resolvedRoles) {\n    if (!currentRoleIds.has(String(role.id))) {\n      em.persist(em.create(UserRole, { user, role, createdAt: new Date() }))\n    }\n  }\n\n  await em.flush()\n}\n\nasync function loadUserRoleNames(em: EntityManager, userId: string): Promise<string[]> {\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown as User },\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const names = links\n    .map((link) => link.role?.name ?? '')\n    .filter((name): name is string => !!name)\n  return Array.from(new Set(names)).sort((a, b) => a.localeCompare(b))\n}\n\nfunction serializeUser(user: User, roles: string[], custom?: Record<string, unknown> | null): SerializedUser {\n  const payload: SerializedUser = {\n    email: String(user.email ?? ''),\n    organizationId: user.organizationId ? String(user.organizationId) : null,\n    tenantId: user.tenantId ? String(user.tenantId) : null,\n    roles,\n    name: user.name ? String(user.name) : null,\n    isConfirmed: Boolean(user.isConfirmed),\n  }\n  if (custom && Object.keys(custom).length) payload.custom = custom\n  return payload\n}\n\nfunction captureUserSnapshots(\n  user: User,\n  roles: string[],\n  acls: UserAclSnapshot[] = [],\n  custom?: Record<string, unknown> | null\n): UserSnapshots {\n  return {\n    view: serializeUser(user, roles, custom),\n    undo: {\n      id: String(user.id),\n      email: String(user.email ?? ''),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      passwordHash: user.passwordHash ? String(user.passwordHash) : null,\n      name: user.name ? String(user.name) : null,\n      isConfirmed: Boolean(user.isConfirmed),\n      roles: [...roles],\n      acls,\n      ...(custom && Object.keys(custom).length ? { custom } : {}),\n    },\n  }\n}\n\nasync function loadUserAclSnapshots(em: EntityManager, userId: string): Promise<UserAclSnapshot[]> {\n  const list = await findWithDecryption(em, UserAcl, { user: userId as unknown as User }, {}, { tenantId: null, organizationId: null })\n  return list.map((acl) => ({\n    tenantId: String(acl.tenantId),\n    features: Array.isArray(acl.featuresJson) ? [...acl.featuresJson] : null,\n    isSuperAdmin: Boolean(acl.isSuperAdmin),\n    organizations: Array.isArray(acl.organizationsJson) ? [...acl.organizationsJson] : null,\n  }))\n}\n\nasync function restoreUserAcls(em: EntityManager, user: User, acls: UserAclSnapshot[]) {\n  await em.nativeDelete(UserAcl, { user: String(user.id) })\n  for (const acl of acls) {\n    const entity = em.create(UserAcl, {\n      user,\n      tenantId: acl.tenantId,\n      featuresJson: acl.features ?? null,\n      isSuperAdmin: acl.isSuperAdmin,\n      organizationsJson: acl.organizations ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\nasync function loadUserCustomSnapshot(\n  em: EntityManager,\n  id: string,\n  tenantId: string | null,\n  organizationId: string | null\n): Promise<Record<string, unknown>> {\n  return await loadCustomFieldSnapshot(em, {\n    entityId: E.auth.user,\n    recordId: id,\n    tenantId,\n    organizationId,\n  })\n}\n\nasync function invalidateUserCache(ctx: CommandRuntimeContext, userId: string) {\n  try {\n    const rbacService = ctx.container.resolve('rbacService') as { invalidateUserCache: (uid: string) => Promise<void> }\n    await rbacService.invalidateUserCache(userId)\n  } catch {\n    // RBAC not available\n  }\n\n  try {\n    const cache = ctx.container.resolve('cache') as { deleteByTags?: (tags: string[]) => Promise<void> }\n    if (cache?.deleteByTags) await cache.deleteByTags([`rbac:user:${userId}`])\n  } catch {\n    // cache not available\n  }\n}\n\nfunction diffRoleChanges(before: string[], after: string[]) {\n  const beforeSet = new Set(before)\n  const afterSet = new Set(after)\n  const assigned = after.filter((role) => !beforeSet.has(role))\n  const revoked = before.filter((role) => !afterSet.has(role))\n  return { assigned, revoked }\n}\n\nfunction arrayEquals(left: string[] | undefined, right: string[]): boolean {\n  if (!left) return false\n  if (left.length !== right.length) return false\n  return left.every((value, idx) => value === right[idx])\n}\n\nasync function throwDuplicateEmailError(): Promise<never> {\n  const { translate } = await resolveTranslations()\n  const message = translate('auth.users.errors.emailExists', 'Email already in use')\n  throw new CrudHttpError(400, {\n    error: message,\n    fieldErrors: { email: message },\n    details: [{ path: ['email'], message, code: 'duplicate', origin: 'validation' }],\n  })\n}\n\ntype ProtectedRoleFloorOptions = {\n  deactivating?: boolean\n  newRoles?: string[]\n  deleting?: boolean\n}\n\n/**\n * True when the requested mutation can lower a role's active holder count. Guards the\n * floor check so that ordinary edits (display name, password, email) never take the\n * tenant-wide role lock \u2014 `PUT /api/auth/profile` routes every self-service password\n * change through `auth.users.update`, so an unconditional lock would serialize them.\n */\nfunction couldReduceActiveHolders(options: ProtectedRoleFloorOptions): boolean {\n  return options.deleting === true || options.deactivating === true || options.newRoles !== undefined\n}\n\nasync function enforceProtectedRoleFloor(\n  em: EntityManager,\n  tenantId: string | null,\n  userId: string,\n  options: ProtectedRoleFloorOptions,\n  ctx?: CommandRuntimeContext,\n): Promise<void> {\n  // Internal automation (CLI, migrations, tenant teardown) must never be blocked by the\n  // floor. Superadmins are deliberately NOT exempt \u2014 see the spec's Risks section.\n  if (ctx?.systemActor === true) return\n  if (!couldReduceActiveHolders(options)) return\n\n  const normalizedTenantId = normalizeTenantId(tenantId) ?? null\n  if (!normalizedTenantId) return\n\n  // Find all protected roles in this tenant, acquiring a pessimistic write lock in a deterministic primary key order\n  const protectedRoles = await findWithDecryption(em, Role, {\n    tenantId: normalizedTenantId,\n    minActiveHolders: { $gt: 0 },\n    deletedAt: null\n  }, {\n    lockMode: LockMode.PESSIMISTIC_WRITE,\n    orderBy: { id: 'ASC' }\n  }, { tenantId: normalizedTenantId, organizationId: null })\n\n  if (protectedRoles.length === 0) return\n\n  const { translate } = await resolveTranslations()\n\n  for (const role of protectedRoles) {\n    const minFloor = role.minActiveHolders ?? 0\n    if (minFloor <= 0) continue\n\n    // Active links for this role, scoped to the tenant by the nested user filter so the\n    // database \u2014 not a post-filter \u2014 enforces isolation. Deliberately NOT populated:\n    // `findWithDecryption` runs `decryptEntityGraph` over loaded relations, which would\n    // decrypt every admin's email and name on each check just to read their ids.\n    const activeLinks = await findWithDecryption(em, UserRole, {\n      role: role.id,\n      deletedAt: null,\n      user: {\n        deletedAt: null,\n        isConfirmed: true,\n        tenantId: normalizedTenantId\n      }\n    }, {}, { tenantId: null, organizationId: null })\n\n    // Count distinct user IDs in the tenant holding this role to prevent overcounting due to duplicate links\n    const activeUserIds = Array.from(\n      new Set(\n        activeLinks\n          .map((link) => {\n            const userRef = link.user as unknown as { id?: string } | string | null | undefined\n            const linkedUserId = typeof userRef === 'string' ? userRef : userRef?.id\n            return linkedUserId ? String(linkedUserId) : null\n          })\n          .filter((id): id is string => !!id)\n      )\n    )\n\n    // Is the target user currently one of the active holders?\n    if (activeUserIds.includes(userId)) {\n      // Determine if they will remain an active holder\n      let willStillBeActiveHolder = true\n\n      if (options.deleting || options.deactivating) {\n        willStillBeActiveHolder = false\n      } else if (options.newRoles !== undefined) {\n        // Checking role list\n        const desiredUnique = Array.from(new Set(options.newRoles.map((r) => r.trim().toLowerCase()).filter(Boolean)))\n        const roleNameLower = role.name.toLowerCase()\n        const hasRoleByName = desiredUnique.includes(roleNameLower) || desiredUnique.includes(String(role.id).toLowerCase())\n        if (!hasRoleByName) {\n          willStillBeActiveHolder = false\n        }\n      }\n\n      if (!willStillBeActiveHolder) {\n        const remaining = activeUserIds.length - 1\n        if (remaining < minFloor) {\n          throw new CrudHttpError(400, {\n            error: translate('auth.users.errors.lastHolderOfCriticalRole', 'Cannot remove the last active holder of role \"{roleName}\"', { roleName: role.name })\n          })\n        }\n      }\n    }\n  }\n}\n"],
-  "mappings": "AACA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAI9B,SAAS,2BAA2B;AACpC,SAAS,oCAAoC,gBAAgB;AAE7D,SAAS,MAAM,UAAU,MAAM,SAAS,SAAS,qBAAqB;AACtE,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC,SAAS,SAAS;AAClB,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA4C;AACrD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAC1B,OAAO,qBAAqB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAqCzE,SAAS,wBAAwB,KAA2C;AAC1E,MAAI,IAAI,gBAAgB,KAAM,QAAO;AACrC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAoC,iBAAiB,KAAM,QAAO;AACvE,QAAM,gBAAgB,kBAAkB,KAAK,YAAY,IAAI,KAAK;AAClE,SAAO;AACT;AAEA,SAAS,0BAA0B,kBAAiC,gBAAyB,eAA6B;AACxH,MAAI,CAAC,iBAAkB;AACvB,QAAM,eAAe,kBAAkB,cAAc,KAAK;AAC1D,MAAI,CAAC,gBAAgB,iBAAiB,kBAAkB;AACtD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,EACvD;AACF;AAEA,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,oBAAoB,EAAE;AAAA,EAC1B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACxD;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACtC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAEM,MAAM,iBAAmC;AAAA,EAC9C,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEO,MAAM,kBAAqC;AAAA,EAChD,YAAY,EAAE,KAAK;AAAA,EACnB,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AAAA,EACA,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,eAAe,kBACb,KACA,MACA,eACA,cACe;AACf,QAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,MAAI,CAAC,SAAU;AACf,QAAM,iBAAiB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAE3E,MAAI;AACF,UAAM,sBAAsB,2BAA2B,IAAI,SAAS;AACpE,QAAI,cAAc,QAAQ;AACxB,YAAM,eAAe,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,oBAAoB;AACxF,UAAI,cAAc;AAChB,cAAM,oBAAoB,0BAA0B,cAAc;AAAA,UAChE,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB,EAAE,UAAU,eAAe,CAAC;AAAA,MAClF;AAAA,IACF;AAEA,QAAI,aAAa,QAAQ;AACvB,YAAM,cAAc,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,mBAAmB;AACtF,UAAI,aAAa;AACf,cAAM,oBAAoB,0BAA0B,aAAa;AAAA,UAC/D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB,EAAE,UAAU,eAAe,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,iCAAiC,EAAE,IAAI,CAAC;AAAA,EACvD;AACF;AAIA,MAAM,oBAA+E;AAAA,EACnF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AAEtC,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,OAAO,eAAe;AAAA,MAC5B,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,gBAAgB,OAAO,eAAe;AAAA,IAC1D;AACA,QAAI,CAAC,aAAc,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACnF,UAAM,WAAW,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AAC5E,8BAA0B,wBAAwB,GAAG,GAAG,UAAU,wBAAwB;AAE1F,UAAM,YAAY,iBAAiB,OAAO,KAAK;AAK/C,UAAM,YAAY,MAAM,sBAAsB,IAAI,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,OAAO,KAAK,EAAE,EAAE,CAAC,GAAG,WAAW,MAAM,SAAS,GAAU,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvO,QAAI,UAAW,OAAM,yBAAyB;AAE9C,QAAI,eAA8B;AAClC,QAAI,OAAO,UAAU;AACnB,YAAM,EAAE,KAAK,IAAI,MAAM,OAAO,UAAU;AACxC,qBAAe,MAAM,KAAK,OAAO,UAAU,EAAE;AAAA,IAC/C;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,gBAAgB;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,OAAO,OAAO;AAAA,UACd,MAAM,OAAO;AAAA,UACb;AAAA,UACA;AAAA,UACA,aAAa;AAAA,UACb,gBAAgB,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,kBAAkB,KAAK,EAAG,OAAM,yBAAyB;AAC7D,YAAM;AAAA,IACR;AAEA,QAAI,gBAA0B,CAAC;AAC/B,QAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,MAAM,QAAQ;AACtD,YAAM,cAAc,IAAI,MAAM,OAAO,OAAO,QAAQ;AACpD,sBAAgB,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,kBAAkB;AACtB,QAAI,OAAO,iBAAiB;AAC1B,YAAM,eAAe,MAAM,iBAAiB,IAAI,IAAI;AACpD,wBAAkB,aAAa;AAAA,IACjC;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACpE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,cAAc,UAAU,CAAC,OAAO,iBAAiB;AACnD,YAAM,kBAAkB,KAAK,MAAM,eAAe,CAAC,CAAC;AAAA,IACtD;AAEA,UAAM,UAAW,OAAO,mBAAmB,CAAC,kBAAmB,wBAAiC;AAEhG,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AAAA,EACA,cAAc,OAAO,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAC7C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AACzD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,EAAE;AAAA,MACd,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACxC,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtD;AACA,WAAO,cAAc,MAAM,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,EAAE,KAAK,GAAG,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AACzD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,EAAE;AAAA,MACd,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACxC,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtD;AACA,UAAM,WAAW,qBAAqB,MAAM,OAAO,QAAW,MAAM;AACpE,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,KAAK,EAAE;AAAA,MAC1B,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,eAAe,SAAS;AAAA,MACxB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,OAAO,UAAU,eAAe,WAAW,SAAS,aAAa;AAChF,QAAI,CAAC,OAAQ;AACb,UAAM,WAAW,UAAU;AAC3B,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAO9C,QAAI,UAAuB;AAC3B,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACnI,cAAM,gBAAgB,SAAS,WAAW,OAAO,QAAQ,QAAQ,IAAK,UAAU,YAAY;AAK5F,cAAM,0BAA0B,IAAI,eAAe,QAAQ,EAAE,UAAU,KAAK,GAAG,GAAG;AAElF,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,OAAO,CAAC;AAChD,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,cAAM,GAAG,aAAa,eAAe,EAAE,MAAM,OAAO,CAAC;AAErD,YAAI,UAAU,UAAU,OAAO,KAAK,SAAS,MAAM,EAAE,QAAQ;AAC3D,gBAAM,QAAQ,yBAAyB,QAAW,SAAS,MAAM;AACjE,cAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,kBAAM,qBAAqB;AAAA,cACzB,YAAY;AAAA,cACZ,UAAU,EAAE,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,gBAAgB,SAAS;AAAA,cACzB,UAAU,SAAS;AAAA,cACnB,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AACA,kBAAU,MAAM,GAAG,gBAAgB;AAAA,UACjC,QAAQ;AAAA,UACR,OAAO,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,UACrC,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,yBAAyB,CAAC;AAEzD,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI;AAAA,QACJ,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,UAAU,UAAU,YAAY;AAAA,MAClC;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,QAAQ,oBAAsC,QAAQ;AAC5D,QAAI,CAAC,MAAO,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uDAAuD,CAAC;AAC1G,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,YAAY,iBAAiB,MAAM,KAAK;AAE9C,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC/G,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,YAAI,MAAM;AACR,eAAK,YAAY;AACjB,eAAK,QAAQ,MAAM;AACnB,eAAK,YAAY;AACjB,eAAK,iBAAiB,MAAM,kBAAkB;AAC9C,eAAK,WAAW,MAAM,YAAY;AAClC,eAAK,eAAe,MAAM,gBAAgB;AAC1C,eAAK,OAAO,MAAM,QAAQ;AAC1B,eAAK,cAAc,MAAM;AACzB,gBAAM,GAAG,MAAM;AAAA,QACjB,OAAO;AACL,iBAAO,MAAM,GAAG,gBAAgB;AAAA,YAC9B,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,IAAI,MAAM;AAAA,cACV,OAAO,MAAM;AAAA,cACb;AAAA,cACA,gBAAgB,MAAM,kBAAkB;AAAA,cACxC,UAAU,MAAM,YAAY;AAAA,cAC5B,cAAc,MAAM,gBAAgB;AAAA,cACpC,MAAM,MAAM,QAAQ;AAAA,cACpB,aAAa,MAAM;AAAA,YACrB;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,CAAC,KAAM;AAEX,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,MAAM,GAAG,CAAC;AAClD,cAAM,cAAc,IAAI,MAAM,MAAM,OAAO,MAAM,QAAQ;AACzD,cAAM,gBAAgB,IAAI,MAAM,MAAM,IAAI;AAE1C,YAAI,MAAM,UAAU,OAAO,KAAK,MAAM,MAAM,EAAE,QAAQ;AACpD,gBAAM,QAAQ,yBAAyB,MAAM,QAAQ,MAAS;AAC9D,cAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,kBAAM,qBAAqB;AAAA,cACzB,YAAY;AAAA,cACZ,UAAU,EAAE,KAAK;AAAA,cACjB,UAAU,MAAM;AAAA,cAChB,gBAAgB,MAAM,kBAAkB;AAAA,cACxC,UAAU,MAAM,YAAY;AAAA,cAC5B,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,6CAA6C,CAAC;AAE/F,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,MAAM;AAAA,QACV,gBAAgB,MAAM,kBAAkB;AAAA,QACxC,UAAU,MAAM,YAAY;AAAA,MAC9B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM,EAAE;AAEvC,WAAO,EAAE,KAAK;AAAA,EAChB;AACF;AAEA,eAAe,iBACb,IACA,MACiC;AACjC,QAAM,WAAW,kBAAkB;AACnC,QAAM,YAAY,cAAc,QAAQ;AACxC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,mBAAmB;AAC3D,QAAM,MAAM,GAAG,OAAO,eAAe,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAC;AACjG,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAE5B,QAAM,OAAO,wBAAwB;AACrC,QAAM,YAAY,GAAG,IAAI,UAAU,QAAQ;AAE3C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,6BAA6B,uBAAuB;AAC9E,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,6BAA6B,qBAAqB;AAAA,IACrE,OAAO,UAAU,2BAA2B,uBAAuB;AAAA,IACnE,MAAM,UAAU,0BAA0B,gIAAgI;AAAA,IAC1K,KAAK,UAAU,yBAAyB,sBAAsB;AAAA,IAC9D,MAAM,UAAU,0BAA0B,0EAA0E;AAAA,EACtH;AAEA,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,UAAU;AAAA,MACd,IAAI,KAAK;AAAA,MACT;AAAA,MACA,OAAO,gBAAgB,EAAE,WAAW,KAAK,CAAC;AAAA,MAC1C,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,gBAAY;AAAA,EACd;AAEA,SAAO,EAAE,UAAU;AACrB;AAEA,SAAS,kBAAkB,OAAyB;AAClD,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA4B;AAC1C,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,aAAc,OAAgC;AACpD,QAAM,UAAU,OAAO,eAAe,WAAW,aAAa;AAC9D,SAAO,QAAQ,YAAY,EAAE,SAAS,eAAe;AACvD;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AAC/D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,8BAA0B,wBAAwB,GAAG,GAAG,SAAS,UAAU,gBAAgB;AAC3F,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,EAAE;AACnD,UAAM,OAAO,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACrD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,MACP,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,MAChD,SAAS,iBAAiB,OAAO,SAAS,cAAc,IAAI;AAAA,IAC9D;AACA,WAAO,EAAE,QAAQ,qBAAqB,UAAU,OAAO,MAAM,MAAM,EAAE;AAAA,EACvE;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,mBAAmB,wBAAwB,GAAG;AACpD,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,QAAI,oBAAoB,SAAS,YAAY,OAAO,SAAS,QAAQ,MAAM,kBAAkB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC1D;AAEA,UAAM,cAAc,MAAM,QAAQ,OAAO,KAAK,IAC1C,MAAM,kBAAkB,IAAI,OAAO,EAAE,IACrC;AAEJ,QAAI;AACJ,QAAI,qBAAqB;AACzB,QAAI,OAAO,mBAAmB,QAAW;AACvC,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,eAAe;AAAA,QAC5B,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,QACvB,EAAE,UAAU,MAAM,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,MAClE;AACA,UAAI,CAAC,aAAc,QAAO,yCAAyC,GAAG;AACtE,iBAAW,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AACtE,UAAI,CAAC,SAAU,QAAO,yCAAyC,GAAG;AAClE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,QACjC,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,YAAa,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAC1E,YAAM,wBAAwB,YAAY,iBAAiB,OAAO,YAAY,cAAc,IAAI;AAChG,YAAM,kBAAkB,YAAY,WAAW,OAAO,YAAY,QAAQ,IAAI;AAC9E,2BAAqB,0BAA0B,OAAO,kBAAkB,oBAAoB;AAC5F,UAAI,oBAAoB;AACtB,cAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,cAAM,mBAAmB,MAAM,4BAA4B;AAAA,UACzD;AAAA,UACA,cAAc,OAAO;AAAA,UACrB,qBAAqB;AAAA,UACrB,YAAY,OAAO;AAAA,QACrB,CAAC;AACD,cAAM,oBAAoB,IAAI,gBAAgB,QAAQ,IAAI,MAAM,iBAAiB;AACjF,cAAM,oBAAoB,IAAI,mBAAmB,aAAa,WAC1D,IAAI,oBACJ,CAAC,qBAAqB,IAAI,MAAM,MAC9B,MAAM,yBAAyB;AAAA,UAC7B;AAAA,UACA,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV;AAAA,QACF,CAAC,IACD;AACN,cAAM,oCAAoC;AAAA,UACxC;AAAA,UACA;AAAA,UACA,aAAa,IAAI,MAAM;AAAA,UACvB;AAAA,UACA,UAAU,IAAI,MAAM,YAAY;AAAA,UAChC,gBAAgB,IAAI,MAAM,SAAS;AAAA,UACnC,wBAAwB,mBAAmB;AAAA,UAC3C,qBAAqB;AAAA,UACrB,2BAA2B,OAAO;AAAA,UAClC,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,eAAe,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AACrE,UAAM,iBAAiB,aAAa,SAAY,WAAW;AAC3D,UAAM,mBAAmB,mBAAmB;AAG5C,QAAI,SAAwB;AAC5B,QAAI,YAA2B;AAC/B,QAAI,OAAO,UAAU;AACnB,YAAM,EAAE,KAAK,IAAI,MAAM,OAAO,UAAU;AACxC,eAAS,MAAM,KAAK,OAAO,UAAU,EAAE;AAAA,IACzC;AACA,QAAI,OAAO,UAAU,QAAW;AAC9B,kBAAY,iBAAiB,OAAO,KAAK;AAAA,IAC3C;AAEA,UAAM,cAAuC,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAC9E,QAAI,iBAAkB,aAAY,WAAW;AAE7C,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI;AAEJ,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AAEV,cAAM,0BAA0B,IAAI,cAAc,OAAO,IAAI;AAAA,UAC3D,cAAc,OAAO,gBAAgB,SAAS;AAAA,UAC9C,UAAU,OAAO;AAAA,QACnB,GAAG,GAAG;AAMN,YAAI,OAAO,UAAU,QAAW;AAC9B,gBAAM,YAAY,MAAM;AAAA,YACtB;AAAA,YACA;AAAA,YACA;AAAA,cACE,KAAK,CAAC,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,OAAO,KAAK,EAAE,EAAE,CAAC;AAAA,cAC1F,WAAW;AAAA,cACX,UAAU;AAAA,cACV,IAAI,EAAE,KAAK,OAAO,GAAG;AAAA,YACvB;AAAA,YACA,CAAC;AAAA,YACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,UACzC;AACA,cAAI,UAAW,OAAM,yBAAyB;AAAA,QAChD;AAEA,YAAI;AACF,gBAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,YACvC,QAAQ;AAAA,YACR,OAAO;AAAA,YACP,OAAO,CAAC,WAAW;AACjB,kBAAI,OAAO,UAAU,QAAW;AAC9B,uBAAO,QAAQ,OAAO;AACtB,uBAAO,YAAY;AAAA,cACrB;AACA,kBAAI,OAAO,SAAS,QAAW;AAC7B,uBAAO,OAAO,OAAO;AAAA,cACvB;AACA,kBAAI,OAAO,mBAAmB,QAAW;AACvC,uBAAO,iBAAiB,OAAO;AAC/B,uBAAO,WAAW,YAAY;AAAA,cAChC;AACA,kBAAI,OAAO,gBAAgB,QAAW;AACpC,uBAAO,cAAc,OAAO;AAAA,cAC9B;AACA,kBAAI,OAAQ,QAAO,eAAe;AAAA,YACpC;AAAA,UACF,CAAC;AACD,cAAI,QAAS,QAAO;AAAA,QACtB,SAAS,OAAO;AACd,cAAI,kBAAkB,KAAK,EAAG,OAAM,yBAAyB;AAC7D,gBAAM;AAAA,QACR;AACA,YAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEnE,YAAI,UAAU,OAAO,gBAAgB,OAAO;AAC1C,gBAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,GAAG,CAAC;AAAA,QACpD;AAEA,YAAI,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC/B,gBAAM,cAAc,IAAI,MAAM,OAAO,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY,IAAI;AAAA,QACtG;AAEA,cAAM,qBAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,UAAU,EAAE,KAAK;AAAA,UACjB,UAAU,OAAO,KAAK,EAAE;AAAA,UACxB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,UACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY;AAAA,UAC9D,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,qBAAqB,kCAAkC,oBAAoB,CAAC;AAE3G,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY;AAAA,IAChE;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,QAAQ;AACV,YAAM,UAAU,IAAI,MAAM,MAAM,OAAO,IAAI,KAAK,GAAG,IAAI;AAOvD,YAAM,YAAY,IAAI,gBAAgB,QAAQ,CAAC,UAC3C,WACA,YAAY,YAAY,KAAK,SAAS;AAC1C,WAAK,cAAc,yBAAyB;AAAA,QAC1C,IAAI,YAAY;AAAA,QAChB,UAAU,YAAY;AAAA,QACtB,gBAAgB,YAAY;AAAA,QAC5B;AAAA,QACA,aAAa;AAAA,QACb,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAChD;AAEA,QAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,aAAa,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AAC9D,YAAM,EAAE,UAAU,QAAQ,IAAI,gBAAgB,aAAa,UAAU;AACrE,UAAI,SAAS,UAAU,QAAQ,QAAQ;AACrC,cAAM,kBAAkB,KAAK,MAAM,UAAU,OAAO;AAAA,MACtD;AAAA,IACF;AAEA,UAAM,oBAAoB,KAAK,OAAO,EAAE;AAExC,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,OAAO,EAAE,CAAC;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,EAAE;AAAA,MAChB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC5C,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,IAC1D;AACA,WAAO,cAAc,QAAQ,OAAO,MAAM;AAAA,EAC5C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,aAAa,MAAM,kBAAkB,IAAI,OAAO,OAAO,EAAE,CAAC;AAChE,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA,OAAO,OAAO,EAAE;AAAA,MAChB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC5C,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,IAC1D;AACA,UAAM,iBAAiB,qBAAqB,QAAQ,YAAY,QAAW,WAAW;AACtF,UAAM,QAAQ,eAAe;AAC7B,UAAM,UAAU,aAAa,UAAU,MAAM,OAAkC,CAAC,SAAS,kBAAkB,YAAY,QAAQ,aAAa,CAAC;AAC7I,QAAI,UAAU,CAAC,YAAY,OAAO,OAAO,UAAU,GAAG;AACpD,cAAQ,QAAQ,EAAE,MAAM,OAAO,OAAO,IAAI,WAAW;AAAA,IACvD;AACA,UAAM,aAAa,uBAAuB,QAAQ,QAAQ,WAAW;AACrE,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACpD,cAAQ,MAAM,GAAG,EAAE,IAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,gBAAgB,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MACxE;AAAA,MACA,gBAAgB,UAAU;AAAA,MAC1B,eAAe;AAAA,MACf,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,OAAO,eAAe;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAkD,QAAQ;AAC1E,UAAM,SAAS,SAAS;AACxB,UAAM,QAAQ,SAAS;AACvB,QAAI,CAAC,OAAQ;AACb,UAAM,SAAS,OAAO;AACtB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAM9C,UAAM,mBAAmB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAErE,QAAI,UAAuB;AAC3B,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACnI,cAAM,kBAAkB,SAAS,WAAW,OAAO,QAAQ,QAAQ,IAAI;AAEvE,cAAM,0BAA0B,IAAI,iBAAiB,QAAQ;AAAA,UAC3D,cAAc,OAAO,gBAAgB,SAAS,qBAAqB;AAAA,UACnE,UAAU,OAAO;AAAA,QACnB,GAAG,GAAG;AAEN,kBAAU,MAAM,GAAG,gBAAgB;AAAA,UACjC,QAAQ;AAAA,UACR,OAAO,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,UACrC,OAAO,CAAC,WAAW;AACjB,mBAAO,QAAQ,OAAO;AACtB,mBAAO,iBAAiB,OAAO,kBAAkB;AACjD,mBAAO,WAAW,OAAO,YAAY;AACrC,mBAAO,eAAe,OAAO,gBAAgB;AAC7C,mBAAO,OAAO,OAAO,QAAQ;AAC7B,mBAAO,cAAc,OAAO;AAAA,UAC9B;AAAA,QACF,CAAC;AAED,YAAI,SAAS;AACX,gBAAM,cAAc,IAAI,SAAS,OAAO,OAAO,OAAO,QAAQ;AAAA,QAChE;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,yBAAyB,CAAC;AAEzD,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,OAAO,MAAM;AACnE,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,QAC7B,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM;AAAA,EACvC;AACF;AAEA,MAAM,oBAA+G;AAAA,EACnH,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,QAAO,CAAC;AACvB,UAAM,mBAAmB,wBAAwB,GAAG;AACpD,QAAI,kBAAkB;AACpB,YAAM,eAAe,kBAAkB,SAAS,QAAQ,KAAK;AAC7D,UAAI,CAAC,gBAAgB,iBAAiB,iBAAkB,QAAO,CAAC;AAAA,IAClE;AACA,UAAM,QAAQ,MAAM,kBAAkB,IAAI,EAAE;AAC5C,UAAM,OAAO,MAAM,qBAAqB,IAAI,EAAE;AAC9C,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,MAChD,SAAS,iBAAiB,OAAO,SAAS,cAAc,IAAI;AAAA,IAC9D;AACA,WAAO,EAAE,QAAQ,qBAAqB,UAAU,OAAO,MAAM,MAAM,EAAE;AAAA,EACvE;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,mBAAmB,wBAAwB,GAAG;AAEpD,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,QAAI,oBAAoB,SAAS,YAAY,OAAO,SAAS,QAAQ,MAAM,kBAAkB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC1D;AAEA,UAAM,cAAuC,EAAE,IAAI,WAAW,KAAK;AACnE,QAAI,iBAAkB,aAAY,WAAW;AAE7C,QAAI;AACJ,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,eAAe,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AACrE,cAAM,0BAA0B,IAAI,cAAc,IAAI,EAAE,UAAU,KAAK,GAAG,GAAG;AAE7E,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAC3C,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,GAAG,CAAC;AAC5C,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAC3C,cAAM,GAAG,aAAa,eAAe,EAAE,MAAM,GAAG,CAAC;AACjD,cAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,UACvC,QAAQ;AAAA,UACR,OAAO;AAAA,UACP,MAAM;AAAA,QACR,CAAC;AACD,YAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACtE,eAAO;AAAA,MACT;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,EAAE;AAAA,QACb,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACpD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,EAAE;AAEjC,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,gBAAgB,UAAU;AAAA,MAC1B,UAAU,QAAQ,YAAY;AAAA,MAC9B,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAkD,QAAQ;AAC1E,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAChH,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,YAAI,MAAM;AACR,cAAI,KAAK,WAAW;AAClB,iBAAK,YAAY;AAAA,UACnB;AACA,eAAK,QAAQ,OAAO;AACpB,eAAK,iBAAiB,OAAO,kBAAkB;AAC/C,eAAK,WAAW,OAAO,YAAY;AACnC,eAAK,eAAe,OAAO,gBAAgB;AAC3C,eAAK,OAAO,OAAO,QAAQ;AAC3B,eAAK,cAAc,OAAO;AAC1B,gBAAM,GAAG,MAAM;AAAA,QACjB,OAAO;AACL,iBAAO,MAAM,GAAG,gBAAgB;AAAA,YAC9B,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,IAAI,OAAO;AAAA,cACX,OAAO,OAAO;AAAA,cACd,gBAAgB,OAAO,kBAAkB;AAAA,cACzC,UAAU,OAAO,YAAY;AAAA,cAC7B,cAAc,OAAO,gBAAgB;AAAA,cACrC,MAAM,OAAO,QAAQ;AAAA,cACrB,aAAa,OAAO;AAAA,YACtB;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,CAAC,KAAM;AAEX,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,OAAO,GAAG,CAAC;AACnD,cAAM,cAAc,IAAI,MAAM,OAAO,OAAO,OAAO,QAAQ;AAE3D,cAAM,gBAAgB,IAAI,MAAM,OAAO,IAAI;AAE3C,cAAM,QAAQ,yBAAyB,OAAO,QAAQ,MAAS;AAC/D,YAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,gBAAM,qBAAqB;AAAA,YACzB,YAAY;AAAA,YACZ,UAAU,EAAE,KAAK;AAAA,YACjB,UAAU,OAAO;AAAA,YACjB,gBAAgB,OAAO,kBAAkB;AAAA,YACzC,UAAU,OAAO,YAAY;AAAA,YAC7B,QAAQ;AAAA,YACR,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,UAAM,oBAAoB,KAAK,OAAO,EAAE;AAAA,EAC1C;AACF;AAEA,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AAEjC,MAAM,UAAU;AAEhB,eAAe,YACb,IACA,OACA,oBACsB;AACtB,MAAI,QAAQ,KAAK,KAAK,GAAG;AACvB,UAAM,QAAiC,EAAE,IAAI,MAAM;AACnD,QAAI,uBAAuB,MAAM;AAC/B,YAAM,WAAW;AAAA,IACnB;AACA,WAAO,sBAAsB,IAAI,MAAM,OAAc,CAAC,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAAA,EACjH;AACA,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,OAAO,UAAU,mBAAmB,GAAG,CAAC,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAClJ;AAEA,eAAe,cAAc,IAAmB,MAAY,cAAwB,UAAyB;AAC3G,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,QAAM,qBAAqB,kBAAkB,YAAY,IAAI,KAAK;AAElE,QAAM,gBAAwB,CAAC;AAC/B,QAAM,eAAyB,CAAC;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,MAAM,YAAY,IAAI,OAAO,kBAAkB;AAC5D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,oBAAc,KAAK,IAAI;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AAC1D,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,QAAM,aAAa,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AACjE,QAAM,eAAe,MAAM,mBAAmB,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAClH,QAAM,iBAAiB,IAAI;AAAA,IACzB,aAAa,IAAI,CAAC,SAAS;AACzB,YAAM,SAAS,OAAO,KAAK,MAAM,MAAO,KAAK,QAA8B,EAAE;AAC7E,aAAO,CAAC,QAAQ,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,CAAC,QAAQ,IAAI,KAAK,eAAe,QAAQ,GAAG;AACrD,QAAI,CAAC,WAAW,IAAI,MAAM,KAAK,MAAM;AACnC,SAAG,OAAO,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,eAAe,IAAI,OAAO,KAAK,EAAE,CAAC,GAAG;AACxC,SAAG,QAAQ,GAAG,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,kBAAkB,IAAmB,QAAmC;AACrF,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAA0B;AAAA,IAClC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,QAAQ,MACX,IAAI,CAAC,SAAS,KAAK,MAAM,QAAQ,EAAE,EACnC,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,SAAO,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACrE;AAEA,SAAS,cAAc,MAAY,OAAiB,QAAyD;AAC3G,QAAM,UAA0B;AAAA,IAC9B,OAAO,OAAO,KAAK,SAAS,EAAE;AAAA,IAC9B,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,IAClD;AAAA,IACA,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IACtC,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC;AACA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,OAAQ,SAAQ,SAAS;AAC3D,SAAO;AACT;AAEA,SAAS,qBACP,MACA,OACA,OAA0B,CAAC,GAC3B,QACe;AACf,SAAO;AAAA,IACL,MAAM,cAAc,MAAM,OAAO,MAAM;AAAA,IACvC,MAAM;AAAA,MACJ,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,OAAO,OAAO,KAAK,SAAS,EAAE;AAAA,MAC9B,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,cAAc,KAAK,eAAe,OAAO,KAAK,YAAY,IAAI;AAAA,MAC9D,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,MACtC,aAAa,QAAQ,KAAK,WAAW;AAAA,MACrC,OAAO,CAAC,GAAG,KAAK;AAAA,MAChB;AAAA,MACA,GAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,IAAmB,QAA4C;AACjG,QAAM,OAAO,MAAM,mBAAmB,IAAI,SAAS,EAAE,MAAM,OAA0B,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACpI,SAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IACxB,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,CAAC,GAAG,IAAI,YAAY,IAAI;AAAA,IACpE,cAAc,QAAQ,IAAI,YAAY;AAAA,IACtC,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG,IAAI,iBAAiB,IAAI;AAAA,EACrF,EAAE;AACJ;AAEA,eAAe,gBAAgB,IAAmB,MAAY,MAAyB;AACrF,QAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,KAAK,EAAE,EAAE,CAAC;AACxD,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,GAAG,OAAO,SAAS;AAAA,MAChC;AAAA,MACA,UAAU,IAAI;AAAA,MACd,cAAc,IAAI,YAAY;AAAA,MAC9B,cAAc,IAAI;AAAA,MAClB,mBAAmB,IAAI,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,uBACb,IACA,IACA,UACA,gBACkC;AAClC,SAAO,MAAM,wBAAwB,IAAI;AAAA,IACvC,UAAU,EAAE,KAAK;AAAA,IACjB,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAe,oBAAoB,KAA4B,QAAgB;AAC7E,MAAI;AACF,UAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,UAAM,YAAY,oBAAoB,MAAM;AAAA,EAC9C,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,QAAQ,IAAI,UAAU,QAAQ,OAAO;AAC3C,QAAI,OAAO,aAAc,OAAM,MAAM,aAAa,CAAC,aAAa,MAAM,EAAE,CAAC;AAAA,EAC3E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,gBAAgB,QAAkB,OAAiB;AAC1D,QAAM,YAAY,IAAI,IAAI,MAAM;AAChC,QAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,QAAM,WAAW,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;AAC5D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3D,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,YAAY,MAA4B,OAA0B;AACzE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,SAAO,KAAK,MAAM,CAAC,OAAO,QAAQ,UAAU,MAAM,GAAG,CAAC;AACxD;AAEA,eAAe,2BAA2C;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,iCAAiC,sBAAsB;AACjF,QAAM,IAAI,cAAc,KAAK;AAAA,IAC3B,OAAO;AAAA,IACP,aAAa,EAAE,OAAO,QAAQ;AAAA,IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,SAAS,MAAM,aAAa,QAAQ,aAAa,CAAC;AAAA,EACjF,CAAC;AACH;AAcA,SAAS,yBAAyB,SAA6C;AAC7E,SAAO,QAAQ,aAAa,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,aAAa;AAC5F;AAEA,eAAe,0BACb,IACA,UACA,QACA,SACA,KACe;AAGf,MAAI,KAAK,gBAAgB,KAAM;AAC/B,MAAI,CAAC,yBAAyB,OAAO,EAAG;AAExC,QAAM,qBAAqB,kBAAkB,QAAQ,KAAK;AAC1D,MAAI,CAAC,mBAAoB;AAGzB,QAAM,iBAAiB,MAAM,mBAAmB,IAAI,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,kBAAkB,EAAE,KAAK,EAAE;AAAA,IAC3B,WAAW;AAAA,EACb,GAAG;AAAA,IACD,UAAU,SAAS;AAAA,IACnB,SAAS,EAAE,IAAI,MAAM;AAAA,EACvB,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAEzD,MAAI,eAAe,WAAW,EAAG;AAEjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,aAAW,QAAQ,gBAAgB;AACjC,UAAM,WAAW,KAAK,oBAAoB;AAC1C,QAAI,YAAY,EAAG;AAMnB,UAAM,cAAc,MAAM,mBAAmB,IAAI,UAAU;AAAA,MACzD,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM;AAAA,QACJ,WAAW;AAAA,QACX,aAAa;AAAA,QACb,UAAU;AAAA,MACZ;AAAA,IACF,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAG/C,UAAM,gBAAgB,MAAM;AAAA,MAC1B,IAAI;AAAA,QACF,YACG,IAAI,CAAC,SAAS;AACb,gBAAM,UAAU,KAAK;AACrB,gBAAM,eAAe,OAAO,YAAY,WAAW,UAAU,SAAS;AACtE,iBAAO,eAAe,OAAO,YAAY,IAAI;AAAA,QAC/C,CAAC,EACA,OAAO,CAAC,OAAqB,CAAC,CAAC,EAAE;AAAA,MACtC;AAAA,IACF;AAGA,QAAI,cAAc,SAAS,MAAM,GAAG;AAElC,UAAI,0BAA0B;AAE9B,UAAI,QAAQ,YAAY,QAAQ,cAAc;AAC5C,kCAA0B;AAAA,MAC5B,WAAW,QAAQ,aAAa,QAAW;AAEzC,cAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC7G,cAAM,gBAAgB,KAAK,KAAK,YAAY;AAC5C,cAAM,gBAAgB,cAAc,SAAS,aAAa,KAAK,cAAc,SAAS,OAAO,KAAK,EAAE,EAAE,YAAY,CAAC;AACnH,YAAI,CAAC,eAAe;AAClB,oCAA0B;AAAA,QAC5B;AAAA,MACF;AAEA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,YAAY,cAAc,SAAS;AACzC,YAAI,YAAY,UAAU;AACxB,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,8CAA8C,6DAA6D,EAAE,UAAU,KAAK,KAAK,CAAC;AAAA,UACrJ,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport {\n  parseWithCustomFields,\n  setCustomFieldsIfAny,\n  emitCrudSideEffects,\n  emitCrudUndoSideEffects,\n  buildChanges,\n  requireId,\n} from '@open-mercato/shared/lib/commands/helpers'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { CrudEventsConfig, CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { UniqueConstraintViolationException, LockMode } from '@mikro-orm/core'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport {\n  User,\n  UserRole,\n  Role,\n  UserAcl,\n  Session,\n  PasswordReset,\n  UserSidebarPreference,\n  SidebarVariant,\n} from '@open-mercato/core/modules/auth/data/entities'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { resolveOrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { E } from '#generated/entities.ids.generated'\nimport { z } from 'zod'\nimport {\n  loadCustomFieldSnapshot,\n  buildCustomFieldResetMap,\n  diffCustomFieldChanges,\n} from '@open-mercato/shared/lib/commands/customFieldSnapshots'\nimport { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'\nimport notificationTypes from '@open-mercato/core/modules/auth/notifications'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport InviteUserEmail from '@open-mercato/core/modules/auth/emails/InviteUserEmail'\nimport { INVITE_TOKEN_TTL_MS } from '@open-mercato/core/modules/auth/lib/inviteToken'\nimport { getSecurityEmailBaseUrl } from '@open-mercato/shared/lib/url'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  assertActorCanAssignUserDestination,\n  resolveUserDestinationRoles,\n  throwUserDestinationOrganizationNotFound,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\nconst logger = createLogger('auth').child({ component: 'users-commands' })\n\ntype SerializedUser = {\n  email: string\n  organizationId: string | null\n  tenantId: string | null\n  roles: string[]\n  name: string | null\n  isConfirmed: boolean\n  custom?: Record<string, unknown>\n}\n\ntype UserAclSnapshot = {\n  tenantId: string\n  features: string[] | null\n  isSuperAdmin: boolean\n  organizations: string[] | null\n}\n\ntype UserUndoSnapshot = {\n  id: string\n  email: string\n  organizationId: string | null\n  tenantId: string | null\n  passwordHash: string | null\n  name: string | null\n  isConfirmed: boolean\n  roles: string[]\n  acls: UserAclSnapshot[]\n  custom?: Record<string, unknown>\n}\n\ntype UserSnapshots = {\n  view: SerializedUser\n  undo: UserUndoSnapshot\n}\n\nfunction resolveActorTenantScope(ctx: CommandRuntimeContext): string | null {\n  if (ctx.systemActor === true) return null\n  const auth = ctx.auth\n  if (!auth) return null\n  if ((auth as { isSuperAdmin?: boolean }).isSuperAdmin === true) return null\n  const actorTenantId = normalizeTenantId(auth.tenantId ?? null) ?? null\n  return actorTenantId\n}\n\nfunction assertTargetTenantInScope(actorTenantScope: string | null, targetTenantId: unknown, notFoundError: string): void {\n  if (!actorTenantScope) return\n  const targetTenant = normalizeTenantId(targetTenantId) ?? null\n  if (!targetTenant || targetTenant !== actorTenantScope) {\n    throw new CrudHttpError(404, { error: notFoundError })\n  }\n}\n\nconst passwordSchema = buildPasswordSchema()\n\nconst displayNameSchema = z.preprocess(\n  normalizeDisplayNameInput,\n  z.string().trim().min(1).max(120).nullable().optional(),\n)\n\nconst createSchema = z.object({\n  email: z.string().email(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  sendInviteEmail: z.boolean().optional(),\n  organizationId: z.string().uuid(),\n  roles: z.array(z.string()).optional(),\n}).refine(\n  (data) => data.password || data.sendInviteEmail,\n  { message: 'Either password or sendInviteEmail is required', path: ['password'] },\n)\n\nconst updateSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string().email().optional(),\n  name: displayNameSchema,\n  password: passwordSchema.optional(),\n  organizationId: z.string().uuid().optional(),\n  roles: z.array(z.string()).optional(),\n  isConfirmed: z.boolean().optional(),\n})\n\nexport const userCrudEvents: CrudEventsConfig = {\n  module: 'auth',\n  entity: 'user',\n  persistent: true,\n  buildPayload: (ctx) => ({\n    id: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nexport const userCrudIndexer: CrudIndexerConfig = {\n  entityType: E.auth.user,\n  buildUpsertPayload: (ctx) => ({\n    entityType: E.auth.user,\n    recordId: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n  buildDeletePayload: (ctx) => ({\n    entityType: E.auth.user,\n    recordId: ctx.identifiers.id,\n    organizationId: ctx.identifiers.organizationId,\n    tenantId: ctx.identifiers.tenantId,\n  }),\n}\n\nasync function notifyRoleChanges(\n  ctx: CommandRuntimeContext,\n  user: User,\n  assignedRoles: string[],\n  revokedRoles: string[],\n): Promise<void> {\n  const tenantId = user.tenantId ? String(user.tenantId) : null\n  if (!tenantId) return\n  const organizationId = user.organizationId ? String(user.organizationId) : null\n\n  try {\n    const notificationService = resolveNotificationService(ctx.container)\n    if (assignedRoles.length) {\n      const assignedType = notificationTypes.find((type) => type.type === 'auth.role.assigned')\n      if (assignedType) {\n        const notificationInput = buildNotificationFromType(assignedType, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, { tenantId, organizationId })\n      }\n    }\n\n    if (revokedRoles.length) {\n      const revokedType = notificationTypes.find((type) => type.type === 'auth.role.revoked')\n      if (revokedType) {\n        const notificationInput = buildNotificationFromType(revokedType, {\n          recipientUserId: String(user.id),\n          sourceEntityType: 'auth:user',\n          sourceEntityId: String(user.id),\n        })\n        await notificationService.create(notificationInput, { tenantId, organizationId })\n      }\n    }\n  } catch (err) {\n    logger.error('Failed to create notification', { err })\n  }\n}\n\ntype CreateUserResult = { user: User; warning?: 'invite_email_failed' }\n\nconst createUserCommand: CommandHandler<Record<string, unknown>, CreateUserResult> = {\n  id: 'auth.users.create',\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n\n    const organization = await findOneWithDecryption(\n      em,\n      Organization,\n      { id: parsed.organizationId },\n      { populate: ['tenant'] },\n      { tenantId: null, organizationId: parsed.organizationId },\n    )\n    if (!organization) throw new CrudHttpError(400, { error: 'Organization not found' })\n    const tenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n    assertTargetTenantInScope(resolveActorTenantScope(ctx), tenantId, 'Organization not found')\n\n    const emailHash = computeEmailHash(parsed.email)\n    // Email is unique per-tenant, not globally (see Migration20260610120000:\n    // users_tenant_email_hash_uniq). Scope the duplicate check to the target tenant so the same\n    // email may legitimately exist in other tenants without blocking creation or leaking\n    // cross-tenant account existence (#2934).\n    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }], deletedAt: null, tenantId } as any, {}, { tenantId: null, organizationId: null })\n    if (duplicate) await throwDuplicateEmailError()\n\n    let passwordHash: string | null = null\n    if (parsed.password) {\n      const { hash } = await import('bcryptjs')\n      passwordHash = await hash(parsed.password, 10)\n    }\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let user: User\n    try {\n      user = await de.createOrmEntity({\n        entity: User,\n        data: {\n          email: parsed.email,\n          name: parsed.name,\n          emailHash,\n          passwordHash,\n          isConfirmed: true,\n          organizationId: parsed.organizationId,\n          tenantId,\n        },\n      })\n    } catch (error) {\n      if (isUniqueViolation(error)) await throwDuplicateEmailError()\n      throw error\n    }\n\n    let assignedRoles: string[] = []\n    if (Array.isArray(parsed.roles) && parsed.roles.length) {\n      await syncUserRoles(em, user, parsed.roles, tenantId)\n      assignedRoles = await loadUserRoleNames(em, String(user.id))\n    }\n\n    await setCustomFieldsIfAny({\n      dataEngine: de,\n      entityId: E.auth.user,\n      recordId: String(user.id),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: tenantId,\n      values: custom,\n    })\n\n    let inviteEmailSent = false\n    if (parsed.sendInviteEmail) {\n      const inviteResult = await sendInviteToUser(em, user)\n      inviteEmailSent = inviteResult.emailSent\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: user,\n      identifiers: {\n        id: String(user.id),\n        organizationId: user.organizationId ? String(user.organizationId) : null,\n        tenantId,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    if (assignedRoles.length && !parsed.sendInviteEmail) {\n      await notifyRoleChanges(ctx, user, assignedRoles, [])\n    }\n\n    const warning = (parsed.sendInviteEmail && !inviteEmailSent) ? 'invite_email_failed' as const : undefined\n\n    return { user, warning }\n  },\n  captureAfter: async (_input, { user }, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(user.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(user.id),\n      user.tenantId ? String(user.tenantId) : null,\n      user.organizationId ? String(user.organizationId) : null\n    )\n    return serializeUser(user, roles, custom)\n  },\n  buildLog: async ({ result: { user }, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(user.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(user.id),\n      user.tenantId ? String(user.tenantId) : null,\n      user.organizationId ? String(user.organizationId) : null\n    )\n    const snapshot = captureUserSnapshots(user, roles, undefined, custom)\n    return {\n      actionLabel: translate('auth.audit.users.create', 'Create user'),\n      resourceKind: 'auth.user',\n      resourceId: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      snapshotAfter: snapshot.view,\n      payload: {\n        undo: {\n          after: snapshot.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const userId = typeof logEntry?.resourceId === 'string' ? logEntry.resourceId : null\n    if (!userId) return\n    const snapshot = logEntry?.snapshotAfter as SerializedUser | undefined\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    // Evaluate the floor against the user's CURRENT tenant, not the one recorded at\n    // creation. A user moved to another tenant after being created would otherwise be\n    // checked against the origin tenant \u2014 where they no longer hold anything \u2014 and the\n    // undo would hard-delete the destination tenant's last administrator unchecked.\n    // The create snapshot is only a fallback for a row that is already gone.\n    let removed: User | null = null\n    await withAtomicFlush(em, [\n      async () => {\n        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n        const floorTenantId = current?.tenantId ? String(current.tenantId) : (snapshot?.tenantId ?? null)\n\n        // Undoing a create hard-deletes the user, so it can strip a tenant's last active\n        // admin exactly like `auth.users.delete` can \u2014 promote a second admin, delete the\n        // first, then undo the promotion's create. Same guard applies.\n        await enforceProtectedRoleFloor(em, floorTenantId, userId, { deleting: true }, ctx)\n\n        await em.nativeDelete(UserAcl, { user: userId })\n        await em.nativeDelete(UserRole, { user: userId })\n        await em.nativeDelete(Session, { user: userId })\n        await em.nativeDelete(PasswordReset, { user: userId })\n        await em.nativeDelete(UserSidebarPreference, { user: userId })\n        await em.nativeDelete(SidebarVariant, { user: userId })\n\n        if (snapshot?.custom && Object.keys(snapshot.custom).length) {\n          const reset = buildCustomFieldResetMap(undefined, snapshot.custom)\n          if (Object.keys(reset).length) {\n            await setCustomFieldsIfAny({\n              dataEngine: de,\n              entityId: E.auth.user,\n              recordId: userId,\n              organizationId: snapshot.organizationId,\n              tenantId: snapshot.tenantId,\n              values: reset,\n              notify: false,\n            })\n          }\n        }\n        removed = await de.deleteOrmEntity({\n          entity: User,\n          where: { id: userId, deletedAt: null } as FilterQuery<User>,\n          soft: false,\n        })\n      },\n    ], { transaction: true, label: 'auth.users.create.undo' })\n\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: removed,\n      identifiers: {\n        id: userId,\n        organizationId: snapshot?.organizationId ?? null,\n        tenantId: snapshot?.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, userId)\n  },\n  // The create-undo hard-deletes the user, but the after-snapshot persists the\n  // original passwordHash (see captureUserSnapshots), so redo restores the row\n  // with the SAME id and the SAME hash \u2014 never fabricating credentials (#2506).\n  redo: async ({ logEntry, ctx }) => {\n    const after = resolveRedoSnapshot<UserUndoSnapshot>(logEntry)\n    if (!after) throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for user create' })\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const emailHash = computeEmailHash(after.email)\n\n    let user = await findOneWithDecryption(em, User, { id: after.id }, {}, { tenantId: null, organizationId: null })\n    await withAtomicFlush(em, [\n      async () => {\n        if (user) {\n          user.deletedAt = null\n          user.email = after.email\n          user.emailHash = emailHash\n          user.organizationId = after.organizationId ?? null\n          user.tenantId = after.tenantId ?? null\n          user.passwordHash = after.passwordHash ?? null\n          user.name = after.name ?? null\n          user.isConfirmed = after.isConfirmed\n          await em.flush()\n        } else {\n          user = await de.createOrmEntity({\n            entity: User,\n            data: {\n              id: after.id,\n              email: after.email,\n              emailHash,\n              organizationId: after.organizationId ?? null,\n              tenantId: after.tenantId ?? null,\n              passwordHash: after.passwordHash ?? null,\n              name: after.name ?? null,\n              isConfirmed: after.isConfirmed,\n            },\n          })\n        }\n\n        if (!user) return\n\n        await em.nativeDelete(UserRole, { user: after.id })\n        await syncUserRoles(em, user, after.roles, after.tenantId)\n        await restoreUserAcls(em, user, after.acls)\n\n        if (after.custom && Object.keys(after.custom).length) {\n          const reset = buildCustomFieldResetMap(after.custom, undefined)\n          if (Object.keys(reset).length) {\n            await setCustomFieldsIfAny({\n              dataEngine: de,\n              entityId: E.auth.user,\n              recordId: after.id,\n              organizationId: after.organizationId ?? null,\n              tenantId: after.tenantId ?? null,\n              values: reset,\n              notify: false,\n            })\n          }\n        }\n      },\n    ], { transaction: true })\n\n    if (!user) throw new CrudHttpError(400, { error: '[internal] redo failed to restore user row' })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'created',\n      entity: user,\n      identifiers: {\n        id: after.id,\n        organizationId: after.organizationId ?? null,\n        tenantId: after.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, after.id)\n\n    return { user }\n  },\n}\n\nasync function sendInviteToUser(\n  em: EntityManager,\n  user: User,\n): Promise<{ emailSent: boolean }> {\n  const rawToken = generateAuthToken()\n  const tokenHash = hashAuthToken(rawToken)\n  const expiresAt = new Date(Date.now() + INVITE_TOKEN_TTL_MS)\n  const row = em.create(PasswordReset, { user, token: tokenHash, expiresAt, createdAt: new Date() })\n  await em.persist(row).flush()\n\n  const base = getSecurityEmailBaseUrl()\n  const inviteUrl = `${base}/reset/${rawToken}`\n\n  const { translate } = await resolveTranslations()\n  const subject = translate('auth.email.invite.subject', 'You have been invited')\n  const copy = {\n    preview: translate('auth.email.invite.preview', 'Set up your account'),\n    title: translate('auth.email.invite.title', 'You have been invited'),\n    body: translate('auth.email.invite.body', 'An administrator has created an account for you. Click the link below to set your password. This link will expire in 48 hours.'),\n    cta: translate('auth.email.invite.cta', 'Set up your password'),\n    hint: translate('auth.email.invite.hint', 'If you did not expect this invitation, you can safely ignore this email.'),\n  }\n\n  let emailSent = true\n  try {\n    await sendEmail({\n      to: user.email,\n      subject,\n      react: InviteUserEmail({ inviteUrl, copy }),\n      tenantId: user.tenantId ? String(user.tenantId) : undefined,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    })\n  } catch (err) {\n    logger.error('Failed to send invitation email', { err })\n    emailSent = false\n  }\n\n  return { emailSent }\n}\n\nfunction isUniqueViolation(error: unknown): boolean {\n  if (error instanceof UniqueConstraintViolationException) return true\n  if (!error || typeof error !== 'object') return false\n  const code = (error as { code?: string }).code\n  if (code === '23505') return true\n  const messageRaw = (error as { message?: string })?.message\n  const message = typeof messageRaw === 'string' ? messageRaw : ''\n  return message.toLowerCase().includes('duplicate key')\n}\n\nconst updateUserCommand: CommandHandler<Record<string, unknown>, User> = {\n  id: 'auth.users.update',\n  async prepare(rawInput, ctx) {\n    const { parsed } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    assertTargetTenantInScope(resolveActorTenantScope(ctx), existing.tenantId, 'User not found')\n    const roles = await loadUserRoleNames(em, parsed.id)\n    const acls = await loadUserAclSnapshots(em, parsed.id)\n    const custom = await loadUserCustomSnapshot(\n      em,\n      parsed.id,\n      existing.tenantId ? String(existing.tenantId) : null,\n      existing.organizationId ? String(existing.organizationId) : null\n    )\n    return { before: captureUserSnapshots(existing, roles, acls, custom) }\n  },\n  async execute(rawInput, ctx) {\n    const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const actorTenantScope = resolveActorTenantScope(ctx)\n    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {\n      throw new CrudHttpError(404, { error: 'User not found' })\n    }\n\n    const rolesBefore = Array.isArray(parsed.roles)\n      ? await loadUserRoleNames(em, parsed.id)\n      : null\n\n    let tenantId: string | null | undefined\n    let destinationChanged = false\n    if (parsed.organizationId !== undefined) {\n      const organization = await findOneWithDecryption(\n        em,\n        Organization,\n        { id: parsed.organizationId },\n        { populate: ['tenant'] },\n        { tenantId: null, organizationId: parsed.organizationId ?? null },\n      )\n      if (!organization) return throwUserDestinationOrganizationNotFound(400)\n      tenantId = organization.tenant?.id ? String(organization.tenant.id) : null\n      if (!tenantId) return throwUserDestinationOrganizationNotFound(400)\n      const currentUser = await findOneWithDecryption(\n        em,\n        User,\n        { id: parsed.id, deletedAt: null },\n        {},\n        { tenantId: null, organizationId: null },\n      )\n      if (!currentUser) throw new CrudHttpError(404, { error: 'User not found' })\n      const currentOrganizationId = currentUser.organizationId ? String(currentUser.organizationId) : null\n      const currentTenantId = currentUser.tenantId ? String(currentUser.tenantId) : null\n      destinationChanged = currentOrganizationId !== parsed.organizationId || currentTenantId !== tenantId\n      if (destinationChanged) {\n        const rbacService = ctx.container.resolve('rbacService') as RbacService\n        const destinationRoles = await resolveUserDestinationRoles({\n          em,\n          targetUserId: parsed.id,\n          destinationTenantId: tenantId,\n          roleTokens: parsed.roles,\n        })\n        const actorIsSuperAdmin = ctx.systemActor === true || ctx.auth?.isSuperAdmin === true\n        const organizationScope = ctx.organizationScope?.tenantId === tenantId\n          ? ctx.organizationScope\n          : !actorIsSuperAdmin && ctx.auth?.sub\n            ? await resolveOrganizationScope({\n                em,\n                rbac: rbacService,\n                auth: ctx.auth,\n                tenantId,\n              })\n            : null\n        await assertActorCanAssignUserDestination({\n          em,\n          rbacService,\n          actorUserId: ctx.auth?.sub,\n          actorIsSuperAdmin,\n          tenantId: ctx.auth?.tenantId ?? null,\n          organizationId: ctx.auth?.orgId ?? null,\n          allowedOrganizationIds: organizationScope?.allowedIds,\n          destinationTenantId: tenantId,\n          destinationOrganizationId: parsed.organizationId,\n          roles: destinationRoles,\n        })\n      }\n    }\n\n    const userTenantId = existing.tenantId ? String(existing.tenantId) : null\n    const targetTenantId = tenantId !== undefined ? tenantId : userTenantId\n    const isTenantChanging = targetTenantId !== userTenantId\n\n    // Hash password BEFORE transaction begins to avoid holding locks during CPU-heavy tasks\n    let hashed: string | null = null\n    let emailHash: string | null = null\n    if (parsed.password) {\n      const { hash } = await import('bcryptjs')\n      hashed = await hash(parsed.password, 10)\n    }\n    if (parsed.email !== undefined) {\n      emailHash = computeEmailHash(parsed.email)\n    }\n\n    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }\n    if (actorTenantScope) updateWhere.tenantId = actorTenantScope\n\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    let user!: User\n\n    await withAtomicFlush(em, [\n      async () => {\n        // Floor check must run inside the transaction so that LockMode.PESSIMISTIC_WRITE locks Role rows properly\n        await enforceProtectedRoleFloor(em, userTenantId, parsed.id, {\n          deactivating: parsed.isConfirmed === false || isTenantChanging,\n          newRoles: parsed.roles,\n        }, ctx)\n\n        // Email is unique per-tenant, not globally (see Migration20260610120000:\n        // users_tenant_email_hash_uniq) \u2014 a matching email in another tenant must not block\n        // the update or leak cross-tenant account existence (#2934). `targetTenantId` is the\n        // tenant the user will belong to after this update, so the check follows a move.\n        if (parsed.email !== undefined) {\n          const duplicate = await findOneWithDecryption(\n            em,\n            User,\n            {\n              $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],\n              deletedAt: null,\n              tenantId: targetTenantId,\n              id: { $ne: parsed.id } as any,\n            } as FilterQuery<User>,\n            {},\n            { tenantId: null, organizationId: null },\n          )\n          if (duplicate) await throwDuplicateEmailError()\n        }\n\n        try {\n          const updated = await de.updateOrmEntity({\n            entity: User,\n            where: updateWhere as FilterQuery<User>,\n            apply: (entity) => {\n              if (parsed.email !== undefined) {\n                entity.email = parsed.email\n                entity.emailHash = emailHash\n              }\n              if (parsed.name !== undefined) {\n                entity.name = parsed.name\n              }\n              if (parsed.organizationId !== undefined) {\n                entity.organizationId = parsed.organizationId\n                entity.tenantId = tenantId ?? null\n              }\n              if (parsed.isConfirmed !== undefined) {\n                entity.isConfirmed = parsed.isConfirmed\n              }\n              if (hashed) entity.passwordHash = hashed\n            },\n          })\n          if (updated) user = updated\n        } catch (error) {\n          if (isUniqueViolation(error)) await throwDuplicateEmailError()\n          throw error\n        }\n        if (!user) throw new CrudHttpError(404, { error: 'User not found' })\n\n        if (hashed || parsed.isConfirmed === false) {\n          await em.nativeDelete(Session, { user: parsed.id })\n        }\n\n        if (Array.isArray(parsed.roles)) {\n          await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null)\n        }\n\n        await setCustomFieldsIfAny({\n          dataEngine: de,\n          entityId: E.auth.user,\n          recordId: String(user.id),\n          organizationId: user.organizationId ? String(user.organizationId) : null,\n          tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,\n          values: custom,\n        })\n      }\n    ], { transaction: true, label: destinationChanged ? 'auth.users.update.destination' : 'auth.users.update' })\n\n    const identifiers = {\n      id: String(user.id),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,\n    }\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: user,\n      identifiers,\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    if (hashed) {\n      const actorId = ctx.auth?.sub ? String(ctx.auth.sub) : null\n      // `system` covers a command invocation with no auth context and one running under\n      // `ctx.systemActor`. Without it those writes would be indistinguishable from an\n      // administrator setting someone else's password, which is exactly the case security\n      // alerting escalates on. Password writes that never reach this command \u2014 `mercato\n      // auth set-password`, tenant provisioning \u2014 set `passwordHash` directly and emit\n      // nothing, so a subscriber cannot treat this event as covering every credential change.\n      const changedBy = ctx.systemActor === true || !actorId\n        ? 'system'\n        : actorId === identifiers.id ? 'self' : 'admin'\n      void emitAuthEvent('auth.password.changed', {\n        id: identifiers.id,\n        tenantId: identifiers.tenantId,\n        organizationId: identifiers.organizationId,\n        changedBy,\n        changedById: actorId,\n        at: new Date().toISOString(),\n      }, { persistent: true }).catch(() => undefined)\n    }\n\n    if (Array.isArray(parsed.roles) && rolesBefore) {\n      const rolesAfter = await loadUserRoleNames(em, String(user.id))\n      const { assigned, revoked } = diffRoleChanges(rolesBefore, rolesAfter)\n      if (assigned.length || revoked.length) {\n        await notifyRoleChanges(ctx, user, assigned, revoked)\n      }\n    }\n\n    await invalidateUserCache(ctx, parsed.id)\n\n    return user\n  },\n  captureAfter: async (_input, result, ctx) => {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const roles = await loadUserRoleNames(em, String(result.id))\n    const custom = await loadUserCustomSnapshot(\n      em,\n      String(result.id),\n      result.tenantId ? String(result.tenantId) : null,\n      result.organizationId ? String(result.organizationId) : null\n    )\n    return serializeUser(result, roles, custom)\n  },\n  buildLog: async ({ result, snapshots, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as UserSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const afterRoles = await loadUserRoleNames(em, String(result.id))\n    const afterCustom = await loadUserCustomSnapshot(\n      em,\n      String(result.id),\n      result.tenantId ? String(result.tenantId) : null,\n      result.organizationId ? String(result.organizationId) : null\n    )\n    const afterSnapshots = captureUserSnapshots(result, afterRoles, undefined, afterCustom)\n    const after = afterSnapshots.view\n    const changes = buildChanges(before ?? null, after as Record<string, unknown>, ['email', 'organizationId', 'tenantId', 'name', 'isConfirmed'])\n    if (before && !arrayEquals(before.roles, afterRoles)) {\n      changes.roles = { from: before.roles, to: afterRoles }\n    }\n    const customDiff = diffCustomFieldChanges(before?.custom, afterCustom)\n    for (const [key, diff] of Object.entries(customDiff)) {\n      changes[`cf_${key}`] = diff\n    }\n    return {\n      actionLabel: translate('auth.audit.users.update', 'Update user'),\n      resourceKind: 'auth.user',\n      resourceId: String(result.id),\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      organizationId: result.organizationId ? String(result.organizationId) : null,\n      changes,\n      snapshotBefore: before ?? null,\n      snapshotAfter: after,\n      payload: {\n        undo: {\n          before: beforeUndo,\n          after: afterSnapshots.undo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<UndoPayload<UserUndoSnapshot>>(logEntry)\n    const before = payload?.before\n    const after = payload?.after\n    if (!before) return\n    const userId = before.id\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    // Reverting an update can drop the tenant below a protected role's floor just as the\n    // forward path can \u2014 restoring an empty `before.roles` on what is now the last admin,\n    // or restoring `isConfirmed: false`. Undo is reachable from the audit-log UI, so the\n    // guard has to run here too, inside a transaction so the row lock is valid.\n    const restoredTenantId = before.tenantId ? String(before.tenantId) : null\n\n    let updated: User | null = null\n    await withAtomicFlush(em, [\n      async () => {\n        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n        const currentTenantId = current?.tenantId ? String(current.tenantId) : null\n\n        await enforceProtectedRoleFloor(em, currentTenantId, userId, {\n          deactivating: before.isConfirmed === false || restoredTenantId !== currentTenantId,\n          newRoles: before.roles,\n        }, ctx)\n\n        updated = await de.updateOrmEntity({\n          entity: User,\n          where: { id: userId, deletedAt: null } as FilterQuery<User>,\n          apply: (entity) => {\n            entity.email = before.email\n            entity.organizationId = before.organizationId ?? null\n            entity.tenantId = before.tenantId ?? null\n            entity.passwordHash = before.passwordHash ?? null\n            entity.name = before.name ?? null\n            entity.isConfirmed = before.isConfirmed\n          },\n        })\n\n        if (updated) {\n          await syncUserRoles(em, updated, before.roles, before.tenantId)\n        }\n      },\n    ], { transaction: true, label: 'auth.users.update.undo' })\n\n    const reset = buildCustomFieldResetMap(before.custom, after?.custom)\n    if (Object.keys(reset).length) {\n      await setCustomFieldsIfAny({\n        dataEngine: de,\n        entityId: E.auth.user,\n        recordId: before.id,\n        organizationId: before.organizationId ?? null,\n        tenantId: before.tenantId ?? null,\n        values: reset,\n        notify: false,\n      })\n    }\n\n    await emitCrudUndoSideEffects({\n      dataEngine: de,\n      action: 'updated',\n      entity: updated,\n      identifiers: {\n        id: before.id,\n        organizationId: before.organizationId ?? null,\n        tenantId: before.tenantId ?? null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, userId)\n  },\n}\n\nconst deleteUserCommand: CommandHandler<{ body?: Record<string, unknown>; query?: Record<string, unknown> }, User> = {\n  id: 'auth.users.delete',\n  async prepare(input, ctx) {\n    const id = requireId(input, 'User id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) return {}\n    const actorTenantScope = resolveActorTenantScope(ctx)\n    if (actorTenantScope) {\n      const targetTenant = normalizeTenantId(existing.tenantId) ?? null\n      if (!targetTenant || targetTenant !== actorTenantScope) return {}\n    }\n    const roles = await loadUserRoleNames(em, id)\n    const acls = await loadUserAclSnapshots(em, id)\n    const custom = await loadUserCustomSnapshot(\n      em,\n      id,\n      existing.tenantId ? String(existing.tenantId) : null,\n      existing.organizationId ? String(existing.organizationId) : null\n    )\n    return { before: captureUserSnapshots(existing, roles, acls, custom) }\n  },\n  async execute(input, ctx) {\n    const id = requireId(input, 'User id required')\n    const em = (ctx.container.resolve('em') as EntityManager)\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n    const actorTenantScope = resolveActorTenantScope(ctx)\n\n    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })\n    if (!existing) throw new CrudHttpError(404, { error: 'User not found' })\n    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {\n      throw new CrudHttpError(404, { error: 'User not found' })\n    }\n\n    const deleteWhere: Record<string, unknown> = { id, deletedAt: null }\n    if (actorTenantScope) deleteWhere.tenantId = actorTenantScope\n\n    let user!: User\n    await withAtomicFlush(em, [\n      async () => {\n        const userTenantId = existing.tenantId ? String(existing.tenantId) : null\n        await enforceProtectedRoleFloor(em, userTenantId, id, { deleting: true }, ctx)\n\n        await em.nativeDelete(UserAcl, { user: id })\n        await em.nativeDelete(UserRole, { user: id })\n        await em.nativeDelete(Session, { user: id })\n        await em.nativeDelete(PasswordReset, { user: id })\n        await em.nativeDelete(UserSidebarPreference, { user: id })\n        await em.nativeDelete(SidebarVariant, { user: id })\n        const removed = await de.deleteOrmEntity({\n          entity: User,\n          where: deleteWhere as FilterQuery<User>,\n          soft: false,\n        })\n        if (!removed) throw new CrudHttpError(404, { error: 'User not found' })\n        user = removed\n      },\n    ], { transaction: true })\n\n    await emitCrudSideEffects({\n      dataEngine: de,\n      action: 'deleted',\n      entity: user,\n      identifiers: {\n        id: String(id),\n        organizationId: user.organizationId ? String(user.organizationId) : null,\n        tenantId: user.tenantId ? String(user.tenantId) : null,\n      },\n      events: userCrudEvents,\n      indexer: userCrudIndexer,\n    })\n\n    await invalidateUserCache(ctx, id)\n\n    return user\n  },\n  buildLog: async ({ snapshots, input, ctx }) => {\n    const { translate } = await resolveTranslations()\n    const beforeSnapshots = snapshots.before as UserSnapshots | undefined\n    const before = beforeSnapshots?.view\n    const beforeUndo = beforeSnapshots?.undo ?? null\n    const id = requireId(input, 'User id required')\n    return {\n      actionLabel: translate('auth.audit.users.delete', 'Delete user'),\n      resourceKind: 'auth.user',\n      resourceId: id,\n      snapshotBefore: before ?? null,\n      tenantId: before?.tenantId ?? null,\n      organizationId: before?.organizationId ?? null,\n      payload: {\n        undo: {\n          before: beforeUndo,\n        },\n      },\n    }\n  },\n  undo: async ({ logEntry, ctx }) => {\n    const payload = extractUndoPayload<UndoPayload<UserUndoSnapshot>>(logEntry)\n    const before = payload?.before\n    if (!before) return\n    const em = (ctx.container.resolve('em') as EntityManager)\n    let user = await findOneWithDecryption(em, User, { id: before.id }, {}, { tenantId: null, organizationId: null })\n    const de = (ctx.container.resolve('dataEngine') as DataEngine)\n\n    await withAtomicFlush(em, [\n      async () => {\n        if (user) {\n          if (user.deletedAt) {\n            user.deletedAt = null\n          }\n          user.email = before.email\n          user.organizationId = before.organizationId ?? null\n          user.tenantId = before.tenantId ?? null\n          user.passwordHash = before.passwordHash ?? null\n          user.name = before.name ?? null\n          user.isConfirmed = before.isConfirmed\n          await em.flush()\n        } else {\n          user = await de.createOrmEntity({\n            entity: User,\n            data: {\n              id: before.id,\n              email: before.email,\n              organizationId: before.organizationId ?? null,\n              tenantId: before.tenantId ?? null,\n              passwordHash: before.passwordHash ?? null,\n              name: before.name ?? null,\n              isConfirmed: before.isConfirmed,\n            },\n          })\n        }\n\n        if (!user) return\n\n        await em.nativeDelete(UserRole, { user: before.id })\n        await syncUserRoles(em, user, before.roles, before.tenantId)\n\n        await restoreUserAcls(em, user, before.acls)\n\n        const reset = buildCustomFieldResetMap(before.custom, undefined)\n        if (Object.keys(reset).length) {\n          await setCustomFieldsIfAny({\n            dataEngine: de,\n            entityId: E.auth.user,\n            recordId: before.id,\n            organizationId: before.organizationId ?? null,\n            tenantId: before.tenantId ?? null,\n            values: reset,\n            notify: false,\n          })\n        }\n      },\n    ], { transaction: true })\n\n    await invalidateUserCache(ctx, before.id)\n  },\n}\n\nregisterCommand(createUserCommand)\nregisterCommand(updateUserCommand)\nregisterCommand(deleteUserCommand)\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nasync function resolveRole(\n  em: EntityManager,\n  value: string,\n  normalizedTenantId: string | null,\n): Promise<Role | null> {\n  if (UUID_RE.test(value)) {\n    const where: Record<string, unknown> = { id: value }\n    if (normalizedTenantId !== null) {\n      where.tenantId = normalizedTenantId\n    }\n    return findOneWithDecryption(em, Role, where as any, {}, { tenantId: normalizedTenantId, organizationId: null })\n  }\n  return findOneWithDecryption(em, Role, { name: value, tenantId: normalizedTenantId }, {}, { tenantId: normalizedTenantId, organizationId: null })\n}\n\nasync function syncUserRoles(em: EntityManager, user: User, desiredRoles: string[], tenantId: string | null) {\n  const unique = Array.from(new Set(desiredRoles.map((role) => role.trim()).filter(Boolean)))\n  const normalizedTenantId = normalizeTenantId(tenantId ?? null) ?? null\n\n  const resolvedRoles: Role[] = []\n  const missingRoles: string[] = []\n  for (const value of unique) {\n    const role = await resolveRole(em, value, normalizedTenantId)\n    if (!role) {\n      missingRoles.push(value)\n    } else {\n      resolvedRoles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((n) => `\"${n}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  const desiredIds = new Set(resolvedRoles.map((r) => String(r.id)))\n  const currentLinks = await findWithDecryption(em, UserRole, { user }, {}, { tenantId: null, organizationId: null })\n  const currentRoleIds = new Map(\n    currentLinks.map((link) => {\n      const roleId = String(link.role?.id ?? (link.role as unknown as string) ?? '')\n      return [roleId, link] as const\n    }),\n  )\n\n  for (const [roleId, link] of currentRoleIds.entries()) {\n    if (!desiredIds.has(roleId) && link) {\n      em.remove(link)\n    }\n  }\n\n  for (const role of resolvedRoles) {\n    if (!currentRoleIds.has(String(role.id))) {\n      em.persist(em.create(UserRole, { user, role, createdAt: new Date() }))\n    }\n  }\n\n  await em.flush()\n}\n\nasync function loadUserRoleNames(em: EntityManager, userId: string): Promise<string[]> {\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown as User },\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const names = links\n    .map((link) => link.role?.name ?? '')\n    .filter((name): name is string => !!name)\n  return Array.from(new Set(names)).sort((a, b) => a.localeCompare(b))\n}\n\nfunction serializeUser(user: User, roles: string[], custom?: Record<string, unknown> | null): SerializedUser {\n  const payload: SerializedUser = {\n    email: String(user.email ?? ''),\n    organizationId: user.organizationId ? String(user.organizationId) : null,\n    tenantId: user.tenantId ? String(user.tenantId) : null,\n    roles,\n    name: user.name ? String(user.name) : null,\n    isConfirmed: Boolean(user.isConfirmed),\n  }\n  if (custom && Object.keys(custom).length) payload.custom = custom\n  return payload\n}\n\nfunction captureUserSnapshots(\n  user: User,\n  roles: string[],\n  acls: UserAclSnapshot[] = [],\n  custom?: Record<string, unknown> | null\n): UserSnapshots {\n  return {\n    view: serializeUser(user, roles, custom),\n    undo: {\n      id: String(user.id),\n      email: String(user.email ?? ''),\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      passwordHash: user.passwordHash ? String(user.passwordHash) : null,\n      name: user.name ? String(user.name) : null,\n      isConfirmed: Boolean(user.isConfirmed),\n      roles: [...roles],\n      acls,\n      ...(custom && Object.keys(custom).length ? { custom } : {}),\n    },\n  }\n}\n\nasync function loadUserAclSnapshots(em: EntityManager, userId: string): Promise<UserAclSnapshot[]> {\n  const list = await findWithDecryption(em, UserAcl, { user: userId as unknown as User }, {}, { tenantId: null, organizationId: null })\n  return list.map((acl) => ({\n    tenantId: String(acl.tenantId),\n    features: Array.isArray(acl.featuresJson) ? [...acl.featuresJson] : null,\n    isSuperAdmin: Boolean(acl.isSuperAdmin),\n    organizations: Array.isArray(acl.organizationsJson) ? [...acl.organizationsJson] : null,\n  }))\n}\n\nasync function restoreUserAcls(em: EntityManager, user: User, acls: UserAclSnapshot[]) {\n  await em.nativeDelete(UserAcl, { user: String(user.id) })\n  for (const acl of acls) {\n    const entity = em.create(UserAcl, {\n      user,\n      tenantId: acl.tenantId,\n      featuresJson: acl.features ?? null,\n      isSuperAdmin: acl.isSuperAdmin,\n      organizationsJson: acl.organizations ?? null,\n      createdAt: new Date(),\n    })\n    em.persist(entity)\n  }\n  await em.flush()\n}\n\nasync function loadUserCustomSnapshot(\n  em: EntityManager,\n  id: string,\n  tenantId: string | null,\n  organizationId: string | null\n): Promise<Record<string, unknown>> {\n  return await loadCustomFieldSnapshot(em, {\n    entityId: E.auth.user,\n    recordId: id,\n    tenantId,\n    organizationId,\n  })\n}\n\nasync function invalidateUserCache(ctx: CommandRuntimeContext, userId: string) {\n  try {\n    const rbacService = ctx.container.resolve('rbacService') as { invalidateUserCache: (uid: string) => Promise<void> }\n    await rbacService.invalidateUserCache(userId)\n  } catch {\n    // RBAC not available\n  }\n\n  try {\n    const cache = ctx.container.resolve('cache') as { deleteByTags?: (tags: string[]) => Promise<void> }\n    if (cache?.deleteByTags) await cache.deleteByTags([`rbac:user:${userId}`])\n  } catch {\n    // cache not available\n  }\n}\n\nfunction diffRoleChanges(before: string[], after: string[]) {\n  const beforeSet = new Set(before)\n  const afterSet = new Set(after)\n  const assigned = after.filter((role) => !beforeSet.has(role))\n  const revoked = before.filter((role) => !afterSet.has(role))\n  return { assigned, revoked }\n}\n\nfunction arrayEquals(left: string[] | undefined, right: string[]): boolean {\n  if (!left) return false\n  if (left.length !== right.length) return false\n  return left.every((value, idx) => value === right[idx])\n}\n\nasync function throwDuplicateEmailError(): Promise<never> {\n  const { translate } = await resolveTranslations()\n  const message = translate('auth.users.errors.emailExists', 'Email already in use')\n  throw new CrudHttpError(400, {\n    error: message,\n    fieldErrors: { email: message },\n    details: [{ path: ['email'], message, code: 'duplicate', origin: 'validation' }],\n  })\n}\n\ntype ProtectedRoleFloorOptions = {\n  deactivating?: boolean\n  newRoles?: string[]\n  deleting?: boolean\n}\n\n/**\n * True when the requested mutation can lower a role's active holder count. Guards the\n * floor check so that ordinary edits (display name, password, email) never take the\n * tenant-wide role lock \u2014 `PUT /api/auth/profile` routes every self-service password\n * change through `auth.users.update`, so an unconditional lock would serialize them.\n */\nfunction couldReduceActiveHolders(options: ProtectedRoleFloorOptions): boolean {\n  return options.deleting === true || options.deactivating === true || options.newRoles !== undefined\n}\n\nasync function enforceProtectedRoleFloor(\n  em: EntityManager,\n  tenantId: string | null,\n  userId: string,\n  options: ProtectedRoleFloorOptions,\n  ctx?: CommandRuntimeContext,\n): Promise<void> {\n  // Internal automation (CLI, migrations, tenant teardown) must never be blocked by the\n  // floor. Superadmins are deliberately NOT exempt \u2014 see the spec's Risks section.\n  if (ctx?.systemActor === true) return\n  if (!couldReduceActiveHolders(options)) return\n\n  const normalizedTenantId = normalizeTenantId(tenantId) ?? null\n  if (!normalizedTenantId) return\n\n  // Find all protected roles in this tenant, acquiring a pessimistic write lock in a deterministic primary key order\n  const protectedRoles = await findWithDecryption(em, Role, {\n    tenantId: normalizedTenantId,\n    minActiveHolders: { $gt: 0 },\n    deletedAt: null\n  }, {\n    lockMode: LockMode.PESSIMISTIC_WRITE,\n    orderBy: { id: 'ASC' }\n  }, { tenantId: normalizedTenantId, organizationId: null })\n\n  if (protectedRoles.length === 0) return\n\n  const { translate } = await resolveTranslations()\n\n  for (const role of protectedRoles) {\n    const minFloor = role.minActiveHolders ?? 0\n    if (minFloor <= 0) continue\n\n    // Active links for this role, scoped to the tenant by the nested user filter so the\n    // database \u2014 not a post-filter \u2014 enforces isolation. Deliberately NOT populated:\n    // `findWithDecryption` runs `decryptEntityGraph` over loaded relations, which would\n    // decrypt every admin's email and name on each check just to read their ids.\n    const activeLinks = await findWithDecryption(em, UserRole, {\n      role: role.id,\n      deletedAt: null,\n      user: {\n        deletedAt: null,\n        isConfirmed: true,\n        tenantId: normalizedTenantId\n      }\n    }, {}, { tenantId: null, organizationId: null })\n\n    // Count distinct user IDs in the tenant holding this role to prevent overcounting due to duplicate links\n    const activeUserIds = Array.from(\n      new Set(\n        activeLinks\n          .map((link) => {\n            const userRef = link.user as unknown as { id?: string } | string | null | undefined\n            const linkedUserId = typeof userRef === 'string' ? userRef : userRef?.id\n            return linkedUserId ? String(linkedUserId) : null\n          })\n          .filter((id): id is string => !!id)\n      )\n    )\n\n    // Is the target user currently one of the active holders?\n    if (activeUserIds.includes(userId)) {\n      // Determine if they will remain an active holder\n      let willStillBeActiveHolder = true\n\n      if (options.deleting || options.deactivating) {\n        willStillBeActiveHolder = false\n      } else if (options.newRoles !== undefined) {\n        // Checking role list\n        const desiredUnique = Array.from(new Set(options.newRoles.map((r) => r.trim().toLowerCase()).filter(Boolean)))\n        const roleNameLower = role.name.toLowerCase()\n        const hasRoleByName = desiredUnique.includes(roleNameLower) || desiredUnique.includes(String(role.id).toLowerCase())\n        if (!hasRoleByName) {\n          willStillBeActiveHolder = false\n        }\n      }\n\n      if (!willStillBeActiveHolder) {\n        const remaining = activeUserIds.length - 1\n        if (remaining < minFloor) {\n          throw new CrudHttpError(400, {\n            error: translate('auth.users.errors.lastHolderOfCriticalRole', 'Cannot remove the last active holder of role \"{roleName}\"', { roleName: role.name })\n          })\n        }\n      }\n    }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAI9B,SAAS,2BAA2B;AACpC,SAAS,oCAAoC,gBAAgB;AAE7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC,SAAS,SAAS;AAClB,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA4C;AACrD,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,kBAAkB,6BAA6B;AACxD,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,OAAO,uBAAuB;AAC9B,SAAS,2BAA2B;AACpC,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAC1B,OAAO,qBAAqB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAqCzE,SAAS,wBAAwB,KAA2C;AAC1E,MAAI,IAAI,gBAAgB,KAAM,QAAO;AACrC,QAAM,OAAO,IAAI;AACjB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAoC,iBAAiB,KAAM,QAAO;AACvE,QAAM,gBAAgB,kBAAkB,KAAK,YAAY,IAAI,KAAK;AAClE,SAAO;AACT;AAEA,SAAS,0BAA0B,kBAAiC,gBAAyB,eAA6B;AACxH,MAAI,CAAC,iBAAkB;AACvB,QAAM,eAAe,kBAAkB,cAAc,KAAK;AAC1D,MAAI,CAAC,gBAAgB,iBAAiB,kBAAkB;AACtD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,EACvD;AACF;AAEA,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,oBAAoB,EAAE;AAAA,EAC1B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACxD;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACtC,CAAC,EAAE;AAAA,EACD,CAAC,SAAS,KAAK,YAAY,KAAK;AAAA,EAChC,EAAE,SAAS,kDAAkD,MAAM,CAAC,UAAU,EAAE;AAClF;AAEA,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,MAAM;AAAA,EACN,UAAU,eAAe,SAAS;AAAA,EAClC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAEM,MAAM,iBAAmC;AAAA,EAC9C,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,cAAc,CAAC,SAAS;AAAA,IACtB,IAAI,IAAI,YAAY;AAAA,IACpB,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEO,MAAM,kBAAqC;AAAA,EAChD,YAAY,EAAE,KAAK;AAAA,EACnB,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AAAA,EACA,oBAAoB,CAAC,SAAS;AAAA,IAC5B,YAAY,EAAE,KAAK;AAAA,IACnB,UAAU,IAAI,YAAY;AAAA,IAC1B,gBAAgB,IAAI,YAAY;AAAA,IAChC,UAAU,IAAI,YAAY;AAAA,EAC5B;AACF;AAEA,eAAe,kBACb,KACA,MACA,eACA,cACe;AACf,QAAM,WAAW,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AACzD,MAAI,CAAC,SAAU;AACf,QAAM,iBAAiB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAE3E,MAAI;AACF,UAAM,sBAAsB,2BAA2B,IAAI,SAAS;AACpE,QAAI,cAAc,QAAQ;AACxB,YAAM,eAAe,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,oBAAoB;AACxF,UAAI,cAAc;AAChB,cAAM,oBAAoB,0BAA0B,cAAc;AAAA,UAChE,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB,EAAE,UAAU,eAAe,CAAC;AAAA,MAClF;AAAA,IACF;AAEA,QAAI,aAAa,QAAQ;AACvB,YAAM,cAAc,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,mBAAmB;AACtF,UAAI,aAAa;AACf,cAAM,oBAAoB,0BAA0B,aAAa;AAAA,UAC/D,iBAAiB,OAAO,KAAK,EAAE;AAAA,UAC/B,kBAAkB;AAAA,UAClB,gBAAgB,OAAO,KAAK,EAAE;AAAA,QAChC,CAAC;AACD,cAAM,oBAAoB,OAAO,mBAAmB,EAAE,UAAU,eAAe,CAAC;AAAA,MAClF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,iCAAiC,EAAE,IAAI,CAAC;AAAA,EACvD;AACF;AAIA,MAAM,oBAA+E;AAAA,EACnF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AAEtC,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,OAAO,eAAe;AAAA,MAC5B,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB,EAAE,UAAU,MAAM,gBAAgB,OAAO,eAAe;AAAA,IAC1D;AACA,QAAI,CAAC,aAAc,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yBAAyB,CAAC;AACnF,UAAM,WAAW,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AAC5E,8BAA0B,wBAAwB,GAAG,GAAG,UAAU,wBAAwB;AAE1F,UAAM,YAAY,iBAAiB,OAAO,KAAK;AAK/C,UAAM,YAAY,MAAM,sBAAsB,IAAI,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,OAAO,KAAK,EAAE,EAAE,CAAC,GAAG,WAAW,MAAM,SAAS,GAAU,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvO,QAAI,UAAW,OAAM,yBAAyB;AAE9C,QAAI,eAA8B;AAClC,QAAI,OAAO,UAAU;AACnB,YAAM,EAAE,KAAK,IAAI,MAAM,OAAO,UAAU;AACxC,qBAAe,MAAM,KAAK,OAAO,UAAU,EAAE;AAAA,IAC/C;AAEA,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,GAAG,gBAAgB;AAAA,QAC9B,QAAQ;AAAA,QACR,MAAM;AAAA,UACJ,OAAO,OAAO;AAAA,UACd,MAAM,OAAO;AAAA,UACb;AAAA,UACA;AAAA,UACA,aAAa;AAAA,UACb,gBAAgB,OAAO;AAAA,UACvB;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,kBAAkB,KAAK,EAAG,OAAM,yBAAyB;AAC7D,YAAM;AAAA,IACR;AAEA,QAAI,gBAA0B,CAAC;AAC/B,QAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,MAAM,QAAQ;AACtD,YAAM,cAAc,IAAI,MAAM,OAAO,OAAO,QAAQ;AACpD,sBAAgB,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,qBAAqB;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU,EAAE,KAAK;AAAA,MACjB,UAAU,OAAO,KAAK,EAAE;AAAA,MACxB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAED,QAAI,kBAAkB;AACtB,QAAI,OAAO,iBAAiB;AAC1B,YAAM,eAAe,MAAM,iBAAiB,IAAI,IAAI;AACpD,wBAAkB,aAAa;AAAA,IACjC;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,KAAK,EAAE;AAAA,QAClB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACpE;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,cAAc,UAAU,CAAC,OAAO,iBAAiB;AACnD,YAAM,kBAAkB,KAAK,MAAM,eAAe,CAAC,CAAC;AAAA,IACtD;AAEA,UAAM,UAAW,OAAO,mBAAmB,CAAC,kBAAmB,wBAAiC;AAEhG,WAAO,EAAE,MAAM,QAAQ;AAAA,EACzB;AAAA,EACA,cAAc,OAAO,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAC7C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AACzD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,EAAE;AAAA,MACd,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACxC,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtD;AACA,WAAO,cAAc,MAAM,OAAO,MAAM;AAAA,EAC1C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,EAAE,KAAK,GAAG,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AACzD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,KAAK,EAAE;AAAA,MACd,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACxC,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtD;AACA,UAAM,WAAW,qBAAqB,MAAM,OAAO,QAAW,MAAM;AACpE,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,KAAK,EAAE;AAAA,MAC1B,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,eAAe,SAAS;AAAA,MACxB,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,OAAO,SAAS;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,SAAS,OAAO,UAAU,eAAe,WAAW,SAAS,aAAa;AAChF,QAAI,CAAC,OAAQ;AACb,UAAM,WAAW,UAAU;AAC3B,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAO9C,QAAI,UAAuB;AAC3B,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACnI,cAAM,gBAAgB,SAAS,WAAW,OAAO,QAAQ,QAAQ,IAAK,UAAU,YAAY;AAK5F,cAAM,0BAA0B,IAAI,eAAe,QAAQ,EAAE,UAAU,KAAK,GAAG,GAAG;AAElF,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,OAAO,CAAC;AAChD,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAC/C,cAAM,GAAG,aAAa,eAAe,EAAE,MAAM,OAAO,CAAC;AACrD,cAAM,GAAG,aAAa,uBAAuB,EAAE,MAAM,OAAO,CAAC;AAC7D,cAAM,GAAG,aAAa,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAEtD,YAAI,UAAU,UAAU,OAAO,KAAK,SAAS,MAAM,EAAE,QAAQ;AAC3D,gBAAM,QAAQ,yBAAyB,QAAW,SAAS,MAAM;AACjE,cAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,kBAAM,qBAAqB;AAAA,cACzB,YAAY;AAAA,cACZ,UAAU,EAAE,KAAK;AAAA,cACjB,UAAU;AAAA,cACV,gBAAgB,SAAS;AAAA,cACzB,UAAU,SAAS;AAAA,cACnB,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AACA,kBAAU,MAAM,GAAG,gBAAgB;AAAA,UACjC,QAAQ;AAAA,UACR,OAAO,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,UACrC,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,yBAAyB,CAAC;AAEzD,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI;AAAA,QACJ,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,UAAU,UAAU,YAAY;AAAA,MAClC;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,QAAQ,oBAAsC,QAAQ;AAC5D,QAAI,CAAC,MAAO,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uDAAuD,CAAC;AAC1G,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,YAAY,iBAAiB,MAAM,KAAK;AAE9C,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC/G,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,YAAI,MAAM;AACR,eAAK,YAAY;AACjB,eAAK,QAAQ,MAAM;AACnB,eAAK,YAAY;AACjB,eAAK,iBAAiB,MAAM,kBAAkB;AAC9C,eAAK,WAAW,MAAM,YAAY;AAClC,eAAK,eAAe,MAAM,gBAAgB;AAC1C,eAAK,OAAO,MAAM,QAAQ;AAC1B,eAAK,cAAc,MAAM;AACzB,gBAAM,GAAG,MAAM;AAAA,QACjB,OAAO;AACL,iBAAO,MAAM,GAAG,gBAAgB;AAAA,YAC9B,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,IAAI,MAAM;AAAA,cACV,OAAO,MAAM;AAAA,cACb;AAAA,cACA,gBAAgB,MAAM,kBAAkB;AAAA,cACxC,UAAU,MAAM,YAAY;AAAA,cAC5B,cAAc,MAAM,gBAAgB;AAAA,cACpC,MAAM,MAAM,QAAQ;AAAA,cACpB,aAAa,MAAM;AAAA,YACrB;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,CAAC,KAAM;AAEX,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,MAAM,GAAG,CAAC;AAClD,cAAM,cAAc,IAAI,MAAM,MAAM,OAAO,MAAM,QAAQ;AACzD,cAAM,gBAAgB,IAAI,MAAM,MAAM,IAAI;AAE1C,YAAI,MAAM,UAAU,OAAO,KAAK,MAAM,MAAM,EAAE,QAAQ;AACpD,gBAAM,QAAQ,yBAAyB,MAAM,QAAQ,MAAS;AAC9D,cAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,kBAAM,qBAAqB;AAAA,cACzB,YAAY;AAAA,cACZ,UAAU,EAAE,KAAK;AAAA,cACjB,UAAU,MAAM;AAAA,cAChB,gBAAgB,MAAM,kBAAkB;AAAA,cACxC,UAAU,MAAM,YAAY;AAAA,cAC5B,QAAQ;AAAA,cACR,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,QAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,6CAA6C,CAAC;AAE/F,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,MAAM;AAAA,QACV,gBAAgB,MAAM,kBAAkB;AAAA,QACxC,UAAU,MAAM,YAAY;AAAA,MAC9B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM,EAAE;AAEvC,WAAO,EAAE,KAAK;AAAA,EAChB;AACF;AAEA,eAAe,iBACb,IACA,MACiC;AACjC,QAAM,WAAW,kBAAkB;AACnC,QAAM,YAAY,cAAc,QAAQ;AACxC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,mBAAmB;AAC3D,QAAM,MAAM,GAAG,OAAO,eAAe,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAC;AACjG,QAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAE5B,QAAM,OAAO,wBAAwB;AACrC,QAAM,YAAY,GAAG,IAAI,UAAU,QAAQ;AAE3C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,6BAA6B,uBAAuB;AAC9E,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,6BAA6B,qBAAqB;AAAA,IACrE,OAAO,UAAU,2BAA2B,uBAAuB;AAAA,IACnE,MAAM,UAAU,0BAA0B,gIAAgI;AAAA,IAC1K,KAAK,UAAU,yBAAyB,sBAAsB;AAAA,IAC9D,MAAM,UAAU,0BAA0B,0EAA0E;AAAA,EACtH;AAEA,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,UAAU;AAAA,MACd,IAAI,KAAK;AAAA,MACT;AAAA,MACA,OAAO,gBAAgB,EAAE,WAAW,KAAK,CAAC;AAAA,MAC1C,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,gBAAY;AAAA,EACd;AAEA,SAAO,EAAE,UAAU;AACrB;AAEA,SAAS,kBAAkB,OAAyB;AAClD,MAAI,iBAAiB,mCAAoC,QAAO;AAChE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,OAAQ,MAA4B;AAC1C,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,aAAc,OAAgC;AACpD,QAAM,UAAU,OAAO,eAAe,WAAW,aAAa;AAC9D,SAAO,QAAQ,YAAY,EAAE,SAAS,eAAe;AACvD;AAEA,MAAM,oBAAmE;AAAA,EACvE,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AAC/D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,8BAA0B,wBAAwB,GAAG,GAAG,SAAS,UAAU,gBAAgB;AAC3F,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,EAAE;AACnD,UAAM,OAAO,MAAM,qBAAqB,IAAI,OAAO,EAAE;AACrD,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,MACP,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,MAChD,SAAS,iBAAiB,OAAO,SAAS,cAAc,IAAI;AAAA,IAC9D;AACA,WAAO,EAAE,QAAQ,qBAAqB,UAAU,OAAO,MAAM,MAAM,EAAE;AAAA,EACvE;AAAA,EACA,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,EAAE,QAAQ,OAAO,IAAI,sBAAsB,cAAc,QAAQ;AACvE,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,mBAAmB,wBAAwB,GAAG;AACpD,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACvI,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,QAAI,oBAAoB,SAAS,YAAY,OAAO,SAAS,QAAQ,MAAM,kBAAkB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC1D;AAEA,UAAM,cAAc,MAAM,QAAQ,OAAO,KAAK,IAC1C,MAAM,kBAAkB,IAAI,OAAO,EAAE,IACrC;AAEJ,QAAI;AACJ,QAAI,qBAAqB;AACzB,QAAI,OAAO,mBAAmB,QAAW;AACvC,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,eAAe;AAAA,QAC5B,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,QACvB,EAAE,UAAU,MAAM,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,MAClE;AACA,UAAI,CAAC,aAAc,QAAO,yCAAyC,GAAG;AACtE,iBAAW,aAAa,QAAQ,KAAK,OAAO,aAAa,OAAO,EAAE,IAAI;AACtE,UAAI,CAAC,SAAU,QAAO,yCAAyC,GAAG;AAClE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAAA,QACjC,CAAC;AAAA,QACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,MACzC;AACA,UAAI,CAAC,YAAa,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAC1E,YAAM,wBAAwB,YAAY,iBAAiB,OAAO,YAAY,cAAc,IAAI;AAChG,YAAM,kBAAkB,YAAY,WAAW,OAAO,YAAY,QAAQ,IAAI;AAC9E,2BAAqB,0BAA0B,OAAO,kBAAkB,oBAAoB;AAC5F,UAAI,oBAAoB;AACtB,cAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,cAAM,mBAAmB,MAAM,4BAA4B;AAAA,UACzD;AAAA,UACA,cAAc,OAAO;AAAA,UACrB,qBAAqB;AAAA,UACrB,YAAY,OAAO;AAAA,QACrB,CAAC;AACD,cAAM,oBAAoB,IAAI,gBAAgB,QAAQ,IAAI,MAAM,iBAAiB;AACjF,cAAM,oBAAoB,IAAI,mBAAmB,aAAa,WAC1D,IAAI,oBACJ,CAAC,qBAAqB,IAAI,MAAM,MAC9B,MAAM,yBAAyB;AAAA,UAC7B;AAAA,UACA,MAAM;AAAA,UACN,MAAM,IAAI;AAAA,UACV;AAAA,QACF,CAAC,IACD;AACN,cAAM,oCAAoC;AAAA,UACxC;AAAA,UACA;AAAA,UACA,aAAa,IAAI,MAAM;AAAA,UACvB;AAAA,UACA,UAAU,IAAI,MAAM,YAAY;AAAA,UAChC,gBAAgB,IAAI,MAAM,SAAS;AAAA,UACnC,wBAAwB,mBAAmB;AAAA,UAC3C,qBAAqB;AAAA,UACrB,2BAA2B,OAAO;AAAA,UAClC,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,eAAe,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AACrE,UAAM,iBAAiB,aAAa,SAAY,WAAW;AAC3D,UAAM,mBAAmB,mBAAmB;AAG5C,QAAI,SAAwB;AAC5B,QAAI,YAA2B;AAC/B,QAAI,OAAO,UAAU;AACnB,YAAM,EAAE,KAAK,IAAI,MAAM,OAAO,UAAU;AACxC,eAAS,MAAM,KAAK,OAAO,UAAU,EAAE;AAAA,IACzC;AACA,QAAI,OAAO,UAAU,QAAW;AAC9B,kBAAY,iBAAiB,OAAO,KAAK;AAAA,IAC3C;AAEA,UAAM,cAAuC,EAAE,IAAI,OAAO,IAAI,WAAW,KAAK;AAC9E,QAAI,iBAAkB,aAAY,WAAW;AAE7C,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,QAAI;AAEJ,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AAEV,cAAM,0BAA0B,IAAI,cAAc,OAAO,IAAI;AAAA,UAC3D,cAAc,OAAO,gBAAgB,SAAS;AAAA,UAC9C,UAAU,OAAO;AAAA,QACnB,GAAG,GAAG;AAMN,YAAI,OAAO,UAAU,QAAW;AAC9B,gBAAM,YAAY,MAAM;AAAA,YACtB;AAAA,YACA;AAAA,YACA;AAAA,cACE,KAAK,CAAC,EAAE,OAAO,OAAO,MAAM,GAAG,EAAE,WAAW,EAAE,KAAK,sBAAsB,OAAO,KAAK,EAAE,EAAE,CAAC;AAAA,cAC1F,WAAW;AAAA,cACX,UAAU;AAAA,cACV,IAAI,EAAE,KAAK,OAAO,GAAG;AAAA,YACvB;AAAA,YACA,CAAC;AAAA,YACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,UACzC;AACA,cAAI,UAAW,OAAM,yBAAyB;AAAA,QAChD;AAEA,YAAI;AACF,gBAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,YACvC,QAAQ;AAAA,YACR,OAAO;AAAA,YACP,OAAO,CAAC,WAAW;AACjB,kBAAI,OAAO,UAAU,QAAW;AAC9B,uBAAO,QAAQ,OAAO;AACtB,uBAAO,YAAY;AAAA,cACrB;AACA,kBAAI,OAAO,SAAS,QAAW;AAC7B,uBAAO,OAAO,OAAO;AAAA,cACvB;AACA,kBAAI,OAAO,mBAAmB,QAAW;AACvC,uBAAO,iBAAiB,OAAO;AAC/B,uBAAO,WAAW,YAAY;AAAA,cAChC;AACA,kBAAI,OAAO,gBAAgB,QAAW;AACpC,uBAAO,cAAc,OAAO;AAAA,cAC9B;AACA,kBAAI,OAAQ,QAAO,eAAe;AAAA,YACpC;AAAA,UACF,CAAC;AACD,cAAI,QAAS,QAAO;AAAA,QACtB,SAAS,OAAO;AACd,cAAI,kBAAkB,KAAK,EAAG,OAAM,yBAAyB;AAC7D,gBAAM;AAAA,QACR;AACA,YAAI,CAAC,KAAM,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAEnE,YAAI,UAAU,OAAO,gBAAgB,OAAO;AAC1C,gBAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,GAAG,CAAC;AAAA,QACpD;AAEA,YAAI,MAAM,QAAQ,OAAO,KAAK,GAAG;AAC/B,gBAAM,cAAc,IAAI,MAAM,OAAO,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY,IAAI;AAAA,QACtG;AAEA,cAAM,qBAAqB;AAAA,UACzB,YAAY;AAAA,UACZ,UAAU,EAAE,KAAK;AAAA,UACjB,UAAU,OAAO,KAAK,EAAE;AAAA,UACxB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,UACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY;AAAA,UAC9D,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,qBAAqB,kCAAkC,oBAAoB,CAAC;AAE3G,UAAM,cAAc;AAAA,MAClB,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,YAAY;AAAA,IAChE;AAEA,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,QAAI,QAAQ;AACV,YAAM,UAAU,IAAI,MAAM,MAAM,OAAO,IAAI,KAAK,GAAG,IAAI;AAOvD,YAAM,YAAY,IAAI,gBAAgB,QAAQ,CAAC,UAC3C,WACA,YAAY,YAAY,KAAK,SAAS;AAC1C,WAAK,cAAc,yBAAyB;AAAA,QAC1C,IAAI,YAAY;AAAA,QAChB,UAAU,YAAY;AAAA,QACtB,gBAAgB,YAAY;AAAA,QAC5B;AAAA,QACA,aAAa;AAAA,QACb,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC7B,GAAG,EAAE,YAAY,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAChD;AAEA,QAAI,MAAM,QAAQ,OAAO,KAAK,KAAK,aAAa;AAC9C,YAAM,aAAa,MAAM,kBAAkB,IAAI,OAAO,KAAK,EAAE,CAAC;AAC9D,YAAM,EAAE,UAAU,QAAQ,IAAI,gBAAgB,aAAa,UAAU;AACrE,UAAI,SAAS,UAAU,QAAQ,QAAQ;AACrC,cAAM,kBAAkB,KAAK,MAAM,UAAU,OAAO;AAAA,MACtD;AAAA,IACF;AAEA,UAAM,oBAAoB,KAAK,OAAO,EAAE;AAExC,WAAO;AAAA,EACT;AAAA,EACA,cAAc,OAAO,QAAQ,QAAQ,QAAQ;AAC3C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,QAAQ,MAAM,kBAAkB,IAAI,OAAO,OAAO,EAAE,CAAC;AAC3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,EAAE;AAAA,MAChB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC5C,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,IAC1D;AACA,WAAO,cAAc,QAAQ,OAAO,MAAM;AAAA,EAC5C;AAAA,EACA,UAAU,OAAO,EAAE,QAAQ,WAAW,IAAI,MAAM;AAC9C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,aAAa,MAAM,kBAAkB,IAAI,OAAO,OAAO,EAAE,CAAC;AAChE,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA,OAAO,OAAO,EAAE;AAAA,MAChB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MAC5C,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,IAC1D;AACA,UAAM,iBAAiB,qBAAqB,QAAQ,YAAY,QAAW,WAAW;AACtF,UAAM,QAAQ,eAAe;AAC7B,UAAM,UAAU,aAAa,UAAU,MAAM,OAAkC,CAAC,SAAS,kBAAkB,YAAY,QAAQ,aAAa,CAAC;AAC7I,QAAI,UAAU,CAAC,YAAY,OAAO,OAAO,UAAU,GAAG;AACpD,cAAQ,QAAQ,EAAE,MAAM,OAAO,OAAO,IAAI,WAAW;AAAA,IACvD;AACA,UAAM,aAAa,uBAAuB,QAAQ,QAAQ,WAAW;AACrE,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACpD,cAAQ,MAAM,GAAG,EAAE,IAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY,OAAO,OAAO,EAAE;AAAA,MAC5B,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,gBAAgB,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MACxE;AAAA,MACA,gBAAgB,UAAU;AAAA,MAC1B,eAAe;AAAA,MACf,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,UACR,OAAO,eAAe;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAkD,QAAQ;AAC1E,UAAM,SAAS,SAAS;AACxB,UAAM,QAAQ,SAAS;AACvB,QAAI,CAAC,OAAQ;AACb,UAAM,SAAS,OAAO;AACtB,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAM9C,UAAM,mBAAmB,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAErE,QAAI,UAAuB;AAC3B,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,UAAU,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACnI,cAAM,kBAAkB,SAAS,WAAW,OAAO,QAAQ,QAAQ,IAAI;AAEvE,cAAM,0BAA0B,IAAI,iBAAiB,QAAQ;AAAA,UAC3D,cAAc,OAAO,gBAAgB,SAAS,qBAAqB;AAAA,UACnE,UAAU,OAAO;AAAA,QACnB,GAAG,GAAG;AAEN,kBAAU,MAAM,GAAG,gBAAgB;AAAA,UACjC,QAAQ;AAAA,UACR,OAAO,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,UACrC,OAAO,CAAC,WAAW;AACjB,mBAAO,QAAQ,OAAO;AACtB,mBAAO,iBAAiB,OAAO,kBAAkB;AACjD,mBAAO,WAAW,OAAO,YAAY;AACrC,mBAAO,eAAe,OAAO,gBAAgB;AAC7C,mBAAO,OAAO,OAAO,QAAQ;AAC7B,mBAAO,cAAc,OAAO;AAAA,UAC9B;AAAA,QACF,CAAC;AAED,YAAI,SAAS;AACX,gBAAM,cAAc,IAAI,SAAS,OAAO,OAAO,OAAO,QAAQ;AAAA,QAChE;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,MAAM,OAAO,yBAAyB,CAAC;AAEzD,UAAM,QAAQ,yBAAyB,OAAO,QAAQ,OAAO,MAAM;AACnE,QAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,YAAM,qBAAqB;AAAA,QACzB,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,QAC7B,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,UAAM,wBAAwB;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,MAAM;AAAA,EACvC;AACF;AAEA,MAAM,oBAA+G;AAAA,EACnH,IAAI;AAAA,EACJ,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,QAAO,CAAC;AACvB,UAAM,mBAAmB,wBAAwB,GAAG;AACpD,QAAI,kBAAkB;AACpB,YAAM,eAAe,kBAAkB,SAAS,QAAQ,KAAK;AAC7D,UAAI,CAAC,gBAAgB,iBAAiB,iBAAkB,QAAO,CAAC;AAAA,IAClE;AACA,UAAM,QAAQ,MAAM,kBAAkB,IAAI,EAAE;AAC5C,UAAM,OAAO,MAAM,qBAAqB,IAAI,EAAE;AAC9C,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AAAA,MAChD,SAAS,iBAAiB,OAAO,SAAS,cAAc,IAAI;AAAA,IAC9D;AACA,WAAO,EAAE,QAAQ,qBAAqB,UAAU,OAAO,MAAM,MAAM,EAAE;AAAA,EACvE;AAAA,EACA,MAAM,QAAQ,OAAO,KAAK;AACxB,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAC9C,UAAM,mBAAmB,wBAAwB,GAAG;AAEpD,UAAM,WAAW,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC5H,QAAI,CAAC,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACvE,QAAI,oBAAoB,SAAS,YAAY,OAAO,SAAS,QAAQ,MAAM,kBAAkB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,IAC1D;AAEA,UAAM,cAAuC,EAAE,IAAI,WAAW,KAAK;AACnE,QAAI,iBAAkB,aAAY,WAAW;AAE7C,QAAI;AACJ,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,cAAM,eAAe,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI;AACrE,cAAM,0BAA0B,IAAI,cAAc,IAAI,EAAE,UAAU,KAAK,GAAG,GAAG;AAE7E,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAC3C,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,GAAG,CAAC;AAC5C,cAAM,GAAG,aAAa,SAAS,EAAE,MAAM,GAAG,CAAC;AAC3C,cAAM,GAAG,aAAa,eAAe,EAAE,MAAM,GAAG,CAAC;AACjD,cAAM,GAAG,aAAa,uBAAuB,EAAE,MAAM,GAAG,CAAC;AACzD,cAAM,GAAG,aAAa,gBAAgB,EAAE,MAAM,GAAG,CAAC;AAClD,cAAM,UAAU,MAAM,GAAG,gBAAgB;AAAA,UACvC,QAAQ;AAAA,UACR,OAAO;AAAA,UACP,MAAM;AAAA,QACR,CAAC;AACD,YAAI,CAAC,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACtE,eAAO;AAAA,MACT;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,UAAM,oBAAoB;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO,EAAE;AAAA,QACb,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,QACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MACpD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAED,UAAM,oBAAoB,KAAK,EAAE;AAEjC,WAAO;AAAA,EACT;AAAA,EACA,UAAU,OAAO,EAAE,WAAW,OAAO,IAAI,MAAM;AAC7C,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,kBAAkB,UAAU;AAClC,UAAM,SAAS,iBAAiB;AAChC,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,KAAK,UAAU,OAAO,kBAAkB;AAC9C,WAAO;AAAA,MACL,aAAa,UAAU,2BAA2B,aAAa;AAAA,MAC/D,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,gBAAgB,UAAU;AAAA,MAC1B,UAAU,QAAQ,YAAY;AAAA,MAC9B,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,SAAS;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM,OAAO,EAAE,UAAU,IAAI,MAAM;AACjC,UAAM,UAAU,mBAAkD,QAAQ;AAC1E,UAAM,SAAS,SAAS;AACxB,QAAI,CAAC,OAAQ;AACb,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI;AACtC,QAAI,OAAO,MAAM,sBAAsB,IAAI,MAAM,EAAE,IAAI,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAChH,UAAM,KAAM,IAAI,UAAU,QAAQ,YAAY;AAE9C,UAAM,gBAAgB,IAAI;AAAA,MACxB,YAAY;AACV,YAAI,MAAM;AACR,cAAI,KAAK,WAAW;AAClB,iBAAK,YAAY;AAAA,UACnB;AACA,eAAK,QAAQ,OAAO;AACpB,eAAK,iBAAiB,OAAO,kBAAkB;AAC/C,eAAK,WAAW,OAAO,YAAY;AACnC,eAAK,eAAe,OAAO,gBAAgB;AAC3C,eAAK,OAAO,OAAO,QAAQ;AAC3B,eAAK,cAAc,OAAO;AAC1B,gBAAM,GAAG,MAAM;AAAA,QACjB,OAAO;AACL,iBAAO,MAAM,GAAG,gBAAgB;AAAA,YAC9B,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,IAAI,OAAO;AAAA,cACX,OAAO,OAAO;AAAA,cACd,gBAAgB,OAAO,kBAAkB;AAAA,cACzC,UAAU,OAAO,YAAY;AAAA,cAC7B,cAAc,OAAO,gBAAgB;AAAA,cACrC,MAAM,OAAO,QAAQ;AAAA,cACrB,aAAa,OAAO;AAAA,YACtB;AAAA,UACF,CAAC;AAAA,QACH;AAEA,YAAI,CAAC,KAAM;AAEX,cAAM,GAAG,aAAa,UAAU,EAAE,MAAM,OAAO,GAAG,CAAC;AACnD,cAAM,cAAc,IAAI,MAAM,OAAO,OAAO,OAAO,QAAQ;AAE3D,cAAM,gBAAgB,IAAI,MAAM,OAAO,IAAI;AAE3C,cAAM,QAAQ,yBAAyB,OAAO,QAAQ,MAAS;AAC/D,YAAI,OAAO,KAAK,KAAK,EAAE,QAAQ;AAC7B,gBAAM,qBAAqB;AAAA,YACzB,YAAY;AAAA,YACZ,UAAU,EAAE,KAAK;AAAA,YACjB,UAAU,OAAO;AAAA,YACjB,gBAAgB,OAAO,kBAAkB;AAAA,YACzC,UAAU,OAAO,YAAY;AAAA,YAC7B,QAAQ;AAAA,YACR,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,GAAG,EAAE,aAAa,KAAK,CAAC;AAExB,UAAM,oBAAoB,KAAK,OAAO,EAAE;AAAA,EAC1C;AACF;AAEA,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AACjC,gBAAgB,iBAAiB;AAEjC,MAAM,UAAU;AAEhB,eAAe,YACb,IACA,OACA,oBACsB;AACtB,MAAI,QAAQ,KAAK,KAAK,GAAG;AACvB,UAAM,QAAiC,EAAE,IAAI,MAAM;AACnD,QAAI,uBAAuB,MAAM;AAC/B,YAAM,WAAW;AAAA,IACnB;AACA,WAAO,sBAAsB,IAAI,MAAM,OAAc,CAAC,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAAA,EACjH;AACA,SAAO,sBAAsB,IAAI,MAAM,EAAE,MAAM,OAAO,UAAU,mBAAmB,GAAG,CAAC,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAClJ;AAEA,eAAe,cAAc,IAAmB,MAAY,cAAwB,UAAyB;AAC3G,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC1F,QAAM,qBAAqB,kBAAkB,YAAY,IAAI,KAAK;AAElE,QAAM,gBAAwB,CAAC;AAC/B,QAAM,eAAyB,CAAC;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,MAAM,YAAY,IAAI,OAAO,kBAAkB;AAC5D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,oBAAc,KAAK,IAAI;AAAA,IACzB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI;AAC1D,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,QAAM,aAAa,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,OAAO,EAAE,EAAE,CAAC,CAAC;AACjE,QAAM,eAAe,MAAM,mBAAmB,IAAI,UAAU,EAAE,KAAK,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAClH,QAAM,iBAAiB,IAAI;AAAA,IACzB,aAAa,IAAI,CAAC,SAAS;AACzB,YAAM,SAAS,OAAO,KAAK,MAAM,MAAO,KAAK,QAA8B,EAAE;AAC7E,aAAO,CAAC,QAAQ,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,aAAW,CAAC,QAAQ,IAAI,KAAK,eAAe,QAAQ,GAAG;AACrD,QAAI,CAAC,WAAW,IAAI,MAAM,KAAK,MAAM;AACnC,SAAG,OAAO,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,aAAW,QAAQ,eAAe;AAChC,QAAI,CAAC,eAAe,IAAI,OAAO,KAAK,EAAE,CAAC,GAAG;AACxC,SAAG,QAAQ,GAAG,OAAO,UAAU,EAAE,MAAM,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,CAAC;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,kBAAkB,IAAmB,QAAmC;AACrF,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAA0B;AAAA,IAClC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,QAAQ,MACX,IAAI,CAAC,SAAS,KAAK,MAAM,QAAQ,EAAE,EACnC,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,SAAO,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACrE;AAEA,SAAS,cAAc,MAAY,OAAiB,QAAyD;AAC3G,QAAM,UAA0B;AAAA,IAC9B,OAAO,OAAO,KAAK,SAAS,EAAE;AAAA,IAC9B,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,IAClD;AAAA,IACA,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,IACtC,aAAa,QAAQ,KAAK,WAAW;AAAA,EACvC;AACA,MAAI,UAAU,OAAO,KAAK,MAAM,EAAE,OAAQ,SAAQ,SAAS;AAC3D,SAAO;AACT;AAEA,SAAS,qBACP,MACA,OACA,OAA0B,CAAC,GAC3B,QACe;AACf,SAAO;AAAA,IACL,MAAM,cAAc,MAAM,OAAO,MAAM;AAAA,IACvC,MAAM;AAAA,MACJ,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,OAAO,OAAO,KAAK,SAAS,EAAE;AAAA,MAC9B,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,MACpE,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,cAAc,KAAK,eAAe,OAAO,KAAK,YAAY,IAAI;AAAA,MAC9D,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,IAAI;AAAA,MACtC,aAAa,QAAQ,KAAK,WAAW;AAAA,MACrC,OAAO,CAAC,GAAG,KAAK;AAAA,MAChB;AAAA,MACA,GAAI,UAAU,OAAO,KAAK,MAAM,EAAE,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAEA,eAAe,qBAAqB,IAAmB,QAA4C;AACjG,QAAM,OAAO,MAAM,mBAAmB,IAAI,SAAS,EAAE,MAAM,OAA0B,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AACpI,SAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IACxB,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,CAAC,GAAG,IAAI,YAAY,IAAI;AAAA,IACpE,cAAc,QAAQ,IAAI,YAAY;AAAA,IACtC,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,CAAC,GAAG,IAAI,iBAAiB,IAAI;AAAA,EACrF,EAAE;AACJ;AAEA,eAAe,gBAAgB,IAAmB,MAAY,MAAyB;AACrF,QAAM,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,KAAK,EAAE,EAAE,CAAC;AACxD,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,GAAG,OAAO,SAAS;AAAA,MAChC;AAAA,MACA,UAAU,IAAI;AAAA,MACd,cAAc,IAAI,YAAY;AAAA,MAC9B,cAAc,IAAI;AAAA,MAClB,mBAAmB,IAAI,iBAAiB;AAAA,MACxC,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,uBACb,IACA,IACA,UACA,gBACkC;AAClC,SAAO,MAAM,wBAAwB,IAAI;AAAA,IACvC,UAAU,EAAE,KAAK;AAAA,IACjB,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAe,oBAAoB,KAA4B,QAAgB;AAC7E,MAAI;AACF,UAAM,cAAc,IAAI,UAAU,QAAQ,aAAa;AACvD,UAAM,YAAY,oBAAoB,MAAM;AAAA,EAC9C,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,QAAQ,IAAI,UAAU,QAAQ,OAAO;AAC3C,QAAI,OAAO,aAAc,OAAM,MAAM,aAAa,CAAC,aAAa,MAAM,EAAE,CAAC;AAAA,EAC3E,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,gBAAgB,QAAkB,OAAiB;AAC1D,QAAM,YAAY,IAAI,IAAI,MAAM;AAChC,QAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,QAAM,WAAW,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC;AAC5D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3D,SAAO,EAAE,UAAU,QAAQ;AAC7B;AAEA,SAAS,YAAY,MAA4B,OAA0B;AACzE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,SAAO,KAAK,MAAM,CAAC,OAAO,QAAQ,UAAU,MAAM,GAAG,CAAC;AACxD;AAEA,eAAe,2BAA2C;AACxD,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,UAAU,UAAU,iCAAiC,sBAAsB;AACjF,QAAM,IAAI,cAAc,KAAK;AAAA,IAC3B,OAAO;AAAA,IACP,aAAa,EAAE,OAAO,QAAQ;AAAA,IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,SAAS,MAAM,aAAa,QAAQ,aAAa,CAAC;AAAA,EACjF,CAAC;AACH;AAcA,SAAS,yBAAyB,SAA6C;AAC7E,SAAO,QAAQ,aAAa,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,aAAa;AAC5F;AAEA,eAAe,0BACb,IACA,UACA,QACA,SACA,KACe;AAGf,MAAI,KAAK,gBAAgB,KAAM;AAC/B,MAAI,CAAC,yBAAyB,OAAO,EAAG;AAExC,QAAM,qBAAqB,kBAAkB,QAAQ,KAAK;AAC1D,MAAI,CAAC,mBAAoB;AAGzB,QAAM,iBAAiB,MAAM,mBAAmB,IAAI,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,kBAAkB,EAAE,KAAK,EAAE;AAAA,IAC3B,WAAW;AAAA,EACb,GAAG;AAAA,IACD,UAAU,SAAS;AAAA,IACnB,SAAS,EAAE,IAAI,MAAM;AAAA,EACvB,GAAG,EAAE,UAAU,oBAAoB,gBAAgB,KAAK,CAAC;AAEzD,MAAI,eAAe,WAAW,EAAG;AAEjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,aAAW,QAAQ,gBAAgB;AACjC,UAAM,WAAW,KAAK,oBAAoB;AAC1C,QAAI,YAAY,EAAG;AAMnB,UAAM,cAAc,MAAM,mBAAmB,IAAI,UAAU;AAAA,MACzD,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM;AAAA,QACJ,WAAW;AAAA,QACX,aAAa;AAAA,QACb,UAAU;AAAA,MACZ;AAAA,IACF,GAAG,CAAC,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAG/C,UAAM,gBAAgB,MAAM;AAAA,MAC1B,IAAI;AAAA,QACF,YACG,IAAI,CAAC,SAAS;AACb,gBAAM,UAAU,KAAK;AACrB,gBAAM,eAAe,OAAO,YAAY,WAAW,UAAU,SAAS;AACtE,iBAAO,eAAe,OAAO,YAAY,IAAI;AAAA,QAC/C,CAAC,EACA,OAAO,CAAC,OAAqB,CAAC,CAAC,EAAE;AAAA,MACtC;AAAA,IACF;AAGA,QAAI,cAAc,SAAS,MAAM,GAAG;AAElC,UAAI,0BAA0B;AAE9B,UAAI,QAAQ,YAAY,QAAQ,cAAc;AAC5C,kCAA0B;AAAA,MAC5B,WAAW,QAAQ,aAAa,QAAW;AAEzC,cAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,QAAQ,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAC7G,cAAM,gBAAgB,KAAK,KAAK,YAAY;AAC5C,cAAM,gBAAgB,cAAc,SAAS,aAAa,KAAK,cAAc,SAAS,OAAO,KAAK,EAAE,EAAE,YAAY,CAAC;AACnH,YAAI,CAAC,eAAe;AAClB,oCAA0B;AAAA,QAC5B;AAAA,MACF;AAEA,UAAI,CAAC,yBAAyB;AAC5B,cAAM,YAAY,cAAc,SAAS;AACzC,YAAI,YAAY,UAAU;AACxB,gBAAM,IAAI,cAAc,KAAK;AAAA,YAC3B,OAAO,UAAU,8CAA8C,6DAA6D,EAAE,UAAU,KAAK,KAAK,CAAC;AAAA,UACrJ,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/data/entities.js

@@ -95,7 +95,7 @@ __decorateClass([
   PrimaryKey({ type: "uuid", defaultRaw: "gen_random_uuid()" })
 ], UserSidebarPreference.prototype, "id", 2);
 __decorateClass([
-  ManyToOne(() => User)
+  ManyToOne(() => User, { deleteRule: "cascade" })
 ], UserSidebarPreference.prototype, "user", 2);
 __decorateClass([
   Property({ name: "tenant_id", type: "uuid", nullable: true })
@@ -163,7 +163,7 @@ __decorateClass([
   PrimaryKey({ type: "uuid", defaultRaw: "gen_random_uuid()" })
 ], SidebarVariant.prototype, "id", 2);
 __decorateClass([
-  ManyToOne(() => User)
+  ManyToOne(() => User, { deleteRule: "cascade" })
 ], SidebarVariant.prototype, "user", 2);
 __decorateClass([
   Property({ name: "tenant_id", type: "uuid", nullable: true })