@open-mercato/core 0.7.1-develop.7172.1.a45dece080 → 0.7.1-develop.7175.1.d49ab48ee2

package/dist/modules/customers/data/validators.js

@@ -312,7 +312,9 @@ const interactionLinkedEntitySchema = z.object({
   id: z.string().uuid(),
   // 'resource' links calendar events to bookable resources (rooms, cars,
   // equipment) from the optional resources module (#3552).
-  type: z.enum(["company", "deal", "offer", "resource"]),
+  // 'person' links an interaction to a `customer_entities` row with kind='person',
+  // a first-class CRM record like a company (#5934).
+  type: z.enum(["company", "deal", "offer", "resource", "person"]),
   label: z.string().trim().max(500)
 });
 const interactionGuestPermissionsSchema = z.object({

package/dist/modules/customers/data/validators.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/data/validators.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport { isValidPhoneNumber } from '@open-mercato/shared/lib/phone'\nimport { COORDINATE_RANGES } from '@open-mercato/shared/lib/location/coordinates'\nimport { dictionaryEntrySortModeSchema } from '@open-mercato/core/modules/dictionaries/lib/entrySort'\n\nconst uuid = () => z.string().uuid()\n\nexport const CUSTOMER_PHONE_INVALID_MESSAGE_KEY = 'customers.people.form.primaryPhone.invalid'\nexport const ACTIVITY_DATE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.dateRequired'\nexport const ACTIVITY_TIME_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.timeRequired'\nexport const ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.phoneRequired'\nexport const ACTIVITY_PHONE_INVALID_MESSAGE_KEY = 'customers.activities.errors.phoneInvalid'\nexport const INTERACTION_PARTICIPANT_IDENTITY_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.participantIdentityRequired'\nexport const INTERACTION_PARTICIPANT_EMAIL_INVALID_MESSAGE_KEY = 'customers.activities.errors.participantEmailInvalid'\n\n// customer_deals.description is an unbounded `text` column; this cap only exists to keep\n// request bodies, fulltext search documents and query-index documents from growing without limit.\nexport const DEAL_DESCRIPTION_MAX_LENGTH = 50_000\n\nconst emptyStringToNull = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length ? trimmed : null\n}\n\nconst phoneSchema = z.preprocess(\n  emptyStringToNull,\n  z\n    .string()\n    .trim()\n    .max(50)\n    .refine((val) => isValidPhoneNumber(val), { message: CUSTOMER_PHONE_INVALID_MESSAGE_KEY })\n    .nullable()\n    .optional(),\n)\n\nconst clearableEmailSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().email().max(320).nullable().optional(),\n)\n\nconst clearableUrlSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().url().max(300).nullable().optional(),\n)\n\n// Domain is a plain (non-URL) string that maps to a nullable column, so blanking\n// a previously-set value on edit must transmit null to clear it. See #2529.\nconst clearableDomainSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().trim().max(200).nullable().optional(),\n)\n\n// Plain optional string fields that map to nullable columns: blanking a previously-set\n// value on edit must transmit null to clear it, not be silently dropped. See #3050.\nconst clearableStringSchema = (max: number) =>\n  z.preprocess(emptyStringToNull, z.string().trim().max(max).nullable().optional())\n\n// Annual revenue maps to a nullable numeric column. `''`/whitespace/null all clear it;\n// `.nullable()` short-circuits before coercion so null does not coerce to 0. See #3050.\nconst clearableRevenueSchema = z.preprocess(\n  (value) => {\n    if (typeof value === 'string' && value.trim().length === 0) return null\n    return value\n  },\n  z.coerce.number().min(0).nullable().optional(),\n)\n\nconst interactionPhoneNumberSchema = z.string().trim().max(50).optional().nullable()\n\nconst scopedSchema = z.object({\n  organizationId: uuid(),\n  tenantId: uuid(),\n})\n\nconst nextInteractionSchema = z\n  .object({\n    at: z.coerce.date(),\n    name: z.string().trim().min(1).max(200),\n    refId: z.string().trim().max(191).optional().nullable(),\n    icon: z.string().trim().max(100).optional().nullable(),\n    color: z\n      .string()\n      .trim()\n      .regex(/^#([0-9a-fA-F]{6})$/)\n      .optional()\n      .nullable(),\n  })\n  .strict()\n\nconst displayNameSchema = z.string().trim().min(1).max(200)\n\nconst baseEntitySchema = {\n  displayName: displayNameSchema,\n  // Nullable so a blanked description on edit clears the column instead of being dropped. See #3050.\n  description: clearableStringSchema(4000),\n  ownerUserId: uuid().optional(),\n  primaryEmail: clearableEmailSchema,\n  primaryPhone: phoneSchema,\n  status: z.string().trim().max(100).optional(),\n  lifecycleStage: z.string().trim().max(100).optional(),\n  source: z.string().trim().max(150).optional(),\n  temperature: z.string().trim().max(100).optional(),\n  renewalQuarter: z.string().trim().max(100).optional(),\n  isActive: z.boolean().optional(),\n  nextInteraction: nextInteractionSchema.nullable().optional(),\n  tags: z.array(uuid()).optional(),\n}\n\nconst personDetailsSchema = {\n  preferredName: z.string().trim().max(120).optional(),\n  jobTitle: z.string().trim().max(150).optional(),\n  department: z.string().trim().max(150).optional(),\n  seniority: z.string().trim().max(100).optional(),\n  timezone: z.string().trim().max(120).optional(),\n  linkedInUrl: clearableUrlSchema,\n  twitterUrl: clearableUrlSchema,\n  companyEntityId: uuid().nullable().optional(),\n}\n\nconst personFirstNameSchema = z.string().trim().min(1).max(120)\nconst personLastNameSchema = z.string().trim().min(1).max(120)\n\nconst companyDetailsSchema = {\n  // Nullable so blanked values on edit clear the columns instead of being dropped. See #3050.\n  legalName: clearableStringSchema(200),\n  brandName: clearableStringSchema(200),\n  domain: clearableDomainSchema,\n  websiteUrl: clearableUrlSchema,\n  industry: z.string().trim().max(150).optional(),\n  sizeBucket: clearableStringSchema(100),\n  annualRevenue: clearableRevenueSchema,\n}\n\nexport const personCreateSchema = scopedSchema.extend({\n  ...baseEntitySchema,\n  displayName: displayNameSchema.optional(),\n  firstName: personFirstNameSchema,\n  lastName: personLastNameSchema,\n  ...personDetailsSchema,\n})\n\nexport const personUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(\n    scopedSchema.extend({\n      ...baseEntitySchema,\n      ...personDetailsSchema,\n      firstName: personFirstNameSchema.optional(),\n      lastName: personLastNameSchema.optional(),\n    }).partial()\n  )\n\nexport const companyCreateSchema = scopedSchema.extend({\n  ...baseEntitySchema,\n  displayName: displayNameSchema,\n  ...companyDetailsSchema,\n})\n\nexport const companyUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(companyCreateSchema.partial())\n\nexport const dealCreateSchema = scopedSchema.extend({\n  title: z.string().min(1).max(200),\n  description: z.string().max(DEAL_DESCRIPTION_MAX_LENGTH).optional(),\n  status: z.string().max(50).optional(),\n  pipelineStage: z.string().max(100).optional(),\n  pipelineId: uuid().optional(),\n  pipelineStageId: uuid().optional(),\n  valueAmount: z.coerce.number().min(0).optional(),\n  valueCurrency: z.string().min(3).max(3).optional(),\n  probability: z.number().min(0).max(100).optional(),\n  expectedCloseAt: z.coerce.date().optional(),\n  // Nullable: the bulk owner-update worker passes `null` to clear ownership.\n  // Without `.nullable()`, dealUpdateSchema.parse({ ownerUserId: null }) throws\n  // ZodError \"expected string, received null\" inside the queue worker (TC-CRM-069).\n  ownerUserId: uuid().optional().nullable(),\n  source: z.string().max(150).optional(),\n  closureOutcome: z.enum(['won', 'lost']).optional(),\n  lossReasonId: uuid().optional(),\n  lossNotes: z.string().max(4000).optional(),\n  companyIds: z.array(uuid()).optional(),\n  personIds: z.array(uuid()).optional(),\n  primaryPersonEntityId: uuid().nullable().optional(),\n})\n\nexport const dealUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(dealCreateSchema.partial())\n\n// Bulk update schemas \u2014 used by `api/deals/bulk-update-{owner,stage}/route.ts`. Kept here\n// so all deal-write contracts live next to `dealCreateSchema` / `dealUpdateSchema`.\nexport const dealsBulkUpdateOwnerSchema = z.object({\n  ids: z.array(uuid()).min(1).max(10000),\n  ownerUserId: uuid().nullable(),\n})\n\nexport const dealsBulkUpdateStageSchema = z.object({\n  ids: z.array(uuid()).min(1).max(10000),\n  pipelineStageId: uuid(),\n})\n\nexport const dealsBulkUpdateResponseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: uuid().nullable(),\n  message: z.string(),\n})\n\nexport const activityCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  activityType: z.string().min(1).max(100),\n  subject: z.string().max(200).optional(),\n  body: z.string().max(8000).optional(),\n  date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n  time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n  phoneNumber: interactionPhoneNumberSchema,\n  occurredAt: z.coerce.date().optional(),\n  dealId: uuid().optional(),\n  authorUserId: uuid().optional(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z\n    .string()\n    .trim()\n    .regex(/^#([0-9a-fA-F]{6})$/)\n    .optional()\n    .nullable(),\n})\n\nexport const activityUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(activityCreateSchema.partial())\n\nexport const commentCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  dealId: uuid().optional(),\n  body: z.string().min(1).max(8000),\n  authorUserId: uuid().optional(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z\n    .string()\n    .trim()\n    .regex(/^#([0-9a-fA-F]{6})$/)\n    .optional()\n    .nullable(),\n})\n\nexport const commentUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(commentCreateSchema.partial())\n\nexport const addressCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  name: z.string().max(150).optional(),\n  purpose: z.string().max(150).optional(),\n  companyName: z.string().max(200).optional(),\n  addressLine1: z.string().min(1).max(300),\n  addressLine2: z.string().max(300).optional(),\n  buildingNumber: z.string().max(50).optional(),\n  flatNumber: z.string().max(50).optional(),\n  city: z.string().max(150).optional(),\n  region: z.string().max(150).optional(),\n  postalCode: z.string().max(30).optional(),\n  country: z.string().max(150).optional(),\n  latitude: z.coerce\n    .number()\n    .min(COORDINATE_RANGES.latitude.min)\n    .max(COORDINATE_RANGES.latitude.max)\n    .nullable()\n    .optional(),\n  longitude: z.coerce\n    .number()\n    .min(COORDINATE_RANGES.longitude.min)\n    .max(COORDINATE_RANGES.longitude.max)\n    .nullable()\n    .optional(),\n  isPrimary: z.boolean().optional(),\n})\n\nexport const addressUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(addressCreateSchema.partial())\n\nexport const tagCreateSchema = scopedSchema.extend({\n  slug: z\n    .string()\n    .min(1)\n    .max(80)\n    .regex(/^[a-z0-9_-]+$/, 'Slug must be lowercase and may contain dashes or underscores'),\n  label: z.string().min(1).max(120),\n  color: z.string().max(30).optional(),\n  description: z.string().max(400).optional(),\n})\n\nexport const tagUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(tagCreateSchema.partial())\n\nconst KNOWN_DICTIONARY_KINDS = [\n  'status',\n  'source',\n  'lifecycle_stage',\n  'address_type',\n  'activity_type',\n  'deal_status',\n  'pipeline_stage',\n  'job_title',\n  'industry',\n  'temperature',\n  'renewal_quarter',\n  'person_company_role',\n] as const\nconst CUSTOM_DICTIONARY_KIND_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/\nconst dictionaryKindEnum = z.string().trim().refine(\n  (value) =>\n    (KNOWN_DICTIONARY_KINDS as readonly string[]).includes(value) ||\n    CUSTOM_DICTIONARY_KIND_PATTERN.test(value),\n  { message: 'Unsupported dictionary kind' },\n)\n\nconst dictionaryValueSchema = z.string().trim().min(1).max(150)\nconst dictionaryLabelSchema = z.string().trim().max(150)\n// Pipeline-stage rows migrated to semantic tone identifiers in\n// Migration20260519120000_pipeline_stage_color_tones; AddStageDialog now writes those\n// directly. Other dictionary kinds still store hex. Accept either format so round-tripping\n// a migrated pipeline-stage entry through the dictionary edit UI doesn't fail validation.\nconst DICTIONARY_COLOR_TONES = ['success', 'warning', 'info', 'error', 'neutral', 'brand', 'pink'] as const\nconst dictionaryColorSchema = z\n  .string()\n  .trim()\n  .regex(\n    new RegExp(`^(#[0-9a-fA-F]{6}|${DICTIONARY_COLOR_TONES.join('|')})$`),\n    'Color must be a six-digit hex code (e.g. #3366ff) or a semantic tone identifier',\n  )\nconst dictionaryIconSchema = z.string().trim().max(48)\n\nexport const customerDictionaryEntryCreateSchema = scopedSchema.extend({\n  kind: dictionaryKindEnum,\n  value: dictionaryValueSchema,\n  label: dictionaryLabelSchema.optional(),\n  color: dictionaryColorSchema.nullable().optional(),\n  icon: dictionaryIconSchema.nullable().optional(),\n})\n\nexport type CustomerDictionaryEntryCreateInput = z.infer<typeof customerDictionaryEntryCreateSchema>\n\nexport const customerDictionaryEntryUpdateSchema = scopedSchema\n  .extend({\n    id: uuid(),\n    kind: dictionaryKindEnum,\n    value: dictionaryValueSchema.optional(),\n    label: dictionaryLabelSchema.optional(),\n    color: dictionaryColorSchema.nullable().optional(),\n    icon: dictionaryIconSchema.nullable().optional(),\n  })\n  .refine(\n    (payload) =>\n      payload.value !== undefined ||\n      payload.label !== undefined ||\n      payload.color !== undefined ||\n      payload.icon !== undefined,\n    {\n      message: 'Provide at least one field to update.',\n      path: ['value'],\n    }\n  )\n\nexport type CustomerDictionaryEntryUpdateInput = z.infer<typeof customerDictionaryEntryUpdateSchema>\n\nexport const customerDictionaryEntryDeleteSchema = scopedSchema.extend({\n  id: uuid(),\n  kind: dictionaryKindEnum,\n})\n\nexport type CustomerDictionaryEntryDeleteInput = z.infer<typeof customerDictionaryEntryDeleteSchema>\n\nexport const tagAssignmentSchema = scopedSchema.extend({\n  tagId: uuid(),\n  entityId: uuid(),\n})\n\nexport const todoLinkCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  todoId: uuid(),\n  todoSource: z.string().min(1).max(120).default('customers:interaction'),\n  createdByUserId: uuid().optional(),\n})\n\nexport const todoLinkWithTodoCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  title: z.string().min(1).max(200),\n  isDone: z.boolean().optional(),\n  is_done: z.boolean().optional(),\n  todoSource: z.string().min(1).max(120).default('customers:interaction'),\n  createdByUserId: uuid().optional(),\n  todoCustom: z.record(z.string(), z.any()).optional(),\n  custom: z.record(z.string(), z.any()).optional(),\n})\n\n// --- Interaction schemas ---\n\n/**\n * @deprecated Interaction statuses are now dictionary-backed and tenant-configurable\n * (the `interaction-statuses` dictionary). This frozen 3-value list is kept only for\n * backward compatibility; it is no longer the validation source (the API accepts any\n * `z.string().max(50)`). For open/terminal semantics use `lib/interactionStatus.ts`\n * (`isOpenInteractionStatus` / `isTerminalInteractionStatus` / `INTERACTION_STATUS_*`);\n * for the seeded default set use `INTERACTION_STATUS_DEFAULTS` in `cli.ts`. Do not expand\n * this list \u2014 adding members would break exhaustive consumers.\n */\nexport const interactionStatusValues = ['planned', 'done', 'canceled'] as const\n/** @deprecated See {@link interactionStatusValues}. */\nexport type InteractionStatus = typeof interactionStatusValues[number]\n\n// A participant is either a real record (`userId`) or an external guest carrying\n// no id at all. A guest is only addressable through its email, so that email is\n// required and must actually be routable \u2014 an unparseable string would persist\n// and only fail later, at invitation or calendar-sync time. Participants that DO\n// have a userId keep an unvalidated auxiliary email, as before.\nconst interactionParticipantSchema = z\n  .object({\n    userId: z.string().uuid().optional(),\n    name: z.string().trim().max(200).optional(),\n    email: z.string().trim().max(320).optional(),\n    status: z.string().trim().max(50).optional(),\n  })\n  .superRefine((participant, ctx) => {\n    if (participant.userId) return\n    if (!participant.email) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['email'],\n        message: INTERACTION_PARTICIPANT_IDENTITY_REQUIRED_MESSAGE_KEY,\n      })\n      return\n    }\n    if (!z.string().email().safeParse(participant.email).success) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['email'],\n        message: INTERACTION_PARTICIPANT_EMAIL_INVALID_MESSAGE_KEY,\n      })\n    }\n  })\n\nconst interactionLinkedEntitySchema = z.object({\n  id: z.string().uuid(),\n  // 'resource' links calendar events to bookable resources (rooms, cars,\n  // equipment) from the optional resources module (#3552).\n  type: z.enum(['company', 'deal', 'offer', 'resource']),\n  label: z.string().trim().max(500),\n})\n\nconst interactionGuestPermissionsSchema = z\n  .object({\n    canInviteOthers: z.boolean().optional(),\n    canModify: z.boolean().optional(),\n    canSeeList: z.boolean().optional(),\n  })\n  .strict()\n\nconst interactionExtendedFields = {\n  durationMinutes: z.number().int().min(0).optional().nullable(),\n  location: z.string().trim().max(500).optional().nullable(),\n  allDay: z.boolean().optional().nullable(),\n  recurrenceRule: z.string().trim().max(500).optional().nullable(),\n  recurrenceEnd: z.coerce.date().optional().nullable(),\n  participants: z.array(interactionParticipantSchema).optional().nullable(),\n  reminderMinutes: z.number().int().min(0).optional().nullable(),\n  visibility: z.string().trim().max(50).optional().nullable(),\n  linkedEntities: z.array(interactionLinkedEntitySchema).optional().nullable(),\n  guestPermissions: interactionGuestPermissionsSchema.optional().nullable(),\n} as const\n\nconst interactionCreateBaseSchema = scopedSchema.extend({\n  id: z.string().uuid().optional(),\n  entityId: z.string().uuid(),\n  interactionType: z.string().trim().min(1).max(100),\n  title: z.string().trim().max(500).optional().nullable(),\n  body: z.string().trim().max(10000).optional().nullable(),\n  // Lenient like `deal_status` (status: z.string().max(50)). The `interaction-statuses`\n  // dictionary drives the UI dropdown; the API accepts any string <=50 chars so existing\n  // rows, external writers, and the dispatch-crm MCP keep working. Open/terminal semantics\n  // live in lib/interactionStatus.ts, not in this validator.\n  status: z.string().max(50).optional().default('planned'),\n  date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n  time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n  phoneNumber: interactionPhoneNumberSchema,\n  scheduledAt: z.coerce.date().optional().nullable(),\n  occurredAt: z.coerce.date().optional().nullable(),\n  priority: z.number().int().min(0).max(100).optional().nullable(),\n  authorUserId: z.string().uuid().optional().nullable(),\n  ownerUserId: z.string().uuid().optional().nullable(),\n  dealId: z.string().uuid().optional().nullable(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z.string().trim().regex(/^#([0-9a-fA-F]{6})$/).optional().nullable(),\n  source: z.string().trim().max(100).optional().nullable(),\n  ...interactionExtendedFields,\n})\n\nfunction deriveScheduledAtFromDateTime(date?: string, time?: string): Date | null {\n  if (!date || typeof date !== 'string') return null\n  const trimmedDate = date.trim()\n  if (!trimmedDate) return null\n  const trimmedTime = typeof time === 'string' ? time.trim() : ''\n  const iso = trimmedTime ? `${trimmedDate}T${trimmedTime}:00` : `${trimmedDate}T00:00:00`\n  const parsed = new Date(iso)\n  return Number.isNaN(parsed.getTime()) ? null : parsed\n}\n\nexport const interactionCreateSchema = interactionCreateBaseSchema\n  .superRefine((value, ctx) => {\n    if (value.interactionType === 'call' && value.phoneNumber !== undefined && value.phoneNumber !== null) {\n      const phone = typeof value.phoneNumber === 'string' ? value.phoneNumber.trim() : ''\n      if (!phone) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY,\n        })\n      } else if (!isValidPhoneNumber(phone)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_INVALID_MESSAGE_KEY,\n        })\n      }\n    }\n  })\n  // Derive `scheduledAt` from `date+time` when only the latter are sent so\n  // external API consumers don't silently persist `scheduled_at: null` after\n  // the validator already enforced non-empty date/time. The form already\n  // computes `scheduledAt` itself, so this branch is a no-op for the form path.\n  .transform((value) => {\n    if (value.scheduledAt) return value\n    const derived = deriveScheduledAtFromDateTime(value.date, value.time)\n    return derived ? { ...value, scheduledAt: derived } : value\n  })\n\nexport type InteractionCreateInput = z.infer<typeof interactionCreateSchema>\n\nconst interactionUpdateBaseSchema = z\n  .object({\n    id: z.string().uuid(),\n  })\n  .merge(\n    scopedSchema\n      .extend({\n        interactionType: z.string().trim().min(1).max(100).optional(),\n        title: z.string().trim().max(500).optional().nullable(),\n        body: z.string().trim().max(10000).optional().nullable(),\n        status: z.string().max(50).optional(),\n        date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n        time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n        phoneNumber: interactionPhoneNumberSchema,\n        scheduledAt: z.coerce.date().optional().nullable(),\n        occurredAt: z.coerce.date().optional().nullable(),\n        priority: z.number().int().min(0).max(100).optional().nullable(),\n        authorUserId: z.string().uuid().optional().nullable(),\n        ownerUserId: z.string().uuid().optional().nullable(),\n        dealId: z.string().uuid().optional().nullable(),\n        appearanceIcon: z.string().trim().max(100).optional().nullable(),\n        appearanceColor: z.string().trim().regex(/^#([0-9a-fA-F]{6})$/).optional().nullable(),\n        pinned: z.boolean().optional(),\n        ...interactionExtendedFields,\n      })\n      .partial(),\n  )\n\nexport const interactionUpdateSchema = interactionUpdateBaseSchema\n  .superRefine((value, ctx) => {\n    if (value.interactionType === 'call' && value.phoneNumber !== undefined) {\n      const phone = typeof value.phoneNumber === 'string' ? value.phoneNumber.trim() : ''\n      if (!phone) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY,\n        })\n      } else if (!isValidPhoneNumber(phone)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_INVALID_MESSAGE_KEY,\n        })\n      }\n    }\n  })\n  // Mirror the create-schema derivation for partial updates: when an external\n  // caller supplies `date+time` without `scheduledAt`, derive the timestamp so\n  // the update doesn't silently leave `scheduled_at` stale.\n  .transform((value) => {\n    if (value.scheduledAt !== undefined) return value\n    if (!value.date && !value.time) return value\n    const derived = deriveScheduledAtFromDateTime(value.date, value.time)\n    return derived ? { ...value, scheduledAt: derived } : value\n  })\n\nexport type InteractionUpdateInput = z.infer<typeof interactionUpdateSchema>\n\nexport const interactionCompleteSchema = z.object({\n  id: z.string().uuid(),\n  occurredAt: z.coerce.date().optional(),\n})\n\nexport const interactionCancelSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport const customerAddressFormatSchema = z.enum(['line_first', 'street_first'])\n\nexport const customerSettingsUpsertSchema = scopedSchema.extend({\n  addressFormat: customerAddressFormatSchema,\n})\n\nexport const customerStuckThresholdUpsertSchema = scopedSchema.extend({\n  stuckThresholdDays: z.number().int().min(1).max(365),\n})\n\nexport const customerDictionarySortModesSchema = z.record(z.string(), dictionaryEntrySortModeSchema)\n\nexport const customerDictionarySortModesUpsertSchema = scopedSchema.extend({\n  dictionarySortModes: customerDictionarySortModesSchema,\n})\n\nexport type PersonCreateInput = z.infer<typeof personCreateSchema>\nexport type PersonUpdateInput = z.infer<typeof personUpdateSchema>\nexport type CompanyCreateInput = z.infer<typeof companyCreateSchema>\nexport type CompanyUpdateInput = z.infer<typeof companyUpdateSchema>\nexport type DealCreateInput = z.infer<typeof dealCreateSchema>\nexport type DealUpdateInput = z.infer<typeof dealUpdateSchema>\nexport type ActivityCreateInput = z.infer<typeof activityCreateSchema>\nexport type ActivityUpdateInput = z.infer<typeof activityUpdateSchema>\nexport type CommentCreateInput = z.infer<typeof commentCreateSchema>\nexport type CommentUpdateInput = z.infer<typeof commentUpdateSchema>\nexport type AddressCreateInput = z.infer<typeof addressCreateSchema>\nexport type AddressUpdateInput = z.infer<typeof addressUpdateSchema>\nexport type TagCreateInput = z.infer<typeof tagCreateSchema>\nexport type TagUpdateInput = z.infer<typeof tagUpdateSchema>\nexport type TagAssignmentInput = z.infer<typeof tagAssignmentSchema>\nexport type TodoLinkCreateInput = z.infer<typeof todoLinkCreateSchema>\nexport type TodoLinkWithTodoCreateInput = z.infer<typeof todoLinkWithTodoCreateSchema>\nexport type CustomerSettingsUpsertInput = z.infer<typeof customerSettingsUpsertSchema>\nexport type CustomerStuckThresholdUpsertInput = z.infer<typeof customerStuckThresholdUpsertSchema>\nexport type CustomerDictionarySortModesUpsertInput = z.infer<typeof customerDictionarySortModesUpsertSchema>\nexport type CustomerAddressFormatInput = z.infer<typeof customerAddressFormatSchema>\nexport type InteractionCompleteInput = z.infer<typeof interactionCompleteSchema>\nexport type InteractionCancelInput = z.infer<typeof interactionCancelSchema>\n\n// --- Pipeline schemas ---\n\nexport const pipelineCreateSchema = scopedSchema.extend({\n  name: z.string().trim().min(1).max(200),\n  isDefault: z.boolean().optional(),\n})\n\nexport const pipelineUpdateSchema = z.object({\n  id: uuid(),\n  name: z.string().trim().min(1).max(200).optional(),\n  isDefault: z.boolean().optional(),\n})\n\nexport const pipelineDeleteSchema = z.object({\n  id: uuid(),\n})\n\nexport type PipelineCreateInput = z.infer<typeof pipelineCreateSchema>\nexport type PipelineUpdateInput = z.infer<typeof pipelineUpdateSchema>\nexport type PipelineDeleteInput = z.infer<typeof pipelineDeleteSchema>\n\n// --- Pipeline Stage schemas ---\n\nexport const pipelineStageCreateSchema = scopedSchema.extend({\n  pipelineId: uuid(),\n  label: z.string().trim().min(1).max(200),\n  order: z.number().int().min(0).optional(),\n  color: z.string().trim().max(20).nullish(),\n  icon: z.string().trim().max(100).nullish(),\n})\n\nexport const pipelineStageUpdateSchema = z.object({\n  id: uuid(),\n  label: z.string().trim().min(1).max(200).optional(),\n  order: z.number().int().min(0).optional(),\n  color: z.string().trim().max(20).nullish(),\n  icon: z.string().trim().max(100).nullish(),\n})\n\nexport const pipelineStageDeleteSchema = z.object({\n  id: uuid(),\n})\n\nexport const pipelineStageReorderSchema = scopedSchema.extend({\n  stages: z.array(z.object({\n    id: uuid(),\n    order: z.number().int().min(0),\n  })).min(1),\n})\n\nexport type PipelineStageCreateInput = z.infer<typeof pipelineStageCreateSchema>\nexport type PipelineStageUpdateInput = z.infer<typeof pipelineStageUpdateSchema>\nexport type PipelineStageDeleteInput = z.infer<typeof pipelineStageDeleteSchema>\nexport type PipelineStageReorderInput = z.infer<typeof pipelineStageReorderSchema>\n\nexport const entityRoleCreateSchema = scopedSchema.extend({\n  entityType: z.enum(['company', 'person']),\n  entityId: uuid(),\n  roleType: z.string().trim().min(1).max(100),\n  userId: uuid(),\n})\n\nexport const entityRoleUpdateSchema = scopedSchema.extend({\n  id: uuid(),\n  userId: uuid(),\n})\n\nexport const entityRoleDeleteSchema = scopedSchema.extend({\n  id: uuid(),\n})\n\nexport type EntityRoleCreateInput = z.infer<typeof entityRoleCreateSchema>\nexport type EntityRoleUpdateInput = z.infer<typeof entityRoleUpdateSchema>\nexport type EntityRoleDeleteInput = z.infer<typeof entityRoleDeleteSchema>\n\nexport const updateKindSettingSchema = z.object({\n  kind: z.string().trim().min(1).max(100),\n  selectionMode: z.enum(['single', 'multi']).optional(),\n  visibleInTags: z.boolean().optional(),\n  sortOrder: z.number().int().min(0).optional(),\n})\n\nexport type UpdateKindSettingInput = z.infer<typeof updateKindSettingSchema>\n\nexport const customerKindSettingsUpsertSchema = scopedSchema.extend({\n  kind: z.string().trim().min(1).max(100),\n  selectionMode: z.enum(['single', 'multi']).optional(),\n  visibleInTags: z.boolean().optional(),\n  sortOrder: z.number().int().min(0).optional(),\n})\n\nexport type CustomerKindSettingsUpsertInput = z.infer<typeof customerKindSettingsUpsertSchema>\n\nexport const labelCreateSchema = z.object({\n  label: z.string().trim().min(1).max(120),\n  slug: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/).optional(),\n})\n\nexport type LabelCreateInput = z.infer<typeof labelCreateSchema>\n\nexport const labelCreateCommandSchema = scopedSchema.extend({\n  label: z.string().trim().min(1).max(120),\n  slug: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/),\n  userId: uuid(),\n})\n\nexport type LabelCreateCommandInput = z.infer<typeof labelCreateCommandSchema>\n\nexport const labelAssignmentSchema = z.object({\n  labelId: z.string().uuid(),\n  entityId: z.string().uuid(),\n})\n\nexport type LabelAssignmentInput = z.infer<typeof labelAssignmentSchema>\n\nexport const labelAssignCommandSchema = scopedSchema.extend({\n  labelId: uuid(),\n  entityId: uuid(),\n})\n\nexport const labelUnassignCommandSchema = scopedSchema.extend({\n  labelId: uuid(),\n  entityId: uuid(),\n})\n\nexport type LabelAssignCommandInput = z.infer<typeof labelAssignCommandSchema>\nexport type LabelUnassignCommandInput = z.infer<typeof labelUnassignCommandSchema>\n\nexport const personCompanyLinkCreateSchema = scopedSchema.extend({\n  personEntityId: uuid(),\n  companyEntityId: uuid(),\n  isPrimary: z.boolean().optional(),\n})\n\nexport const personCompanyLinkUpdateSchema = scopedSchema.extend({\n  linkId: uuid(),\n  isPrimary: z.boolean(),\n})\n\n// Two shapes are accepted, because a person can belong to a company in two ways:\n// through a `customer_person_company_links` row (`linkId`), or through a legacy\n// profile-only assignment where `customer_person_profiles.company_id` is set and no\n// link row was ever created (migrated CRM data, #5114). Both detaches go through the\n// same command so audit, undo and cache invalidation stay consistent.\nexport const personCompanyLinkDeleteSchema = scopedSchema\n  .extend({\n    linkId: uuid().optional(),\n    personEntityId: uuid().optional(),\n    companyEntityId: uuid().optional(),\n  })\n  .refine(\n    (payload) => Boolean(payload.linkId) || Boolean(payload.personEntityId && payload.companyEntityId),\n    {\n      message: 'Provide either linkId or both personEntityId and companyEntityId.',\n      path: ['linkId'],\n    }\n  )\n\nexport type PersonCompanyLinkCreateInput = z.infer<typeof personCompanyLinkCreateSchema>\nexport type PersonCompanyLinkUpdateInput = z.infer<typeof personCompanyLinkUpdateSchema>\nexport type PersonCompanyLinkDeleteInput = z.infer<typeof personCompanyLinkDeleteSchema>\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,qCAAqC;AAE9C,MAAM,OAAO,MAAM,EAAE,OAAO,EAAE,KAAK;AAE5B,MAAM,qCAAqC;AAC3C,MAAM,qCAAqC;AAC3C,MAAM,qCAAqC;AAC3C,MAAM,sCAAsC;AAC5C,MAAM,qCAAqC;AAC3C,MAAM,wDAAwD;AAC9D,MAAM,oDAAoD;AAI1D,MAAM,8BAA8B;AAE3C,MAAM,oBAAoB,CAAC,UAA4B;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,MAAM,cAAc,EAAE;AAAA,EACpB;AAAA,EACA,EACG,OAAO,EACP,KAAK,EACL,IAAI,EAAE,EACN,OAAO,CAAC,QAAQ,mBAAmB,GAAG,GAAG,EAAE,SAAS,mCAAmC,CAAC,EACxF,SAAS,EACT,SAAS;AACd;AAEA,MAAM,uBAAuB,EAAE;AAAA,EAC7B;AAAA,EACA,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAClD;AAEA,MAAM,qBAAqB,EAAE;AAAA,EAC3B;AAAA,EACA,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAChD;AAIA,MAAM,wBAAwB,EAAE;AAAA,EAC9B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACjD;AAIA,MAAM,wBAAwB,CAAC,QAC7B,EAAE,WAAW,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC;AAIlF,MAAM,yBAAyB,EAAE;AAAA,EAC/B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,WAAO;AAAA,EACT;AAAA,EACA,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC/C;AAEA,MAAM,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAEnF,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,gBAAgB,KAAK;AAAA,EACrB,UAAU,KAAK;AACjB,CAAC;AAED,MAAM,wBAAwB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,KAAK;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,OAAO,EACJ,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC,EACA,OAAO;AAEV,MAAM,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE1D,MAAM,mBAAmB;AAAA,EACvB,aAAa;AAAA;AAAA,EAEb,aAAa,sBAAsB,GAAI;AAAA,EACvC,aAAa,KAAK,EAAE,SAAS;AAAA,EAC7B,cAAc;AAAA,EACd,cAAc;AAAA,EACd,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,iBAAiB,sBAAsB,SAAS,EAAE,SAAS;AAAA,EAC3D,MAAM,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AACjC;AAEA,MAAM,sBAAsB;AAAA,EAC1B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,iBAAiB,KAAK,EAAE,SAAS,EAAE,SAAS;AAC9C;AAEA,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC9D,MAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE7D,MAAM,uBAAuB;AAAA;AAAA,EAE3B,WAAW,sBAAsB,GAAG;AAAA,EACpC,WAAW,sBAAsB,GAAG;AAAA,EACpC,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,sBAAsB,GAAG;AAAA,EACrC,eAAe;AACjB;AAEO,MAAM,qBAAqB,aAAa,OAAO;AAAA,EACpD,GAAG;AAAA,EACH,aAAa,kBAAkB,SAAS;AAAA,EACxC,WAAW;AAAA,EACX,UAAU;AAAA,EACV,GAAG;AACL,CAAC;AAEM,MAAM,qBAAqB,EAC/B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA;AAAA,EACC,aAAa,OAAO;AAAA,IAClB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,WAAW,sBAAsB,SAAS;AAAA,IAC1C,UAAU,qBAAqB,SAAS;AAAA,EAC1C,CAAC,EAAE,QAAQ;AACb;AAEK,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,GAAG;AAAA,EACH,aAAa;AAAA,EACb,GAAG;AACL,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,mBAAmB,aAAa,OAAO;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,2BAA2B,EAAE,SAAS;AAAA,EAClE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,YAAY,KAAK,EAAE,SAAS;AAAA,EAC5B,iBAAiB,KAAK,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EACjD,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AAAA,EACpC,uBAAuB,KAAK,EAAE,SAAS,EAAE,SAAS;AACpD,CAAC;AAEM,MAAM,mBAAmB,EAC7B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,iBAAiB,QAAQ,CAAC;AAI5B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK;AAAA,EACrC,aAAa,KAAK,EAAE,SAAS;AAC/B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK;AAAA,EACrC,iBAAiB,KAAK;AACxB,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,KAAK,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO;AACpB,CAAC;AAEM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,UAAU,KAAK;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,aAAa;AAAA,EACb,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EACd,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC;AAEM,MAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,qBAAqB,QAAQ,CAAC;AAEhC,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAChC,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EACd,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,UAAU,KAAK;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OACT,OAAO,EACP,IAAI,kBAAkB,SAAS,GAAG,EAClC,IAAI,kBAAkB,SAAS,GAAG,EAClC,SAAS,EACT,SAAS;AAAA,EACZ,WAAW,EAAE,OACV,OAAO,EACP,IAAI,kBAAkB,UAAU,GAAG,EACnC,IAAI,kBAAkB,UAAU,GAAG,EACnC,SAAS,EACT,SAAS;AAAA,EACZ,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,kBAAkB,aAAa,OAAO;AAAA,EACjD,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,iBAAiB,8DAA8D;AAAA,EACxF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,gBAAgB,QAAQ,CAAC;AAElC,MAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,MAAM,iCAAiC;AACvC,MAAM,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE;AAAA,EAC3C,CAAC,UACE,uBAA6C,SAAS,KAAK,KAC5D,+BAA+B,KAAK,KAAK;AAAA,EAC3C,EAAE,SAAS,8BAA8B;AAC3C;AAEA,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC9D,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG;AAKvD,MAAM,yBAAyB,CAAC,WAAW,WAAW,QAAQ,SAAS,WAAW,SAAS,MAAM;AACjG,MAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL;AAAA,EACC,IAAI,OAAO,qBAAqB,uBAAuB,KAAK,GAAG,CAAC,IAAI;AAAA,EACpE;AACF;AACF,MAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;AAE9C,MAAM,sCAAsC,aAAa,OAAO;AAAA,EACrE,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,qBAAqB,SAAS,EAAE,SAAS;AACjD,CAAC;AAIM,MAAM,sCAAsC,aAChD,OAAO;AAAA,EACN,IAAI,KAAK;AAAA,EACT,MAAM;AAAA,EACN,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,qBAAqB,SAAS,EAAE,SAAS;AACjD,CAAC,EACA;AAAA,EACC,CAAC,YACC,QAAQ,UAAU,UAClB,QAAQ,UAAU,UAClB,QAAQ,UAAU,UAClB,QAAQ,SAAS;AAAA,EACnB;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,OAAO;AAAA,EAChB;AACF;AAIK,MAAM,sCAAsC,aAAa,OAAO;AAAA,EACrE,IAAI,KAAK;AAAA,EACT,MAAM;AACR,CAAC;AAIM,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,OAAO,KAAK;AAAA,EACZ,UAAU,KAAK;AACjB,CAAC;AAEM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,uBAAuB;AAAA,EACtE,iBAAiB,KAAK,EAAE,SAAS;AACnC,CAAC;AAEM,MAAM,+BAA+B,aAAa,OAAO;AAAA,EAC9D,UAAU,KAAK;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,uBAAuB;AAAA,EACtE,iBAAiB,KAAK,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AACjD,CAAC;AAaM,MAAM,0BAA0B,CAAC,WAAW,QAAQ,UAAU;AASrE,MAAM,+BAA+B,EAClC,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY,CAAC,aAAa,QAAQ;AACjC,MAAI,YAAY,OAAQ;AACxB,MAAI,CAAC,YAAY,OAAO;AACtB,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,YAAY,KAAK,EAAE,SAAS;AAC5D,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEH,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA,EAGpB,MAAM,EAAE,KAAK,CAAC,WAAW,QAAQ,SAAS,UAAU,CAAC;AAAA,EACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG;AAClC,CAAC;AAED,MAAM,oCAAoC,EACvC,OAAO;AAAA,EACN,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AACnC,CAAC,EACA,OAAO;AAEV,MAAM,4BAA4B;AAAA,EAChC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,eAAe,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,cAAc,EAAE,MAAM,4BAA4B,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,gBAAgB,EAAE,MAAM,6BAA6B,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3E,kBAAkB,kCAAkC,SAAS,EAAE,SAAS;AAC1E;AAEA,MAAM,8BAA8B,aAAa,OAAO;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,EAAE,SAAS,EAAE,SAAS;AAAA,EACpF,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,GAAG;AACL,CAAC;AAED,SAAS,8BAA8B,MAAe,MAA4B;AAChF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,cAAc,KAAK,KAAK;AAC9B,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,cAAc,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI;AAC7D,QAAM,MAAM,cAAc,GAAG,WAAW,IAAI,WAAW,QAAQ,GAAG,WAAW;AAC7E,QAAM,SAAS,IAAI,KAAK,GAAG;AAC3B,SAAO,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,OAAO;AACjD;AAEO,MAAM,0BAA0B,4BACpC,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,oBAAoB,UAAU,MAAM,gBAAgB,UAAa,MAAM,gBAAgB,MAAM;AACrG,UAAM,QAAQ,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,IAAI;AACjF,QAAI,CAAC,OAAO;AACV,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH,WAAW,CAAC,mBAAmB,KAAK,GAAG;AACrC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC,EAKA,UAAU,CAAC,UAAU;AACpB,MAAI,MAAM,YAAa,QAAO;AAC9B,QAAM,UAAU,8BAA8B,MAAM,MAAM,MAAM,IAAI;AACpE,SAAO,UAAU,EAAE,GAAG,OAAO,aAAa,QAAQ,IAAI;AACxD,CAAC;AAIH,MAAM,8BAA8B,EACjC,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC,EACA;AAAA,EACC,aACG,OAAO;AAAA,IACN,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACvD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,IACpC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,IAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,IAC5E,aAAa;AAAA,IACb,aAAa,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACjD,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAChD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/D,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACnD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC9C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,EAAE,SAAS,EAAE,SAAS;AAAA,IACpF,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,GAAG;AAAA,EACL,CAAC,EACA,QAAQ;AACb;AAEK,MAAM,0BAA0B,4BACpC,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,oBAAoB,UAAU,MAAM,gBAAgB,QAAW;AACvE,UAAM,QAAQ,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,IAAI;AACjF,QAAI,CAAC,OAAO;AACV,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH,WAAW,CAAC,mBAAmB,KAAK,GAAG;AACrC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC,EAIA,UAAU,CAAC,UAAU;AACpB,MAAI,MAAM,gBAAgB,OAAW,QAAO;AAC5C,MAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,KAAM,QAAO;AACvC,QAAM,UAAU,8BAA8B,MAAM,MAAM,MAAM,IAAI;AACpE,SAAO,UAAU,EAAE,GAAG,OAAO,aAAa,QAAQ,IAAI;AACxD,CAAC;AAII,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAEM,MAAM,8BAA8B,EAAE,KAAK,CAAC,cAAc,cAAc,CAAC;AAEzE,MAAM,+BAA+B,aAAa,OAAO;AAAA,EAC9D,eAAe;AACjB,CAAC;AAEM,MAAM,qCAAqC,aAAa,OAAO;AAAA,EACpE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACrD,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO,EAAE,OAAO,GAAG,6BAA6B;AAE5F,MAAM,0CAA0C,aAAa,OAAO;AAAA,EACzE,qBAAqB;AACvB,CAAC;AA4BM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,KAAK;AAAA,EACT,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,KAAK;AACX,CAAC;AAQM,MAAM,4BAA4B,aAAa,OAAO;AAAA,EAC3D,YAAY,KAAK;AAAA,EACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,QAAQ;AAC3C,CAAC;AAEM,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,KAAK;AAAA,EACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,QAAQ;AAC3C,CAAC;AAEM,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,KAAK;AACX,CAAC;AAEM,MAAM,6BAA6B,aAAa,OAAO;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO;AAAA,IACvB,IAAI,KAAK;AAAA,IACT,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,EAC/B,CAAC,CAAC,EAAE,IAAI,CAAC;AACX,CAAC;AAOM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACxC,UAAU,KAAK;AAAA,EACf,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,QAAQ,KAAK;AACf,CAAC;AAEM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,IAAI,KAAK;AAAA,EACT,QAAQ,KAAK;AACf,CAAC;AAEM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,IAAI,KAAK;AACX,CAAC;AAMM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC9C,CAAC;AAIM,MAAM,mCAAmC,aAAa,OAAO;AAAA,EAClE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC9C,CAAC;AAIM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,eAAe,EAAE,SAAS;AACzE,CAAC;AAIM,MAAM,2BAA2B,aAAa,OAAO;AAAA,EAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,eAAe;AAAA,EAC5D,QAAQ,KAAK;AACf,CAAC;AAIM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAIM,MAAM,2BAA2B,aAAa,OAAO;AAAA,EAC1D,SAAS,KAAK;AAAA,EACd,UAAU,KAAK;AACjB,CAAC;AAEM,MAAM,6BAA6B,aAAa,OAAO;AAAA,EAC5D,SAAS,KAAK;AAAA,EACd,UAAU,KAAK;AACjB,CAAC;AAKM,MAAM,gCAAgC,aAAa,OAAO;AAAA,EAC/D,gBAAgB,KAAK;AAAA,EACrB,iBAAiB,KAAK;AAAA,EACtB,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,gCAAgC,aAAa,OAAO;AAAA,EAC/D,QAAQ,KAAK;AAAA,EACb,WAAW,EAAE,QAAQ;AACvB,CAAC;AAOM,MAAM,gCAAgC,aAC1C,OAAO;AAAA,EACN,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,gBAAgB,KAAK,EAAE,SAAS;AAAA,EAChC,iBAAiB,KAAK,EAAE,SAAS;AACnC,CAAC,EACA;AAAA,EACC,CAAC,YAAY,QAAQ,QAAQ,MAAM,KAAK,QAAQ,QAAQ,kBAAkB,QAAQ,eAAe;AAAA,EACjG;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,QAAQ;AAAA,EACjB;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport { isValidPhoneNumber } from '@open-mercato/shared/lib/phone'\nimport { COORDINATE_RANGES } from '@open-mercato/shared/lib/location/coordinates'\nimport { dictionaryEntrySortModeSchema } from '@open-mercato/core/modules/dictionaries/lib/entrySort'\n\nconst uuid = () => z.string().uuid()\n\nexport const CUSTOMER_PHONE_INVALID_MESSAGE_KEY = 'customers.people.form.primaryPhone.invalid'\nexport const ACTIVITY_DATE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.dateRequired'\nexport const ACTIVITY_TIME_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.timeRequired'\nexport const ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.phoneRequired'\nexport const ACTIVITY_PHONE_INVALID_MESSAGE_KEY = 'customers.activities.errors.phoneInvalid'\nexport const INTERACTION_PARTICIPANT_IDENTITY_REQUIRED_MESSAGE_KEY = 'customers.activities.errors.participantIdentityRequired'\nexport const INTERACTION_PARTICIPANT_EMAIL_INVALID_MESSAGE_KEY = 'customers.activities.errors.participantEmailInvalid'\n\n// customer_deals.description is an unbounded `text` column; this cap only exists to keep\n// request bodies, fulltext search documents and query-index documents from growing without limit.\nexport const DEAL_DESCRIPTION_MAX_LENGTH = 50_000\n\nconst emptyStringToNull = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length ? trimmed : null\n}\n\nconst phoneSchema = z.preprocess(\n  emptyStringToNull,\n  z\n    .string()\n    .trim()\n    .max(50)\n    .refine((val) => isValidPhoneNumber(val), { message: CUSTOMER_PHONE_INVALID_MESSAGE_KEY })\n    .nullable()\n    .optional(),\n)\n\nconst clearableEmailSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().email().max(320).nullable().optional(),\n)\n\nconst clearableUrlSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().url().max(300).nullable().optional(),\n)\n\n// Domain is a plain (non-URL) string that maps to a nullable column, so blanking\n// a previously-set value on edit must transmit null to clear it. See #2529.\nconst clearableDomainSchema = z.preprocess(\n  emptyStringToNull,\n  z.string().trim().max(200).nullable().optional(),\n)\n\n// Plain optional string fields that map to nullable columns: blanking a previously-set\n// value on edit must transmit null to clear it, not be silently dropped. See #3050.\nconst clearableStringSchema = (max: number) =>\n  z.preprocess(emptyStringToNull, z.string().trim().max(max).nullable().optional())\n\n// Annual revenue maps to a nullable numeric column. `''`/whitespace/null all clear it;\n// `.nullable()` short-circuits before coercion so null does not coerce to 0. See #3050.\nconst clearableRevenueSchema = z.preprocess(\n  (value) => {\n    if (typeof value === 'string' && value.trim().length === 0) return null\n    return value\n  },\n  z.coerce.number().min(0).nullable().optional(),\n)\n\nconst interactionPhoneNumberSchema = z.string().trim().max(50).optional().nullable()\n\nconst scopedSchema = z.object({\n  organizationId: uuid(),\n  tenantId: uuid(),\n})\n\nconst nextInteractionSchema = z\n  .object({\n    at: z.coerce.date(),\n    name: z.string().trim().min(1).max(200),\n    refId: z.string().trim().max(191).optional().nullable(),\n    icon: z.string().trim().max(100).optional().nullable(),\n    color: z\n      .string()\n      .trim()\n      .regex(/^#([0-9a-fA-F]{6})$/)\n      .optional()\n      .nullable(),\n  })\n  .strict()\n\nconst displayNameSchema = z.string().trim().min(1).max(200)\n\nconst baseEntitySchema = {\n  displayName: displayNameSchema,\n  // Nullable so a blanked description on edit clears the column instead of being dropped. See #3050.\n  description: clearableStringSchema(4000),\n  ownerUserId: uuid().optional(),\n  primaryEmail: clearableEmailSchema,\n  primaryPhone: phoneSchema,\n  status: z.string().trim().max(100).optional(),\n  lifecycleStage: z.string().trim().max(100).optional(),\n  source: z.string().trim().max(150).optional(),\n  temperature: z.string().trim().max(100).optional(),\n  renewalQuarter: z.string().trim().max(100).optional(),\n  isActive: z.boolean().optional(),\n  nextInteraction: nextInteractionSchema.nullable().optional(),\n  tags: z.array(uuid()).optional(),\n}\n\nconst personDetailsSchema = {\n  preferredName: z.string().trim().max(120).optional(),\n  jobTitle: z.string().trim().max(150).optional(),\n  department: z.string().trim().max(150).optional(),\n  seniority: z.string().trim().max(100).optional(),\n  timezone: z.string().trim().max(120).optional(),\n  linkedInUrl: clearableUrlSchema,\n  twitterUrl: clearableUrlSchema,\n  companyEntityId: uuid().nullable().optional(),\n}\n\nconst personFirstNameSchema = z.string().trim().min(1).max(120)\nconst personLastNameSchema = z.string().trim().min(1).max(120)\n\nconst companyDetailsSchema = {\n  // Nullable so blanked values on edit clear the columns instead of being dropped. See #3050.\n  legalName: clearableStringSchema(200),\n  brandName: clearableStringSchema(200),\n  domain: clearableDomainSchema,\n  websiteUrl: clearableUrlSchema,\n  industry: z.string().trim().max(150).optional(),\n  sizeBucket: clearableStringSchema(100),\n  annualRevenue: clearableRevenueSchema,\n}\n\nexport const personCreateSchema = scopedSchema.extend({\n  ...baseEntitySchema,\n  displayName: displayNameSchema.optional(),\n  firstName: personFirstNameSchema,\n  lastName: personLastNameSchema,\n  ...personDetailsSchema,\n})\n\nexport const personUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(\n    scopedSchema.extend({\n      ...baseEntitySchema,\n      ...personDetailsSchema,\n      firstName: personFirstNameSchema.optional(),\n      lastName: personLastNameSchema.optional(),\n    }).partial()\n  )\n\nexport const companyCreateSchema = scopedSchema.extend({\n  ...baseEntitySchema,\n  displayName: displayNameSchema,\n  ...companyDetailsSchema,\n})\n\nexport const companyUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(companyCreateSchema.partial())\n\nexport const dealCreateSchema = scopedSchema.extend({\n  title: z.string().min(1).max(200),\n  description: z.string().max(DEAL_DESCRIPTION_MAX_LENGTH).optional(),\n  status: z.string().max(50).optional(),\n  pipelineStage: z.string().max(100).optional(),\n  pipelineId: uuid().optional(),\n  pipelineStageId: uuid().optional(),\n  valueAmount: z.coerce.number().min(0).optional(),\n  valueCurrency: z.string().min(3).max(3).optional(),\n  probability: z.number().min(0).max(100).optional(),\n  expectedCloseAt: z.coerce.date().optional(),\n  // Nullable: the bulk owner-update worker passes `null` to clear ownership.\n  // Without `.nullable()`, dealUpdateSchema.parse({ ownerUserId: null }) throws\n  // ZodError \"expected string, received null\" inside the queue worker (TC-CRM-069).\n  ownerUserId: uuid().optional().nullable(),\n  source: z.string().max(150).optional(),\n  closureOutcome: z.enum(['won', 'lost']).optional(),\n  lossReasonId: uuid().optional(),\n  lossNotes: z.string().max(4000).optional(),\n  companyIds: z.array(uuid()).optional(),\n  personIds: z.array(uuid()).optional(),\n  primaryPersonEntityId: uuid().nullable().optional(),\n})\n\nexport const dealUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(dealCreateSchema.partial())\n\n// Bulk update schemas \u2014 used by `api/deals/bulk-update-{owner,stage}/route.ts`. Kept here\n// so all deal-write contracts live next to `dealCreateSchema` / `dealUpdateSchema`.\nexport const dealsBulkUpdateOwnerSchema = z.object({\n  ids: z.array(uuid()).min(1).max(10000),\n  ownerUserId: uuid().nullable(),\n})\n\nexport const dealsBulkUpdateStageSchema = z.object({\n  ids: z.array(uuid()).min(1).max(10000),\n  pipelineStageId: uuid(),\n})\n\nexport const dealsBulkUpdateResponseSchema = z.object({\n  ok: z.boolean(),\n  progressJobId: uuid().nullable(),\n  message: z.string(),\n})\n\nexport const activityCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  activityType: z.string().min(1).max(100),\n  subject: z.string().max(200).optional(),\n  body: z.string().max(8000).optional(),\n  date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n  time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n  phoneNumber: interactionPhoneNumberSchema,\n  occurredAt: z.coerce.date().optional(),\n  dealId: uuid().optional(),\n  authorUserId: uuid().optional(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z\n    .string()\n    .trim()\n    .regex(/^#([0-9a-fA-F]{6})$/)\n    .optional()\n    .nullable(),\n})\n\nexport const activityUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(activityCreateSchema.partial())\n\nexport const commentCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  dealId: uuid().optional(),\n  body: z.string().min(1).max(8000),\n  authorUserId: uuid().optional(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z\n    .string()\n    .trim()\n    .regex(/^#([0-9a-fA-F]{6})$/)\n    .optional()\n    .nullable(),\n})\n\nexport const commentUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(commentCreateSchema.partial())\n\nexport const addressCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  name: z.string().max(150).optional(),\n  purpose: z.string().max(150).optional(),\n  companyName: z.string().max(200).optional(),\n  addressLine1: z.string().min(1).max(300),\n  addressLine2: z.string().max(300).optional(),\n  buildingNumber: z.string().max(50).optional(),\n  flatNumber: z.string().max(50).optional(),\n  city: z.string().max(150).optional(),\n  region: z.string().max(150).optional(),\n  postalCode: z.string().max(30).optional(),\n  country: z.string().max(150).optional(),\n  latitude: z.coerce\n    .number()\n    .min(COORDINATE_RANGES.latitude.min)\n    .max(COORDINATE_RANGES.latitude.max)\n    .nullable()\n    .optional(),\n  longitude: z.coerce\n    .number()\n    .min(COORDINATE_RANGES.longitude.min)\n    .max(COORDINATE_RANGES.longitude.max)\n    .nullable()\n    .optional(),\n  isPrimary: z.boolean().optional(),\n})\n\nexport const addressUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(addressCreateSchema.partial())\n\nexport const tagCreateSchema = scopedSchema.extend({\n  slug: z\n    .string()\n    .min(1)\n    .max(80)\n    .regex(/^[a-z0-9_-]+$/, 'Slug must be lowercase and may contain dashes or underscores'),\n  label: z.string().min(1).max(120),\n  color: z.string().max(30).optional(),\n  description: z.string().max(400).optional(),\n})\n\nexport const tagUpdateSchema = z\n  .object({\n    id: uuid(),\n  })\n  .merge(tagCreateSchema.partial())\n\nconst KNOWN_DICTIONARY_KINDS = [\n  'status',\n  'source',\n  'lifecycle_stage',\n  'address_type',\n  'activity_type',\n  'deal_status',\n  'pipeline_stage',\n  'job_title',\n  'industry',\n  'temperature',\n  'renewal_quarter',\n  'person_company_role',\n] as const\nconst CUSTOM_DICTIONARY_KIND_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/\nconst dictionaryKindEnum = z.string().trim().refine(\n  (value) =>\n    (KNOWN_DICTIONARY_KINDS as readonly string[]).includes(value) ||\n    CUSTOM_DICTIONARY_KIND_PATTERN.test(value),\n  { message: 'Unsupported dictionary kind' },\n)\n\nconst dictionaryValueSchema = z.string().trim().min(1).max(150)\nconst dictionaryLabelSchema = z.string().trim().max(150)\n// Pipeline-stage rows migrated to semantic tone identifiers in\n// Migration20260519120000_pipeline_stage_color_tones; AddStageDialog now writes those\n// directly. Other dictionary kinds still store hex. Accept either format so round-tripping\n// a migrated pipeline-stage entry through the dictionary edit UI doesn't fail validation.\nconst DICTIONARY_COLOR_TONES = ['success', 'warning', 'info', 'error', 'neutral', 'brand', 'pink'] as const\nconst dictionaryColorSchema = z\n  .string()\n  .trim()\n  .regex(\n    new RegExp(`^(#[0-9a-fA-F]{6}|${DICTIONARY_COLOR_TONES.join('|')})$`),\n    'Color must be a six-digit hex code (e.g. #3366ff) or a semantic tone identifier',\n  )\nconst dictionaryIconSchema = z.string().trim().max(48)\n\nexport const customerDictionaryEntryCreateSchema = scopedSchema.extend({\n  kind: dictionaryKindEnum,\n  value: dictionaryValueSchema,\n  label: dictionaryLabelSchema.optional(),\n  color: dictionaryColorSchema.nullable().optional(),\n  icon: dictionaryIconSchema.nullable().optional(),\n})\n\nexport type CustomerDictionaryEntryCreateInput = z.infer<typeof customerDictionaryEntryCreateSchema>\n\nexport const customerDictionaryEntryUpdateSchema = scopedSchema\n  .extend({\n    id: uuid(),\n    kind: dictionaryKindEnum,\n    value: dictionaryValueSchema.optional(),\n    label: dictionaryLabelSchema.optional(),\n    color: dictionaryColorSchema.nullable().optional(),\n    icon: dictionaryIconSchema.nullable().optional(),\n  })\n  .refine(\n    (payload) =>\n      payload.value !== undefined ||\n      payload.label !== undefined ||\n      payload.color !== undefined ||\n      payload.icon !== undefined,\n    {\n      message: 'Provide at least one field to update.',\n      path: ['value'],\n    }\n  )\n\nexport type CustomerDictionaryEntryUpdateInput = z.infer<typeof customerDictionaryEntryUpdateSchema>\n\nexport const customerDictionaryEntryDeleteSchema = scopedSchema.extend({\n  id: uuid(),\n  kind: dictionaryKindEnum,\n})\n\nexport type CustomerDictionaryEntryDeleteInput = z.infer<typeof customerDictionaryEntryDeleteSchema>\n\nexport const tagAssignmentSchema = scopedSchema.extend({\n  tagId: uuid(),\n  entityId: uuid(),\n})\n\nexport const todoLinkCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  todoId: uuid(),\n  todoSource: z.string().min(1).max(120).default('customers:interaction'),\n  createdByUserId: uuid().optional(),\n})\n\nexport const todoLinkWithTodoCreateSchema = scopedSchema.extend({\n  entityId: uuid(),\n  title: z.string().min(1).max(200),\n  isDone: z.boolean().optional(),\n  is_done: z.boolean().optional(),\n  todoSource: z.string().min(1).max(120).default('customers:interaction'),\n  createdByUserId: uuid().optional(),\n  todoCustom: z.record(z.string(), z.any()).optional(),\n  custom: z.record(z.string(), z.any()).optional(),\n})\n\n// --- Interaction schemas ---\n\n/**\n * @deprecated Interaction statuses are now dictionary-backed and tenant-configurable\n * (the `interaction-statuses` dictionary). This frozen 3-value list is kept only for\n * backward compatibility; it is no longer the validation source (the API accepts any\n * `z.string().max(50)`). For open/terminal semantics use `lib/interactionStatus.ts`\n * (`isOpenInteractionStatus` / `isTerminalInteractionStatus` / `INTERACTION_STATUS_*`);\n * for the seeded default set use `INTERACTION_STATUS_DEFAULTS` in `cli.ts`. Do not expand\n * this list \u2014 adding members would break exhaustive consumers.\n */\nexport const interactionStatusValues = ['planned', 'done', 'canceled'] as const\n/** @deprecated See {@link interactionStatusValues}. */\nexport type InteractionStatus = typeof interactionStatusValues[number]\n\n// A participant is either a real record (`userId`) or an external guest carrying\n// no id at all. A guest is only addressable through its email, so that email is\n// required and must actually be routable \u2014 an unparseable string would persist\n// and only fail later, at invitation or calendar-sync time. Participants that DO\n// have a userId keep an unvalidated auxiliary email, as before.\nconst interactionParticipantSchema = z\n  .object({\n    userId: z.string().uuid().optional(),\n    name: z.string().trim().max(200).optional(),\n    email: z.string().trim().max(320).optional(),\n    status: z.string().trim().max(50).optional(),\n  })\n  .superRefine((participant, ctx) => {\n    if (participant.userId) return\n    if (!participant.email) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['email'],\n        message: INTERACTION_PARTICIPANT_IDENTITY_REQUIRED_MESSAGE_KEY,\n      })\n      return\n    }\n    if (!z.string().email().safeParse(participant.email).success) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['email'],\n        message: INTERACTION_PARTICIPANT_EMAIL_INVALID_MESSAGE_KEY,\n      })\n    }\n  })\n\nconst interactionLinkedEntitySchema = z.object({\n  id: z.string().uuid(),\n  // 'resource' links calendar events to bookable resources (rooms, cars,\n  // equipment) from the optional resources module (#3552).\n  // 'person' links an interaction to a `customer_entities` row with kind='person',\n  // a first-class CRM record like a company (#5934).\n  type: z.enum(['company', 'deal', 'offer', 'resource', 'person']),\n  label: z.string().trim().max(500),\n})\n\nconst interactionGuestPermissionsSchema = z\n  .object({\n    canInviteOthers: z.boolean().optional(),\n    canModify: z.boolean().optional(),\n    canSeeList: z.boolean().optional(),\n  })\n  .strict()\n\nconst interactionExtendedFields = {\n  durationMinutes: z.number().int().min(0).optional().nullable(),\n  location: z.string().trim().max(500).optional().nullable(),\n  allDay: z.boolean().optional().nullable(),\n  recurrenceRule: z.string().trim().max(500).optional().nullable(),\n  recurrenceEnd: z.coerce.date().optional().nullable(),\n  participants: z.array(interactionParticipantSchema).optional().nullable(),\n  reminderMinutes: z.number().int().min(0).optional().nullable(),\n  visibility: z.string().trim().max(50).optional().nullable(),\n  linkedEntities: z.array(interactionLinkedEntitySchema).optional().nullable(),\n  guestPermissions: interactionGuestPermissionsSchema.optional().nullable(),\n} as const\n\nconst interactionCreateBaseSchema = scopedSchema.extend({\n  id: z.string().uuid().optional(),\n  entityId: z.string().uuid(),\n  interactionType: z.string().trim().min(1).max(100),\n  title: z.string().trim().max(500).optional().nullable(),\n  body: z.string().trim().max(10000).optional().nullable(),\n  // Lenient like `deal_status` (status: z.string().max(50)). The `interaction-statuses`\n  // dictionary drives the UI dropdown; the API accepts any string <=50 chars so existing\n  // rows, external writers, and the dispatch-crm MCP keep working. Open/terminal semantics\n  // live in lib/interactionStatus.ts, not in this validator.\n  status: z.string().max(50).optional().default('planned'),\n  date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n  time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n  phoneNumber: interactionPhoneNumberSchema,\n  scheduledAt: z.coerce.date().optional().nullable(),\n  occurredAt: z.coerce.date().optional().nullable(),\n  priority: z.number().int().min(0).max(100).optional().nullable(),\n  authorUserId: z.string().uuid().optional().nullable(),\n  ownerUserId: z.string().uuid().optional().nullable(),\n  dealId: z.string().uuid().optional().nullable(),\n  appearanceIcon: z.string().trim().max(100).optional().nullable(),\n  appearanceColor: z.string().trim().regex(/^#([0-9a-fA-F]{6})$/).optional().nullable(),\n  source: z.string().trim().max(100).optional().nullable(),\n  ...interactionExtendedFields,\n})\n\nfunction deriveScheduledAtFromDateTime(date?: string, time?: string): Date | null {\n  if (!date || typeof date !== 'string') return null\n  const trimmedDate = date.trim()\n  if (!trimmedDate) return null\n  const trimmedTime = typeof time === 'string' ? time.trim() : ''\n  const iso = trimmedTime ? `${trimmedDate}T${trimmedTime}:00` : `${trimmedDate}T00:00:00`\n  const parsed = new Date(iso)\n  return Number.isNaN(parsed.getTime()) ? null : parsed\n}\n\nexport const interactionCreateSchema = interactionCreateBaseSchema\n  .superRefine((value, ctx) => {\n    if (value.interactionType === 'call' && value.phoneNumber !== undefined && value.phoneNumber !== null) {\n      const phone = typeof value.phoneNumber === 'string' ? value.phoneNumber.trim() : ''\n      if (!phone) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY,\n        })\n      } else if (!isValidPhoneNumber(phone)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_INVALID_MESSAGE_KEY,\n        })\n      }\n    }\n  })\n  // Derive `scheduledAt` from `date+time` when only the latter are sent so\n  // external API consumers don't silently persist `scheduled_at: null` after\n  // the validator already enforced non-empty date/time. The form already\n  // computes `scheduledAt` itself, so this branch is a no-op for the form path.\n  .transform((value) => {\n    if (value.scheduledAt) return value\n    const derived = deriveScheduledAtFromDateTime(value.date, value.time)\n    return derived ? { ...value, scheduledAt: derived } : value\n  })\n\nexport type InteractionCreateInput = z.infer<typeof interactionCreateSchema>\n\nconst interactionUpdateBaseSchema = z\n  .object({\n    id: z.string().uuid(),\n  })\n  .merge(\n    scopedSchema\n      .extend({\n        interactionType: z.string().trim().min(1).max(100).optional(),\n        title: z.string().trim().max(500).optional().nullable(),\n        body: z.string().trim().max(10000).optional().nullable(),\n        status: z.string().max(50).optional(),\n        date: z.string().trim().min(1, ACTIVITY_DATE_REQUIRED_MESSAGE_KEY).optional(),\n        time: z.string().trim().min(1, ACTIVITY_TIME_REQUIRED_MESSAGE_KEY).optional(),\n        phoneNumber: interactionPhoneNumberSchema,\n        scheduledAt: z.coerce.date().optional().nullable(),\n        occurredAt: z.coerce.date().optional().nullable(),\n        priority: z.number().int().min(0).max(100).optional().nullable(),\n        authorUserId: z.string().uuid().optional().nullable(),\n        ownerUserId: z.string().uuid().optional().nullable(),\n        dealId: z.string().uuid().optional().nullable(),\n        appearanceIcon: z.string().trim().max(100).optional().nullable(),\n        appearanceColor: z.string().trim().regex(/^#([0-9a-fA-F]{6})$/).optional().nullable(),\n        pinned: z.boolean().optional(),\n        ...interactionExtendedFields,\n      })\n      .partial(),\n  )\n\nexport const interactionUpdateSchema = interactionUpdateBaseSchema\n  .superRefine((value, ctx) => {\n    if (value.interactionType === 'call' && value.phoneNumber !== undefined) {\n      const phone = typeof value.phoneNumber === 'string' ? value.phoneNumber.trim() : ''\n      if (!phone) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_REQUIRED_MESSAGE_KEY,\n        })\n      } else if (!isValidPhoneNumber(phone)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['phoneNumber'],\n          message: ACTIVITY_PHONE_INVALID_MESSAGE_KEY,\n        })\n      }\n    }\n  })\n  // Mirror the create-schema derivation for partial updates: when an external\n  // caller supplies `date+time` without `scheduledAt`, derive the timestamp so\n  // the update doesn't silently leave `scheduled_at` stale.\n  .transform((value) => {\n    if (value.scheduledAt !== undefined) return value\n    if (!value.date && !value.time) return value\n    const derived = deriveScheduledAtFromDateTime(value.date, value.time)\n    return derived ? { ...value, scheduledAt: derived } : value\n  })\n\nexport type InteractionUpdateInput = z.infer<typeof interactionUpdateSchema>\n\nexport const interactionCompleteSchema = z.object({\n  id: z.string().uuid(),\n  occurredAt: z.coerce.date().optional(),\n})\n\nexport const interactionCancelSchema = z.object({\n  id: z.string().uuid(),\n})\n\nexport const customerAddressFormatSchema = z.enum(['line_first', 'street_first'])\n\nexport const customerSettingsUpsertSchema = scopedSchema.extend({\n  addressFormat: customerAddressFormatSchema,\n})\n\nexport const customerStuckThresholdUpsertSchema = scopedSchema.extend({\n  stuckThresholdDays: z.number().int().min(1).max(365),\n})\n\nexport const customerDictionarySortModesSchema = z.record(z.string(), dictionaryEntrySortModeSchema)\n\nexport const customerDictionarySortModesUpsertSchema = scopedSchema.extend({\n  dictionarySortModes: customerDictionarySortModesSchema,\n})\n\nexport type PersonCreateInput = z.infer<typeof personCreateSchema>\nexport type PersonUpdateInput = z.infer<typeof personUpdateSchema>\nexport type CompanyCreateInput = z.infer<typeof companyCreateSchema>\nexport type CompanyUpdateInput = z.infer<typeof companyUpdateSchema>\nexport type DealCreateInput = z.infer<typeof dealCreateSchema>\nexport type DealUpdateInput = z.infer<typeof dealUpdateSchema>\nexport type ActivityCreateInput = z.infer<typeof activityCreateSchema>\nexport type ActivityUpdateInput = z.infer<typeof activityUpdateSchema>\nexport type CommentCreateInput = z.infer<typeof commentCreateSchema>\nexport type CommentUpdateInput = z.infer<typeof commentUpdateSchema>\nexport type AddressCreateInput = z.infer<typeof addressCreateSchema>\nexport type AddressUpdateInput = z.infer<typeof addressUpdateSchema>\nexport type TagCreateInput = z.infer<typeof tagCreateSchema>\nexport type TagUpdateInput = z.infer<typeof tagUpdateSchema>\nexport type TagAssignmentInput = z.infer<typeof tagAssignmentSchema>\nexport type TodoLinkCreateInput = z.infer<typeof todoLinkCreateSchema>\nexport type TodoLinkWithTodoCreateInput = z.infer<typeof todoLinkWithTodoCreateSchema>\nexport type CustomerSettingsUpsertInput = z.infer<typeof customerSettingsUpsertSchema>\nexport type CustomerStuckThresholdUpsertInput = z.infer<typeof customerStuckThresholdUpsertSchema>\nexport type CustomerDictionarySortModesUpsertInput = z.infer<typeof customerDictionarySortModesUpsertSchema>\nexport type CustomerAddressFormatInput = z.infer<typeof customerAddressFormatSchema>\nexport type InteractionCompleteInput = z.infer<typeof interactionCompleteSchema>\nexport type InteractionCancelInput = z.infer<typeof interactionCancelSchema>\n\n// --- Pipeline schemas ---\n\nexport const pipelineCreateSchema = scopedSchema.extend({\n  name: z.string().trim().min(1).max(200),\n  isDefault: z.boolean().optional(),\n})\n\nexport const pipelineUpdateSchema = z.object({\n  id: uuid(),\n  name: z.string().trim().min(1).max(200).optional(),\n  isDefault: z.boolean().optional(),\n})\n\nexport const pipelineDeleteSchema = z.object({\n  id: uuid(),\n})\n\nexport type PipelineCreateInput = z.infer<typeof pipelineCreateSchema>\nexport type PipelineUpdateInput = z.infer<typeof pipelineUpdateSchema>\nexport type PipelineDeleteInput = z.infer<typeof pipelineDeleteSchema>\n\n// --- Pipeline Stage schemas ---\n\nexport const pipelineStageCreateSchema = scopedSchema.extend({\n  pipelineId: uuid(),\n  label: z.string().trim().min(1).max(200),\n  order: z.number().int().min(0).optional(),\n  color: z.string().trim().max(20).nullish(),\n  icon: z.string().trim().max(100).nullish(),\n})\n\nexport const pipelineStageUpdateSchema = z.object({\n  id: uuid(),\n  label: z.string().trim().min(1).max(200).optional(),\n  order: z.number().int().min(0).optional(),\n  color: z.string().trim().max(20).nullish(),\n  icon: z.string().trim().max(100).nullish(),\n})\n\nexport const pipelineStageDeleteSchema = z.object({\n  id: uuid(),\n})\n\nexport const pipelineStageReorderSchema = scopedSchema.extend({\n  stages: z.array(z.object({\n    id: uuid(),\n    order: z.number().int().min(0),\n  })).min(1),\n})\n\nexport type PipelineStageCreateInput = z.infer<typeof pipelineStageCreateSchema>\nexport type PipelineStageUpdateInput = z.infer<typeof pipelineStageUpdateSchema>\nexport type PipelineStageDeleteInput = z.infer<typeof pipelineStageDeleteSchema>\nexport type PipelineStageReorderInput = z.infer<typeof pipelineStageReorderSchema>\n\nexport const entityRoleCreateSchema = scopedSchema.extend({\n  entityType: z.enum(['company', 'person']),\n  entityId: uuid(),\n  roleType: z.string().trim().min(1).max(100),\n  userId: uuid(),\n})\n\nexport const entityRoleUpdateSchema = scopedSchema.extend({\n  id: uuid(),\n  userId: uuid(),\n})\n\nexport const entityRoleDeleteSchema = scopedSchema.extend({\n  id: uuid(),\n})\n\nexport type EntityRoleCreateInput = z.infer<typeof entityRoleCreateSchema>\nexport type EntityRoleUpdateInput = z.infer<typeof entityRoleUpdateSchema>\nexport type EntityRoleDeleteInput = z.infer<typeof entityRoleDeleteSchema>\n\nexport const updateKindSettingSchema = z.object({\n  kind: z.string().trim().min(1).max(100),\n  selectionMode: z.enum(['single', 'multi']).optional(),\n  visibleInTags: z.boolean().optional(),\n  sortOrder: z.number().int().min(0).optional(),\n})\n\nexport type UpdateKindSettingInput = z.infer<typeof updateKindSettingSchema>\n\nexport const customerKindSettingsUpsertSchema = scopedSchema.extend({\n  kind: z.string().trim().min(1).max(100),\n  selectionMode: z.enum(['single', 'multi']).optional(),\n  visibleInTags: z.boolean().optional(),\n  sortOrder: z.number().int().min(0).optional(),\n})\n\nexport type CustomerKindSettingsUpsertInput = z.infer<typeof customerKindSettingsUpsertSchema>\n\nexport const labelCreateSchema = z.object({\n  label: z.string().trim().min(1).max(120),\n  slug: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/).optional(),\n})\n\nexport type LabelCreateInput = z.infer<typeof labelCreateSchema>\n\nexport const labelCreateCommandSchema = scopedSchema.extend({\n  label: z.string().trim().min(1).max(120),\n  slug: z.string().trim().min(1).max(80).regex(/^[a-z0-9_-]+$/),\n  userId: uuid(),\n})\n\nexport type LabelCreateCommandInput = z.infer<typeof labelCreateCommandSchema>\n\nexport const labelAssignmentSchema = z.object({\n  labelId: z.string().uuid(),\n  entityId: z.string().uuid(),\n})\n\nexport type LabelAssignmentInput = z.infer<typeof labelAssignmentSchema>\n\nexport const labelAssignCommandSchema = scopedSchema.extend({\n  labelId: uuid(),\n  entityId: uuid(),\n})\n\nexport const labelUnassignCommandSchema = scopedSchema.extend({\n  labelId: uuid(),\n  entityId: uuid(),\n})\n\nexport type LabelAssignCommandInput = z.infer<typeof labelAssignCommandSchema>\nexport type LabelUnassignCommandInput = z.infer<typeof labelUnassignCommandSchema>\n\nexport const personCompanyLinkCreateSchema = scopedSchema.extend({\n  personEntityId: uuid(),\n  companyEntityId: uuid(),\n  isPrimary: z.boolean().optional(),\n})\n\nexport const personCompanyLinkUpdateSchema = scopedSchema.extend({\n  linkId: uuid(),\n  isPrimary: z.boolean(),\n})\n\n// Two shapes are accepted, because a person can belong to a company in two ways:\n// through a `customer_person_company_links` row (`linkId`), or through a legacy\n// profile-only assignment where `customer_person_profiles.company_id` is set and no\n// link row was ever created (migrated CRM data, #5114). Both detaches go through the\n// same command so audit, undo and cache invalidation stay consistent.\nexport const personCompanyLinkDeleteSchema = scopedSchema\n  .extend({\n    linkId: uuid().optional(),\n    personEntityId: uuid().optional(),\n    companyEntityId: uuid().optional(),\n  })\n  .refine(\n    (payload) => Boolean(payload.linkId) || Boolean(payload.personEntityId && payload.companyEntityId),\n    {\n      message: 'Provide either linkId or both personEntityId and companyEntityId.',\n      path: ['linkId'],\n    }\n  )\n\nexport type PersonCompanyLinkCreateInput = z.infer<typeof personCompanyLinkCreateSchema>\nexport type PersonCompanyLinkUpdateInput = z.infer<typeof personCompanyLinkUpdateSchema>\nexport type PersonCompanyLinkDeleteInput = z.infer<typeof personCompanyLinkDeleteSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,yBAAyB;AAClC,SAAS,qCAAqC;AAE9C,MAAM,OAAO,MAAM,EAAE,OAAO,EAAE,KAAK;AAE5B,MAAM,qCAAqC;AAC3C,MAAM,qCAAqC;AAC3C,MAAM,qCAAqC;AAC3C,MAAM,sCAAsC;AAC5C,MAAM,qCAAqC;AAC3C,MAAM,wDAAwD;AAC9D,MAAM,oDAAoD;AAI1D,MAAM,8BAA8B;AAE3C,MAAM,oBAAoB,CAAC,UAA4B;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,MAAM,cAAc,EAAE;AAAA,EACpB;AAAA,EACA,EACG,OAAO,EACP,KAAK,EACL,IAAI,EAAE,EACN,OAAO,CAAC,QAAQ,mBAAmB,GAAG,GAAG,EAAE,SAAS,mCAAmC,CAAC,EACxF,SAAS,EACT,SAAS;AACd;AAEA,MAAM,uBAAuB,EAAE;AAAA,EAC7B;AAAA,EACA,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAClD;AAEA,MAAM,qBAAqB,EAAE;AAAA,EAC3B;AAAA,EACA,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAChD;AAIA,MAAM,wBAAwB,EAAE;AAAA,EAC9B;AAAA,EACA,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AACjD;AAIA,MAAM,wBAAwB,CAAC,QAC7B,EAAE,WAAW,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC;AAIlF,MAAM,yBAAyB,EAAE;AAAA,EAC/B,CAAC,UAAU;AACT,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO;AACnE,WAAO;AAAA,EACT;AAAA,EACA,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAC/C;AAEA,MAAM,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAEnF,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,gBAAgB,KAAK;AAAA,EACrB,UAAU,KAAK;AACjB,CAAC;AAED,MAAM,wBAAwB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,KAAK;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACrD,OAAO,EACJ,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC,EACA,OAAO;AAEV,MAAM,oBAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE1D,MAAM,mBAAmB;AAAA,EACvB,aAAa;AAAA;AAAA,EAEb,aAAa,sBAAsB,GAAI;AAAA,EACvC,aAAa,KAAK,EAAE,SAAS;AAAA,EAC7B,cAAc;AAAA,EACd,cAAc;AAAA,EACd,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/B,iBAAiB,sBAAsB,SAAS,EAAE,SAAS;AAAA,EAC3D,MAAM,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AACjC;AAEA,MAAM,sBAAsB;AAAA,EAC1B,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC/C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,iBAAiB,KAAK,EAAE,SAAS,EAAE,SAAS;AAC9C;AAEA,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC9D,MAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAE7D,MAAM,uBAAuB;AAAA;AAAA,EAE3B,WAAW,sBAAsB,GAAG;AAAA,EACpC,WAAW,sBAAsB,GAAG;AAAA,EACpC,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,sBAAsB,GAAG;AAAA,EACrC,eAAe;AACjB;AAEO,MAAM,qBAAqB,aAAa,OAAO;AAAA,EACpD,GAAG;AAAA,EACH,aAAa,kBAAkB,SAAS;AAAA,EACxC,WAAW;AAAA,EACX,UAAU;AAAA,EACV,GAAG;AACL,CAAC;AAEM,MAAM,qBAAqB,EAC/B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA;AAAA,EACC,aAAa,OAAO;AAAA,IAClB,GAAG;AAAA,IACH,GAAG;AAAA,IACH,WAAW,sBAAsB,SAAS;AAAA,IAC1C,UAAU,qBAAqB,SAAS;AAAA,EAC1C,CAAC,EAAE,QAAQ;AACb;AAEK,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,GAAG;AAAA,EACH,aAAa;AAAA,EACb,GAAG;AACL,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,mBAAmB,aAAa,OAAO;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,IAAI,2BAA2B,EAAE,SAAS;AAAA,EAClE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,YAAY,KAAK,EAAE,SAAS;AAAA,EAC5B,iBAAiB,KAAK,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/C,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACjD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,iBAAiB,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA,EAI1C,aAAa,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAAA,EACjD,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AAAA,EACrC,WAAW,EAAE,MAAM,KAAK,CAAC,EAAE,SAAS;AAAA,EACpC,uBAAuB,KAAK,EAAE,SAAS,EAAE,SAAS;AACpD,CAAC;AAEM,MAAM,mBAAmB,EAC7B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,iBAAiB,QAAQ,CAAC;AAI5B,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK;AAAA,EACrC,aAAa,KAAK,EAAE,SAAS;AAC/B,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,KAAK,EAAE,MAAM,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK;AAAA,EACrC,iBAAiB,KAAK;AACxB,CAAC;AAEM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,IAAI,EAAE,QAAQ;AAAA,EACd,eAAe,KAAK,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,OAAO;AACpB,CAAC;AAEM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,UAAU,KAAK;AAAA,EACf,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,aAAa;AAAA,EACb,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS;AAAA,EACrC,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EACd,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC;AAEM,MAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,qBAAqB,QAAQ,CAAC;AAEhC,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,EAChC,cAAc,KAAK,EAAE,SAAS;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EACd,OAAO,EACP,KAAK,EACL,MAAM,qBAAqB,EAC3B,SAAS,EACT,SAAS;AACd,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,UAAU,KAAK;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACnC,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OACT,OAAO,EACP,IAAI,kBAAkB,SAAS,GAAG,EAClC,IAAI,kBAAkB,SAAS,GAAG,EAClC,SAAS,EACT,SAAS;AAAA,EACZ,WAAW,EAAE,OACV,OAAO,EACP,IAAI,kBAAkB,UAAU,GAAG,EACnC,IAAI,kBAAkB,UAAU,GAAG,EACnC,SAAS,EACT,SAAS;AAAA,EACZ,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,oBAAoB,QAAQ,CAAC;AAE/B,MAAM,kBAAkB,aAAa,OAAO;AAAA,EACjD,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,iBAAiB,8DAA8D;AAAA,EACxF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI,KAAK;AACX,CAAC,EACA,MAAM,gBAAgB,QAAQ,CAAC;AAElC,MAAM,yBAAyB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,MAAM,iCAAiC;AACvC,MAAM,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE;AAAA,EAC3C,CAAC,UACE,uBAA6C,SAAS,KAAK,KAC5D,+BAA+B,KAAK,KAAK;AAAA,EAC3C,EAAE,SAAS,8BAA8B;AAC3C;AAEA,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC9D,MAAM,wBAAwB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG;AAKvD,MAAM,yBAAyB,CAAC,WAAW,WAAW,QAAQ,SAAS,WAAW,SAAS,MAAM;AACjG,MAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL;AAAA,EACC,IAAI,OAAO,qBAAqB,uBAAuB,KAAK,GAAG,CAAC,IAAI;AAAA,EACpE;AACF;AACF,MAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;AAE9C,MAAM,sCAAsC,aAAa,OAAO;AAAA,EACrE,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,qBAAqB,SAAS,EAAE,SAAS;AACjD,CAAC;AAIM,MAAM,sCAAsC,aAChD,OAAO;AAAA,EACN,IAAI,KAAK;AAAA,EACT,MAAM;AAAA,EACN,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS;AAAA,EACtC,OAAO,sBAAsB,SAAS,EAAE,SAAS;AAAA,EACjD,MAAM,qBAAqB,SAAS,EAAE,SAAS;AACjD,CAAC,EACA;AAAA,EACC,CAAC,YACC,QAAQ,UAAU,UAClB,QAAQ,UAAU,UAClB,QAAQ,UAAU,UAClB,QAAQ,SAAS;AAAA,EACnB;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,OAAO;AAAA,EAChB;AACF;AAIK,MAAM,sCAAsC,aAAa,OAAO;AAAA,EACrE,IAAI,KAAK;AAAA,EACT,MAAM;AACR,CAAC;AAIM,MAAM,sBAAsB,aAAa,OAAO;AAAA,EACrD,OAAO,KAAK;AAAA,EACZ,UAAU,KAAK;AACjB,CAAC;AAEM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AAAA,EACb,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,uBAAuB;AAAA,EACtE,iBAAiB,KAAK,EAAE,SAAS;AACnC,CAAC;AAEM,MAAM,+BAA+B,aAAa,OAAO;AAAA,EAC9D,UAAU,KAAK;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC9B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,uBAAuB;AAAA,EACtE,iBAAiB,KAAK,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,IAAI,CAAC,EAAE,SAAS;AACjD,CAAC;AAaM,MAAM,0BAA0B,CAAC,WAAW,QAAQ,UAAU;AASrE,MAAM,+BAA+B,EAClC,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS;AAC7C,CAAC,EACA,YAAY,CAAC,aAAa,QAAQ;AACjC,MAAI,YAAY,OAAQ;AACxB,MAAI,CAAC,YAAY,OAAO;AACtB,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,YAAY,KAAK,EAAE,SAAS;AAC5D,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEH,MAAM,gCAAgC,EAAE,OAAO;AAAA,EAC7C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKpB,MAAM,EAAE,KAAK,CAAC,WAAW,QAAQ,SAAS,YAAY,QAAQ,CAAC;AAAA,EAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG;AAClC,CAAC;AAED,MAAM,oCAAoC,EACvC,OAAO;AAAA,EACN,iBAAiB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,EAChC,YAAY,EAAE,QAAQ,EAAE,SAAS;AACnC,CAAC,EACA,OAAO;AAEV,MAAM,4BAA4B;AAAA,EAChC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,eAAe,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,cAAc,EAAE,MAAM,4BAA4B,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1D,gBAAgB,EAAE,MAAM,6BAA6B,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3E,kBAAkB,kCAAkC,SAAS,EAAE,SAAS;AAC1E;AAEA,MAAM,8BAA8B,aAAa,OAAO;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC/B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAK,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,SAAS;AAAA,EACvD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC/D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,EAAE,SAAS,EAAE,SAAS;AAAA,EACpF,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,GAAG;AACL,CAAC;AAED,SAAS,8BAA8B,MAAe,MAA4B;AAChF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,cAAc,KAAK,KAAK;AAC9B,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,cAAc,OAAO,SAAS,WAAW,KAAK,KAAK,IAAI;AAC7D,QAAM,MAAM,cAAc,GAAG,WAAW,IAAI,WAAW,QAAQ,GAAG,WAAW;AAC7E,QAAM,SAAS,IAAI,KAAK,GAAG;AAC3B,SAAO,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,OAAO;AACjD;AAEO,MAAM,0BAA0B,4BACpC,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,oBAAoB,UAAU,MAAM,gBAAgB,UAAa,MAAM,gBAAgB,MAAM;AACrG,UAAM,QAAQ,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,IAAI;AACjF,QAAI,CAAC,OAAO;AACV,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH,WAAW,CAAC,mBAAmB,KAAK,GAAG;AACrC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC,EAKA,UAAU,CAAC,UAAU;AACpB,MAAI,MAAM,YAAa,QAAO;AAC9B,QAAM,UAAU,8BAA8B,MAAM,MAAM,MAAM,IAAI;AACpE,SAAO,UAAU,EAAE,GAAG,OAAO,aAAa,QAAQ,IAAI;AACxD,CAAC;AAIH,MAAM,8BAA8B,EACjC,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC,EACA;AAAA,EACC,aACG,OAAO;AAAA,IACN,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACvD,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,IACpC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,IAC5E,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,kCAAkC,EAAE,SAAS;AAAA,IAC5E,aAAa;AAAA,IACb,aAAa,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACjD,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAChD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/D,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IACnD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,IAC9C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,EAAE,SAAS,EAAE,SAAS;AAAA,IACpF,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,IAC7B,GAAG;AAAA,EACL,CAAC,EACA,QAAQ;AACb;AAEK,MAAM,0BAA0B,4BACpC,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,oBAAoB,UAAU,MAAM,gBAAgB,QAAW;AACvE,UAAM,QAAQ,OAAO,MAAM,gBAAgB,WAAW,MAAM,YAAY,KAAK,IAAI;AACjF,QAAI,CAAC,OAAO;AACV,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH,WAAW,CAAC,mBAAmB,KAAK,GAAG;AACrC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AACF,CAAC,EAIA,UAAU,CAAC,UAAU;AACpB,MAAI,MAAM,gBAAgB,OAAW,QAAO;AAC5C,MAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,KAAM,QAAO;AACvC,QAAM,UAAU,8BAA8B,MAAM,MAAM,MAAM,IAAI;AACpE,SAAO,UAAU,EAAE,GAAG,OAAO,aAAa,QAAQ,IAAI;AACxD,CAAC;AAII,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,OAAO,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAEM,MAAM,8BAA8B,EAAE,KAAK,CAAC,cAAc,cAAc,CAAC;AAEzE,MAAM,+BAA+B,aAAa,OAAO;AAAA,EAC9D,eAAe;AACjB,CAAC;AAEM,MAAM,qCAAqC,aAAa,OAAO;AAAA,EACpE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACrD,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO,EAAE,OAAO,GAAG,6BAA6B;AAE5F,MAAM,0CAA0C,aAAa,OAAO;AAAA,EACzE,qBAAqB;AACvB,CAAC;AA4BM,MAAM,uBAAuB,aAAa,OAAO;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,KAAK;AAAA,EACT,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,KAAK;AACX,CAAC;AAQM,MAAM,4BAA4B,aAAa,OAAO;AAAA,EAC3D,YAAY,KAAK;AAAA,EACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,QAAQ;AAC3C,CAAC;AAEM,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,KAAK;AAAA,EACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ;AAAA,EACzC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,QAAQ;AAC3C,CAAC;AAEM,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,KAAK;AACX,CAAC;AAEM,MAAM,6BAA6B,aAAa,OAAO;AAAA,EAC5D,QAAQ,EAAE,MAAM,EAAE,OAAO;AAAA,IACvB,IAAI,KAAK;AAAA,IACT,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,EAC/B,CAAC,CAAC,EAAE,IAAI,CAAC;AACX,CAAC;AAOM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC;AAAA,EACxC,UAAU,KAAK;AAAA,EACf,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,QAAQ,KAAK;AACf,CAAC;AAEM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,IAAI,KAAK;AAAA,EACT,QAAQ,KAAK;AACf,CAAC;AAEM,MAAM,yBAAyB,aAAa,OAAO;AAAA,EACxD,IAAI,KAAK;AACX,CAAC;AAMM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC9C,CAAC;AAIM,MAAM,mCAAmC,aAAa,OAAO;AAAA,EAClE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC,EAAE,SAAS;AAAA,EACpD,eAAe,EAAE,QAAQ,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC9C,CAAC;AAIM,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,eAAe,EAAE,SAAS;AACzE,CAAC;AAIM,MAAM,2BAA2B,aAAa,OAAO;AAAA,EAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,eAAe;AAAA,EAC5D,QAAQ,KAAK;AACf,CAAC;AAIM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAIM,MAAM,2BAA2B,aAAa,OAAO;AAAA,EAC1D,SAAS,KAAK;AAAA,EACd,UAAU,KAAK;AACjB,CAAC;AAEM,MAAM,6BAA6B,aAAa,OAAO;AAAA,EAC5D,SAAS,KAAK;AAAA,EACd,UAAU,KAAK;AACjB,CAAC;AAKM,MAAM,gCAAgC,aAAa,OAAO;AAAA,EAC/D,gBAAgB,KAAK;AAAA,EACrB,iBAAiB,KAAK;AAAA,EACtB,WAAW,EAAE,QAAQ,EAAE,SAAS;AAClC,CAAC;AAEM,MAAM,gCAAgC,aAAa,OAAO;AAAA,EAC/D,QAAQ,KAAK;AAAA,EACb,WAAW,EAAE,QAAQ;AACvB,CAAC;AAOM,MAAM,gCAAgC,aAC1C,OAAO;AAAA,EACN,QAAQ,KAAK,EAAE,SAAS;AAAA,EACxB,gBAAgB,KAAK,EAAE,SAAS;AAAA,EAChC,iBAAiB,KAAK,EAAE,SAAS;AACnC,CAAC,EACA;AAAA,EACC,CAAC,YAAY,QAAQ,QAAQ,MAAM,KAAK,QAAQ,QAAQ,kBAAkB,QAAQ,eAAe;AAAA,EACjG;AAAA,IACE,SAAS;AAAA,IACT,MAAM,CAAC,QAAQ;AAAA,EACjB;AACF;",
   "names": []
 }

package/dist/modules/entities/cli.js

@@ -19,7 +19,8 @@ import {
 } from "@open-mercato/shared/lib/encryption/aes";
 import {
   TenantDataEncryptionService,
-  parseDecryptedFieldValue
+  parseDecryptedFieldValue,
+  resolveEncryptionKeyId
 } from "@open-mercato/shared/lib/encryption/tenantDataEncryptionService";
 import { resolveEntityIdFromMetadata } from "@open-mercato/shared/lib/encryption/entityIds";
 import { listEntityMetadata } from "@open-mercato/shared/lib/db/entityMetadata";
@@ -473,6 +474,19 @@ const rotateEncryptionKey = {
       return scopes;
     };
     const oldDekCache = /* @__PURE__ */ new Map();
+    const dekAvailability = /* @__PURE__ */ new Map();
+    const hasExistingDek = async (tenantId) => {
+      const cached = dekAvailability.get(tenantId);
+      if (cached !== void 0) return cached;
+      const available = Boolean(await encryptionService.getDek(tenantId));
+      dekAvailability.set(tenantId, available);
+      if (!available) {
+        console.warn(
+          `[dry-run] Tenant ${tenantId} has no data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`
+        );
+      }
+      return available;
+    };
     const processScope = async (entityId, meta, fields, scope) => {
       const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : "id";
       const columns = /* @__PURE__ */ new Set();
@@ -495,6 +509,7 @@ const rotateEncryptionKey = {
       const rows = await conn.execute(selectSql, [scope.tenantId, scope.organizationId]);
       const list = Array.isArray(rows) ? rows : [];
       if (!list.length) return 0;
+      const dekAvailable = dryRun ? await hasExistingDek(scope.tenantId) : true;
       let updated = 0;
       for (const row of list) {
         const payload = {};
@@ -530,11 +545,23 @@ const rotateEncryptionKey = {
             payload[rule.field] = parseDecryptedFieldValue(decrypted);
           }
         }
+        if (!dekAvailable) {
+          const wouldChange = fields.some((rule) => {
+            const col = resolveProperty(meta, rule.field)?.columnName;
+            if (!col) return false;
+            const value = row[col];
+            if (value === null || value === void 0) return false;
+            return rotate ? isEncryptedPayload(value) : !isEncryptedPayload(value);
+          });
+          if (wouldChange) updated += 1;
+          continue;
+        }
         const encrypted = await encryptionService.encryptEntityPayload(
           entityId,
           payload,
           scope.tenantId,
-          scope.organizationId
+          scope.organizationId,
+          { createMissingDek: !dryRun }
         );
         const updates = {};
         for (const rule of fields) {
@@ -992,6 +1019,12 @@ const backfillSystemEncryption = {
       }
       const columnList = Array.from(columns);
       const selectList = columnList.map((column) => `"${column}"`).join(", ");
+      const systemDekAvailable = dryRun ? Boolean(await encryptionService.getDek(resolveEncryptionKeyId(entityId, "system", null))) : true;
+      if (!systemDekAvailable) {
+        console.warn(
+          `[dry-run] ${entityId} has no system data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`
+        );
+      }
       let cursor = null;
       let entityRowsScanned = 0;
       let entityRowsUpdated = 0;
@@ -1019,7 +1052,17 @@ const backfillSystemEncryption = {
             }
           }
           if (!hasPlaintext) continue;
-          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null);
+          if (!systemDekAvailable) {
+            entityRowsUpdated += 1;
+            continue;
+          }
+          const encrypted = await encryptionService.encryptEntityPayload(
+            entityId,
+            payload,
+            null,
+            null,
+            { createMissingDek: !dryRun }
+          );
           const updates = {};
           for (const rule of map.fields) {
             const resolved = resolveProperty(meta, rule.field);

package/dist/modules/entities/cli.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/entities/cli.ts"],
-  "sourcesContent": ["import { getCliModules, getDefaultEncryptionMaps, type Module, type ModuleCli } from '@open-mercato/shared/modules/registry'\nimport type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryption'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CacheStrategy } from '@open-mercato/cache/types'\nimport { CustomEntity, CustomFieldDef, EncryptionMap } from './data/entities'\nimport {\n  installCustomEntitiesFromModules,\n  getAggregatedCustomEntityConfigs,\n} from './lib/install-from-ce'\nimport readline from 'node:readline/promises'\nimport { stdin as input, stdout as output } from 'node:process'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport { createKmsService, type KmsService, type TenantDek } from '@open-mercato/shared/lib/encryption/kms'\nimport {\n  decryptWithAesGcm,\n  decryptWithAesGcmStrict,\n  TenantDataEncryptionError,\n  TenantDataEncryptionErrorCode,\n} from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'\nimport { Organization } from '../directory/data/entities'\nimport crypto from 'node:crypto'\n\nfunction parseArgs(rest: string[]) {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const a = rest[i]\n    if (!a) continue\n    if (a.startsWith('--')) {\n      const [k, v] = a.replace(/^--/, '').split('=')\n      if (v !== undefined) args[k] = v\n      else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) { args[k] = rest[i + 1]!; i++ }\n      else args[k] = true\n    }\n  }\n  return args\n}\n\nconst seedDefs: ModuleCli = {\n  command: 'install',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string)\n    const globalOnly = Boolean(args.global)\n    const dry = Boolean(args['dry-run'] || args.dry)\n    const force = Boolean(args.force)\n    const includeGlobal = args['no-global'] ? false : true\n\n    if (globalOnly && includeGlobal === false) {\n      console.error('Cannot combine --global with --no-global.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    let cache: CacheStrategy | null = null\n    try { cache = resolve('cache') as CacheStrategy } catch {}\n\n    const tenantIds = tenantIdArg\n      ? [tenantIdArg]\n      : (globalOnly ? [] : undefined)\n\n    const logger = (message: string) => {\n      const prefix = dry ? '[dry-run] ' : ''\n      console.log(`${prefix}${message}`)\n    }\n\n    const result = await installCustomEntitiesFromModules(em, cache, {\n      tenantIds,\n      includeGlobal,\n      dryRun: dry,\n      force,\n      logger,\n    })\n    const label = dry ? 'Dry-run' : 'Sync'\n    console.log(`\u2705 ${label} complete: processed=${result.processed}, updated=${result.synchronized}, fieldsChanged=${result.fieldChanges}, skipped=${result.skipped}`)\n  },\n}\n\n// Reinstall: remove existing definitions for target scope and re-seed from modules\nconst reinstallDefs: ModuleCli = {\n  command: 'reinstall',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string)\n    const globalOnly = Boolean(args.global)\n    const dry = Boolean(args['dry-run'] || args.dry)\n    const includeGlobal = globalOnly ? true : (args['no-global'] ? false : true)\n\n    if (globalOnly && includeGlobal === false) {\n      console.error('Cannot combine --global with --no-global.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    let cache: CacheStrategy | null = null\n    try { cache = resolve('cache') as CacheStrategy } catch {}\n\n    const tenantIds = tenantIdArg\n      ? [tenantIdArg]\n      : (globalOnly ? [] : undefined)\n\n    const aggregates = getAggregatedCustomEntityConfigs()\n    const relevant = aggregates.filter((entry) => (globalOnly ? entry.spec?.global === true : true))\n    if (!relevant.length) {\n      console.log('No custom entities or fields discovered. Nothing to reinstall.')\n      return\n    }\n    const entityIds = Array.from(new Set(relevant.map((entry) => entry.entityId)))\n    if (!entityIds.length) {\n      console.log('No entity ids discovered. Nothing to reinstall.')\n      return\n    }\n\n    const logger = (message: string) => {\n      const prefix = dry ? '[dry-run] ' : ''\n      console.log(`${prefix}${message}`)\n    }\n\n    if (dry) {\n      console.log('Dry-run: would remove existing custom entity definitions before reinstall.')\n    } else {\n      const fieldWhere: any = { entityId: { $in: entityIds } }\n      if (tenantIds !== undefined) {\n        if (tenantIds.length === 0) fieldWhere.tenantId = null\n        else fieldWhere.tenantId = { $in: tenantIds }\n      }\n      const removedFields = await em.nativeDelete(CustomFieldDef, fieldWhere)\n\n      const entityWhere: any = { entityId: { $in: entityIds } }\n      if (tenantIds !== undefined) {\n        if (tenantIds.length === 0) entityWhere.tenantId = null\n        else entityWhere.tenantId = { $in: tenantIds }\n      }\n      const removedEntities = await em.nativeDelete(CustomEntity, entityWhere)\n\n      if (cache && entityIds.length) {\n        try {\n          await cache.deleteByTags(entityIds.map((id) => `custom-entity:${id}`))\n        } catch {}\n      }\n      console.log(`Cleared definitions: fields=${removedFields}, entities=${removedEntities}`)\n    }\n\n    const result = await installCustomEntitiesFromModules(em, cache, {\n      tenantIds,\n      includeGlobal,\n      dryRun: dry,\n      force: true,\n      logger,\n    })\n    const label = dry ? 'Dry-run' : 'Reinstall'\n    console.log(`\u2705 ${label} complete: processed=${result.processed}, updated=${result.synchronized}, fieldsChanged=${result.fieldChanges}, skipped=${result.skipped}`)\n  },\n}\n\n// Interactive: add a single custom field definition\nconst addField: ModuleCli = {\n  command: 'add-field',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const rl = readline.createInterface({ input, output })\n    const ask = async (q: string, d?: string) => {\n      const a = (await rl.question(d ? `${q} [${d}]: ` : `${q}: `)).trim()\n      return a || (d ?? '')\n    }\n    const askBool = async (q: string, d = false) => {\n      const a = (await ask(q, d ? 'y' : 'n')).toLowerCase()\n      return parseBooleanToken(a) === true\n    }\n\n    try {\n      const { resolve } = await createRequestContainer()\n      const em = resolve('em') as any\n\n      const entityId = (args.entity as string) || (args.e as string) || await ask('Entity ID (e.g., example:todo)')\n      const isGlobal = args.global ? true : await askBool('Global (no organization)?', false)\n      const orgId = isGlobal ? null : ((args.org as string) || (args.organizationId as string) || await ask('Organization ID'))\n      const tenantId = isGlobal ? null : ((args.tenant as string) || (args.tenantId as string) || await ask('Tenant ID'))\n      const key = (args.key as string) || await ask('Field key (snake_case)')\n      let kind = (args.kind as string) || await ask(\"Kind (text|multiline|integer|float|boolean|select|currency|relation|attachment)\", 'text')\n      kind = kind.toLowerCase()\n      if (!['text','multiline','integer','float','boolean','select','currency','relation','attachment'].includes(kind)) throw new Error('Invalid kind')\n      const label = (args.label as string) || (await ask('Label', key))\n      const description = (args.description as string) || ''\n      const required = args.required !== undefined ? Boolean(args.required) : await askBool('Required?', false)\n      const multi = args.multi !== undefined ? Boolean(args.multi) : await askBool('Allow multiple?', false)\n      let options: string[] | undefined\n      if (kind === 'select') {\n        const raw = (args.options as string) || await ask('Options (comma-separated)', 'low,medium,high')\n        options = parseCommaSeparatedList(raw)\n      }\n      let defaultValue: any = undefined\n      const defRaw = (args.default as string) ?? (args.defaultValue as string)\n      const needDefault = defRaw !== undefined ? defRaw : await ask('Default value (leave empty for none)', '')\n      if (needDefault !== '') {\n        switch (kind) {\n          case 'integer': defaultValue = Number(needDefault); break\n          case 'float': defaultValue = Number(needDefault); break\n          case 'boolean': defaultValue = parseBooleanToken(String(needDefault)) === true; break\n          default: defaultValue = String(needDefault)\n        }\n      }\n      const filterable = args.filterable !== undefined ? Boolean(args.filterable) : await askBool('Filterable?', true)\n      const listVisible = args.listVisible !== undefined ? Boolean(args.listVisible) : await askBool('Visible in list?', true)\n      const formEditable = args.formEditable !== undefined ? Boolean(args.formEditable) : await askBool('Editable in forms?', true)\n      const indexed = args.indexed !== undefined ? Boolean(args.indexed) : await askBool('Indexed?', false)\n\n      const where = { entityId, organizationId: orgId, tenantId: tenantId, key }\n      const existing = await em.findOne(CustomFieldDef, where)\n      const configJson: any = {}\n      if (options) configJson.options = options\n      if (defaultValue !== undefined) configJson.defaultValue = defaultValue\n      if (required !== undefined) configJson.required = required\n      if (multi !== undefined) configJson.multi = multi\n      if (filterable !== undefined) configJson.filterable = filterable\n      if (indexed !== undefined) configJson.indexed = indexed\n      if (listVisible !== undefined) configJson.listVisible = listVisible\n      if (formEditable !== undefined) configJson.formEditable = formEditable\n      if (label !== undefined) configJson.label = label\n      if (description !== undefined) configJson.description = description\n\n      if (!existing) {\n        await em.persist(em.create(CustomFieldDef, {\n          entityId,\n          organizationId: orgId,\n          tenantId: tenantId,\n          key,\n          kind,\n          configJson,\n          isActive: true,\n        })).flush()\n        console.log(`Created custom field: ${entityId}.${key} (${kind})${orgId == null ? ' [global]' : ` [org=${orgId}, tenant=${tenantId}]`}`)\n      } else {\n        existing.kind = kind as any\n        existing.configJson = configJson\n        existing.isActive = true\n        await em.flush()\n        console.log(`Updated custom field: ${entityId}.${key} (${kind})${orgId == null ? ' [global]' : ` [org=${orgId}, tenant=${tenantId}]`}`)\n      }\n    } catch (e: any) {\n      console.error('Failed:', e?.message || e)\n    } finally {\n      await rl.close()\n    }\n  },\n}\n\nfunction resolveEncryptionMapModules(): Module[] {\n  const cliModules = getCliModules()\n  if (cliModules.length > 0) return cliModules\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n\n/**\n * Entity ids whose encryption map is declared in module code with `keyScope: 'system'`.\n *\n * Their ciphertext is sealed under a `system:<entityId>` DEK that has no tenant, so every\n * tenant-scoped command here MUST leave them alone: re-wrapping such a value under a tenant\n * DEK produces a payload runtime decryption can never read again. `backfill-system-encryption`\n * is the one command that handles them.\n */\nfunction getSystemScopedEntityIds(): Set<string> {\n  return new Set(\n    getDefaultEncryptionMaps(resolveEncryptionMapModules())\n      .filter((map) => map.keyScope === 'system')\n      .map((map) => map.entityId),\n  )\n}\n\n// Idempotently upsert a specific set of encryption-map specs for one (tenant, org) scope. Exported so\n// upgrade actions can backfill a newly-added encrypted entity for pre-existing tenants (whose maps were\n// seeded once at tenant creation and never re-run) without depending on the full CLI module registry.\nexport async function upsertEncryptionMapSpecs(\n  em: any,\n  tenantId: string,\n  organizationId: string | null,\n  specs: ModuleEncryptionMap[],\n  logger: (msg: string) => void = () => {},\n) {\n  for (const spec of specs) {\n    if (spec.keyScope === 'system') {\n      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)\n      continue\n    }\n    const existing = await em.findOne(EncryptionMap, {\n      entityId: spec.entityId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing) {\n      existing.fieldsJson = spec.fields\n      existing.isActive = true\n      existing.updatedAt = new Date()\n      logger(`\uD83D\uDD12 Updated encryption map for ${spec.entityId} \u2728`)\n      await em.persist(existing).flush()\n      continue\n    }\n    const map = em.create(EncryptionMap, {\n      entityId: spec.entityId,\n      tenantId,\n      organizationId,\n      fieldsJson: spec.fields,\n      isActive: true,\n    })\n    await em.persist(map).flush()\n    logger(`Created encryption map for ${spec.entityId}`)\n  }\n}\n\nasync function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {\n  await upsertEncryptionMapSpecs(em, tenantId, organizationId, getDefaultEncryptionMaps(resolveEncryptionMapModules()), logger)\n}\n\nconst seedEncryptionMaps: ModuleCli = {\n  command: 'seed-encryption',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantId = (args.tenant as string) || (args.tenantId as string)\n    const organizationId = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n\n    if (!tenantId) {\n      console.error('tenant id is required (use --tenant <uuid>)')\n      return\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.warn('TENANT_DATA_ENCRYPTION is disabled; skipping encryption map seeding.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const logger = (msg: string) => console.log(msg)\n    await upsertEncryptionMaps(em, tenantId, organizationId, logger)\n    console.log('\u2705 Encryption maps seeded')\n  },\n}\n\nfunction normalizeKeyInput(value: string): string {\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\nclass DerivedKeyKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    this.root = crypto.createHash('sha256').update(normalizeKeyInput(secret)).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nfunction fingerprintDek(dek: TenantDek | null): string | null {\n  if (!dek?.key) return null\n  return crypto.createHash('sha256').update(dek.key).digest('hex').slice(0, 12)\n}\n\nfunction decryptWithOldKey(\n  payload: string,\n  dek: TenantDek | null,\n): string | null {\n  if (!dek?.key) return null\n  return decryptWithAesGcm(payload, dek.key)\n}\n\nfunction resolveProperty(meta: any, field: string): { columnName: string | null; prop: any | null } {\n  if (!meta?.properties) return { columnName: null, prop: null }\n  const candidates = [\n    field,\n    field.replace(/_([a-z])/g, (_, c) => c.toUpperCase()),\n    field.replace(/([A-Z])/g, '_$1').toLowerCase(),\n  ]\n  for (const candidate of candidates) {\n    const prop = meta.properties[candidate]\n    const fieldName =\n      prop?.fieldName ??\n      (Array.isArray(prop?.fieldNames) && prop.fieldNames.length ? prop.fieldNames[0] : undefined)\n    if (typeof fieldName === 'string' && fieldName.length) return { columnName: fieldName, prop }\n    if (prop?.name) return { columnName: prop.name, prop }\n  }\n  return { columnName: null, prop: null }\n}\n\nfunction buildEntityMetaRegistry(em: any): Map<string, any> {\n  const allMeta = listEntityMetadata(em)\n  const metaByEntityId = new Map<string, any>()\n  for (const meta of allMeta) {\n    const resolved = resolveEntityIdFromMetadata(meta)\n    if (resolved) metaByEntityId.set(resolved, meta)\n  }\n  return metaByEntityId\n}\n\ninterface EncryptionMapMeta {\n  entityId: string\n  meta: any\n  fields: Array<{ field: string; hashField?: string | null }>\n  tenantId: string\n}\n\nfunction resolveMapMeta(\n  map: EncryptionMap,\n  metaByEntityId: Map<string, any>,\n  warn: (msg: string) => void = () => {},\n): EncryptionMapMeta | null {\n  const entityId = String(map.entityId)\n  const meta = metaByEntityId.get(entityId)\n  if (!meta) {\n    warn(`Skipping ${entityId}: metadata not found.`)\n    return null\n  }\n  const fields = Array.isArray(map.fieldsJson) ? map.fieldsJson : []\n  if (!fields.length) return null\n  const tenantId = map.tenantId ? String(map.tenantId) : null\n  if (!tenantId) return null\n  return { entityId, meta, fields, tenantId }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nfunction formatValueForColumn(prop: any, value: unknown): unknown {\n  if (value === null || value === undefined) return value\n  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []\n  const type = String(prop?.type ?? '').toLowerCase()\n  const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'\n  if (!isJson) return value\n  return JSON.stringify(value)\n}\n\nconst rotateEncryptionKey: ModuleCli = {\n  command: 'rotate-encryption-key',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string) || null\n    const organizationIdArg = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n    const oldKey = (args['old-key'] as string) || (args.oldKey as string) || null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const debug = Boolean(args.debug)\n    const rotate = Boolean(oldKey)\n    if (rotate && !tenantIdArg) {\n      console.warn(\n        '\u26A0\uFE0F  Rotating with --old-key across all tenants. A single old key should normally target one tenant; consider --tenant.',\n      )\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw connection; aborting.')\n      return\n    }\n\n    const encryptionService = new TenantDataEncryptionService(em as any, { kms: createKmsService() })\n    const oldKms = rotate && oldKey ? new DerivedKeyKmsService(oldKey) : null\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')\n      return\n    }\n\n    if (debug) {\n      console.log('[rotate-encryption-key]', {\n        hasOldKey: Boolean(oldKey),\n        rotate,\n        tenantId: tenantIdArg ?? null,\n        organizationId: organizationIdArg ?? null,\n      })\n      if (tenantIdArg) {\n        const [oldDek, newDek] = await Promise.all([\n          oldKms?.getTenantDek(tenantIdArg) ?? Promise.resolve(null),\n          encryptionService.getDek(tenantIdArg),\n        ])\n        console.log('[rotate-encryption-key] dek fingerprints', {\n          oldKey: fingerprintDek(oldDek),\n          currentKey: fingerprintDek(newDek),\n        })\n      } else {\n        console.log('[rotate-encryption-key] dek fingerprints skipped (no tenantId)')\n      }\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n\n    const where: any = { deletedAt: null }\n    if (tenantIdArg) where.tenantId = tenantIdArg\n    if (organizationIdArg) where.organizationId = organizationIdArg\n    const allMaps = await em.find(EncryptionMap, where)\n    const systemScopedEntityIds = getSystemScopedEntityIds()\n    const maps = allMaps.filter((map: EncryptionMap) => {\n      if (!systemScopedEntityIds.has(String(map.entityId))) return true\n      console.warn(\n        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key \u2014 use \"mercato entities backfill-system-encryption\" instead.`,\n      )\n      return false\n    })\n    if (!maps.length) {\n      console.log('No encryption maps found for the selected scope.')\n      return\n    }\n\n    const resolveScopes = async (tenantId: string, organizationId: string | null) => {\n      if (organizationId) return [{ tenantId, organizationId }]\n      const orgs = await em.find(Organization, { tenant: tenantId })\n      const scopes = orgs.map((org: Organization) => ({\n        tenantId,\n        organizationId: String(org.id),\n      }))\n      scopes.push({ tenantId, organizationId: null })\n      return scopes\n    }\n\n    const oldDekCache = new Map<string, TenantDek | null>()\n    const processScope = async (\n      entityId: string,\n      meta: any,\n      fields: Array<{ field: string; hashField?: string | null }>,\n      scope: { tenantId: string; organizationId: string | null },\n    ): Promise<number> => {\n      const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const columns = new Set<string>()\n      columns.add(pk)\n      for (const rule of fields) {\n        const resolved = resolveProperty(meta, rule.field)\n        if (resolved?.columnName) columns.add(resolved.columnName)\n        if (rule.hashField) {\n          const resolvedHash = resolveProperty(meta, rule.hashField)\n          if (resolvedHash?.columnName) columns.add(resolvedHash.columnName)\n        }\n      }\n      const columnList = Array.from(columns)\n      if (!columnList.length) return 0\n      const tableName = meta?.tableName\n      if (!tableName) return 0\n      const schema = meta?.schema\n      const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n      const selectSql = `select ${columnList.map((c) => `\"${c}\"`).join(', ')} from ${qualifiedTable} where tenant_id = ? and organization_id is not distinct from ?`\n      const rows = await conn.execute(selectSql, [scope.tenantId, scope.organizationId])\n      const list = Array.isArray(rows) ? rows : []\n      if (!list.length) return 0\n      let updated = 0\n      for (const row of list) {\n        const payload: Record<string, unknown> = {}\n        for (const rule of fields) {\n          const resolved = resolveProperty(meta, rule.field)\n          const col = resolved?.columnName\n          if (!col) continue\n          const rawValue = row[col]\n          if (rotate && !isEncryptedPayload(rawValue)) {\n            continue\n          }\n          payload[rule.field] = rawValue\n          if (rule.hashField) {\n            const resolvedHash = resolveProperty(meta, rule.hashField)\n            const hashCol = resolvedHash?.columnName\n            if (hashCol) payload[rule.hashField] = row[hashCol]\n          }\n        }\n        if (rotate && !Object.keys(payload).length) {\n          continue\n        }\n        if (rotate && oldKms) {\n          let oldDek = oldDekCache.get(scope.tenantId) ?? null\n          if (!oldDekCache.has(scope.tenantId)) {\n            oldDek = await oldKms.getTenantDek(scope.tenantId)\n            oldDekCache.set(scope.tenantId, oldDek)\n          }\n          for (const rule of fields) {\n            const value = payload[rule.field]\n            if (typeof value !== 'string' || !isEncryptedPayload(value)) continue\n            const decrypted = decryptWithOldKey(value, oldDek)\n            if (decrypted === null) continue\n            payload[rule.field] = parseDecryptedFieldValue(decrypted)\n          }\n        }\n        const encrypted = await encryptionService.encryptEntityPayload(\n          entityId,\n          payload,\n          scope.tenantId,\n          scope.organizationId,\n        )\n        const updates: Record<string, unknown> = {}\n        for (const rule of fields) {\n          const resolved = resolveProperty(meta, rule.field)\n          const col = resolved?.columnName\n          if (!col) continue\n          const nextValue = (encrypted as any)[rule.field]\n          if (nextValue !== undefined && nextValue !== row[col]) {\n            if (!rotate && isEncryptedPayload(row[col])) continue\n            updates[col] = formatValueForColumn(resolved?.prop, nextValue)\n          }\n          if (rule.hashField) {\n            const resolvedHash = resolveProperty(meta, rule.hashField)\n            const hashCol = resolvedHash?.columnName\n            const hashValue = (encrypted as any)[rule.hashField]\n            if (hashCol && hashValue !== undefined && hashValue !== row[hashCol]) {\n              updates[hashCol] = formatValueForColumn(resolvedHash?.prop, hashValue)\n            }\n          }\n        }\n        if (!Object.keys(updates).length) continue\n        if (!dryRun) {\n          const setSql = Object.keys(updates).map((col) => `\"${col}\" = ?`).join(', ')\n          await conn.execute(\n            `update ${qualifiedTable} set ${setSql} where \"${pk}\" = ?`,\n            [...Object.values(updates), row[pk]],\n          )\n        }\n        updated += 1\n      }\n      return updated\n    }\n\n    let total = 0\n    for (const map of maps) {\n      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)\n      if (!mapMeta) continue\n      const { entityId, meta, fields, tenantId } = mapMeta\n      const scopes = await resolveScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n      for (const scope of scopes) {\n        const updated = await processScope(entityId, meta, fields, scope)\n        if (updated > 0) {\n          console.log(\n            `${dryRun ? '[dry-run] ' : ''}Encrypted ${updated} record(s) for ${entityId} org=${scope.organizationId ?? 'null'}`\n          )\n        }\n        total += updated\n      }\n    }\n\n    if (total > 0) {\n      console.log(`Encrypted ${total} record(s) across mapped entities.`)\n    } else {\n      console.log('All mapped entity fields already encrypted for the selected scope.')\n    }\n  },\n}\n\nconst decryptDatabase: ModuleCli = {\n  command: 'decrypt-database',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string) || null\n    const organizationIdArg = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n    const entityIdArg = (args.entity as string) || null\n    const checkMode = Boolean(args.check)\n    const dryRun = Boolean(args['dry-run'] || args.dry) || checkMode\n    const deactivateMaps = Boolean(args['deactivate-maps'])\n    const confirm = (args.confirm as string) || null\n    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)\n    const sleepMs = Math.max(0, parseInt(String(args['sleep-ms'] || args.sleepMs || '0'), 10) || 0)\n    const debug = Boolean(args.debug)\n\n    if (!tenantIdArg) {\n      console.error('--tenant <uuid> is required.')\n      return\n    }\n\n    if (!checkMode) {\n      if (!confirm) {\n        console.error('--confirm <tenantUuid> is required (safety gate). Pass the exact tenant UUID to confirm the operation.')\n        return\n      }\n      if (confirm !== tenantIdArg) {\n        console.error(`--confirm value \"${confirm}\" does not match --tenant \"${tenantIdArg}\". Aborting.`)\n        return\n      }\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw database connection; aborting.')\n      return\n    }\n\n    if (!checkMode && !isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Data may already be decrypted.')\n      return\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n\n    const resolveDecryptScopes = async (\n      tenantId: string,\n      organizationId: string | null,\n    ): Promise<Array<{ tenantId: string; organizationId: string | null }>> => {\n      if (organizationId) return [{ tenantId, organizationId }]\n      const rows = await conn.execute(\n        `SELECT DISTINCT organization_id FROM encryption_maps WHERE tenant_id = ? AND deleted_at IS NULL`,\n        [tenantId],\n      )\n      const orgIds = new Set<string | null>()\n      for (const row of Array.isArray(rows) ? rows : []) {\n        orgIds.add(row.organization_id ?? null)\n      }\n      orgIds.add(null)\n      return Array.from(orgIds).map((orgId) => ({ tenantId, organizationId: orgId }))\n    }\n\n    const mapWhere: any = { tenantId: tenantIdArg, deletedAt: null, isActive: true }\n    if (organizationIdArg) mapWhere.organizationId = organizationIdArg\n    if (entityIdArg) mapWhere.entityId = entityIdArg\n    const allMaps = await em.find(EncryptionMap, mapWhere)\n    const systemScopedEntityIds = getSystemScopedEntityIds()\n    const maps = allMaps.filter((map: EncryptionMap) => {\n      if (!systemScopedEntityIds.has(String(map.entityId))) return true\n      console.warn(\n        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`,\n      )\n      return false\n    })\n\n    if (!maps.length) {\n      console.log('No active encryption maps found for the selected scope.')\n      return\n    }\n\n    const kms = createKmsService()\n    const dekCache = new Map<string, TenantDek | null>()\n    const getDek = async (tenantId: string): Promise<TenantDek | null> => {\n      if (dekCache.has(tenantId)) return dekCache.get(tenantId) ?? null\n      const dek = await kms.getTenantDek(tenantId)\n      dekCache.set(tenantId, dek)\n      return dek\n    }\n\n    if (checkMode) {\n      const envValue = process.env.TENANT_DATA_ENCRYPTION ?? '(not set)'\n      console.log(`TENANT_DATA_ENCRYPTION = ${envValue}`)\n      console.log(`Active EncryptionMap records for scope: ${maps.length}`)\n      let encryptedCandidatesSampled = 0\n      let malformedPayloadCountSampled = 0\n      for (const map of maps) {\n        const mapMeta = resolveMapMeta(map, metaByEntityId)\n        if (!mapMeta) continue\n        const { entityId, meta, fields, tenantId } = mapMeta\n        const dek = await getDek(tenantId).catch(() => null)\n        if (!dek) continue\n        const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n        const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n        const tableName = meta?.tableName\n        if (!tableName) continue\n        const schema = meta?.schema\n        const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n        const fieldCols = fields.flatMap((f: any) => {\n          const r = resolveProperty(meta, f.field)\n          return r.columnName ? [r.columnName] : []\n        })\n        const colList = Array.from(new Set([pk, ...fieldCols]))\n        for (const scope of scopes) {\n          const sampleRows = await conn.execute(\n            `SELECT ${colList.map((c: string) => `\"${c}\"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? LIMIT 100`,\n            [scope.tenantId, scope.organizationId],\n          ).catch(() => [])\n          for (const row of Array.isArray(sampleRows) ? sampleRows : []) {\n            let rowHasEncrypted = false\n            for (const fieldRule of fields) {\n              const resolved = resolveProperty(meta, fieldRule.field)\n              const col = resolved?.columnName\n              if (!col) continue\n              const rawValue = row[col]\n              if (rawValue === null || rawValue === undefined) continue\n              try {\n                decryptWithAesGcmStrict(String(rawValue), dek.key)\n                rowHasEncrypted = true\n              } catch (e: any) {\n                if (e instanceof TenantDataEncryptionError && e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {\n                  malformedPayloadCountSampled++\n                }\n              }\n            }\n            if (rowHasEncrypted) encryptedCandidatesSampled++\n          }\n        }\n      }\n      console.log(`estimated encrypted candidates (sampled): ${encryptedCandidatesSampled}`)\n      if (malformedPayloadCountSampled > 0) {\n        console.warn(`\u26A0 malformed payloads (sampled): ${malformedPayloadCountSampled} \u2014 may indicate corruption`)\n      } else {\n        console.log(`malformed payloads (sampled): ${malformedPayloadCountSampled}`)\n      }\n      console.log('not a proof of absence \u2014 run full command + rerun --check to confirm')\n      return\n    }\n\n    let totalRowsFetched = 0\n    let totalRowsUpdated = 0\n    let totalHashFieldsCleared = 0\n    const totalHashFieldsSkipped = new Set<string>()\n    let totalMalformedPayloadCount = 0\n    const malformedByLocation = new Map<string, number>()\n    let totalEntitiesProcessed = 0\n\n    for (const map of maps) {\n      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)\n      if (!mapMeta) continue\n      const { entityId, meta, fields, tenantId } = mapMeta\n      const dek = await getDek(tenantId)\n      if (!dek) {\n        console.warn(`No DEK available for tenant ${tenantId}; skipping ${entityId}.`)\n        continue\n      }\n      const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const tableName = meta?.tableName\n      if (!tableName) {\n        console.warn(`Skipping ${entityId}: table name not found.`)\n        continue\n      }\n      const schema = meta?.schema\n      const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n      const fieldCols = fields.flatMap((f: any) => {\n        const r = resolveProperty(meta, f.field)\n        return r.columnName ? [r.columnName] : []\n      })\n      const colList = Array.from(new Set([pk, ...fieldCols]))\n      totalEntitiesProcessed++\n\n      const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n\n      for (const scope of scopes) {\n        let lastId: string | null = null\n        let scopeMalformedCount = 0\n\n        while (true) {\n          let selectSql = `SELECT ${colList.map((c: string) => `\"${c}\"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ?`\n          const selectParams: unknown[] = [scope.tenantId, scope.organizationId]\n          if (lastId !== null) {\n            selectSql += ` AND \"${pk}\" > ?`\n            selectParams.push(lastId)\n          }\n          selectSql += ` ORDER BY \"${pk}\" LIMIT ?`\n          selectParams.push(batchSize)\n\n          const batchRows = await conn.execute(selectSql, selectParams)\n          const batch = Array.isArray(batchRows) ? batchRows : []\n          if (!batch.length) break\n\n          lastId = String(batch[batch.length - 1]![pk])\n          totalRowsFetched += batch.length\n\n          const batchStart = Date.now()\n          await conn.execute('BEGIN')\n          let batchCommitted = false\n          try {\n            for (const row of batch) {\n              const updates: Record<string, unknown> = {}\n              let rowDecrypted = false\n\n              for (const fieldRule of fields) {\n                const resolved = resolveProperty(meta, fieldRule.field)\n                const col = resolved?.columnName\n                if (!col) continue\n                const rawValue = row[col]\n                if (rawValue === null || rawValue === undefined) continue\n                try {\n                  const decrypted = decryptWithAesGcmStrict(String(rawValue), dek.key)\n                  let valueToWrite: string\n                  try {\n                    const parsed = JSON.parse(decrypted)\n                    valueToWrite = typeof parsed === 'string' ? parsed : decrypted\n                  } catch {\n                    valueToWrite = decrypted\n                  }\n                  updates[col] = valueToWrite\n                  rowDecrypted = true\n                } catch (e: any) {\n                  if (e instanceof TenantDataEncryptionError) {\n                    if (e.code === TenantDataEncryptionErrorCode.AUTH_FAILED) {\n                      // Value is plaintext \u2014 skip silently\n                    } else if (e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {\n                      scopeMalformedCount++\n                      const locationKey = `${tableName}:${col}`\n                      malformedByLocation.set(locationKey, (malformedByLocation.get(locationKey) ?? 0) + 1)\n                      console.warn(`\u26A0 MALFORMED_PAYLOAD for ${entityId} field \"${col}\" row ${row[pk]}; skipping field.`)\n                    } else {\n                      throw e\n                    }\n                  } else {\n                    throw e\n                  }\n                }\n              }\n\n              if (rowDecrypted) {\n                for (const fieldRule of fields) {\n                  if (!fieldRule.hashField) continue\n                  const resolvedHash = resolveProperty(meta, fieldRule.hashField)\n                  const hashCol = resolvedHash?.columnName\n                  if (!hashCol) {\n                    const skippedKey = `${tableName}:${fieldRule.hashField}`\n                    if (!totalHashFieldsSkipped.has(skippedKey)) {\n                      console.warn(`\u26A0 Hash column \"${fieldRule.hashField}\" not found in metadata for ${entityId}; skipping.`)\n                      totalHashFieldsSkipped.add(skippedKey)\n                    }\n                    continue\n                  }\n                  updates[hashCol] = null\n                  totalHashFieldsCleared++\n                }\n              }\n\n              if (Object.keys(updates).length > 0) {\n                if (!dryRun) {\n                  const setSql = Object.keys(updates).map((col) => `\"${col}\" = ?`).join(', ')\n                  await conn.execute(\n                    `UPDATE ${qualifiedTable} SET ${setSql} WHERE \"${pk}\" = ?`,\n                    [...Object.values(updates), row[pk]],\n                  )\n                }\n                totalRowsUpdated++\n              }\n            }\n            await conn.execute('COMMIT')\n            batchCommitted = true\n          } catch (fatalErr: any) {\n            if (!batchCommitted) {\n              try { await conn.execute('ROLLBACK') } catch {}\n            }\n            console.error(`Fatal error during batch processing for ${entityId}: ${(fatalErr as Error)?.message || String(fatalErr)}`)\n            throw fatalErr\n          }\n\n          const batchDurationMs = Date.now() - batchStart\n          if (debug) {\n            console.log(\n              `[debug] Batch ${entityId} org=${scope.organizationId ?? 'null'}: ${batch.length} rows in ${batchDurationMs}ms, scopeMalformed=${scopeMalformedCount}`,\n            )\n            if (batchDurationMs > 30_000) {\n              console.warn('\u26A0 Batch took >30s; consider reducing --batch-size.')\n            }\n          }\n          if (sleepMs > 0) {\n            await new Promise<void>((r) => setTimeout(r, sleepMs))\n          }\n        }\n\n        totalMalformedPayloadCount += scopeMalformedCount\n      }\n    }\n\n    if (deactivateMaps && !dryRun) {\n      let deactivateSql = `UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND deleted_at IS NULL`\n      const deactivateParams: unknown[] = [tenantIdArg]\n      if (organizationIdArg) {\n        deactivateSql += ` AND (organization_id = ? OR organization_id IS NULL)`\n        deactivateParams.push(organizationIdArg)\n      }\n      if (entityIdArg) {\n        deactivateSql += ` AND entity_id = ?`\n        deactivateParams.push(entityIdArg)\n      }\n      await conn.execute(deactivateSql, deactivateParams)\n      console.warn('\u26A0 Restart all application replicas \u2014 in-process map caches may still be active.')\n      if (isTenantDataEncryptionEnabled()) {\n        console.warn('\u26A0 Env TENANT_DATA_ENCRYPTION is still true \u2014 new writes will be re-encrypted until env is updated and replicas restarted.')\n      }\n    }\n\n    if (deactivateMaps && dryRun) {\n      console.log(`[dry-run] Would deactivate ${maps.length} EncryptionMap record(s).`)\n    }\n\n    const prefix = dryRun ? '[dry-run] ' : ''\n    console.log(`\\n${prefix}Decryption summary:`)\n    console.log(`  Rows fetched:        ${totalRowsFetched}`)\n    console.log(`  Rows updated:        ${totalRowsUpdated}`)\n    console.log(`  Entities processed:  ${totalEntitiesProcessed}`)\n    console.log(`  Hash fields cleared: ${totalHashFieldsCleared}`)\n    if (totalHashFieldsSkipped.size > 0) {\n      console.log(`  Hash fields skipped (missing columns): ${Array.from(totalHashFieldsSkipped).join(', ')}`)\n    }\n    if (totalMalformedPayloadCount > 0) {\n      console.warn(\n        `  \u26A0 ${totalMalformedPayloadCount} field value(s) returned MALFORMED_PAYLOAD and were skipped; these may be corrupted ciphertexts. Investigate before assuming decryption is complete.`,\n      )\n      if (debug && malformedByLocation.size > 0) {\n        const top = Array.from(malformedByLocation.entries())\n          .sort((a, b) => b[1] - a[1])\n          .slice(0, 10)\n        console.log('  Top malformed locations:')\n        for (const [loc, count] of top) {\n          console.log(`    ${loc}: ${count}`)\n        }\n      }\n    }\n\n    if (!dryRun) {\n      console.log(`\\n\u2705 Decryption complete. Required next steps:`)\n      console.log(`   1. Set TENANT_DATA_ENCRYPTION=false in your environment / secrets`)\n      console.log(`   2. Restart all application replicas`)\n      console.log(`   3. Run: mercato query_index reindex --tenant ${tenantIdArg}  \u2190 run after env flip + restart; search/filter degraded until this completes`)\n      console.log(`   4. Run: mercato entities decrypt-database --tenant ${tenantIdArg} --check  to confirm no encrypted values remain`)\n      console.log(`   NOTE: if the run was long and concurrent inserts occurred, run again before step 4 \u2014 it is idempotent.`)\n    }\n  },\n}\n\n/**\n * Encrypt rows that a **system-scoped** encryption map covers but that were written\n * before the map existed.\n *\n * `rotate-encryption-key` cannot reach them: it walks the `encryption_maps` table and\n * skips every row without a `tenant_id`, while system-scoped maps are declared in module\n * code (`defaultEncryptionMaps` with `keyScope: 'system'`) and cover pre-tenant records\n * that have no tenant at all \u2014 onboarding requests being the first such entity. Without a\n * backfill those historical rows stay plaintext forever, since only the write path\n * encrypts.\n *\n * The command is forward-only (plaintext \u2192 ciphertext), never accepts an old key and never\n * decrypts, so it cannot re-encrypt data under the wrong key. It is idempotent: values that\n * already decrypt under the current system DEK are left untouched by\n * `encryptEntityPayload`, so a partial run can simply be repeated.\n */\nconst backfillSystemEncryption: ModuleCli = {\n  command: 'backfill-system-encryption',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const entityIdArg = (args.entity as string) || null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)\n    const debug = Boolean(args.debug)\n\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.')\n      return\n    }\n\n    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === 'system')\n    if (!systemMaps.length) {\n      console.log('No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.')\n      return\n    }\n    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps\n    if (!selectedMaps.length) {\n      console.error(`No system-scoped encryption map declared for entity \"${entityIdArg}\".`)\n      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(', ')}`)\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw database connection; aborting.')\n      return\n    }\n\n    const encryptionService = new TenantDataEncryptionService(em as any, {\n      kms: createKmsService(),\n      defaultEncryptionMaps: systemMaps,\n    })\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.')\n      return\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n    const prefix = dryRun ? '[dry-run] ' : ''\n    let totalRowsScanned = 0\n    let totalRowsUpdated = 0\n    let totalRowsUnchanged = 0\n\n    for (const map of selectedMaps) {\n      const entityId = map.entityId\n      const meta = metaByEntityId.get(entityId)\n      if (!meta) {\n        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`)\n        continue\n      }\n      const tableName = meta?.tableName\n      if (!tableName) {\n        console.warn(`Skipping ${entityId}: entity has no table name.`)\n        continue\n      }\n      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey)\n      const pkColumn = primaryKeyColumn ?? primaryKey\n      const qualifiedTable = meta?.schema ? `\"${meta.schema}\".\"${tableName}\"` : `\"${tableName}\"`\n\n      const columns = new Set<string>([pkColumn])\n      for (const rule of map.fields) {\n        const resolved = resolveProperty(meta, rule.field)\n        if (resolved.columnName) columns.add(resolved.columnName)\n        if (rule.hashField) {\n          const resolvedHash = resolveProperty(meta, rule.hashField)\n          if (resolvedHash.columnName) columns.add(resolvedHash.columnName)\n        }\n      }\n      const columnList = Array.from(columns)\n      const selectList = columnList.map((column) => `\"${column}\"`).join(', ')\n\n      let cursor: unknown = null\n      let entityRowsScanned = 0\n      let entityRowsUpdated = 0\n      let entityRowsUnchanged = 0\n\n      for (;;) {\n        const selectSql = cursor === null\n          ? `select ${selectList} from ${qualifiedTable} order by \"${pkColumn}\" asc limit ?`\n          : `select ${selectList} from ${qualifiedTable} where \"${pkColumn}\" > ? order by \"${pkColumn}\" asc limit ?`\n        const params = cursor === null ? [batchSize] : [cursor, batchSize]\n        const rows = await conn.execute(selectSql, params)\n        const list = Array.isArray(rows) ? rows : []\n        if (!list.length) break\n\n        for (const row of list) {\n          entityRowsScanned += 1\n          cursor = row[pkColumn]\n          const payload: Record<string, unknown> = {}\n          let hasPlaintext = false\n          for (const rule of map.fields) {\n            const resolved = resolveProperty(meta, rule.field)\n            if (!resolved.columnName) continue\n            const rawValue = row[resolved.columnName]\n            payload[rule.field] = rawValue\n            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true\n            if (rule.hashField) {\n              const resolvedHash = resolveProperty(meta, rule.hashField)\n              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]\n            }\n          }\n          if (!hasPlaintext) continue\n\n          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null)\n          const updates: Record<string, unknown> = {}\n          for (const rule of map.fields) {\n            const resolved = resolveProperty(meta, rule.field)\n            if (resolved.columnName) {\n              const nextValue = encrypted[rule.field]\n              if (nextValue !== undefined && nextValue !== row[resolved.columnName]) {\n                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue)\n              }\n            }\n            if (rule.hashField) {\n              const resolvedHash = resolveProperty(meta, rule.hashField)\n              const nextHash = encrypted[rule.hashField]\n              if (resolvedHash.columnName && nextHash !== undefined && nextHash !== row[resolvedHash.columnName]) {\n                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash)\n              }\n            }\n          }\n          if (!Object.keys(updates).length) {\n            entityRowsUnchanged += 1\n            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`)\n            continue\n          }\n          if (!dryRun) {\n            const setSql = Object.keys(updates).map((column) => `\"${column}\" = ?`).join(', ')\n            await conn.execute(\n              `update ${qualifiedTable} set ${setSql} where \"${pkColumn}\" = ?`,\n              [...Object.values(updates), row[pkColumn]],\n            )\n          }\n          entityRowsUpdated += 1\n        }\n\n        if (list.length < batchSize) break\n      }\n\n      totalRowsScanned += entityRowsScanned\n      totalRowsUpdated += entityRowsUpdated\n      totalRowsUnchanged += entityRowsUnchanged\n      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`)\n    }\n\n    console.log(`\\n${prefix}Backfill summary:`)\n    console.log(`  Rows scanned:   ${totalRowsScanned}`)\n    console.log(`  Rows encrypted: ${totalRowsUpdated}`)\n    if (totalRowsUnchanged > 0) {\n      console.warn(\n        `  \u26A0 ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted \u2014 the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`,\n      )\n    }\n    if (!dryRun && totalRowsUpdated > 0) {\n      console.log('\\n\u2705 Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.')\n    }\n  },\n}\n\n// Keep default export stable (install first for help listing)\nexport default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption]\n"],
-  "mappings": "AAAA,SAAS,eAAe,gCAA6D;AAErF,SAAS,8BAA8B;AAEvC,SAAS,cAAc,gBAAgB,qBAAqB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,OAAO,cAAc;AACrB,SAAS,SAAS,OAAO,UAAU,cAAc;AACjD,SAAS,qCAAqC;AAC9C,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,wBAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,OAAO,YAAY;AAEnB,SAAS,UAAU,MAAgB;AACjC,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,IAAI,GAAG;AACtB,YAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AAC7C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,eACtB,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AAAE,aAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAAI;AAAA,MAAI,MACjF,MAAK,CAAC,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK;AACrD,UAAM,aAAa,QAAQ,KAAK,MAAM;AACtC,UAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAC/C,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,gBAAgB,KAAK,WAAW,IAAI,QAAQ;AAElD,QAAI,cAAc,kBAAkB,OAAO;AACzC,cAAQ,MAAM,2CAA2C;AACzD;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,QAA8B;AAClC,QAAI;AAAE,cAAQ,QAAQ,OAAO;AAAA,IAAmB,QAAQ;AAAA,IAAC;AAEzD,UAAM,YAAY,cACd,CAAC,WAAW,IACX,aAAa,CAAC,IAAI;AAEvB,UAAM,SAAS,CAAC,YAAoB;AAClC,YAAM,SAAS,MAAM,eAAe;AACpC,cAAQ,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,IACnC;AAEA,UAAM,SAAS,MAAM,iCAAiC,IAAI,OAAO;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,MAAM,YAAY;AAChC,YAAQ,IAAI,UAAK,KAAK,wBAAwB,OAAO,SAAS,aAAa,OAAO,YAAY,mBAAmB,OAAO,YAAY,aAAa,OAAO,OAAO,EAAE;AAAA,EACnK;AACF;AAGA,MAAM,gBAA2B;AAAA,EAC/B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK;AACrD,UAAM,aAAa,QAAQ,KAAK,MAAM;AACtC,UAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAC/C,UAAM,gBAAgB,aAAa,OAAQ,KAAK,WAAW,IAAI,QAAQ;AAEvE,QAAI,cAAc,kBAAkB,OAAO;AACzC,cAAQ,MAAM,2CAA2C;AACzD;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,QAA8B;AAClC,QAAI;AAAE,cAAQ,QAAQ,OAAO;AAAA,IAAmB,QAAQ;AAAA,IAAC;AAEzD,UAAM,YAAY,cACd,CAAC,WAAW,IACX,aAAa,CAAC,IAAI;AAEvB,UAAM,aAAa,iCAAiC;AACpD,UAAM,WAAW,WAAW,OAAO,CAAC,UAAW,aAAa,MAAM,MAAM,WAAW,OAAO,IAAK;AAC/F,QAAI,CAAC,SAAS,QAAQ;AACpB,cAAQ,IAAI,gEAAgE;AAC5E;AAAA,IACF;AACA,UAAM,YAAY,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC,CAAC;AAC7E,QAAI,CAAC,UAAU,QAAQ;AACrB,cAAQ,IAAI,iDAAiD;AAC7D;AAAA,IACF;AAEA,UAAM,SAAS,CAAC,YAAoB;AAClC,YAAM,SAAS,MAAM,eAAe;AACpC,cAAQ,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,KAAK;AACP,cAAQ,IAAI,4EAA4E;AAAA,IAC1F,OAAO;AACL,YAAM,aAAkB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE;AACvD,UAAI,cAAc,QAAW;AAC3B,YAAI,UAAU,WAAW,EAAG,YAAW,WAAW;AAAA,YAC7C,YAAW,WAAW,EAAE,KAAK,UAAU;AAAA,MAC9C;AACA,YAAM,gBAAgB,MAAM,GAAG,aAAa,gBAAgB,UAAU;AAEtE,YAAM,cAAmB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE;AACxD,UAAI,cAAc,QAAW;AAC3B,YAAI,UAAU,WAAW,EAAG,aAAY,WAAW;AAAA,YAC9C,aAAY,WAAW,EAAE,KAAK,UAAU;AAAA,MAC/C;AACA,YAAM,kBAAkB,MAAM,GAAG,aAAa,cAAc,WAAW;AAEvE,UAAI,SAAS,UAAU,QAAQ;AAC7B,YAAI;AACF,gBAAM,MAAM,aAAa,UAAU,IAAI,CAAC,OAAO,iBAAiB,EAAE,EAAE,CAAC;AAAA,QACvE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,cAAQ,IAAI,+BAA+B,aAAa,cAAc,eAAe,EAAE;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,iCAAiC,IAAI,OAAO;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,MAAM,YAAY;AAChC,YAAQ,IAAI,UAAK,KAAK,wBAAwB,OAAO,SAAS,aAAa,OAAO,YAAY,mBAAmB,OAAO,YAAY,aAAa,OAAO,OAAO,EAAE;AAAA,EACnK;AACF;AAGA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,OAAO,CAAC;AACrD,UAAM,MAAM,OAAO,GAAW,MAAe;AAC3C,YAAM,KAAK,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,KAAK;AACnE,aAAO,MAAM,KAAK;AAAA,IACpB;AACA,UAAM,UAAU,OAAO,GAAW,IAAI,UAAU;AAC9C,YAAM,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,YAAY;AACpD,aAAO,kBAAkB,CAAC,MAAM;AAAA,IAClC;AAEA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,YAAM,KAAK,QAAQ,IAAI;AAEvB,YAAM,WAAY,KAAK,UAAsB,KAAK,KAAgB,MAAM,IAAI,gCAAgC;AAC5G,YAAM,WAAW,KAAK,SAAS,OAAO,MAAM,QAAQ,6BAA6B,KAAK;AACtF,YAAM,QAAQ,WAAW,OAAS,KAAK,OAAmB,KAAK,kBAA6B,MAAM,IAAI,iBAAiB;AACvH,YAAM,WAAW,WAAW,OAAS,KAAK,UAAsB,KAAK,YAAuB,MAAM,IAAI,WAAW;AACjH,YAAM,MAAO,KAAK,OAAkB,MAAM,IAAI,wBAAwB;AACtE,UAAI,OAAQ,KAAK,QAAmB,MAAM,IAAI,mFAAmF,MAAM;AACvI,aAAO,KAAK,YAAY;AACxB,UAAI,CAAC,CAAC,QAAO,aAAY,WAAU,SAAQ,WAAU,UAAS,YAAW,YAAW,YAAY,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,cAAc;AAChJ,YAAM,QAAS,KAAK,SAAqB,MAAM,IAAI,SAAS,GAAG;AAC/D,YAAM,cAAe,KAAK,eAA0B;AACpD,YAAM,WAAW,KAAK,aAAa,SAAY,QAAQ,KAAK,QAAQ,IAAI,MAAM,QAAQ,aAAa,KAAK;AACxG,YAAM,QAAQ,KAAK,UAAU,SAAY,QAAQ,KAAK,KAAK,IAAI,MAAM,QAAQ,mBAAmB,KAAK;AACrG,UAAI;AACJ,UAAI,SAAS,UAAU;AACrB,cAAM,MAAO,KAAK,WAAsB,MAAM,IAAI,6BAA6B,iBAAiB;AAChG,kBAAU,wBAAwB,GAAG;AAAA,MACvC;AACA,UAAI,eAAoB;AACxB,YAAM,SAAU,KAAK,WAAuB,KAAK;AACjD,YAAM,cAAc,WAAW,SAAY,SAAS,MAAM,IAAI,wCAAwC,EAAE;AACxG,UAAI,gBAAgB,IAAI;AACtB,gBAAQ,MAAM;AAAA,UACZ,KAAK;AAAW,2BAAe,OAAO,WAAW;AAAG;AAAA,UACpD,KAAK;AAAS,2BAAe,OAAO,WAAW;AAAG;AAAA,UAClD,KAAK;AAAW,2BAAe,kBAAkB,OAAO,WAAW,CAAC,MAAM;AAAM;AAAA,UAChF;AAAS,2BAAe,OAAO,WAAW;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,aAAa,KAAK,eAAe,SAAY,QAAQ,KAAK,UAAU,IAAI,MAAM,QAAQ,eAAe,IAAI;AAC/G,YAAM,cAAc,KAAK,gBAAgB,SAAY,QAAQ,KAAK,WAAW,IAAI,MAAM,QAAQ,oBAAoB,IAAI;AACvH,YAAM,eAAe,KAAK,iBAAiB,SAAY,QAAQ,KAAK,YAAY,IAAI,MAAM,QAAQ,sBAAsB,IAAI;AAC5H,YAAM,UAAU,KAAK,YAAY,SAAY,QAAQ,KAAK,OAAO,IAAI,MAAM,QAAQ,YAAY,KAAK;AAEpG,YAAM,QAAQ,EAAE,UAAU,gBAAgB,OAAO,UAAoB,IAAI;AACzE,YAAM,WAAW,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AACvD,YAAM,aAAkB,CAAC;AACzB,UAAI,QAAS,YAAW,UAAU;AAClC,UAAI,iBAAiB,OAAW,YAAW,eAAe;AAC1D,UAAI,aAAa,OAAW,YAAW,WAAW;AAClD,UAAI,UAAU,OAAW,YAAW,QAAQ;AAC5C,UAAI,eAAe,OAAW,YAAW,aAAa;AACtD,UAAI,YAAY,OAAW,YAAW,UAAU;AAChD,UAAI,gBAAgB,OAAW,YAAW,cAAc;AACxD,UAAI,iBAAiB,OAAW,YAAW,eAAe;AAC1D,UAAI,UAAU,OAAW,YAAW,QAAQ;AAC5C,UAAI,gBAAgB,OAAW,YAAW,cAAc;AAExD,UAAI,CAAC,UAAU;AACb,cAAM,GAAG,QAAQ,GAAG,OAAO,gBAAgB;AAAA,UACzC;AAAA,UACA,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QACZ,CAAC,CAAC,EAAE,MAAM;AACV,gBAAQ,IAAI,yBAAyB,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,OAAO,cAAc,SAAS,KAAK,YAAY,QAAQ,GAAG,EAAE;AAAA,MACxI,OAAO;AACL,iBAAS,OAAO;AAChB,iBAAS,aAAa;AACtB,iBAAS,WAAW;AACpB,cAAM,GAAG,MAAM;AACf,gBAAQ,IAAI,yBAAyB,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,OAAO,cAAc,SAAS,KAAK,YAAY,QAAQ,GAAG,EAAE;AAAA,MACxI;AAAA,IACF,SAAS,GAAQ;AACf,cAAQ,MAAM,WAAW,GAAG,WAAW,CAAC;AAAA,IAC1C,UAAE;AACA,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAEA,SAAS,8BAAwC;AAC/C,QAAM,aAAa,cAAc;AACjC,MAAI,WAAW,SAAS,EAAG,QAAO;AAClC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAUA,SAAS,2BAAwC;AAC/C,SAAO,IAAI;AAAA,IACT,yBAAyB,4BAA4B,CAAC,EACnD,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ,EACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ;AAAA,EAC9B;AACF;AAKA,eAAsB,yBACpB,IACA,UACA,gBACA,OACA,SAAgC,MAAM;AAAC,GACvC;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,aAAa,UAAU;AAC9B,aAAO,YAAY,KAAK,QAAQ,0EAA0E;AAC1G;AAAA,IACF;AACA,UAAM,WAAW,MAAM,GAAG,QAAQ,eAAe;AAAA,MAC/C,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,eAAS,aAAa,KAAK;AAC3B,eAAS,WAAW;AACpB,eAAS,YAAY,oBAAI,KAAK;AAC9B,aAAO,wCAAiC,KAAK,QAAQ,SAAI;AACzD,YAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AACjC;AAAA,IACF;AACA,UAAM,MAAM,GAAG,OAAO,eAAe;AAAA,MACnC,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,WAAO,8BAA8B,KAAK,QAAQ,EAAE;AAAA,EACtD;AACF;AAEA,eAAe,qBAAqB,IAAS,UAAkB,gBAA+B,QAA+B;AAC3H,QAAM,yBAAyB,IAAI,UAAU,gBAAgB,yBAAyB,4BAA4B,CAAC,GAAG,MAAM;AAC9H;AAEA,MAAM,qBAAgC;AAAA,EACpC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,WAAY,KAAK,UAAsB,KAAK;AAClD,UAAM,iBAAkB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AAEnH,QAAI,CAAC,UAAU;AACb,cAAQ,MAAM,6CAA6C;AAC3D;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,KAAK,sEAAsE;AACnF;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,SAAS,CAAC,QAAgB,QAAQ,IAAI,GAAG;AAC/C,UAAM,qBAAqB,IAAI,UAAU,gBAAgB,MAAM;AAC/D,YAAQ,IAAI,+BAA0B;AAAA,EACxC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAEA,MAAM,qBAA2C;AAAA,EAE/C,YAAY,QAAgB;AAC1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,MAAM,CAAC,EAAE,OAAO;AAAA,EACnF;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEA,SAAS,eAAe,KAAsC;AAC5D,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E;AAEA,SAAS,kBACP,SACA,KACe;AACf,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,kBAAkB,SAAS,IAAI,GAAG;AAC3C;AAEA,SAAS,gBAAgB,MAAW,OAAgE;AAClG,MAAI,CAAC,MAAM,WAAY,QAAO,EAAE,YAAY,MAAM,MAAM,KAAK;AAC7D,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAAA,IACpD,MAAM,QAAQ,YAAY,KAAK,EAAE,YAAY;AAAA,EAC/C;AACA,aAAW,aAAa,YAAY;AAClC,UAAM,OAAO,KAAK,WAAW,SAAS;AACtC,UAAM,YACJ,MAAM,cACL,MAAM,QAAQ,MAAM,UAAU,KAAK,KAAK,WAAW,SAAS,KAAK,WAAW,CAAC,IAAI;AACpF,QAAI,OAAO,cAAc,YAAY,UAAU,OAAQ,QAAO,EAAE,YAAY,WAAW,KAAK;AAC5F,QAAI,MAAM,KAAM,QAAO,EAAE,YAAY,KAAK,MAAM,KAAK;AAAA,EACvD;AACA,SAAO,EAAE,YAAY,MAAM,MAAM,KAAK;AACxC;AAEA,SAAS,wBAAwB,IAA2B;AAC1D,QAAM,UAAU,mBAAmB,EAAE;AACrC,QAAM,iBAAiB,oBAAI,IAAiB;AAC5C,aAAW,QAAQ,SAAS;AAC1B,UAAM,WAAW,4BAA4B,IAAI;AACjD,QAAI,SAAU,gBAAe,IAAI,UAAU,IAAI;AAAA,EACjD;AACA,SAAO;AACT;AASA,SAAS,eACP,KACA,gBACA,OAA8B,MAAM;AAAC,GACX;AAC1B,QAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,MAAI,CAAC,MAAM;AACT,SAAK,YAAY,QAAQ,uBAAuB;AAChD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC;AACjE,MAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,QAAM,WAAW,IAAI,WAAW,OAAO,IAAI,QAAQ,IAAI;AACvD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,EAAE,UAAU,MAAM,QAAQ,SAAS;AAC5C;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEA,SAAS,qBAAqB,MAAW,OAAyB;AAChE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,QAAQ,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,cAAc,CAAC;AACrE,QAAM,OAAO,OAAO,MAAM,QAAQ,EAAE,EAAE,YAAY;AAClD,QAAM,SAAS,MAAM,KAAK,CAAC,UAAkB,MAAM,YAAY,EAAE,SAAS,MAAM,CAAC,KAAK,SAAS,UAAU,SAAS;AAClH,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,MAAM,sBAAiC;AAAA,EACrC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK,YAAuB;AAC5E,UAAM,oBAAqB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AACtH,UAAM,SAAU,KAAK,SAAS,KAAiB,KAAK,UAAqB;AACzE,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,UAAU,CAAC,aAAa;AAC1B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,+CAA+C;AAC7D;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,4CAA4C;AAC1D;AAAA,IACF;AAEA,UAAM,oBAAoB,IAAI,4BAA4B,IAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;AAChG,UAAM,SAAS,UAAU,SAAS,IAAI,qBAAqB,MAAM,IAAI;AACrE,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,wEAAwE;AACtF;AAAA,IACF;AAEA,QAAI,OAAO;AACT,cAAQ,IAAI,2BAA2B;AAAA,QACrC,WAAW,QAAQ,MAAM;AAAA,QACzB;AAAA,QACA,UAAU,eAAe;AAAA,QACzB,gBAAgB,qBAAqB;AAAA,MACvC,CAAC;AACD,UAAI,aAAa;AACf,cAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,UACzC,QAAQ,aAAa,WAAW,KAAK,QAAQ,QAAQ,IAAI;AAAA,UACzD,kBAAkB,OAAO,WAAW;AAAA,QACtC,CAAC;AACD,gBAAQ,IAAI,4CAA4C;AAAA,UACtD,QAAQ,eAAe,MAAM;AAAA,UAC7B,YAAY,eAAe,MAAM;AAAA,QACnC,CAAC;AAAA,MACH,OAAO;AACL,gBAAQ,IAAI,gEAAgE;AAAA,MAC9E;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AAEjD,UAAM,QAAa,EAAE,WAAW,KAAK;AACrC,QAAI,YAAa,OAAM,WAAW;AAClC,QAAI,kBAAmB,OAAM,iBAAiB;AAC9C,UAAM,UAAU,MAAM,GAAG,KAAK,eAAe,KAAK;AAClD,UAAM,wBAAwB,yBAAyB;AACvD,UAAM,OAAO,QAAQ,OAAO,CAAC,QAAuB;AAClD,UAAI,CAAC,sBAAsB,IAAI,OAAO,IAAI,QAAQ,CAAC,EAAG,QAAO;AAC7D,cAAQ;AAAA,QACN,YAAY,IAAI,QAAQ;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,IAAI,kDAAkD;AAC9D;AAAA,IACF;AAEA,UAAM,gBAAgB,OAAO,UAAkB,mBAAkC;AAC/E,UAAI,eAAgB,QAAO,CAAC,EAAE,UAAU,eAAe,CAAC;AACxD,YAAM,OAAO,MAAM,GAAG,KAAK,cAAc,EAAE,QAAQ,SAAS,CAAC;AAC7D,YAAM,SAAS,KAAK,IAAI,CAAC,SAAuB;AAAA,QAC9C;AAAA,QACA,gBAAgB,OAAO,IAAI,EAAE;AAAA,MAC/B,EAAE;AACF,aAAO,KAAK,EAAE,UAAU,gBAAgB,KAAK,CAAC;AAC9C,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,oBAAI,IAA8B;AACtD,UAAM,eAAe,OACnB,UACA,MACA,QACA,UACoB;AACpB,YAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,YAAM,UAAU,oBAAI,IAAY;AAChC,cAAQ,IAAI,EAAE;AACd,iBAAW,QAAQ,QAAQ;AACzB,cAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,YAAI,UAAU,WAAY,SAAQ,IAAI,SAAS,UAAU;AACzD,YAAI,KAAK,WAAW;AAClB,gBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,cAAI,cAAc,WAAY,SAAQ,IAAI,aAAa,UAAU;AAAA,QACnE;AAAA,MACF;AACA,YAAM,aAAa,MAAM,KAAK,OAAO;AACrC,UAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,UAAW,QAAO;AACvB,YAAM,SAAS,MAAM;AACrB,YAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,YAAM,YAAY,UAAU,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAC7F,YAAM,OAAO,MAAM,KAAK,QAAQ,WAAW,CAAC,MAAM,UAAU,MAAM,cAAc,CAAC;AACjF,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,UAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,UAAI,UAAU;AACd,iBAAW,OAAO,MAAM;AACtB,cAAM,UAAmC,CAAC;AAC1C,mBAAW,QAAQ,QAAQ;AACzB,gBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAM,MAAM,UAAU;AACtB,cAAI,CAAC,IAAK;AACV,gBAAM,WAAW,IAAI,GAAG;AACxB,cAAI,UAAU,CAAC,mBAAmB,QAAQ,GAAG;AAC3C;AAAA,UACF;AACA,kBAAQ,KAAK,KAAK,IAAI;AACtB,cAAI,KAAK,WAAW;AAClB,kBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAM,UAAU,cAAc;AAC9B,gBAAI,QAAS,SAAQ,KAAK,SAAS,IAAI,IAAI,OAAO;AAAA,UACpD;AAAA,QACF;AACA,YAAI,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,QAAQ;AAC1C;AAAA,QACF;AACA,YAAI,UAAU,QAAQ;AACpB,cAAI,SAAS,YAAY,IAAI,MAAM,QAAQ,KAAK;AAChD,cAAI,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG;AACpC,qBAAS,MAAM,OAAO,aAAa,MAAM,QAAQ;AACjD,wBAAY,IAAI,MAAM,UAAU,MAAM;AAAA,UACxC;AACA,qBAAW,QAAQ,QAAQ;AACzB,kBAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,gBAAI,OAAO,UAAU,YAAY,CAAC,mBAAmB,KAAK,EAAG;AAC7D,kBAAM,YAAY,kBAAkB,OAAO,MAAM;AACjD,gBAAI,cAAc,KAAM;AACxB,oBAAQ,KAAK,KAAK,IAAI,yBAAyB,SAAS;AAAA,UAC1D;AAAA,QACF;AACA,cAAM,YAAY,MAAM,kBAAkB;AAAA,UACxC;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AACA,cAAM,UAAmC,CAAC;AAC1C,mBAAW,QAAQ,QAAQ;AACzB,gBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAM,MAAM,UAAU;AACtB,cAAI,CAAC,IAAK;AACV,gBAAM,YAAa,UAAkB,KAAK,KAAK;AAC/C,cAAI,cAAc,UAAa,cAAc,IAAI,GAAG,GAAG;AACrD,gBAAI,CAAC,UAAU,mBAAmB,IAAI,GAAG,CAAC,EAAG;AAC7C,oBAAQ,GAAG,IAAI,qBAAqB,UAAU,MAAM,SAAS;AAAA,UAC/D;AACA,cAAI,KAAK,WAAW;AAClB,kBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAM,UAAU,cAAc;AAC9B,kBAAM,YAAa,UAAkB,KAAK,SAAS;AACnD,gBAAI,WAAW,cAAc,UAAa,cAAc,IAAI,OAAO,GAAG;AACpE,sBAAQ,OAAO,IAAI,qBAAqB,cAAc,MAAM,SAAS;AAAA,YACvE;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,OAAO,KAAK,OAAO,EAAE,OAAQ;AAClC,YAAI,CAAC,QAAQ;AACX,gBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI;AAC1E,gBAAM,KAAK;AAAA,YACT,UAAU,cAAc,QAAQ,MAAM,WAAW,EAAE;AAAA,YACnD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,EAAE,CAAC;AAAA,UACrC;AAAA,QACF;AACA,mBAAW;AAAA,MACb;AACA,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ;AACZ,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,eAAe,KAAK,gBAAgB,QAAQ,IAAI;AAChE,UAAI,CAAC,QAAS;AACd,YAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,YAAM,SAAS,MAAM,cAAc,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AACnG,iBAAW,SAAS,QAAQ;AAC1B,cAAM,UAAU,MAAM,aAAa,UAAU,MAAM,QAAQ,KAAK;AAChE,YAAI,UAAU,GAAG;AACf,kBAAQ;AAAA,YACN,GAAG,SAAS,eAAe,EAAE,aAAa,OAAO,kBAAkB,QAAQ,QAAQ,MAAM,kBAAkB,MAAM;AAAA,UACnH;AAAA,QACF;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,QAAQ,GAAG;AACb,cAAQ,IAAI,aAAa,KAAK,oCAAoC;AAAA,IACpE,OAAO;AACL,cAAQ,IAAI,oEAAoE;AAAA,IAClF;AAAA,EACF;AACF;AAEA,MAAM,kBAA6B;AAAA,EACjC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK,YAAuB;AAC5E,UAAM,oBAAqB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AACtH,UAAM,cAAe,KAAK,UAAqB;AAC/C,UAAM,YAAY,QAAQ,KAAK,KAAK;AACpC,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG,KAAK;AACvD,UAAM,iBAAiB,QAAQ,KAAK,iBAAiB,CAAC;AACtD,UAAM,UAAW,KAAK,WAAsB;AAC5C,UAAM,YAAY,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,GAAG,EAAE,KAAK,GAAG;AACxG,UAAM,UAAU,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,UAAU,KAAK,KAAK,WAAW,GAAG,GAAG,EAAE,KAAK,CAAC;AAC9F,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAEhC,QAAI,CAAC,aAAa;AAChB,cAAQ,MAAM,8BAA8B;AAC5C;AAAA,IACF;AAEA,QAAI,CAAC,WAAW;AACd,UAAI,CAAC,SAAS;AACZ,gBAAQ,MAAM,wGAAwG;AACtH;AAAA,MACF;AACA,UAAI,YAAY,aAAa;AAC3B,gBAAQ,MAAM,oBAAoB,OAAO,8BAA8B,WAAW,cAAc;AAChG;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,qDAAqD;AACnE;AAAA,IACF;AAEA,QAAI,CAAC,aAAa,CAAC,8BAA8B,GAAG;AAClD,cAAQ,MAAM,8EAA8E;AAC5F;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AAEjD,UAAM,uBAAuB,OAC3B,UACA,mBACwE;AACxE,UAAI,eAAgB,QAAO,CAAC,EAAE,UAAU,eAAe,CAAC;AACxD,YAAM,OAAO,MAAM,KAAK;AAAA,QACtB;AAAA,QACA,CAAC,QAAQ;AAAA,MACX;AACA,YAAM,SAAS,oBAAI,IAAmB;AACtC,iBAAW,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG;AACjD,eAAO,IAAI,IAAI,mBAAmB,IAAI;AAAA,MACxC;AACA,aAAO,IAAI,IAAI;AACf,aAAO,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,gBAAgB,MAAM,EAAE;AAAA,IAChF;AAEA,UAAM,WAAgB,EAAE,UAAU,aAAa,WAAW,MAAM,UAAU,KAAK;AAC/E,QAAI,kBAAmB,UAAS,iBAAiB;AACjD,QAAI,YAAa,UAAS,WAAW;AACrC,UAAM,UAAU,MAAM,GAAG,KAAK,eAAe,QAAQ;AACrD,UAAM,wBAAwB,yBAAyB;AACvD,UAAM,OAAO,QAAQ,OAAO,CAAC,QAAuB;AAClD,UAAI,CAAC,sBAAsB,IAAI,OAAO,IAAI,QAAQ,CAAC,EAAG,QAAO;AAC7D,cAAQ;AAAA,QACN,YAAY,IAAI,QAAQ;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,IAAI,yDAAyD;AACrE;AAAA,IACF;AAEA,UAAM,MAAM,iBAAiB;AAC7B,UAAM,WAAW,oBAAI,IAA8B;AACnD,UAAM,SAAS,OAAO,aAAgD;AACpE,UAAI,SAAS,IAAI,QAAQ,EAAG,QAAO,SAAS,IAAI,QAAQ,KAAK;AAC7D,YAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,eAAS,IAAI,UAAU,GAAG;AAC1B,aAAO;AAAA,IACT;AAEA,QAAI,WAAW;AACb,YAAM,WAAW,QAAQ,IAAI,0BAA0B;AACvD,cAAQ,IAAI,4BAA4B,QAAQ,EAAE;AAClD,cAAQ,IAAI,2CAA2C,KAAK,MAAM,EAAE;AACpE,UAAI,6BAA6B;AACjC,UAAI,+BAA+B;AACnC,iBAAW,OAAO,MAAM;AACtB,cAAM,UAAU,eAAe,KAAK,cAAc;AAClD,YAAI,CAAC,QAAS;AACd,cAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,cAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,MAAM,IAAI;AACnD,YAAI,CAAC,IAAK;AACV,cAAM,SAAS,MAAM,qBAAqB,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAC1G,cAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,cAAM,YAAY,MAAM;AACxB,YAAI,CAAC,UAAW;AAChB,cAAM,SAAS,MAAM;AACrB,cAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,cAAM,YAAY,OAAO,QAAQ,CAAC,MAAW;AAC3C,gBAAM,IAAI,gBAAgB,MAAM,EAAE,KAAK;AACvC,iBAAO,EAAE,aAAa,CAAC,EAAE,UAAU,IAAI,CAAC;AAAA,QAC1C,CAAC;AACD,cAAM,UAAU,MAAM,KAAK,oBAAI,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;AACtD,mBAAW,SAAS,QAAQ;AAC1B,gBAAM,aAAa,MAAM,KAAK;AAAA,YAC5B,UAAU,QAAQ,IAAI,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAAA,YAChF,CAAC,MAAM,UAAU,MAAM,cAAc;AAAA,UACvC,EAAE,MAAM,MAAM,CAAC,CAAC;AAChB,qBAAW,OAAO,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAC,GAAG;AAC7D,gBAAI,kBAAkB;AACtB,uBAAW,aAAa,QAAQ;AAC9B,oBAAM,WAAW,gBAAgB,MAAM,UAAU,KAAK;AACtD,oBAAM,MAAM,UAAU;AACtB,kBAAI,CAAC,IAAK;AACV,oBAAM,WAAW,IAAI,GAAG;AACxB,kBAAI,aAAa,QAAQ,aAAa,OAAW;AACjD,kBAAI;AACF,wCAAwB,OAAO,QAAQ,GAAG,IAAI,GAAG;AACjD,kCAAkB;AAAA,cACpB,SAAS,GAAQ;AACf,oBAAI,aAAa,6BAA6B,EAAE,SAAS,8BAA8B,mBAAmB;AACxG;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBAAI,gBAAiB;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,6CAA6C,0BAA0B,EAAE;AACrF,UAAI,+BAA+B,GAAG;AACpC,gBAAQ,KAAK,wCAAmC,4BAA4B,iCAA4B;AAAA,MAC1G,OAAO;AACL,gBAAQ,IAAI,iCAAiC,4BAA4B,EAAE;AAAA,MAC7E;AACA,cAAQ,IAAI,2EAAsE;AAClF;AAAA,IACF;AAEA,QAAI,mBAAmB;AACvB,QAAI,mBAAmB;AACvB,QAAI,yBAAyB;AAC7B,UAAM,yBAAyB,oBAAI,IAAY;AAC/C,QAAI,6BAA6B;AACjC,UAAM,sBAAsB,oBAAI,IAAoB;AACpD,QAAI,yBAAyB;AAE7B,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,eAAe,KAAK,gBAAgB,QAAQ,IAAI;AAChE,UAAI,CAAC,QAAS;AACd,YAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,YAAM,MAAM,MAAM,OAAO,QAAQ;AACjC,UAAI,CAAC,KAAK;AACR,gBAAQ,KAAK,+BAA+B,QAAQ,cAAc,QAAQ,GAAG;AAC7E;AAAA,MACF;AACA,YAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,WAAW;AACd,gBAAQ,KAAK,YAAY,QAAQ,yBAAyB;AAC1D;AAAA,MACF;AACA,YAAM,SAAS,MAAM;AACrB,YAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,YAAM,YAAY,OAAO,QAAQ,CAAC,MAAW;AAC3C,cAAM,IAAI,gBAAgB,MAAM,EAAE,KAAK;AACvC,eAAO,EAAE,aAAa,CAAC,EAAE,UAAU,IAAI,CAAC;AAAA,MAC1C,CAAC;AACD,YAAM,UAAU,MAAM,KAAK,oBAAI,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;AACtD;AAEA,YAAM,SAAS,MAAM,qBAAqB,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAE1G,iBAAW,SAAS,QAAQ;AAC1B,YAAI,SAAwB;AAC5B,YAAI,sBAAsB;AAE1B,eAAO,MAAM;AACX,cAAI,YAAY,UAAU,QAAQ,IAAI,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAChG,gBAAM,eAA0B,CAAC,MAAM,UAAU,MAAM,cAAc;AACrE,cAAI,WAAW,MAAM;AACnB,yBAAa,SAAS,EAAE;AACxB,yBAAa,KAAK,MAAM;AAAA,UAC1B;AACA,uBAAa,cAAc,EAAE;AAC7B,uBAAa,KAAK,SAAS;AAE3B,gBAAM,YAAY,MAAM,KAAK,QAAQ,WAAW,YAAY;AAC5D,gBAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;AACtD,cAAI,CAAC,MAAM,OAAQ;AAEnB,mBAAS,OAAO,MAAM,MAAM,SAAS,CAAC,EAAG,EAAE,CAAC;AAC5C,8BAAoB,MAAM;AAE1B,gBAAM,aAAa,KAAK,IAAI;AAC5B,gBAAM,KAAK,QAAQ,OAAO;AAC1B,cAAI,iBAAiB;AACrB,cAAI;AACF,uBAAW,OAAO,OAAO;AACvB,oBAAM,UAAmC,CAAC;AAC1C,kBAAI,eAAe;AAEnB,yBAAW,aAAa,QAAQ;AAC9B,sBAAM,WAAW,gBAAgB,MAAM,UAAU,KAAK;AACtD,sBAAM,MAAM,UAAU;AACtB,oBAAI,CAAC,IAAK;AACV,sBAAM,WAAW,IAAI,GAAG;AACxB,oBAAI,aAAa,QAAQ,aAAa,OAAW;AACjD,oBAAI;AACF,wBAAM,YAAY,wBAAwB,OAAO,QAAQ,GAAG,IAAI,GAAG;AACnE,sBAAI;AACJ,sBAAI;AACF,0BAAM,SAAS,KAAK,MAAM,SAAS;AACnC,mCAAe,OAAO,WAAW,WAAW,SAAS;AAAA,kBACvD,QAAQ;AACN,mCAAe;AAAA,kBACjB;AACA,0BAAQ,GAAG,IAAI;AACf,iCAAe;AAAA,gBACjB,SAAS,GAAQ;AACf,sBAAI,aAAa,2BAA2B;AAC1C,wBAAI,EAAE,SAAS,8BAA8B,aAAa;AAAA,oBAE1D,WAAW,EAAE,SAAS,8BAA8B,mBAAmB;AACrE;AACA,4BAAM,cAAc,GAAG,SAAS,IAAI,GAAG;AACvC,0CAAoB,IAAI,cAAc,oBAAoB,IAAI,WAAW,KAAK,KAAK,CAAC;AACpF,8BAAQ,KAAK,gCAA2B,QAAQ,WAAW,GAAG,SAAS,IAAI,EAAE,CAAC,mBAAmB;AAAA,oBACnG,OAAO;AACL,4BAAM;AAAA,oBACR;AAAA,kBACF,OAAO;AACL,0BAAM;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,cAAc;AAChB,2BAAW,aAAa,QAAQ;AAC9B,sBAAI,CAAC,UAAU,UAAW;AAC1B,wBAAM,eAAe,gBAAgB,MAAM,UAAU,SAAS;AAC9D,wBAAM,UAAU,cAAc;AAC9B,sBAAI,CAAC,SAAS;AACZ,0BAAM,aAAa,GAAG,SAAS,IAAI,UAAU,SAAS;AACtD,wBAAI,CAAC,uBAAuB,IAAI,UAAU,GAAG;AAC3C,8BAAQ,KAAK,uBAAkB,UAAU,SAAS,+BAA+B,QAAQ,aAAa;AACtG,6CAAuB,IAAI,UAAU;AAAA,oBACvC;AACA;AAAA,kBACF;AACA,0BAAQ,OAAO,IAAI;AACnB;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,oBAAI,CAAC,QAAQ;AACX,wBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI;AAC1E,wBAAM,KAAK;AAAA,oBACT,UAAU,cAAc,QAAQ,MAAM,WAAW,EAAE;AAAA,oBACnD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,EAAE,CAAC;AAAA,kBACrC;AAAA,gBACF;AACA;AAAA,cACF;AAAA,YACF;AACA,kBAAM,KAAK,QAAQ,QAAQ;AAC3B,6BAAiB;AAAA,UACnB,SAAS,UAAe;AACtB,gBAAI,CAAC,gBAAgB;AACnB,kBAAI;AAAE,sBAAM,KAAK,QAAQ,UAAU;AAAA,cAAE,QAAQ;AAAA,cAAC;AAAA,YAChD;AACA,oBAAQ,MAAM,2CAA2C,QAAQ,KAAM,UAAoB,WAAW,OAAO,QAAQ,CAAC,EAAE;AACxH,kBAAM;AAAA,UACR;AAEA,gBAAM,kBAAkB,KAAK,IAAI,IAAI;AACrC,cAAI,OAAO;AACT,oBAAQ;AAAA,cACN,iBAAiB,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,KAAK,MAAM,MAAM,YAAY,eAAe,sBAAsB,mBAAmB;AAAA,YACtJ;AACA,gBAAI,kBAAkB,KAAQ;AAC5B,sBAAQ,KAAK,yDAAoD;AAAA,YACnE;AAAA,UACF;AACA,cAAI,UAAU,GAAG;AACf,kBAAM,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAAA,UACvD;AAAA,QACF;AAEA,sCAA8B;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,kBAAkB,CAAC,QAAQ;AAC7B,UAAI,gBAAgB;AACpB,YAAM,mBAA8B,CAAC,WAAW;AAChD,UAAI,mBAAmB;AACrB,yBAAiB;AACjB,yBAAiB,KAAK,iBAAiB;AAAA,MACzC;AACA,UAAI,aAAa;AACf,yBAAiB;AACjB,yBAAiB,KAAK,WAAW;AAAA,MACnC;AACA,YAAM,KAAK,QAAQ,eAAe,gBAAgB;AAClD,cAAQ,KAAK,2FAAiF;AAC9F,UAAI,8BAA8B,GAAG;AACnC,gBAAQ,KAAK,qIAA2H;AAAA,MAC1I;AAAA,IACF;AAEA,QAAI,kBAAkB,QAAQ;AAC5B,cAAQ,IAAI,8BAA8B,KAAK,MAAM,2BAA2B;AAAA,IAClF;AAEA,UAAM,SAAS,SAAS,eAAe;AACvC,YAAQ,IAAI;AAAA,EAAK,MAAM,qBAAqB;AAC5C,YAAQ,IAAI,0BAA0B,gBAAgB,EAAE;AACxD,YAAQ,IAAI,0BAA0B,gBAAgB,EAAE;AACxD,YAAQ,IAAI,0BAA0B,sBAAsB,EAAE;AAC9D,YAAQ,IAAI,0BAA0B,sBAAsB,EAAE;AAC9D,QAAI,uBAAuB,OAAO,GAAG;AACnC,cAAQ,IAAI,4CAA4C,MAAM,KAAK,sBAAsB,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,IACzG;AACA,QAAI,6BAA6B,GAAG;AAClC,cAAQ;AAAA,QACN,YAAO,0BAA0B;AAAA,MACnC;AACA,UAAI,SAAS,oBAAoB,OAAO,GAAG;AACzC,cAAM,MAAM,MAAM,KAAK,oBAAoB,QAAQ,CAAC,EACjD,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAC1B,MAAM,GAAG,EAAE;AACd,gBAAQ,IAAI,4BAA4B;AACxC,mBAAW,CAAC,KAAK,KAAK,KAAK,KAAK;AAC9B,kBAAQ,IAAI,OAAO,GAAG,KAAK,KAAK,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI;AAAA,iDAA+C;AAC3D,cAAQ,IAAI,sEAAsE;AAClF,cAAQ,IAAI,wCAAwC;AACpD,cAAQ,IAAI,mDAAmD,WAAW,oFAA+E;AACzJ,cAAQ,IAAI,yDAAyD,WAAW,iDAAiD;AACjI,cAAQ,IAAI,gHAA2G;AAAA,IACzH;AAAA,EACF;AACF;AAkBA,MAAM,2BAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAqB;AAC/C,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,YAAY,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,GAAG,EAAE,KAAK,GAAG;AACxG,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAEhC,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,qFAAqF;AACnG;AAAA,IACF;AAEA,UAAM,aAAa,yBAAyB,4BAA4B,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ;AACpH,QAAI,CAAC,WAAW,QAAQ;AACtB,cAAQ,IAAI,8FAA8F;AAC1G;AAAA,IACF;AACA,UAAM,eAAe,cAAc,WAAW,OAAO,CAAC,QAAQ,IAAI,aAAa,WAAW,IAAI;AAC9F,QAAI,CAAC,aAAa,QAAQ;AACxB,cAAQ,MAAM,wDAAwD,WAAW,IAAI;AACrF,cAAQ,MAAM,iCAAiC,WAAW,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,EAAE;AACjG;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,qDAAqD;AACnE;AAAA,IACF;AAEA,UAAM,oBAAoB,IAAI,4BAA4B,IAAW;AAAA,MACnE,KAAK,iBAAiB;AAAA,MACtB,uBAAuB;AAAA,IACzB,CAAC;AACD,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,uFAAuF;AACrG;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AACjD,UAAM,SAAS,SAAS,eAAe;AACvC,QAAI,mBAAmB;AACvB,QAAI,mBAAmB;AACvB,QAAI,qBAAqB;AAEzB,eAAW,OAAO,cAAc;AAC9B,YAAM,WAAW,IAAI;AACrB,YAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,UAAI,CAAC,MAAM;AACT,gBAAQ,KAAK,YAAY,QAAQ,8DAA8D;AAC/F;AAAA,MACF;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,WAAW;AACd,gBAAQ,KAAK,YAAY,QAAQ,6BAA6B;AAC9D;AAAA,MACF;AACA,YAAM,aAAa,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AACvG,YAAM,EAAE,YAAY,iBAAiB,IAAI,gBAAgB,MAAM,UAAU;AACzE,YAAM,WAAW,oBAAoB;AACrC,YAAM,iBAAiB,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAEvF,YAAM,UAAU,oBAAI,IAAY,CAAC,QAAQ,CAAC;AAC1C,iBAAW,QAAQ,IAAI,QAAQ;AAC7B,cAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,YAAI,SAAS,WAAY,SAAQ,IAAI,SAAS,UAAU;AACxD,YAAI,KAAK,WAAW;AAClB,gBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,cAAI,aAAa,WAAY,SAAQ,IAAI,aAAa,UAAU;AAAA,QAClE;AAAA,MACF;AACA,YAAM,aAAa,MAAM,KAAK,OAAO;AACrC,YAAM,aAAa,WAAW,IAAI,CAAC,WAAW,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AAEtE,UAAI,SAAkB;AACtB,UAAI,oBAAoB;AACxB,UAAI,oBAAoB;AACxB,UAAI,sBAAsB;AAE1B,iBAAS;AACP,cAAM,YAAY,WAAW,OACzB,UAAU,UAAU,SAAS,cAAc,cAAc,QAAQ,kBACjE,UAAU,UAAU,SAAS,cAAc,WAAW,QAAQ,mBAAmB,QAAQ;AAC7F,cAAM,SAAS,WAAW,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ,SAAS;AACjE,cAAM,OAAO,MAAM,KAAK,QAAQ,WAAW,MAAM;AACjD,cAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,YAAI,CAAC,KAAK,OAAQ;AAElB,mBAAW,OAAO,MAAM;AACtB,+BAAqB;AACrB,mBAAS,IAAI,QAAQ;AACrB,gBAAM,UAAmC,CAAC;AAC1C,cAAI,eAAe;AACnB,qBAAW,QAAQ,IAAI,QAAQ;AAC7B,kBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAI,CAAC,SAAS,WAAY;AAC1B,kBAAM,WAAW,IAAI,SAAS,UAAU;AACxC,oBAAQ,KAAK,KAAK,IAAI;AACtB,gBAAI,aAAa,QAAQ,aAAa,UAAa,CAAC,mBAAmB,QAAQ,EAAG,gBAAe;AACjG,gBAAI,KAAK,WAAW;AAClB,oBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAI,aAAa,WAAY,SAAQ,KAAK,SAAS,IAAI,IAAI,aAAa,UAAU;AAAA,YACpF;AAAA,UACF;AACA,cAAI,CAAC,aAAc;AAEnB,gBAAM,YAAY,MAAM,kBAAkB,qBAAqB,UAAU,SAAS,MAAM,IAAI;AAC5F,gBAAM,UAAmC,CAAC;AAC1C,qBAAW,QAAQ,IAAI,QAAQ;AAC7B,kBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAI,SAAS,YAAY;AACvB,oBAAM,YAAY,UAAU,KAAK,KAAK;AACtC,kBAAI,cAAc,UAAa,cAAc,IAAI,SAAS,UAAU,GAAG;AACrE,wBAAQ,SAAS,UAAU,IAAI,qBAAqB,SAAS,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF;AACA,gBAAI,KAAK,WAAW;AAClB,oBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,oBAAM,WAAW,UAAU,KAAK,SAAS;AACzC,kBAAI,aAAa,cAAc,aAAa,UAAa,aAAa,IAAI,aAAa,UAAU,GAAG;AAClG,wBAAQ,aAAa,UAAU,IAAI,qBAAqB,aAAa,MAAM,QAAQ;AAAA,cACrF;AAAA,YACF;AAAA,UACF;AACA,cAAI,CAAC,OAAO,KAAK,OAAO,EAAE,QAAQ;AAChC,mCAAuB;AACvB,gBAAI,MAAO,SAAQ,KAAK,gCAAgC,QAAQ,IAAI,OAAO,IAAI,QAAQ,CAAC,CAAC,4BAA4B;AACrH;AAAA,UACF;AACA,cAAI,CAAC,QAAQ;AACX,kBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,OAAO,EAAE,KAAK,IAAI;AAChF,kBAAM,KAAK;AAAA,cACT,UAAU,cAAc,QAAQ,MAAM,WAAW,QAAQ;AAAA,cACzD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,QAAQ,CAAC;AAAA,YAC3C;AAAA,UACF;AACA,+BAAqB;AAAA,QACvB;AAEA,YAAI,KAAK,SAAS,UAAW;AAAA,MAC/B;AAEA,0BAAoB;AACpB,0BAAoB;AACpB,4BAAsB;AACtB,cAAQ,IAAI,GAAG,MAAM,GAAG,QAAQ,aAAa,iBAAiB,eAAe,iBAAiB,EAAE;AAAA,IAClG;AAEA,YAAQ,IAAI;AAAA,EAAK,MAAM,mBAAmB;AAC1C,YAAQ,IAAI,qBAAqB,gBAAgB,EAAE;AACnD,YAAQ,IAAI,qBAAqB,gBAAgB,EAAE;AACnD,QAAI,qBAAqB,GAAG;AAC1B,cAAQ;AAAA,QACN,YAAO,kBAAkB;AAAA,MAC3B;AAAA,IACF;AACA,QAAI,CAAC,UAAU,mBAAmB,GAAG;AACnC,cAAQ,IAAI,wFAAmF;AAAA,IACjG;AAAA,EACF;AACF;AAGA,IAAO,cAAQ,CAAC,UAAU,eAAe,UAAU,oBAAoB,qBAAqB,iBAAiB,wBAAwB;",
+  "sourcesContent": ["import { getCliModules, getDefaultEncryptionMaps, type Module, type ModuleCli } from '@open-mercato/shared/modules/registry'\nimport type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryption'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CacheStrategy } from '@open-mercato/cache/types'\nimport { CustomEntity, CustomFieldDef, EncryptionMap } from './data/entities'\nimport {\n  installCustomEntitiesFromModules,\n  getAggregatedCustomEntityConfigs,\n} from './lib/install-from-ce'\nimport readline from 'node:readline/promises'\nimport { stdin as input, stdout as output } from 'node:process'\nimport { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport { createKmsService, type KmsService, type TenantDek } from '@open-mercato/shared/lib/encryption/kms'\nimport {\n  decryptWithAesGcm,\n  decryptWithAesGcmStrict,\n  TenantDataEncryptionError,\n  TenantDataEncryptionErrorCode,\n} from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  TenantDataEncryptionService,\n  parseDecryptedFieldValue,\n  resolveEncryptionKeyId,\n} from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'\nimport { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'\nimport { Organization } from '../directory/data/entities'\nimport crypto from 'node:crypto'\n\nfunction parseArgs(rest: string[]) {\n  const args: Record<string, string | boolean> = {}\n  for (let i = 0; i < rest.length; i++) {\n    const a = rest[i]\n    if (!a) continue\n    if (a.startsWith('--')) {\n      const [k, v] = a.replace(/^--/, '').split('=')\n      if (v !== undefined) args[k] = v\n      else if (rest[i + 1] && !rest[i + 1]!.startsWith('--')) { args[k] = rest[i + 1]!; i++ }\n      else args[k] = true\n    }\n  }\n  return args\n}\n\nconst seedDefs: ModuleCli = {\n  command: 'install',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string)\n    const globalOnly = Boolean(args.global)\n    const dry = Boolean(args['dry-run'] || args.dry)\n    const force = Boolean(args.force)\n    const includeGlobal = args['no-global'] ? false : true\n\n    if (globalOnly && includeGlobal === false) {\n      console.error('Cannot combine --global with --no-global.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    let cache: CacheStrategy | null = null\n    try { cache = resolve('cache') as CacheStrategy } catch {}\n\n    const tenantIds = tenantIdArg\n      ? [tenantIdArg]\n      : (globalOnly ? [] : undefined)\n\n    const logger = (message: string) => {\n      const prefix = dry ? '[dry-run] ' : ''\n      console.log(`${prefix}${message}`)\n    }\n\n    const result = await installCustomEntitiesFromModules(em, cache, {\n      tenantIds,\n      includeGlobal,\n      dryRun: dry,\n      force,\n      logger,\n    })\n    const label = dry ? 'Dry-run' : 'Sync'\n    console.log(`\u2705 ${label} complete: processed=${result.processed}, updated=${result.synchronized}, fieldsChanged=${result.fieldChanges}, skipped=${result.skipped}`)\n  },\n}\n\n// Reinstall: remove existing definitions for target scope and re-seed from modules\nconst reinstallDefs: ModuleCli = {\n  command: 'reinstall',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string)\n    const globalOnly = Boolean(args.global)\n    const dry = Boolean(args['dry-run'] || args.dry)\n    const includeGlobal = globalOnly ? true : (args['no-global'] ? false : true)\n\n    if (globalOnly && includeGlobal === false) {\n      console.error('Cannot combine --global with --no-global.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    let cache: CacheStrategy | null = null\n    try { cache = resolve('cache') as CacheStrategy } catch {}\n\n    const tenantIds = tenantIdArg\n      ? [tenantIdArg]\n      : (globalOnly ? [] : undefined)\n\n    const aggregates = getAggregatedCustomEntityConfigs()\n    const relevant = aggregates.filter((entry) => (globalOnly ? entry.spec?.global === true : true))\n    if (!relevant.length) {\n      console.log('No custom entities or fields discovered. Nothing to reinstall.')\n      return\n    }\n    const entityIds = Array.from(new Set(relevant.map((entry) => entry.entityId)))\n    if (!entityIds.length) {\n      console.log('No entity ids discovered. Nothing to reinstall.')\n      return\n    }\n\n    const logger = (message: string) => {\n      const prefix = dry ? '[dry-run] ' : ''\n      console.log(`${prefix}${message}`)\n    }\n\n    if (dry) {\n      console.log('Dry-run: would remove existing custom entity definitions before reinstall.')\n    } else {\n      const fieldWhere: any = { entityId: { $in: entityIds } }\n      if (tenantIds !== undefined) {\n        if (tenantIds.length === 0) fieldWhere.tenantId = null\n        else fieldWhere.tenantId = { $in: tenantIds }\n      }\n      const removedFields = await em.nativeDelete(CustomFieldDef, fieldWhere)\n\n      const entityWhere: any = { entityId: { $in: entityIds } }\n      if (tenantIds !== undefined) {\n        if (tenantIds.length === 0) entityWhere.tenantId = null\n        else entityWhere.tenantId = { $in: tenantIds }\n      }\n      const removedEntities = await em.nativeDelete(CustomEntity, entityWhere)\n\n      if (cache && entityIds.length) {\n        try {\n          await cache.deleteByTags(entityIds.map((id) => `custom-entity:${id}`))\n        } catch {}\n      }\n      console.log(`Cleared definitions: fields=${removedFields}, entities=${removedEntities}`)\n    }\n\n    const result = await installCustomEntitiesFromModules(em, cache, {\n      tenantIds,\n      includeGlobal,\n      dryRun: dry,\n      force: true,\n      logger,\n    })\n    const label = dry ? 'Dry-run' : 'Reinstall'\n    console.log(`\u2705 ${label} complete: processed=${result.processed}, updated=${result.synchronized}, fieldsChanged=${result.fieldChanges}, skipped=${result.skipped}`)\n  },\n}\n\n// Interactive: add a single custom field definition\nconst addField: ModuleCli = {\n  command: 'add-field',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const rl = readline.createInterface({ input, output })\n    const ask = async (q: string, d?: string) => {\n      const a = (await rl.question(d ? `${q} [${d}]: ` : `${q}: `)).trim()\n      return a || (d ?? '')\n    }\n    const askBool = async (q: string, d = false) => {\n      const a = (await ask(q, d ? 'y' : 'n')).toLowerCase()\n      return parseBooleanToken(a) === true\n    }\n\n    try {\n      const { resolve } = await createRequestContainer()\n      const em = resolve('em') as any\n\n      const entityId = (args.entity as string) || (args.e as string) || await ask('Entity ID (e.g., example:todo)')\n      const isGlobal = args.global ? true : await askBool('Global (no organization)?', false)\n      const orgId = isGlobal ? null : ((args.org as string) || (args.organizationId as string) || await ask('Organization ID'))\n      const tenantId = isGlobal ? null : ((args.tenant as string) || (args.tenantId as string) || await ask('Tenant ID'))\n      const key = (args.key as string) || await ask('Field key (snake_case)')\n      let kind = (args.kind as string) || await ask(\"Kind (text|multiline|integer|float|boolean|select|currency|relation|attachment)\", 'text')\n      kind = kind.toLowerCase()\n      if (!['text','multiline','integer','float','boolean','select','currency','relation','attachment'].includes(kind)) throw new Error('Invalid kind')\n      const label = (args.label as string) || (await ask('Label', key))\n      const description = (args.description as string) || ''\n      const required = args.required !== undefined ? Boolean(args.required) : await askBool('Required?', false)\n      const multi = args.multi !== undefined ? Boolean(args.multi) : await askBool('Allow multiple?', false)\n      let options: string[] | undefined\n      if (kind === 'select') {\n        const raw = (args.options as string) || await ask('Options (comma-separated)', 'low,medium,high')\n        options = parseCommaSeparatedList(raw)\n      }\n      let defaultValue: any = undefined\n      const defRaw = (args.default as string) ?? (args.defaultValue as string)\n      const needDefault = defRaw !== undefined ? defRaw : await ask('Default value (leave empty for none)', '')\n      if (needDefault !== '') {\n        switch (kind) {\n          case 'integer': defaultValue = Number(needDefault); break\n          case 'float': defaultValue = Number(needDefault); break\n          case 'boolean': defaultValue = parseBooleanToken(String(needDefault)) === true; break\n          default: defaultValue = String(needDefault)\n        }\n      }\n      const filterable = args.filterable !== undefined ? Boolean(args.filterable) : await askBool('Filterable?', true)\n      const listVisible = args.listVisible !== undefined ? Boolean(args.listVisible) : await askBool('Visible in list?', true)\n      const formEditable = args.formEditable !== undefined ? Boolean(args.formEditable) : await askBool('Editable in forms?', true)\n      const indexed = args.indexed !== undefined ? Boolean(args.indexed) : await askBool('Indexed?', false)\n\n      const where = { entityId, organizationId: orgId, tenantId: tenantId, key }\n      const existing = await em.findOne(CustomFieldDef, where)\n      const configJson: any = {}\n      if (options) configJson.options = options\n      if (defaultValue !== undefined) configJson.defaultValue = defaultValue\n      if (required !== undefined) configJson.required = required\n      if (multi !== undefined) configJson.multi = multi\n      if (filterable !== undefined) configJson.filterable = filterable\n      if (indexed !== undefined) configJson.indexed = indexed\n      if (listVisible !== undefined) configJson.listVisible = listVisible\n      if (formEditable !== undefined) configJson.formEditable = formEditable\n      if (label !== undefined) configJson.label = label\n      if (description !== undefined) configJson.description = description\n\n      if (!existing) {\n        await em.persist(em.create(CustomFieldDef, {\n          entityId,\n          organizationId: orgId,\n          tenantId: tenantId,\n          key,\n          kind,\n          configJson,\n          isActive: true,\n        })).flush()\n        console.log(`Created custom field: ${entityId}.${key} (${kind})${orgId == null ? ' [global]' : ` [org=${orgId}, tenant=${tenantId}]`}`)\n      } else {\n        existing.kind = kind as any\n        existing.configJson = configJson\n        existing.isActive = true\n        await em.flush()\n        console.log(`Updated custom field: ${entityId}.${key} (${kind})${orgId == null ? ' [global]' : ` [org=${orgId}, tenant=${tenantId}]`}`)\n      }\n    } catch (e: any) {\n      console.error('Failed:', e?.message || e)\n    } finally {\n      await rl.close()\n    }\n  },\n}\n\nfunction resolveEncryptionMapModules(): Module[] {\n  const cliModules = getCliModules()\n  if (cliModules.length > 0) return cliModules\n  try {\n    const { getModules } = require('@open-mercato/shared/lib/modules/registry')\n    return getModules()\n  } catch {\n    return []\n  }\n}\n\n/**\n * Entity ids whose encryption map is declared in module code with `keyScope: 'system'`.\n *\n * Their ciphertext is sealed under a `system:<entityId>` DEK that has no tenant, so every\n * tenant-scoped command here MUST leave them alone: re-wrapping such a value under a tenant\n * DEK produces a payload runtime decryption can never read again. `backfill-system-encryption`\n * is the one command that handles them.\n */\nfunction getSystemScopedEntityIds(): Set<string> {\n  return new Set(\n    getDefaultEncryptionMaps(resolveEncryptionMapModules())\n      .filter((map) => map.keyScope === 'system')\n      .map((map) => map.entityId),\n  )\n}\n\n// Idempotently upsert a specific set of encryption-map specs for one (tenant, org) scope. Exported so\n// upgrade actions can backfill a newly-added encrypted entity for pre-existing tenants (whose maps were\n// seeded once at tenant creation and never re-run) without depending on the full CLI module registry.\nexport async function upsertEncryptionMapSpecs(\n  em: any,\n  tenantId: string,\n  organizationId: string | null,\n  specs: ModuleEncryptionMap[],\n  logger: (msg: string) => void = () => {},\n) {\n  for (const spec of specs) {\n    if (spec.keyScope === 'system') {\n      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)\n      continue\n    }\n    const existing = await em.findOne(EncryptionMap, {\n      entityId: spec.entityId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing) {\n      existing.fieldsJson = spec.fields\n      existing.isActive = true\n      existing.updatedAt = new Date()\n      logger(`\uD83D\uDD12 Updated encryption map for ${spec.entityId} \u2728`)\n      await em.persist(existing).flush()\n      continue\n    }\n    const map = em.create(EncryptionMap, {\n      entityId: spec.entityId,\n      tenantId,\n      organizationId,\n      fieldsJson: spec.fields,\n      isActive: true,\n    })\n    await em.persist(map).flush()\n    logger(`Created encryption map for ${spec.entityId}`)\n  }\n}\n\nasync function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {\n  await upsertEncryptionMapSpecs(em, tenantId, organizationId, getDefaultEncryptionMaps(resolveEncryptionMapModules()), logger)\n}\n\nconst seedEncryptionMaps: ModuleCli = {\n  command: 'seed-encryption',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantId = (args.tenant as string) || (args.tenantId as string)\n    const organizationId = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n\n    if (!tenantId) {\n      console.error('tenant id is required (use --tenant <uuid>)')\n      return\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.warn('TENANT_DATA_ENCRYPTION is disabled; skipping encryption map seeding.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const logger = (msg: string) => console.log(msg)\n    await upsertEncryptionMaps(em, tenantId, organizationId, logger)\n    console.log('\u2705 Encryption maps seeded')\n  },\n}\n\nfunction normalizeKeyInput(value: string): string {\n  return value.trim().replace(/(?:^['\"]|['\"]$)/g, '')\n}\n\nclass DerivedKeyKmsService implements KmsService {\n  private root: Buffer\n  constructor(secret: string) {\n    this.root = crypto.createHash('sha256').update(normalizeKeyInput(secret)).digest()\n  }\n\n  isHealthy(): boolean {\n    return true\n  }\n\n  private deriveKey(tenantId: string): string {\n    const iterations = 310_000\n    const keyLength = 32\n    const derived = crypto.pbkdf2Sync(this.root, tenantId, iterations, keyLength, 'sha512')\n    return derived.toString('base64')\n  }\n\n  async getTenantDek(tenantId: string): Promise<TenantDek | null> {\n    if (!tenantId) return null\n    return { tenantId, key: this.deriveKey(tenantId), fetchedAt: Date.now() }\n  }\n\n  async createTenantDek(tenantId: string): Promise<TenantDek | null> {\n    return this.getTenantDek(tenantId)\n  }\n}\n\nfunction fingerprintDek(dek: TenantDek | null): string | null {\n  if (!dek?.key) return null\n  return crypto.createHash('sha256').update(dek.key).digest('hex').slice(0, 12)\n}\n\nfunction decryptWithOldKey(\n  payload: string,\n  dek: TenantDek | null,\n): string | null {\n  if (!dek?.key) return null\n  return decryptWithAesGcm(payload, dek.key)\n}\n\nfunction resolveProperty(meta: any, field: string): { columnName: string | null; prop: any | null } {\n  if (!meta?.properties) return { columnName: null, prop: null }\n  const candidates = [\n    field,\n    field.replace(/_([a-z])/g, (_, c) => c.toUpperCase()),\n    field.replace(/([A-Z])/g, '_$1').toLowerCase(),\n  ]\n  for (const candidate of candidates) {\n    const prop = meta.properties[candidate]\n    const fieldName =\n      prop?.fieldName ??\n      (Array.isArray(prop?.fieldNames) && prop.fieldNames.length ? prop.fieldNames[0] : undefined)\n    if (typeof fieldName === 'string' && fieldName.length) return { columnName: fieldName, prop }\n    if (prop?.name) return { columnName: prop.name, prop }\n  }\n  return { columnName: null, prop: null }\n}\n\nfunction buildEntityMetaRegistry(em: any): Map<string, any> {\n  const allMeta = listEntityMetadata(em)\n  const metaByEntityId = new Map<string, any>()\n  for (const meta of allMeta) {\n    const resolved = resolveEntityIdFromMetadata(meta)\n    if (resolved) metaByEntityId.set(resolved, meta)\n  }\n  return metaByEntityId\n}\n\ninterface EncryptionMapMeta {\n  entityId: string\n  meta: any\n  fields: Array<{ field: string; hashField?: string | null }>\n  tenantId: string\n}\n\nfunction resolveMapMeta(\n  map: EncryptionMap,\n  metaByEntityId: Map<string, any>,\n  warn: (msg: string) => void = () => {},\n): EncryptionMapMeta | null {\n  const entityId = String(map.entityId)\n  const meta = metaByEntityId.get(entityId)\n  if (!meta) {\n    warn(`Skipping ${entityId}: metadata not found.`)\n    return null\n  }\n  const fields = Array.isArray(map.fieldsJson) ? map.fieldsJson : []\n  if (!fields.length) return null\n  const tenantId = map.tenantId ? String(map.tenantId) : null\n  if (!tenantId) return null\n  return { entityId, meta, fields, tenantId }\n}\n\nfunction isEncryptedPayload(value: unknown): boolean {\n  if (typeof value !== 'string') return false\n  const parts = value.split(':')\n  return parts.length === 4 && parts[3] === 'v1'\n}\n\nfunction formatValueForColumn(prop: any, value: unknown): unknown {\n  if (value === null || value === undefined) return value\n  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []\n  const type = String(prop?.type ?? '').toLowerCase()\n  const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'\n  if (!isJson) return value\n  return JSON.stringify(value)\n}\n\nconst rotateEncryptionKey: ModuleCli = {\n  command: 'rotate-encryption-key',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string) || null\n    const organizationIdArg = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n    const oldKey = (args['old-key'] as string) || (args.oldKey as string) || null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const debug = Boolean(args.debug)\n    const rotate = Boolean(oldKey)\n    if (rotate && !tenantIdArg) {\n      console.warn(\n        '\u26A0\uFE0F  Rotating with --old-key across all tenants. A single old key should normally target one tenant; consider --tenant.',\n      )\n    }\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw connection; aborting.')\n      return\n    }\n\n    const encryptionService = new TenantDataEncryptionService(em as any, { kms: createKmsService() })\n    const oldKms = rotate && oldKey ? new DerivedKeyKmsService(oldKey) : null\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')\n      return\n    }\n\n    if (debug) {\n      console.log('[rotate-encryption-key]', {\n        hasOldKey: Boolean(oldKey),\n        rotate,\n        tenantId: tenantIdArg ?? null,\n        organizationId: organizationIdArg ?? null,\n      })\n      if (tenantIdArg) {\n        const [oldDek, newDek] = await Promise.all([\n          oldKms?.getTenantDek(tenantIdArg) ?? Promise.resolve(null),\n          encryptionService.getDek(tenantIdArg),\n        ])\n        console.log('[rotate-encryption-key] dek fingerprints', {\n          oldKey: fingerprintDek(oldDek),\n          currentKey: fingerprintDek(newDek),\n        })\n      } else {\n        console.log('[rotate-encryption-key] dek fingerprints skipped (no tenantId)')\n      }\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n\n    const where: any = { deletedAt: null }\n    if (tenantIdArg) where.tenantId = tenantIdArg\n    if (organizationIdArg) where.organizationId = organizationIdArg\n    const allMaps = await em.find(EncryptionMap, where)\n    const systemScopedEntityIds = getSystemScopedEntityIds()\n    const maps = allMaps.filter((map: EncryptionMap) => {\n      if (!systemScopedEntityIds.has(String(map.entityId))) return true\n      console.warn(\n        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key \u2014 use \"mercato entities backfill-system-encryption\" instead.`,\n      )\n      return false\n    })\n    if (!maps.length) {\n      console.log('No encryption maps found for the selected scope.')\n      return\n    }\n\n    const resolveScopes = async (tenantId: string, organizationId: string | null) => {\n      if (organizationId) return [{ tenantId, organizationId }]\n      const orgs = await em.find(Organization, { tenant: tenantId })\n      const scopes = orgs.map((org: Organization) => ({\n        tenantId,\n        organizationId: String(org.id),\n      }))\n      scopes.push({ tenantId, organizationId: null })\n      return scopes\n    }\n\n    const oldDekCache = new Map<string, TenantDek | null>()\n    // A dry run must not provision key material. `encryptEntityPayload` creates and\n    // persists a tenant DEK in KMS/Vault the first time it runs for a tenant, so a\n    // read-only preview would silently mutate KMS state (#5950). Probe read-only\n    // once per tenant instead, and report what a real run would rewrite.\n    //\n    // The tenant id IS the key id here: this command skips every system-scoped\n    // entity above, and its service is built without `defaultEncryptionMaps`, so\n    // no map it sees can resolve to a `system:<entityId>` key.\n    const dekAvailability = new Map<string, boolean>()\n    const hasExistingDek = async (tenantId: string): Promise<boolean> => {\n      const cached = dekAvailability.get(tenantId)\n      if (cached !== undefined) return cached\n      const available = Boolean(await encryptionService.getDek(tenantId))\n      dekAvailability.set(tenantId, available)\n      if (!available) {\n        console.warn(\n          `[dry-run] Tenant ${tenantId} has no data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`,\n        )\n      }\n      return available\n    }\n    const processScope = async (\n      entityId: string,\n      meta: any,\n      fields: Array<{ field: string; hashField?: string | null }>,\n      scope: { tenantId: string; organizationId: string | null },\n    ): Promise<number> => {\n      const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const columns = new Set<string>()\n      columns.add(pk)\n      for (const rule of fields) {\n        const resolved = resolveProperty(meta, rule.field)\n        if (resolved?.columnName) columns.add(resolved.columnName)\n        if (rule.hashField) {\n          const resolvedHash = resolveProperty(meta, rule.hashField)\n          if (resolvedHash?.columnName) columns.add(resolvedHash.columnName)\n        }\n      }\n      const columnList = Array.from(columns)\n      if (!columnList.length) return 0\n      const tableName = meta?.tableName\n      if (!tableName) return 0\n      const schema = meta?.schema\n      const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n      const selectSql = `select ${columnList.map((c) => `\"${c}\"`).join(', ')} from ${qualifiedTable} where tenant_id = ? and organization_id is not distinct from ?`\n      const rows = await conn.execute(selectSql, [scope.tenantId, scope.organizationId])\n      const list = Array.isArray(rows) ? rows : []\n      if (!list.length) return 0\n      const dekAvailable = dryRun ? await hasExistingDek(scope.tenantId) : true\n      let updated = 0\n      for (const row of list) {\n        const payload: Record<string, unknown> = {}\n        for (const rule of fields) {\n          const resolved = resolveProperty(meta, rule.field)\n          const col = resolved?.columnName\n          if (!col) continue\n          const rawValue = row[col]\n          if (rotate && !isEncryptedPayload(rawValue)) {\n            continue\n          }\n          payload[rule.field] = rawValue\n          if (rule.hashField) {\n            const resolvedHash = resolveProperty(meta, rule.hashField)\n            const hashCol = resolvedHash?.columnName\n            if (hashCol) payload[rule.hashField] = row[hashCol]\n          }\n        }\n        if (rotate && !Object.keys(payload).length) {\n          continue\n        }\n        if (rotate && oldKms) {\n          let oldDek = oldDekCache.get(scope.tenantId) ?? null\n          if (!oldDekCache.has(scope.tenantId)) {\n            oldDek = await oldKms.getTenantDek(scope.tenantId)\n            oldDekCache.set(scope.tenantId, oldDek)\n          }\n          for (const rule of fields) {\n            const value = payload[rule.field]\n            if (typeof value !== 'string' || !isEncryptedPayload(value)) continue\n            const decrypted = decryptWithOldKey(value, oldDek)\n            if (decrypted === null) continue\n            payload[rule.field] = parseDecryptedFieldValue(decrypted)\n          }\n        }\n        if (!dekAvailable) {\n          // Nothing was encrypted because no key exists and this run refuses to\n          // create one. Count the rows a real run would rewrite by applying the\n          // same plaintext/ciphertext filters the update path uses below.\n          const wouldChange = fields.some((rule) => {\n            const col = resolveProperty(meta, rule.field)?.columnName\n            if (!col) return false\n            const value = row[col]\n            if (value === null || value === undefined) return false\n            return rotate ? isEncryptedPayload(value) : !isEncryptedPayload(value)\n          })\n          if (wouldChange) updated += 1\n          continue\n        }\n        const encrypted = await encryptionService.encryptEntityPayload(\n          entityId,\n          payload,\n          scope.tenantId,\n          scope.organizationId,\n          { createMissingDek: !dryRun },\n        )\n        const updates: Record<string, unknown> = {}\n        for (const rule of fields) {\n          const resolved = resolveProperty(meta, rule.field)\n          const col = resolved?.columnName\n          if (!col) continue\n          const nextValue = (encrypted as any)[rule.field]\n          if (nextValue !== undefined && nextValue !== row[col]) {\n            if (!rotate && isEncryptedPayload(row[col])) continue\n            updates[col] = formatValueForColumn(resolved?.prop, nextValue)\n          }\n          if (rule.hashField) {\n            const resolvedHash = resolveProperty(meta, rule.hashField)\n            const hashCol = resolvedHash?.columnName\n            const hashValue = (encrypted as any)[rule.hashField]\n            if (hashCol && hashValue !== undefined && hashValue !== row[hashCol]) {\n              updates[hashCol] = formatValueForColumn(resolvedHash?.prop, hashValue)\n            }\n          }\n        }\n        if (!Object.keys(updates).length) continue\n        if (!dryRun) {\n          const setSql = Object.keys(updates).map((col) => `\"${col}\" = ?`).join(', ')\n          await conn.execute(\n            `update ${qualifiedTable} set ${setSql} where \"${pk}\" = ?`,\n            [...Object.values(updates), row[pk]],\n          )\n        }\n        updated += 1\n      }\n      return updated\n    }\n\n    let total = 0\n    for (const map of maps) {\n      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)\n      if (!mapMeta) continue\n      const { entityId, meta, fields, tenantId } = mapMeta\n      const scopes = await resolveScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n      for (const scope of scopes) {\n        const updated = await processScope(entityId, meta, fields, scope)\n        if (updated > 0) {\n          console.log(\n            `${dryRun ? '[dry-run] ' : ''}Encrypted ${updated} record(s) for ${entityId} org=${scope.organizationId ?? 'null'}`\n          )\n        }\n        total += updated\n      }\n    }\n\n    if (total > 0) {\n      console.log(`Encrypted ${total} record(s) across mapped entities.`)\n    } else {\n      console.log('All mapped entity fields already encrypted for the selected scope.')\n    }\n  },\n}\n\nconst decryptDatabase: ModuleCli = {\n  command: 'decrypt-database',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const tenantIdArg = (args.tenant as string) || (args.tenantId as string) || null\n    const organizationIdArg = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null\n    const entityIdArg = (args.entity as string) || null\n    const checkMode = Boolean(args.check)\n    const dryRun = Boolean(args['dry-run'] || args.dry) || checkMode\n    const deactivateMaps = Boolean(args['deactivate-maps'])\n    const confirm = (args.confirm as string) || null\n    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)\n    const sleepMs = Math.max(0, parseInt(String(args['sleep-ms'] || args.sleepMs || '0'), 10) || 0)\n    const debug = Boolean(args.debug)\n\n    if (!tenantIdArg) {\n      console.error('--tenant <uuid> is required.')\n      return\n    }\n\n    if (!checkMode) {\n      if (!confirm) {\n        console.error('--confirm <tenantUuid> is required (safety gate). Pass the exact tenant UUID to confirm the operation.')\n        return\n      }\n      if (confirm !== tenantIdArg) {\n        console.error(`--confirm value \"${confirm}\" does not match --tenant \"${tenantIdArg}\". Aborting.`)\n        return\n      }\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw database connection; aborting.')\n      return\n    }\n\n    if (!checkMode && !isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Data may already be decrypted.')\n      return\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n\n    const resolveDecryptScopes = async (\n      tenantId: string,\n      organizationId: string | null,\n    ): Promise<Array<{ tenantId: string; organizationId: string | null }>> => {\n      if (organizationId) return [{ tenantId, organizationId }]\n      const rows = await conn.execute(\n        `SELECT DISTINCT organization_id FROM encryption_maps WHERE tenant_id = ? AND deleted_at IS NULL`,\n        [tenantId],\n      )\n      const orgIds = new Set<string | null>()\n      for (const row of Array.isArray(rows) ? rows : []) {\n        orgIds.add(row.organization_id ?? null)\n      }\n      orgIds.add(null)\n      return Array.from(orgIds).map((orgId) => ({ tenantId, organizationId: orgId }))\n    }\n\n    const mapWhere: any = { tenantId: tenantIdArg, deletedAt: null, isActive: true }\n    if (organizationIdArg) mapWhere.organizationId = organizationIdArg\n    if (entityIdArg) mapWhere.entityId = entityIdArg\n    const allMaps = await em.find(EncryptionMap, mapWhere)\n    const systemScopedEntityIds = getSystemScopedEntityIds()\n    const maps = allMaps.filter((map: EncryptionMap) => {\n      if (!systemScopedEntityIds.has(String(map.entityId))) return true\n      console.warn(\n        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`,\n      )\n      return false\n    })\n\n    if (!maps.length) {\n      console.log('No active encryption maps found for the selected scope.')\n      return\n    }\n\n    const kms = createKmsService()\n    const dekCache = new Map<string, TenantDek | null>()\n    const getDek = async (tenantId: string): Promise<TenantDek | null> => {\n      if (dekCache.has(tenantId)) return dekCache.get(tenantId) ?? null\n      const dek = await kms.getTenantDek(tenantId)\n      dekCache.set(tenantId, dek)\n      return dek\n    }\n\n    if (checkMode) {\n      const envValue = process.env.TENANT_DATA_ENCRYPTION ?? '(not set)'\n      console.log(`TENANT_DATA_ENCRYPTION = ${envValue}`)\n      console.log(`Active EncryptionMap records for scope: ${maps.length}`)\n      let encryptedCandidatesSampled = 0\n      let malformedPayloadCountSampled = 0\n      for (const map of maps) {\n        const mapMeta = resolveMapMeta(map, metaByEntityId)\n        if (!mapMeta) continue\n        const { entityId, meta, fields, tenantId } = mapMeta\n        const dek = await getDek(tenantId).catch(() => null)\n        if (!dek) continue\n        const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n        const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n        const tableName = meta?.tableName\n        if (!tableName) continue\n        const schema = meta?.schema\n        const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n        const fieldCols = fields.flatMap((f: any) => {\n          const r = resolveProperty(meta, f.field)\n          return r.columnName ? [r.columnName] : []\n        })\n        const colList = Array.from(new Set([pk, ...fieldCols]))\n        for (const scope of scopes) {\n          const sampleRows = await conn.execute(\n            `SELECT ${colList.map((c: string) => `\"${c}\"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? LIMIT 100`,\n            [scope.tenantId, scope.organizationId],\n          ).catch(() => [])\n          for (const row of Array.isArray(sampleRows) ? sampleRows : []) {\n            let rowHasEncrypted = false\n            for (const fieldRule of fields) {\n              const resolved = resolveProperty(meta, fieldRule.field)\n              const col = resolved?.columnName\n              if (!col) continue\n              const rawValue = row[col]\n              if (rawValue === null || rawValue === undefined) continue\n              try {\n                decryptWithAesGcmStrict(String(rawValue), dek.key)\n                rowHasEncrypted = true\n              } catch (e: any) {\n                if (e instanceof TenantDataEncryptionError && e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {\n                  malformedPayloadCountSampled++\n                }\n              }\n            }\n            if (rowHasEncrypted) encryptedCandidatesSampled++\n          }\n        }\n      }\n      console.log(`estimated encrypted candidates (sampled): ${encryptedCandidatesSampled}`)\n      if (malformedPayloadCountSampled > 0) {\n        console.warn(`\u26A0 malformed payloads (sampled): ${malformedPayloadCountSampled} \u2014 may indicate corruption`)\n      } else {\n        console.log(`malformed payloads (sampled): ${malformedPayloadCountSampled}`)\n      }\n      console.log('not a proof of absence \u2014 run full command + rerun --check to confirm')\n      return\n    }\n\n    let totalRowsFetched = 0\n    let totalRowsUpdated = 0\n    let totalHashFieldsCleared = 0\n    const totalHashFieldsSkipped = new Set<string>()\n    let totalMalformedPayloadCount = 0\n    const malformedByLocation = new Map<string, number>()\n    let totalEntitiesProcessed = 0\n\n    for (const map of maps) {\n      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)\n      if (!mapMeta) continue\n      const { entityId, meta, fields, tenantId } = mapMeta\n      const dek = await getDek(tenantId)\n      if (!dek) {\n        console.warn(`No DEK available for tenant ${tenantId}; skipping ${entityId}.`)\n        continue\n      }\n      const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const tableName = meta?.tableName\n      if (!tableName) {\n        console.warn(`Skipping ${entityId}: table name not found.`)\n        continue\n      }\n      const schema = meta?.schema\n      const qualifiedTable = schema ? `\"${schema}\".\"${tableName}\"` : `\"${tableName}\"`\n      const fieldCols = fields.flatMap((f: any) => {\n        const r = resolveProperty(meta, f.field)\n        return r.columnName ? [r.columnName] : []\n      })\n      const colList = Array.from(new Set([pk, ...fieldCols]))\n      totalEntitiesProcessed++\n\n      const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null)\n\n      for (const scope of scopes) {\n        let lastId: string | null = null\n        let scopeMalformedCount = 0\n\n        while (true) {\n          let selectSql = `SELECT ${colList.map((c: string) => `\"${c}\"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ?`\n          const selectParams: unknown[] = [scope.tenantId, scope.organizationId]\n          if (lastId !== null) {\n            selectSql += ` AND \"${pk}\" > ?`\n            selectParams.push(lastId)\n          }\n          selectSql += ` ORDER BY \"${pk}\" LIMIT ?`\n          selectParams.push(batchSize)\n\n          const batchRows = await conn.execute(selectSql, selectParams)\n          const batch = Array.isArray(batchRows) ? batchRows : []\n          if (!batch.length) break\n\n          lastId = String(batch[batch.length - 1]![pk])\n          totalRowsFetched += batch.length\n\n          const batchStart = Date.now()\n          await conn.execute('BEGIN')\n          let batchCommitted = false\n          try {\n            for (const row of batch) {\n              const updates: Record<string, unknown> = {}\n              let rowDecrypted = false\n\n              for (const fieldRule of fields) {\n                const resolved = resolveProperty(meta, fieldRule.field)\n                const col = resolved?.columnName\n                if (!col) continue\n                const rawValue = row[col]\n                if (rawValue === null || rawValue === undefined) continue\n                try {\n                  const decrypted = decryptWithAesGcmStrict(String(rawValue), dek.key)\n                  let valueToWrite: string\n                  try {\n                    const parsed = JSON.parse(decrypted)\n                    valueToWrite = typeof parsed === 'string' ? parsed : decrypted\n                  } catch {\n                    valueToWrite = decrypted\n                  }\n                  updates[col] = valueToWrite\n                  rowDecrypted = true\n                } catch (e: any) {\n                  if (e instanceof TenantDataEncryptionError) {\n                    if (e.code === TenantDataEncryptionErrorCode.AUTH_FAILED) {\n                      // Value is plaintext \u2014 skip silently\n                    } else if (e.code === TenantDataEncryptionErrorCode.MALFORMED_PAYLOAD) {\n                      scopeMalformedCount++\n                      const locationKey = `${tableName}:${col}`\n                      malformedByLocation.set(locationKey, (malformedByLocation.get(locationKey) ?? 0) + 1)\n                      console.warn(`\u26A0 MALFORMED_PAYLOAD for ${entityId} field \"${col}\" row ${row[pk]}; skipping field.`)\n                    } else {\n                      throw e\n                    }\n                  } else {\n                    throw e\n                  }\n                }\n              }\n\n              if (rowDecrypted) {\n                for (const fieldRule of fields) {\n                  if (!fieldRule.hashField) continue\n                  const resolvedHash = resolveProperty(meta, fieldRule.hashField)\n                  const hashCol = resolvedHash?.columnName\n                  if (!hashCol) {\n                    const skippedKey = `${tableName}:${fieldRule.hashField}`\n                    if (!totalHashFieldsSkipped.has(skippedKey)) {\n                      console.warn(`\u26A0 Hash column \"${fieldRule.hashField}\" not found in metadata for ${entityId}; skipping.`)\n                      totalHashFieldsSkipped.add(skippedKey)\n                    }\n                    continue\n                  }\n                  updates[hashCol] = null\n                  totalHashFieldsCleared++\n                }\n              }\n\n              if (Object.keys(updates).length > 0) {\n                if (!dryRun) {\n                  const setSql = Object.keys(updates).map((col) => `\"${col}\" = ?`).join(', ')\n                  await conn.execute(\n                    `UPDATE ${qualifiedTable} SET ${setSql} WHERE \"${pk}\" = ?`,\n                    [...Object.values(updates), row[pk]],\n                  )\n                }\n                totalRowsUpdated++\n              }\n            }\n            await conn.execute('COMMIT')\n            batchCommitted = true\n          } catch (fatalErr: any) {\n            if (!batchCommitted) {\n              try { await conn.execute('ROLLBACK') } catch {}\n            }\n            console.error(`Fatal error during batch processing for ${entityId}: ${(fatalErr as Error)?.message || String(fatalErr)}`)\n            throw fatalErr\n          }\n\n          const batchDurationMs = Date.now() - batchStart\n          if (debug) {\n            console.log(\n              `[debug] Batch ${entityId} org=${scope.organizationId ?? 'null'}: ${batch.length} rows in ${batchDurationMs}ms, scopeMalformed=${scopeMalformedCount}`,\n            )\n            if (batchDurationMs > 30_000) {\n              console.warn('\u26A0 Batch took >30s; consider reducing --batch-size.')\n            }\n          }\n          if (sleepMs > 0) {\n            await new Promise<void>((r) => setTimeout(r, sleepMs))\n          }\n        }\n\n        totalMalformedPayloadCount += scopeMalformedCount\n      }\n    }\n\n    if (deactivateMaps && !dryRun) {\n      let deactivateSql = `UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND deleted_at IS NULL`\n      const deactivateParams: unknown[] = [tenantIdArg]\n      if (organizationIdArg) {\n        deactivateSql += ` AND (organization_id = ? OR organization_id IS NULL)`\n        deactivateParams.push(organizationIdArg)\n      }\n      if (entityIdArg) {\n        deactivateSql += ` AND entity_id = ?`\n        deactivateParams.push(entityIdArg)\n      }\n      await conn.execute(deactivateSql, deactivateParams)\n      console.warn('\u26A0 Restart all application replicas \u2014 in-process map caches may still be active.')\n      if (isTenantDataEncryptionEnabled()) {\n        console.warn('\u26A0 Env TENANT_DATA_ENCRYPTION is still true \u2014 new writes will be re-encrypted until env is updated and replicas restarted.')\n      }\n    }\n\n    if (deactivateMaps && dryRun) {\n      console.log(`[dry-run] Would deactivate ${maps.length} EncryptionMap record(s).`)\n    }\n\n    const prefix = dryRun ? '[dry-run] ' : ''\n    console.log(`\\n${prefix}Decryption summary:`)\n    console.log(`  Rows fetched:        ${totalRowsFetched}`)\n    console.log(`  Rows updated:        ${totalRowsUpdated}`)\n    console.log(`  Entities processed:  ${totalEntitiesProcessed}`)\n    console.log(`  Hash fields cleared: ${totalHashFieldsCleared}`)\n    if (totalHashFieldsSkipped.size > 0) {\n      console.log(`  Hash fields skipped (missing columns): ${Array.from(totalHashFieldsSkipped).join(', ')}`)\n    }\n    if (totalMalformedPayloadCount > 0) {\n      console.warn(\n        `  \u26A0 ${totalMalformedPayloadCount} field value(s) returned MALFORMED_PAYLOAD and were skipped; these may be corrupted ciphertexts. Investigate before assuming decryption is complete.`,\n      )\n      if (debug && malformedByLocation.size > 0) {\n        const top = Array.from(malformedByLocation.entries())\n          .sort((a, b) => b[1] - a[1])\n          .slice(0, 10)\n        console.log('  Top malformed locations:')\n        for (const [loc, count] of top) {\n          console.log(`    ${loc}: ${count}`)\n        }\n      }\n    }\n\n    if (!dryRun) {\n      console.log(`\\n\u2705 Decryption complete. Required next steps:`)\n      console.log(`   1. Set TENANT_DATA_ENCRYPTION=false in your environment / secrets`)\n      console.log(`   2. Restart all application replicas`)\n      console.log(`   3. Run: mercato query_index reindex --tenant ${tenantIdArg}  \u2190 run after env flip + restart; search/filter degraded until this completes`)\n      console.log(`   4. Run: mercato entities decrypt-database --tenant ${tenantIdArg} --check  to confirm no encrypted values remain`)\n      console.log(`   NOTE: if the run was long and concurrent inserts occurred, run again before step 4 \u2014 it is idempotent.`)\n    }\n  },\n}\n\n/**\n * Encrypt rows that a **system-scoped** encryption map covers but that were written\n * before the map existed.\n *\n * `rotate-encryption-key` cannot reach them: it walks the `encryption_maps` table and\n * skips every row without a `tenant_id`, while system-scoped maps are declared in module\n * code (`defaultEncryptionMaps` with `keyScope: 'system'`) and cover pre-tenant records\n * that have no tenant at all \u2014 onboarding requests being the first such entity. Without a\n * backfill those historical rows stay plaintext forever, since only the write path\n * encrypts.\n *\n * The command is forward-only (plaintext \u2192 ciphertext), never accepts an old key and never\n * decrypts, so it cannot re-encrypt data under the wrong key. It is idempotent: values that\n * already decrypt under the current system DEK are left untouched by\n * `encryptEntityPayload`, so a partial run can simply be repeated.\n */\nconst backfillSystemEncryption: ModuleCli = {\n  command: 'backfill-system-encryption',\n  async run(rest) {\n    const args = parseArgs(rest)\n    const entityIdArg = (args.entity as string) || null\n    const dryRun = Boolean(args['dry-run'] || args.dry)\n    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)\n    const debug = Boolean(args.debug)\n\n    if (!isTenantDataEncryptionEnabled()) {\n      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.')\n      return\n    }\n\n    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === 'system')\n    if (!systemMaps.length) {\n      console.log('No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.')\n      return\n    }\n    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps\n    if (!selectedMaps.length) {\n      console.error(`No system-scoped encryption map declared for entity \"${entityIdArg}\".`)\n      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(', ')}`)\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve('em') as any\n    const conn: any = em?.getConnection?.()\n    if (!conn || typeof conn.execute !== 'function') {\n      console.error('Unable to access raw database connection; aborting.')\n      return\n    }\n\n    const encryptionService = new TenantDataEncryptionService(em as any, {\n      kms: createKmsService(),\n      defaultEncryptionMaps: systemMaps,\n    })\n    if (!encryptionService.isEnabled()) {\n      console.error('Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.')\n      return\n    }\n\n    const metaByEntityId = buildEntityMetaRegistry(em)\n    const prefix = dryRun ? '[dry-run] ' : ''\n    let totalRowsScanned = 0\n    let totalRowsUpdated = 0\n    let totalRowsUnchanged = 0\n\n    for (const map of selectedMaps) {\n      const entityId = map.entityId\n      const meta = metaByEntityId.get(entityId)\n      if (!meta) {\n        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`)\n        continue\n      }\n      const tableName = meta?.tableName\n      if (!tableName) {\n        console.warn(`Skipping ${entityId}: entity has no table name.`)\n        continue\n      }\n      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'\n      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey)\n      const pkColumn = primaryKeyColumn ?? primaryKey\n      const qualifiedTable = meta?.schema ? `\"${meta.schema}\".\"${tableName}\"` : `\"${tableName}\"`\n\n      const columns = new Set<string>([pkColumn])\n      for (const rule of map.fields) {\n        const resolved = resolveProperty(meta, rule.field)\n        if (resolved.columnName) columns.add(resolved.columnName)\n        if (rule.hashField) {\n          const resolvedHash = resolveProperty(meta, rule.hashField)\n          if (resolvedHash.columnName) columns.add(resolvedHash.columnName)\n        }\n      }\n      const columnList = Array.from(columns)\n      const selectList = columnList.map((column) => `\"${column}\"`).join(', ')\n\n      // Same dry-run guarantee as rotate-encryption-key: previewing must not make\n      // the KMS provision this entity's system DEK as a side effect (#5950).\n      const systemDekAvailable = dryRun\n        ? Boolean(await encryptionService.getDek(resolveEncryptionKeyId(entityId, 'system', null)))\n        : true\n      if (!systemDekAvailable) {\n        console.warn(\n          `[dry-run] ${entityId} has no system data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`,\n        )\n      }\n\n      let cursor: unknown = null\n      let entityRowsScanned = 0\n      let entityRowsUpdated = 0\n      let entityRowsUnchanged = 0\n\n      for (;;) {\n        const selectSql = cursor === null\n          ? `select ${selectList} from ${qualifiedTable} order by \"${pkColumn}\" asc limit ?`\n          : `select ${selectList} from ${qualifiedTable} where \"${pkColumn}\" > ? order by \"${pkColumn}\" asc limit ?`\n        const params = cursor === null ? [batchSize] : [cursor, batchSize]\n        const rows = await conn.execute(selectSql, params)\n        const list = Array.isArray(rows) ? rows : []\n        if (!list.length) break\n\n        for (const row of list) {\n          entityRowsScanned += 1\n          cursor = row[pkColumn]\n          const payload: Record<string, unknown> = {}\n          let hasPlaintext = false\n          for (const rule of map.fields) {\n            const resolved = resolveProperty(meta, rule.field)\n            if (!resolved.columnName) continue\n            const rawValue = row[resolved.columnName]\n            payload[rule.field] = rawValue\n            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true\n            if (rule.hashField) {\n              const resolvedHash = resolveProperty(meta, rule.hashField)\n              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]\n            }\n          }\n          if (!hasPlaintext) continue\n          if (!systemDekAvailable) {\n            // `hasPlaintext` already means a real run would rewrite this row.\n            entityRowsUpdated += 1\n            continue\n          }\n\n          const encrypted = await encryptionService.encryptEntityPayload(\n            entityId,\n            payload,\n            null,\n            null,\n            { createMissingDek: !dryRun },\n          )\n          const updates: Record<string, unknown> = {}\n          for (const rule of map.fields) {\n            const resolved = resolveProperty(meta, rule.field)\n            if (resolved.columnName) {\n              const nextValue = encrypted[rule.field]\n              if (nextValue !== undefined && nextValue !== row[resolved.columnName]) {\n                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue)\n              }\n            }\n            if (rule.hashField) {\n              const resolvedHash = resolveProperty(meta, rule.hashField)\n              const nextHash = encrypted[rule.hashField]\n              if (resolvedHash.columnName && nextHash !== undefined && nextHash !== row[resolvedHash.columnName]) {\n                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash)\n              }\n            }\n          }\n          if (!Object.keys(updates).length) {\n            entityRowsUnchanged += 1\n            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`)\n            continue\n          }\n          if (!dryRun) {\n            const setSql = Object.keys(updates).map((column) => `\"${column}\" = ?`).join(', ')\n            await conn.execute(\n              `update ${qualifiedTable} set ${setSql} where \"${pkColumn}\" = ?`,\n              [...Object.values(updates), row[pkColumn]],\n            )\n          }\n          entityRowsUpdated += 1\n        }\n\n        if (list.length < batchSize) break\n      }\n\n      totalRowsScanned += entityRowsScanned\n      totalRowsUpdated += entityRowsUpdated\n      totalRowsUnchanged += entityRowsUnchanged\n      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`)\n    }\n\n    console.log(`\\n${prefix}Backfill summary:`)\n    console.log(`  Rows scanned:   ${totalRowsScanned}`)\n    console.log(`  Rows encrypted: ${totalRowsUpdated}`)\n    if (totalRowsUnchanged > 0) {\n      console.warn(\n        `  \u26A0 ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted \u2014 the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`,\n      )\n    }\n    if (!dryRun && totalRowsUpdated > 0) {\n      console.log('\\n\u2705 Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.')\n    }\n  },\n}\n\n// Keep default export stable (install first for help listing)\nexport default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption]\n"],
+  "mappings": "AAAA,SAAS,eAAe,gCAA6D;AAErF,SAAS,8BAA8B;AAEvC,SAAS,cAAc,gBAAgB,qBAAqB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,OAAO,cAAc;AACrB,SAAS,SAAS,OAAO,UAAU,cAAc;AACjD,SAAS,qCAAqC;AAC9C,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC,SAAS,wBAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,OAAO,YAAY;AAEnB,SAAS,UAAU,MAAgB;AACjC,QAAM,OAAyC,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,WAAW,IAAI,GAAG;AACtB,YAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,GAAG;AAC7C,UAAI,MAAM,OAAW,MAAK,CAAC,IAAI;AAAA,eACtB,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EAAG,WAAW,IAAI,GAAG;AAAE,aAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAAI;AAAA,MAAI,MACjF,MAAK,CAAC,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK;AACrD,UAAM,aAAa,QAAQ,KAAK,MAAM;AACtC,UAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAC/C,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,gBAAgB,KAAK,WAAW,IAAI,QAAQ;AAElD,QAAI,cAAc,kBAAkB,OAAO;AACzC,cAAQ,MAAM,2CAA2C;AACzD;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,QAA8B;AAClC,QAAI;AAAE,cAAQ,QAAQ,OAAO;AAAA,IAAmB,QAAQ;AAAA,IAAC;AAEzD,UAAM,YAAY,cACd,CAAC,WAAW,IACX,aAAa,CAAC,IAAI;AAEvB,UAAM,SAAS,CAAC,YAAoB;AAClC,YAAM,SAAS,MAAM,eAAe;AACpC,cAAQ,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,IACnC;AAEA,UAAM,SAAS,MAAM,iCAAiC,IAAI,OAAO;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,MAAM,YAAY;AAChC,YAAQ,IAAI,UAAK,KAAK,wBAAwB,OAAO,SAAS,aAAa,OAAO,YAAY,mBAAmB,OAAO,YAAY,aAAa,OAAO,OAAO,EAAE;AAAA,EACnK;AACF;AAGA,MAAM,gBAA2B;AAAA,EAC/B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK;AACrD,UAAM,aAAa,QAAQ,KAAK,MAAM;AACtC,UAAM,MAAM,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAC/C,UAAM,gBAAgB,aAAa,OAAQ,KAAK,WAAW,IAAI,QAAQ;AAEvE,QAAI,cAAc,kBAAkB,OAAO;AACzC,cAAQ,MAAM,2CAA2C;AACzD;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,QAA8B;AAClC,QAAI;AAAE,cAAQ,QAAQ,OAAO;AAAA,IAAmB,QAAQ;AAAA,IAAC;AAEzD,UAAM,YAAY,cACd,CAAC,WAAW,IACX,aAAa,CAAC,IAAI;AAEvB,UAAM,aAAa,iCAAiC;AACpD,UAAM,WAAW,WAAW,OAAO,CAAC,UAAW,aAAa,MAAM,MAAM,WAAW,OAAO,IAAK;AAC/F,QAAI,CAAC,SAAS,QAAQ;AACpB,cAAQ,IAAI,gEAAgE;AAC5E;AAAA,IACF;AACA,UAAM,YAAY,MAAM,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC,CAAC;AAC7E,QAAI,CAAC,UAAU,QAAQ;AACrB,cAAQ,IAAI,iDAAiD;AAC7D;AAAA,IACF;AAEA,UAAM,SAAS,CAAC,YAAoB;AAClC,YAAM,SAAS,MAAM,eAAe;AACpC,cAAQ,IAAI,GAAG,MAAM,GAAG,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,KAAK;AACP,cAAQ,IAAI,4EAA4E;AAAA,IAC1F,OAAO;AACL,YAAM,aAAkB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE;AACvD,UAAI,cAAc,QAAW;AAC3B,YAAI,UAAU,WAAW,EAAG,YAAW,WAAW;AAAA,YAC7C,YAAW,WAAW,EAAE,KAAK,UAAU;AAAA,MAC9C;AACA,YAAM,gBAAgB,MAAM,GAAG,aAAa,gBAAgB,UAAU;AAEtE,YAAM,cAAmB,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE;AACxD,UAAI,cAAc,QAAW;AAC3B,YAAI,UAAU,WAAW,EAAG,aAAY,WAAW;AAAA,YAC9C,aAAY,WAAW,EAAE,KAAK,UAAU;AAAA,MAC/C;AACA,YAAM,kBAAkB,MAAM,GAAG,aAAa,cAAc,WAAW;AAEvE,UAAI,SAAS,UAAU,QAAQ;AAC7B,YAAI;AACF,gBAAM,MAAM,aAAa,UAAU,IAAI,CAAC,OAAO,iBAAiB,EAAE,EAAE,CAAC;AAAA,QACvE,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,cAAQ,IAAI,+BAA+B,aAAa,cAAc,eAAe,EAAE;AAAA,IACzF;AAEA,UAAM,SAAS,MAAM,iCAAiC,IAAI,OAAO;AAAA,MAC/D;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,MAAM,YAAY;AAChC,YAAQ,IAAI,UAAK,KAAK,wBAAwB,OAAO,SAAS,aAAa,OAAO,YAAY,mBAAmB,OAAO,YAAY,aAAa,OAAO,OAAO,EAAE;AAAA,EACnK;AACF;AAGA,MAAM,WAAsB;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,KAAK,SAAS,gBAAgB,EAAE,OAAO,OAAO,CAAC;AACrD,UAAM,MAAM,OAAO,GAAW,MAAe;AAC3C,YAAM,KAAK,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,KAAK;AACnE,aAAO,MAAM,KAAK;AAAA,IACpB;AACA,UAAM,UAAU,OAAO,GAAW,IAAI,UAAU;AAC9C,YAAM,KAAK,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,YAAY;AACpD,aAAO,kBAAkB,CAAC,MAAM;AAAA,IAClC;AAEA,QAAI;AACF,YAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,YAAM,KAAK,QAAQ,IAAI;AAEvB,YAAM,WAAY,KAAK,UAAsB,KAAK,KAAgB,MAAM,IAAI,gCAAgC;AAC5G,YAAM,WAAW,KAAK,SAAS,OAAO,MAAM,QAAQ,6BAA6B,KAAK;AACtF,YAAM,QAAQ,WAAW,OAAS,KAAK,OAAmB,KAAK,kBAA6B,MAAM,IAAI,iBAAiB;AACvH,YAAM,WAAW,WAAW,OAAS,KAAK,UAAsB,KAAK,YAAuB,MAAM,IAAI,WAAW;AACjH,YAAM,MAAO,KAAK,OAAkB,MAAM,IAAI,wBAAwB;AACtE,UAAI,OAAQ,KAAK,QAAmB,MAAM,IAAI,mFAAmF,MAAM;AACvI,aAAO,KAAK,YAAY;AACxB,UAAI,CAAC,CAAC,QAAO,aAAY,WAAU,SAAQ,WAAU,UAAS,YAAW,YAAW,YAAY,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,cAAc;AAChJ,YAAM,QAAS,KAAK,SAAqB,MAAM,IAAI,SAAS,GAAG;AAC/D,YAAM,cAAe,KAAK,eAA0B;AACpD,YAAM,WAAW,KAAK,aAAa,SAAY,QAAQ,KAAK,QAAQ,IAAI,MAAM,QAAQ,aAAa,KAAK;AACxG,YAAM,QAAQ,KAAK,UAAU,SAAY,QAAQ,KAAK,KAAK,IAAI,MAAM,QAAQ,mBAAmB,KAAK;AACrG,UAAI;AACJ,UAAI,SAAS,UAAU;AACrB,cAAM,MAAO,KAAK,WAAsB,MAAM,IAAI,6BAA6B,iBAAiB;AAChG,kBAAU,wBAAwB,GAAG;AAAA,MACvC;AACA,UAAI,eAAoB;AACxB,YAAM,SAAU,KAAK,WAAuB,KAAK;AACjD,YAAM,cAAc,WAAW,SAAY,SAAS,MAAM,IAAI,wCAAwC,EAAE;AACxG,UAAI,gBAAgB,IAAI;AACtB,gBAAQ,MAAM;AAAA,UACZ,KAAK;AAAW,2BAAe,OAAO,WAAW;AAAG;AAAA,UACpD,KAAK;AAAS,2BAAe,OAAO,WAAW;AAAG;AAAA,UAClD,KAAK;AAAW,2BAAe,kBAAkB,OAAO,WAAW,CAAC,MAAM;AAAM;AAAA,UAChF;AAAS,2BAAe,OAAO,WAAW;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,aAAa,KAAK,eAAe,SAAY,QAAQ,KAAK,UAAU,IAAI,MAAM,QAAQ,eAAe,IAAI;AAC/G,YAAM,cAAc,KAAK,gBAAgB,SAAY,QAAQ,KAAK,WAAW,IAAI,MAAM,QAAQ,oBAAoB,IAAI;AACvH,YAAM,eAAe,KAAK,iBAAiB,SAAY,QAAQ,KAAK,YAAY,IAAI,MAAM,QAAQ,sBAAsB,IAAI;AAC5H,YAAM,UAAU,KAAK,YAAY,SAAY,QAAQ,KAAK,OAAO,IAAI,MAAM,QAAQ,YAAY,KAAK;AAEpG,YAAM,QAAQ,EAAE,UAAU,gBAAgB,OAAO,UAAoB,IAAI;AACzE,YAAM,WAAW,MAAM,GAAG,QAAQ,gBAAgB,KAAK;AACvD,YAAM,aAAkB,CAAC;AACzB,UAAI,QAAS,YAAW,UAAU;AAClC,UAAI,iBAAiB,OAAW,YAAW,eAAe;AAC1D,UAAI,aAAa,OAAW,YAAW,WAAW;AAClD,UAAI,UAAU,OAAW,YAAW,QAAQ;AAC5C,UAAI,eAAe,OAAW,YAAW,aAAa;AACtD,UAAI,YAAY,OAAW,YAAW,UAAU;AAChD,UAAI,gBAAgB,OAAW,YAAW,cAAc;AACxD,UAAI,iBAAiB,OAAW,YAAW,eAAe;AAC1D,UAAI,UAAU,OAAW,YAAW,QAAQ;AAC5C,UAAI,gBAAgB,OAAW,YAAW,cAAc;AAExD,UAAI,CAAC,UAAU;AACb,cAAM,GAAG,QAAQ,GAAG,OAAO,gBAAgB;AAAA,UACzC;AAAA,UACA,gBAAgB;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QACZ,CAAC,CAAC,EAAE,MAAM;AACV,gBAAQ,IAAI,yBAAyB,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,OAAO,cAAc,SAAS,KAAK,YAAY,QAAQ,GAAG,EAAE;AAAA,MACxI,OAAO;AACL,iBAAS,OAAO;AAChB,iBAAS,aAAa;AACtB,iBAAS,WAAW;AACpB,cAAM,GAAG,MAAM;AACf,gBAAQ,IAAI,yBAAyB,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,SAAS,OAAO,cAAc,SAAS,KAAK,YAAY,QAAQ,GAAG,EAAE;AAAA,MACxI;AAAA,IACF,SAAS,GAAQ;AACf,cAAQ,MAAM,WAAW,GAAG,WAAW,CAAC;AAAA,IAC1C,UAAE;AACA,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAEA,SAAS,8BAAwC;AAC/C,QAAM,aAAa,cAAc;AACjC,MAAI,WAAW,SAAS,EAAG,QAAO;AAClC,MAAI;AACF,UAAM,EAAE,WAAW,IAAI,QAAQ,2CAA2C;AAC1E,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAUA,SAAS,2BAAwC;AAC/C,SAAO,IAAI;AAAA,IACT,yBAAyB,4BAA4B,CAAC,EACnD,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ,EACzC,IAAI,CAAC,QAAQ,IAAI,QAAQ;AAAA,EAC9B;AACF;AAKA,eAAsB,yBACpB,IACA,UACA,gBACA,OACA,SAAgC,MAAM;AAAC,GACvC;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,aAAa,UAAU;AAC9B,aAAO,YAAY,KAAK,QAAQ,0EAA0E;AAC1G;AAAA,IACF;AACA,UAAM,WAAW,MAAM,GAAG,QAAQ,eAAe;AAAA,MAC/C,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,eAAS,aAAa,KAAK;AAC3B,eAAS,WAAW;AACpB,eAAS,YAAY,oBAAI,KAAK;AAC9B,aAAO,wCAAiC,KAAK,QAAQ,SAAI;AACzD,YAAM,GAAG,QAAQ,QAAQ,EAAE,MAAM;AACjC;AAAA,IACF;AACA,UAAM,MAAM,GAAG,OAAO,eAAe;AAAA,MACnC,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,WAAO,8BAA8B,KAAK,QAAQ,EAAE;AAAA,EACtD;AACF;AAEA,eAAe,qBAAqB,IAAS,UAAkB,gBAA+B,QAA+B;AAC3H,QAAM,yBAAyB,IAAI,UAAU,gBAAgB,yBAAyB,4BAA4B,CAAC,GAAG,MAAM;AAC9H;AAEA,MAAM,qBAAgC;AAAA,EACpC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,WAAY,KAAK,UAAsB,KAAK;AAClD,UAAM,iBAAkB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AAEnH,QAAI,CAAC,UAAU;AACb,cAAQ,MAAM,6CAA6C;AAC3D;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,KAAK,sEAAsE;AACnF;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,SAAS,CAAC,QAAgB,QAAQ,IAAI,GAAG;AAC/C,UAAM,qBAAqB,IAAI,UAAU,gBAAgB,MAAM;AAC/D,YAAQ,IAAI,+BAA0B;AAAA,EACxC;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,MAAM,KAAK,EAAE,QAAQ,oBAAoB,EAAE;AACpD;AAEA,MAAM,qBAA2C;AAAA,EAE/C,YAAY,QAAgB;AAC1B,SAAK,OAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,kBAAkB,MAAM,CAAC,EAAE,OAAO;AAAA,EACnF;AAAA,EAEA,YAAqB;AACnB,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,UAA0B;AAC1C,UAAM,aAAa;AACnB,UAAM,YAAY;AAClB,UAAM,UAAU,OAAO,WAAW,KAAK,MAAM,UAAU,YAAY,WAAW,QAAQ;AACtF,WAAO,QAAQ,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,UAA6C;AAC9D,QAAI,CAAC,SAAU,QAAO;AACtB,WAAO,EAAE,UAAU,KAAK,KAAK,UAAU,QAAQ,GAAG,WAAW,KAAK,IAAI,EAAE;AAAA,EAC1E;AAAA,EAEA,MAAM,gBAAgB,UAA6C;AACjE,WAAO,KAAK,aAAa,QAAQ;AAAA,EACnC;AACF;AAEA,SAAS,eAAe,KAAsC;AAC5D,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAC9E;AAEA,SAAS,kBACP,SACA,KACe;AACf,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,SAAO,kBAAkB,SAAS,IAAI,GAAG;AAC3C;AAEA,SAAS,gBAAgB,MAAW,OAAgE;AAClG,MAAI,CAAC,MAAM,WAAY,QAAO,EAAE,YAAY,MAAM,MAAM,KAAK;AAC7D,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ,aAAa,CAAC,GAAG,MAAM,EAAE,YAAY,CAAC;AAAA,IACpD,MAAM,QAAQ,YAAY,KAAK,EAAE,YAAY;AAAA,EAC/C;AACA,aAAW,aAAa,YAAY;AAClC,UAAM,OAAO,KAAK,WAAW,SAAS;AACtC,UAAM,YACJ,MAAM,cACL,MAAM,QAAQ,MAAM,UAAU,KAAK,KAAK,WAAW,SAAS,KAAK,WAAW,CAAC,IAAI;AACpF,QAAI,OAAO,cAAc,YAAY,UAAU,OAAQ,QAAO,EAAE,YAAY,WAAW,KAAK;AAC5F,QAAI,MAAM,KAAM,QAAO,EAAE,YAAY,KAAK,MAAM,KAAK;AAAA,EACvD;AACA,SAAO,EAAE,YAAY,MAAM,MAAM,KAAK;AACxC;AAEA,SAAS,wBAAwB,IAA2B;AAC1D,QAAM,UAAU,mBAAmB,EAAE;AACrC,QAAM,iBAAiB,oBAAI,IAAiB;AAC5C,aAAW,QAAQ,SAAS;AAC1B,UAAM,WAAW,4BAA4B,IAAI;AACjD,QAAI,SAAU,gBAAe,IAAI,UAAU,IAAI;AAAA,EACjD;AACA,SAAO;AACT;AASA,SAAS,eACP,KACA,gBACA,OAA8B,MAAM;AAAC,GACX;AAC1B,QAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,MAAI,CAAC,MAAM;AACT,SAAK,YAAY,QAAQ,uBAAuB;AAChD,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,IAAI,IAAI,aAAa,CAAC;AACjE,MAAI,CAAC,OAAO,OAAQ,QAAO;AAC3B,QAAM,WAAW,IAAI,WAAW,OAAO,IAAI,QAAQ,IAAI;AACvD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,EAAE,UAAU,MAAM,QAAQ,SAAS;AAC5C;AAEA,SAAS,mBAAmB,OAAyB;AACnD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,SAAO,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM;AAC5C;AAEA,SAAS,qBAAqB,MAAW,OAAyB;AAChE,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,QAAQ,MAAM,QAAQ,MAAM,WAAW,IAAI,KAAK,cAAc,CAAC;AACrE,QAAM,OAAO,OAAO,MAAM,QAAQ,EAAE,EAAE,YAAY;AAClD,QAAM,SAAS,MAAM,KAAK,CAAC,UAAkB,MAAM,YAAY,EAAE,SAAS,MAAM,CAAC,KAAK,SAAS,UAAU,SAAS;AAClH,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,MAAM,sBAAiC;AAAA,EACrC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK,YAAuB;AAC5E,UAAM,oBAAqB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AACtH,UAAM,SAAU,KAAK,SAAS,KAAiB,KAAK,UAAqB;AACzE,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,UAAU,CAAC,aAAa;AAC1B,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,+CAA+C;AAC7D;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,4CAA4C;AAC1D;AAAA,IACF;AAEA,UAAM,oBAAoB,IAAI,4BAA4B,IAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;AAChG,UAAM,SAAS,UAAU,SAAS,IAAI,qBAAqB,MAAM,IAAI;AACrE,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,wEAAwE;AACtF;AAAA,IACF;AAEA,QAAI,OAAO;AACT,cAAQ,IAAI,2BAA2B;AAAA,QACrC,WAAW,QAAQ,MAAM;AAAA,QACzB;AAAA,QACA,UAAU,eAAe;AAAA,QACzB,gBAAgB,qBAAqB;AAAA,MACvC,CAAC;AACD,UAAI,aAAa;AACf,cAAM,CAAC,QAAQ,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,UACzC,QAAQ,aAAa,WAAW,KAAK,QAAQ,QAAQ,IAAI;AAAA,UACzD,kBAAkB,OAAO,WAAW;AAAA,QACtC,CAAC;AACD,gBAAQ,IAAI,4CAA4C;AAAA,UACtD,QAAQ,eAAe,MAAM;AAAA,UAC7B,YAAY,eAAe,MAAM;AAAA,QACnC,CAAC;AAAA,MACH,OAAO;AACL,gBAAQ,IAAI,gEAAgE;AAAA,MAC9E;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AAEjD,UAAM,QAAa,EAAE,WAAW,KAAK;AACrC,QAAI,YAAa,OAAM,WAAW;AAClC,QAAI,kBAAmB,OAAM,iBAAiB;AAC9C,UAAM,UAAU,MAAM,GAAG,KAAK,eAAe,KAAK;AAClD,UAAM,wBAAwB,yBAAyB;AACvD,UAAM,OAAO,QAAQ,OAAO,CAAC,QAAuB;AAClD,UAAI,CAAC,sBAAsB,IAAI,OAAO,IAAI,QAAQ,CAAC,EAAG,QAAO;AAC7D,cAAQ;AAAA,QACN,YAAY,IAAI,QAAQ;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,IAAI,kDAAkD;AAC9D;AAAA,IACF;AAEA,UAAM,gBAAgB,OAAO,UAAkB,mBAAkC;AAC/E,UAAI,eAAgB,QAAO,CAAC,EAAE,UAAU,eAAe,CAAC;AACxD,YAAM,OAAO,MAAM,GAAG,KAAK,cAAc,EAAE,QAAQ,SAAS,CAAC;AAC7D,YAAM,SAAS,KAAK,IAAI,CAAC,SAAuB;AAAA,QAC9C;AAAA,QACA,gBAAgB,OAAO,IAAI,EAAE;AAAA,MAC/B,EAAE;AACF,aAAO,KAAK,EAAE,UAAU,gBAAgB,KAAK,CAAC;AAC9C,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,oBAAI,IAA8B;AAStD,UAAM,kBAAkB,oBAAI,IAAqB;AACjD,UAAM,iBAAiB,OAAO,aAAuC;AACnE,YAAM,SAAS,gBAAgB,IAAI,QAAQ;AAC3C,UAAI,WAAW,OAAW,QAAO;AACjC,YAAM,YAAY,QAAQ,MAAM,kBAAkB,OAAO,QAAQ,CAAC;AAClE,sBAAgB,IAAI,UAAU,SAAS;AACvC,UAAI,CAAC,WAAW;AACd,gBAAQ;AAAA,UACN,oBAAoB,QAAQ;AAAA,QAC9B;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,UAAM,eAAe,OACnB,UACA,MACA,QACA,UACoB;AACpB,YAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,YAAM,UAAU,oBAAI,IAAY;AAChC,cAAQ,IAAI,EAAE;AACd,iBAAW,QAAQ,QAAQ;AACzB,cAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,YAAI,UAAU,WAAY,SAAQ,IAAI,SAAS,UAAU;AACzD,YAAI,KAAK,WAAW;AAClB,gBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,cAAI,cAAc,WAAY,SAAQ,IAAI,aAAa,UAAU;AAAA,QACnE;AAAA,MACF;AACA,YAAM,aAAa,MAAM,KAAK,OAAO;AACrC,UAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,UAAW,QAAO;AACvB,YAAM,SAAS,MAAM;AACrB,YAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,YAAM,YAAY,UAAU,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAC7F,YAAM,OAAO,MAAM,KAAK,QAAQ,WAAW,CAAC,MAAM,UAAU,MAAM,cAAc,CAAC;AACjF,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,UAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,YAAM,eAAe,SAAS,MAAM,eAAe,MAAM,QAAQ,IAAI;AACrE,UAAI,UAAU;AACd,iBAAW,OAAO,MAAM;AACtB,cAAM,UAAmC,CAAC;AAC1C,mBAAW,QAAQ,QAAQ;AACzB,gBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAM,MAAM,UAAU;AACtB,cAAI,CAAC,IAAK;AACV,gBAAM,WAAW,IAAI,GAAG;AACxB,cAAI,UAAU,CAAC,mBAAmB,QAAQ,GAAG;AAC3C;AAAA,UACF;AACA,kBAAQ,KAAK,KAAK,IAAI;AACtB,cAAI,KAAK,WAAW;AAClB,kBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAM,UAAU,cAAc;AAC9B,gBAAI,QAAS,SAAQ,KAAK,SAAS,IAAI,IAAI,OAAO;AAAA,UACpD;AAAA,QACF;AACA,YAAI,UAAU,CAAC,OAAO,KAAK,OAAO,EAAE,QAAQ;AAC1C;AAAA,QACF;AACA,YAAI,UAAU,QAAQ;AACpB,cAAI,SAAS,YAAY,IAAI,MAAM,QAAQ,KAAK;AAChD,cAAI,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG;AACpC,qBAAS,MAAM,OAAO,aAAa,MAAM,QAAQ;AACjD,wBAAY,IAAI,MAAM,UAAU,MAAM;AAAA,UACxC;AACA,qBAAW,QAAQ,QAAQ;AACzB,kBAAM,QAAQ,QAAQ,KAAK,KAAK;AAChC,gBAAI,OAAO,UAAU,YAAY,CAAC,mBAAmB,KAAK,EAAG;AAC7D,kBAAM,YAAY,kBAAkB,OAAO,MAAM;AACjD,gBAAI,cAAc,KAAM;AACxB,oBAAQ,KAAK,KAAK,IAAI,yBAAyB,SAAS;AAAA,UAC1D;AAAA,QACF;AACA,YAAI,CAAC,cAAc;AAIjB,gBAAM,cAAc,OAAO,KAAK,CAAC,SAAS;AACxC,kBAAM,MAAM,gBAAgB,MAAM,KAAK,KAAK,GAAG;AAC/C,gBAAI,CAAC,IAAK,QAAO;AACjB,kBAAM,QAAQ,IAAI,GAAG;AACrB,gBAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,mBAAO,SAAS,mBAAmB,KAAK,IAAI,CAAC,mBAAmB,KAAK;AAAA,UACvE,CAAC;AACD,cAAI,YAAa,YAAW;AAC5B;AAAA,QACF;AACA,cAAM,YAAY,MAAM,kBAAkB;AAAA,UACxC;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,MAAM;AAAA,UACN,EAAE,kBAAkB,CAAC,OAAO;AAAA,QAC9B;AACA,cAAM,UAAmC,CAAC;AAC1C,mBAAW,QAAQ,QAAQ;AACzB,gBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAM,MAAM,UAAU;AACtB,cAAI,CAAC,IAAK;AACV,gBAAM,YAAa,UAAkB,KAAK,KAAK;AAC/C,cAAI,cAAc,UAAa,cAAc,IAAI,GAAG,GAAG;AACrD,gBAAI,CAAC,UAAU,mBAAmB,IAAI,GAAG,CAAC,EAAG;AAC7C,oBAAQ,GAAG,IAAI,qBAAqB,UAAU,MAAM,SAAS;AAAA,UAC/D;AACA,cAAI,KAAK,WAAW;AAClB,kBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAM,UAAU,cAAc;AAC9B,kBAAM,YAAa,UAAkB,KAAK,SAAS;AACnD,gBAAI,WAAW,cAAc,UAAa,cAAc,IAAI,OAAO,GAAG;AACpE,sBAAQ,OAAO,IAAI,qBAAqB,cAAc,MAAM,SAAS;AAAA,YACvE;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,OAAO,KAAK,OAAO,EAAE,OAAQ;AAClC,YAAI,CAAC,QAAQ;AACX,gBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI;AAC1E,gBAAM,KAAK;AAAA,YACT,UAAU,cAAc,QAAQ,MAAM,WAAW,EAAE;AAAA,YACnD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,EAAE,CAAC;AAAA,UACrC;AAAA,QACF;AACA,mBAAW;AAAA,MACb;AACA,aAAO;AAAA,IACT;AAEA,QAAI,QAAQ;AACZ,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,eAAe,KAAK,gBAAgB,QAAQ,IAAI;AAChE,UAAI,CAAC,QAAS;AACd,YAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,YAAM,SAAS,MAAM,cAAc,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AACnG,iBAAW,SAAS,QAAQ;AAC1B,cAAM,UAAU,MAAM,aAAa,UAAU,MAAM,QAAQ,KAAK;AAChE,YAAI,UAAU,GAAG;AACf,kBAAQ;AAAA,YACN,GAAG,SAAS,eAAe,EAAE,aAAa,OAAO,kBAAkB,QAAQ,QAAQ,MAAM,kBAAkB,MAAM;AAAA,UACnH;AAAA,QACF;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,QAAQ,GAAG;AACb,cAAQ,IAAI,aAAa,KAAK,oCAAoC;AAAA,IACpE,OAAO;AACL,cAAQ,IAAI,oEAAoE;AAAA,IAClF;AAAA,EACF;AACF;AAEA,MAAM,kBAA6B;AAAA,EACjC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAsB,KAAK,YAAuB;AAC5E,UAAM,oBAAqB,KAAK,OAAmB,KAAK,gBAA4B,KAAK,kBAA6B;AACtH,UAAM,cAAe,KAAK,UAAqB;AAC/C,UAAM,YAAY,QAAQ,KAAK,KAAK;AACpC,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG,KAAK;AACvD,UAAM,iBAAiB,QAAQ,KAAK,iBAAiB,CAAC;AACtD,UAAM,UAAW,KAAK,WAAsB;AAC5C,UAAM,YAAY,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,GAAG,EAAE,KAAK,GAAG;AACxG,UAAM,UAAU,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,UAAU,KAAK,KAAK,WAAW,GAAG,GAAG,EAAE,KAAK,CAAC;AAC9F,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAEhC,QAAI,CAAC,aAAa;AAChB,cAAQ,MAAM,8BAA8B;AAC5C;AAAA,IACF;AAEA,QAAI,CAAC,WAAW;AACd,UAAI,CAAC,SAAS;AACZ,gBAAQ,MAAM,wGAAwG;AACtH;AAAA,MACF;AACA,UAAI,YAAY,aAAa;AAC3B,gBAAQ,MAAM,oBAAoB,OAAO,8BAA8B,WAAW,cAAc;AAChG;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,qDAAqD;AACnE;AAAA,IACF;AAEA,QAAI,CAAC,aAAa,CAAC,8BAA8B,GAAG;AAClD,cAAQ,MAAM,8EAA8E;AAC5F;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AAEjD,UAAM,uBAAuB,OAC3B,UACA,mBACwE;AACxE,UAAI,eAAgB,QAAO,CAAC,EAAE,UAAU,eAAe,CAAC;AACxD,YAAM,OAAO,MAAM,KAAK;AAAA,QACtB;AAAA,QACA,CAAC,QAAQ;AAAA,MACX;AACA,YAAM,SAAS,oBAAI,IAAmB;AACtC,iBAAW,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG;AACjD,eAAO,IAAI,IAAI,mBAAmB,IAAI;AAAA,MACxC;AACA,aAAO,IAAI,IAAI;AACf,aAAO,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,gBAAgB,MAAM,EAAE;AAAA,IAChF;AAEA,UAAM,WAAgB,EAAE,UAAU,aAAa,WAAW,MAAM,UAAU,KAAK;AAC/E,QAAI,kBAAmB,UAAS,iBAAiB;AACjD,QAAI,YAAa,UAAS,WAAW;AACrC,UAAM,UAAU,MAAM,GAAG,KAAK,eAAe,QAAQ;AACrD,UAAM,wBAAwB,yBAAyB;AACvD,UAAM,OAAO,QAAQ,OAAO,CAAC,QAAuB;AAClD,UAAI,CAAC,sBAAsB,IAAI,OAAO,IAAI,QAAQ,CAAC,EAAG,QAAO;AAC7D,cAAQ;AAAA,QACN,YAAY,IAAI,QAAQ;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,IAAI,yDAAyD;AACrE;AAAA,IACF;AAEA,UAAM,MAAM,iBAAiB;AAC7B,UAAM,WAAW,oBAAI,IAA8B;AACnD,UAAM,SAAS,OAAO,aAAgD;AACpE,UAAI,SAAS,IAAI,QAAQ,EAAG,QAAO,SAAS,IAAI,QAAQ,KAAK;AAC7D,YAAM,MAAM,MAAM,IAAI,aAAa,QAAQ;AAC3C,eAAS,IAAI,UAAU,GAAG;AAC1B,aAAO;AAAA,IACT;AAEA,QAAI,WAAW;AACb,YAAM,WAAW,QAAQ,IAAI,0BAA0B;AACvD,cAAQ,IAAI,4BAA4B,QAAQ,EAAE;AAClD,cAAQ,IAAI,2CAA2C,KAAK,MAAM,EAAE;AACpE,UAAI,6BAA6B;AACjC,UAAI,+BAA+B;AACnC,iBAAW,OAAO,MAAM;AACtB,cAAM,UAAU,eAAe,KAAK,cAAc;AAClD,YAAI,CAAC,QAAS;AACd,cAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,cAAM,MAAM,MAAM,OAAO,QAAQ,EAAE,MAAM,MAAM,IAAI;AACnD,YAAI,CAAC,IAAK;AACV,cAAM,SAAS,MAAM,qBAAqB,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAC1G,cAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,cAAM,YAAY,MAAM;AACxB,YAAI,CAAC,UAAW;AAChB,cAAM,SAAS,MAAM;AACrB,cAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,cAAM,YAAY,OAAO,QAAQ,CAAC,MAAW;AAC3C,gBAAM,IAAI,gBAAgB,MAAM,EAAE,KAAK;AACvC,iBAAO,EAAE,aAAa,CAAC,EAAE,UAAU,IAAI,CAAC;AAAA,QAC1C,CAAC;AACD,cAAM,UAAU,MAAM,KAAK,oBAAI,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;AACtD,mBAAW,SAAS,QAAQ;AAC1B,gBAAM,aAAa,MAAM,KAAK;AAAA,YAC5B,UAAU,QAAQ,IAAI,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAAA,YAChF,CAAC,MAAM,UAAU,MAAM,cAAc;AAAA,UACvC,EAAE,MAAM,MAAM,CAAC,CAAC;AAChB,qBAAW,OAAO,MAAM,QAAQ,UAAU,IAAI,aAAa,CAAC,GAAG;AAC7D,gBAAI,kBAAkB;AACtB,uBAAW,aAAa,QAAQ;AAC9B,oBAAM,WAAW,gBAAgB,MAAM,UAAU,KAAK;AACtD,oBAAM,MAAM,UAAU;AACtB,kBAAI,CAAC,IAAK;AACV,oBAAM,WAAW,IAAI,GAAG;AACxB,kBAAI,aAAa,QAAQ,aAAa,OAAW;AACjD,kBAAI;AACF,wCAAwB,OAAO,QAAQ,GAAG,IAAI,GAAG;AACjD,kCAAkB;AAAA,cACpB,SAAS,GAAQ;AACf,oBAAI,aAAa,6BAA6B,EAAE,SAAS,8BAA8B,mBAAmB;AACxG;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AACA,gBAAI,gBAAiB;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,6CAA6C,0BAA0B,EAAE;AACrF,UAAI,+BAA+B,GAAG;AACpC,gBAAQ,KAAK,wCAAmC,4BAA4B,iCAA4B;AAAA,MAC1G,OAAO;AACL,gBAAQ,IAAI,iCAAiC,4BAA4B,EAAE;AAAA,MAC7E;AACA,cAAQ,IAAI,2EAAsE;AAClF;AAAA,IACF;AAEA,QAAI,mBAAmB;AACvB,QAAI,mBAAmB;AACvB,QAAI,yBAAyB;AAC7B,UAAM,yBAAyB,oBAAI,IAAY;AAC/C,QAAI,6BAA6B;AACjC,UAAM,sBAAsB,oBAAI,IAAoB;AACpD,QAAI,yBAAyB;AAE7B,eAAW,OAAO,MAAM;AACtB,YAAM,UAAU,eAAe,KAAK,gBAAgB,QAAQ,IAAI;AAChE,UAAI,CAAC,QAAS;AACd,YAAM,EAAE,UAAU,MAAM,QAAQ,SAAS,IAAI;AAC7C,YAAM,MAAM,MAAM,OAAO,QAAQ;AACjC,UAAI,CAAC,KAAK;AACR,gBAAQ,KAAK,+BAA+B,QAAQ,cAAc,QAAQ,GAAG;AAC7E;AAAA,MACF;AACA,YAAM,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AAC/F,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,WAAW;AACd,gBAAQ,KAAK,YAAY,QAAQ,yBAAyB;AAC1D;AAAA,MACF;AACA,YAAM,SAAS,MAAM;AACrB,YAAM,iBAAiB,SAAS,IAAI,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAC5E,YAAM,YAAY,OAAO,QAAQ,CAAC,MAAW;AAC3C,cAAM,IAAI,gBAAgB,MAAM,EAAE,KAAK;AACvC,eAAO,EAAE,aAAa,CAAC,EAAE,UAAU,IAAI,CAAC;AAAA,MAC1C,CAAC;AACD,YAAM,UAAU,MAAM,KAAK,oBAAI,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;AACtD;AAEA,YAAM,SAAS,MAAM,qBAAqB,UAAU,IAAI,iBAAiB,OAAO,IAAI,cAAc,IAAI,IAAI;AAE1G,iBAAW,SAAS,QAAQ;AAC1B,YAAI,SAAwB;AAC5B,YAAI,sBAAsB;AAE1B,eAAO,MAAM;AACX,cAAI,YAAY,UAAU,QAAQ,IAAI,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,SAAS,cAAc;AAChG,gBAAM,eAA0B,CAAC,MAAM,UAAU,MAAM,cAAc;AACrE,cAAI,WAAW,MAAM;AACnB,yBAAa,SAAS,EAAE;AACxB,yBAAa,KAAK,MAAM;AAAA,UAC1B;AACA,uBAAa,cAAc,EAAE;AAC7B,uBAAa,KAAK,SAAS;AAE3B,gBAAM,YAAY,MAAM,KAAK,QAAQ,WAAW,YAAY;AAC5D,gBAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI,YAAY,CAAC;AACtD,cAAI,CAAC,MAAM,OAAQ;AAEnB,mBAAS,OAAO,MAAM,MAAM,SAAS,CAAC,EAAG,EAAE,CAAC;AAC5C,8BAAoB,MAAM;AAE1B,gBAAM,aAAa,KAAK,IAAI;AAC5B,gBAAM,KAAK,QAAQ,OAAO;AAC1B,cAAI,iBAAiB;AACrB,cAAI;AACF,uBAAW,OAAO,OAAO;AACvB,oBAAM,UAAmC,CAAC;AAC1C,kBAAI,eAAe;AAEnB,yBAAW,aAAa,QAAQ;AAC9B,sBAAM,WAAW,gBAAgB,MAAM,UAAU,KAAK;AACtD,sBAAM,MAAM,UAAU;AACtB,oBAAI,CAAC,IAAK;AACV,sBAAM,WAAW,IAAI,GAAG;AACxB,oBAAI,aAAa,QAAQ,aAAa,OAAW;AACjD,oBAAI;AACF,wBAAM,YAAY,wBAAwB,OAAO,QAAQ,GAAG,IAAI,GAAG;AACnE,sBAAI;AACJ,sBAAI;AACF,0BAAM,SAAS,KAAK,MAAM,SAAS;AACnC,mCAAe,OAAO,WAAW,WAAW,SAAS;AAAA,kBACvD,QAAQ;AACN,mCAAe;AAAA,kBACjB;AACA,0BAAQ,GAAG,IAAI;AACf,iCAAe;AAAA,gBACjB,SAAS,GAAQ;AACf,sBAAI,aAAa,2BAA2B;AAC1C,wBAAI,EAAE,SAAS,8BAA8B,aAAa;AAAA,oBAE1D,WAAW,EAAE,SAAS,8BAA8B,mBAAmB;AACrE;AACA,4BAAM,cAAc,GAAG,SAAS,IAAI,GAAG;AACvC,0CAAoB,IAAI,cAAc,oBAAoB,IAAI,WAAW,KAAK,KAAK,CAAC;AACpF,8BAAQ,KAAK,gCAA2B,QAAQ,WAAW,GAAG,SAAS,IAAI,EAAE,CAAC,mBAAmB;AAAA,oBACnG,OAAO;AACL,4BAAM;AAAA,oBACR;AAAA,kBACF,OAAO;AACL,0BAAM;AAAA,kBACR;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,cAAc;AAChB,2BAAW,aAAa,QAAQ;AAC9B,sBAAI,CAAC,UAAU,UAAW;AAC1B,wBAAM,eAAe,gBAAgB,MAAM,UAAU,SAAS;AAC9D,wBAAM,UAAU,cAAc;AAC9B,sBAAI,CAAC,SAAS;AACZ,0BAAM,aAAa,GAAG,SAAS,IAAI,UAAU,SAAS;AACtD,wBAAI,CAAC,uBAAuB,IAAI,UAAU,GAAG;AAC3C,8BAAQ,KAAK,uBAAkB,UAAU,SAAS,+BAA+B,QAAQ,aAAa;AACtG,6CAAuB,IAAI,UAAU;AAAA,oBACvC;AACA;AAAA,kBACF;AACA,0BAAQ,OAAO,IAAI;AACnB;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,oBAAI,CAAC,QAAQ;AACX,wBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI;AAC1E,wBAAM,KAAK;AAAA,oBACT,UAAU,cAAc,QAAQ,MAAM,WAAW,EAAE;AAAA,oBACnD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,EAAE,CAAC;AAAA,kBACrC;AAAA,gBACF;AACA;AAAA,cACF;AAAA,YACF;AACA,kBAAM,KAAK,QAAQ,QAAQ;AAC3B,6BAAiB;AAAA,UACnB,SAAS,UAAe;AACtB,gBAAI,CAAC,gBAAgB;AACnB,kBAAI;AAAE,sBAAM,KAAK,QAAQ,UAAU;AAAA,cAAE,QAAQ;AAAA,cAAC;AAAA,YAChD;AACA,oBAAQ,MAAM,2CAA2C,QAAQ,KAAM,UAAoB,WAAW,OAAO,QAAQ,CAAC,EAAE;AACxH,kBAAM;AAAA,UACR;AAEA,gBAAM,kBAAkB,KAAK,IAAI,IAAI;AACrC,cAAI,OAAO;AACT,oBAAQ;AAAA,cACN,iBAAiB,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,KAAK,MAAM,MAAM,YAAY,eAAe,sBAAsB,mBAAmB;AAAA,YACtJ;AACA,gBAAI,kBAAkB,KAAQ;AAC5B,sBAAQ,KAAK,yDAAoD;AAAA,YACnE;AAAA,UACF;AACA,cAAI,UAAU,GAAG;AACf,kBAAM,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAAA,UACvD;AAAA,QACF;AAEA,sCAA8B;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,kBAAkB,CAAC,QAAQ;AAC7B,UAAI,gBAAgB;AACpB,YAAM,mBAA8B,CAAC,WAAW;AAChD,UAAI,mBAAmB;AACrB,yBAAiB;AACjB,yBAAiB,KAAK,iBAAiB;AAAA,MACzC;AACA,UAAI,aAAa;AACf,yBAAiB;AACjB,yBAAiB,KAAK,WAAW;AAAA,MACnC;AACA,YAAM,KAAK,QAAQ,eAAe,gBAAgB;AAClD,cAAQ,KAAK,2FAAiF;AAC9F,UAAI,8BAA8B,GAAG;AACnC,gBAAQ,KAAK,qIAA2H;AAAA,MAC1I;AAAA,IACF;AAEA,QAAI,kBAAkB,QAAQ;AAC5B,cAAQ,IAAI,8BAA8B,KAAK,MAAM,2BAA2B;AAAA,IAClF;AAEA,UAAM,SAAS,SAAS,eAAe;AACvC,YAAQ,IAAI;AAAA,EAAK,MAAM,qBAAqB;AAC5C,YAAQ,IAAI,0BAA0B,gBAAgB,EAAE;AACxD,YAAQ,IAAI,0BAA0B,gBAAgB,EAAE;AACxD,YAAQ,IAAI,0BAA0B,sBAAsB,EAAE;AAC9D,YAAQ,IAAI,0BAA0B,sBAAsB,EAAE;AAC9D,QAAI,uBAAuB,OAAO,GAAG;AACnC,cAAQ,IAAI,4CAA4C,MAAM,KAAK,sBAAsB,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,IACzG;AACA,QAAI,6BAA6B,GAAG;AAClC,cAAQ;AAAA,QACN,YAAO,0BAA0B;AAAA,MACnC;AACA,UAAI,SAAS,oBAAoB,OAAO,GAAG;AACzC,cAAM,MAAM,MAAM,KAAK,oBAAoB,QAAQ,CAAC,EACjD,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAC1B,MAAM,GAAG,EAAE;AACd,gBAAQ,IAAI,4BAA4B;AACxC,mBAAW,CAAC,KAAK,KAAK,KAAK,KAAK;AAC9B,kBAAQ,IAAI,OAAO,GAAG,KAAK,KAAK,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI;AAAA,iDAA+C;AAC3D,cAAQ,IAAI,sEAAsE;AAClF,cAAQ,IAAI,wCAAwC;AACpD,cAAQ,IAAI,mDAAmD,WAAW,oFAA+E;AACzJ,cAAQ,IAAI,yDAAyD,WAAW,iDAAiD;AACjI,cAAQ,IAAI,gHAA2G;AAAA,IACzH;AAAA,EACF;AACF;AAkBA,MAAM,2BAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,UAAU,IAAI;AAC3B,UAAM,cAAe,KAAK,UAAqB;AAC/C,UAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,KAAK,GAAG;AAClD,UAAM,YAAY,KAAK,IAAI,GAAG,SAAS,OAAO,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,GAAG,EAAE,KAAK,GAAG;AACxG,UAAM,QAAQ,QAAQ,KAAK,KAAK;AAEhC,QAAI,CAAC,8BAA8B,GAAG;AACpC,cAAQ,MAAM,qFAAqF;AACnG;AAAA,IACF;AAEA,UAAM,aAAa,yBAAyB,4BAA4B,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,QAAQ;AACpH,QAAI,CAAC,WAAW,QAAQ;AACtB,cAAQ,IAAI,8FAA8F;AAC1G;AAAA,IACF;AACA,UAAM,eAAe,cAAc,WAAW,OAAO,CAAC,QAAQ,IAAI,aAAa,WAAW,IAAI;AAC9F,QAAI,CAAC,aAAa,QAAQ;AACxB,cAAQ,MAAM,wDAAwD,WAAW,IAAI;AACrF,cAAQ,MAAM,iCAAiC,WAAW,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC,EAAE;AACjG;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAQ,IAAI;AACvB,UAAM,OAAY,IAAI,gBAAgB;AACtC,QAAI,CAAC,QAAQ,OAAO,KAAK,YAAY,YAAY;AAC/C,cAAQ,MAAM,qDAAqD;AACnE;AAAA,IACF;AAEA,UAAM,oBAAoB,IAAI,4BAA4B,IAAW;AAAA,MACnE,KAAK,iBAAiB;AAAA,MACtB,uBAAuB;AAAA,IACzB,CAAC;AACD,QAAI,CAAC,kBAAkB,UAAU,GAAG;AAClC,cAAQ,MAAM,uFAAuF;AACrG;AAAA,IACF;AAEA,UAAM,iBAAiB,wBAAwB,EAAE;AACjD,UAAM,SAAS,SAAS,eAAe;AACvC,QAAI,mBAAmB;AACvB,QAAI,mBAAmB;AACvB,QAAI,qBAAqB;AAEzB,eAAW,OAAO,cAAc;AAC9B,YAAM,WAAW,IAAI;AACrB,YAAM,OAAO,eAAe,IAAI,QAAQ;AACxC,UAAI,CAAC,MAAM;AACT,gBAAQ,KAAK,YAAY,QAAQ,8DAA8D;AAC/F;AAAA,MACF;AACA,YAAM,YAAY,MAAM;AACxB,UAAI,CAAC,WAAW;AACd,gBAAQ,KAAK,YAAY,QAAQ,6BAA6B;AAC9D;AAAA,MACF;AACA,YAAM,aAAa,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,YAAY,SAAS,KAAK,YAAY,CAAC,IAAI;AACvG,YAAM,EAAE,YAAY,iBAAiB,IAAI,gBAAgB,MAAM,UAAU;AACzE,YAAM,WAAW,oBAAoB;AACrC,YAAM,iBAAiB,MAAM,SAAS,IAAI,KAAK,MAAM,MAAM,SAAS,MAAM,IAAI,SAAS;AAEvF,YAAM,UAAU,oBAAI,IAAY,CAAC,QAAQ,CAAC;AAC1C,iBAAW,QAAQ,IAAI,QAAQ;AAC7B,cAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,YAAI,SAAS,WAAY,SAAQ,IAAI,SAAS,UAAU;AACxD,YAAI,KAAK,WAAW;AAClB,gBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,cAAI,aAAa,WAAY,SAAQ,IAAI,aAAa,UAAU;AAAA,QAClE;AAAA,MACF;AACA,YAAM,aAAa,MAAM,KAAK,OAAO;AACrC,YAAM,aAAa,WAAW,IAAI,CAAC,WAAW,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AAItE,YAAM,qBAAqB,SACvB,QAAQ,MAAM,kBAAkB,OAAO,uBAAuB,UAAU,UAAU,IAAI,CAAC,CAAC,IACxF;AACJ,UAAI,CAAC,oBAAoB;AACvB,gBAAQ;AAAA,UACN,aAAa,QAAQ;AAAA,QACvB;AAAA,MACF;AAEA,UAAI,SAAkB;AACtB,UAAI,oBAAoB;AACxB,UAAI,oBAAoB;AACxB,UAAI,sBAAsB;AAE1B,iBAAS;AACP,cAAM,YAAY,WAAW,OACzB,UAAU,UAAU,SAAS,cAAc,cAAc,QAAQ,kBACjE,UAAU,UAAU,SAAS,cAAc,WAAW,QAAQ,mBAAmB,QAAQ;AAC7F,cAAM,SAAS,WAAW,OAAO,CAAC,SAAS,IAAI,CAAC,QAAQ,SAAS;AACjE,cAAM,OAAO,MAAM,KAAK,QAAQ,WAAW,MAAM;AACjD,cAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC;AAC3C,YAAI,CAAC,KAAK,OAAQ;AAElB,mBAAW,OAAO,MAAM;AACtB,+BAAqB;AACrB,mBAAS,IAAI,QAAQ;AACrB,gBAAM,UAAmC,CAAC;AAC1C,cAAI,eAAe;AACnB,qBAAW,QAAQ,IAAI,QAAQ;AAC7B,kBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAI,CAAC,SAAS,WAAY;AAC1B,kBAAM,WAAW,IAAI,SAAS,UAAU;AACxC,oBAAQ,KAAK,KAAK,IAAI;AACtB,gBAAI,aAAa,QAAQ,aAAa,UAAa,CAAC,mBAAmB,QAAQ,EAAG,gBAAe;AACjG,gBAAI,KAAK,WAAW;AAClB,oBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,kBAAI,aAAa,WAAY,SAAQ,KAAK,SAAS,IAAI,IAAI,aAAa,UAAU;AAAA,YACpF;AAAA,UACF;AACA,cAAI,CAAC,aAAc;AACnB,cAAI,CAAC,oBAAoB;AAEvB,iCAAqB;AACrB;AAAA,UACF;AAEA,gBAAM,YAAY,MAAM,kBAAkB;AAAA,YACxC;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,EAAE,kBAAkB,CAAC,OAAO;AAAA,UAC9B;AACA,gBAAM,UAAmC,CAAC;AAC1C,qBAAW,QAAQ,IAAI,QAAQ;AAC7B,kBAAM,WAAW,gBAAgB,MAAM,KAAK,KAAK;AACjD,gBAAI,SAAS,YAAY;AACvB,oBAAM,YAAY,UAAU,KAAK,KAAK;AACtC,kBAAI,cAAc,UAAa,cAAc,IAAI,SAAS,UAAU,GAAG;AACrE,wBAAQ,SAAS,UAAU,IAAI,qBAAqB,SAAS,MAAM,SAAS;AAAA,cAC9E;AAAA,YACF;AACA,gBAAI,KAAK,WAAW;AAClB,oBAAM,eAAe,gBAAgB,MAAM,KAAK,SAAS;AACzD,oBAAM,WAAW,UAAU,KAAK,SAAS;AACzC,kBAAI,aAAa,cAAc,aAAa,UAAa,aAAa,IAAI,aAAa,UAAU,GAAG;AAClG,wBAAQ,aAAa,UAAU,IAAI,qBAAqB,aAAa,MAAM,QAAQ;AAAA,cACrF;AAAA,YACF;AAAA,UACF;AACA,cAAI,CAAC,OAAO,KAAK,OAAO,EAAE,QAAQ;AAChC,mCAAuB;AACvB,gBAAI,MAAO,SAAQ,KAAK,gCAAgC,QAAQ,IAAI,OAAO,IAAI,QAAQ,CAAC,CAAC,4BAA4B;AACrH;AAAA,UACF;AACA,cAAI,CAAC,QAAQ;AACX,kBAAM,SAAS,OAAO,KAAK,OAAO,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM,OAAO,EAAE,KAAK,IAAI;AAChF,kBAAM,KAAK;AAAA,cACT,UAAU,cAAc,QAAQ,MAAM,WAAW,QAAQ;AAAA,cACzD,CAAC,GAAG,OAAO,OAAO,OAAO,GAAG,IAAI,QAAQ,CAAC;AAAA,YAC3C;AAAA,UACF;AACA,+BAAqB;AAAA,QACvB;AAEA,YAAI,KAAK,SAAS,UAAW;AAAA,MAC/B;AAEA,0BAAoB;AACpB,0BAAoB;AACpB,4BAAsB;AACtB,cAAQ,IAAI,GAAG,MAAM,GAAG,QAAQ,aAAa,iBAAiB,eAAe,iBAAiB,EAAE;AAAA,IAClG;AAEA,YAAQ,IAAI;AAAA,EAAK,MAAM,mBAAmB;AAC1C,YAAQ,IAAI,qBAAqB,gBAAgB,EAAE;AACnD,YAAQ,IAAI,qBAAqB,gBAAgB,EAAE;AACnD,QAAI,qBAAqB,GAAG;AAC1B,cAAQ;AAAA,QACN,YAAO,kBAAkB;AAAA,MAC3B;AAAA,IACF;AACA,QAAI,CAAC,UAAU,mBAAmB,GAAG;AACnC,cAAQ,IAAI,wFAAmF;AAAA,IACjG;AAAA,EACF;AACF;AAGA,IAAO,cAAQ,CAAC,UAAU,eAAe,UAAU,oBAAoB,qBAAqB,iBAAiB,wBAAwB;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.7.1-develop.7172.1.a45dece080",
+  "version": "0.7.1-develop.7175.1.d49ab48ee2",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7172.1.a45dece080",
-    "@open-mercato/shared": "0.7.1-develop.7172.1.a45dece080",
-    "@open-mercato/ui": "0.7.1-develop.7172.1.a45dece080",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7175.1.d49ab48ee2",
+    "@open-mercato/shared": "0.7.1-develop.7175.1.d49ab48ee2",
+    "@open-mercato/ui": "0.7.1-develop.7175.1.d49ab48ee2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.7.1-develop.7172.1.a45dece080",
-    "@open-mercato/shared": "0.7.1-develop.7172.1.a45dece080",
-    "@open-mercato/ui": "0.7.1-develop.7172.1.a45dece080",
+    "@open-mercato/ai-assistant": "0.7.1-develop.7175.1.d49ab48ee2",
+    "@open-mercato/shared": "0.7.1-develop.7175.1.d49ab48ee2",
+    "@open-mercato/ui": "0.7.1-develop.7175.1.d49ab48ee2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/customers/data/validators.ts

@@ -461,7 +461,9 @@ const interactionLinkedEntitySchema = z.object({
   id: z.string().uuid(),
   // 'resource' links calendar events to bookable resources (rooms, cars,
   // equipment) from the optional resources module (#3552).
-  type: z.enum(['company', 'deal', 'offer', 'resource']),
+  // 'person' links an interaction to a `customer_entities` row with kind='person',
+  // a first-class CRM record like a company (#5934).
+  type: z.enum(['company', 'deal', 'offer', 'resource', 'person']),
   label: z.string().trim().max(500),
 })
 

package/src/modules/entities/cli.ts

@@ -22,6 +22,7 @@ import {
 import {
   TenantDataEncryptionService,
   parseDecryptedFieldValue,
+  resolveEncryptionKeyId,
 } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
 import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
@@ -549,6 +550,27 @@ const rotateEncryptionKey: ModuleCli = {
     }
 
     const oldDekCache = new Map<string, TenantDek | null>()
+    // A dry run must not provision key material. `encryptEntityPayload` creates and
+    // persists a tenant DEK in KMS/Vault the first time it runs for a tenant, so a
+    // read-only preview would silently mutate KMS state (#5950). Probe read-only
+    // once per tenant instead, and report what a real run would rewrite.
+    //
+    // The tenant id IS the key id here: this command skips every system-scoped
+    // entity above, and its service is built without `defaultEncryptionMaps`, so
+    // no map it sees can resolve to a `system:<entityId>` key.
+    const dekAvailability = new Map<string, boolean>()
+    const hasExistingDek = async (tenantId: string): Promise<boolean> => {
+      const cached = dekAvailability.get(tenantId)
+      if (cached !== undefined) return cached
+      const available = Boolean(await encryptionService.getDek(tenantId))
+      dekAvailability.set(tenantId, available)
+      if (!available) {
+        console.warn(
+          `[dry-run] Tenant ${tenantId} has no data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`,
+        )
+      }
+      return available
+    }
     const processScope = async (
       entityId: string,
       meta: any,
@@ -576,6 +598,7 @@ const rotateEncryptionKey: ModuleCli = {
       const rows = await conn.execute(selectSql, [scope.tenantId, scope.organizationId])
       const list = Array.isArray(rows) ? rows : []
       if (!list.length) return 0
+      const dekAvailable = dryRun ? await hasExistingDek(scope.tenantId) : true
       let updated = 0
       for (const row of list) {
         const payload: Record<string, unknown> = {}
@@ -611,11 +634,26 @@ const rotateEncryptionKey: ModuleCli = {
             payload[rule.field] = parseDecryptedFieldValue(decrypted)
           }
         }
+        if (!dekAvailable) {
+          // Nothing was encrypted because no key exists and this run refuses to
+          // create one. Count the rows a real run would rewrite by applying the
+          // same plaintext/ciphertext filters the update path uses below.
+          const wouldChange = fields.some((rule) => {
+            const col = resolveProperty(meta, rule.field)?.columnName
+            if (!col) return false
+            const value = row[col]
+            if (value === null || value === undefined) return false
+            return rotate ? isEncryptedPayload(value) : !isEncryptedPayload(value)
+          })
+          if (wouldChange) updated += 1
+          continue
+        }
         const encrypted = await encryptionService.encryptEntityPayload(
           entityId,
           payload,
           scope.tenantId,
           scope.organizationId,
+          { createMissingDek: !dryRun },
         )
         const updates: Record<string, unknown> = {}
         for (const rule of fields) {
@@ -1129,6 +1167,17 @@ const backfillSystemEncryption: ModuleCli = {
       const columnList = Array.from(columns)
       const selectList = columnList.map((column) => `"${column}"`).join(', ')
 
+      // Same dry-run guarantee as rotate-encryption-key: previewing must not make
+      // the KMS provision this entity's system DEK as a side effect (#5950).
+      const systemDekAvailable = dryRun
+        ? Boolean(await encryptionService.getDek(resolveEncryptionKeyId(entityId, 'system', null)))
+        : true
+      if (!systemDekAvailable) {
+        console.warn(
+          `[dry-run] ${entityId} has no system data-encryption key yet. Reporting the rows a real run would encrypt; no key material was provisioned.`,
+        )
+      }
+
       let cursor: unknown = null
       let entityRowsScanned = 0
       let entityRowsUpdated = 0
@@ -1160,8 +1209,19 @@ const backfillSystemEncryption: ModuleCli = {
             }
           }
           if (!hasPlaintext) continue
+          if (!systemDekAvailable) {
+            // `hasPlaintext` already means a real run would rewrite this row.
+            entityRowsUpdated += 1
+            continue
+          }
 
-          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null)
+          const encrypted = await encryptionService.encryptEntityPayload(
+            entityId,
+            payload,
+            null,
+            null,
+            { createMissingDek: !dryRun },
+          )
           const updates: Record<string, unknown> = {}
           for (const rule of map.fields) {
             const resolved = resolveProperty(meta, rule.field)