@portaidentity/server 1.7.0

package/dist/lib/data-export.js

@@ -0,0 +1,272 @@
+/**
+ * Bounded administrative data export.
+ *
+ * Every query selects an explicit public field list, reads one row beyond the public limit, and
+ * writes a content-free audit record in the same repeatable-read transaction. CSV output is
+ * neutralized before quoting so spreadsheet applications cannot execute imported formulas.
+ */
+import { getPool } from './database.js';
+/** Maximum number of rows returned by one export. */
+export const MAXIMUM_EXPORT_ROWS = 10_000;
+/** Minimal export failure which never retains query or row diagnostics. */
+export class ExportOperationError extends Error {
+    /** Stable public failure discriminator. */
+    code;
+    /** Recommended HTTP status. */
+    status;
+    /**
+     * Create a closed export failure.
+     *
+     * @param code - Stable public failure discriminator.
+     * @param status - Recommended route status.
+     */
+    constructor(code, status) {
+        super('Export request could not be completed');
+        this.name = 'ExportOperationError';
+        this.code = code;
+        this.status = status;
+    }
+}
+const EXPORT_QUERIES = Object.freeze({
+    users: {
+        sql: `SELECT u.id, u.email, u.status, u.given_name, u.family_name, u.nickname, u.locale,
+                 u.email_verified, u.phone_number, u.created_at, u.updated_at, u.last_login_at,
+                 u.login_count
+          FROM users u WHERE u.organization_id = $1
+          ORDER BY u.created_at LIMIT 10001`,
+        columns: [
+            'id',
+            'email',
+            'status',
+            'given_name',
+            'family_name',
+            'nickname',
+            'locale',
+            'email_verified',
+            'phone_number',
+            'created_at',
+            'updated_at',
+            'last_login_at',
+            'login_count',
+        ],
+        requiredScope: 'organization',
+    },
+    organizations: {
+        sql: `SELECT id, name, slug, status, is_super_admin, default_locale, created_at, updated_at
+          FROM organizations ORDER BY created_at LIMIT 10001`,
+        columns: [
+            'id',
+            'name',
+            'slug',
+            'status',
+            'is_super_admin',
+            'default_locale',
+            'created_at',
+            'updated_at',
+        ],
+        requiredScope: 'none',
+    },
+    clients: {
+        sql: `SELECT c.id, c.client_id, c.client_name, c.client_type, c.status,
+                 c.application_type, c.grant_types, c.redirect_uris, c.created_at, c.updated_at
+          FROM clients c WHERE c.organization_id = $1
+          ORDER BY c.created_at LIMIT 10001`,
+        columns: [
+            'id',
+            'client_id',
+            'client_name',
+            'client_type',
+            'status',
+            'application_type',
+            'grant_types',
+            'redirect_uris',
+            'created_at',
+            'updated_at',
+        ],
+        requiredScope: 'organization',
+    },
+    roles: {
+        sql: `SELECT r.id, r.name, r.slug, r.description, r.created_at
+          FROM roles r
+          WHERE r.application_id = $2
+            AND EXISTS (
+              SELECT 1 FROM clients c
+              WHERE c.application_id = r.application_id AND c.organization_id = $1
+            )
+          ORDER BY r.created_at LIMIT 10001`,
+        columns: ['id', 'name', 'slug', 'description', 'created_at'],
+        requiredScope: 'organization-and-application',
+    },
+    audit: {
+        sql: `SELECT id, event_type, event_category, actor_id, metadata, created_at
+          FROM audit_log
+          WHERE organization_id = $1 AND created_at >= $2 AND created_at <= $3
+          ORDER BY created_at DESC LIMIT 10001`,
+        columns: ['id', 'event_type', 'event_category', 'actor_id', 'created_at', 'safe_details'],
+        requiredScope: 'audit',
+    },
+});
+/** Metadata fields safe to disclose for explicitly recognized event types. */
+const SAFE_AUDIT_DETAIL_FIELDS = Object.freeze({
+    'admin.import': ['mode', 'manifestVersion', 'manifestDigest', 'created', 'updated', 'skipped'],
+    'admin.export': ['entityType', 'format', 'rowCount'],
+});
+/** Validate scope requirements and return the query parameters in SQL order. */
+function exportParameters(options, definition) {
+    if (definition.requiredScope !== 'none' && options.organizationId === undefined) {
+        throw new ExportOperationError('export_scope_required', 400);
+    }
+    if (definition.requiredScope === 'organization-and-application' &&
+        options.applicationId === undefined) {
+        throw new ExportOperationError('export_scope_required', 400);
+    }
+    if (definition.requiredScope === 'audit') {
+        if (options.startDate === undefined || options.endDate === undefined) {
+            throw new ExportOperationError('export_scope_required', 400);
+        }
+        if (options.startDate.getTime() > options.endDate.getTime()) {
+            throw new ExportOperationError('export_invalid_range', 400);
+        }
+        return [options.organizationId, options.startDate, options.endDate];
+    }
+    if (definition.requiredScope === 'organization-and-application') {
+        return [options.organizationId, options.applicationId];
+    }
+    return definition.requiredScope === 'organization' ? [options.organizationId] : [];
+}
+/** Copy only event-specific safe details from one audit metadata object. */
+function safeAuditDetails(eventType, metadata) {
+    if (typeof metadata !== 'object' || metadata === null || Array.isArray(metadata))
+        return {};
+    const entries = new Map(Object.entries(metadata));
+    const safe = {};
+    for (const field of SAFE_AUDIT_DETAIL_FIELDS[eventType] ?? []) {
+        const value = entries.get(field);
+        if (typeof value === 'string' ||
+            typeof value === 'number' ||
+            typeof value === 'boolean' ||
+            value === null) {
+            safe[field] = value;
+        }
+    }
+    return safe;
+}
+/** Replace private audit metadata with the closed event-specific safe-detail object. */
+function sanitizeRows(entityType, rows) {
+    if (entityType !== 'audit')
+        return rows.map((row) => ({ ...row }));
+    return rows.map((row) => ({
+        id: row.id,
+        event_type: row.event_type,
+        event_category: row.event_category,
+        actor_id: row.actor_id,
+        created_at: row.created_at,
+        safe_details: typeof row.event_type === 'string' ? safeAuditDetails(row.event_type, row.metadata) : {},
+    }));
+}
+/** Write one content-free audit row through the export transaction. */
+async function writeExportAudit(client, options, rowCount) {
+    if (options.actorId === undefined)
+        return;
+    await client.query(`INSERT INTO audit_log (
+       organization_id, actor_id, event_type, event_category, metadata
+     ) VALUES ($1, $2, 'admin.export', 'admin', $3)`, [
+        options.organizationId ?? null,
+        options.actorId,
+        JSON.stringify({
+            entityType: options.entityType,
+            format: options.format,
+            rowCount,
+            ...(options.applicationId === undefined ? {} : { applicationId: options.applicationId }),
+            ...(options.startDate === undefined ? {} : { startDate: options.startDate.toISOString() }),
+            ...(options.endDate === undefined ? {} : { endDate: options.endDate.toISOString() }),
+        }),
+    ]);
+}
+/** Prove that the requested application participates in the requested tenant before role access. */
+async function requireRoleRelationship(client, options) {
+    if (options.entityType !== 'roles')
+        return;
+    const relationship = await client.query(`SELECT 1 FROM clients
+     WHERE organization_id = $1 AND application_id = $2
+     LIMIT 1`, [options.organizationId, options.applicationId]);
+    if (relationship.rowCount !== 1) {
+        throw new ExportOperationError('export_scope_required', 400);
+    }
+}
+/**
+ * Export one authorized entity set through a bounded repeatable-read transaction.
+ *
+ * @param options - Exact entity, representation, scope, and actor.
+ * @returns Complete serialized export and exact row count.
+ * @throws ExportOperationError when scope is incomplete, the bound is exceeded, or persistence
+ * fails.
+ */
+export async function exportData(options) {
+    const definition = EXPORT_QUERIES[options.entityType];
+    const parameters = exportParameters(options, definition);
+    const pool = getPool();
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ');
+        await requireRoleRelationship(client, options);
+        const queryResult = await client.query(definition.sql, parameters);
+        if (queryResult.rows.length > MAXIMUM_EXPORT_ROWS) {
+            throw new ExportOperationError('export_too_large', 413);
+        }
+        const rows = sanitizeRows(options.entityType, queryResult.rows);
+        await writeExportAudit(client, options, rows.length);
+        await client.query('COMMIT');
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+        const filename = `${options.entityType}-export-${timestamp}`;
+        if (options.format === 'csv') {
+            return {
+                data: toCsv(rows, definition.columns),
+                contentType: 'text/csv',
+                filename: `${filename}.csv`,
+                rowCount: rows.length,
+            };
+        }
+        return {
+            data: JSON.stringify({ data: rows, exportedAt: new Date().toISOString(), total: rows.length }, null, 2),
+            contentType: 'application/json',
+            filename: `${filename}.json`,
+            rowCount: rows.length,
+        };
+    }
+    catch (error) {
+        try {
+            await client.query('ROLLBACK');
+        }
+        catch {
+            // The original error remains authoritative; releasing the connection handles cleanup.
+        }
+        throw error instanceof ExportOperationError
+            ? error
+            : new ExportOperationError('export_failed', 503);
+    }
+    finally {
+        client.release();
+    }
+}
+/** Prefix spreadsheet formula input after leading whitespace with an inert apostrophe. */
+function neutralizeFormula(value) {
+    const firstContent = value.search(/\S/);
+    if (firstContent === -1 || !['=', '+', '-', '@'].includes(value[firstContent]))
+        return value;
+    return `${value.slice(0, firstContent)}'${value.slice(firstContent)}`;
+}
+/** Serialize one CSV cell after formula neutralization and RFC-compatible quote escaping. */
+function escapeCsvValue(value) {
+    if (value === null || value === undefined)
+        return '';
+    const source = value instanceof Date ? value.toISOString() : String(value);
+    const safe = neutralizeFormula(source);
+    return /[",\r\n]/.test(safe) ? `"${safe.replace(/"/g, '""')}"` : safe;
+}
+/** Serialize rows using one exact ordered public column list. */
+function toCsv(rows, columns) {
+    const dataRows = rows.map((row) => columns.map((column) => escapeCsvValue(row[column])).join(','));
+    return [columns.join(','), ...dataRows].join('\r\n');
+}
+//# sourceMappingURL=data-export.js.map

package/dist/lib/data-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-export.js","sourceRoot":"","sources":["../../src/lib/data-export.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAQxC,qDAAqD;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAoC1C,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,2CAA2C;IAC3B,IAAI,CAAoB;IAExC,+BAA+B;IACf,MAAM,CAAkB;IAExC;;;;;OAKG;IACH,YAAmB,IAAuB,EAAE,MAAuB;QACjE,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AASD,MAAM,cAAc,GAA8D,MAAM,CAAC,MAAM,CAAC;IAC9F,KAAK,EAAE;QACL,GAAG,EAAE;;;;4CAImC;QACxC,OAAO,EAAE;YACP,IAAI;YACJ,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,aAAa;YACb,UAAU;YACV,QAAQ;YACR,gBAAgB;YAChB,cAAc;YACd,YAAY;YACZ,YAAY;YACZ,eAAe;YACf,aAAa;SACd;QACD,aAAa,EAAE,cAAc;KAC9B;IACD,aAAa,EAAE;QACb,GAAG,EAAE;6DACoD;QACzD,OAAO,EAAE;YACP,IAAI;YACJ,MAAM;YACN,MAAM;YACN,QAAQ;YACR,gBAAgB;YAChB,gBAAgB;YAChB,YAAY;YACZ,YAAY;SACb;QACD,aAAa,EAAE,MAAM;KACtB;IACD,OAAO,EAAE;QACP,GAAG,EAAE;;;4CAGmC;QACxC,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,aAAa;YACb,aAAa;YACb,QAAQ;YACR,kBAAkB;YAClB,aAAa;YACb,eAAe;YACf,YAAY;YACZ,YAAY;SACb;QACD,aAAa,EAAE,cAAc;KAC9B;IACD,KAAK,EAAE;QACL,GAAG,EAAE;;;;;;;4CAOmC;QACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC;QAC5D,aAAa,EAAE,8BAA8B;KAC9C;IACD,KAAK,EAAE;QACL,GAAG,EAAE;;;+CAGsC;QAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,CAAC;QACzF,aAAa,EAAE,OAAO;KACvB;CACF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,wBAAwB,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC1F,cAAc,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;IAC9F,cAAc,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;CACrD,CAAC,CAAC;AAEH,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,OAAsB,EAAE,UAAiC;IACjF,IAAI,UAAU,CAAC,aAAa,KAAK,MAAM,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,IACE,UAAU,CAAC,aAAa,KAAK,8BAA8B;QAC3D,OAAO,CAAC,aAAa,KAAK,SAAS,EACnC,CAAC;QACD,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,IAAI,oBAAoB,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,CAAC,aAAa,KAAK,8BAA8B,EAAE,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,UAAU,CAAC,aAAa,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,SAAiB,EAAE,QAAiB;IAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,wBAAwB,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS;YAC1B,KAAK,KAAK,IAAI,EACd,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CACnB,UAA4B,EAC5B,IAAwC;IAExC,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EACV,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC3F,CAAC,CAAC,CAAC;AACN,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,gBAAgB,CAC7B,MAAkB,EAClB,OAAsB,EACtB,QAAgB;IAEhB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IAC1C,MAAM,MAAM,CAAC,KAAK,CAChB;;oDAEgD,EAChD;QACE,OAAO,CAAC,cAAc,IAAI,IAAI;QAC9B,OAAO,CAAC,OAAO;QACf,IAAI,CAAC,SAAS,CAAC;YACb,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ;YACR,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1F,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACrF,CAAC;KACH,CACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,OAAsB;IAC/E,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO;IAC3C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC;;aAES,EACT,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,CAChD,CAAC;IACF,IAAI,YAAY,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAsB;IACrD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5D,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,UAAU,WAAW,SAAS,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;gBACrC,WAAW,EAAE,UAAU;gBACvB,QAAQ,EAAE,GAAG,QAAQ,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EACxE,IAAI,EACJ,CAAC,CACF;YACD,WAAW,EAAE,kBAAkB;YAC/B,QAAQ,EAAE,GAAG,QAAQ,OAAO;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;QACD,MAAM,KAAK,YAAY,oBAAoB;YACzC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,oBAAoB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,iBAAiB,CAAC,KAAa;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,iEAAiE;AACjE,SAAS,KAAK,CAAC,IAAwC,EAAE,OAA0B;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC/D,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/dist/lib/data-import-plan.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Pure import-manifest planning.
+ *
+ * The planner assigns every admitted entity a stable tenant-qualified natural key and explicit
+ * parent references before database mutation begins. Database-backed planning later resolves the
+ * returned external references against one consistent transaction snapshot.
+ */
+import type { ImportManifest } from './data-import.js';
+import type { PoolClient } from 'pg';
+/** Closed entity catalog accepted by the version 1.0 manifest. */
+export type ImportEntityType = 'organization' | 'application' | 'client' | 'role' | 'permission' | 'claim_definition' | 'role_permission_mapping' | 'application_module' | 'user' | 'user_role_assignment' | 'user_claim_value' | 'config';
+/** Parent reference which must exist in the manifest or the database snapshot. */
+export interface ImportPlanDependency {
+    readonly entityType: ImportEntityType;
+    readonly naturalKey: string;
+    readonly source: 'manifest' | 'database';
+}
+/** One deterministic manifest entry prepared for database-backed action planning. */
+export interface ImportPlanEntry {
+    readonly entityType: ImportEntityType;
+    readonly naturalKey: string;
+    readonly mutableFields: readonly string[];
+    readonly dependencies: readonly ImportPlanDependency[];
+    readonly credentialWillBeGenerated: boolean;
+}
+/** Immutable mutation-free plan produced from a validated manifest. */
+export interface ImportManifestPlan {
+    readonly version: '1.0';
+    readonly entries: readonly ImportPlanEntry[];
+    readonly externalDependencies: readonly ImportPlanDependency[];
+}
+/** Return whether a configuration key can carry authentication material. */
+export declare function isProhibitedImportConfigKey(configKey: string): boolean;
+/**
+ * Build a deterministic, mutation-free plan from a schema-validated manifest.
+ *
+ * @param manifest - Strictly parsed version 1.0 manifest.
+ * @returns Ordered entries and the exact parents that must be resolved from the database.
+ * @throws Error when a system configuration key could carry authentication material.
+ */
+export declare function buildImportManifestPlan(manifest: ImportManifest): ImportManifestPlan;
+/**
+ * Resolve every external parent against the current transaction snapshot.
+ *
+ * @param client - Transaction client used by the later import execution.
+ * @param plan - Pure manifest plan built before acquiring the client.
+ * @throws Error when a parent is missing or storage contains an ambiguous natural key.
+ */
+export declare function requireResolvedImportDependencies(client: PoolClient, plan: ImportManifestPlan): Promise<void>;
+//# sourceMappingURL=data-import-plan.d.ts.map

package/dist/lib/data-import-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-import-plan.d.ts","sourceRoot":"","sources":["../../src/lib/data-import-plan.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAErC,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GACxB,cAAc,GACd,aAAa,GACb,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,kBAAkB,GAClB,yBAAyB,GACzB,oBAAoB,GACpB,MAAM,GACN,sBAAsB,GACtB,kBAAkB,GAClB,QAAQ,CAAC;AAEb,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAAC;CAC1C;AAED,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvD,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;CAC7C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAChE;AA4BD,4EAA4E;AAC5E,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEtE;AAgDD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,cAAc,GAAG,kBAAkB,CAgKpF;AAoDD;;;;;;GAMG;AACH,wBAAsB,iCAAiC,CACrD,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/lib/data-import-plan.js

@@ -0,0 +1,235 @@
+/**
+ * Pure import-manifest planning.
+ *
+ * The planner assigns every admitted entity a stable tenant-qualified natural key and explicit
+ * parent references before database mutation begins. Database-backed planning later resolves the
+ * returned external references against one consistent transaction snapshot.
+ */
+const MUTABLE_FIELDS = Object.freeze({
+    organization: [
+        'name',
+        'default_locale',
+        'branding_primary_color',
+        'branding_company_name',
+        'branding_custom_css',
+        'branding_logo_url',
+        'branding_favicon_url',
+    ],
+    application: ['name', 'description'],
+    client: ['client_name'],
+    role: ['name', 'description'],
+    permission: ['name', 'description'],
+    claim_definition: ['name', 'description'],
+    role_permission_mapping: [],
+    application_module: ['name', 'description'],
+    user: ['given_name', 'family_name', 'locale'],
+    user_role_assignment: [],
+    user_claim_value: ['value'],
+    config: ['value'],
+});
+const PROHIBITED_CONFIG_KEY = /(^|_)(password|secret|private_key|signing_key|cookie_key|session_key|recovery_code|totp_secret)(_|$)/i;
+/** Return whether a configuration key can carry authentication material. */
+export function isProhibitedImportConfigKey(configKey) {
+    return PROHIBITED_CONFIG_KEY.test(configKey);
+}
+/** Join natural-key components without ambiguous concatenation. */
+function key(...parts) {
+    return parts.join('\u001f');
+}
+/** Split an internal natural key and reject malformed planner state. */
+function keyParts(naturalKey, expectedParts) {
+    const parts = naturalKey.split('\u001f');
+    if (parts.length !== expectedParts || parts.some((part) => part.length === 0)) {
+        throw new Error('Import plan contains an invalid natural key');
+    }
+    return parts;
+}
+/** Return a manifest/database reference for one required parent. */
+function dependency(entityType, naturalKey, manifestKeys) {
+    return Object.freeze({
+        entityType,
+        naturalKey,
+        source: manifestKeys.has(naturalKey) ? 'manifest' : 'database',
+    });
+}
+/** Add one immutable entry to the ordered plan. */
+function addEntry(entries, entityType, naturalKey, dependencies, credentialWillBeGenerated = false) {
+    entries.push(Object.freeze({
+        entityType,
+        naturalKey,
+        mutableFields: MUTABLE_FIELDS[entityType],
+        dependencies: Object.freeze([...dependencies]),
+        credentialWillBeGenerated,
+    }));
+}
+/**
+ * Build a deterministic, mutation-free plan from a schema-validated manifest.
+ *
+ * @param manifest - Strictly parsed version 1.0 manifest.
+ * @returns Ordered entries and the exact parents that must be resolved from the database.
+ * @throws Error when a system configuration key could carry authentication material.
+ */
+export function buildImportManifestPlan(manifest) {
+    const entries = [];
+    const organizationKeys = new Set(manifest.organizations.map((item) => item.slug));
+    const applicationKeys = new Set(manifest.applications.map((item) => item.slug));
+    const roleKeys = new Set(manifest.roles.map((item) => key(item.application_slug, item.slug)));
+    const permissionKeys = new Set(manifest.permissions.map((item) => key(item.application_slug, item.slug)));
+    const claimKeys = new Set(manifest.claim_definitions.map((item) => key(item.application_slug, item.slug)));
+    const userKeys = new Set(manifest.users.map((item) => key(item.organization_slug, item.email.toLowerCase())));
+    for (const organization of manifest.organizations) {
+        addEntry(entries, 'organization', organization.slug, []);
+    }
+    for (const application of manifest.applications) {
+        addEntry(entries, 'application', application.slug, [
+            dependency('organization', application.organization_slug, organizationKeys),
+        ]);
+    }
+    for (const client of manifest.clients) {
+        addEntry(entries, 'client', key(client.organization_slug, client.application_slug, client.client_name), [
+            dependency('organization', client.organization_slug, organizationKeys),
+            dependency('application', client.application_slug, applicationKeys),
+        ], client.client_type === 'confidential');
+    }
+    for (const role of manifest.roles) {
+        addEntry(entries, 'role', key(role.application_slug, role.slug), [
+            dependency('organization', role.organization_slug, organizationKeys),
+            dependency('application', role.application_slug, applicationKeys),
+        ]);
+    }
+    for (const permission of manifest.permissions) {
+        addEntry(entries, 'permission', key(permission.application_slug, permission.slug), [
+            dependency('organization', permission.organization_slug, organizationKeys),
+            dependency('application', permission.application_slug, applicationKeys),
+        ]);
+    }
+    for (const claim of manifest.claim_definitions) {
+        addEntry(entries, 'claim_definition', key(claim.application_slug, claim.slug), [
+            dependency('organization', claim.organization_slug, organizationKeys),
+            dependency('application', claim.application_slug, applicationKeys),
+        ]);
+    }
+    for (const mapping of manifest.role_permission_mappings) {
+        const dependencies = [
+            dependency('organization', mapping.organization_slug, organizationKeys),
+            dependency('application', mapping.application_slug, applicationKeys),
+            dependency('role', key(mapping.application_slug, mapping.role_slug), roleKeys),
+            ...mapping.permission_slugs.map((slug) => dependency('permission', key(mapping.application_slug, slug), permissionKeys)),
+        ];
+        addEntry(entries, 'role_permission_mapping', key(mapping.application_slug, mapping.role_slug), dependencies);
+    }
+    for (const module of manifest.application_modules) {
+        addEntry(entries, 'application_module', key(module.application_slug, module.slug), [
+            dependency('organization', module.organization_slug, organizationKeys),
+            dependency('application', module.application_slug, applicationKeys),
+        ]);
+    }
+    for (const user of manifest.users) {
+        addEntry(entries, 'user', key(user.organization_slug, user.email.toLowerCase()), [
+            dependency('organization', user.organization_slug, organizationKeys),
+        ]);
+    }
+    for (const assignment of manifest.user_role_assignments) {
+        addEntry(entries, 'user_role_assignment', key(assignment.organization_slug, assignment.application_slug, assignment.email.toLowerCase(), assignment.role_slug), [
+            dependency('organization', assignment.organization_slug, organizationKeys),
+            dependency('application', assignment.application_slug, applicationKeys),
+            dependency('user', key(assignment.organization_slug, assignment.email.toLowerCase()), userKeys),
+            dependency('role', key(assignment.application_slug, assignment.role_slug), roleKeys),
+        ]);
+    }
+    for (const claimValue of manifest.user_claim_values) {
+        addEntry(entries, 'user_claim_value', key(claimValue.organization_slug, claimValue.application_slug, claimValue.email.toLowerCase(), claimValue.claim_slug), [
+            dependency('organization', claimValue.organization_slug, organizationKeys),
+            dependency('application', claimValue.application_slug, applicationKeys),
+            dependency('user', key(claimValue.organization_slug, claimValue.email.toLowerCase()), userKeys),
+            dependency('claim_definition', key(claimValue.application_slug, claimValue.claim_slug), claimKeys),
+        ]);
+    }
+    for (const configKey of Object.keys(manifest.config ?? {}).sort()) {
+        if (isProhibitedImportConfigKey(configKey)) {
+            throw new Error('Import manifest contains prohibited authentication material');
+        }
+        addEntry(entries, 'config', configKey, []);
+    }
+    const externalByKey = new Map();
+    for (const entry of entries) {
+        for (const required of entry.dependencies) {
+            if (required.source === 'database') {
+                externalByKey.set(key(required.entityType, required.naturalKey), required);
+            }
+        }
+    }
+    return Object.freeze({
+        version: '1.0',
+        entries: Object.freeze(entries),
+        externalDependencies: Object.freeze([...externalByKey.values()]),
+    });
+}
+/** Resolve one database-owned parent without exposing its identifier in an error. */
+async function databaseDependencyExists(client, required) {
+    if (required.entityType === 'organization') {
+        const result = await client.query('SELECT 1 FROM organizations WHERE slug = $1', [
+            required.naturalKey,
+        ]);
+        return result.rowCount === 1;
+    }
+    if (required.entityType === 'application') {
+        const result = await client.query('SELECT 1 FROM applications WHERE slug = $1', [
+            required.naturalKey,
+        ]);
+        return result.rowCount === 1;
+    }
+    if (required.entityType === 'role' ||
+        required.entityType === 'permission' ||
+        required.entityType === 'claim_definition') {
+        const [applicationSlug, entitySlug] = keyParts(required.naturalKey, 2);
+        const table = required.entityType === 'role'
+            ? 'roles'
+            : required.entityType === 'permission'
+                ? 'permissions'
+                : 'claim_definitions';
+        const result = await client.query(`SELECT 1 FROM ${table} entity
+       JOIN applications application ON application.id = entity.application_id
+       WHERE application.slug = $1 AND entity.slug = $2`, [applicationSlug, entitySlug]);
+        return result.rowCount === 1;
+    }
+    if (required.entityType === 'user') {
+        const [organizationSlug, email] = keyParts(required.naturalKey, 2);
+        const result = await client.query(`SELECT 1 FROM users user_account
+       JOIN organizations organization ON organization.id = user_account.organization_id
+       WHERE organization.slug = $1 AND user_account.email = $2`, [organizationSlug, email]);
+        return result.rowCount === 1;
+    }
+    throw new Error('Import plan contains an unsupported external dependency');
+}
+/**
+ * Resolve every external parent against the current transaction snapshot.
+ *
+ * @param client - Transaction client used by the later import execution.
+ * @param plan - Pure manifest plan built before acquiring the client.
+ * @throws Error when a parent is missing or storage contains an ambiguous natural key.
+ */
+export async function requireResolvedImportDependencies(client, plan) {
+    for (const required of plan.externalDependencies) {
+        if (!(await databaseDependencyExists(client, required))) {
+            throw new Error('Import manifest contains a missing or unauthorized parent reference');
+        }
+    }
+    for (const entry of plan.entries) {
+        if (entry.entityType !== 'client')
+            continue;
+        const [organizationSlug, applicationSlug, clientName] = keyParts(entry.naturalKey, 3);
+        const result = await client.query(`SELECT COUNT(*)::integer AS count
+       FROM clients client
+       JOIN organizations organization ON organization.id = client.organization_id
+       JOIN applications application ON application.id = client.application_id
+       WHERE organization.slug = $1
+         AND application.slug = $2
+         AND client.client_name = $3`, [organizationSlug, applicationSlug, clientName]);
+        const count = Number(result.rows[0]?.count ?? 0);
+        if (!Number.isSafeInteger(count) || count > 1) {
+            throw new Error('Import manifest natural key collides with ambiguous stored data');
+        }
+    }
+}
+//# sourceMappingURL=data-import-plan.js.map

package/dist/lib/data-import-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-import-plan.js","sourceRoot":"","sources":["../../src/lib/data-import-plan.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2CH,MAAM,cAAc,GAA0D,MAAM,CAAC,MAAM,CAAC;IAC1F,YAAY,EAAE;QACZ,MAAM;QACN,gBAAgB;QAChB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;QACrB,mBAAmB;QACnB,sBAAsB;KACvB;IACD,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACpC,MAAM,EAAE,CAAC,aAAa,CAAC;IACvB,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IAC7B,UAAU,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACnC,gBAAgB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IACzC,uBAAuB,EAAE,EAAE;IAC3B,kBAAkB,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;IAC3C,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,EAAE,QAAQ,CAAC;IAC7C,oBAAoB,EAAE,EAAE;IACxB,gBAAgB,EAAE,CAAC,OAAO,CAAC;IAC3B,MAAM,EAAE,CAAC,OAAO,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GACzB,uGAAuG,CAAC;AAE1G,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B,CAAC,SAAiB;IAC3D,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,mEAAmE;AACnE,SAAS,GAAG,CAAC,GAAG,KAAwB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,UAAkB,EAAE,aAAqB;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CACjB,UAA4B,EAC5B,UAAkB,EAClB,YAAiC;IAEjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;KAC/D,CAAC,CAAC;AACL,CAAC;AAED,mDAAmD;AACnD,SAAS,QAAQ,CACf,OAA0B,EAC1B,UAA4B,EAC5B,UAAkB,EAClB,YAA6C,EAC7C,yBAAyB,GAAG,KAAK;IAEjC,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,CAAC;QACZ,UAAU;QACV,UAAU;QACV,aAAa,EAAE,cAAc,CAAC,UAAU,CAAC;QACzC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;QAC9C,yBAAyB;KAC1B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAwB;IAC9D,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAC1E,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAChF,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CACpF,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAClD,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,IAAI,EAAE;YACjD,UAAU,CAAC,cAAc,EAAE,WAAW,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,QAAQ,CACN,OAAO,EACP,QAAQ,EACR,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,EAC1E;YACE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACtE,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACpE,EACD,MAAM,CAAC,WAAW,KAAK,cAAc,CACtC,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;YAC/D,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACpE,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;YACjF,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC7E,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACrE,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QACxD,MAAM,YAAY,GAA2B;YAC3C,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACvE,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACpE,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;YAC9E,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACvC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAC9E;SACF,CAAC;QACF,QAAQ,CACN,OAAO,EACP,yBAAyB,EACzB,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,EAChD,YAAY,CACb,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAClD,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;YACjF,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YACtE,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;YAC/E,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACxD,QAAQ,CACN,OAAO,EACP,sBAAsB,EACtB,GAAG,CACD,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,gBAAgB,EAC3B,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAC9B,UAAU,CAAC,SAAS,CACrB,EACD;YACE,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACvE,UAAU,CACR,MAAM,EACN,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EACjE,QAAQ,CACT;YACD,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;SACrF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACpD,QAAQ,CACN,OAAO,EACP,kBAAkB,EAClB,GAAG,CACD,UAAU,CAAC,iBAAiB,EAC5B,UAAU,CAAC,gBAAgB,EAC3B,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAC9B,UAAU,CAAC,UAAU,CACtB,EACD;YACE,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;YAC1E,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,EAAE,eAAe,CAAC;YACvE,UAAU,CACR,MAAM,EACN,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EACjE,QAAQ,CACT;YACD,UAAU,CACR,kBAAkB,EAClB,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC,EACvD,SAAS,CACV;SACF,CACF,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClE,IAAI,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACnC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;KACjE,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,wBAAwB,CACrC,MAAkB,EAClB,QAA8B;IAE9B,IAAI,QAAQ,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE;YAC/E,QAAQ,CAAC,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAC9E,QAAQ,CAAC,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,KAAK,MAAM;QAC9B,QAAQ,CAAC,UAAU,KAAK,YAAY;QACpC,QAAQ,CAAC,UAAU,KAAK,kBAAkB,EAC1C,CAAC;QACD,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,KAAK,GACT,QAAQ,CAAC,UAAU,KAAK,MAAM;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,YAAY;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,mBAAmB,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,iBAAiB,KAAK;;wDAE4B,EAClD,CAAC,eAAe,EAAE,UAAU,CAAC,CAC9B,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;gEAE0D,EAC1D,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAC1B,CAAC;QACF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,MAAkB,EAClB,IAAwB;IAExB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;;;;;;qCAM+B,EAC/B,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC,CAChD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC"}