@portaidentity/server 1.7.3 → 1.8.0

package/dist/portability/cleanup.js

@@ -0,0 +1,167 @@
+/** Targeted cache and authority cleanup for committed portability imports. */
+import { invalidateApplicationCache } from '../applications/cache.js';
+import { invalidateClientCache } from '../clients/cache.js';
+import { invalidateDefinitionsCache } from '../custom-claims/cache.js';
+import { revokeAffectedAuthorityInTransaction } from '../lib/authority-revocation.js';
+import { afterDatabaseCommit, runDatabaseTransaction } from '../lib/database.js';
+import { registerAuthorityCleanup } from '../lib/deletion-cleanup.js';
+import { invalidateOrganizationCache } from '../organizations/cache.js';
+import { invalidateRoleCache, invalidateUserRbacCache } from '../rbac/cache.js';
+import { invalidateUserCache } from '../users/cache.js';
+import { key, normalizedEmail, normalizedRbac, normalizedSlug } from './plan-support.js';
+/**
+ * Return whether one public result record was created or updated.
+ *
+ * @param plan - Completed write plan
+ * @param entityType - Portable collection containing the record
+ * @param encodedKey - JSON-encoded public natural key
+ * @returns True when the record changed destination state
+ */
+function changed(plan, entityType, encodedKey) {
+    return plan.result.items.some((item) => item.entity_type === entityType &&
+        JSON.stringify(item.natural_key) === encodedKey &&
+        item.action !== 'skipped');
+}
+/**
+ * Register cache invalidation for every created or updated cached record.
+ *
+ * @param plan - Completed write plan
+ * @param ids - Destination identifiers resolved by the writers
+ */
+async function registerCacheInvalidation(plan, ids) {
+    const rbacUserIds = new Set();
+    for (const record of plan.manifest.organizations) {
+        if (!changed(plan, 'organizations', JSON.stringify({ slug: record.slug })))
+            continue;
+        const id = ids.organizationIds.get(normalizedSlug(record.slug));
+        if (id !== undefined)
+            await invalidateOrganizationCache(record.slug, id);
+    }
+    for (const record of plan.manifest.applications) {
+        if (!changed(plan, 'applications', JSON.stringify({ slug: record.slug })))
+            continue;
+        const id = ids.applicationIds.get(normalizedSlug(record.slug));
+        if (id !== undefined)
+            await invalidateApplicationCache(record.slug, id);
+    }
+    for (const record of plan.manifest.roles) {
+        const naturalKey = { application_slug: record.application_slug, slug: record.slug };
+        if (!changed(plan, 'roles', JSON.stringify(naturalKey)))
+            continue;
+        const id = ids.roleIds.get(key(normalizedSlug(record.application_slug), normalizedRbac(record.slug)));
+        if (id !== undefined)
+            await invalidateRoleCache(id);
+    }
+    for (const record of plan.manifest.claim_definitions) {
+        const naturalKey = {
+            application_slug: record.application_slug,
+            claim_name: record.claim_name,
+        };
+        if (!changed(plan, 'claim_definitions', JSON.stringify(naturalKey)))
+            continue;
+        const applicationId = ids.applicationIds.get(normalizedSlug(record.application_slug));
+        if (applicationId !== undefined)
+            await invalidateDefinitionsCache(applicationId);
+    }
+    for (const record of plan.manifest.users) {
+        const naturalKey = { organization_slug: record.organization_slug, email: record.email };
+        if (!changed(plan, 'users', JSON.stringify(naturalKey)))
+            continue;
+        const id = ids.userIds.get(key(normalizedSlug(record.organization_slug), normalizedEmail(record.email)));
+        if (id !== undefined)
+            await invalidateUserCache(id);
+    }
+    for (const record of plan.manifest.user_role_assignments) {
+        const naturalKey = {
+            organization_slug: record.organization_slug,
+            email: record.email,
+            application_slug: record.application_slug,
+            role_slug: record.role_slug,
+        };
+        if (!changed(plan, 'user_role_assignments', JSON.stringify(naturalKey)))
+            continue;
+        const id = ids.userIds.get(key(normalizedSlug(record.organization_slug), normalizedEmail(record.email)));
+        if (id !== undefined)
+            rbacUserIds.add(id);
+    }
+    for (const record of plan.manifest.role_permission_mappings) {
+        const naturalKey = {
+            application_slug: record.application_slug,
+            role_slug: record.role_slug,
+        };
+        if (!changed(plan, 'role_permission_mappings', JSON.stringify(naturalKey)))
+            continue;
+        for (const assignment of plan.snapshot.userRoles) {
+            if (normalizedSlug(assignment.application_slug) !== normalizedSlug(record.application_slug) ||
+                normalizedRbac(assignment.role_slug) !== normalizedRbac(record.role_slug)) {
+                continue;
+            }
+            const id = ids.userIds.get(key(normalizedSlug(assignment.organization_slug), normalizedEmail(assignment.email)));
+            if (id !== undefined)
+                rbacUserIds.add(id);
+        }
+    }
+    for (const id of [...rbacUserIds].sort())
+        await invalidateUserRbacCache(id);
+    for (const record of plan.manifest.clients) {
+        if (!changed(plan, 'clients', JSON.stringify({ client_id: record.client_id })))
+            continue;
+        const id = ids.clientIds.get(record.client_id);
+        if (id !== undefined)
+            await invalidateClientCache(record.client_id, id);
+    }
+}
+/**
+ * Find existing users whose import changes active authority to inactive.
+ *
+ * @param plan - Completed write plan and pre-write destination snapshot
+ * @param ids - Destination identifiers resolved by the writers
+ * @returns Sorted unique identifiers for users whose sessions must be revoked
+ */
+function deactivatedUserIds(plan, ids) {
+    const destinationUsers = new Map(plan.snapshot.users.map((row) => [
+        key(normalizedSlug(row.organization_slug), normalizedEmail(row.email)),
+        row,
+    ]));
+    const affected = new Set();
+    for (const record of plan.manifest.users) {
+        if (record.status !== 'inactive')
+            continue;
+        const userKey = key(normalizedSlug(record.organization_slug), normalizedEmail(record.email));
+        const destination = destinationUsers.get(userKey);
+        if (destination === undefined || destination.status === 'inactive')
+            continue;
+        const id = ids.userIds.get(userKey);
+        if (id !== undefined)
+            affected.add(id);
+    }
+    return [...affected].sort();
+}
+/**
+ * Register exact cache invalidation and affected-user revocation for the commit boundary.
+ *
+ * The authority callback starts only after the import commits. Its short PostgreSQL transaction
+ * revokes durable sessions and grant rows, then the existing cleanup helper schedules Redis work
+ * without keeping a PostgreSQL transaction open for Redis.
+ *
+ * @param plan - Valid plan and destination snapshot used by the apply transaction
+ * @param ids - Destination identifiers resolved by successful writes
+ */
+export async function registerPortabilityCleanup(plan, ids) {
+    await registerCacheInvalidation(plan, ids);
+    const userIds = deactivatedUserIds(plan, ids);
+    if (userIds.length === 0)
+        return;
+    await afterDatabaseCommit(async () => {
+        await runDatabaseTransaction(async () => {
+            const revoked = await revokeAffectedAuthorityInTransaction(userIds);
+            await registerAuthorityCleanup({
+                userIds,
+                grantIds: revoked.grantIds,
+                roleIds: [],
+                revokeOidcState: true,
+            });
+        });
+    });
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/portability/cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../src/portability/cleanup.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAmBzF;;;;;;;GAOG;AACH,SAAS,OAAO,CACd,IAA6B,EAC7B,UAAiC,EACjC,UAAkB;IAElB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,WAAW,KAAK,UAAU;QAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,UAAU;QAC/C,IAAI,CAAC,MAAM,KAAK,SAAS,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,yBAAyB,CACtC,IAA6B,EAC7B,GAAwB;IAExB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,SAAS;QACrF,MAAM,EAAE,GAAG,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAAE,SAAS;QACpF,MAAM,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,0BAA0B,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CACxB,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAC1E,CAAC;QACF,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAC9E,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtF,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACxF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAClE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CACxB,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;QACF,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG;YACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QAClF,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CACxB,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC7E,CAAC;QACF,IAAI,EAAE,KAAK,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAAE,SAAS;QACrF,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,IACE,cAAc,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACvF,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EACzE,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CACxB,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CACrF,CAAC;YACF,IAAI,EAAE,KAAK,SAAS;gBAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE;QAAE,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAAE,SAAS;QACzF,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,IAA6B,EAC7B,GAAwB;IAExB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/B,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtE,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7F,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAC7E,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,EAAE,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAA6B,EAC7B,GAAwB;IAExB,MAAM,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,MAAM,sBAAsB,CAAC,KAAK,IAAI,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,oCAAoC,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,wBAAwB,CAAC;gBAC7B,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,EAAE;gBACX,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/portability/export.d.ts

@@ -0,0 +1,18 @@
+/** Selective portability export service boundary. */
+import { type ExportManifestRequest, type PortabilityActor, type PortabilityManifest } from './types.js';
+/** Manifest and safe attachment name produced by one export snapshot. */
+export interface PortabilityExport {
+    /** Complete validated portability manifest. */
+    readonly manifest: PortabilityManifest;
+    /** Safe basename returned in Content-Disposition. */
+    readonly filename: string;
+}
+/**
+ * Export the selected portable graph.
+ *
+ * @param request - Validated export selection
+ * @param actor - Authenticated audit actor
+ * @returns Exported manifest and attachment name
+ */
+export declare function exportPortabilityManifest(request: ExportManifestRequest, actor: PortabilityActor): Promise<PortabilityExport>;
+//# sourceMappingURL=export.d.ts.map

package/dist/portability/export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.d.ts","sourceRoot":"","sources":["../../src/portability/export.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAerD,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,YAAY,CAAC;AAKpB,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA4BD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,qBAAqB,EAC9B,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAmG5B"}

package/dist/portability/export.js

@@ -0,0 +1,125 @@
+/** Selective portability export service boundary. */
+import { createHash } from 'node:crypto';
+import { writeAuditLogInTransaction } from '../lib/audit-log.js';
+import { getPool } from '../lib/database.js';
+import { portabilityManifestSchema } from './schema.js';
+import { attachOrganizationBrandingAssets, readApplicationExportSelection, readAuthorizationExportGraph, readClientExportRecords, readOrganizationExportScope, readUserExportGraph, } from './repository.js';
+import { PortabilityError, } from './types.js';
+/** Maximum UTF-8 manifest size accepted by the matching import boundary. */
+const MAXIMUM_MANIFEST_BYTES = 64 * 1024 * 1024;
+/** Build non-sensitive per-collection counts for the export audit event. */
+function recordCounts(manifest) {
+    return {
+        organizations: manifest.organizations.length,
+        applications: manifest.applications.length,
+        application_modules: manifest.application_modules.length,
+        roles: manifest.roles.length,
+        permissions: manifest.permissions.length,
+        claim_definitions: manifest.claim_definitions.length,
+        role_permission_mappings: manifest.role_permission_mappings.length,
+        users: manifest.users.length,
+        user_role_assignments: manifest.user_role_assignments.length,
+        user_claim_values: manifest.user_claim_values.length,
+        clients: manifest.clients.length,
+    };
+}
+/** Roll back without replacing the original export failure. */
+async function rollbackQuietly(client) {
+    try {
+        await client.query('ROLLBACK');
+    }
+    catch {
+        // Releasing the failed connection handles cleanup; the original failure remains authoritative.
+    }
+}
+/**
+ * Export the selected portable graph.
+ *
+ * @param request - Validated export selection
+ * @param actor - Authenticated audit actor
+ * @returns Exported manifest and attachment name
+ */
+export async function exportPortabilityManifest(request, actor) {
+    const client = await getPool().connect();
+    try {
+        await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ');
+        const organizationScope = await readOrganizationExportScope(client, request.scope, actor.controlPlaneOrganizationId);
+        const selectsApplicationData = request.categories.some((category) => category !== 'organizations');
+        const applicationSelection = selectsApplicationData
+            ? await readApplicationExportSelection(client, request.application_selection)
+            : { applicationIds: [], applications: [] };
+        const includesAuthorization = request.categories.includes('applications_authorization');
+        const authorization = includesAuthorization
+            ? await readAuthorizationExportGraph(client, applicationSelection.applicationIds)
+            : {
+                applicationModules: [],
+                roles: [],
+                permissions: [],
+                claimDefinitions: [],
+                rolePermissionMappings: [],
+            };
+        const organizations = request.categories.includes('organizations')
+            ? await attachOrganizationBrandingAssets(client, organizationScope.organizations, organizationScope.organizationIds)
+            : [];
+        const userGraph = request.categories.includes('users_assignments')
+            ? await readUserExportGraph(client, organizationScope.organizationIds, applicationSelection.applicationIds)
+            : { users: [], userRoleAssignments: [], userClaimValues: [] };
+        const clients = request.categories.includes('oidc_clients')
+            ? await readClientExportRecords(client, organizationScope.organizationIds, applicationSelection.applicationIds)
+            : [];
+        const exportedAt = new Date().toISOString();
+        const manifest = portabilityManifestSchema.parse({
+            version: '1.0',
+            exported_at: exportedAt,
+            scope: request.scope,
+            categories: [...request.categories].sort(),
+            application_selection: {
+                all_applications: request.application_selection.all_applications,
+                application_slugs: [...request.application_selection.application_slugs].sort(),
+            },
+            organizations,
+            applications: includesAuthorization ? applicationSelection.applications : [],
+            application_modules: authorization.applicationModules,
+            roles: authorization.roles,
+            permissions: authorization.permissions,
+            claim_definitions: authorization.claimDefinitions,
+            role_permission_mappings: authorization.rolePermissionMappings,
+            users: userGraph.users,
+            user_role_assignments: userGraph.userRoleAssignments,
+            user_claim_values: userGraph.userClaimValues,
+            clients,
+        });
+        const serialized = JSON.stringify(manifest);
+        if (Buffer.byteLength(serialized, 'utf8') > MAXIMUM_MANIFEST_BYTES) {
+            throw new PortabilityError(413, 'export_manifest_too_large', 'Export manifest is too large');
+        }
+        await writeAuditLogInTransaction(client, {
+            organizationId: request.scope.kind === 'organization'
+                ? organizationScope.organizationIds[0]
+                : actor.controlPlaneOrganizationId,
+            actorId: actor.userId,
+            eventType: 'admin.export',
+            eventCategory: 'admin',
+            metadata: {
+                manifest_version: manifest.version,
+                sha256_digest: createHash('sha256').update(serialized).digest('hex'),
+                mode: request.scope.kind,
+                categories: manifest.categories,
+                record_counts: recordCounts(manifest),
+            },
+        });
+        await client.query('COMMIT');
+        return {
+            manifest,
+            filename: `porta-manifest-${exportedAt.replace(/[:.]/g, '-')}.json`,
+        };
+    }
+    catch (error) {
+        await rollbackQuietly(client);
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+//# sourceMappingURL=export.js.map

package/dist/portability/export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export.js","sourceRoot":"","sources":["../../src/portability/export.ts"],"names":[],"mappings":"AAAA,qDAAqD;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAUhD,4EAA4E;AAC5E,SAAS,YAAY,CAAC,QAA6B;IACjD,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;QAC5C,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM;QAC1C,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,MAAM;QACxD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QAC5B,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM;QACxC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,MAAM;QACpD,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,MAAM;QAClE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;QAC5B,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,CAAC,MAAM;QAC5D,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,MAAM;QACpD,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;KACjC,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,eAAe,CAAC,MAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;IACjG,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAA8B,EAC9B,KAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CACzD,MAAM,EACN,OAAO,CAAC,KAAK,EACb,KAAK,CAAC,0BAA0B,CACjC,CAAC;QACF,MAAM,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CACpD,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,eAAe,CAC3C,CAAC;QACF,MAAM,oBAAoB,GAAG,sBAAsB;YACjD,CAAC,CAAC,MAAM,8BAA8B,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC;YAC7E,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC7C,MAAM,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QACxF,MAAM,aAAa,GAAG,qBAAqB;YACzC,CAAC,CAAC,MAAM,4BAA4B,CAAC,MAAM,EAAE,oBAAoB,CAAC,cAAc,CAAC;YACjF,CAAC,CAAC;gBACE,kBAAkB,EAAE,EAAE;gBACtB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;gBACf,gBAAgB,EAAE,EAAE;gBACpB,sBAAsB,EAAE,EAAE;aAC3B,CAAC;QACN,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;YAChE,CAAC,CAAC,MAAM,gCAAgC,CACpC,MAAM,EACN,iBAAiB,CAAC,aAAa,EAC/B,iBAAiB,CAAC,eAAe,CAClC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAChE,CAAC,CAAC,MAAM,mBAAmB,CACvB,MAAM,EACN,iBAAiB,CAAC,eAAe,EACjC,oBAAoB,CAAC,cAAc,CACpC;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC;YACzD,CAAC,CAAC,MAAM,uBAAuB,CAC3B,MAAM,EACN,iBAAiB,CAAC,eAAe,EACjC,oBAAoB,CAAC,cAAc,CACpC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;YAC1C,qBAAqB,EAAE;gBACrB,gBAAgB,EAAE,OAAO,CAAC,qBAAqB,CAAC,gBAAgB;gBAChE,iBAAiB,EAAE,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE;aAC/E;YACD,aAAa;YACb,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;YAC5E,mBAAmB,EAAE,aAAa,CAAC,kBAAkB;YACrD,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,iBAAiB,EAAE,aAAa,CAAC,gBAAgB;YACjD,wBAAwB,EAAE,aAAa,CAAC,sBAAsB;YAC9D,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,qBAAqB,EAAE,SAAS,CAAC,mBAAmB;YACpD,iBAAiB,EAAE,SAAS,CAAC,eAAe;YAC5C,OAAO;SACR,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,EAAE,8BAA8B,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,0BAA0B,CAAC,MAAM,EAAE;YACvC,cAAc,EACZ,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;gBACnC,CAAC,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC;gBACtC,CAAC,CAAC,KAAK,CAAC,0BAA0B;YACtC,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE;gBACR,gBAAgB,EAAE,QAAQ,CAAC,OAAO;gBAClC,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC;aACtC;SACF,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;YACL,QAAQ;YACR,QAAQ,EAAE,kBAAkB,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/portability/import-repository.d.ts

@@ -0,0 +1,204 @@
+/** Explicit PostgreSQL reads used to plan selective portability imports. */
+import type { PortabilityApplication, PortabilityApplicationModule, PortabilityClaimDefinition, PortabilityClient, PortabilityManifest, PortabilityJsonValue, PortabilityOrganization, PortabilityPermission, PortabilityRole, PortabilityUser } from './types.js';
+/** Destination organization fields needed for matching and mutable-value comparison. */
+export interface ImportOrganizationRow extends Omit<PortabilityOrganization, 'branding'> {
+    /** Internal identifier used only to resolve relationships inside the transaction. */
+    readonly id: string;
+    /** Whether this is Porta's protected control-plane organization. */
+    readonly is_super_admin: boolean;
+    /** Stored external logo URL. */
+    readonly branding_logo_url: string | null;
+    /** Stored external favicon URL. */
+    readonly branding_favicon_url: string | null;
+    /** Stored HTML accent color. */
+    readonly branding_primary_color: string | null;
+    /** Stored hosted-page company name. */
+    readonly branding_company_name: string | null;
+    /** Stored hosted-page custom CSS. */
+    readonly branding_custom_css: string | null;
+}
+/** Stored organization branding bytes needed for exact update planning. */
+export interface ImportBrandingAssetRow {
+    /** Owning organization's public slug. */
+    readonly organization_slug: string;
+    /** Branding slot occupied by these bytes. */
+    readonly asset_type: 'logo' | 'favicon';
+    /** Validated image media type. */
+    readonly content_type: string;
+    /** Validated stored image bytes. */
+    readonly data: Buffer;
+}
+/** Destination application fields needed for matching and comparison. */
+export interface ImportApplicationRow extends PortabilityApplication {
+    /** Internal identifier used only to resolve children. */
+    readonly id: string;
+}
+/** Destination application-module fields plus internal relationship identifiers. */
+export interface ImportModuleRow extends PortabilityApplicationModule {
+    /** Internal module identifier used only by writers. */
+    readonly id: string;
+    /** Internal application identifier used only by writers. */
+    readonly application_id: string;
+}
+/** Destination role fields plus internal relationship identifiers. */
+export interface ImportRoleRow extends PortabilityRole {
+    /** Internal role identifier used only by writers. */
+    readonly id: string;
+    /** Internal application identifier used only by writers. */
+    readonly application_id: string;
+}
+/** Destination permission fields plus internal relationship identifiers. */
+export interface ImportPermissionRow extends PortabilityPermission {
+    /** Internal permission identifier used only by writers. */
+    readonly id: string;
+    /** Internal application identifier used only by writers. */
+    readonly application_id: string;
+    /** Internal module identifier, or null for application-wide permission. */
+    readonly module_id: string | null;
+}
+/** Destination custom-claim definition plus its internal identifier. */
+export interface ImportClaimDefinitionRow extends PortabilityClaimDefinition {
+    /** Internal claim identifier used only by writers. */
+    readonly id: string;
+    /** Internal application identifier used only by writers. */
+    readonly application_id: string;
+}
+/** Existing role-to-permission edges aggregated for one public role natural key. */
+export interface ImportRolePermissionRow {
+    /** Owning application slug. */
+    readonly application_slug: string;
+    /** Role claim value. */
+    readonly role_slug: string;
+    /** Existing permission claim values for this role. */
+    readonly permission_slugs: readonly string[];
+}
+/** Destination user fields plus internal ownership identifiers. */
+export interface ImportUserRow extends PortabilityUser {
+    /** Internal user identifier used only by writers. */
+    readonly id: string;
+    /** Internal organization identifier used only by writers. */
+    readonly organization_id: string;
+}
+/** One existing user-to-role edge, qualified by public natural keys. */
+export interface ImportUserRoleRow {
+    /** Owning organization slug. */
+    readonly organization_slug: string;
+    /** Assigned user's normalized email. */
+    readonly email: string;
+    /** Owning application slug. */
+    readonly application_slug: string;
+    /** Assigned role claim value. */
+    readonly role_slug: string;
+}
+/** One existing user claim value, qualified by public natural keys. */
+export interface ImportUserClaimValueRow {
+    /** Owning organization slug. */
+    readonly organization_slug: string;
+    /** Assigned user's normalized email. */
+    readonly email: string;
+    /** Owning application slug. */
+    readonly application_slug: string;
+    /** Custom claim name. */
+    readonly claim_name: string;
+    /** Existing JSON-compatible claim value. */
+    readonly value: PortabilityJsonValue;
+}
+/** Destination OIDC client fields plus internal ownership identifiers. */
+export interface ImportClientRow extends PortabilityClient {
+    /** Internal client identifier used only by writers. */
+    readonly id: string;
+    /** Internal organization identifier used only by writers. */
+    readonly organization_id: string;
+    /** Internal application identifier used only by writers. */
+    readonly application_id: string;
+}
+/** Complete destination state required by the mutation-free import planner. */
+export interface PortabilityImportSnapshot {
+    /** Destination organizations. */
+    readonly organizations: readonly ImportOrganizationRow[];
+    /** Destination branding image records. */
+    readonly brandingAssets: readonly ImportBrandingAssetRow[];
+    /** Destination applications. */
+    readonly applications: readonly ImportApplicationRow[];
+    /** Destination application modules. */
+    readonly applicationModules: readonly ImportModuleRow[];
+    /** Destination roles. */
+    readonly roles: readonly ImportRoleRow[];
+    /** Destination permissions. */
+    readonly permissions: readonly ImportPermissionRow[];
+    /** Destination custom-claim definitions. */
+    readonly claimDefinitions: readonly ImportClaimDefinitionRow[];
+    /** Destination role-to-permission edges. */
+    readonly rolePermissions: readonly ImportRolePermissionRow[];
+    /** Destination users. */
+    readonly users: readonly ImportUserRow[];
+    /** Destination user-to-role edges. */
+    readonly userRoles: readonly ImportUserRoleRow[];
+    /** Destination custom-claim values. */
+    readonly userClaimValues: readonly ImportUserClaimValueRow[];
+    /** Destination OIDC clients. */
+    readonly clients: readonly ImportClientRow[];
+}
+/**
+ * Read the small destination catalog used to plan an import.
+ *
+ * The product is configured by an administrator and does not need large-data streaming here.
+ * Explicit columns keep credentials, lock state, audit data, and other non-portable fields out of
+ * planner memory. The surrounding request transaction provides the consistent snapshot.
+ *
+ * @param manifest - Normalized scope, category, application selection, and imported client IDs
+ * @returns Destination records with internal identifiers retained only for relationship matching
+ */
+export declare function readPortabilityImportSnapshot(manifest: PortabilityManifest): Promise<PortabilityImportSnapshot>;
+/**
+ * Insert or update one organization and its optional branding assets.
+ *
+ * @param record - Strict portable organization fields
+ * @param destinationId - Existing identifier for update, or null for create
+ * @param destinationAssetTypes - Branding slots which currently contain stored bytes
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityOrganization(record: PortabilityOrganization, destinationId: string | null, destinationAssetTypes: ReadonlySet<'logo' | 'favicon'>): Promise<string>;
+/**
+ * @param record - Strict portable application fields
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityApplication(record: PortabilityApplication, destinationId: string | null): Promise<string>;
+/**
+ * @param record - Strict portable module fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityModule(record: PortabilityApplicationModule, applicationId: string, destinationId: string | null): Promise<string>;
+/**
+ * @param record - Strict portable role fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityRole(record: PortabilityRole, applicationId: string, destinationId: string | null): Promise<string>;
+/**
+ * @param record - Strict portable permission fields
+ * @param applicationId - Resolved parent application identifier
+ * @param moduleId - Resolved optional module identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityPermission(record: PortabilityPermission, applicationId: string, moduleId: string | null, destinationId: string | null): Promise<string>;
+/**
+ * @param record - Strict portable claim-definition fields
+ * @param applicationId - Resolved parent application identifier
+ * @param destinationId - Existing identifier for update, or null for create
+ * @returns Authoritative destination identifier
+ */
+export declare function writePortabilityClaimDefinition(record: PortabilityClaimDefinition, applicationId: string, destinationId: string | null): Promise<string>;
+/**
+ * Add listed role-permission edges without removing destination-only edges.
+ *
+ * @param roleId - Resolved role identifier
+ * @param permissionIds - Resolved permission identifiers listed by the manifest
+ */
+export declare function writePortabilityRolePermissions(roleId: string, permissionIds: readonly string[]): Promise<void>;
+//# sourceMappingURL=import-repository.d.ts.map

package/dist/portability/import-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-repository.d.ts","sourceRoot":"","sources":["../../src/portability/import-repository.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAI5E,OAAO,KAAK,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,eAAe,EACf,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,wFAAwF;AACxF,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,CAAC;IACtF,qFAAqF;IACrF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,gCAAgC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,mCAAmC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,gCAAgC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,uCAAuC;IACvC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,qCAAqC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,yCAAyC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,kCAAkC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAqB,SAAQ,sBAAsB;IAClE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAgB,SAAQ,4BAA4B;IACnE,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,qDAAqD;IACrD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAyB,SAAQ,0BAA0B;IAC1E,sDAAsD;IACtD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,oFAAoF;AACpF,MAAM,WAAW,uBAAuB;IACtC,+BAA+B;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,wBAAwB;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,qDAAqD;IACrD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,gCAAgC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,yBAAyB;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;CACtC;AAED,0EAA0E;AAC1E,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,uDAAuD;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,+EAA+E;AAC/E,MAAM,WAAW,yBAAyB;IACxC,iCAAiC;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC3D,gCAAgC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvD,uCAAuC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,eAAe,EAAE,CAAC;IACxD,yBAAyB;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,+BAA+B;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACrD,4CAA4C;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC/D,4CAA4C;IAC5C,QAAQ,CAAC,eAAe,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC7D,yBAAyB;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IACzC,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,uCAAuC;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAC7D,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;CAC9C;AAmDD;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAAC,yBAAyB,CAAC,CAiLpC;AAED;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,uBAAuB,EAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,qBAAqB,EAAE,WAAW,CAAC,MAAM,GAAG,SAAS,CAAC,GACrD,OAAO,CAAC,MAAM,CAAC,CAyDjB;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,EACpC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,qBAAqB,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAejB;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,0BAA0B,EAClC,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,MAAM,CAAC,CAiCjB;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAQf"}