@powerhousedao/reactor-api 6.2.3-dev.4 → 6.2.3-dev.41

package/dist/adapter-http-fastify-BwXO6rqE.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapter-http-fastify-BwXO6rqE.mjs","sources":["../src/graphql/gateway/adapter-http-fastify.ts"],"sourcesContent":["import fastifyCors from \"@fastify/cors\";\nimport fastifyFormbody from \"@fastify/formbody\";\nimport fastifyMiddie from \"@fastify/middie\";\nimport type { CorsOptions } from \"cors\";\nimport devcert from \"devcert\";\nimport Fastify from \"fastify\";\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport fs from \"node:fs\";\nimport http from \"node:http\";\nimport https from \"node:https\";\nimport nodePath from \"node:path\";\nimport { Readable } from \"node:stream\";\nimport type { ReadableStream as WebReadableStream } from \"node:stream/web\";\nimport { match, type MatchFunction, type ParamData } from \"path-to-regexp\";\nimport type {\n  FetchHandler,\n  HttpMethod,\n  IHttpAdapter,\n  NodeRouteOptions,\n  AdapterRouteHandle,\n  TlsOptions,\n} from \"./types.js\";\nimport { normalizePath } from \"./path-normalize.js\";\n\n/** Parses body-limit strings like \"50mb\" to bytes. */\nfunction parseBodyLimit(limit: string): number {\n  const m = /^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb)?$/i.exec(limit.trim());\n  if (!m) return 52_428_800; // 50 MB fallback\n  const n = parseFloat(m[1]);\n  const units: Record<string, number> = {\n    b: 1,\n    kb: 1_024,\n    mb: 1_048_576,\n    gb: 1_073_741_824,\n  };\n  return Math.round(n * (units[(m[2] ?? \"b\").toLowerCase()] ?? 1));\n}\n\ntype FetchEntry = {\n  path: string;\n  handler: FetchHandler;\n  matcher: MatchFunction<ParamData>;\n  prefix: boolean;\n};\n\ntype GetEntry = {\n  path: string;\n  handler: (r: Request) => Response | Promise<Response>;\n  matcher: MatchFunction<ParamData>;\n};\n\ntype NodeHandler = (\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  body?: unknown,\n) => void;\n\ntype NodeEntry = {\n  path: string;\n  method: HttpMethod;\n  matcher: MatchFunction<ParamData>;\n  handler: NodeHandler;\n  /** Claimed in the onRequest hook, before any body parsing. */\n  rawBody: boolean;\n};\n\n// Pre-listen configuration ops (need the Fastify instance to apply).\ntype SetupOp =\n  | { kind: \"cors\"; options?: CorsOptions; bodyLimit: number }\n  | { kind: \"middie\"; middleware: unknown };\n\nexport class FastifyHttpAdapter implements IHttpAdapter {\n  // Dispatch maps, keyed by route handle and iterated in registration\n  // order — populated at any time (before or after listen). Mounting a\n  // path that already holds a route of the same kind (and method, for\n  // node routes) replaces the old entry, so re-mounting is last-write-\n  // wins without accumulating; a handle's dispose() removes its own entry.\n  readonly #fetchRoutes = new Map<number, FetchEntry>();\n  readonly #getRoutes = new Map<number, GetEntry>();\n  readonly #nodeRoutes = new Map<number, NodeEntry>();\n  #nextHandle = 0;\n\n  // Ops that need the Fastify instance (CORS config, Connect middleware).\n  readonly #setupOps: SetupOp[] = [];\n\n  #instance: FastifyInstance | undefined;\n\n  get handle(): unknown {\n    return this.#instance;\n  }\n\n  setupMiddleware({\n    corsOptions,\n    bodyLimit = \"50mb\",\n  }: {\n    corsOptions?: CorsOptions;\n    bodyLimit?: string;\n  }): void {\n    this.#setupOps.push({\n      kind: \"cors\",\n      options: corsOptions,\n      bodyLimit: parseBodyLimit(bodyLimit),\n    });\n  }\n\n  mount(\n    path: string,\n    handler: FetchHandler,\n    { prefix, exact }: { prefix?: boolean; exact?: boolean } = {},\n  ): AdapterRouteHandle {\n    // `exact` never meant exact: it selected prefix matching. Kept as an alias\n    // so existing callers keep working while the name is retired.\n    const asPrefix = prefix ?? exact ?? false;\n    for (const [handle, entry] of this.#fetchRoutes) {\n      if (entry.path === path) this.#fetchRoutes.delete(handle);\n    }\n    const handle = this.#nextHandle++;\n    this.#fetchRoutes.set(handle, {\n      path,\n      handler,\n      matcher: match(normalizePath(path), { end: !asPrefix }),\n      prefix: asPrefix,\n    });\n    return { dispose: () => this.#fetchRoutes.delete(handle) };\n  }\n\n  getRoute(\n    path: string,\n    handler: (r: Request) => Response | Promise<Response>,\n  ): AdapterRouteHandle {\n    for (const [handle, entry] of this.#getRoutes) {\n      if (entry.path === path) this.#getRoutes.delete(handle);\n    }\n    const handle = this.#nextHandle++;\n    this.#getRoutes.set(handle, {\n      path,\n      handler,\n      matcher: match(normalizePath(path)),\n    });\n    return { dispose: () => this.#getRoutes.delete(handle) };\n  }\n\n  mountNodeRoute(\n    method: HttpMethod,\n    path: string,\n    handler: NodeHandler,\n    { rawBody = false, prefix = false }: NodeRouteOptions = {},\n  ): AdapterRouteHandle {\n    for (const [handle, entry] of this.#nodeRoutes) {\n      if (entry.path === path && entry.method === method) {\n        this.#nodeRoutes.delete(handle);\n      }\n    }\n    const handle = this.#nextHandle++;\n    this.#nodeRoutes.set(handle, {\n      path,\n      method,\n      matcher: match(normalizePath(path), { end: !prefix }),\n      handler,\n      rawBody,\n    });\n    return { dispose: () => this.#nodeRoutes.delete(handle) };\n  }\n\n  mountRawMiddleware(middleware: unknown): void {\n    if (this.#instance) {\n      // @fastify/middie is always registered, so .use() is available post-listen.\n      (\n        this.#instance as FastifyInstance & {\n          use(middleware: unknown): FastifyInstance;\n        }\n      ).use(middleware);\n    } else {\n      this.#setupOps.push({ kind: \"middie\", middleware });\n    }\n  }\n\n  setupSentryErrorHandler(sentry: object): void {\n    if (!this.#instance) return;\n    const s = sentry as {\n      setupFastifyErrorHandler(app: FastifyInstance): void;\n    };\n    s.setupFastifyErrorHandler(this.#instance);\n  }\n\n  async listen(port: number, tls?: TlsOptions): Promise<http.Server> {\n    let httpServer: http.Server;\n\n    if (tls === true) {\n      const { cert, key } = (await devcert.certificateFor(\"localhost\")) as {\n        cert: Buffer;\n        key: Buffer;\n      };\n      if (!cert || !key) throw new Error(\"Invalid certificate generated\");\n      httpServer = https.createServer({ cert, key });\n    } else if (tls && \"keyPath\" in tls) {\n      const cwd = process.cwd();\n      httpServer = https.createServer({\n        key: fs.readFileSync(nodePath.join(cwd, tls.keyPath)),\n        cert: fs.readFileSync(nodePath.join(cwd, tls.certPath)),\n      });\n    } else if (tls && \"cert\" in tls) {\n      httpServer = https.createServer({ cert: tls.cert, key: tls.key });\n    } else {\n      httpServer = http.createServer();\n    }\n\n    const corsOp = this.#setupOps.find(\n      (op): op is Extract<SetupOp, { kind: \"cors\" }> => op.kind === \"cors\",\n    );\n    const bodyLimit = corsOp?.bodyLimit ?? 52_428_800;\n\n    const instance = Fastify({\n      serverFactory: (handler) => {\n        httpServer.on(\"request\", handler);\n        return httpServer;\n      },\n      bodyLimit,\n      logger: false,\n    });\n\n    this.#instance = instance;\n\n    // Always register middie first so .use() is available post-listen.\n    await instance.register(fastifyMiddie);\n    await instance.register(fastifyFormbody);\n\n    for (const op of this.#setupOps) {\n      if (op.kind === \"cors\") {\n        await instance.register(\n          fastifyCors,\n          op.options as Parameters<typeof fastifyCors>[1],\n        );\n      } else {\n        (\n          instance as FastifyInstance & {\n            use(middleware: unknown): FastifyInstance;\n          }\n        ).use(op.middleware);\n      }\n    }\n\n    // Raw routes are claimed here, in the earliest hook there is: Fastify\n    // parses the body before the handler runs, and it 415s an unknown content\n    // type outright, so a route that needs the octets as sent cannot wait for\n    // dispatch. `hijack()` takes the reply out of Fastify's lifecycle and the\n    // handler owns the socket from here.\n    instance.addHook(\"onRequest\", (req, reply, done) => {\n      const claimed = this.#matchNodeRoute(req, true);\n      if (!claimed) {\n        done();\n        return;\n      }\n      (req.raw as http.IncomingMessage & { params?: ParamData }).params =\n        claimed.params;\n      reply.hijack();\n      claimed.route.handler(req.raw, reply.raw, undefined);\n    });\n\n    // Single catch-all route — all dispatching is done via the Maps above so\n    // that routes registered after listen() are picked up automatically.\n    // OPTIONS is excluded because @fastify/cors registers its own OPTIONS /*\n    // handler for preflight; including it here would cause a duplicate-route\n    // conflict at startup.\n    instance.route({\n      method: [\"DELETE\", \"GET\", \"HEAD\", \"PATCH\", \"POST\", \"PUT\"],\n      url: \"/*\",\n      handler: (req, reply) => this.#dispatch(req, reply),\n    });\n\n    await instance.ready();\n\n    return new Promise<http.Server>((resolve, reject) => {\n      httpServer.once(\"error\", reject);\n      httpServer.listen(port, () => {\n        httpServer.off(\"error\", reject);\n        resolve(httpServer);\n      });\n    });\n  }\n\n  /**\n   * Finds a node route for this request. `raw` selects which half of the\n   * registry to consider: raw routes are claimed in the onRequest hook, the\n   * rest in the catch-all handler once the body is parsed.\n   */\n  #matchNodeRoute(\n    req: FastifyRequest,\n    raw: boolean,\n  ): { route: NodeEntry; params: ParamData } | undefined {\n    const pathname = new URL(req.url, \"http://localhost\").pathname;\n    const method = req.method.toUpperCase();\n    for (const entry of this.#nodeRoutes.values()) {\n      if (entry.rawBody !== raw) continue;\n      if (entry.method !== method) continue;\n      const result = entry.matcher(pathname);\n      if (result) return { route: entry, params: result.params };\n    }\n    return undefined;\n  }\n\n  #dispatch(\n    req: FastifyRequest,\n    reply: FastifyReply,\n  ): void | Promise<FastifyReply> {\n    const pathname = new URL(req.url, \"http://localhost\").pathname;\n    const method = req.method.toUpperCase() as\n      | \"DELETE\"\n      | \"GET\"\n      | \"HEAD\"\n      | \"PATCH\"\n      | \"POST\"\n      | \"PUT\";\n\n    // 1. Node routes — path-to-regexp match + method, handler manages raw\n    // response. Attach decoded params onto `req.raw` so downstream handlers\n    // can read them via the same `req.params` API the Express adapter exposes.\n    const node = this.#matchNodeRoute(req, false);\n    if (node) {\n      (req.raw as http.IncomingMessage & { params?: ParamData }).params =\n        node.params;\n      reply.hijack();\n      node.route.handler(req.raw, reply.raw, req.body);\n      return;\n    }\n\n    // 2. GET-specific routes (health, explorer, etc.).\n    if (method === \"GET\") {\n      for (const entry of this.#getRoutes.values()) {\n        if (entry.matcher(pathname)) {\n          return this.#serveGetEntry(entry, req, reply);\n        }\n      }\n    }\n\n    // 3. Fetch routes (GraphQL handlers, SSE, etc.).\n    // Iterate in reverse so that the last-mounted handler wins when the same\n    // path is mounted more than once (e.g. supergraph remount after reload).\n    for (const entry of [...this.#fetchRoutes.values()].reverse()) {\n      if (entry.matcher(pathname)) {\n        return serveFetchHandler(entry.handler, req, reply);\n      }\n    }\n\n    void reply.status(404).send({\n      message: `Route ${req.method}:${pathname} not found`,\n      error: \"Not Found\",\n      statusCode: 404,\n    });\n  }\n\n  async #serveGetEntry(\n    entry: GetEntry,\n    req: FastifyRequest,\n    reply: FastifyReply,\n  ): Promise<FastifyReply> {\n    const url = buildUrl(req);\n    const headers = buildHeaders(req);\n    const fetchReq = new Request(url, { method: \"GET\", headers });\n    const response = await entry.handler(fetchReq);\n    writeResponse(reply, response);\n    if (response.body === null) {\n      return reply.send(await response.text());\n    }\n    // Stream the body instead of awaiting .text(): a stream-backed body\n    // (e.g. graphql-sse) only closes when the subscription completes, so\n    // awaiting would hang the request. Fastify tears the source down on\n    // client disconnect and routes pre-header stream errors to the\n    // error handler.\n    // `response.body` is typed against the global (lib) ReadableStream\n    // declaration, while Readable.fromWeb wants node:stream/web's; at\n    // runtime they are the same stream, so the cast is safe.\n    const bodyStream = response.body as WebReadableStream;\n    return reply.send(Readable.fromWeb(bodyStream));\n  }\n}\n\nasync function serveFetchHandler(\n  handler: FetchHandler,\n  req: FastifyRequest,\n  reply: FastifyReply,\n): Promise<FastifyReply> {\n  const url = buildUrl(req);\n  const headers = buildHeaders(req);\n  let body: string | undefined;\n  if (req.method !== \"GET\" && req.method !== \"HEAD\" && req.body !== undefined) {\n    body = JSON.stringify(req.body);\n  }\n  const response = await handler(\n    new Request(url, { method: req.method, headers, body }),\n  );\n  writeResponse(reply, response);\n  if (response.body === null) {\n    return reply.send(await response.text());\n  }\n  // Stream the body instead of awaiting .text(): a stream-backed body\n  // (e.g. graphql-sse) only closes when the subscription completes, so\n  // awaiting would hang the request. Fastify tears the source down on\n  // client disconnect and routes pre-header stream errors to the\n  // error handler.\n  // `response.body` is typed against the global (lib) ReadableStream\n  // declaration, while Readable.fromWeb wants node:stream/web's; at\n  // runtime they are the same stream, so the cast is safe.\n  const bodyStream = response.body as WebReadableStream;\n  return reply.send(Readable.fromWeb(bodyStream));\n}\n\nfunction buildUrl(req: FastifyRequest): string {\n  const protocol = req.protocol;\n  const host = req.headers.host ?? \"localhost\";\n  return `${protocol}://${host}${req.url}`;\n}\n\nfunction buildHeaders(req: FastifyRequest): Headers {\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (typeof value === \"string\") {\n      headers.set(key, value);\n    } else if (Array.isArray(value)) {\n      headers.set(key, value.join(\", \"));\n    }\n  }\n  return headers;\n}\n\nfunction writeResponse(reply: FastifyReply, response: Response): void {\n  reply.statusCode = response.status;\n  response.headers.forEach((value, key) => {\n    reply.header(key, value);\n  });\n}\n\nexport function createFastifyHttpAdapter(): { adapter: IHttpAdapter } {\n  return { adapter: new FastifyHttpAdapter() };\n}\n"],"names":["#fetchRoutes","#getRoutes","#nodeRoutes","#setupOps","#instance","#nextHandle","nodePath","#matchNodeRoute","#dispatch","#serveGetEntry"],"mappings":";;;;;;;;;;;;;;;;AAyBA,SAAS,eAAe,OAAuB;CAC7C,MAAM,IAAI,qCAAqC,KAAK,MAAM,MAAM,CAAC;AACjE,KAAI,CAAC,EAAG,QAAO;CACf,MAAM,IAAI,WAAW,EAAE,GAAG;AAO1B,QAAO,KAAK,MAAM,KANoB;EACpC,GAAG;EACH,IAAI;EACJ,IAAI;EACJ,IAAI;EACL,EAC6B,EAAE,MAAM,KAAK,aAAa,KAAK,GAAG;;AAoClE,IAAa,qBAAb,MAAwD;CAMtD,+BAAwB,IAAI,KAAyB;CACrD,6BAAsB,IAAI,KAAuB;CACjD,8BAAuB,IAAI,KAAwB;CACnD,cAAc;CAGd,YAAgC,EAAE;CAElC;CAEA,IAAI,SAAkB;AACpB,SAAO,MAAA;;CAGT,gBAAgB,EACd,aACA,YAAY,UAIL;AACP,QAAA,SAAe,KAAK;GAClB,MAAM;GACN,SAAS;GACT,WAAW,eAAe,UAAU;GACrC,CAAC;;CAGJ,MACE,MACA,SACA,EAAE,QAAQ,UAAiD,EAAE,EACzC;EAGpB,MAAM,WAAW,UAAU,SAAS;AACpC,OAAK,MAAM,CAAC,QAAQ,UAAU,MAAA,YAC5B,KAAI,MAAM,SAAS,KAAM,OAAA,YAAkB,OAAO,OAAO;EAE3D,MAAM,SAAS,MAAA;AACf,QAAA,YAAkB,IAAI,QAAQ;GAC5B;GACA;GACA,SAAS,MAAM,cAAc,KAAK,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC;GACvD,QAAQ;GACT,CAAC;AACF,SAAO,EAAE,eAAe,MAAA,YAAkB,OAAO,OAAO,EAAE;;CAG5D,SACE,MACA,SACoB;AACpB,OAAK,MAAM,CAAC,QAAQ,UAAU,MAAA,UAC5B,KAAI,MAAM,SAAS,KAAM,OAAA,UAAgB,OAAO,OAAO;EAEzD,MAAM,SAAS,MAAA;AACf,QAAA,UAAgB,IAAI,QAAQ;GAC1B;GACA;GACA,SAAS,MAAM,cAAc,KAAK,CAAC;GACpC,CAAC;AACF,SAAO,EAAE,eAAe,MAAA,UAAgB,OAAO,OAAO,EAAE;;CAG1D,eACE,QACA,MACA,SACA,EAAE,UAAU,OAAO,SAAS,UAA4B,EAAE,EACtC;AACpB,OAAK,MAAM,CAAC,QAAQ,UAAU,MAAA,WAC5B,KAAI,MAAM,SAAS,QAAQ,MAAM,WAAW,OAC1C,OAAA,WAAiB,OAAO,OAAO;EAGnC,MAAM,SAAS,MAAA;AACf,QAAA,WAAiB,IAAI,QAAQ;GAC3B;GACA;GACA,SAAS,MAAM,cAAc,KAAK,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC;GACrD;GACA;GACD,CAAC;AACF,SAAO,EAAE,eAAe,MAAA,WAAiB,OAAO,OAAO,EAAE;;CAG3D,mBAAmB,YAA2B;AAC5C,MAAI,MAAA,SAGA,OAAA,SAGA,IAAI,WAAW;MAEjB,OAAA,SAAe,KAAK;GAAE,MAAM;GAAU;GAAY,CAAC;;CAIvD,wBAAwB,QAAsB;AAC5C,MAAI,CAAC,MAAA,SAAgB;AACX,SAGR,yBAAyB,MAAA,SAAe;;CAG5C,MAAM,OAAO,MAAc,KAAwC;EACjE,IAAI;AAEJ,MAAI,QAAQ,MAAM;GAChB,MAAM,EAAE,MAAM,QAAS,MAAM,QAAQ,eAAe,YAAY;AAIhE,OAAI,CAAC,QAAQ,CAAC,IAAK,OAAM,IAAI,MAAM,gCAAgC;AACnE,gBAAa,MAAM,aAAa;IAAE;IAAM;IAAK,CAAC;aACrC,OAAO,aAAa,KAAK;GAClC,MAAM,MAAM,QAAQ,KAAK;AACzB,gBAAa,MAAM,aAAa;IAC9B,KAAK,GAAG,aAAaM,KAAS,KAAK,KAAK,IAAI,QAAQ,CAAC;IACrD,MAAM,GAAG,aAAaA,KAAS,KAAK,KAAK,IAAI,SAAS,CAAC;IACxD,CAAC;aACO,OAAO,UAAU,IAC1B,cAAa,MAAM,aAAa;GAAE,MAAM,IAAI;GAAM,KAAK,IAAI;GAAK,CAAC;MAEjE,cAAa,KAAK,cAAc;EAQlC,MAAM,WAAW,QAAQ;GACvB,gBAAgB,YAAY;AAC1B,eAAW,GAAG,WAAW,QAAQ;AACjC,WAAO;;GAET,WAVa,MAAA,SAAe,MAC3B,OAAiD,GAAG,SAAS,OAC/D,EACyB,aAAa;GAQrC,QAAQ;GACT,CAAC;AAEF,QAAA,WAAiB;AAGjB,QAAM,SAAS,SAAS,cAAc;AACtC,QAAM,SAAS,SAAS,gBAAgB;AAExC,OAAK,MAAM,MAAM,MAAA,SACf,KAAI,GAAG,SAAS,OACd,OAAM,SAAS,SACb,aACA,GAAG,QACJ;MAGC,UAGA,IAAI,GAAG,WAAW;AASxB,WAAS,QAAQ,cAAc,KAAK,OAAO,SAAS;GAClD,MAAM,UAAU,MAAA,eAAqB,KAAK,KAAK;AAC/C,OAAI,CAAC,SAAS;AACZ,UAAM;AACN;;AAED,OAAI,IAAsD,SACzD,QAAQ;AACV,SAAM,QAAQ;AACd,WAAQ,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,KAAA,EAAU;IACpD;AAOF,WAAS,MAAM;GACb,QAAQ;IAAC;IAAU;IAAO;IAAQ;IAAS;IAAQ;IAAM;GACzD,KAAK;GACL,UAAU,KAAK,UAAU,MAAA,SAAe,KAAK,MAAM;GACpD,CAAC;AAEF,QAAM,SAAS,OAAO;AAEtB,SAAO,IAAI,SAAsB,SAAS,WAAW;AACnD,cAAW,KAAK,SAAS,OAAO;AAChC,cAAW,OAAO,YAAY;AAC5B,eAAW,IAAI,SAAS,OAAO;AAC/B,YAAQ,WAAW;KACnB;IACF;;;;;;;CAQJ,gBACE,KACA,KACqD;EACrD,MAAM,WAAW,IAAI,IAAI,IAAI,KAAK,mBAAmB,CAAC;EACtD,MAAM,SAAS,IAAI,OAAO,aAAa;AACvC,OAAK,MAAM,SAAS,MAAA,WAAiB,QAAQ,EAAE;AAC7C,OAAI,MAAM,YAAY,IAAK;AAC3B,OAAI,MAAM,WAAW,OAAQ;GAC7B,MAAM,SAAS,MAAM,QAAQ,SAAS;AACtC,OAAI,OAAQ,QAAO;IAAE,OAAO;IAAO,QAAQ,OAAO;IAAQ;;;CAK9D,UACE,KACA,OAC8B;EAC9B,MAAM,WAAW,IAAI,IAAI,IAAI,KAAK,mBAAmB,CAAC;EACtD,MAAM,SAAS,IAAI,OAAO,aAAa;EAWvC,MAAM,OAAO,MAAA,eAAqB,KAAK,MAAM;AAC7C,MAAI,MAAM;AACP,OAAI,IAAsD,SACzD,KAAK;AACP,SAAM,QAAQ;AACd,QAAK,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK;AAChD;;AAIF,MAAI,WAAW;QACR,MAAM,SAAS,MAAA,UAAgB,QAAQ,CAC1C,KAAI,MAAM,QAAQ,SAAS,CACzB,QAAO,MAAA,cAAoB,OAAO,KAAK,MAAM;;AAQnD,OAAK,MAAM,SAAS,CAAC,GAAG,MAAA,YAAkB,QAAQ,CAAC,CAAC,SAAS,CAC3D,KAAI,MAAM,QAAQ,SAAS,CACzB,QAAO,kBAAkB,MAAM,SAAS,KAAK,MAAM;AAIlD,QAAM,OAAO,IAAI,CAAC,KAAK;GAC1B,SAAS,SAAS,IAAI,OAAO,GAAG,SAAS;GACzC,OAAO;GACP,YAAY;GACb,CAAC;;CAGJ,OAAA,cACE,OACA,KACA,OACuB;EACvB,MAAM,MAAM,SAAS,IAAI;EACzB,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,WAAW,IAAI,QAAQ,KAAK;GAAE,QAAQ;GAAO;GAAS,CAAC;EAC7D,MAAM,WAAW,MAAM,MAAM,QAAQ,SAAS;AAC9C,gBAAc,OAAO,SAAS;AAC9B,MAAI,SAAS,SAAS,KACpB,QAAO,MAAM,KAAK,MAAM,SAAS,MAAM,CAAC;EAU1C,MAAM,aAAa,SAAS;AAC5B,SAAO,MAAM,KAAK,SAAS,QAAQ,WAAW,CAAC;;;AAInD,eAAe,kBACb,SACA,KACA,OACuB;CACvB,MAAM,MAAM,SAAS,IAAI;CACzB,MAAM,UAAU,aAAa,IAAI;CACjC,IAAI;AACJ,KAAI,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,KAAA,EAChE,QAAO,KAAK,UAAU,IAAI,KAAK;CAEjC,MAAM,WAAW,MAAM,QACrB,IAAI,QAAQ,KAAK;EAAE,QAAQ,IAAI;EAAQ;EAAS;EAAM,CAAC,CACxD;AACD,eAAc,OAAO,SAAS;AAC9B,KAAI,SAAS,SAAS,KACpB,QAAO,MAAM,KAAK,MAAM,SAAS,MAAM,CAAC;CAU1C,MAAM,aAAa,SAAS;AAC5B,QAAO,MAAM,KAAK,SAAS,QAAQ,WAAW,CAAC;;AAGjD,SAAS,SAAS,KAA6B;AAG7C,QAAO,GAFU,IAAI,SAEF,KADN,IAAI,QAAQ,QAAQ,cACF,IAAI;;AAGrC,SAAS,aAAa,KAA8B;CAClD,MAAM,UAAU,IAAI,SAAS;AAC7B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,QAAQ,CACpD,KAAI,OAAO,UAAU,SACnB,SAAQ,IAAI,KAAK,MAAM;UACd,MAAM,QAAQ,MAAM,CAC7B,SAAQ,IAAI,KAAK,MAAM,KAAK,KAAK,CAAC;AAGtC,QAAO;;AAGT,SAAS,cAAc,OAAqB,UAA0B;AACpE,OAAM,aAAa,SAAS;AAC5B,UAAS,QAAQ,SAAS,OAAO,QAAQ;AACvC,QAAM,OAAO,KAAK,MAAM;GACxB;;AAGJ,SAAgB,2BAAsD;AACpE,QAAO,EAAE,SAAS,IAAI,oBAAoB,EAAE","debug_id":"07c62958-83d2-55bc-b138-149275988013"}

package/dist/path-normalize-BOQwY9wR.mjs

@@ -1,23 +0,0 @@
-//#region src/graphql/gateway/path-normalize.ts
-/**
-* Normalises a route path for path-to-regexp v8:
-* - Collapses duplicate slashes (e.g. "//explorer" → "/explorer")
-* - Converts legacy optional-param syntax "/:param?" → "{/:param}". The
-*   slash must move inside the group: in p-r v8 a group whose content
-*   begins with "/" is what makes the slash and the parameter optional
-*   together, while a literal "/" left in front of the group compiles to
-*   a pattern that matches nothing (and v8 rejects a bare ":param?").
-*
-* Shared by both http adapters so registry dispatch matches the same path
-* shapes regardless of which framework is in use.
-*/
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f73d6dcb-dc2c-52e3-abd2-3653df07260f")}catch(e){}}();
-function normalizePath(path) {
-	return path.replace(/\/+/g, "/").replace(/\/:(\w+)\?/g, "{/:$1}");
-}
-//#endregion
-export { normalizePath as t };
-
-//# sourceMappingURL=path-normalize-BOQwY9wR.mjs.map
-//# debugId=f73d6dcb-dc2c-52e3-abd2-3653df07260f

package/dist/path-normalize-BOQwY9wR.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-normalize-BOQwY9wR.mjs","sources":["../src/graphql/gateway/path-normalize.ts"],"sourcesContent":["/**\n * Normalises a route path for path-to-regexp v8:\n * - Collapses duplicate slashes (e.g. \"//explorer\" → \"/explorer\")\n * - Converts legacy optional-param syntax \"/:param?\" → \"{/:param}\". The\n *   slash must move inside the group: in p-r v8 a group whose content\n *   begins with \"/\" is what makes the slash and the parameter optional\n *   together, while a literal \"/\" left in front of the group compiles to\n *   a pattern that matches nothing (and v8 rejects a bare \":param?\").\n *\n * Shared by both http adapters so registry dispatch matches the same path\n * shapes regardless of which framework is in use.\n */\nexport function normalizePath(path: string): string {\n  return path.replace(/\\/+/g, \"/\").replace(/\\/:(\\w+)\\?/g, \"{/:$1}\");\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAYA,SAAgB,cAAc,MAAsB;AAClD,QAAO,KAAK,QAAQ,QAAQ,IAAI,CAAC,QAAQ,eAAe,SAAS","debug_id":"f73d6dcb-dc2c-52e3-abd2-3653df07260f"}

package/dist/types-DcYyNcHJ.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-DcYyNcHJ.d.mts","names":[],"sources":["../src/packages/types.ts"],"mappings":";;;;;UAUiB,cAAA;EACf,IAAA;EACA,kBAAA,CACE,UAAA,UACA,SAAA,aACC,OAAA,CAAQ,mBAAA;EALkB;;;;EAU7B,oBAAA,EACE,UAAA,WACC,OAAA,CAAQ,eAAA;EACX,aAAA,CACE,UAAA,UACA,SAAA,aACC,OAAA,CAAQ,aAAA;EACX,cAAA,CACE,UAAA,UACA,SAAA,aACC,OAAA,CAAQ,uBAAA;AAAA;AAAA,UAGI,oBAAA;EACf,QAAA;AAAA;AAAA,UAGe,0BAAA,SAAmC,cAAA;EAClD,sBAAA,EACE,UAAA,UACA,OAAA,GAAU,cAAA,EAAgB,mBAAA,aAC1B,OAAA,GAAU,oBAAA;EAEZ,iBAAA,EACE,UAAA,UACA,OAAA,GAAU,SAAA,EAAW,aAAA,aACrB,OAAA,GAAU,oBAAA;EAEZ,kBAAA,EACE,UAAA,UACA,OAAA,GAAU,UAAA,EAAY,uBAAA,kBACtB,OAAA,GAAU,oBAAA;AAAA;AAAA,UAIG,eAAA;EACf,sBAAA,CACE,OAAA,GAAU,cAAA,EAAgB,MAAA,SAAe,mBAAA;EArC3C;;;;EA2CA,aAAA,CAAc,WAAA;AAAA;AAAA,KAGJ,qBAAA;EACV,MAAA,GAAS,OAAA;AAAA;AAAA,KAGC,sBAAA;EACV,QAAA;EACA,UAAA;AAAA;AAAA,KAWU,oBAAA;EACV,cAAA,EAAgB,mBAAA;EAChB,gBAAA,EAAkB,eAAA;EAClB,SAAA,EAAW,GAAA,SAAY,aAAA;EACvB,UAAA,EAAY,GAAA,SAAY,uBAAA;AAAA"}

package/dist/utils-XWVecaNn.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"utils-XWVecaNn.mjs","sources":["../src/graphql/errors.ts","../src/services/authorization.service.ts","../src/services/canonical-document-id.ts","../src/graphql/base-subgraph.ts","../src/packages/import-resolver.ts","../src/packages/util.ts","../src/graphql/utils.ts"],"sourcesContent":["import { GraphQLError } from \"graphql\";\nimport {\n  DRIVE_AUTH_ERROR_MESSAGES,\n  RECOVERABLE_GRAPHQL_ERROR_CODES,\n} from \"@powerhousedao/reactor\";\n\n/** Caller (authenticated or anonymous) lacks permission for the document. */\nexport class ForbiddenError extends GraphQLError {\n  constructor(detail = \"\") {\n    const base = DRIVE_AUTH_ERROR_MESSAGES.forbidden;\n    super(`${base}${detail ? ` ${detail}` : \"\"}`, {\n      extensions: { code: \"FORBIDDEN\" },\n    });\n  }\n}\n\n/** Anonymous caller on an action that requires logging in. */\nexport class AuthenticationRequiredError extends GraphQLError {\n  constructor(detail = \"\") {\n    const base = DRIVE_AUTH_ERROR_MESSAGES.authenticationRequired;\n    super(`${base}${detail ? ` ${detail}` : \"\"}`, {\n      extensions: { code: \"UNAUTHENTICATED\" },\n    });\n  }\n}\n\n/**\n * The reactor holds no decision model, so no authorization preflight can be\n * answered.\n *\n * Distinct from a denial, and deliberately so: a caller that cannot get a\n * prediction should render its controls as it did before it asked and let the\n * submit path refuse. Reading this as a denial would disable every control on a\n * switchboard running without authEnforcement. The code is what a client\n * branches on, since the message is not a contract.\n */\nexport class AuthEvaluationUnsupportedError extends GraphQLError {\n  constructor() {\n    super(\n      \"Authorization evaluation is unavailable: this reactor runs without the \" +\n        \"authEnforcement feature flag, so it holds no decision model\",\n      { extensions: { code: \"AUTH_EVALUATION_UNSUPPORTED\" } },\n    );\n  }\n}\n\n/**\n * A stored operation cannot be represented in the schema, so it is reported\n * rather than served.\n *\n * The schema declares an action's id, type, timestamp, input and scope\n * non-null; an operation written before the API rejected an action without an\n * id violates that. Left to the executor, the missing value nullifies the\n * action, which bubbles up through the non-null chain until it nullifies the\n * envelope's whole operation list, and the caller receives a partial response\n * beside \"Cannot return null for non-nullable field Action.id\" - which says\n * nothing about which operation, and which a sync client can only read as a\n * permanent GraphQL rejection, stopping its poll timer for good.\n *\n * Thrown instead, with a code that says the failure is worth polling through:\n * the document holding the operation needs repairing, but the channel serves\n * every other document, and a peer that stopped polling would stop receiving\n * those too. The code is what a client branches on, since the message is not a\n * contract.\n */\nexport class MalformedStoredOperationError extends GraphQLError {\n  constructor(detail: string) {\n    super(`Stored operation cannot be served: ${detail}`, {\n      extensions: {\n        code: RECOVERABLE_GRAPHQL_ERROR_CODES.malformedStoredOperation,\n      },\n    });\n  }\n}\n","import type { DocumentPermissionLevel } from \"../utils/db.js\";\nimport type {\n  DocumentPermissionService,\n  GetParentIdsFn,\n} from \"./document-permission.service.js\";\n\n/**\n * A document id that has been resolved to its canonical form, never a slug.\n *\n * Protection and grant rows are written under the canonical id, while the\n * read/operation data paths accept an id-or-slug identifier. The decision layer\n * must key on the canonical id, so branding it forces every caller to resolve a\n * slug to its id before consulting this service, closing the slug-aliasing\n * bypass (S-C1). The only sanctioned cast from string to CanonicalDocumentId\n * lives in createCanonicalDocumentIdResolver, immediately after the shared\n * resolveIdOrSlug lookup returns.\n */\nexport type CanonicalDocumentId = string & {\n  readonly __canonicalDocumentId: unique symbol;\n};\n\n/**\n * Result of a passed per-document authorization check. `fetchIdentifier` is\n * always safe for the data fetch: the canonical id when resolved, or the raw\n * identifier when the check was skipped for a policy-wide caller.\n */\nexport class AuthorizedDocumentHandle {\n  private constructor(\n    readonly fetchIdentifier: string,\n    readonly isResolved: boolean,\n  ) {}\n\n  static resolved(documentId: CanonicalDocumentId): AuthorizedDocumentHandle {\n    return new AuthorizedDocumentHandle(documentId, true);\n  }\n\n  static skipped(identifier: string): AuthorizedDocumentHandle {\n    return new AuthorizedDocumentHandle(identifier, false);\n  }\n\n  /** The verified canonical id; throws when resolution was skipped. */\n  canonicalId(): CanonicalDocumentId {\n    if (!this.isResolved) {\n      throw new Error(\n        \"Canonical document id is unavailable: the authorization check was skipped for a policy-wide caller\",\n      );\n    }\n    return this.fetchIdentifier as CanonicalDocumentId;\n  }\n}\n\nexport const AuthorizationPolicy = {\n  OPEN: \"OPEN\",\n  ADMIN_ONLY: \"ADMIN_ONLY\",\n  DOCUMENT_PERMISSIONS: \"DOCUMENT_PERMISSIONS\",\n} as const;\n\nexport type AuthorizationPolicy =\n  (typeof AuthorizationPolicy)[keyof typeof AuthorizationPolicy];\n\nexport interface AuthorizationConfig {\n  admins: string[];\n  defaultProtection: boolean;\n  policy: AuthorizationPolicy;\n}\n\n/**\n * Single source of truth for every permission decision. Always present (never\n * null) so callers branch on data, not on the existence of a service.\n *\n * The policy selects an implementation once at boot:\n * - OPEN: authentication disabled — everyone (incl. anonymous) is allowed.\n * - ADMIN_ONLY: authentication on, document permissions off — only ADMINS.\n * - DOCUMENT_PERMISSIONS: the full per-document protection + grant model.\n *\n * Permission inheritance walks the parent-document hierarchy through a\n * parent resolver injected at construction; callers never supply one.\n */\nexport interface IAuthorizationService {\n  readonly config: AuthorizationConfig;\n\n  /**\n   * Whether the user has unrestricted, policy-wide access. Under OPEN this is\n   * true for everyone (including anonymous callers) by design: OPEN means \"no\n   * restrictions\", and consumers use this check to skip per-document\n   * filtering. It does NOT mean the caller is in the ADMINS list.\n   */\n  isSupremeAdmin(userAddress?: string): boolean;\n\n  /**\n   * Whether the user may create new documents under the current policy:\n   * everyone in OPEN, only admins in ADMIN_ONLY, any authenticated user in\n   * DOCUMENT_PERMISSIONS.\n   */\n  canCreate(userAddress?: string): boolean;\n\n  canRead(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  canWrite(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  /**\n   * Whether the user administers the document: supreme admin, document\n   * owner, or holder of an ADMIN grant.\n   */\n  canManage(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  canMutate(\n    documentId: CanonicalDocumentId,\n    operationType: string,\n    userAddress?: string,\n  ): Promise<boolean>;\n}\n\n/** Shared config holder and admin-list check for the policy strategies. */\nabstract class BaseAuthorizationService implements IAuthorizationService {\n  constructor(readonly config: AuthorizationConfig) {}\n\n  isSupremeAdmin(userAddress?: string): boolean {\n    if (!userAddress) return false;\n    return this.config.admins.includes(userAddress.toLowerCase());\n  }\n\n  abstract canCreate(userAddress?: string): boolean;\n\n  abstract canRead(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  abstract canWrite(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  abstract canManage(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean>;\n\n  abstract canMutate(\n    documentId: CanonicalDocumentId,\n    operationType: string,\n    userAddress?: string,\n  ): Promise<boolean>;\n}\n\n/** OPEN: authentication disabled — everyone (incl. anonymous) is allowed. */\nclass OpenAuthorizationService extends BaseAuthorizationService {\n  isSupremeAdmin(): boolean {\n    return true;\n  }\n\n  canCreate(): boolean {\n    return true;\n  }\n\n  canRead(): Promise<boolean> {\n    return Promise.resolve(true);\n  }\n\n  canWrite(): Promise<boolean> {\n    return Promise.resolve(true);\n  }\n\n  canManage(): Promise<boolean> {\n    return Promise.resolve(true);\n  }\n\n  canMutate(): Promise<boolean> {\n    return Promise.resolve(true);\n  }\n}\n\n/** ADMIN_ONLY: authentication on, document permissions off — only ADMINS. */\nclass AdminOnlyAuthorizationService extends BaseAuthorizationService {\n  canCreate(userAddress?: string): boolean {\n    return this.isSupremeAdmin(userAddress);\n  }\n\n  canRead(\n    _documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return Promise.resolve(this.isSupremeAdmin(userAddress));\n  }\n\n  canWrite(\n    _documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return Promise.resolve(this.isSupremeAdmin(userAddress));\n  }\n\n  canManage(\n    _documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return Promise.resolve(this.isSupremeAdmin(userAddress));\n  }\n\n  canMutate(\n    _documentId: CanonicalDocumentId,\n    _operationType: string,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return Promise.resolve(this.isSupremeAdmin(userAddress));\n  }\n}\n\nconst PERMISSION_RANK: Record<DocumentPermissionLevel, number> = {\n  READ: 1,\n  WRITE: 2,\n  ADMIN: 3,\n};\n\nfunction satisfies(\n  level: DocumentPermissionLevel | null,\n  required: DocumentPermissionLevel,\n): boolean {\n  return level !== null && PERMISSION_RANK[level] >= PERMISSION_RANK[required];\n}\n\n/**\n * DOCUMENT_PERMISSIONS: the full per-document protection + grant model.\n *\n * All decisions live here; DocumentPermissionService is the data-access\n * layer underneath (grants, protection rows, owners).\n */\nclass DocumentPermissionsAuthorizationService extends BaseAuthorizationService {\n  readonly #permissions: DocumentPermissionService;\n  readonly #getParentIds: GetParentIdsFn;\n\n  constructor(\n    permissions: DocumentPermissionService,\n    getParentIds: GetParentIdsFn,\n    config: AuthorizationConfig,\n  ) {\n    super(config);\n    this.#permissions = permissions;\n    this.#getParentIds = getParentIds;\n  }\n\n  canCreate(userAddress?: string): boolean {\n    return this.isSupremeAdmin(userAddress) || !!userAddress;\n  }\n\n  canRead(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return this.#canAccess(documentId, \"READ\", userAddress);\n  }\n\n  canWrite(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return this.#canAccess(documentId, \"WRITE\", userAddress);\n  }\n\n  canManage(\n    documentId: CanonicalDocumentId,\n    userAddress?: string,\n  ): Promise<boolean> {\n    return this.#isDocumentAdmin(documentId, userAddress);\n  }\n\n  async canMutate(\n    documentId: CanonicalDocumentId,\n    operationType: string,\n    userAddress?: string,\n  ): Promise<boolean> {\n    if (this.isSupremeAdmin(userAddress)) return true;\n\n    const isRestricted = await this.#permissions.isOperationRestricted(\n      documentId,\n      operationType,\n    );\n    if (isRestricted) {\n      if (!userAddress) return false;\n      if (await this.#isDocumentAdmin(documentId, userAddress)) return true;\n      return this.#permissions.hasOperationGrant(\n        documentId,\n        operationType,\n        userAddress,\n      );\n    }\n\n    return this.#canAccess(documentId, \"WRITE\", userAddress);\n  }\n\n  /**\n   * The one \"administers this document\" predicate: supreme admin, document\n   * owner, or ADMIN grant on the document itself.\n   */\n  async #isDocumentAdmin(\n    documentId: string,\n    userAddress?: string,\n  ): Promise<boolean> {\n    if (this.isSupremeAdmin(userAddress)) return true;\n    if (!userAddress) return false;\n\n    const owner = await this.#permissions.getDocumentOwner(documentId);\n    if (owner && owner === userAddress.toLowerCase()) return true;\n\n    return satisfies(await this.#grantLevel(documentId, userAddress), \"ADMIN\");\n  }\n\n  /**\n   * The one read/write decision shape: supreme admin → unprotected (self or\n   * ancestor) → owner → inherited grant of at least the required level.\n   */\n  async #canAccess(\n    documentId: string,\n    required: DocumentPermissionLevel,\n    userAddress?: string,\n  ): Promise<boolean> {\n    if (this.isSupremeAdmin(userAddress)) return true;\n\n    const isProtected = await this.#permissions.isProtectedWithAncestors(\n      documentId,\n      this.#getParentIds,\n    );\n    if (!isProtected) return true;\n    if (!userAddress) return false;\n\n    const owner = await this.#permissions.getDocumentOwner(documentId);\n    if (owner && owner === userAddress.toLowerCase()) return true;\n\n    return this.#hasGrantInHierarchy(documentId, userAddress, required);\n  }\n\n  /** Best grant the user holds on the document. */\n  async #grantLevel(\n    documentId: string,\n    userAddress: string,\n  ): Promise<DocumentPermissionLevel | null> {\n    return this.#permissions.getUserPermission(documentId, userAddress);\n  }\n\n  /**\n   * Walks the parent hierarchy (with cycle protection) looking for a grant of\n   * at least the required level on the document or any ancestor.\n   */\n  async #hasGrantInHierarchy(\n    documentId: string,\n    userAddress: string,\n    required: DocumentPermissionLevel,\n  ): Promise<boolean> {\n    const visited = new Set<string>();\n    const queue = [documentId];\n\n    while (queue.length > 0) {\n      const current = queue.shift()!;\n      if (visited.has(current)) continue;\n      visited.add(current);\n\n      const level = await this.#grantLevel(current, userAddress);\n      if (satisfies(level, required)) return true;\n\n      for (const parentId of await this.#getParentIds(current)) {\n        if (!visited.has(parentId)) queue.push(parentId);\n      }\n    }\n\n    return false;\n  }\n}\n\n/**\n * Selects the strategy for the configured policy. The strategy classes are\n * not exported, so this guard is the only construction path.\n */\nexport function createAuthorizationService(\n  config: AuthorizationConfig,\n  documentPermissionService?: DocumentPermissionService,\n  getParentIds?: GetParentIdsFn,\n): IAuthorizationService {\n  if (config.policy === AuthorizationPolicy.OPEN) {\n    return new OpenAuthorizationService(config);\n  }\n  if (config.policy === AuthorizationPolicy.ADMIN_ONLY) {\n    return new AdminOnlyAuthorizationService(config);\n  }\n  if (!documentPermissionService) {\n    throw new Error(\n      \"DocumentPermissionService is required for the DOCUMENT_PERMISSIONS policy\",\n    );\n  }\n  if (!getParentIds) {\n    throw new Error(\n      \"A getParentIds resolver is required for the DOCUMENT_PERMISSIONS policy\",\n    );\n  }\n  return new DocumentPermissionsAuthorizationService(\n    documentPermissionService,\n    getParentIds,\n    config,\n  );\n}\n","import type { IReactorClient } from \"@powerhousedao/reactor\";\nimport type { CanonicalDocumentId } from \"./authorization.service.js\";\n\n/**\n * Raised when a caller-supplied identifier cannot be resolved to a canonical\n * document id. Carries no detail on purpose: resolution failures must not act\n * as a document-existence oracle, so consumers map this to their generic\n * fail-closed response.\n */\nexport class CanonicalDocumentIdResolutionError extends Error {\n  constructor() {\n    super(\"Document identifier could not be resolved\");\n    this.name = \"CanonicalDocumentIdResolutionError\";\n  }\n}\n\nexport type CanonicalDocumentIdResolver = (\n  identifier: string,\n) => Promise<CanonicalDocumentId>;\n\n/**\n * The sanctioned string-to-CanonicalDocumentId cast: both the GraphQL layer\n * and server routes must resolve caller identifiers through this helper so\n * decision and data layers always agree on the subject document.\n */\nexport function createCanonicalDocumentIdResolver(\n  client: Pick<IReactorClient, \"resolveIdOrSlug\">,\n): CanonicalDocumentIdResolver {\n  return async (identifier: string) => {\n    let resolved: string;\n    try {\n      resolved = await client.resolveIdOrSlug(identifier);\n    } catch {\n      throw new CanonicalDocumentIdResolutionError();\n    }\n    return resolved as CanonicalDocumentId;\n  };\n}\n","import type {\n  IReactorClient,\n  IRelationalDb,\n  ISyncManager,\n  SyncScopeGate,\n} from \"@powerhousedao/reactor\";\nimport type { AuthSubject } from \"@powerhousedao/shared/document-model\";\nimport type {\n  GraphQLManager,\n  ISubgraph,\n  SubgraphArgs,\n} from \"@powerhousedao/reactor-api\";\nimport type { DocumentNode } from \"graphql\";\nimport { ForbiddenError, AuthenticationRequiredError } from \"./errors.js\";\nimport { gql } from \"graphql-tag\";\nimport {\n  AuthorizationPolicy,\n  AuthorizedDocumentHandle,\n  type CanonicalDocumentId,\n  type IAuthorizationService,\n} from \"../services/authorization.service.js\";\nimport {\n  createCanonicalDocumentIdResolver,\n  type CanonicalDocumentIdResolver,\n} from \"../services/canonical-document-id.js\";\nimport type { DocumentPermissionService } from \"../services/document-permission.service.js\";\nimport type { Context } from \"./types.js\";\n\nexport class BaseSubgraph implements ISubgraph {\n  name = \"example\";\n  // The host's base path as injected by the GraphQL manager. Routing\n  // ignores it: the manager mounts every subgraph under its own base path.\n  path = \"\";\n  resolvers: Record<string, any> = {\n    Query: {\n      hello: () => this.name,\n    },\n  };\n  typeDefs: DocumentNode = gql`\n    type Query {\n      hello: String\n    }\n  `;\n  reactorClient: IReactorClient;\n  /** This package's namespaced slice of the HTTP surface. */\n  readonly http: SubgraphArgs[\"http\"];\n  graphqlManager: GraphQLManager;\n  relationalDb: IRelationalDb;\n  syncManager: ISyncManager;\n  documentPermissionService?: DocumentPermissionService;\n  authorizationService: IAuthorizationService;\n  syncServingGate?: SyncScopeGate;\n\n  /**\n   * Per-request memo of raw identifier to canonical document id, keyed on the\n   * request context object so entries are released when the request ends. Lets\n   * batch resolvers resolve each distinct identifier at most once.\n   */\n  readonly #canonicalIdMemo = new WeakMap<\n    object,\n    Map<string, CanonicalDocumentId>\n  >();\n\n  readonly #resolveCanonical: CanonicalDocumentIdResolver;\n\n  constructor(args: SubgraphArgs) {\n    this.#resolveCanonical = createCanonicalDocumentIdResolver(\n      args.reactorClient,\n    );\n    this.http = args.http;\n    this.reactorClient = args.reactorClient;\n    this.graphqlManager = args.graphqlManager;\n    this.relationalDb = args.relationalDb;\n    this.syncManager = args.syncManager;\n    this.documentPermissionService = args.documentPermissionService;\n    this.authorizationService = args.authorizationService;\n    this.syncServingGate = args.syncServingGate;\n    this.path = args.path ?? \"\";\n  }\n\n  async onSetup() {\n    // noop\n  }\n\n  async onDisconnect(): Promise<void> {\n    // noop\n  }\n\n  // ============================================\n  // Shared permission helpers\n  // ============================================\n\n  /**\n   * Resolves a caller-supplied identifier (id or slug) to its canonical\n   * document id, memoized per request. Both the decision layer and the data\n   * layer must agree on the subject, so this runs the same resolveIdOrSlug\n   * lookup the data path uses. A resolution failure (not found, ambiguous, or\n   * transient) surfaces as a generic Forbidden, fail-closed, so a bad\n   * identifier cannot be used as a document-existence oracle.\n   */\n  async resolveCanonicalDocumentId(\n    identifier: string,\n    requestKey: object,\n  ): Promise<CanonicalDocumentId> {\n    let cache = this.#canonicalIdMemo.get(requestKey);\n    if (!cache) {\n      cache = new Map<string, CanonicalDocumentId>();\n      this.#canonicalIdMemo.set(requestKey, cache);\n    }\n\n    const cached = cache.get(identifier);\n    if (cached !== undefined) return cached;\n\n    let canonical: CanonicalDocumentId;\n    try {\n      canonical = await this.#resolveCanonical(identifier);\n    } catch {\n      throw new ForbiddenError();\n    }\n\n    cache.set(identifier, canonical);\n    return canonical;\n  }\n\n  /**\n   * Resolves the args' `documentId` to canonical form. Unconditional (unlike the\n   * assertCan* helpers, no admin skip): ACL rows are keyed on the canonical id.\n   */\n  async withCanonicalDocumentId<T extends { documentId: string }>(\n    args: T,\n    requestKey: object,\n  ): Promise<T & { documentId: CanonicalDocumentId }> {\n    const documentId = await this.resolveCanonicalDocumentId(\n      args.documentId,\n      requestKey,\n    );\n    return { ...args, documentId };\n  }\n\n  /**\n   * Resolves an identifier for a per-document check, or null when the caller has\n   * policy-wide access (OPEN or supreme admin) and the check can be skipped.\n   * Only DOCUMENT_PERMISSIONS keys on the document id, so other policies fail\n   * closed without resolving.\n   */\n  async #resolveForCheck(\n    identifier: string,\n    ctx: Context,\n  ): Promise<CanonicalDocumentId | null> {\n    if (this.authorizationService.isSupremeAdmin(ctx.user?.address)) {\n      return null;\n    }\n    if (\n      this.authorizationService.config.policy !==\n      AuthorizationPolicy.DOCUMENT_PERMISSIONS\n    ) {\n      throw new ForbiddenError();\n    }\n    return this.resolveCanonicalDocumentId(identifier, ctx);\n  }\n\n  /**\n   * Read filter for an already-canonical document id (one sourced from the data\n   * layer, such as a fetched document's id). Performs no slug resolution.\n   */\n  async canReadDocument(\n    documentId: CanonicalDocumentId,\n    ctx: Context,\n  ): Promise<boolean> {\n    return this.authorizationService.canRead(documentId, ctx.user?.address);\n  }\n\n  /**\n   * The principal a request decides as: the authenticated caller's address, and\n   * the did:key of the app instance whose token authenticated it.\n   *\n   * Both, because a policy can name either. The key is what a document records\n   * as its creator, so a subject built without one cannot match the creator's\n   * standing permission over the auth scope -- the document's own creator would\n   * be refused an operation the write path accepts, since a signed action\n   * carries the same key. Anonymous callers supply neither.\n   */\n  protected viewSubject(ctx: Context): AuthSubject {\n    return { address: ctx.user?.address, key: ctx.user?.appKey };\n  }\n\n  /**\n   * Asserts read access, resolving a slug first. Returns a handle whose\n   * `fetchIdentifier` the caller reuses for the data fetch; a denial throws.\n   */\n  async assertCanRead(\n    identifier: string,\n    ctx: Context,\n  ): Promise<AuthorizedDocumentHandle> {\n    const documentId = await this.#resolveForCheck(identifier, ctx);\n    if (documentId === null)\n      return AuthorizedDocumentHandle.skipped(identifier);\n    await this.assertCanReadCanonical(documentId, ctx);\n    return AuthorizedDocumentHandle.resolved(documentId);\n  }\n\n  async assertCanWrite(\n    identifier: string,\n    ctx: Context,\n  ): Promise<AuthorizedDocumentHandle> {\n    const documentId = await this.#resolveForCheck(identifier, ctx);\n    if (documentId === null)\n      return AuthorizedDocumentHandle.skipped(identifier);\n    await this.assertCanWriteCanonical(documentId, ctx);\n    return AuthorizedDocumentHandle.resolved(documentId);\n  }\n\n  async assertCanExecuteOperation(\n    identifier: string,\n    operationType: string,\n    ctx: Context,\n  ): Promise<AuthorizedDocumentHandle> {\n    const documentId = await this.#resolveForCheck(identifier, ctx);\n    if (documentId === null)\n      return AuthorizedDocumentHandle.skipped(identifier);\n    await this.assertCanExecuteOperationCanonical(\n      documentId,\n      operationType,\n      ctx,\n    );\n    return AuthorizedDocumentHandle.resolved(documentId);\n  }\n\n  /**\n   * Read assertion for an already-canonical document id. No slug resolution;\n   * use only with ids sourced from the data layer or already resolved.\n   */\n  async assertCanReadCanonical(\n    documentId: CanonicalDocumentId,\n    ctx: Context,\n  ): Promise<void> {\n    const canRead = await this.authorizationService.canRead(\n      documentId,\n      ctx.user?.address,\n    );\n    if (!canRead) {\n      throw new ForbiddenError(\"to read this document\");\n    }\n  }\n\n  async assertCanWriteCanonical(\n    documentId: CanonicalDocumentId,\n    ctx: Context,\n  ): Promise<void> {\n    const canWrite = await this.authorizationService.canWrite(\n      documentId,\n      ctx.user?.address,\n    );\n    if (!canWrite) {\n      throw new ForbiddenError(\"to write to this document\");\n    }\n  }\n\n  async assertCanExecuteOperationCanonical(\n    documentId: CanonicalDocumentId,\n    operationType: string,\n    ctx: Context,\n  ): Promise<void> {\n    const canMutate = await this.authorizationService.canMutate(\n      documentId,\n      operationType,\n      ctx.user?.address,\n    );\n    if (!canMutate) {\n      throw new ForbiddenError(\n        `to execute operation \"${operationType}\" on this document`,\n      );\n    }\n  }\n\n  assertCanCreate(ctx: Context): void {\n    if (this.authorizationService.canCreate(ctx.user?.address)) return;\n    if (ctx.user?.address) {\n      throw new ForbiddenError(\"to create documents\");\n    }\n    throw new AuthenticationRequiredError(\"to create documents\");\n  }\n}\n","import path from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n/**\n * Imports a specifier that may be either a bare package specifier or a\n * filesystem path. Absolute paths are converted to file:// URLs, because the\n * ESM loader reads the drive letter in a Windows path as a URL scheme\n * (`import('D:\\\\...')` fails with ERR_UNSUPPORTED_ESM_URL_SCHEME).\n */\nasync function importSpecifier<T>(target: string): Promise<T> {\n  const specifier = path.isAbsolute(target)\n    ? pathToFileURL(target).href\n    : target;\n  return (await import(/* @vite-ignore */ specifier)) as T;\n}\n\n/**\n * Attempts to import from suggested Node.js paths\n */\nasync function tryNodeSuggestedPaths<T>(\n  packageName: string,\n  subPath: string,\n): Promise<T | null> {\n  const suggestedPaths = [\n    `${packageName}/dist/node/${subPath}/index.mjs`,\n    `${packageName}/dist/node/${subPath}.mjs`,\n    `${packageName}/dist/${subPath}/index.js`,\n    `${packageName}/dist/${subPath}.js`,\n  ];\n\n  for (const suggestedPath of suggestedPaths) {\n    try {\n      return await importSpecifier<T>(suggestedPath);\n    } catch {\n      // Continue to next attempt\n    }\n  }\n\n  return null;\n}\n\n/**\n * Attempts to resolve package using import.meta.resolve\n */\nasync function tryImportMetaResolve<T>(\n  packageName: string,\n  subPath: string,\n): Promise<T | null> {\n  try {\n    const resolvedUrl = import.meta.resolve?.(`${packageName}/package.json`);\n    if (!resolvedUrl) return null;\n\n    // fileURLToPath, not URL.pathname: the latter yields \"/D:/...\" on Windows.\n    const packageRoot = path.dirname(fileURLToPath(resolvedUrl));\n    const pathsToTry = [\n      path.join(packageRoot, \"dist\", \"node\", subPath, \"index.mjs\"),\n      path.join(packageRoot, \"dist\", \"node\", `${subPath}.mjs`),\n      path.join(packageRoot, \"dist\", subPath, \"index.js\"),\n      path.join(packageRoot, \"dist\", `${subPath}.js`),\n      path.join(packageRoot, subPath, \"index.js\"),\n      path.join(packageRoot, `${subPath}.js`),\n    ];\n\n    for (const attemptPath of pathsToTry) {\n      try {\n        return await importSpecifier<T>(attemptPath);\n      } catch {\n        // Continue to next attempt\n      }\n    }\n  } catch {\n    // import.meta.resolve failed\n  }\n\n  return null;\n}\n\n/**\n * Resolves symlinks in node_modules to find the real package location\n */\nasync function resolveSymlinkedPaths(\n  packageName: string,\n  subPath: string,\n): Promise<string[]> {\n  const packageBaseName = packageName.includes(\"/\")\n    ? packageName.split(\"/\").pop()\n    : packageName;\n  const nodeModulesPatterns = [\n    path.join(process.cwd(), \"node_modules\", packageName),\n    path.join(process.cwd(), \"node_modules\", packageBaseName || packageName),\n  ];\n\n  const workspacePatterns: string[] = [];\n\n  for (const nodeModulesPath of nodeModulesPatterns) {\n    try {\n      const fs = await import(\"node:fs\");\n      if (fs.existsSync(nodeModulesPath)) {\n        const realPath = fs.realpathSync(nodeModulesPath);\n\n        workspacePatterns.push(\n          path.join(realPath, \"dist\", \"node\", subPath, \"index.mjs\"),\n          path.join(realPath, \"dist\", \"node\", `${subPath}.mjs`),\n          path.join(realPath, \"dist\", subPath, \"index.js\"),\n          path.join(realPath, \"dist\", `${subPath}.js`),\n          path.join(realPath, subPath, \"index.js\"),\n          path.join(realPath, `${subPath}.js`),\n        );\n      }\n    } catch {\n      // Continue to next attempt\n    }\n  }\n\n  return workspacePatterns;\n}\n\n/**\n * Generates common workspace pattern paths\n */\nfunction getCommonWorkspacePaths(\n  packageName: string,\n  subPath: string,\n): string[] {\n  const packageBaseName = packageName.includes(\"/\")\n    ? packageName.split(\"/\").pop()\n    : packageName;\n  const commonRoots = [process.cwd(), path.dirname(process.cwd())];\n\n  const workspacePatterns: string[] = [];\n  for (const root of commonRoots) {\n    workspacePatterns.push(\n      path.join(\n        root,\n        \"packages\",\n        packageBaseName || packageName,\n        \"dist\",\n        \"node\",\n        subPath,\n        \"index.mjs\",\n      ),\n      path.join(\n        root,\n        \"packages\",\n        packageBaseName || packageName,\n        \"dist\",\n        \"node\",\n        `${subPath}.mjs`,\n      ),\n      path.join(\n        root,\n        \"packages\",\n        packageBaseName || packageName,\n        \"dist\",\n        subPath,\n        \"index.js\",\n      ),\n      path.join(\n        root,\n        \"packages\",\n        packageBaseName || packageName,\n        \"dist\",\n        `${subPath}.js`,\n      ),\n    );\n  }\n\n  return workspacePatterns;\n}\n\n/**\n * Attempts to import from a list of workspace patterns\n */\nasync function tryWorkspacePatterns<T>(patterns: string[]): Promise<T | null> {\n  for (const workspacePath of patterns) {\n    try {\n      return await importSpecifier<T>(workspacePath);\n    } catch {\n      // Continue to next attempt\n    }\n  }\n\n  return null;\n}\n\n/**\n * Attempts to resolve linked packages using various fallback strategies\n */\nexport async function resolveLinkedPackage<T>(\n  packageName: string,\n  subPath: string,\n): Promise<T | null> {\n  // Try Node.js suggested paths first\n  let result = await tryNodeSuggestedPaths<T>(packageName, subPath);\n  if (result) return result;\n\n  // Try import.meta.resolve\n  result = await tryImportMetaResolve<T>(packageName, subPath);\n  if (result) return result;\n\n  // Try symlink resolution\n  const symlinkPaths = await resolveSymlinkedPaths(packageName, subPath);\n  result = await tryWorkspacePatterns<T>(symlinkPaths);\n  if (result) return result;\n\n  // Try common workspace patterns as final fallback\n  const commonPaths = getCommonWorkspacePaths(packageName, subPath);\n  result = await tryWorkspacePatterns<T>(commonPaths);\n  if (result) return result;\n\n  return null;\n}\n","import type {\n  ProcessorFactoryBuilder,\n  SubgraphClass,\n} from \"@powerhousedao/reactor-api\";\nimport type {\n  DocumentModelModule,\n  UpgradeManifest,\n} from \"@powerhousedao/shared/document-model\";\nimport { childLogger } from \"document-model\";\nimport { execSync } from \"node:child_process\";\nimport path from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { resolveLinkedPackage } from \"./import-resolver.js\";\n\n// Define the expected module export structures\ntype DocumentModelsExport = Record<string, DocumentModelModule>;\ntype SubgraphsExport = Record<string, Record<string, SubgraphClass>>;\ntype ProcessorsExport = {\n  processorFactory?: ProcessorFactoryBuilder;\n  processorFactoryLegacy?: ProcessorFactoryBuilder;\n};\n\nconst _logger = childLogger([\"reactor-api\", \"packages/util\"]);\n\nexport const installPackages = (packages: string[]): Promise<void> => {\n  for (const packageName of packages) {\n    execSync(`ph install ${packageName}`);\n  }\n  return Promise.resolve();\n};\n\nexport const readManifest = () => {\n  const manifest = execSync(`ph manifest`).toString();\n  return manifest;\n};\n\n/**\n * Tries to import document models from a package. This function cannot throw.\n */\nexport async function loadDocumentModels(\n  packageName: string,\n): Promise<DocumentModelsExport | null> {\n  return loadDependency(packageName, \"document-models\");\n}\n\n/**\n * Tries to import subgraphs from a package. This function cannot throw.\n */\nexport async function loadSubgraphs(\n  packageName: string,\n): Promise<SubgraphsExport | null> {\n  return loadDependency(packageName, \"subgraphs\");\n}\n\n/**\n * Tries to import processors from a package. This function cannot throw.\n */\nexport async function loadProcessors(\n  packageName: string,\n): Promise<ProcessorsExport | null> {\n  return loadDependency(packageName, \"processors\");\n}\n\n/**\n * Generic dependency loader - tries to import a dependency from a package. This function cannot throw.\n * Returns null if the dependency cannot be loaded.\n */\nasync function loadDependency<T = unknown>(\n  packageName: string,\n  subPath: string,\n): Promise<T> {\n  // A local package is identified by an absolute path, which has to become a\n  // file:// URL: the ESM loader reads the drive letter in a Windows path as a\n  // URL scheme.\n  const fullPath = path.isAbsolute(packageName)\n    ? pathToFileURL(path.join(packageName, subPath)).href\n    : `${packageName}/${subPath}`;\n\n  // Try the standard import first\n  try {\n    // vite does not support this, but that's okay as we have provided the\n    // vite-loader for this purpose\n\n    const module = (await import(/* @vite-ignore */ fullPath)) as T;\n    return module;\n  } catch (e) {\n    // Handle module not found errors with fallback resolution.\n    // ERR_UNSUPPORTED_ESM_URL_SCHEME joins the list because a directory\n    // specifier that is a plain path fails with it on Windows where POSIX\n    // reports ERR_UNSUPPORTED_DIR_IMPORT.\n    if (\n      e instanceof Error &&\n      \"code\" in e &&\n      (e.code === \"ERR_MODULE_NOT_FOUND\" ||\n        e.code === \"ERR_UNSUPPORTED_DIR_IMPORT\" ||\n        e.code === \"ERR_UNSUPPORTED_ESM_URL_SCHEME\")\n    ) {\n      const result = await resolveLinkedPackage<T>(packageName, subPath);\n      if (result) return result;\n    }\n    throw e;\n  }\n}\n\nfunction isUpgradeManifest(\n  value: unknown,\n): value is UpgradeManifest<readonly number[]> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"documentType\" in value &&\n    \"supportedVersions\" in value &&\n    \"upgrades\" in value\n  );\n}\n\n/**\n * Collects upgrade manifests from a package's document-models namespace.\n * Handles both the aggregate `upgradeManifests` array export and individual\n * manifest exports; dedupes by documentType.\n */\nexport function extractUpgradeManifests(\n  namespace: Record<string, unknown>,\n): UpgradeManifest<readonly number[]>[] {\n  const manifests = new Map<string, UpgradeManifest<readonly number[]>>();\n  const add = (value: unknown) => {\n    if (isUpgradeManifest(value)) {\n      manifests.set(value.documentType, value);\n    }\n  };\n  for (const value of Object.values(namespace)) {\n    if (Array.isArray(value)) {\n      value.forEach(add);\n    } else {\n      add(value);\n    }\n  }\n  return Array.from(manifests.values());\n}\n\nexport function debounce<T extends unknown[], R>(\n  func: (...args: T) => Promise<R>,\n  delay = 250,\n) {\n  let timer: number;\n  return (immediate = false, ...args: T) => {\n    if (timer) {\n      clearTimeout(timer);\n    }\n    return new Promise<R>((resolve, reject) => {\n      if (immediate) {\n        func(...args)\n          .then(resolve)\n          .catch(reject);\n      } else {\n        timer = setTimeout(() => {\n          func(...args)\n            .then(resolve)\n            .catch(reject);\n        }, delay) as unknown as number;\n      }\n    });\n  };\n}\n\nexport function isSubpath(parent: string, dir: string) {\n  const relative = path.relative(parent, dir);\n  return relative && !relative.startsWith(\"..\") && !path.isAbsolute(relative);\n}\n","import type {\n  GqlDocument,\n  GqlDriveDocument,\n  GqlOperation,\n  SubgraphClass,\n} from \"@powerhousedao/reactor-api\";\nimport type { DocumentDriveDocument } from \"@powerhousedao/shared/document-drive\";\nimport type {\n  Operation,\n  PHDocument,\n} from \"@powerhousedao/shared/document-model\";\nimport { BaseSubgraph } from \"./base-subgraph.js\";\n\nexport function isSubgraphClass(\n  candidate: unknown,\n): candidate is SubgraphClass {\n  if (typeof candidate !== \"function\") return false;\n\n  let proto: unknown = Object.getPrototypeOf(candidate);\n  while (proto) {\n    if (Object.prototype.isPrototypeOf.call(proto, BaseSubgraph)) return true;\n\n    proto = Object.getPrototypeOf(proto);\n  }\n\n  return false;\n}\n\nexport function buildGraphqlOperations(\n  operations: Operation[],\n  skip: number,\n  first: number,\n): GqlOperation[] {\n  return operations.slice(skip, skip + first).map(buildGraphqlOperation);\n}\n\nexport function buildGraphqlOperation(operation: Operation): GqlOperation {\n  const signer = operation.action.context?.signer;\n  return {\n    id: operation.id ?? \"\",\n    type: operation.action.type,\n    index: operation.index,\n    timestampUtcMs: operation.timestampUtcMs,\n    hash: operation.hash,\n    skip: operation.skip,\n    inputText:\n      typeof operation.action.input === \"string\"\n        ? operation.action.input\n        : JSON.stringify(operation.action.input),\n    error: operation.error,\n    context: {\n      signer: signer\n        ? {\n            user: signer.user,\n            app: signer.app,\n            signatures: signer.signatures.map((sig) =>\n              Array.isArray(sig) ? sig.join(\", \") : sig,\n            ),\n          }\n        : undefined,\n    },\n  };\n}\n\nexport function buildGraphQlDocument(doc: PHDocument): GqlDocument {\n  // Return full state with all scopes (auth, document, global, local)\n  // This matches the ReactorSubgraph pattern in adapters.ts\n  const state = doc.state;\n  const initialState = doc.initialState;\n  // For stateJSON, use global state for backward compatibility\n  const globalState = \"global\" in doc.state ? doc.state.global : {};\n  return {\n    id: doc.header.id,\n    name: doc.header.name,\n    documentType: doc.header.documentType,\n    revision: doc.header.revision.global || 0,\n    createdAtUtcIso: doc.header.createdAtUtcIso,\n    lastModifiedAtUtcIso: doc.header.lastModifiedAtUtcIso,\n    operations: [],\n    stateJSON: globalState as JSON,\n    state,\n    initialState,\n  };\n}\n\nexport function buildGraphQlDriveDocument(\n  doc: DocumentDriveDocument,\n): GqlDriveDocument {\n  const gqlDoc = buildGraphQlDocument(doc);\n  return {\n    ...gqlDoc,\n    meta: {\n      preferredEditor: doc.header.meta?.preferredEditor,\n    },\n    slug: doc.header.slug,\n    state: doc.state.global,\n    initialState: doc.state.global,\n  };\n}\n"],"names":["#permissions","#getParentIds","#canAccess","#isDocumentAdmin","#grantLevel","#hasGrantInHierarchy","#canonicalIdMemo","#resolveCanonical","#resolveForCheck"],"mappings":";;;;;;;;;;AAOA,IAAa,iBAAb,cAAoC,aAAa;CAC/C,YAAY,SAAS,IAAI;EACvB,MAAM,OAAO,0BAA0B;AACvC,QAAM,GAAG,OAAO,SAAS,IAAI,WAAW,MAAM,EAC5C,YAAY,EAAE,MAAM,aAAa,EAClC,CAAC;;;;AAKN,IAAa,8BAAb,cAAiD,aAAa;CAC5D,YAAY,SAAS,IAAI;EACvB,MAAM,OAAO,0BAA0B;AACvC,QAAM,GAAG,OAAO,SAAS,IAAI,WAAW,MAAM,EAC5C,YAAY,EAAE,MAAM,mBAAmB,EACxC,CAAC;;;;;;;;;;;;;AAcN,IAAa,iCAAb,cAAoD,aAAa;CAC/D,cAAc;AACZ,QACE,sIAEA,EAAE,YAAY,EAAE,MAAM,+BAA+B,EAAE,CACxD;;;;;;;;;;;;;;;;;;;;;;AAuBL,IAAa,gCAAb,cAAmD,aAAa;CAC9D,YAAY,QAAgB;AAC1B,QAAM,sCAAsC,UAAU,EACpD,YAAY,EACV,MAAM,gCAAgC,0BACvC,EACF,CAAC;;;;;;;;;;AC7CN,IAAa,2BAAb,MAAa,yBAAyB;CACpC,YACE,iBACA,YACA;AAFS,OAAA,kBAAA;AACA,OAAA,aAAA;;CAGX,OAAO,SAAS,YAA2D;AACzE,SAAO,IAAI,yBAAyB,YAAY,KAAK;;CAGvD,OAAO,QAAQ,YAA8C;AAC3D,SAAO,IAAI,yBAAyB,YAAY,MAAM;;;CAIxD,cAAmC;AACjC,MAAI,CAAC,KAAK,WACR,OAAM,IAAI,MACR,qGACD;AAEH,SAAO,KAAK;;;AAIhB,MAAa,sBAAsB;CACjC,MAAM;CACN,YAAY;CACZ,sBAAsB;CACvB;;AAoED,IAAe,2BAAf,MAAyE;CACvE,YAAY,QAAsC;AAA7B,OAAA,SAAA;;CAErB,eAAe,aAA+B;AAC5C,MAAI,CAAC,YAAa,QAAO;AACzB,SAAO,KAAK,OAAO,OAAO,SAAS,YAAY,aAAa,CAAC;;;;AA4BjE,IAAM,2BAAN,cAAuC,yBAAyB;CAC9D,iBAA0B;AACxB,SAAO;;CAGT,YAAqB;AACnB,SAAO;;CAGT,UAA4B;AAC1B,SAAO,QAAQ,QAAQ,KAAK;;CAG9B,WAA6B;AAC3B,SAAO,QAAQ,QAAQ,KAAK;;CAG9B,YAA8B;AAC5B,SAAO,QAAQ,QAAQ,KAAK;;CAG9B,YAA8B;AAC5B,SAAO,QAAQ,QAAQ,KAAK;;;;AAKhC,IAAM,gCAAN,cAA4C,yBAAyB;CACnE,UAAU,aAA+B;AACvC,SAAO,KAAK,eAAe,YAAY;;CAGzC,QACE,aACA,aACkB;AAClB,SAAO,QAAQ,QAAQ,KAAK,eAAe,YAAY,CAAC;;CAG1D,SACE,aACA,aACkB;AAClB,SAAO,QAAQ,QAAQ,KAAK,eAAe,YAAY,CAAC;;CAG1D,UACE,aACA,aACkB;AAClB,SAAO,QAAQ,QAAQ,KAAK,eAAe,YAAY,CAAC;;CAG1D,UACE,aACA,gBACA,aACkB;AAClB,SAAO,QAAQ,QAAQ,KAAK,eAAe,YAAY,CAAC;;;AAI5D,MAAM,kBAA2D;CAC/D,MAAM;CACN,OAAO;CACP,OAAO;CACR;AAED,SAAS,UACP,OACA,UACS;AACT,QAAO,UAAU,QAAQ,gBAAgB,UAAU,gBAAgB;;;;;;;;AASrE,IAAM,0CAAN,cAAsD,yBAAyB;CAC7E;CACA;CAEA,YACE,aACA,cACA,QACA;AACA,QAAM,OAAO;AACb,QAAA,cAAoB;AACpB,QAAA,eAAqB;;CAGvB,UAAU,aAA+B;AACvC,SAAO,KAAK,eAAe,YAAY,IAAI,CAAC,CAAC;;CAG/C,QACE,YACA,aACkB;AAClB,SAAO,MAAA,UAAgB,YAAY,QAAQ,YAAY;;CAGzD,SACE,YACA,aACkB;AAClB,SAAO,MAAA,UAAgB,YAAY,SAAS,YAAY;;CAG1D,UACE,YACA,aACkB;AAClB,SAAO,MAAA,gBAAsB,YAAY,YAAY;;CAGvD,MAAM,UACJ,YACA,eACA,aACkB;AAClB,MAAI,KAAK,eAAe,YAAY,CAAE,QAAO;AAM7C,MAJqB,MAAM,MAAA,YAAkB,sBAC3C,YACA,cACD,EACiB;AAChB,OAAI,CAAC,YAAa,QAAO;AACzB,OAAI,MAAM,MAAA,gBAAsB,YAAY,YAAY,CAAE,QAAO;AACjE,UAAO,MAAA,YAAkB,kBACvB,YACA,eACA,YACD;;AAGH,SAAO,MAAA,UAAgB,YAAY,SAAS,YAAY;;;;;;CAO1D,OAAA,gBACE,YACA,aACkB;AAClB,MAAI,KAAK,eAAe,YAAY,CAAE,QAAO;AAC7C,MAAI,CAAC,YAAa,QAAO;EAEzB,MAAM,QAAQ,MAAM,MAAA,YAAkB,iBAAiB,WAAW;AAClE,MAAI,SAAS,UAAU,YAAY,aAAa,CAAE,QAAO;AAEzD,SAAO,UAAU,MAAM,MAAA,WAAiB,YAAY,YAAY,EAAE,QAAQ;;;;;;CAO5E,OAAA,UACE,YACA,UACA,aACkB;AAClB,MAAI,KAAK,eAAe,YAAY,CAAE,QAAO;AAM7C,MAAI,CAJgB,MAAM,MAAA,YAAkB,yBAC1C,YACA,MAAA,aACD,CACiB,QAAO;AACzB,MAAI,CAAC,YAAa,QAAO;EAEzB,MAAM,QAAQ,MAAM,MAAA,YAAkB,iBAAiB,WAAW;AAClE,MAAI,SAAS,UAAU,YAAY,aAAa,CAAE,QAAO;AAEzD,SAAO,MAAA,oBAA0B,YAAY,aAAa,SAAS;;;CAIrE,OAAA,WACE,YACA,aACyC;AACzC,SAAO,MAAA,YAAkB,kBAAkB,YAAY,YAAY;;;;;;CAOrE,OAAA,oBACE,YACA,aACA,UACkB;EAClB,MAAM,0BAAU,IAAI,KAAa;EACjC,MAAM,QAAQ,CAAC,WAAW;AAE1B,SAAO,MAAM,SAAS,GAAG;GACvB,MAAM,UAAU,MAAM,OAAO;AAC7B,OAAI,QAAQ,IAAI,QAAQ,CAAE;AAC1B,WAAQ,IAAI,QAAQ;AAGpB,OAAI,UADU,MAAM,MAAA,WAAiB,SAAS,YAAY,EACrC,SAAS,CAAE,QAAO;AAEvC,QAAK,MAAM,YAAY,MAAM,MAAA,aAAmB,QAAQ,CACtD,KAAI,CAAC,QAAQ,IAAI,SAAS,CAAE,OAAM,KAAK,SAAS;;AAIpD,SAAO;;;;;;;AAQX,SAAgB,2BACd,QACA,2BACA,cACuB;AACvB,KAAI,OAAO,WAAW,oBAAoB,KACxC,QAAO,IAAI,yBAAyB,OAAO;AAE7C,KAAI,OAAO,WAAW,oBAAoB,WACxC,QAAO,IAAI,8BAA8B,OAAO;AAElD,KAAI,CAAC,0BACH,OAAM,IAAI,MACR,4EACD;AAEH,KAAI,CAAC,aACH,OAAM,IAAI,MACR,0EACD;AAEH,QAAO,IAAI,wCACT,2BACA,cACA,OACD;;;;;;;;;;AC9YH,IAAa,qCAAb,cAAwD,MAAM;CAC5D,cAAc;AACZ,QAAM,4CAA4C;AAClD,OAAK,OAAO;;;;;;;;AAahB,SAAgB,kCACd,QAC6B;AAC7B,QAAO,OAAO,eAAuB;EACnC,IAAI;AACJ,MAAI;AACF,cAAW,MAAM,OAAO,gBAAgB,WAAW;UAC7C;AACN,SAAM,IAAI,oCAAoC;;AAEhD,SAAO;;;;;ACPX,IAAa,eAAb,MAA+C;CAC7C,OAAO;CAGP,OAAO;CACP,YAAiC,EAC/B,OAAO,EACL,aAAa,KAAK,MACnB,EACF;CACD,WAAyB,GAAG;;;;;CAK5B;;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;;;;;;CAOA,mCAA4B,IAAI,SAG7B;CAEH;CAEA,YAAY,MAAoB;AAC9B,QAAA,mBAAyB,kCACvB,KAAK,cACN;AACD,OAAK,OAAO,KAAK;AACjB,OAAK,gBAAgB,KAAK;AAC1B,OAAK,iBAAiB,KAAK;AAC3B,OAAK,eAAe,KAAK;AACzB,OAAK,cAAc,KAAK;AACxB,OAAK,4BAA4B,KAAK;AACtC,OAAK,uBAAuB,KAAK;AACjC,OAAK,kBAAkB,KAAK;AAC5B,OAAK,OAAO,KAAK,QAAQ;;CAG3B,MAAM,UAAU;CAIhB,MAAM,eAA8B;;;;;;;;;CAgBpC,MAAM,2BACJ,YACA,YAC8B;EAC9B,IAAI,QAAQ,MAAA,gBAAsB,IAAI,WAAW;AACjD,MAAI,CAAC,OAAO;AACV,2BAAQ,IAAI,KAAkC;AAC9C,SAAA,gBAAsB,IAAI,YAAY,MAAM;;EAG9C,MAAM,SAAS,MAAM,IAAI,WAAW;AACpC,MAAI,WAAW,KAAA,EAAW,QAAO;EAEjC,IAAI;AACJ,MAAI;AACF,eAAY,MAAM,MAAA,iBAAuB,WAAW;UAC9C;AACN,SAAM,IAAI,gBAAgB;;AAG5B,QAAM,IAAI,YAAY,UAAU;AAChC,SAAO;;;;;;CAOT,MAAM,wBACJ,MACA,YACkD;EAClD,MAAM,aAAa,MAAM,KAAK,2BAC5B,KAAK,YACL,WACD;AACD,SAAO;GAAE,GAAG;GAAM;GAAY;;;;;;;;CAShC,OAAA,gBACE,YACA,KACqC;AACrC,MAAI,KAAK,qBAAqB,eAAe,IAAI,MAAM,QAAQ,CAC7D,QAAO;AAET,MACE,KAAK,qBAAqB,OAAO,WACjC,oBAAoB,qBAEpB,OAAM,IAAI,gBAAgB;AAE5B,SAAO,KAAK,2BAA2B,YAAY,IAAI;;;;;;CAOzD,MAAM,gBACJ,YACA,KACkB;AAClB,SAAO,KAAK,qBAAqB,QAAQ,YAAY,IAAI,MAAM,QAAQ;;;;;;;;;;;;CAazE,YAAsB,KAA2B;AAC/C,SAAO;GAAE,SAAS,IAAI,MAAM;GAAS,KAAK,IAAI,MAAM;GAAQ;;;;;;CAO9D,MAAM,cACJ,YACA,KACmC;EACnC,MAAM,aAAa,MAAM,MAAA,gBAAsB,YAAY,IAAI;AAC/D,MAAI,eAAe,KACjB,QAAO,yBAAyB,QAAQ,WAAW;AACrD,QAAM,KAAK,uBAAuB,YAAY,IAAI;AAClD,SAAO,yBAAyB,SAAS,WAAW;;CAGtD,MAAM,eACJ,YACA,KACmC;EACnC,MAAM,aAAa,MAAM,MAAA,gBAAsB,YAAY,IAAI;AAC/D,MAAI,eAAe,KACjB,QAAO,yBAAyB,QAAQ,WAAW;AACrD,QAAM,KAAK,wBAAwB,YAAY,IAAI;AACnD,SAAO,yBAAyB,SAAS,WAAW;;CAGtD,MAAM,0BACJ,YACA,eACA,KACmC;EACnC,MAAM,aAAa,MAAM,MAAA,gBAAsB,YAAY,IAAI;AAC/D,MAAI,eAAe,KACjB,QAAO,yBAAyB,QAAQ,WAAW;AACrD,QAAM,KAAK,mCACT,YACA,eACA,IACD;AACD,SAAO,yBAAyB,SAAS,WAAW;;;;;;CAOtD,MAAM,uBACJ,YACA,KACe;AAKf,MAAI,CAJY,MAAM,KAAK,qBAAqB,QAC9C,YACA,IAAI,MAAM,QACX,CAEC,OAAM,IAAI,eAAe,wBAAwB;;CAIrD,MAAM,wBACJ,YACA,KACe;AAKf,MAAI,CAJa,MAAM,KAAK,qBAAqB,SAC/C,YACA,IAAI,MAAM,QACX,CAEC,OAAM,IAAI,eAAe,4BAA4B;;CAIzD,MAAM,mCACJ,YACA,eACA,KACe;AAMf,MAAI,CALc,MAAM,KAAK,qBAAqB,UAChD,YACA,eACA,IAAI,MAAM,QACX,CAEC,OAAM,IAAI,eACR,yBAAyB,cAAc,oBACxC;;CAIL,gBAAgB,KAAoB;AAClC,MAAI,KAAK,qBAAqB,UAAU,IAAI,MAAM,QAAQ,CAAE;AAC5D,MAAI,IAAI,MAAM,QACZ,OAAM,IAAI,eAAe,sBAAsB;AAEjD,QAAM,IAAI,4BAA4B,sBAAsB;;;;;;;;;;;AC/QhE,eAAe,gBAAmB,QAA4B;AAI5D,QAAQ,OAHU,KAAK,WAAW,OAAO,GAAA,OACrC,cAAc,OAAO,CAAC,QAAA,OACtB;;;;;AAON,eAAe,sBACb,aACA,SACmB;CACnB,MAAM,iBAAiB;EACrB,GAAG,YAAY,aAAa,QAAQ;EACpC,GAAG,YAAY,aAAa,QAAQ;EACpC,GAAG,YAAY,QAAQ,QAAQ;EAC/B,GAAG,YAAY,QAAQ,QAAQ;EAChC;AAED,MAAK,MAAM,iBAAiB,eAC1B,KAAI;AACF,SAAO,MAAM,gBAAmB,cAAc;SACxC;AAKV,QAAO;;;;;AAMT,eAAe,qBACb,aACA,SACmB;AACnB,KAAI;EACF,MAAM,cAAc,OAAO,KAAK,UAAU,GAAG,YAAY,eAAe;AACxE,MAAI,CAAC,YAAa,QAAO;EAGzB,MAAM,cAAc,KAAK,QAAQ,cAAc,YAAY,CAAC;EAC5D,MAAM,aAAa;GACjB,KAAK,KAAK,aAAa,QAAQ,QAAQ,SAAS,YAAY;GAC5D,KAAK,KAAK,aAAa,QAAQ,QAAQ,GAAG,QAAQ,MAAM;GACxD,KAAK,KAAK,aAAa,QAAQ,SAAS,WAAW;GACnD,KAAK,KAAK,aAAa,QAAQ,GAAG,QAAQ,KAAK;GAC/C,KAAK,KAAK,aAAa,SAAS,WAAW;GAC3C,KAAK,KAAK,aAAa,GAAG,QAAQ,KAAK;GACxC;AAED,OAAK,MAAM,eAAe,WACxB,KAAI;AACF,UAAO,MAAM,gBAAmB,YAAY;UACtC;SAIJ;AAIR,QAAO;;;;;AAMT,eAAe,sBACb,aACA,SACmB;CACnB,MAAM,kBAAkB,YAAY,SAAS,IAAI,GAC7C,YAAY,MAAM,IAAI,CAAC,KAAK,GAC5B;CACJ,MAAM,sBAAsB,CAC1B,KAAK,KAAK,QAAQ,KAAK,EAAE,gBAAgB,YAAY,EACrD,KAAK,KAAK,QAAQ,KAAK,EAAE,gBAAgB,mBAAmB,YAAY,CACzE;CAED,MAAM,oBAA8B,EAAE;AAEtC,MAAK,MAAM,mBAAmB,oBAC5B,KAAI;EACF,MAAM,KAAK,MAAM,OAAO;AACxB,MAAI,GAAG,WAAW,gBAAgB,EAAE;GAClC,MAAM,WAAW,GAAG,aAAa,gBAAgB;AAEjD,qBAAkB,KAChB,KAAK,KAAK,UAAU,QAAQ,QAAQ,SAAS,YAAY,EACzD,KAAK,KAAK,UAAU,QAAQ,QAAQ,GAAG,QAAQ,MAAM,EACrD,KAAK,KAAK,UAAU,QAAQ,SAAS,WAAW,EAChD,KAAK,KAAK,UAAU,QAAQ,GAAG,QAAQ,KAAK,EAC5C,KAAK,KAAK,UAAU,SAAS,WAAW,EACxC,KAAK,KAAK,UAAU,GAAG,QAAQ,KAAK,CACrC;;SAEG;AAKV,QAAO;;;;;AAMT,SAAS,wBACP,aACA,SACU;CACV,MAAM,kBAAkB,YAAY,SAAS,IAAI,GAC7C,YAAY,MAAM,IAAI,CAAC,KAAK,GAC5B;CACJ,MAAM,cAAc,CAAC,QAAQ,KAAK,EAAE,KAAK,QAAQ,QAAQ,KAAK,CAAC,CAAC;CAEhE,MAAM,oBAA8B,EAAE;AACtC,MAAK,MAAM,QAAQ,YACjB,mBAAkB,KAChB,KAAK,KACH,MACA,YACA,mBAAmB,aACnB,QACA,QACA,SACA,YACD,EACD,KAAK,KACH,MACA,YACA,mBAAmB,aACnB,QACA,QACA,GAAG,QAAQ,MACZ,EACD,KAAK,KACH,MACA,YACA,mBAAmB,aACnB,QACA,SACA,WACD,EACD,KAAK,KACH,MACA,YACA,mBAAmB,aACnB,QACA,GAAG,QAAQ,KACZ,CACF;AAGH,QAAO;;;;;AAMT,eAAe,qBAAwB,UAAuC;AAC5E,MAAK,MAAM,iBAAiB,SAC1B,KAAI;AACF,SAAO,MAAM,gBAAmB,cAAc;SACxC;AAKV,QAAO;;;;;AAMT,eAAsB,qBACpB,aACA,SACmB;CAEnB,IAAI,SAAS,MAAM,sBAAyB,aAAa,QAAQ;AACjE,KAAI,OAAQ,QAAO;AAGnB,UAAS,MAAM,qBAAwB,aAAa,QAAQ;AAC5D,KAAI,OAAQ,QAAO;AAInB,UAAS,MAAM,qBADM,MAAM,sBAAsB,aAAa,QAAQ,CAClB;AACpD,KAAI,OAAQ,QAAO;AAInB,UAAS,MAAM,qBADK,wBAAwB,aAAa,QAAQ,CACd;AACnD,KAAI,OAAQ,QAAO;AAEnB,QAAO;;;;AC5LO,YAAY,CAAC,eAAe,gBAAgB,CAAC;;;;AAiB7D,eAAsB,mBACpB,aACsC;AACtC,QAAO,eAAe,aAAa,kBAAkB;;;;;AAMvD,eAAsB,cACpB,aACiC;AACjC,QAAO,eAAe,aAAa,YAAY;;;;;AAMjD,eAAsB,eACpB,aACkC;AAClC,QAAO,eAAe,aAAa,aAAa;;;;;;AAOlD,eAAe,eACb,aACA,SACY;CAIZ,MAAM,WAAW,KAAK,WAAW,YAAY,GACzC,cAAc,KAAK,KAAK,aAAa,QAAQ,CAAC,CAAC,OAC/C,GAAG,YAAY,GAAG;AAGtB,KAAI;AAKF,SADgB,MAAM;;GAA0B;;UAEzC,GAAG;AAKV,MACE,aAAa,SACb,UAAU,MACT,EAAE,SAAS,0BACV,EAAE,SAAS,gCACX,EAAE,SAAS,mCACb;GACA,MAAM,SAAS,MAAM,qBAAwB,aAAa,QAAQ;AAClE,OAAI,OAAQ,QAAO;;AAErB,QAAM;;;AAIV,SAAS,kBACP,OAC6C;AAC7C,QACE,OAAO,UAAU,YACjB,UAAU,QACV,kBAAkB,SAClB,uBAAuB,SACvB,cAAc;;;;;;;AASlB,SAAgB,wBACd,WACsC;CACtC,MAAM,4BAAY,IAAI,KAAiD;CACvE,MAAM,OAAO,UAAmB;AAC9B,MAAI,kBAAkB,MAAM,CAC1B,WAAU,IAAI,MAAM,cAAc,MAAM;;AAG5C,MAAK,MAAM,SAAS,OAAO,OAAO,UAAU,CAC1C,KAAI,MAAM,QAAQ,MAAM,CACtB,OAAM,QAAQ,IAAI;KAElB,KAAI,MAAM;AAGd,QAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;;AAGvC,SAAgB,SACd,MACA,QAAQ,KACR;CACA,IAAI;AACJ,SAAQ,YAAY,OAAO,GAAG,SAAY;AACxC,MAAI,MACF,cAAa,MAAM;AAErB,SAAO,IAAI,SAAY,SAAS,WAAW;AACzC,OAAI,UACF,MAAK,GAAG,KAAK,CACV,KAAK,QAAQ,CACb,MAAM,OAAO;OAEhB,SAAQ,iBAAiB;AACvB,SAAK,GAAG,KAAK,CACV,KAAK,QAAQ,CACb,MAAM,OAAO;MACf,MAAM;IAEX;;;AAIN,SAAgB,UAAU,QAAgB,KAAa;CACrD,MAAM,WAAW,KAAK,SAAS,QAAQ,IAAI;AAC3C,QAAO,YAAY,CAAC,SAAS,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW,SAAS;;;;AC1J7E,SAAgB,gBACd,WAC4B;AAC5B,KAAI,OAAO,cAAc,WAAY,QAAO;CAE5C,IAAI,QAAiB,OAAO,eAAe,UAAU;AACrD,QAAO,OAAO;AACZ,MAAI,OAAO,UAAU,cAAc,KAAK,OAAO,aAAa,CAAE,QAAO;AAErE,UAAQ,OAAO,eAAe,MAAM;;AAGtC,QAAO;;AAGT,SAAgB,uBACd,YACA,MACA,OACgB;AAChB,QAAO,WAAW,MAAM,MAAM,OAAO,MAAM,CAAC,IAAI,sBAAsB;;AAGxE,SAAgB,sBAAsB,WAAoC;CACxE,MAAM,SAAS,UAAU,OAAO,SAAS;AACzC,QAAO;EACL,IAAI,UAAU,MAAM;EACpB,MAAM,UAAU,OAAO;EACvB,OAAO,UAAU;EACjB,gBAAgB,UAAU;EAC1B,MAAM,UAAU;EAChB,MAAM,UAAU;EAChB,WACE,OAAO,UAAU,OAAO,UAAU,WAC9B,UAAU,OAAO,QACjB,KAAK,UAAU,UAAU,OAAO,MAAM;EAC5C,OAAO,UAAU;EACjB,SAAS,EACP,QAAQ,SACJ;GACE,MAAM,OAAO;GACb,KAAK,OAAO;GACZ,YAAY,OAAO,WAAW,KAAK,QACjC,MAAM,QAAQ,IAAI,GAAG,IAAI,KAAK,KAAK,GAAG,IACvC;GACF,GACD,KAAA,GACL;EACF;;AAGH,SAAgB,qBAAqB,KAA8B;CAGjE,MAAM,QAAQ,IAAI;CAClB,MAAM,eAAe,IAAI;CAEzB,MAAM,cAAc,YAAY,IAAI,QAAQ,IAAI,MAAM,SAAS,EAAE;AACjE,QAAO;EACL,IAAI,IAAI,OAAO;EACf,MAAM,IAAI,OAAO;EACjB,cAAc,IAAI,OAAO;EACzB,UAAU,IAAI,OAAO,SAAS,UAAU;EACxC,iBAAiB,IAAI,OAAO;EAC5B,sBAAsB,IAAI,OAAO;EACjC,YAAY,EAAE;EACd,WAAW;EACX;EACA;EACD;;AAGH,SAAgB,0BACd,KACkB;AAElB,QAAO;EACL,GAFa,qBAAqB,IAAI;EAGtC,MAAM,EACJ,iBAAiB,IAAI,OAAO,MAAM,iBACnC;EACD,MAAM,IAAI,OAAO;EACjB,OAAO,IAAI,MAAM;EACjB,cAAc,IAAI,MAAM;EACzB","debug_id":"df700b05-17ec-5ac9-b31f-f6f9cfcfa5f5"}