@rolealpha/n8n-nodes-rolealpha 0.5.1 → 0.7.0

package/README.md

@@ -45,6 +45,9 @@ next run follows. You don't edit code and you don't republish anything.
 - **Teams of agents on one step.** Several roles share a step. Each agent does its own part,
   waits for what it needs and is woken when it arrives. Agents that hang are escalated to
   the role that leads their circle.
+- **Workflows that follow the organisation.** When a step, role or agent is created, changed
+  or removed in roleALPHA, a model proposes what that means for the n8n workflows. The
+  proposal becomes an inactive draft, and only a person filling the deciding role can apply it.
 - **Limits you can change without republishing.** Retries, wait times, run time and tool
   calls come from a settings table and are clamped to fixed bounds.
 
@@ -125,6 +128,64 @@ bound to the account does not run. There is no fallback to the view of the accou
 Approval gates follow this order: **Get Decider → Check Approver → Approval Seal: Sign**. The
 workflow that sends runs **Approval Seal: Verify** first and stops if the content changed.
 
+## Workflows that follow the organisation
+
+Most changes in roleALPHA need no workflow change at all: the runner reads roles, duties and
+deciders on every run. What roleALPHA cannot know is technology: a new step needs a trigger, a
+schedule or a mapping of (collection, status) to its custom ID. The **roleALPHA Workflow
+Builder** closes that gap without letting a model change production on its own.
+
+```
+Scheduler (every 15 min)
+ └ Data table: snapshot rows
+   └ Workflow Builder: Detect Changes        new / changed / removed steps, roles, agents
+     ├ store and remove snapshot rows
+     └ per change: Workflow Builder: Propose  ← chat model
+                    └ Create Draft            inactive, tagged rolealpha-draft
+                      └ roleALPHA: Get Decider (governing step)
+                        └ per person: Issue Approval Tokens → e-mail with approve / reject link
+
+Approval link (GET)  → Verify Approval Token → page with a confirm button
+Confirm button (POST)
+ └ Verify Approval Token → roleALPHA: Check Approver (governing step, fail-closed)
+   ├ approve → Workflow Builder: Apply Draft   only with the hash in the token
+   └ reject  → Workflow Builder: Discard Draft
+```
+
+**Detect** compares a fingerprint of every watched entity (name, custom ID, attributes and
+edges) with the rows stored last time. The first run only stores the snapshot. An entity that
+cannot be read is neither changed nor removed; removals count only when the complete index was
+read.
+
+**Propose** gives the model the change, the entity as roleALPHA shows it now (a step with its
+roles, never persons), the managed workflows and the credentials they use. Its answer is
+checked, and a failed check goes back to the model once more with the problems:
+
+- only node types from the allow list (no Code node by default),
+- no e-mail address and no UUID in any parameter: those are read from roleALPHA at run time,
+- only credentials already used by managed workflows; a node that stays keeps its own
+  credentials, IDs and webhook IDs,
+- updates and deactivations only of managed workflows, connections only between existing nodes.
+
+**Drafts** carry everything Apply needs in a sticky note named `roleALPHA binding`: the action,
+the target, the target's version and the content hash. **Apply** refuses when the draft no
+longer has the approved hash or the target changed after the draft was made. A managed workflow
+is one with that note and the tag `rolealpha-managed`; nothing else is ever touched.
+
+**Approval links** carry a token signed with the Approval Seal key: `at1.<claims>.<HMAC>`. It
+names the draft, its content hash, one person and one decision, and it expires (7 days by
+default, at most 30). Nobody can make or change one without the key, so the approval webhook
+can be public and needs no single sign-on. A link works once: Apply and Discard remove the
+draft, and a second use finds none. Whether the person may decide is checked when they
+confirm, not when the mail was sent, so a link of somebody who left the role does nothing.
+Opening a link only shows a confirm page; mail scanners that open links decide nothing.
+
+Two ready workflows are in [`examples/`](examples): import
+`workflows-follow-the-organisation.json` and `approve-workflow-drafts.json`, create a data table
+`rolealpha_snapshot` with the text columns `uuid, entity_type, name, custom_id, fingerprint,
+fields, edges, seen_at`, fill in **Settings** and the credentials, and give a step in roleALPHA
+(the governing step, e.g. `automation:workflow-changes`) a deciding role.
+
 ## Nodes
 
 ### roleALPHA (`roleAlpha`)
@@ -153,6 +214,19 @@ workflow that sends runs **Approval Seal: Verify** first and stops if the conten
 | Settings | Resolve | Runner limits from defaults and a settings table (`scope, target, key, value`): default < global < step < agent. Every value is clamped to fixed bounds; unknown keys and unusable values are reported in `settingProblems` and never applied. | – |
 | Schedule | Is Due | Decides from the step `frequency` (and `termin` / due date) whether a run is due in the current period. | – |
 
+### roleALPHA Workflow Builder (`roleAlphaWorkflowBuilder`)
+
+| Operation | What it does | Credential |
+|---|---|---|
+| Detect Changes | Compares the watched entity types (default: process, role, agent) with the stored snapshot rows. Returns `changes` (`created`, `changed` with `changedFields`, `edgesAdded`, `edgesRemoved`, `removed`), the rows to `upsert` and `remove`, and `unreadable`. | MCP OAuth2 |
+| List Workflows | The managed workflows with their bound entities and the credentials they use. | n8n API |
+| Propose | Needs a chat model on its **Model** input. Returns `ok`, `action` (`create`, `update`, `deactivate`, `none`), `reason`, `workflow`, `contentHash`, `problems` and `notes`. | MCP OAuth2, n8n API |
+| Create Draft | Stores a proposal with `ok = true` as an inactive draft. Returns `draftId` and `contentHash`. | n8n API |
+| Apply Draft | Applies a draft given the approved hash. Optionally activates a new workflow. | n8n API |
+| Discard Draft | Deletes a draft; refuses any workflow that is not a draft. | n8n API |
+| Issue Approval Tokens | `approveToken` and `rejectToken` for one person, bound to `draftId` and `contentHash`, plus `tokenExpiresAt`. Keeps the input fields. | Approval Seal API |
+| Verify Approval Token | Returns `draftId`, `contentHash`, `approver`, `decision` and `expiresAt` of a valid token; fails on a changed, foreign or expired one. | Approval Seal API |
+
 ### Approval Seal (`approvalSeal`)
 
 `Sign` seals exactly the approved content together with the approver. Use it after **Check
@@ -177,7 +251,8 @@ under the agent → *Context & Access*.
 | **MCP OAuth2** (n8n built-in) | Access to the roleALPHA MCP endpoint for one organisation. Used for agents (default source) and for every traversal. The `agent` view needs admin rights on the tenant. For **Connect As: Agent** it must be a roleALPHA function account (grant type Client Credentials) whose role has `agent:run` and that may run the agent ("May run these agents"). |
 | **roleALPHA Agent Keys API** | Optional, for the `Agent Keys` source. `baseUrl` of the data node, and `keys`: `{"<agent uuid>": "agt_…"}`, or a list of `{agentUuid, key, label}`. An agent key reads only its own agent, so it cannot traverse. |
 | **roleALPHA Webhook API** | One signing secret, a JSON list of secrets, or a map from agent UUID to secret. |
-| **Approval Seal API** | `key` (sign and verify) and optionally `legacyKey` (verify v2 only). |
+| **n8n API** (n8n built-in) | API key and base URL of the n8n instance the Workflow Builder manages. When the nodes run in that instance, `http://localhost:5678/api/v1` works even if `/api` is closed to the outside. |
+| **Approval Seal API** | `key` (sign and verify seals and approval tokens) and optionally `legacyKey` (verify v2 seals only). |
 
 Agent keys and webhook secrets are issued in the roleALPHA interface and shown only once.
 Store them nowhere except in these credentials.
@@ -216,6 +291,10 @@ record_keys, event, run_id, attempts, progress, at`.
 - The prompt marks trigger payloads as data. Guardrails take precedence over event content.
 - Keep `requireActive` and `requireGuardrails` on in production.
 - Settings are clamped to fixed bounds.
+- The Workflow Builder never activates or changes a workflow by itself. A proposal is an
+  inactive draft; Apply needs the hash that was sent to the approver and a target that did not
+  change since. The approval link is a signed one-time token for one person and one decision;
+  Check Approver decides at use whether that person may still decide.
 - Duplicate runs are blocked by leases, and wake-ups are claimed before they fire.
 - No credentials are kept in wait, settings or cache rows. The share cache key holds no
   record content, and a cached answer is checked again like a fresh one.
@@ -314,6 +393,10 @@ not caught by the graph.
 | `MCP initialize failed with HTTP 429` | Many runs started at once and roleALPHA turned some away. The client repeats a call turned away with 429 or 503 up to four times (Retry-After, else 1, 2, 4, 8 s). If it still fails, start fewer runs at once. |
 | `Empty MCP response` | The server answered with no body. Reading calls are repeated; a writing tool is not, so it cannot run twice. |
 | `Cannot access "arguments" due to security concerns` | n8n blocks the name `arguments` in expressions and in `$fromAI`. Name the tool input `toolArgs` or `args`. |
+| Propose returns `ok: false` | The model's answer failed the check twice; `problems` says why. Often a node type outside the allow list or a hard-coded address. Add what the model needs to **Extra Rules**. |
+| `The draft changed after it was proposed or approved` | Somebody edited the draft, or the link carries another hash. Discard it; the next change proposes again. |
+| `Workflow … changed after the draft was made` | The target was edited after the draft. Discard the draft and let the builder propose again. |
+| Detect fails with `more than Max Entities` | Every watched entity costs two reads per run. Watch fewer types or raise the limit. |
 | Webhook answers `401` | The `X-RA-Signature` does not match. Check the secret in **roleALPHA Webhook API**. |
 
 ## Licence

package/dist/lib/approvalToken.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Approval tokens: a link that says who may decide what about which draft, signed with the
+ * seal key. The link itself is the proof, so it works without a single sign-on proxy.
+ *
+ *   at1.<base64url claims>.<base64url HMAC-SHA256>
+ *
+ * A token is bound to one draft, its content hash, one person and one decision, and it
+ * expires. It can be used once: applying or discarding removes the draft, and a second
+ * use finds no draft any more. Whether the person may still decide is checked at use,
+ * not when the token is issued.
+ */
+export type Decision = 'approve' | 'reject';
+export interface TokenClaims {
+    draftId: string;
+    contentHash: string;
+    approver: string;
+    decision: Decision;
+    /** Expiry in seconds since the epoch. */
+    exp: number;
+}
+export interface TokenCheck {
+    valid: boolean;
+    reason: string;
+    claims: TokenClaims | null;
+}
+/** Only these characters can occur, so a valid token is safe in a URL and in HTML. */
+export declare const TOKEN_PATTERN: RegExp;
+export declare function issueToken(key: string, input: {
+    draftId: string;
+    contentHash: string;
+    approver: string;
+    decision: Decision;
+}, opts?: {
+    validHours?: number;
+    now?: Date;
+}): {
+    token: string;
+    expiresAt: string;
+};
+export declare function verifyToken(key: string, token: unknown, opts?: {
+    now?: Date;
+}): TokenCheck;

package/dist/lib/approvalToken.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Approval tokens: a link that says who may decide what about which draft, signed with the
+ * seal key. The link itself is the proof, so it works without a single sign-on proxy.
+ *
+ *   at1.<base64url claims>.<base64url HMAC-SHA256>
+ *
+ * A token is bound to one draft, its content hash, one person and one decision, and it
+ * expires. It can be used once: applying or discarding removes the draft, and a second
+ * use finds no draft any more. Whether the person may still decide is checked at use,
+ * not when the token is issued.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_PATTERN = void 0;
+exports.issueToken = issueToken;
+exports.verifyToken = verifyToken;
+const crypto_1 = require("crypto");
+const seal_1 = require("./seal");
+const graph_1 = require("./graph");
+const PREFIX = 'at1';
+/** Keeps a token signature from ever matching a seal made with the same key. */
+const PURPOSE = 'rolealpha-approval-token';
+/** Only these characters can occur, so a valid token is safe in a URL and in HTML. */
+exports.TOKEN_PATTERN = /^at1\.[A-Za-z0-9_-]{16,2048}\.[A-Za-z0-9_-]{43}$/;
+const MAX_HOURS = 24 * 30;
+function requireKey(key) {
+    if (typeof key !== 'string' || key.length < 32)
+        throw new Error('The seal key must be at least 32 characters long');
+}
+function mac(key, body) {
+    return (0, crypto_1.createHmac)('sha256', key).update(`${PURPOSE}:${body}`, 'utf8').digest('base64url');
+}
+function issueToken(key, input, opts = {}) {
+    requireKey(key);
+    const draftId = String(input.draftId ?? '').trim();
+    const contentHash = String(input.contentHash ?? '').trim();
+    const approver = (0, graph_1.normalizeEmail)(input.approver);
+    if (!draftId)
+        throw new Error('A token needs the draft ID');
+    if (!contentHash)
+        throw new Error('A token needs the content hash of the draft');
+    if (!approver.includes('@'))
+        throw new Error('A token needs the approver address');
+    if (input.decision !== 'approve' && input.decision !== 'reject')
+        throw new Error('The decision is approve or reject');
+    const hours = Math.min(Math.max(Number(opts.validHours ?? 168) || 168, 1), MAX_HOURS);
+    const exp = Math.floor((opts.now ?? new Date()).getTime() / 1000) + Math.round(hours * 3600);
+    const claims = { draftId, contentHash, approver, decision: input.decision, exp };
+    const body = Buffer.from((0, seal_1.canonicalJson)(claims), 'utf8').toString('base64url');
+    return { token: `${PREFIX}.${body}.${mac(key, body)}`, expiresAt: new Date(exp * 1000).toISOString() };
+}
+function verifyToken(key, token, opts = {}) {
+    requireKey(key);
+    const value = typeof token === 'string' ? token.trim() : '';
+    if (!exports.TOKEN_PATTERN.test(value))
+        return { valid: false, reason: 'No valid approval token', claims: null };
+    const [, body, sig] = value.split('.');
+    const a = Buffer.from(sig, 'utf8');
+    const b = Buffer.from(mac(key, body), 'utf8');
+    if (a.length !== b.length || !(0, crypto_1.timingSafeEqual)(a, b))
+        return { valid: false, reason: 'The token was not issued here or was changed', claims: null };
+    let raw;
+    try {
+        raw = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+    }
+    catch {
+        return { valid: false, reason: 'The token cannot be read', claims: null };
+    }
+    const claims = {
+        draftId: String(raw.draftId ?? ''),
+        contentHash: String(raw.contentHash ?? ''),
+        approver: String(raw.approver ?? ''),
+        decision: raw.decision,
+        exp: Number(raw.exp),
+    };
+    if (!claims.draftId || !claims.contentHash || !claims.approver.includes('@') || !['approve', 'reject'].includes(claims.decision) || !Number.isFinite(claims.exp)) {
+        return { valid: false, reason: 'The token is incomplete', claims: null };
+    }
+    if (claims.exp * 1000 <= (opts.now ?? new Date()).getTime())
+        return { valid: false, reason: 'The link has expired', claims };
+    return { valid: true, reason: 'Token matches', claims };
+}
+//# sourceMappingURL=approvalToken.js.map

package/dist/lib/approvalToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvalToken.js","sourceRoot":"","sources":["../../lib/approvalToken.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAsCH,gCAkBC;AAED,kCA0BC;AAlFD,mCAAqD;AACrD,iCAAuC;AACvC,mCAAyC;AAmBzC,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,gFAAgF;AAChF,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAC3C,sFAAsF;AACzE,QAAA,aAAa,GAAG,kDAAkD,CAAC;AAChF,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1B,SAAS,UAAU,CAAC,GAAW;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACrH,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,IAAY;IACrC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC3F,CAAC;AAED,SAAgB,UAAU,CACzB,GAAW,EACX,KAAqF,EACrF,OAA4C,EAAE;IAE9C,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAA,sBAAc,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC9F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,oBAAa,EAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,SAAgB,WAAW,CAAC,GAAW,EAAE,KAAc,EAAE,OAAuB,EAAE;IACjF,UAAU,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,qBAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzG,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACnJ,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAgB;QAC3B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC1C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,QAAoB;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;KACpB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClK,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAC7H,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}

package/dist/lib/changes.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Change detection in the roleALPHA graph. roleALPHA sends no event when a step, role or
+ * agent is created or changed, so a scheduler takes a snapshot and compares it with the
+ * rows it stored the last time.
+ *
+ * Fail-closed: an entity that could not be read is neither new nor changed nor removed;
+ * its old row stays. Removals are reported only when the complete index was read.
+ */
+import type { GraphSource, Relationship } from './graph';
+import type { McpClient } from './mcp';
+/** Entity types of the lean index (list_entities). */
+export declare const ENTITY_TYPES: readonly ["process", "role", "agent", "policy", "organigramm", "project", "okr", "person"];
+export interface IndexEntry {
+    uuid: string;
+    name: string;
+    entityType: string;
+}
+export interface EntitySnapshot {
+    uuid: string;
+    name: string;
+    /** Type of the lean index (process, role, agent, …). */
+    entityType: string;
+    customId: string | null;
+    /** Short hash per attribute, so a change names the attributes that changed. */
+    fields: Record<string, string>;
+    /** `TYPE>uuid` (outgoing) and `TYPE<uuid` (incoming), sorted. */
+    edges: string[];
+    fingerprint: string;
+}
+/** A stored snapshot row. `fields` and `edges` are JSON strings so any table can hold them. */
+export interface SnapshotRow {
+    uuid: string;
+    entity_type: string;
+    name: string;
+    custom_id: string | null;
+    fingerprint: string;
+    fields: string;
+    edges: string;
+    seen_at: string;
+}
+export type ChangeKind = 'created' | 'changed' | 'removed';
+export interface EntityChange {
+    change: ChangeKind;
+    uuid: string;
+    name: string;
+    entityType: string;
+    customId: string | null;
+    previousName: string | null;
+    changedFields: string[];
+    edgesAdded: string[];
+    edgesRemoved: string[];
+}
+export interface DetectResult {
+    /** No stored rows yet: the snapshot is stored and nothing is reported. */
+    baseline: boolean;
+    /** Whether the complete index was read; only then are removals reported. */
+    complete: boolean;
+    changes: EntityChange[];
+    /** Rows to insert or replace (by uuid). */
+    upsert: SnapshotRow[];
+    /** UUIDs whose rows are deleted. */
+    remove: string[];
+    /** Entities that could not be read this time; their rows stay as they are. */
+    unreadable: Array<{
+        uuid: string;
+        name: string;
+        error: string;
+    }>;
+}
+export declare function snapshotOf(entry: IndexEntry, details: {
+    name: string;
+    customId: string | null;
+    data: Record<string, unknown>;
+}, rels: Relationship[]): EntitySnapshot;
+export declare function toRow(s: EntitySnapshot, seenAt: string): SnapshotRow;
+/** Rows as they come back from a table: drops rows without uuid or fingerprint. */
+export declare function normalizeRows(raw: unknown): SnapshotRow[];
+export declare function detectChanges(previousRaw: unknown, current: EntitySnapshot[], opts: {
+    complete: boolean;
+    types: string[];
+    unreadable?: DetectResult['unreadable'];
+    now?: Date;
+    reportBaseline?: boolean;
+}): DetectResult;
+/** Reads the complete lean index of one type, page by page. */
+export declare function listIndex(client: McpClient, organisation: string, entityType: string, maxPages?: number): Promise<IndexEntry[]>;
+export interface SnapshotRead {
+    snapshots: EntitySnapshot[];
+    unreadable: DetectResult['unreadable'];
+}
+/** Reads details and relationships of every index entry. A failed read marks the entity unreadable. */
+export declare function readSnapshots(src: GraphSource, entries: IndexEntry[], concurrency?: number): Promise<SnapshotRead>;

package/dist/lib/changes.js

@@ -0,0 +1,192 @@
+"use strict";
+/**
+ * Change detection in the roleALPHA graph. roleALPHA sends no event when a step, role or
+ * agent is created or changed, so a scheduler takes a snapshot and compares it with the
+ * rows it stored the last time.
+ *
+ * Fail-closed: an entity that could not be read is neither new nor changed nor removed;
+ * its old row stays. Removals are reported only when the complete index was read.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITY_TYPES = void 0;
+exports.snapshotOf = snapshotOf;
+exports.toRow = toRow;
+exports.normalizeRows = normalizeRows;
+exports.detectChanges = detectChanges;
+exports.listIndex = listIndex;
+exports.readSnapshots = readSnapshots;
+const crypto_1 = require("crypto");
+const seal_1 = require("./seal");
+/** Entity types of the lean index (list_entities). */
+exports.ENTITY_TYPES = ['process', 'role', 'agent', 'policy', 'organigramm', 'project', 'okr', 'person'];
+function hash(value, length = 16) {
+    return (0, crypto_1.createHash)('sha256').update((0, seal_1.canonicalJson)(value), 'utf8').digest('hex').slice(0, length);
+}
+/** Attributes that change without the entity changing in substance. */
+const VOLATILE = /^(updated_?at|updatedAt|modified_?at|last_?(seen|run|login)(_?at)?|version_?count|views?)$/i;
+function snapshotOf(entry, details, rels) {
+    const fields = {};
+    for (const [key, value] of Object.entries(details.data ?? {})) {
+        if (value === undefined || VOLATILE.test(key))
+            continue;
+        fields[key] = hash(value, 12);
+    }
+    const edges = [...new Set(rels.map((r) => `${r.type}${r.direction === 'outgoing' ? '>' : '<'}${r.uuid}`))].sort();
+    const name = details.name || entry.name;
+    return {
+        uuid: entry.uuid,
+        name,
+        entityType: entry.entityType,
+        customId: details.customId,
+        fields,
+        edges,
+        fingerprint: hash({ name, customId: details.customId, fields, edges }),
+    };
+}
+function toRow(s, seenAt) {
+    return {
+        uuid: s.uuid,
+        entity_type: s.entityType,
+        name: s.name,
+        custom_id: s.customId,
+        fingerprint: s.fingerprint,
+        fields: JSON.stringify(s.fields),
+        edges: JSON.stringify(s.edges),
+        seen_at: seenAt,
+    };
+}
+function parseJson(value, fallback) {
+    if (value && typeof value === 'object')
+        return value;
+    if (typeof value !== 'string' || value.trim() === '')
+        return fallback;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Rows as they come back from a table: drops rows without uuid or fingerprint. */
+function normalizeRows(raw) {
+    return (Array.isArray(raw) ? raw : [])
+        .filter((r) => !!r && typeof r === 'object')
+        .filter((r) => typeof r.uuid === 'string' && r.uuid !== '' && typeof r.fingerprint === 'string')
+        .map((r) => ({
+        uuid: String(r.uuid).toLowerCase(),
+        entity_type: String(r.entity_type ?? ''),
+        name: String(r.name ?? ''),
+        custom_id: typeof r.custom_id === 'string' && r.custom_id !== '' ? r.custom_id : null,
+        fingerprint: String(r.fingerprint),
+        fields: typeof r.fields === 'string' ? r.fields : JSON.stringify(r.fields ?? {}),
+        edges: typeof r.edges === 'string' ? r.edges : JSON.stringify(r.edges ?? []),
+        seen_at: String(r.seen_at ?? ''),
+    }));
+}
+function detectChanges(previousRaw, current, opts) {
+    const now = (opts.now ?? new Date()).toISOString();
+    const types = new Set(opts.types);
+    // Rows of other types belong to another detector with another type filter; leave them alone.
+    const previous = normalizeRows(previousRaw).filter((r) => types.has(r.entity_type));
+    const unreadable = opts.unreadable ?? [];
+    const baseline = previous.length === 0 && !opts.reportBaseline;
+    const before = new Map(previous.map((r) => [r.uuid, r]));
+    const seen = new Set([...current.map((c) => c.uuid), ...unreadable.map((u) => u.uuid.toLowerCase())]);
+    const changes = [];
+    const upsert = [];
+    for (const snap of current) {
+        const old = before.get(snap.uuid);
+        if (old && old.fingerprint === snap.fingerprint)
+            continue;
+        upsert.push(toRow(snap, now));
+        if (baseline)
+            continue;
+        if (!old) {
+            changes.push({ change: 'created', uuid: snap.uuid, name: snap.name, entityType: snap.entityType, customId: snap.customId, previousName: null, changedFields: [], edgesAdded: snap.edges, edgesRemoved: [] });
+            continue;
+        }
+        const oldFields = parseJson(old.fields, {});
+        const oldEdges = new Set(parseJson(old.edges, []));
+        const newEdges = new Set(snap.edges);
+        const changedFields = [...new Set([...Object.keys(oldFields), ...Object.keys(snap.fields)])].filter((k) => oldFields[k] !== snap.fields[k]).sort();
+        if (old.name !== snap.name)
+            changedFields.unshift('name');
+        if ((old.custom_id ?? null) !== snap.customId)
+            changedFields.unshift('customId');
+        changes.push({
+            change: 'changed',
+            uuid: snap.uuid,
+            name: snap.name,
+            entityType: snap.entityType,
+            customId: snap.customId,
+            previousName: old.name !== snap.name ? old.name : null,
+            changedFields,
+            edgesAdded: snap.edges.filter((e) => !oldEdges.has(e)),
+            edgesRemoved: [...oldEdges].filter((e) => !newEdges.has(e)).sort(),
+        });
+    }
+    const remove = [];
+    if (opts.complete) {
+        for (const old of previous) {
+            if (seen.has(old.uuid))
+                continue;
+            remove.push(old.uuid);
+            if (!baseline) {
+                changes.push({ change: 'removed', uuid: old.uuid, name: old.name, entityType: old.entity_type, customId: old.custom_id, previousName: null, changedFields: [], edgesAdded: [], edgesRemoved: parseJson(old.edges, []) });
+            }
+        }
+    }
+    return { baseline, complete: opts.complete, changes, upsert, remove, unreadable };
+}
+// ---------------------------------------------------------------- reading
+function obj(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+/** Reads the complete lean index of one type, page by page. */
+async function listIndex(client, organisation, entityType, maxPages = 20) {
+    const out = [];
+    let offset = 0;
+    for (let page = 0; page < maxPages; page++) {
+        const res = obj(await client.callTool('list_entities', { organisation, entityType, offset }));
+        const rows = Array.isArray(res.entities) ? res.entities : [];
+        for (const raw of rows.map(obj)) {
+            const uuid = typeof raw.uuid === 'string' ? raw.uuid.toLowerCase() : '';
+            if (uuid)
+                out.push({ uuid, name: String(raw.name ?? ''), entityType });
+        }
+        if (res.hasMore !== true || rows.length === 0)
+            return out;
+        offset = typeof res.nextOffset === 'number' ? res.nextOffset : offset + rows.length;
+    }
+    throw new Error(`The index of "${entityType}" has more than ${maxPages} pages; narrow the entity types`);
+}
+/** Runs `fn` over `items` with at most `limit` calls at a time. */
+async function pool(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        while (next < items.length) {
+            const i = next++;
+            out[i] = await fn(items[i]);
+        }
+    });
+    await Promise.all(workers);
+    return out;
+}
+/** Reads details and relationships of every index entry. A failed read marks the entity unreadable. */
+async function readSnapshots(src, entries, concurrency = 4) {
+    const snapshots = [];
+    const unreadable = [];
+    await pool(entries, concurrency, async (entry) => {
+        try {
+            const [details, rels] = await Promise.all([src.details(entry.uuid), src.relationships(entry.uuid)]);
+            snapshots.push(snapshotOf(entry, details, rels));
+        }
+        catch (error) {
+            unreadable.push({ uuid: entry.uuid, name: entry.name, error: String(error.message ?? error).slice(0, 300) });
+        }
+    });
+    snapshots.sort((a, b) => a.uuid.localeCompare(b.uuid));
+    return { snapshots, unreadable };
+}
+//# sourceMappingURL=changes.js.map

package/dist/lib/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../../lib/changes.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA4EH,gCAqBC;AAED,sBAWC;AAaD,sCAcC;AAED,sCAuDC;AASD,8BAcC;AAsBD,sCAaC;AA1PD,mCAAoC;AACpC,iCAAuC;AAIvC,sDAAsD;AACzC,QAAA,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AA6DvH,SAAS,IAAI,CAAC,KAAc,EAAE,MAAM,GAAG,EAAE;IACxC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,oBAAa,EAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACjG,CAAC;AAED,uEAAuE;AACvE,MAAM,QAAQ,GAAG,6FAA6F,CAAC;AAE/G,SAAgB,UAAU,CACzB,KAAiB,EACjB,OAAiF,EACjF,IAAoB;IAEpB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;IACxC,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM;QACN,KAAK;QACL,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;KACtE,CAAC;AACH,CAAC;AAED,SAAgB,KAAK,CAAC,CAAiB,EAAE,MAAc;IACtD,OAAO;QACN,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,UAAU;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9B,OAAO,EAAE,MAAM;KACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAI,KAAc,EAAE,QAAW;IAChD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAU,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACtE,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,mFAAmF;AACnF,SAAgB,aAAa,CAAC,GAAY;IACzC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;SACzE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC;SAC/F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAClC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACrF,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QAChF,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5E,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,aAAa,CAC5B,WAAoB,EACpB,OAAyB,EACzB,IAA2H;IAE3H,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,6FAA6F;IAC7F,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9G,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAAE,SAAS;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,QAAQ;YAAE,SAAS;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7M,SAAS;QACV,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAyB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAW,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnJ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;YAAE,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACtD,aAAa;YACb,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SAClE,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAW,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACpO,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACnF,CAAC;AAED,2EAA2E;AAE3E,SAAS,GAAG,CAAC,KAAc;IAC1B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9G,CAAC;AAED,+DAA+D;AACxD,KAAK,UAAU,SAAS,CAAC,MAAiB,EAAE,YAAoB,EAAE,UAAkB,EAAE,QAAQ,GAAG,EAAE;IACzG,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1D,MAAM,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,mBAAmB,QAAQ,iCAAiC,CAAC,CAAC;AAC1G,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,IAAI,CAAO,KAAU,EAAE,KAAa,EAAE,EAA2B;IAC/E,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC7F,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACF,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACZ,CAAC;AAOD,uGAAuG;AAChG,KAAK,UAAU,aAAa,CAAC,GAAgB,EAAE,OAAqB,EAAE,WAAW,GAAG,CAAC;IAC3F,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,UAAU,GAA+B,EAAE,CAAC;IAClD,MAAM,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,IAAI,CAAC;YACJ,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpG,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAE,KAAe,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACzH,CAAC;IACF,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC"}