@rubytech/create-maxy-code 0.1.437 → 0.1.439

package/payload/platform/scripts/remediate-glsmith-identity.sh

@@ -0,0 +1,500 @@
+#!/usr/bin/env bash
+# ============================================================
+# remediate-glsmith-identity.sh
+#
+# Purpose
+# -------
+# One-account identity-corner repair for G.L.Smith & Sons (accountId
+# 2078cb54) on the SiteDesk Code install (Neo4j bolt://localhost:7689).
+# Merges a fragmented owner/admin/person corner into one canonical named
+# owner. Task 1569. Design + grounded live state:
+#   maxy-code/.docs/migrations/2026-07-glsmith-identity-remediation.md
+#
+# What it does (each step idempotent; logs its post-condition):
+#   rename-owner      3f81e7c2 "Owner" -> name "Dale Smith"
+#   rehome-prefs      move 28 source:explicit prefs from stray profile
+#                     (userId 436fdf2d, acct 2078cb54) to the owner profile,
+#                     re-stamp pref.userId -> 3f81e7c2; delete the 4
+#                     source:behavioural prefs; remove the emptied stray
+#                     profile (clears its cross-account HAS_PROFILE edge)
+#   merge-person      merge the second Dale Person into the owner's Dale
+#                     Person (keep phone 447958391734); one named Dale left
+#   fold-dale-seat    re-point 2f4a0a6b's inbound STARTED_BY to the owner,
+#                     drop its OWNS, remove its empty profile, delete it
+#   retire-joel-seat  delete c6a0e01a + its empty profile; drop the stray
+#                     cross-account OWNS -> Person 324 (house Person 324 kept)
+#   keith-timeline    create a Task RAISED_BY the owner Dale Person and
+#                     AFFECTS Person Keith Bullot (759), from Event 1559
+#   account-admins    account.json.admins -> [] (access is install-wide)
+#   reembed-needed    report nodes needing a nomic-embed-text re-embed
+#
+# Write-gate invariant: the account never drops below one
+# AdminUser{accountId} and always retains its role:'owner' node. Asserted
+# before and after every destructive step.
+#
+# Usage
+# -----
+#   bash remediate-glsmith-identity.sh                 # dry-run (default)
+#   bash remediate-glsmith-identity.sh --dry-run
+#   bash remediate-glsmith-identity.sh --verify        # post-apply asserts
+#   bash remediate-glsmith-identity.sh --apply --dump=/path/to/neo4j.dump
+#   bash remediate-glsmith-identity.sh --apply --force-no-dump   # no dump (loud)
+#
+# --dry-run  Print every intended node/edge change; mutate nothing (default).
+# --apply    Perform the writes. Refuses to run without a valid --dump path
+#            (a fresh full neo4j-admin dump) unless --force-no-dump is given.
+#            Writes a JSON snapshot of every touched node/rel before writing.
+# --verify   Run the post-apply asserts; exit non-zero if any fail.
+#
+# Rollback
+# --------
+# Authoritative: restore the operator's --dump via `neo4j-admin database
+# load`. Fast/targeted: the JSON snapshot at ~/glsmith-1569-snapshot-<ts>.{nodes,rels}
+# records the touched nodes (elementId, labels, properties) and relationships
+# (type, endpoints, properties) as they were before the writes.
+#
+# Reads:
+#   ~/sitedesk-code/platform/config/.neo4j-password   Neo4j password
+#   ~/sitedesk-code/data/accounts/2078cb54-.../account.json
+# ============================================================
+
+set -euo pipefail
+
+# --- Fixed identity constants (account 2078cb54) --------------------
+readonly ACCT='2078cb54-08e9-49e9-bf8e-e9f3ad76ca41'
+readonly OWNER='3f81e7c2-8e38-42f0-bce2-7355cd7c1ecf'   # survivor, role:owner
+readonly JOEL='c6a0e01a-ca12-4c6c-b8a9-0d5be937136b'    # operator seat, retire
+readonly DALE='2f4a0a6b-f239-461b-ba90-0d380fc72f43'    # sub-account seat, fold
+readonly HOUSEOP='436fdf2d-cfa7-4836-9ffa-77d91cef15f9' # house operator; stray profile userId
+readonly DALE_PHONE='447958391734'
+
+readonly PWFILE="$HOME/sitedesk-code/platform/config/.neo4j-password"
+readonly ACCOUNT_JSON="$HOME/sitedesk-code/data/accounts/$ACCT/account.json"
+readonly NEO4J_USER="${NEO4J_USER:-neo4j}"
+readonly URI="${NEO4J_URI:-bolt://localhost:7689}"
+
+MODE="dry-run"
+DUMP_PATH=""
+FORCE_NO_DUMP=0
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --dry-run) MODE="dry-run"; shift ;;
+    --apply)   MODE="apply"; shift ;;
+    --verify)  MODE="verify"; shift ;;
+    --dump=*)  DUMP_PATH="${1#*=}"; shift ;;
+    --dump)    DUMP_PATH="${2:-}"; shift 2 ;;
+    --force-no-dump) FORCE_NO_DUMP=1; shift ;;
+    -h|--help) sed -n '2,/^# =\{20,\}/p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+log() { echo "[id-remediation] $*" >&2; }
+
+# --- Connection -----------------------------------------------------
+[ -f "$PWFILE" ] || { echo "Error: $PWFILE missing (run on the SiteDesk Code box)" >&2; exit 1; }
+command -v cypher-shell >/dev/null 2>&1 || { echo "Error: cypher-shell not in PATH" >&2; exit 1; }
+PW="$(cat "$PWFILE")"
+
+# run_cypher: reads a cypher statement on stdin, prints --format plain output.
+run_cypher() { cypher-shell -u "$NEO4J_USER" -p "$PW" -a "$URI" --format plain; }
+
+# scalar: first data value (row 2), quotes stripped. Always exits 0 (empty result
+# yields empty string) so a `set -e` assignment never aborts on no-rows.
+scalar() { { tail -n +2 | tr -d '"' | grep -v '^[[:space:]]*$' | head -1; } || true; }
+# int: last bare-integer token, defaulting 0.
+as_int() { awk -F',' '{for(i=1;i<=NF;i++){gsub(/[^0-9-]/,"",$i); if($i ~ /^-?[0-9]+$/) v=$i}} END{print v+0}'; }
+
+# --- Write-gate --------------------------------------------------------
+# Echoes "admins=<n> owners=<n> business=<0|1>"; returns 0 iff n>=1 && owners>=1.
+write_gate() {
+  local out n owners biz
+  out="$(run_cypher <<CYPHER
+MATCH (a:AdminUser {accountId:'$ACCT'})
+WITH count(a) AS n, sum(CASE WHEN a.role='owner' THEN 1 ELSE 0 END) AS owners
+OPTIONAL MATCH (b:LocalBusiness {accountId:'$ACCT'})
+RETURN n, owners, CASE WHEN count(b) > 0 THEN 1 ELSE 0 END AS business;
+CYPHER
+)"
+  n="$(echo "$out"   | tail -n +2 | awk -F',' '{print $1+0}')"
+  owners="$(echo "$out" | tail -n +2 | awk -F',' '{print $2+0}')"
+  biz="$(echo "$out" | tail -n +2 | awk -F',' '{print $3+0}')"
+  echo "admins=$n owners=$owners business=$biz"
+  [ "$n" -ge 1 ] && [ "$owners" -ge 1 ]
+}
+
+assert_write_gate() {
+  local g; g="$(write_gate)" || { log "ABORT write-gate breached: $g"; exit 3; }
+  case "$g" in *business=1*) : ;; *) log "ABORT write-gate: no LocalBusiness ($g)"; exit 3 ;; esac
+  log "write-gate ok $g"
+}
+
+# --- Preconditions -----------------------------------------------------
+preconditions() {
+  run_cypher <<< "RETURN 1;" >/dev/null 2>&1 || { echo "Error: cannot connect to $URI" >&2; exit 1; }
+  local ownerName
+  ownerName="$(run_cypher <<CYPHER | scalar
+MATCH (a:AdminUser {userId:'$OWNER', accountId:'$ACCT', role:'owner'}) RETURN a.name;
+CYPHER
+)"
+  [ -n "$ownerName" ] || { log "ABORT precondition: survivor owner $OWNER (role:owner) not found on $ACCT"; exit 3; }
+  assert_write_gate
+  log "preconditions ok survivorOwner=$OWNER name=\"$ownerName\""
+}
+
+# ======================================================================
+# Steps. Each runs a read-only DETECT (always, prints WOULD-change) and,
+# when MODE=apply, the mutation. Idempotent: DETECT reports 0 -> no-op.
+# ======================================================================
+
+step_rename_owner() {
+  local pending
+  pending="$(run_cypher <<CYPHER | as_int
+MATCH (a:AdminUser {userId:'$OWNER', accountId:'$ACCT'}) WHERE a.name <> 'Dale Smith' RETURN count(a);
+CYPHER
+)"
+  if [ "$pending" -eq 0 ]; then log "step=rename-owner no-op (already 'Dale Smith')"; return; fi
+  if [ "$MODE" = "dry-run" ]; then log "step=rename-owner WOULD set AdminUser $OWNER name -> 'Dale Smith'"; return; fi
+  run_cypher <<CYPHER >/dev/null
+MATCH (a:AdminUser {userId:'$OWNER', accountId:'$ACCT'}) SET a.name='Dale Smith', a.updatedAt=timestamp();
+CYPHER
+  log "step=rename-owner name=\"Dale Smith\""
+}
+
+step_rehome_prefs() {
+  local explicit behavioural
+  explicit="$(run_cypher <<CYPHER | as_int
+MATCH (:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'})-[:HAS_PREFERENCE]->(p:Preference) WHERE p.source='explicit' RETURN count(p);
+CYPHER
+)"
+  behavioural="$(run_cypher <<CYPHER | as_int
+MATCH (:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'})-[:HAS_PREFERENCE]->(p:Preference) WHERE p.source='behavioural' RETURN count(p);
+CYPHER
+)"
+  if [ "$explicit" -eq 0 ] && [ "$behavioural" -eq 0 ]; then
+    local strayGone
+    strayGone="$(run_cypher <<CYPHER | as_int
+MATCH (u:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'}) RETURN count(u);
+CYPHER
+)"
+    [ "$strayGone" -eq 0 ] && { log "step=rehome-prefs no-op (stray profile already removed)"; return; }
+  fi
+  if [ "$MODE" = "dry-run" ]; then
+    local ownerNow
+    ownerNow="$(run_cypher <<CYPHER | as_int
+MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:HAS_PROFILE]->(op:UserProfile)-[:HAS_PREFERENCE]->(p) RETURN count(p);
+CYPHER
+)"
+    log "step=rehome-prefs WOULD move explicit=$explicit -> owner profile (now has $ownerNow); delete behavioural=$behavioural; remove stray profile"
+    return
+  fi
+  # Move explicit prefs to the owner profile, re-stamp userId.
+  local moved
+  moved="$(run_cypher <<CYPHER | as_int
+MATCH (stray:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'})-[hp:HAS_PREFERENCE]->(p:Preference) WHERE p.source='explicit'
+MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:HAS_PROFILE]->(op:UserProfile)
+MERGE (op)-[:HAS_PREFERENCE]->(p)
+DELETE hp
+SET p.userId='$OWNER', p.updatedAt=timestamp()
+RETURN count(p);
+CYPHER
+)"
+  # Delete behavioural prefs.
+  local dropped
+  dropped="$(run_cypher <<CYPHER | as_int
+MATCH (:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'})-[:HAS_PREFERENCE]->(p:Preference) WHERE p.source='behavioural'
+DETACH DELETE p RETURN count(p);
+CYPHER
+)"
+  # Remove the now-empty stray profile (clears cross-account HAS_PROFILE).
+  local strayRemoved
+  strayRemoved="$(run_cypher <<CYPHER | as_int
+MATCH (stray:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'}) WHERE NOT (stray)-[:HAS_PREFERENCE]->()
+DETACH DELETE stray RETURN count(*);
+CYPHER
+)"
+  local ownerPrefs
+  ownerPrefs="$(run_cypher <<CYPHER | as_int
+MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:HAS_PROFILE]->(op:UserProfile)-[:HAS_PREFERENCE]->(p) RETURN count(p);
+CYPHER
+)"
+  log "step=rehome-prefs moved=$moved droppedBehavioural=$dropped strayRemoved=$strayRemoved ownerProfilePrefs=$ownerPrefs"
+}
+
+step_merge_person() {
+  # Survivor = the Dale Person carrying the phone + WhatsApp SENT history (496).
+  # Loser    = the bare owner-linked Dale stub (338), no phone, no outbound.
+  # We re-point the loser's inbound OWNS and RAISED_BY onto the survivor, then
+  # delete the stub. This preserves the survivor's hundreds of SENT->Message
+  # edges intact (never delete the message-history node).
+  local dalePersons stubCount
+  dalePersons="$(run_cypher <<CYPHER | as_int
+MATCH (p:Person {accountId:'$ACCT'}) WHERE p.givenName='Dale' AND p.familyName='Smith' RETURN count(p);
+CYPHER
+)"
+  if [ "$dalePersons" -le 1 ]; then log "step=merge-person no-op (one Dale Person already)"; return; fi
+  # A loser is a BARE Dale stub only: not the phone-holder, no phone of its own,
+  # and no SENT history. A real Dale contact with its own phone or messages can
+  # never be the loser, so a name collision is left untouched. The grounded
+  # premise is exactly one such stub (338); abort on any other count.
+  stubCount="$(run_cypher <<CYPHER | as_int
+MATCH (surv:Person {accountId:'$ACCT'}) WHERE surv.givenName='Dale' AND surv.familyName='Smith' AND surv.telephone='$DALE_PHONE'
+MATCH (loser:Person {accountId:'$ACCT'}) WHERE loser.givenName='Dale' AND loser.familyName='Smith' AND elementId(loser) <> elementId(surv) AND loser.telephone IS NULL AND NOT (loser)-[:SENT]->(:Message)
+RETURN count(loser);
+CYPHER
+)"
+  if [ "$stubCount" -ne 1 ]; then
+    log "step=merge-person ABORT expected exactly one bare Dale stub to merge, found $stubCount (dalePersons=$dalePersons); state drift, inspect before applying"
+    exit 3
+  fi
+  if [ "$MODE" = "dry-run" ]; then
+    log "step=merge-person WOULD keep the Dale Person with phone $DALE_PHONE + message history (survivor), re-point the bare stub's OWNS + RAISED_BY onto it, then delete the stub"
+    return
+  fi
+  local movedOwns movedRaised
+  movedOwns="$(run_cypher <<CYPHER | as_int
+MATCH (surv:Person {accountId:'$ACCT'}) WHERE surv.givenName='Dale' AND surv.familyName='Smith' AND surv.telephone='$DALE_PHONE'
+MATCH (loser:Person {accountId:'$ACCT'}) WHERE loser.givenName='Dale' AND loser.familyName='Smith' AND elementId(loser) <> elementId(surv) AND loser.telephone IS NULL AND NOT (loser)-[:SENT]->(:Message)
+MATCH (a)-[o:OWNS]->(loser)
+MERGE (a)-[:OWNS]->(surv)
+DELETE o
+RETURN count(*);
+CYPHER
+)"
+  movedRaised="$(run_cypher <<CYPHER | as_int
+MATCH (surv:Person {accountId:'$ACCT'}) WHERE surv.givenName='Dale' AND surv.familyName='Smith' AND surv.telephone='$DALE_PHONE'
+MATCH (loser:Person {accountId:'$ACCT'}) WHERE loser.givenName='Dale' AND loser.familyName='Smith' AND elementId(loser) <> elementId(surv) AND loser.telephone IS NULL AND NOT (loser)-[:SENT]->(:Message)
+MATCH (t)-[r:RAISED_BY]->(loser)
+MERGE (t)-[:RAISED_BY]->(surv)
+DELETE r
+RETURN count(*);
+CYPHER
+)"
+  # Delete the now-detached bare stub (same narrow predicate: never the survivor,
+  # never a Dale with its own phone or message history).
+  local deleted
+  deleted="$(run_cypher <<CYPHER | as_int
+MATCH (surv:Person {accountId:'$ACCT'}) WHERE surv.givenName='Dale' AND surv.familyName='Smith' AND surv.telephone='$DALE_PHONE'
+MATCH (loser:Person {accountId:'$ACCT'}) WHERE loser.givenName='Dale' AND loser.familyName='Smith' AND elementId(loser) <> elementId(surv) AND loser.telephone IS NULL AND NOT (loser)-[:SENT]->(:Message)
+DETACH DELETE loser
+RETURN count(*);
+CYPHER
+)"
+  local sent ownerOwns
+  sent="$(run_cypher <<CYPHER | as_int
+MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:OWNS]->(p:Person)-[:SENT]->(:Message) RETURN count(*);
+CYPHER
+)"
+  ownerOwns="$(run_cypher <<CYPHER | as_int
+MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:OWNS]->(p:Person) RETURN count(p);
+CYPHER
+)"
+  log "step=merge-person survivor=phone+history stubsDeleted=$deleted ownsMoved=$movedOwns raisedByMoved=$movedRaised ownerOwnsPersons=$ownerOwns survivorSentEdges=$sent"
+}
+
+step_fold_dale_seat() {
+  local present
+  present="$(run_cypher <<CYPHER | as_int
+MATCH (a:AdminUser {userId:'$DALE', accountId:'$ACCT'}) RETURN count(a);
+CYPHER
+)"
+  if [ "$present" -eq 0 ]; then log "step=fold-dale-seat no-op (seat already folded)"; return; fi
+  local startedBy
+  startedBy="$(run_cypher <<CYPHER | as_int
+MATCH (x)-[:STARTED_BY]->(a:AdminUser {userId:'$DALE', accountId:'$ACCT'}) RETURN count(x);
+CYPHER
+)"
+  if [ "$MODE" = "dry-run" ]; then log "step=fold-dale-seat WOULD re-point startedBy=$startedBy to owner, remove empty profile, delete seat $DALE"; return; fi
+  # Re-point inbound STARTED_BY sessions to the owner.
+  local moved
+  moved="$(run_cypher <<CYPHER | as_int
+MATCH (x)-[r:STARTED_BY]->(dale:AdminUser {userId:'$DALE', accountId:'$ACCT'})
+MATCH (owner:AdminUser {userId:'$OWNER', accountId:'$ACCT'})
+MERGE (x)-[:STARTED_BY]->(owner)
+DELETE r
+RETURN count(x);
+CYPHER
+)"
+  # Remove the empty profile (guarded: only if it holds no preferences), then the
+  # seat (DETACH DELETE drops its OWNS edges).
+  run_cypher <<CYPHER >/dev/null
+MATCH (dale:AdminUser {userId:'$DALE', accountId:'$ACCT'})-[:HAS_PROFILE]->(dp:UserProfile)
+WHERE NOT (dp)-[:HAS_PREFERENCE]->()
+DETACH DELETE dp;
+CYPHER
+  run_cypher <<CYPHER >/dev/null
+MATCH (dale:AdminUser {userId:'$DALE', accountId:'$ACCT'}) DETACH DELETE dale;
+CYPHER
+  assert_write_gate
+  local surviving; surviving="$(write_gate | sed 's/.*admins=\([0-9]*\).*/\1/')"
+  log "step=fold-dale-seat startedByMoved=$moved seatRemoved=1 survivingAdminUsers=$surviving"
+}
+
+step_retire_joel_seat() {
+  local present
+  present="$(run_cypher <<CYPHER | as_int
+MATCH (a:AdminUser {userId:'$JOEL', accountId:'$ACCT'}) RETURN count(a);
+CYPHER
+)"
+  if [ "$present" -eq 0 ]; then log "step=retire-joel-seat no-op (seat already retired)"; return; fi
+  if [ "$MODE" = "dry-run" ]; then log "step=retire-joel-seat WOULD delete seat $JOEL + empty profile, drop stray cross-account OWNS -> house Person 324 (324 kept)"; return; fi
+  run_cypher <<CYPHER >/dev/null
+MATCH (joel:AdminUser {userId:'$JOEL', accountId:'$ACCT'})-[:HAS_PROFILE]->(jp:UserProfile)
+WHERE NOT (jp)-[:HAS_PREFERENCE]->()
+DETACH DELETE jp;
+CYPHER
+  run_cypher <<CYPHER >/dev/null
+MATCH (joel:AdminUser {userId:'$JOEL', accountId:'$ACCT'}) DETACH DELETE joel;
+CYPHER
+  assert_write_gate
+  local surviving; surviving="$(write_gate | sed 's/.*admins=\([0-9]*\).*/\1/')"
+  log "step=retire-joel-seat seatRemoved=1 housePersonRetained=324 survivingAdminUsers=$surviving"
+}
+
+step_keith_timeline() {
+  local exists
+  exists="$(run_cypher <<CYPHER | as_int
+MATCH (t:Task {remediationKey:'1569-keith-bathroom-tap', accountId:'$ACCT'}) RETURN count(t);
+CYPHER
+)"
+  if [ "$exists" -gt 0 ]; then log "step=keith-timeline no-op (task already present)"; return; fi
+  if [ "$MODE" = "dry-run" ]; then log "step=keith-timeline WOULD create Task RAISED_BY owner Dale Person, AFFECTS Person Keith Bullot (759)"; return; fi
+  local taskId
+  taskId="$(run_cypher <<CYPHER | scalar
+MATCH (owner:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:OWNS]->(dale:Person)
+MATCH (keith:Person {accountId:'$ACCT'}) WHERE keith.givenName='Keith' AND keith.familyName='Bullot'
+MERGE (t:Task {remediationKey:'1569-keith-bathroom-tap', accountId:'$ACCT'})
+ON CREATE SET t.taskId=randomUUID(), t.name='Text Keith Bullot about the bathroom tap',
+  t.description='Contact Keith Bullot regarding the bathroom tap.', t.status='pending', t.priority='normal',
+  t.createdAt=timestamp(), t.updatedAt=timestamp(),
+  t.createdByTool='remediate-glsmith-identity', t.createdBySession='task-1569', t.createdByAgent='id-remediation'
+MERGE (t)-[:AFFECTS]->(keith)
+MERGE (t)-[:RAISED_BY]->(dale)
+RETURN t.taskId;
+CYPHER
+)"
+  log "step=keith-timeline taskCreated=1 taskId=$taskId raisedBy=owner-dale-person affects=keith-759"
+}
+
+step_account_admins() {
+  [ -f "$ACCOUNT_JSON" ] || { log "step=account-admins SKIP (account.json not found at $ACCOUNT_JSON)"; return; }
+  local already
+  already="$(python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); print("yes" if d.get("admins")==[] else "no")' "$ACCOUNT_JSON")"
+  if [ "$already" = "yes" ]; then log "step=account-admins no-op (already [])"; return; fi
+  if [ "$MODE" = "dry-run" ]; then
+    local cur; cur="$(python3 -c 'import json,sys; d=json.load(open(sys.argv[1])); print([a.get("userId","")[:8] for a in d.get("admins",[])])' "$ACCOUNT_JSON")"
+    log "step=account-admins WOULD set admins [] (currently $cur)"; return
+  fi
+  local ts; ts="$(date +%Y%m%d-%H%M%S)"
+  cp "$ACCOUNT_JSON" "$ACCOUNT_JSON.bak-$ts"
+  python3 -c 'import json,sys
+p=sys.argv[1]; d=json.load(open(p)); d["admins"]=[]
+json.dump(d, open(p,"w"), indent=2)' "$ACCOUNT_JSON"
+  log "step=account-admins admins=[] backup=$ACCOUNT_JSON.bak-$ts"
+}
+
+step_reembed_needed() {
+  local keithTask
+  keithTask="$(run_cypher <<CYPHER | scalar
+MATCH (t:Task {remediationKey:'1569-keith-bathroom-tap', accountId:'$ACCT'}) RETURN t.taskId;
+CYPHER
+)"
+  log "step=reembed-needed nodes=\"AdminUser:$OWNER(name-changed),Task:${keithTask:-<pending>}(new)\" note=raw-cypher-writes-carry-no-embedding"
+}
+
+# --- Rollback guard + snapshot (apply only) -------------------------
+rollback_guard() {
+  if [ -n "$DUMP_PATH" ]; then
+    [ -s "$DUMP_PATH" ] || { echo "Error: --dump path '$DUMP_PATH' is missing or empty" >&2; exit 1; }
+    log "rollback dump provided path=$DUMP_PATH bytes=$(wc -c < "$DUMP_PATH")"
+  elif [ "$FORCE_NO_DUMP" -eq 1 ]; then
+    log "WARNING proceeding WITHOUT a neo4j dump (--force-no-dump); JSON snapshot is the only rollback reference"
+  else
+    echo "Error: --apply needs --dump=/path/to/neo4j.dump (fresh full dump) or --force-no-dump" >&2
+    echo "  Take a dump on the box, e.g.:" >&2
+    echo "    systemctl stop neo4j-sitedesk-code.service && \\" >&2
+    echo "    neo4j-admin database dump neo4j --to-path=\$HOME/glsmith-1569-dump && \\" >&2
+    echo "    systemctl start neo4j-sitedesk-code.service" >&2
+    exit 1
+  fi
+}
+
+write_snapshot() {
+  local ts snap
+  ts="$(date +%Y%m%d-%H%M%S)"; snap="$HOME/glsmith-1569-snapshot-$ts.json"
+  # Nodes: the whole sub-account plus the house-side nodes this script touches
+  # (house Person 324 via Joel's phone, house Dale Person 194 via Dale's phone,
+  # house operator 436fdf2d whose cross-account HAS_PROFILE is cleared).
+  run_cypher <<CYPHER > "$snap.nodes"
+MATCH (n) WHERE n.accountId='$ACCT'
+   OR (n:Person AND n.telephone IN ['$DALE_PHONE','447504472444'])
+   OR (n:AdminUser AND n.userId IN ['$OWNER','$JOEL','$DALE','$HOUSEOP'])
+RETURN elementId(n) AS eid, labels(n) AS labels, properties(n) AS props;
+CYPHER
+  # Rels: every relationship anchored on a touched node, with its properties, so
+  # a re-pointed or dropped edge can be recreated exactly.
+  run_cypher <<CYPHER > "$snap.rels"
+MATCH (n)-[r]-(m) WHERE n.accountId='$ACCT'
+   OR (n:AdminUser AND n.userId IN ['$OWNER','$JOEL','$DALE','$HOUSEOP'])
+   OR (n:Person AND n.telephone IN ['$DALE_PHONE','447504472444'])
+RETURN DISTINCT type(r) AS type, elementId(startNode(r)) AS start, elementId(endNode(r)) AS end, properties(r) AS props;
+CYPHER
+  log "snapshot nodes+rels written prefix=$snap"
+}
+
+# --- Verify ----------------------------------------------------------
+verify() {
+  local fail=0
+  check() { # desc, actual, expected
+    if [ "$2" = "$3" ]; then log "verify OK  $1 ($2)"; else log "verify FAIL $1 (got '$2' want '$3')"; fail=1; fi
+  }
+  local ownerCount ownerName ownerOwns ownerPrefs strayCount dalePersons joelCount daleCount gate
+  ownerCount="$(run_cypher <<< "MATCH (a:AdminUser {accountId:'$ACCT', role:'owner'}) RETURN count(a);" | as_int)"
+  ownerName="$(run_cypher <<< "MATCH (a:AdminUser {accountId:'$ACCT', role:'owner'}) RETURN a.name;" | scalar)"
+  ownerOwns="$(run_cypher <<< "MATCH (a:AdminUser {accountId:'$ACCT', role:'owner'})-[:OWNS]->(p:Person) RETURN count(p);" | as_int)"
+  ownerPrefs="$(run_cypher <<< "MATCH (:AdminUser {userId:'$OWNER', accountId:'$ACCT'})-[:HAS_PROFILE]->(op)-[:HAS_PREFERENCE]->(p) RETURN count(p);" | as_int)"
+  strayCount="$(run_cypher <<< "MATCH (u:UserProfile {userId:'$HOUSEOP', accountId:'$ACCT'}) RETURN count(u);" | as_int)"
+  dalePersons="$(run_cypher <<< "MATCH (p:Person {accountId:'$ACCT'}) WHERE p.givenName='Dale' AND p.familyName='Smith' RETURN count(p);" | as_int)"
+  joelCount="$(run_cypher <<< "MATCH (a:AdminUser {userId:'$JOEL', accountId:'$ACCT'}) RETURN count(a);" | as_int)"
+  daleCount="$(run_cypher <<< "MATCH (a:AdminUser {userId:'$DALE', accountId:'$ACCT'}) RETURN count(a);" | as_int)"
+  gate="$(write_gate || true)"
+  check "one role:owner AdminUser" "$ownerCount" "1"
+  check "owner named Dale Smith" "$ownerName" "Dale Smith"
+  check "owner owns exactly one Person" "$ownerOwns" "1"
+  check "owner profile pref count" "$ownerPrefs" "28"
+  check "stray profile removed" "$strayCount" "0"
+  check "one Dale Person on account" "$dalePersons" "1"
+  check "Joel seat absent" "$joelCount" "0"
+  check "Dale seat absent" "$daleCount" "0"
+  case "$gate" in *"owners=1 business=1"*) log "verify OK  write-gate ($gate)";; *) log "verify FAIL write-gate ($gate)"; fail=1;; esac
+  [ "$fail" -eq 0 ] && { log "verify PASS"; return 0; } || { log "verify FAILED"; return 1; }
+}
+
+# --- Main ------------------------------------------------------------
+log "start mode=$MODE account=$ACCT uri=$URI"
+
+if [ "$MODE" = "verify" ]; then verify; exit $?; fi
+
+preconditions
+
+if [ "$MODE" = "apply" ]; then
+  rollback_guard
+  write_snapshot
+fi
+
+step_rename_owner
+step_rehome_prefs
+step_merge_person
+step_fold_dale_seat
+step_retire_joel_seat
+step_keith_timeline
+step_account_admins
+step_reembed_needed
+
+if [ "$MODE" = "apply" ]; then
+  log "apply complete — running verify"
+  verify || { log "POST-APPLY VERIFY FAILED — inspect before trusting"; exit 4; }
+else
+  log "dry-run complete — no writes performed. Diff the WOULD lines against the target end-state, then re-run with --apply --dump=<path>."
+fi

package/payload/platform/scripts/seed-neo4j.sh

@@ -220,30 +220,46 @@ fi
 
 if [ -n "$USER_ID" ]; then
   # Escape single quotes for Cypher string interpolation (e.g. O'Brien → O''Brien).
-  USER_NAME=$(python3 -c "import json; n=json.load(open('$USERS_FILE'))[0]['name']; print(n.replace(\"'\",\"''\"))" 2>/dev/null || echo "Owner")
-  CREATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  USER_NAME=$(python3 -c "import json; n=json.load(open('$USERS_FILE'))[0]['name']; print(n.replace(\"'\",\"''\"))" 2>/dev/null || true)
+  # Trim surrounding whitespace so a padded value is neither persisted verbatim
+  # nor able to slip a padded " Owner " past the placeholder check below — the
+  # same trim the shared isPlaceholderOwnerName predicate applies.
+  USER_NAME=$(printf '%s' "$USER_NAME" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+  # Task 1570 — the AdminUser carries no name; the owner name lives only on the
+  # OWNS-Person that set-pin's writeAdminUserAndPerson already wrote (1567 made a
+  # real name mandatory there). This block only stamps accountId/role and the
+  # ADMIN_OF edge on that existing AdminUser. A blank or "Owner" USER_NAME means
+  # the install cannot supply a real owner identity, so SKIP the stamp loudly
+  # rather than anchor an owner seat to a placeholder. Skip, not exit: this block
+  # only runs when users.json exists, so the real node is untouched, the per-deploy
+  # reconciles below still run (including the au.name -> Person backfill), and the
+  # standing [identity-audit] surfaces any orphan/nameless owner. Aborting the
+  # whole deploy here would brick re-deploys of exactly the installs to remediate.
+  if [ -z "$USER_NAME" ] || [ "$USER_NAME" = "Owner" ]; then
+    echo "  [seed] WARN: owner name is blank or the placeholder \"Owner\" (users.json[0].name for userId=${USER_ID:0:8}) — skipping owner AdminUser seed. Set a real name (change-PIN) to reconcile; the standing [identity-audit] flags it meanwhile." >&2
+  else
+    CREATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
-  echo "==> Creating AdminUser node for userId=$USER_ID"
-  # Stamp accountId + role='owner' at seed so the graph-write gate's
-  # account-scoped MATCH (au:AdminUser {accountId: $accountId}) succeeds on the
-  # first user-domain write. The ON MATCH branch COALESCEs to preserve any
-  # existing non-null value.
-  "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << CYPHER_EOF
+    echo "==> Creating AdminUser node for userId=$USER_ID"
+    # Stamp accountId + role='owner' at seed so the graph-write gate's
+    # account-scoped MATCH (au:AdminUser {accountId: $accountId}) succeeds on the
+    # first user-domain write. The ON MATCH branch COALESCEs to preserve any
+    # existing non-null value.
+    "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << CYPHER_EOF
 MERGE (au:AdminUser {userId: '$USER_ID'})
 ON CREATE SET au.accountId = '$ACCOUNT_ID',
               au.role = 'owner',
-              au.name = '$USER_NAME',
               au.createdAt = '$CREATED_AT'
 ON MATCH SET au.accountId = COALESCE(au.accountId, '$ACCOUNT_ID'),
-             au.role = COALESCE(au.role, 'owner'),
-             au.name = '$USER_NAME'
+             au.role = COALESCE(au.role, 'owner')
 WITH au
 MATCH (b:LocalBusiness {accountId: '$ACCOUNT_ID'})
 MERGE (au)-[r:ADMIN_OF]->(b)
 ON CREATE SET r.role = 'owner', r.grantedAt = '$CREATED_AT'
 RETURN au.userId, b.accountId;
 CYPHER_EOF
-  echo "  [seed] AdminUser stamped userId=${USER_ID:0:8} accountId=${ACCOUNT_ID:0:8} role=owner"
+    echo "  [seed] AdminUser stamped userId=${USER_ID:0:8} accountId=${ACCOUNT_ID:0:8} role=owner"
+  fi
 else
   echo "  No users.json found — skipping AdminUser seed (set-pin POST creates it)"
 fi
@@ -304,4 +320,53 @@ PROG_TOTAL=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_UR
     "MATCH (s:Sale {accountId: '$ACCOUNT_ID'}) RETURN count(s)" 2>/dev/null | tail -1 | tr -d ' \r')
 echo "  [progression-reconcile] accountId=${ACCOUNT_ID:0:8} stalledSales=${PROG_STALLED:-0} orphanChains=${PROG_ORPHAN_CHAINS:-0} linklessChains=${PROG_LINKLESS:-0} total=${PROG_TOTAL:-0}"
 
+# ------------------------------------------------------------------
+# 7. One-time reconcile — AdminUser.name -> owned Person, then drop au.name (Task 1570)
+# ------------------------------------------------------------------
+# AdminUser carries no name; the owned Person is the sole name source. This heals
+# legacy nodes globally (every account in the shared graph, not just this one).
+# It must NOT touch an AdminUser that already has a named owned Person (the common
+# case: a house owner with a real "Joel Smalley" Person) — only 7c drops au.name
+# there. So the migrate is split so it never MERGE-duplicates a name-keyed Person:
+#   7a — an owned Person exists but is nameless: populate its name.
+#   7b — no owned Person exists at all: create one carrying the name.
+# Owner/admin-personal Persons are keyed on {accountId} + name (writeAdminUserAndPerson,
+# admin-add) or {accountId, userId} (seedAccountGraphRoot); keying a MERGE on
+# {accountId, userId} would miss the former and create a duplicate, so 7a SETs the
+# existing node and only 7b CREATEs (for a genuine orphan). Placeholder names
+# ("Owner"/"Admin"/blank) are excluded from 7a/7b and simply dropped by 7c.
+# Idempotent: once au.name is gone all three match nothing, so re-deploys are
+# no-ops. Split mirrors writeAdminUserAndPerson (first ASCII space: head ->
+# givenName, tail -> familyName); operator names never carry embedded tab/NBSP.
+# Visibility only — never install-blocking.
+IDENT_NAMED=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (au:AdminUser)-[:OWNS]->(p:Person)
+     WHERE p.accountId = au.accountId
+       AND (p.givenName IS NULL OR trim(p.givenName) = '')
+       AND au.name IS NOT NULL
+       AND trim(au.name) <> '' AND trim(au.name) <> 'Owner' AND trim(au.name) <> 'Admin'
+     WITH p, trim(au.name) AS nm
+     SET p.givenName = CASE WHEN nm CONTAINS ' ' THEN trim(split(nm, ' ')[0]) ELSE nm END,
+         p.familyName = CASE WHEN nm CONTAINS ' ' THEN trim(substring(nm, size(split(nm, ' ')[0]) + 1)) ELSE null END
+     RETURN count(p)" 2>/dev/null | tail -1 | tr -d ' \r')
+IDENT_CREATED=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (au:AdminUser)
+     WHERE au.name IS NOT NULL
+       AND trim(au.name) <> '' AND trim(au.name) <> 'Owner' AND trim(au.name) <> 'Admin'
+       AND au.accountId IS NOT NULL
+       AND NOT EXISTS { MATCH (au)-[:OWNS]->(p:Person) WHERE p.accountId = au.accountId }
+     WITH au, trim(au.name) AS nm
+     CREATE (au)-[:OWNS]->(np:Person {
+       accountId: au.accountId, userId: au.userId, role: 'admin-personal', scope: 'admin', createdAt: datetime(),
+       givenName: CASE WHEN nm CONTAINS ' ' THEN trim(split(nm, ' ')[0]) ELSE nm END,
+       familyName: CASE WHEN nm CONTAINS ' ' THEN trim(substring(nm, size(split(nm, ' ')[0]) + 1)) ELSE null END
+     })
+     RETURN count(np)" 2>/dev/null | tail -1 | tr -d ' \r')
+IDENT_DROPPED=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (au:AdminUser) WHERE au.name IS NOT NULL REMOVE au.name RETURN count(au)" 2>/dev/null | tail -1 | tr -d ' \r')
+echo "  [identity-reconcile] namedExisting=${IDENT_NAMED:-0} createdOwned=${IDENT_CREATED:-0} droppedAuName=${IDENT_DROPPED:-0}"
+
 echo "  Done."

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA+BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAw5FpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA+BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAu6FpD"}