@rubytech/create-maxy 1.0.651 → 1.0.652

package/dist/index.js

@@ -2,7 +2,8 @@
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, symlinkSync, unlinkSync, lstatSync, readlinkSync, accessSync, constants as fsConstants } from "node:fs";
 import { resolve, join, dirname } from "node:path";
-import { randomBytes } from "node:crypto";
+import { randomBytes, createHash } from "node:crypto";
+import { TTYD_VERSION, TTYD_SHA256_BY_ARCH, mapUnameToTtydArch, ttydDownloadUrl, } from "./pinned-binaries.js";
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
 // Brand manifest — read from payload to derive all brand-specific installation values.
 // The bundler stamps brand.json into the payload at build time.
@@ -220,11 +221,10 @@ function installSystemDeps() {
         shell("apt-get", ["install", "-y", "curl", "git", "unzip", "jq", "avahi-daemon", "avahi-utils", "poppler-utils", "ffmpeg"], { sudo: true });
         shell("apt-get", ["install", "-y", "tigervnc-standalone-server", "python3-websockify", "novnc", "xdg-utils", "chromium"], { sudo: true });
         shell("apt-get", ["install", "-y", "hostapd", "dnsmasq"], { sudo: true });
-        // ttyd + tmux power the admin terminal surface (Task 591) — ttyd serves a
-        // WebSocket PTY on 127.0.0.1:7681, tmux provides the persistent named
-        // session that outlives admin-server restarts. Both are in Debian/Raspbian
-        // repos; no third-party source needed.
-        shell("apt-get", ["install", "-y", "ttyd", "tmux"], { sudo: true });
+        // tmux backs the admin terminal's persistent named session (Task 591).
+        // ttyd is NOT in Debian Bookworm's apt repo (Task 602) — it ships as a
+        // pinned upstream binary installed by provisionTtydBinary() in step 11.
+        shell("apt-get", ["install", "-y", "tmux"], { sudo: true });
     }
     else {
         console.log("  Skipping apt-get (sudo unavailable non-interactively — deps assumed present from prior install)");
@@ -1504,6 +1504,103 @@ function installCrons() {
         logFile(`  crontab write failed: ${write.stderr}`);
     }
 }
+const TTYD_INSTALL_PATH = "/usr/local/bin/ttyd";
+function sha256File(path) {
+    const hash = createHash("sha256");
+    hash.update(readFileSync(path));
+    return hash.digest("hex");
+}
+// Provision the upstream ttyd binary into /usr/local/bin/ttyd. Degrades with
+// a loud warning and a copy-pasteable remediation command on any failure —
+// never throws. Contract: the caller (installTerminalService) uses the
+// presence of TTYD_INSTALL_PATH after return to decide whether to enable the
+// maxy-ttyd.service systemd unit. ttyd is NOT in Debian Bookworm apt, so we
+// own the full download / verify / install flow here.
+function provisionTtydBinary() {
+    const unameRaw = spawnSync("uname", ["-m"], { encoding: "utf-8", stdio: "pipe", timeout: 5_000 });
+    const uname = (unameRaw.stdout || "").trim();
+    const arch = mapUnameToTtydArch(uname);
+    if (arch === null) {
+        console.error(`  WARNING: ttyd — unsupported architecture 'uname -m'='${uname}'. Admin terminal will be unavailable.`);
+        console.error(`  Remediate: install ttyd ${TTYD_VERSION} manually for your platform and place it at ${TTYD_INSTALL_PATH}, then 'sudo chmod +x ${TTYD_INSTALL_PATH}'.`);
+        return false;
+    }
+    const pinnedDigest = TTYD_SHA256_BY_ARCH[arch];
+    const url = ttydDownloadUrl(arch);
+    const remediation = `curl -L -o /tmp/ttyd.${arch} '${url}' && sudo mv /tmp/ttyd.${arch} ${TTYD_INSTALL_PATH} && sudo chmod +x ${TTYD_INSTALL_PATH}`;
+    // Idempotency: existing binary with matching pinned digest → skip download.
+    if (existsSync(TTYD_INSTALL_PATH)) {
+        try {
+            const existingDigest = sha256File(TTYD_INSTALL_PATH);
+            if (existingDigest === pinnedDigest) {
+                console.log(`  ttyd ${TTYD_VERSION} already installed at ${TTYD_INSTALL_PATH} (SHA256 match — skipping download)`);
+                return true;
+            }
+            console.log(`  ttyd at ${TTYD_INSTALL_PATH} has different digest — replacing with pinned ${TTYD_VERSION}`);
+        }
+        catch (err) {
+            console.error(`  WARNING: could not read existing ${TTYD_INSTALL_PATH}: ${err instanceof Error ? err.message : String(err)} — will overwrite`);
+        }
+    }
+    if (!canSudo()) {
+        console.error(`  WARNING: ttyd — sudo unavailable non-interactively, cannot write ${TTYD_INSTALL_PATH}. Admin terminal will be unavailable.`);
+        console.error(`  Remediate: ${remediation}`);
+        return false;
+    }
+    const tmpPath = `/tmp/ttyd.${arch}`;
+    try {
+        console.log(`  Downloading ttyd ${TTYD_VERSION} for ${arch} from ${url}`);
+        shellRetry("curl", ["-fL", "--retry", "3", "--retry-delay", "5", "-o", tmpPath, url], { timeout: 60_000 });
+    }
+    catch (err) {
+        console.error(`  WARNING: ttyd download failed: ${err instanceof Error ? err.message : String(err)}. Admin terminal will be unavailable.`);
+        console.error(`  Remediate: ${remediation}`);
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch { /* nothing to clean */ }
+        return false;
+    }
+    let actualDigest;
+    try {
+        actualDigest = sha256File(tmpPath);
+    }
+    catch (err) {
+        console.error(`  WARNING: ttyd — could not read downloaded file ${tmpPath}: ${err instanceof Error ? err.message : String(err)}. Admin terminal will be unavailable.`);
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch { /* nothing to clean */ }
+        return false;
+    }
+    if (actualDigest !== pinnedDigest) {
+        console.error(`  WARNING: ttyd SHA256 mismatch — refusing to install unverified binary.`);
+        console.error(`    expected: ${pinnedDigest}`);
+        console.error(`    actual:   ${actualDigest}`);
+        console.error(`  Admin terminal will be unavailable. A later installer version may pin a newer digest.`);
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch { /* nothing to clean */ }
+        return false;
+    }
+    console.log(`  ttyd ${TTYD_VERSION} SHA256 verified (${actualDigest.slice(0, 12)}…)`);
+    try {
+        shell("mv", [tmpPath, TTYD_INSTALL_PATH], { sudo: true });
+        shell("chmod", ["+x", TTYD_INSTALL_PATH], { sudo: true });
+    }
+    catch (err) {
+        console.error(`  WARNING: ttyd — could not install to ${TTYD_INSTALL_PATH}: ${err instanceof Error ? err.message : String(err)}. Admin terminal will be unavailable.`);
+        console.error(`  Remediate: ${remediation}`);
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch { /* already moved or cleaned */ }
+        return false;
+    }
+    console.log(`  ttyd ${TTYD_VERSION} installed at ${TTYD_INSTALL_PATH}`);
+    return true;
+}
 function installTerminalService() {
     log("11", TOTAL, "Installing admin terminal service (ttyd + tmux)...");
     if (!isLinux()) {
@@ -1511,6 +1608,11 @@ function installTerminalService() {
         console.log("    brew install ttyd tmux && ttyd -p 7681 -i 127.0.0.1 -W tmux new-session -A -s maxy-pty");
         return;
     }
+    // ttyd is provisioned from upstream GitHub releases (pinned + SHA256-verified)
+    // because Debian Bookworm's apt does NOT carry a ttyd package (Task 602).
+    // A failure here is loud but non-fatal — the rest of the install completes
+    // and the admin UI degrades to "terminal unavailable" per Task 603.
+    const ttydReady = provisionTtydBinary();
     // Default ~/.tmux.conf — only written if the operator doesn't already have
     // one. `history-limit 50000` is load-bearing: a closed-tab + reopen during
     // an upgrade must show every line the operator missed in scrollback.
@@ -1541,6 +1643,13 @@ function installTerminalService() {
     // unit and every subsequent install is a no-op (idempotent overwrite).
     const systemdUserDir = resolve(homeDir, ".config/systemd/user");
     mkdirSync(systemdUserDir, { recursive: true });
+    // Skip systemd-unit install if the ttyd binary is not in place — enabling
+    // a unit whose ExecStart points at a missing file just churns systemd with
+    // restart failures.
+    if (!ttydReady) {
+        console.error("  Skipping maxy-ttyd.service install — ttyd binary not present. Admin terminal will be unavailable until remediated.");
+        return;
+    }
     const ttydUnitTemplate = resolve(INSTALL_DIR, "platform/templates/systemd/maxy-ttyd.service");
     const ttydUnitDest = join(systemdUserDir, "maxy-ttyd.service");
     try {

package/dist/pinned-binaries.js

@@ -0,0 +1,43 @@
+// Pinned upstream binaries installed by the Linux provisioner.
+//
+// Some binaries we depend on are not available in Debian Bookworm's apt repo
+// (e.g. ttyd — entered Debian trixie and Ubuntu 22.04+ but NOT Bookworm, which
+// is the base of current Raspberry Pi OS). For those, we download the upstream
+// prebuilt static binary from GitHub releases, SHA256-verified, and place it
+// under /usr/local/bin. This module is the single source of truth for every
+// such dependency — version bumps are a one-file change.
+//
+// Verification rule: on SHA256 mismatch the installer aborts the download
+// step with a loud error and never writes the binary. No silent-install of
+// unverified bytes. See packages/create-maxy/src/index.ts → provisionTtydBinary.
+export const TTYD_VERSION = '1.7.7';
+// Asset file name as published on github.com/tsl0922/ttyd/releases.
+export const TTYD_ASSET_BY_ARCH = {
+    aarch64: 'ttyd.aarch64',
+    arm: 'ttyd.arm',
+    x86_64: 'ttyd.x86_64',
+};
+// SHA256 digest of each asset for TTYD_VERSION. Computed by downloading the
+// release asset directly from GitHub and running `sha256sum`. Bump together
+// with TTYD_VERSION — never update one without the other.
+export const TTYD_SHA256_BY_ARCH = {
+    aarch64: 'b38acadd89d1d396a0f5649aa52c539edbad07f4bc7348b27b4f4b7219dd4165',
+    arm: '05eac1223914f18c65898d72c8d14e76bbb5435f7762c6dc7f16f041994a8109',
+    x86_64: '8a217c968aba172e0dbf3f34447218dc015bc4d5e59bf51db2f2cd12b7be4f55',
+};
+// Map Linux kernel `uname -m` output to a TtydArch key. Returns null for
+// architectures we have not pinned a binary for — the caller must treat this
+// as a hard error (no silent fallback, no "try latest").
+export function mapUnameToTtydArch(uname) {
+    const trimmed = uname.trim();
+    if (trimmed === 'aarch64' || trimmed === 'arm64')
+        return 'aarch64';
+    if (trimmed === 'armv7l' || trimmed === 'armv6l' || trimmed === 'arm')
+        return 'arm';
+    if (trimmed === 'x86_64' || trimmed === 'amd64')
+        return 'x86_64';
+    return null;
+}
+export function ttydDownloadUrl(arch) {
+    return `https://github.com/tsl0922/ttyd/releases/download/${TTYD_VERSION}/${TTYD_ASSET_BY_ARCH[arch]}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy",
-  "version": "1.0.651",
+  "version": "1.0.652",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy": "./dist/index.js"

package/payload/platform/lib/graph-trash/dist/index.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Soft-delete primitive for the knowledge graph.
+ *
+ * MCP-tool callers must NEVER `DETACH DELETE` user-domain nodes. Use
+ * `trashNode` to mark a node `:Trashed`; `restoreNode` removes the label;
+ * `emptyTrash` hard-deletes nodes whose `trashedAt < now - graceDays`. The
+ * 2026-04-20 incident wiped 19 nodes via a single autonomous `DETACH DELETE`
+ * — Neo4j Community has no PITR, so properties were unrecoverable. This
+ * primitive contains the blast radius for every caller.
+ *
+ * Unique-constraint handling: when the trashed node's labels carry single-
+ * key UNIQUE constraints (e.g. `OnboardingState.accountId`), the live values
+ * are snapshotted into `_trashedKeys` (JSON) and nulled on the node, so
+ * MERGE against the same key won't collide. `restoreNode` writes them back
+ * and fails loudly when an active node already occupies the slot.
+ */
+import type { Session } from "neo4j-driver";
+export interface TrashParams {
+    session: Session;
+    accountId: string;
+    elementId: string;
+    /** Provenance marker — appears verbatim in `trashedBy` and `[trash:marked] by=`. */
+    by: string;
+    reason?: string;
+}
+export interface TrashResult {
+    trashed: boolean;
+    alreadyTrashed: boolean;
+    nodeId: string;
+    /** Labels excluding `:Trashed`. */
+    labels: string[];
+    trashedAt: string;
+    originalKeys: Record<string, unknown>;
+}
+export declare function trashNode(params: TrashParams): Promise<TrashResult>;
+export interface RestoreParams {
+    session: Session;
+    accountId: string;
+    elementId: string;
+}
+export interface RestoreResult {
+    restored: boolean;
+    nodeId: string;
+    labels: string[];
+    restoredKeys: Record<string, unknown>;
+}
+export declare function restoreNode(params: RestoreParams): Promise<RestoreResult>;
+export interface EmptyTrashParams {
+    session: Session;
+    accountId: string;
+    /** Default 30. */
+    graceDays?: number;
+    dryRun?: boolean;
+    /** Optional label whitelist — only nodes carrying any of these labels are eligible. */
+    labels?: string[];
+    /** Side-effect callback invoked per emptied node, e.g. to clean disk attachments. */
+    onEmpty?: (node: TrashCandidate) => Promise<void>;
+}
+export interface TrashCandidate {
+    elementId: string;
+    labels: string[];
+    trashedAt: string;
+    trashedBy: string | null;
+    /** Original unique-key snapshot — useful for KnowledgeDocument disk cleanup. */
+    trashedKeys: Record<string, unknown>;
+}
+export interface EmptyTrashResult {
+    graceDays: number;
+    dryRun: boolean;
+    candidates: TrashCandidate[];
+    emptied: number;
+}
+export declare function emptyTrash(params: EmptyTrashParams): Promise<EmptyTrashResult>;
+/**
+ * Read-filter clause excluding trashed nodes for the given Cypher alias.
+ *
+ * Filters both the `:Trashed` label (Task 576 primitive) and the legacy
+ * `deletedAt` property (KnowledgeDocument soft-delete pre-Task 576). The
+ * `deletedAt` arm is a transitional belt-and-braces — production graphs may
+ * still hold pre-migration soft-deletes — and stays until those are confirmed
+ * empty, then is dropped.
+ *
+ *   notTrashed("node")    → "(NOT node:Trashed AND node.deletedAt IS NULL)"
+ *   notTrashed("related") → "(NOT related:Trashed AND related.deletedAt IS NULL)"
+ */
+export declare function notTrashed(alias: string): string;
+/** Runtime accessor for the static unique-keys map (for tests + sibling tooling). */
+export declare function uniqueKeysForLabels(labels: string[]): string[];
+/** Property names trashNode writes — exposed so callers can re-MERGE without colliding. */
+export declare const TRASH_METADATA_PROPS: readonly string[];
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/graph-trash/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAuC5C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyEzE;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wBAAsB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAkE/E;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qFAAqF;IACrF,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0EpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAI9D;AAED,2FAA2F;AAC3F,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAqB,CAAC"}

package/payload/platform/lib/graph-trash/dist/index.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * Soft-delete primitive for the knowledge graph.
+ *
+ * MCP-tool callers must NEVER `DETACH DELETE` user-domain nodes. Use
+ * `trashNode` to mark a node `:Trashed`; `restoreNode` removes the label;
+ * `emptyTrash` hard-deletes nodes whose `trashedAt < now - graceDays`. The
+ * 2026-04-20 incident wiped 19 nodes via a single autonomous `DETACH DELETE`
+ * — Neo4j Community has no PITR, so properties were unrecoverable. This
+ * primitive contains the blast radius for every caller.
+ *
+ * Unique-constraint handling: when the trashed node's labels carry single-
+ * key UNIQUE constraints (e.g. `OnboardingState.accountId`), the live values
+ * are snapshotted into `_trashedKeys` (JSON) and nulled on the node, so
+ * MERGE against the same key won't collide. `restoreNode` writes them back
+ * and fails loudly when an active node already occupies the slot.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRASH_METADATA_PROPS = void 0;
+exports.trashNode = trashNode;
+exports.restoreNode = restoreNode;
+exports.emptyTrash = emptyTrash;
+exports.notTrashed = notTrashed;
+exports.uniqueKeysForLabels = uniqueKeysForLabels;
+/**
+ * Single-key UNIQUE properties per label, mirroring `platform/neo4j/schema.cypher`.
+ *
+ * Composite UNIQUEs (UserProfile, Email composite, AccessGrant) are
+ * represented by a single nullable component — Neo4j enforces a composite
+ * constraint only when every component is non-null, so nulling one frees it.
+ */
+const UNIQUE_KEYS_BY_LABEL = {
+    Person: ["email", "telephone"],
+    Service: ["serviceId"],
+    LocalBusiness: ["accountId"],
+    Task: ["taskId"],
+    Event: ["eventId"],
+    KnowledgeDocument: ["attachmentId"],
+    DigitalDocument: ["attachmentId"],
+    Conversation: ["conversationId", "sessionKey"],
+    Message: ["messageId"],
+    OnboardingState: ["accountId"],
+    Workflow: ["workflowId"],
+    WorkflowStep: ["stepId"],
+    WorkflowRun: ["runId"],
+    Preference: ["preferenceId"],
+    Email: ["emailId", "messageId"],
+    AdminUser: ["userId"],
+    ToolCall: ["callId"],
+    // Composite component nulls — frees the composite constraint:
+    AccessGrant: ["contactValue"], // composite (contactValue, agentSlug, accountId)
+    UserProfile: ["userId"], // composite (accountId, userId)
+};
+const TRASH_PROP_NAMES = [
+    "trashedAt",
+    "trashedBy",
+    "trashReason",
+    "_trashedKeys",
+];
+async function trashNode(params) {
+    const { session, accountId, elementId, by, reason } = params;
+    const lookup = await session.run(`MATCH (n) WHERE elementId(n) = $eid AND n.accountId = $accountId
+     RETURN labels(n) AS labels, properties(n) AS props`, { eid: elementId, accountId });
+    if (lookup.records.length === 0) {
+        throw new Error(`trashNode: node not found (elementId=${elementId} accountId=${accountId.slice(0, 8)}…)`);
+    }
+    const allLabels = lookup.records[0].get("labels");
+    const props = lookup.records[0].get("props");
+    const baseLabels = allLabels.filter((l) => l !== "Trashed");
+    if (allLabels.includes("Trashed")) {
+        return {
+            trashed: false,
+            alreadyTrashed: true,
+            nodeId: elementId,
+            labels: baseLabels,
+            trashedAt: String(props.trashedAt ?? ""),
+            originalKeys: {},
+        };
+    }
+    const uniqueKeys = new Set();
+    for (const label of baseLabels) {
+        for (const key of UNIQUE_KEYS_BY_LABEL[label] ?? [])
+            uniqueKeys.add(key);
+    }
+    const originalKeys = {};
+    for (const k of uniqueKeys) {
+        if (props[k] !== undefined && props[k] !== null)
+            originalKeys[k] = props[k];
+    }
+    const setNullClauses = Object.keys(originalKeys)
+        .map((k) => `n.\`${k}\` = null`)
+        .join(", ");
+    const setNullSuffix = setNullClauses ? `, ${setNullClauses}` : "";
+    const trashedAt = new Date().toISOString();
+    await session.run(`MATCH (n) WHERE elementId(n) = $eid
+     SET n:Trashed,
+         n.trashedAt = datetime($trashedAt),
+         n.trashedBy = $by,
+         n.trashReason = $reason,
+         n._trashedKeys = $trashedKeysJson${setNullSuffix}`, {
+        eid: elementId,
+        trashedAt,
+        by,
+        reason: reason ?? null,
+        trashedKeysJson: JSON.stringify(originalKeys),
+    });
+    process.stderr.write(`[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}\n`);
+    return {
+        trashed: true,
+        alreadyTrashed: false,
+        nodeId: elementId,
+        labels: baseLabels,
+        trashedAt,
+        originalKeys,
+    };
+}
+async function restoreNode(params) {
+    const { session, accountId, elementId } = params;
+    const lookup = await session.run(`MATCH (n:Trashed) WHERE elementId(n) = $eid
+     RETURN labels(n) AS labels, n._trashedKeys AS keysJson`, { eid: elementId });
+    if (lookup.records.length === 0) {
+        throw new Error(`restoreNode: trashed node not found (elementId=${elementId})`);
+    }
+    const allLabels = lookup.records[0].get("labels");
+    const baseLabels = allLabels.filter((l) => l !== "Trashed");
+    const keysJson = lookup.records[0].get("keysJson");
+    const originalKeys = keysJson ? JSON.parse(keysJson) : {};
+    // Conflict check: an active node already holds the unique slot we want back?
+    for (const label of baseLabels) {
+        const uniqueKeys = UNIQUE_KEYS_BY_LABEL[label] ?? [];
+        for (const k of uniqueKeys) {
+            const v = originalKeys[k];
+            if (v === undefined || v === null)
+                continue;
+            const conflict = await session.run(`MATCH (other:\`${label}\`)
+         WHERE elementId(other) <> $eid
+           AND NOT other:Trashed
+           AND other.\`${k}\` = $val
+         RETURN elementId(other) AS otherId LIMIT 1`, { eid: elementId, val: v });
+            if (conflict.records.length > 0) {
+                const otherId = conflict.records[0].get("otherId");
+                throw new Error(`restoreNode: cannot restore ${label} elementId=${elementId} — active node elementId=${otherId} already holds ${k}=${JSON.stringify(v)}`);
+            }
+        }
+    }
+    const setClauses = Object.keys(originalKeys)
+        .map((k) => `n.\`${k}\` = $val_${k}`)
+        .join(", ");
+    const setSuffix = setClauses ? `, ${setClauses}` : "";
+    const setParams = { eid: elementId };
+    for (const [k, v] of Object.entries(originalKeys))
+        setParams[`val_${k}`] = v;
+    await session.run(`MATCH (n:Trashed) WHERE elementId(n) = $eid
+     REMOVE n:Trashed, n.trashedAt, n.trashedBy, n.trashReason, n._trashedKeys
+     SET n.restoredAt = datetime()${setSuffix}`, setParams);
+    process.stderr.write(`[trash:restored] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")}\n`);
+    return {
+        restored: true,
+        nodeId: elementId,
+        labels: baseLabels,
+        restoredKeys: originalKeys,
+    };
+}
+async function emptyTrash(params) {
+    const t0 = Date.now();
+    const { session, accountId, graceDays = 30, dryRun = false, labels: labelFilter, onEmpty } = params;
+    const cutoff = new Date(Date.now() - graceDays * 24 * 60 * 60 * 1000).toISOString();
+    const labelClause = labelFilter && labelFilter.length > 0
+        ? `AND ANY(l IN labels(n) WHERE l IN $labelFilter)`
+        : "";
+    const candidatesResult = await session.run(`MATCH (n:Trashed)
+     WHERE n.trashedAt < datetime($cutoff)
+     ${labelClause}
+     RETURN elementId(n) AS eid,
+            labels(n) AS labels,
+            toString(n.trashedAt) AS trashedAt,
+            n.trashedBy AS trashedBy,
+            n._trashedKeys AS keysJson
+     ORDER BY n.trashedAt ASC`, { cutoff, ...(labelFilter ? { labelFilter } : {}) });
+    const candidates = candidatesResult.records.map((r) => {
+        const keysJson = r.get("keysJson");
+        return {
+            elementId: r.get("eid"),
+            labels: r.get("labels").filter((l) => l !== "Trashed"),
+            trashedAt: String(r.get("trashedAt")),
+            trashedBy: r.get("trashedBy") ?? null,
+            trashedKeys: keysJson ? JSON.parse(keysJson) : {},
+        };
+    });
+    process.stderr.write(`[trash:empty-run] accountId=${accountId} graceDays=${graceDays} dryRun=${dryRun} candidates=${candidates.length}\n`);
+    if (dryRun || candidates.length === 0) {
+        process.stderr.write(`[graph:trash:summary] accountId=${accountId} trashedNow=0 emptiedThisRun=0 graceDays=${graceDays} dryRun=${dryRun} elapsedMs=${Date.now() - t0}\n`);
+        return { graceDays, dryRun, candidates, emptied: 0 };
+    }
+    let emptied = 0;
+    for (const c of candidates) {
+        if (onEmpty) {
+            try {
+                await onEmpty(c);
+            }
+            catch (err) {
+                process.stderr.write(`[trash:empty-run] onEmpty side-effect failed for elementId=${c.elementId}: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+        }
+        await session.run(`MATCH (n) WHERE elementId(n) = $eid DETACH DELETE n`, { eid: c.elementId });
+        const ageDays = Math.floor((Date.now() - new Date(c.trashedAt).getTime()) / (24 * 60 * 60 * 1000));
+        process.stderr.write(`[trash:emptied] accountId=${accountId} elementId=${c.elementId} labels=${c.labels.join(",")} trashedAt=${c.trashedAt} ageDays=${ageDays}\n`);
+        emptied++;
+    }
+    process.stderr.write(`[graph:trash:summary] accountId=${accountId} trashedNow=0 emptiedThisRun=${emptied} graceDays=${graceDays} dryRun=${dryRun} elapsedMs=${Date.now() - t0}\n`);
+    return { graceDays, dryRun, candidates, emptied };
+}
+/**
+ * Read-filter clause excluding trashed nodes for the given Cypher alias.
+ *
+ * Filters both the `:Trashed` label (Task 576 primitive) and the legacy
+ * `deletedAt` property (KnowledgeDocument soft-delete pre-Task 576). The
+ * `deletedAt` arm is a transitional belt-and-braces — production graphs may
+ * still hold pre-migration soft-deletes — and stays until those are confirmed
+ * empty, then is dropped.
+ *
+ *   notTrashed("node")    → "(NOT node:Trashed AND node.deletedAt IS NULL)"
+ *   notTrashed("related") → "(NOT related:Trashed AND related.deletedAt IS NULL)"
+ */
+function notTrashed(alias) {
+    return `(NOT \`${alias}\`:Trashed AND \`${alias}\`.deletedAt IS NULL)`;
+}
+/** Runtime accessor for the static unique-keys map (for tests + sibling tooling). */
+function uniqueKeysForLabels(labels) {
+    const out = new Set();
+    for (const l of labels)
+        for (const k of UNIQUE_KEYS_BY_LABEL[l] ?? [])
+            out.add(k);
+    return [...out];
+}
+/** Property names trashNode writes — exposed so callers can re-MERGE without colliding. */
+exports.TRASH_METADATA_PROPS = TRASH_PROP_NAMES;
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/graph-trash/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA4DH,8BAyEC;AAeD,kCAkEC;AA8BD,gCA0EC;AAcD,gCAEC;AAGD,kDAIC;AAjVD;;;;;;GAMG;AACH,MAAM,oBAAoB,GAA6B;IACrD,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,OAAO,EAAE,CAAC,WAAW,CAAC;IACtB,aAAa,EAAE,CAAC,WAAW,CAAC;IAC5B,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,CAAC;IAClB,iBAAiB,EAAE,CAAC,cAAc,CAAC;IACnC,eAAe,EAAE,CAAC,cAAc,CAAC;IACjC,YAAY,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAC9C,OAAO,EAAE,CAAC,WAAW,CAAC;IACtB,eAAe,EAAE,CAAC,WAAW,CAAC;IAC9B,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,YAAY,EAAE,CAAC,QAAQ,CAAC;IACxB,WAAW,EAAE,CAAC,OAAO,CAAC;IACtB,UAAU,EAAE,CAAC,cAAc,CAAC;IAC5B,KAAK,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC;IAC/B,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpB,8DAA8D;IAC9D,WAAW,EAAE,CAAC,cAAc,CAAC,EAAM,iDAAiD;IACpF,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAY,gCAAgC;CACpE,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,WAAW;IACX,WAAW;IACX,aAAa;IACb,cAAc;CACN,CAAC;AAqBJ,KAAK,UAAU,SAAS,CAAC,MAAmB;IACjD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B;wDACoD,EACpD,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAC9B,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,wCAAwC,SAAS,cAAc,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAA4B,CAAC;IACxE,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAE5D,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,cAAc,EAAE,IAAI;YACpB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;YACxC,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,YAAY,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;SAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,CAAC,GAAG,CACf;;;;;4CAKwC,aAAa,EAAE,EACvD;QACE,GAAG,EAAE,SAAS;QACd,SAAS;QACT,EAAE;QACF,MAAM,EAAE,MAAM,IAAI,IAAI;QACtB,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;KAC9C,CACF,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,SAAS,cAAc,SAAS,WAAW,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,MAAM,IAAI,MAAM,IAAI,CACpI,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC;AAeM,KAAK,UAAU,WAAW,CAAC,MAAqB;IACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEjD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B;4DACwD,EACxD,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAC;IACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,kDAAkD,SAAS,GAAG,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAa,CAAC;IAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAkB,CAAC;IACpE,MAAM,YAAY,GAA4B,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEnF,6EAA6E;IAC7E,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,kBAAkB,KAAK;;;yBAGN,CAAC;oDAC0B,EAC5C,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAC3B,CAAC;YACF,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAW,CAAC;gBAC7D,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,cAAc,SAAS,4BAA4B,OAAO,kBAAkB,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CACzI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;SACpC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,SAAS,GAA4B,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAE7E,MAAM,OAAO,CAAC,GAAG,CACf;;oCAEgC,SAAS,EAAE,EAC3C,SAAS,CACV,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,SAAS,cAAc,SAAS,WAAW,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAClG,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,YAAY;KAC3B,CAAC;AACJ,CAAC;AA8BM,KAAK,UAAU,UAAU,CAAC,MAAwB;IACvD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,EAAE,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAEpG,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpF,MAAM,WAAW,GAAG,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC;;OAEG,WAAW;;;;;;8BAMY,EAC1B,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACpD,CAAC;IAEF,MAAM,UAAU,GAAqB,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAkB,CAAC;QACpD,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAW;YACjC,MAAM,EAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;YACpE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,SAAS,EAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAmB,IAAI,IAAI;YACxD,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,SAAS,cAAc,SAAS,WAAW,MAAM,eAAe,UAAU,CAAC,MAAM,IAAI,CACrH,CAAC;IAEF,IAAI,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,SAAS,4CAA4C,SAAS,WAAW,MAAM,cAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CACpJ,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8DAA8D,CAAC,CAAC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACnI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,OAAO,CAAC,GAAG,CACf,qDAAqD,EACrD,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CACrB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACnG,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,SAAS,cAAc,CAAC,CAAC,SAAS,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,SAAS,YAAY,OAAO,IAAI,CAC7I,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,SAAS,gCAAgC,OAAO,cAAc,SAAS,WAAW,MAAM,cAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAC7J,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,UAAU,CAAC,KAAa;IACtC,OAAO,UAAU,KAAK,oBAAoB,KAAK,uBAAuB,CAAC;AACzE,CAAC;AAED,qFAAqF;AACrF,SAAgB,mBAAmB,CAAC,MAAgB;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC9E,QAAA,oBAAoB,GAAsB,gBAAgB,CAAC"}