@rubytech/create-maxy 1.0.744 → 1.0.746

package/dist/__tests__/peer-brand-detect.test.js

@@ -0,0 +1,103 @@
+// Task 800 — acceptance grid for findPeerBrandOnDefaultNeo4jPort.
+//
+// Each test exercises one branch of the matching rule. The wrapper in
+// index.ts owns fs reads + warning emission; this suite does not touch fs.
+//
+// Runs via Node's built-in test runner (matches apt-resolve.test.ts +
+// port-canonicalisation.test.ts). The brief asked for vitest, but the
+// package has no vitest dependency — node:test is the codebase convention
+// and ships with the toolchain.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { findPeerBrandOnDefaultNeo4jPort } from "../peer-brand-detect.js";
+const DEFAULT_PORT = 7687;
+const CURRENT = "realagent"; // installer is realagent; peer would be maxy
+test("no peer hostnames → null", () => {
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [],
+    });
+    assert.equal(result, null);
+});
+test("peer with content=null (no .env on disk) → null", () => {
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", null]],
+    });
+    assert.equal(result, null);
+});
+test("peer pins NEO4J_URI=bolt://localhost:7687 → returns peer hostname", () => {
+    const env = `EMBED_MODEL=nomic-embed-text\nNEO4J_URI=bolt://localhost:7687\nACCOUNT_ID=abc\n`;
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", env]],
+    });
+    assert.equal(result, "maxy");
+});
+test("peer pins dedicated port 7688 (not the system unit) → null", () => {
+    const env = `NEO4J_URI=bolt://localhost:7688\n`;
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", env]],
+    });
+    assert.equal(result, null);
+});
+test("peer .env has no NEO4J_URI line → null", () => {
+    const env = `EMBED_MODEL=nomic-embed-text\nDISPLAY_MODE=hd\n`;
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", env]],
+    });
+    assert.equal(result, null);
+});
+test("peer .env is empty → null", () => {
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", ""]],
+    });
+    assert.equal(result, null);
+});
+test("multiple peers, second one matches → returns the matching hostname", () => {
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [
+            ["future-brand", `NEO4J_URI=bolt://localhost:7689\n`],
+            ["maxy", `NEO4J_URI=bolt://localhost:7687\n`],
+        ],
+    });
+    assert.equal(result, "maxy");
+});
+test("only the current brand in iterable → filtered, returns null", () => {
+    // Caller may pass the full known-brand list; the helper filters self.
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [[CURRENT, `NEO4J_URI=bolt://localhost:7687\n`]],
+    });
+    assert.equal(result, null);
+});
+test("URI with non-bolt scheme is not a match", () => {
+    const env = `NEO4J_URI=neo4j://localhost:7687\n`;
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", env]],
+    });
+    assert.equal(result, null);
+});
+test("URI with non-localhost host is not a match", () => {
+    const env = `NEO4J_URI=bolt://neo4j.example.com:7687\n`;
+    const result = findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: CURRENT,
+        defaultNeo4jPort: DEFAULT_PORT,
+        peerEnvContents: [["maxy", env]],
+    });
+    assert.equal(result, null);
+});

package/dist/index.js

@@ -5,6 +5,7 @@ import { resolve, join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
 import { resolveInstallPortFromFs, buildMaxyUnitFile } from "./port-resolution.js";
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
+import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
 // Brand manifest — read from payload to derive all brand-specific installation values.
 // The bundler stamps brand.json into the payload at build time.
@@ -841,6 +842,48 @@ function installNeo4j() {
     shell("systemctl", ["start", "neo4j"], { sudo: true });
     console.log("  Neo4j started. Password stored securely.");
 }
+/**
+ * Task 800 — does any peer brand on this host pin `NEO4J_URI=bolt://localhost:<default>`
+ * in its `.env`? If yes, the apt-installed `neo4j.service` is its database and the
+ * dedicated-unit installer must NOT stop+disable it. Returns the first matching
+ * peer's hostname, or `null` when no peer pins the default port.
+ *
+ * Wraps the pure decision in `peer-brand-detect.ts` with the fs reads of
+ * `~/.<peer>/.env`. Bias on read errors: if `.env` exists but is unreadable
+ * (permissions, transient I/O), the wrapper treats that peer as a *potential*
+ * dependency and short-circuits to the kept-active path. Disabling the system
+ * unit on faulty evidence would silently kill the peer's database (the exact
+ * failure Task 800 prevents); a conservatively-skipped disable is recoverable
+ * because the dedicated-unit bind check at the end of `setupDedicatedNeo4j`
+ * fails loud if the system unit is actually free.
+ */
+function peerBrandUsingSystemUnit() {
+    const home = process.env.HOME ?? "/root";
+    const peerEnvContents = [];
+    for (const hostname of KNOWN_BRAND_HOSTNAMES) {
+        if (hostname === BRAND.hostname) {
+            peerEnvContents.push([hostname, null]);
+            continue;
+        }
+        const envPath = resolve(home, `.${hostname}`, ".env");
+        if (!existsSync(envPath)) {
+            peerEnvContents.push([hostname, null]);
+            continue;
+        }
+        try {
+            peerEnvContents.push([hostname, readFileSync(envPath, "utf-8")]);
+        }
+        catch (err) {
+            console.error(`  WARNING: unable to read peer brand .env at ${envPath} — treating as potential dependency to avoid data loss (Task 800): ${err instanceof Error ? err.message : String(err)}`);
+            return hostname;
+        }
+    }
+    return findPeerBrandOnDefaultNeo4jPort({
+        currentBrandHostname: BRAND.hostname,
+        defaultNeo4jPort: DEFAULT_NEO4J_PORT,
+        peerEnvContents,
+    });
+}
 /**
  * Create a dedicated Neo4j instance for this brand when NEO4J_DEDICATED is true.
  * Produces: separate config dir, data dir, log dir, systemd service, and password.
@@ -849,6 +892,10 @@ function installNeo4j() {
  * dedicated, start, verify) so a half-installed Pi recovers in-place without
  * manual systemctl. ensureNeo4jPassword() handles password verification on the
  * recovery path.
+ *
+ * Task 800: on multi-brand hosts where a peer brand still depends on the apt
+ * `neo4j.service` (port 7687), the stop+disable step is skipped — disabling
+ * the system unit would kill the peer's database.
  */
 function setupDedicatedNeo4j() {
     if (!NEO4J_DEDICATED)
@@ -952,10 +999,22 @@ WantedBy=multi-user.target
     spawnSync("sudo", ["systemctl", "daemon-reload"], { stdio: "inherit" });
     console.log("  [privileged] systemctl enable");
     shell("systemctl", ["enable", serviceName], { sudo: true });
-    console.log(`  [neo4j] disabling system unit (brand-dedicated active on port ${NEO4J_PORT})`);
-    logFile(`  [neo4j] disabling system unit (brand-dedicated active on port ${NEO4J_PORT})`);
-    shell("systemctl", ["stop", "neo4j"], { sudo: true, bestEffort: true });
-    shell("systemctl", ["disable", "neo4j"], { sudo: true, bestEffort: true });
+    // Task 800: skip stop+disable when a peer brand on this host still depends
+    // on the apt `neo4j.service` (port 7687). Disabling it would kill the peer's
+    // database — Task 797 reproducer on Neo's laptop. The kept-active path is
+    // mutually exclusive with the disable path: exactly one log line per install.
+    const peerOnSystemUnit = peerBrandUsingSystemUnit();
+    if (peerOnSystemUnit !== null) {
+        const keptActiveMsg = `  [neo4j] system unit kept active — peer brand ${peerOnSystemUnit} depends on port ${DEFAULT_NEO4J_PORT} (Task 800)`;
+        console.log(keptActiveMsg);
+        logFile(keptActiveMsg);
+    }
+    else {
+        console.log(`  [neo4j] disabling system unit (brand-dedicated active on port ${NEO4J_PORT})`);
+        logFile(`  [neo4j] disabling system unit (brand-dedicated active on port ${NEO4J_PORT})`);
+        shell("systemctl", ["stop", "neo4j"], { sudo: true });
+        shell("systemctl", ["disable", "neo4j"], { sudo: true });
+    }
     console.log(`  [neo4j] reset-failed ${serviceName} before start`);
     logFile(`  [neo4j] reset-failed ${serviceName} before start`);
     shell("systemctl", ["reset-failed", serviceName], { sudo: true, bestEffort: true });

package/dist/peer-brand-detect.js

@@ -0,0 +1,39 @@
+// Task 800 — pure peer-brand detection. Extracted from index.ts so the
+// "should we leave the system neo4j.service alone?" decision can be unit-
+// tested with concrete `.env` fixtures, no fs reads. Mirrors the apt-resolve
+// / port-resolution pattern: inputs in, decision out, no I/O.
+//
+// The installer's `setupDedicatedNeo4j()` wraps this with the fs reads of
+// `~/.<peer>/.env` and the `console.error` warning on read failure. This
+// module owns only the parsing + matching rule.
+/**
+ * Decide whether any peer brand on the same host depends on the apt-installed
+ * `neo4j.service` (port `defaultNeo4jPort`, conventionally 7687). Returns the
+ * first matching peer brand's hostname, or `null` if no peer pins that port.
+ *
+ * `peerEnvContents` is an iterable of `[hostname, envContent | null]` pairs.
+ * `null` content means the peer's `.env` is absent or unreadable — treated
+ * the same as "no evidence of dependency". The wrapper logs the read failure;
+ * this module stays decision-only.
+ *
+ * Matching rule: a peer pins the default port iff its `.env` contains a line
+ * matching `NEO4J_URI=bolt://localhost:<defaultNeo4jPort>` exactly. Any other
+ * scheme, host, or port → not a match. Self-references (peer hostname equal
+ * to the current install's hostname) are silently skipped so the caller can
+ * pass the full known-brand list without filtering first.
+ */
+export function findPeerBrandOnDefaultNeo4jPort(args) {
+    const { currentBrandHostname, defaultNeo4jPort, peerEnvContents } = args;
+    const expected = `bolt://localhost:${defaultNeo4jPort}`;
+    for (const [hostname, content] of peerEnvContents) {
+        if (hostname === currentBrandHostname)
+            continue;
+        if (content === null)
+            continue;
+        const match = content.match(/^NEO4J_URI=(.+)$/m);
+        if (match && match[1].trim() === expected) {
+            return hostname;
+        }
+    }
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy",
-  "version": "1.0.744",
+  "version": "1.0.746",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy": "./dist/index.js"

package/payload/platform/lib/graph-mcp/dist/cypher-rewrite-stamp.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Cypher rewrite pass that injects provenance stamps into operator-supplied
+ * write_neo4j_cypher (Task 797). Sibling to cypher-validate.ts: validate first,
+ * rewrite second, run third.
+ *
+ * Doctrine context: Task 673 wrapped writers stamp every CREATE node
+ * structurally via writeNodeWithEdges; raw cypher (Task 796) relied on
+ * prompt-internalised discipline. This module closes the asymmetry — the
+ * rewriter appends `SET <alias>.createdAt = $__autoStartTimestamp,
+ * <alias>.createdByAgent = $__autoAgent, <alias>.createdByTool =
+ * 'graph-cypher-write', <alias>.createdBySession = $__autoSession` to every
+ * CREATE/MERGE clause that introduces a new labeled node. Caller supplies
+ * the three `$__auto*` params at tx.run time.
+ *
+ * MERGE handling preserves the create-vs-match distinction. CREATE always
+ * stamps (every CREATE introduces a new node by definition). MERGE injects
+ * `ON CREATE SET` so an existing-node match path keeps the original writer's
+ * provenance intact — overwriting it would destroy forensic attribution.
+ *
+ * Node-only stamping. Edge aliases (`[r:R]`) are not auto-stamped — matches
+ * the wrapped writer's writeNodeWithEdges, which stamps the node only.
+ *
+ * Idempotent: re-applying the rewriter to its own output is a no-op. The
+ * marker that proves "already stamped" is `<alias>.createdBySession =
+ * $__autoSession` — the unique combination of property name + auto param.
+ *
+ * String literals and comments are redacted (chars replaced with spaces,
+ * offsets preserved) so a `CREATE (fake:Foo)` inside a comment or quoted
+ * string cannot mistakenly trip the rewriter.
+ */
+export interface RewriteResult {
+    cypher: string;
+    /** Number of node aliases that received a fresh stamp injection. */
+    stampsAppended: number;
+}
+export declare function rewriteWithProvenanceStamps(cypher: string): RewriteResult;
+//# sourceMappingURL=cypher-rewrite-stamp.d.ts.map

package/payload/platform/lib/graph-mcp/dist/cypher-rewrite-stamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cypher-rewrite-stamp.d.ts","sourceRoot":"","sources":["../src/cypher-rewrite-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;CACxB;AAsPD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAmEzE"}

package/payload/platform/lib/graph-mcp/dist/cypher-rewrite-stamp.js

@@ -0,0 +1,333 @@
+"use strict";
+/**
+ * Cypher rewrite pass that injects provenance stamps into operator-supplied
+ * write_neo4j_cypher (Task 797). Sibling to cypher-validate.ts: validate first,
+ * rewrite second, run third.
+ *
+ * Doctrine context: Task 673 wrapped writers stamp every CREATE node
+ * structurally via writeNodeWithEdges; raw cypher (Task 796) relied on
+ * prompt-internalised discipline. This module closes the asymmetry — the
+ * rewriter appends `SET <alias>.createdAt = $__autoStartTimestamp,
+ * <alias>.createdByAgent = $__autoAgent, <alias>.createdByTool =
+ * 'graph-cypher-write', <alias>.createdBySession = $__autoSession` to every
+ * CREATE/MERGE clause that introduces a new labeled node. Caller supplies
+ * the three `$__auto*` params at tx.run time.
+ *
+ * MERGE handling preserves the create-vs-match distinction. CREATE always
+ * stamps (every CREATE introduces a new node by definition). MERGE injects
+ * `ON CREATE SET` so an existing-node match path keeps the original writer's
+ * provenance intact — overwriting it would destroy forensic attribution.
+ *
+ * Node-only stamping. Edge aliases (`[r:R]`) are not auto-stamped — matches
+ * the wrapped writer's writeNodeWithEdges, which stamps the node only.
+ *
+ * Idempotent: re-applying the rewriter to its own output is a no-op. The
+ * marker that proves "already stamped" is `<alias>.createdBySession =
+ * $__autoSession` — the unique combination of property name + auto param.
+ *
+ * String literals and comments are redacted (chars replaced with spaces,
+ * offsets preserved) so a `CREATE (fake:Foo)` inside a comment or quoted
+ * string cannot mistakenly trip the rewriter.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rewriteWithProvenanceStamps = rewriteWithProvenanceStamps;
+const AUTO_PARAM_AGENT = "$__autoAgent";
+const AUTO_PARAM_SESSION = "$__autoSession";
+const AUTO_PARAM_TIMESTAMP = "$__autoStartTimestamp";
+const AUTO_TOOL_LITERAL = "'graph-cypher-write'";
+const KEYWORD_TERMINATORS = new Set([
+    "SET",
+    "ON",
+    "MATCH",
+    "MERGE",
+    "CREATE",
+    "RETURN",
+    "WITH",
+    "WHERE",
+    "REMOVE",
+    "DELETE",
+    "DETACH",
+    "UNION",
+    "ORDER",
+    "LIMIT",
+    "SKIP",
+    "FOREACH",
+    "UNWIND",
+    "CALL",
+    "USE",
+    "LOAD",
+    "YIELD",
+]);
+function buildRedacted(cypher) {
+    let out = "";
+    let i = 0;
+    while (i < cypher.length) {
+        const c = cypher[i];
+        if (c === "/" && cypher[i + 1] === "/") {
+            while (i < cypher.length && cypher[i] !== "\n") {
+                out += " ";
+                i++;
+            }
+            continue;
+        }
+        if (c === "/" && cypher[i + 1] === "*") {
+            out += "  ";
+            i += 2;
+            while (i < cypher.length && !(cypher[i] === "*" && cypher[i + 1] === "/")) {
+                out += " ";
+                i++;
+            }
+            if (i < cypher.length) {
+                out += "  ";
+                i += 2;
+            }
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            const quote = c;
+            out += c;
+            i++;
+            while (i < cypher.length && cypher[i] !== quote) {
+                if (cypher[i] === "\\" && i + 1 < cypher.length) {
+                    out += "  ";
+                    i += 2;
+                    continue;
+                }
+                out += " ";
+                i++;
+            }
+            if (i < cypher.length) {
+                out += cypher[i];
+                i++;
+            }
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    return out;
+}
+function findKeywordHits(redacted) {
+    const re = /\b(CREATE|MERGE)\b/gi;
+    const results = [];
+    for (const m of redacted.matchAll(re)) {
+        if (m.index === undefined)
+            continue;
+        const upper = m[1].toUpperCase();
+        // Skip `CREATE` that's part of `ON CREATE SET` (a MERGE sub-clause, not
+        // an introducing CREATE). Without this, the auto-stamp's own injected
+        // `ON CREATE SET` would register as a separate CREATE hit on the next
+        // rewriter pass, breaking idempotency by truncating the stamp window.
+        if (upper === "CREATE") {
+            const prefix = redacted.slice(Math.max(0, m.index - 8), m.index);
+            if (/\bON\s+$/i.test(prefix))
+                continue;
+        }
+        results.push({
+            kw: upper,
+            afterKw: m.index + m[0].length,
+        });
+    }
+    return results;
+}
+const TERMINATOR_PROBE = /^(\s*)(?:;|([A-Za-z]+))/;
+/**
+ * Returns true iff position `i` in `redacted` is at a word boundary — i.e.,
+ * the immediately preceding character is not part of an identifier (letters,
+ * digits, underscore). Without this guard, TERMINATOR_PROBE matches the
+ * trailing letters of a multi-char identifier as a keyword (e.g. `Session`
+ * ending in `on` would match the `ON` keyword and truncate the scan
+ * mid-identifier).
+ */
+function atWordBoundary(redacted, i) {
+    if (i === 0)
+        return true;
+    return !/[A-Za-z0-9_]/.test(redacted[i - 1]);
+}
+/**
+ * Returns the index just past the closing `)` of the CREATE/MERGE pattern,
+ * or null if no node pattern follows the keyword (e.g. CREATE INDEX, CREATE
+ * CONSTRAINT — neither would have reached the rewriter, but defensive).
+ */
+function findPatternEnd(redacted, afterKw) {
+    let i = afterKw;
+    while (i < redacted.length && /\s/.test(redacted[i]))
+        i++;
+    if (i >= redacted.length || redacted[i] !== "(")
+        return null;
+    let parenDepth = 0;
+    let bracketDepth = 0;
+    while (i < redacted.length) {
+        if (parenDepth === 0 && bracketDepth === 0 && i > afterKw) {
+            const tmatch = redacted.slice(i).match(TERMINATOR_PROBE);
+            if (tmatch) {
+                const wsLen = tmatch[1].length;
+                const ch = redacted[i + wsLen];
+                if (ch === ";")
+                    return i + wsLen;
+                const word = tmatch[2];
+                if (word &&
+                    KEYWORD_TERMINATORS.has(word.toUpperCase()) &&
+                    atWordBoundary(redacted, i + wsLen)) {
+                    return i + wsLen;
+                }
+            }
+        }
+        const c = redacted[i];
+        if (c === "(")
+            parenDepth++;
+        else if (c === ")")
+            parenDepth--;
+        else if (c === "[")
+            bracketDepth++;
+        else if (c === "]")
+            bracketDepth--;
+        i++;
+    }
+    return i;
+}
+function extractLabeledAliases(redactedSlice) {
+    const out = [];
+    const seen = new Set();
+    const re = /\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*:\s*[A-Z]/g;
+    for (const m of redactedSlice.matchAll(re)) {
+        const alias = m[1];
+        if (!seen.has(alias)) {
+            seen.add(alias);
+            out.push(alias);
+        }
+    }
+    return out;
+}
+function aliasAlreadyStamped(slice, alias) {
+    // Per-pattern scope (review F1). The `slice` covers this CREATE/MERGE
+    // pattern's possible SET / ON CREATE SET clauses up to the next CREATE/
+    // MERGE boundary — scoping the marker check globally would mis-classify
+    // a re-introduction of the same alias name across two distinct patterns
+    // as "already stamped" (the first pattern's stamp would shadow the second).
+    const escaped = alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const marker = new RegExp(`\\b${escaped}\\.createdBySession\\s*=\\s*\\$__autoSession\\b`);
+    return marker.test(slice);
+}
+function buildAssignments(aliases) {
+    return aliases
+        .flatMap((a) => [
+        `${a}.createdAt = ${AUTO_PARAM_TIMESTAMP}`,
+        `${a}.createdByAgent = ${AUTO_PARAM_AGENT}`,
+        `${a}.createdByTool = ${AUTO_TOOL_LITERAL}`,
+        `${a}.createdBySession = ${AUTO_PARAM_SESSION}`,
+    ])
+        .join(", ");
+}
+const ON_CREATE_SET_PROBE = /^ON\s+CREATE\s+SET\s+/i;
+const ON_MATCH_SET_PROBE = /^ON\s+MATCH\s+SET\b/i;
+function findOnCreateSetEnd(redacted, fromIdx) {
+    let i = fromIdx;
+    while (i < redacted.length && /\s/.test(redacted[i]))
+        i++;
+    const m = redacted.slice(i).match(ON_CREATE_SET_PROBE);
+    if (!m)
+        return null;
+    let j = i + m[0].length;
+    let parenDepth = 0;
+    let bracketDepth = 0;
+    while (j < redacted.length) {
+        if (parenDepth === 0 && bracketDepth === 0) {
+            const tmatch = redacted.slice(j).match(TERMINATOR_PROBE);
+            if (tmatch) {
+                const wsLen = tmatch[1].length;
+                const ch = redacted[j + wsLen];
+                if (ch === ";")
+                    return { end: j + wsLen };
+                const word = tmatch[2];
+                if (word &&
+                    KEYWORD_TERMINATORS.has(word.toUpperCase()) &&
+                    atWordBoundary(redacted, j + wsLen)) {
+                    return { end: j + wsLen };
+                }
+            }
+        }
+        const c = redacted[j];
+        if (c === "(")
+            parenDepth++;
+        else if (c === ")")
+            parenDepth--;
+        else if (c === "[")
+            bracketDepth++;
+        else if (c === "]")
+            bracketDepth--;
+        j++;
+    }
+    return { end: j };
+}
+function findOnMatchSetStart(redacted, fromIdx) {
+    let i = fromIdx;
+    while (i < redacted.length && /\s/.test(redacted[i]))
+        i++;
+    if (ON_MATCH_SET_PROBE.test(redacted.slice(i))) {
+        return i;
+    }
+    return null;
+}
+function rewriteWithProvenanceStamps(cypher) {
+    const redacted = buildRedacted(cypher);
+    const hits = findKeywordHits(redacted);
+    const edits = [];
+    let stampsAppended = 0;
+    for (let h = 0; h < hits.length; h++) {
+        const { kw, afterKw } = hits[h];
+        const patternEnd = findPatternEnd(redacted, afterKw);
+        if (patternEnd === null)
+            continue;
+        let pStart = afterKw;
+        while (pStart < redacted.length && /\s/.test(redacted[pStart]))
+            pStart++;
+        const patternSlice = redacted.slice(pStart, patternEnd);
+        const labeled = extractLabeledAliases(patternSlice);
+        // Per-pattern stamp window: from this pattern's start through the next
+        // CREATE/MERGE boundary (or end of cypher). Scoping the "already stamped"
+        // check globally would mis-classify a re-introduction of the same alias
+        // name across two distinct patterns (review F1).
+        const nextHitAfterKw = h + 1 < hits.length ? hits[h + 1].afterKw : redacted.length;
+        const stampWindow = redacted.slice(pStart, nextHitAfterKw);
+        const aliases = labeled.filter((a) => !aliasAlreadyStamped(stampWindow, a));
+        if (aliases.length === 0)
+            continue;
+        if (kw === "CREATE") {
+            // Trailing space matters: when patternEnd lands at a clause keyword
+            // (e.g. ` WITH` immediately after `(n:Person)`), our `findPatternEnd`
+            // returns the keyword's position. Without a trailing space, the
+            // injected `$__autoSession` runs into the keyword and Cypher parses
+            // `$__autoSessionWITH` as one parameter name.
+            edits.push({
+                at: patternEnd,
+                insert: ` SET ${buildAssignments(aliases)} `,
+            });
+            stampsAppended += aliases.length;
+            continue;
+        }
+        const existingOnCreate = findOnCreateSetEnd(redacted, patternEnd);
+        if (existingOnCreate) {
+            edits.push({
+                at: existingOnCreate.end,
+                insert: `, ${buildAssignments(aliases)} `,
+            });
+            stampsAppended += aliases.length;
+            continue;
+        }
+        const onMatchStart = findOnMatchSetStart(redacted, patternEnd);
+        const insertAt = onMatchStart ?? patternEnd;
+        edits.push({
+            at: insertAt,
+            insert: ` ON CREATE SET ${buildAssignments(aliases)} `,
+        });
+        stampsAppended += aliases.length;
+    }
+    edits.sort((a, b) => b.at - a.at);
+    let result = cypher;
+    for (const edit of edits) {
+        result = result.slice(0, edit.at) + edit.insert + result.slice(edit.at);
+    }
+    return { cypher: result, stampsAppended };
+}
+//# sourceMappingURL=cypher-rewrite-stamp.js.map

package/payload/platform/lib/graph-mcp/dist/cypher-rewrite-stamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cypher-rewrite-stamp.js","sourceRoot":"","sources":["../src/cypher-rewrite-stamp.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;AA4PH,kEAmEC;AAvTD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAC5C,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,IAAI;IACJ,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC/C,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACvC,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC1E,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;gBAChD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChD,GAAG,IAAI,IAAI,CAAC;oBACZ,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB;IAEhB,MAAM,EAAE,GAAG,sBAAsB,CAAC;IAClC,MAAM,OAAO,GAAuD,EAAE,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACjE,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,KAA2B;YAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,CAAS;IACjD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,OAAe;IACvD,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,UAAU,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC/B,IAAI,EAAE,KAAK,GAAG;oBAAE,OAAO,CAAC,GAAG,KAAK,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvB,IACE,IAAI;oBACJ,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC3C,cAAc,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,EACnC,CAAC;oBACD,OAAO,CAAC,GAAG,KAAK,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,EAAE,CAAC;aAC5B,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,EAAE,CAAC;aAC9B,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,EAAE,CAAC;QACnC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,EAAE,GAAG,4CAA4C,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,KAAa;IACvD,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,MAAM,OAAO,iDAAiD,CAC/D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAiB;IACzC,OAAO,OAAO;SACX,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACd,GAAG,CAAC,gBAAgB,oBAAoB,EAAE;QAC1C,GAAG,CAAC,qBAAqB,gBAAgB,EAAE;QAC3C,GAAG,CAAC,oBAAoB,iBAAiB,EAAE;QAC3C,GAAG,CAAC,uBAAuB,kBAAkB,EAAE;KAChD,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AACrD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAElD,SAAS,kBAAkB,CACzB,QAAgB,EAChB,OAAe;IAEf,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,UAAU,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;gBAC/B,IAAI,EAAE,KAAK,GAAG;oBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvB,IACE,IAAI;oBACJ,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC3C,cAAc,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,EACnC,CAAC;oBACD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG;YAAE,UAAU,EAAE,CAAC;aAC5B,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,EAAE,CAAC;aAC9B,IAAI,CAAC,KAAK,GAAG;YAAE,YAAY,EAAE,CAAC;QACnC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,OAAe;IAC5D,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC1D,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B,CAAC,MAAc;IACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAGvC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,IAAI;YAAE,SAAS;QAElC,IAAI,MAAM,GAAG,OAAO,CAAC;QACrB,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,EAAE,CAAC;QAEzE,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACpD,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,cAAc,GAClB,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9D,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,oEAAoE;YACpE,sEAAsE;YACtE,gEAAgE;YAChE,oEAAoE;YACpE,8CAA8C;YAC9C,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,UAAU;gBACd,MAAM,EAAE,QAAQ,gBAAgB,CAAC,OAAO,CAAC,GAAG;aAC7C,CAAC,CAAC;YACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;YACjC,SAAS;QACX,CAAC;QAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,gBAAgB,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,gBAAgB,CAAC,GAAG;gBACxB,MAAM,EAAE,KAAK,gBAAgB,CAAC,OAAO,CAAC,GAAG;aAC1C,CAAC,CAAC;YACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,YAAY,IAAI,UAAU,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,kBAAkB,gBAAgB,CAAC,OAAO,CAAC,GAAG;SACvD,CAAC,CAAC;QACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC5C,CAAC"}