@rubytech/create-realagent 1.0.840 → 1.0.843

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-realagent",
-  "version": "1.0.840",
+  "version": "1.0.843",
   "description": "Install Real Agent — Built for agents. By agents.",
   "bin": {
     "create-realagent": "./dist/index.js"

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=enumerate.test.d.ts.map

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/enumerate.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../index.js");
+function makeFixture() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-enum-"));
+    // (a) non-UUID dir → excluded.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "not-a-uuid"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "not-a-uuid", "account.json"), "{}");
+    // (b) UUID dir, no account.json → excluded.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "11111111-2222-3333-4444-555555555555"));
+    // (c) UUID dir, unparseable account.json → excluded (over-prune doctrine).
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "account.json"), "{ broken json");
+    // (d) UUID dir, parseable account.json → included.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "12345678-9abc-def0-1234-56789abcdef0"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "12345678-9abc-def0-1234-56789abcdef0", "account.json"), JSON.stringify({ id: "12345678-9abc-def0-1234-56789abcdef0" }));
+    return root;
+}
+(0, node_test_1.default)("enumerateValidAccountIds returns only UUID dirs with parseable account.json", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        const result = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.deepEqual(result, ["12345678-9abc-def0-1234-56789abcdef0"]);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("enumerateValidAccountIds returns [] when accountsDir does not exist", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const ghost = (0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-enum-does-not-exist-" + Date.now());
+    strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(ghost), []);
+});
+(0, node_test_1.default)("enumerateValidAccountIds caches per accountsDir; reset re-reads", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        const first = (0, index_js_1.enumerateValidAccountIds)(root);
+        // Add a second valid dir AFTER first call; cached call must NOT see it.
+        const newId = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, newId));
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, newId, "account.json"), "{}");
+        const cached = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.deepEqual(cached, first, "cache should hide the newly-added dir");
+        (0, index_js_1._resetEnumerationCache)();
+        const fresh = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.equal(fresh.length, 2);
+        strict_1.default.ok(fresh.includes(newId));
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("getAccountsDirFromEnv throws when MAXY_PLATFORM_ROOT is unset", () => {
+    const saved = process.env.MAXY_PLATFORM_ROOT;
+    delete process.env.MAXY_PLATFORM_ROOT;
+    try {
+        strict_1.default.throws(() => (0, index_js_1.getAccountsDirFromEnv)(), /MAXY_PLATFORM_ROOT not set/);
+    }
+    finally {
+        if (saved !== undefined)
+            process.env.MAXY_PLATFORM_ROOT = saved;
+    }
+});
+(0, node_test_1.default)("getAccountsDirFromEnv resolves to ${root}/../data/accounts when set", () => {
+    const saved = process.env.MAXY_PLATFORM_ROOT;
+    process.env.MAXY_PLATFORM_ROOT = "/tmp/fake-root/platform";
+    try {
+        const result = (0, index_js_1.getAccountsDirFromEnv)();
+        strict_1.default.equal(result, (0, node_path_1.resolve)("/tmp/fake-root/platform", "..", "data/accounts"));
+    }
+    finally {
+        if (saved !== undefined)
+            process.env.MAXY_PLATFORM_ROOT = saved;
+        else
+            delete process.env.MAXY_PLATFORM_ROOT;
+    }
+});
+//# sourceMappingURL=enumerate.test.js.map

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.test.js","sourceRoot":"","sources":["../../src/__tests__/enumerate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAwE;AACxE,qCAAiC;AACjC,yCAA0C;AAC1C,0CAIqB;AAErB,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACvD,+BAA+B;IAC/B,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACpC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,4CAA4C;IAC5C,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,EAAE,cAAc,CAAC,EAClE,eAAe,CAChB,CAAC;IACF,mDAAmD;IACnD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,EAAE,cAAc,CAAC,EAClE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE,CAAC,CAC/D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAA,mBAAI,EAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC9C,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,sCAAsC,CAAC,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,2BAA2B,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,gBAAM,CAAC,SAAS,CAAC,IAAA,mCAAwB,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC7C,wEAAwE;QACxE,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC9C,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,uCAAuC,CAAC,CAAC;QACzE,IAAA,iCAAsB,GAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC7C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9B,gBAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACtC,IAAI,CAAC;QACH,gBAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,gCAAqB,GAAE,EAC7B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAClE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,yBAAyB,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,gCAAqB,GAAE,CAAC;QACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAA,mBAAO,EAAC,yBAAyB,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;;YAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
+ * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
+ * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
+ * dir (over-prune one suspect account beats under-prune the leak it might
+ * be hiding).
+ */
+export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
+ * pattern at platform/ui/app/lib/claude-agent/account.ts:9
+ * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
+ *
+ * Loud-throws when the env var is unset — graph-write's gate must not fall
+ * open silently.
+ */
+export declare function getAccountsDirFromEnv(): string;
+/**
+ * Test-only cache reset. Production callers must not invoke this — the cache
+ * is a deliberate boot-time invariant (see module doc).
+ */
+export declare function _resetEnumerationCache(): void;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
+exports._resetEnumerationCache = _resetEnumerationCache;
+/**
+ * account-enumeration — single source of truth for "which accountIds are
+ * provisioned on disk for this install?".
+ *
+ * Doctrine — `.docs/neo4j.md` "Account isolation invariant": every writer
+ * that stamps `n.accountId` must verify the value against
+ * `${DATA_ROOT}/accounts/<id>/account.json` before write. Read-side scoping
+ * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
+ * an unenforced writer can leak indefinitely with zero downstream symptom.
+ *
+ * Two consumers:
+ *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
+ *      floor; rejects any write whose `props.accountId` is not in the set
+ *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
+ *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *
+ * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
+ * created at install time, so adding/removing accounts requires a service
+ * restart anyway.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const cache = new Map();
+/**
+ * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
+ * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
+ * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
+ * dir (over-prune one suspect account beats under-prune the leak it might
+ * be hiding).
+ */
+function enumerateValidAccountIds(accountsDir) {
+    const cached = cache.get(accountsDir);
+    if (cached !== undefined)
+        return cached;
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)(accountsDir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            cache.set(accountsDir, []);
+            return [];
+        }
+        throw err;
+    }
+    const valid = [];
+    for (const name of names) {
+        if (!UUID_RE.test(name))
+            continue;
+        const configPath = (0, node_path_1.resolve)(accountsDir, name, "account.json");
+        try {
+            JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            valid.push(name);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT")
+                continue;
+            // SyntaxError (parse failure) and other read errors fall through:
+            // exclude this dir, try the next.
+        }
+    }
+    cache.set(accountsDir, valid);
+    return valid;
+}
+/**
+ * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
+ * pattern at platform/ui/app/lib/claude-agent/account.ts:9
+ * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
+ *
+ * Loud-throws when the env var is unset — graph-write's gate must not fall
+ * open silently.
+ */
+function getAccountsDirFromEnv() {
+    const root = process.env.MAXY_PLATFORM_ROOT;
+    if (!root) {
+        throw new Error("[graph-write] MAXY_PLATFORM_ROOT not set — cannot enforce accountId gate. " +
+            "Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly.");
+    }
+    return (0, node_path_1.resolve)(root, "..", "data/accounts");
+}
+/**
+ * Test-only cache reset. Production callers must not invoke this — the cache
+ * is a deliberate boot-time invariant (see module doc).
+ */
+function _resetEnumerationCache() {
+    cache.clear();
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAUD,sDASC;AAMD,wDAEC;AA/FD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/payload/platform/lib/account-enumeration/src/__tests__/enumerate.test.ts

@@ -0,0 +1,94 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import {
+  enumerateValidAccountIds,
+  getAccountsDirFromEnv,
+  _resetEnumerationCache,
+} from "../index.js";
+
+function makeFixture(): string {
+  const root = mkdtempSync(join(tmpdir(), "acct-enum-"));
+  // (a) non-UUID dir → excluded.
+  mkdirSync(join(root, "not-a-uuid"));
+  writeFileSync(join(root, "not-a-uuid", "account.json"), "{}");
+  // (b) UUID dir, no account.json → excluded.
+  mkdirSync(join(root, "11111111-2222-3333-4444-555555555555"));
+  // (c) UUID dir, unparseable account.json → excluded (over-prune doctrine).
+  mkdirSync(join(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"));
+  writeFileSync(
+    join(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "account.json"),
+    "{ broken json",
+  );
+  // (d) UUID dir, parseable account.json → included.
+  mkdirSync(join(root, "12345678-9abc-def0-1234-56789abcdef0"));
+  writeFileSync(
+    join(root, "12345678-9abc-def0-1234-56789abcdef0", "account.json"),
+    JSON.stringify({ id: "12345678-9abc-def0-1234-56789abcdef0" }),
+  );
+  return root;
+}
+
+test("enumerateValidAccountIds returns only UUID dirs with parseable account.json", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    const result = enumerateValidAccountIds(root);
+    assert.deepEqual(result, ["12345678-9abc-def0-1234-56789abcdef0"]);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("enumerateValidAccountIds returns [] when accountsDir does not exist", () => {
+  _resetEnumerationCache();
+  const ghost = join(tmpdir(), "acct-enum-does-not-exist-" + Date.now());
+  assert.deepEqual(enumerateValidAccountIds(ghost), []);
+});
+
+test("enumerateValidAccountIds caches per accountsDir; reset re-reads", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    const first = enumerateValidAccountIds(root);
+    // Add a second valid dir AFTER first call; cached call must NOT see it.
+    const newId = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+    mkdirSync(join(root, newId));
+    writeFileSync(join(root, newId, "account.json"), "{}");
+    const cached = enumerateValidAccountIds(root);
+    assert.deepEqual(cached, first, "cache should hide the newly-added dir");
+    _resetEnumerationCache();
+    const fresh = enumerateValidAccountIds(root);
+    assert.equal(fresh.length, 2);
+    assert.ok(fresh.includes(newId));
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("getAccountsDirFromEnv throws when MAXY_PLATFORM_ROOT is unset", () => {
+  const saved = process.env.MAXY_PLATFORM_ROOT;
+  delete process.env.MAXY_PLATFORM_ROOT;
+  try {
+    assert.throws(
+      () => getAccountsDirFromEnv(),
+      /MAXY_PLATFORM_ROOT not set/,
+    );
+  } finally {
+    if (saved !== undefined) process.env.MAXY_PLATFORM_ROOT = saved;
+  }
+});
+
+test("getAccountsDirFromEnv resolves to ${root}/../data/accounts when set", () => {
+  const saved = process.env.MAXY_PLATFORM_ROOT;
+  process.env.MAXY_PLATFORM_ROOT = "/tmp/fake-root/platform";
+  try {
+    const result = getAccountsDirFromEnv();
+    assert.equal(result, resolve("/tmp/fake-root/platform", "..", "data/accounts"));
+  } finally {
+    if (saved !== undefined) process.env.MAXY_PLATFORM_ROOT = saved;
+    else delete process.env.MAXY_PLATFORM_ROOT;
+  }
+});

package/payload/platform/lib/account-enumeration/src/index.ts

@@ -0,0 +1,96 @@
+/**
+ * account-enumeration — single source of truth for "which accountIds are
+ * provisioned on disk for this install?".
+ *
+ * Doctrine — `.docs/neo4j.md` "Account isolation invariant": every writer
+ * that stamps `n.accountId` must verify the value against
+ * `${DATA_ROOT}/accounts/<id>/account.json` before write. Read-side scoping
+ * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
+ * an unenforced writer can leak indefinitely with zero downstream symptom.
+ *
+ * Two consumers:
+ *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
+ *      floor; rejects any write whose `props.accountId` is not in the set
+ *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
+ *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *
+ * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
+ * created at install time, so adding/removing accounts requires a service
+ * restart anyway.
+ */
+import { readdirSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const UUID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const cache = new Map<string, string[]>();
+
+/**
+ * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
+ * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
+ * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
+ * dir (over-prune one suspect account beats under-prune the leak it might
+ * be hiding).
+ */
+export function enumerateValidAccountIds(accountsDir: string): string[] {
+  const cached = cache.get(accountsDir);
+  if (cached !== undefined) return cached;
+
+  let names: string[];
+  try {
+    names = readdirSync(accountsDir);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") {
+      cache.set(accountsDir, []);
+      return [];
+    }
+    throw err;
+  }
+
+  const valid: string[] = [];
+  for (const name of names) {
+    if (!UUID_RE.test(name)) continue;
+    const configPath = resolve(accountsDir, name, "account.json");
+    try {
+      JSON.parse(readFileSync(configPath, "utf-8"));
+      valid.push(name);
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code === "ENOENT") continue;
+      // SyntaxError (parse failure) and other read errors fall through:
+      // exclude this dir, try the next.
+    }
+  }
+
+  cache.set(accountsDir, valid);
+  return valid;
+}
+
+/**
+ * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
+ * pattern at platform/ui/app/lib/claude-agent/account.ts:9
+ * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
+ *
+ * Loud-throws when the env var is unset — graph-write's gate must not fall
+ * open silently.
+ */
+export function getAccountsDirFromEnv(): string {
+  const root = process.env.MAXY_PLATFORM_ROOT;
+  if (!root) {
+    throw new Error(
+      "[graph-write] MAXY_PLATFORM_ROOT not set — cannot enforce accountId gate. " +
+        "Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly.",
+    );
+  }
+  return resolve(root, "..", "data/accounts");
+}
+
+/**
+ * Test-only cache reset. Production callers must not invoke this — the cache
+ * is a deliberate boot-time invariant (see module doc).
+ */
+export function _resetEnumerationCache(): void {
+  cache.clear();
+}

package/payload/platform/lib/account-enumeration/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/lib/graph-write/dist/__tests__/account-id-gate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=account-id-gate.test.d.ts.map

package/payload/platform/lib/graph-write/dist/__tests__/account-id-gate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-id-gate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/account-id-gate.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/graph-write/dist/__tests__/account-id-gate.test.js

@@ -0,0 +1,165 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const index_js_1 = require("../index.js");
+function makeStubSession(targetId) {
+    const tx = {
+        async run(cypher, params = {}) {
+            if (cypher.includes("RETURN elementId(t) AS id, labels(t) AS labels")) {
+                const ids = params.ids ?? [];
+                const records = ids
+                    .filter((id) => id === targetId)
+                    .map((id) => ({
+                    get(field) {
+                        if (field === "id")
+                            return id;
+                        if (field === "labels")
+                            return ["Account"];
+                        throw new Error(`unknown field ${field}`);
+                    },
+                }));
+                return { records };
+            }
+            if (cypher.includes("CREATE (n:")) {
+                return {
+                    records: [
+                        {
+                            get(field) {
+                                if (field === "nodeId")
+                                    return "new-element-id";
+                                if (field === "nodeLabels")
+                                    return ["Conversation"];
+                                throw new Error(`unknown field ${field}`);
+                            },
+                        },
+                    ],
+                };
+            }
+            if (cypher.includes("CREATE (a)-[") || cypher.includes("CREATE (b)-[")) {
+                return {
+                    records: [],
+                    summary: {
+                        counters: {
+                            updates: () => ({ relationshipsCreated: 1 }),
+                        },
+                    },
+                };
+            }
+            return { records: [] };
+        },
+    };
+    return {
+        async executeWrite(work) {
+            return await work(tx);
+        },
+    };
+}
+const VALID_UUID = "12345678-9abc-def0-1234-56789abcdef0";
+const TARGET_ID = "target-element-id";
+const REL = [
+    { type: "PART_OF", direction: "outgoing", targetNodeId: TARGET_ID },
+];
+function captureStderr() {
+    const original = process.stderr.write.bind(process.stderr);
+    let buf = "";
+    process.stderr.write =
+        (chunk) => {
+            buf += typeof chunk === "string" ? chunk : Buffer.from(chunk).toString();
+            return true;
+        };
+    return {
+        restore: () => {
+            process.stderr.write = original;
+        },
+        output: () => buf,
+    };
+}
+(0, node_test_1.default)("rejects null accountId from non-system writer", async () => {
+    const cap = captureStderr();
+    try {
+        await strict_1.default.rejects(() => (0, index_js_1.writeNodeWithEdges)({
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            session: makeStubSession(TARGET_ID),
+            labels: ["Conversation"],
+            props: { accountId: null },
+            relationships: REL,
+            createdBy: { agent: "test-agent", session: "s" },
+            expectedAccountId: VALID_UUID,
+        }), /invalid-account-id/);
+        cap.restore();
+        strict_1.default.match(cap.output(), /\[graph-write\] reject reason=invalid-account-id accountId=missing writer=test-agent\b/);
+    }
+    finally {
+        cap.restore();
+    }
+});
+(0, node_test_1.default)("rejects non-UUID accountId from non-system writer", async () => {
+    const cap = captureStderr();
+    try {
+        await strict_1.default.rejects(() => (0, index_js_1.writeNodeWithEdges)({
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            session: makeStubSession(TARGET_ID),
+            labels: ["Conversation"],
+            props: { accountId: "evil-leak" },
+            relationships: REL,
+            createdBy: { agent: "test-agent", session: "s" },
+            expectedAccountId: VALID_UUID,
+        }), /invalid-account-id/);
+        cap.restore();
+        strict_1.default.match(cap.output(), /\[graph-write\] reject reason=invalid-account-id accountId=evil-lea writer=test-agent\b/);
+    }
+    finally {
+        cap.restore();
+    }
+});
+(0, node_test_1.default)("rejects UUID-shape accountId that does not match the expected one", async () => {
+    const stranger = "ffffffff-1111-2222-3333-444444444444";
+    const cap = captureStderr();
+    try {
+        await strict_1.default.rejects(() => (0, index_js_1.writeNodeWithEdges)({
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            session: makeStubSession(TARGET_ID),
+            labels: ["Conversation"],
+            props: { accountId: stranger },
+            relationships: REL,
+            createdBy: { agent: "test-agent", session: "s" },
+            expectedAccountId: VALID_UUID,
+        }), /invalid-account-id/);
+        cap.restore();
+        strict_1.default.match(cap.output(), /\[graph-write\] reject reason=invalid-account-id accountId=ffffffff writer=test-agent\b/);
+    }
+    finally {
+        cap.restore();
+    }
+});
+(0, node_test_1.default)("accepts matching accountId from non-system writer", async () => {
+    const result = await (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: makeStubSession(TARGET_ID),
+        labels: ["Conversation"],
+        props: { accountId: VALID_UUID },
+        relationships: REL,
+        createdBy: { agent: "test-agent", session: "s" },
+        expectedAccountId: VALID_UUID,
+    });
+    strict_1.default.equal(result.nodeId, "new-element-id");
+    strict_1.default.equal(result.edgesCreated, 1);
+});
+(0, node_test_1.default)("system bootstrap exemption: bad accountId still proceeds", async () => {
+    const result = await (0, index_js_1.writeNodeWithEdges)({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        session: makeStubSession(TARGET_ID),
+        labels: ["Conversation"],
+        // accountId is intentionally wrong; system bootstrap exempts it.
+        props: { accountId: "not-a-uuid" },
+        relationships: REL,
+        createdBy: { agent: "system", source: "writeAdminUserAndPerson" },
+        expectedAccountId: VALID_UUID,
+    });
+    strict_1.default.equal(result.nodeId, "new-element-id");
+});
+//# sourceMappingURL=account-id-gate.test.js.map

package/payload/platform/lib/graph-write/dist/__tests__/account-id-gate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-id-gate.test.js","sourceRoot":"","sources":["../../src/__tests__/account-id-gate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,0CAAyE;AASzE,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,EAAE,GAAW;QACjB,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,SAAkC,EAAE;YAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,gDAAgD,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAI,MAAM,CAAC,GAAgB,IAAI,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,GAAG;qBAChB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC;qBAC/B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC,KAAa;wBACf,IAAI,KAAK,KAAK,IAAI;4BAAE,OAAO,EAAE,CAAC;wBAC9B,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,CAAC,SAAS,CAAC,CAAC;wBAC3C,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;oBAC5C,CAAC;iBACF,CAAC,CAAC,CAAC;gBACN,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,GAAG,CAAC,KAAa;gCACf,IAAI,KAAK,KAAK,QAAQ;oCAAE,OAAO,gBAAgB,CAAC;gCAChD,IAAI,KAAK,KAAK,YAAY;oCAAE,OAAO,CAAC,cAAc,CAAC,CAAC;gCACpD,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;4BAC5C,CAAC;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,OAAO;oBACL,OAAO,EAAE,EAAE;oBACX,OAAO,EAAE;wBACP,QAAQ,EAAE;4BACR,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC;yBAC7C;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;IACF,OAAO;QACL,KAAK,CAAC,YAAY,CAAI,IAAgC;YACpD,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC,MAAM,GAAG,GAAwB;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE;CACpE,CAAC;AAEF,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,MAA6D,CAAC,KAAK;QAC1E,CAAC,KAA0B,EAAW,EAAE;YACtC,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;QAClC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG;KAClB,CAAC;AACJ,CAAC;AAED,IAAA,mBAAI,EAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,6BAAkB,EAAC;YACjB,8DAA8D;YAC9D,OAAO,EAAE,eAAe,CAAC,SAAS,CAAQ;YAC1C,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1B,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;YAChD,iBAAiB,EAAE,UAAU;SAC9B,CAAC,EACJ,oBAAoB,CACrB,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,gBAAM,CAAC,KAAK,CACV,GAAG,CAAC,MAAM,EAAE,EACZ,wFAAwF,CACzF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,6BAAkB,EAAC;YACjB,8DAA8D;YAC9D,OAAO,EAAE,eAAe,CAAC,SAAS,CAAQ;YAC1C,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE;YACjC,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;YAChD,iBAAiB,EAAE,UAAU;SAC9B,CAAC,EACJ,oBAAoB,CACrB,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,gBAAM,CAAC,KAAK,CACV,GAAG,CAAC,MAAM,EAAE,EACZ,yFAAyF,CAC1F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;IACnF,MAAM,QAAQ,GAAG,sCAAsC,CAAC;IACxD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,gBAAM,CAAC,OAAO,CAClB,GAAG,EAAE,CACH,IAAA,6BAAkB,EAAC;YACjB,8DAA8D;YAC9D,OAAO,EAAE,eAAe,CAAC,SAAS,CAAQ;YAC1C,MAAM,EAAE,CAAC,cAAc,CAAC;YACxB,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC9B,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;YAChD,iBAAiB,EAAE,UAAU;SAC9B,CAAC,EACJ,oBAAoB,CACrB,CAAC;QACF,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,gBAAM,CAAC,KAAK,CACV,GAAG,CAAC,MAAM,EAAE,EACZ,yFAAyF,CAC1F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;QACtC,8DAA8D;QAC9D,OAAO,EAAE,eAAe,CAAC,SAAS,CAAQ;QAC1C,MAAM,EAAE,CAAC,cAAc,CAAC;QACxB,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QAChC,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE;QAChD,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,MAAM,GAAG,MAAM,IAAA,6BAAkB,EAAC;QACtC,8DAA8D;QAC9D,OAAO,EAAE,eAAe,CAAC,SAAS,CAAQ;QAC1C,MAAM,EAAE,CAAC,cAAc,CAAC;QACxB,iEAAiE;QACjE,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE;QAClC,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE;QACjE,iBAAiB,EAAE,UAAU;KAC9B,CAAC,CAAC;IACH,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC"}