@rudderhq/server 0.1.0-canary.0

package/dist/services/orgs.js

@@ -0,0 +1,327 @@
+import { and, count, eq, gte, inArray, lt, sql } from "drizzle-orm";
+import { organizations, organizationLogos, assets, labels, agents, agentConfigRevisions, agentApiKeys, agentRuntimeState, agentTaskSessions, agentWakeupRequests, issues, issueApprovals, issueAttachments, issueComments, issueDocuments, issueReadStates, issueWorkProducts, projects, projectGoals, projectWorkspaces, goals, heartbeatRuns, heartbeatRunEvents, costEvents, financeEvents, approvalComments, approvals, activityLog, chatAttachments, chatContextLinks, chatConversations, chatMessages, organizationSecrets, joinRequests, invites, budgetIncidents, budgetPolicies, documents, documentRevisions, executionWorkspaces, principalPermissionGrants, organizationMemberships, organizationSkills, workspaceOperations, workspaceRuntimeServices, } from "@rudderhq/db";
+import { deriveOrganizationUrlKey } from "@rudderhq/shared";
+import { notFound, unprocessable } from "../errors.js";
+import { ensureOrganizationWorkspaceLayout, removeOrganizationStorage } from "../home-paths.js";
+import { logger } from "../middleware/logger.js";
+export function organizationService(db) {
+    const ISSUE_PREFIX_FALLBACK = "CMP";
+    const DEFAULT_ISSUE_LABELS = [
+        { name: "Bug", color: "#ef4444" },
+        { name: "Feature", color: "#a855f7" },
+        { name: "UI", color: "#06b6d4" },
+    ];
+    const companySelection = {
+        id: organizations.id,
+        urlKey: organizations.urlKey,
+        name: organizations.name,
+        description: organizations.description,
+        status: organizations.status,
+        pauseReason: organizations.pauseReason,
+        pausedAt: organizations.pausedAt,
+        issuePrefix: organizations.issuePrefix,
+        issueCounter: organizations.issueCounter,
+        budgetMonthlyCents: organizations.budgetMonthlyCents,
+        spentMonthlyCents: organizations.spentMonthlyCents,
+        requireBoardApprovalForNewAgents: organizations.requireBoardApprovalForNewAgents,
+        defaultChatIssueCreationMode: organizations.defaultChatIssueCreationMode,
+        defaultChatAgentRuntimeType: organizations.defaultChatAgentRuntimeType,
+        defaultChatAgentRuntimeConfig: organizations.defaultChatAgentRuntimeConfig,
+        brandColor: organizations.brandColor,
+        logoAssetId: organizationLogos.assetId,
+        createdAt: organizations.createdAt,
+        updatedAt: organizations.updatedAt,
+    };
+    function enrichCompany(organization) {
+        return {
+            ...organization,
+            workspace: null,
+            logoUrl: organization.logoAssetId ? `/api/assets/${organization.logoAssetId}/content` : null,
+        };
+    }
+    function currentUtcMonthWindow(now = new Date()) {
+        const year = now.getUTCFullYear();
+        const month = now.getUTCMonth();
+        return {
+            start: new Date(Date.UTC(year, month, 1, 0, 0, 0, 0)),
+            end: new Date(Date.UTC(year, month + 1, 1, 0, 0, 0, 0)),
+        };
+    }
+    async function getMonthlySpendByCompanyIds(orgIds, database = db) {
+        if (orgIds.length === 0)
+            return new Map();
+        const { start, end } = currentUtcMonthWindow();
+        const rows = await database
+            .select({
+            orgId: costEvents.orgId,
+            spentMonthlyCents: sql `coalesce(sum(${costEvents.costCents}), 0)::int`,
+        })
+            .from(costEvents)
+            .where(and(inArray(costEvents.orgId, orgIds), gte(costEvents.occurredAt, start), lt(costEvents.occurredAt, end)))
+            .groupBy(costEvents.orgId);
+        return new Map(rows.map((row) => [row.orgId, Number(row.spentMonthlyCents ?? 0)]));
+    }
+    async function hydrateCompanySpend(rows, database = db) {
+        const spendByCompanyId = await getMonthlySpendByCompanyIds(rows.map((row) => row.id), database);
+        return rows.map((row) => ({
+            ...row,
+            spentMonthlyCents: spendByCompanyId.get(row.id) ?? 0,
+        }));
+    }
+    function getCompanyQuery(database) {
+        return database
+            .select(companySelection)
+            .from(organizations)
+            .leftJoin(organizationLogos, eq(organizationLogos.orgId, organizations.id));
+    }
+    function deriveIssuePrefixBase(name) {
+        const normalized = name.toUpperCase().replace(/[^A-Z]/g, "");
+        return normalized.slice(0, 3) || ISSUE_PREFIX_FALLBACK;
+    }
+    function suffixForAttempt(attempt) {
+        if (attempt <= 1)
+            return "";
+        return "A".repeat(attempt - 1);
+    }
+    function suffixForUrlKeyAttempt(attempt) {
+        if (attempt <= 1)
+            return "";
+        return `-${attempt}`;
+    }
+    function isUniqueConstraintConflict(error, constraintName) {
+        const constraint = typeof error === "object" && error !== null && "constraint" in error
+            ? error.constraint
+            : typeof error === "object" && error !== null && "constraint_name" in error
+                ? error.constraint_name
+                : undefined;
+        return typeof error === "object"
+            && error !== null
+            && "code" in error
+            && error.code === "23505"
+            && constraint === constraintName;
+    }
+    async function createCompanyWithUniqueKeys(database, data) {
+        const base = deriveIssuePrefixBase(data.name);
+        const urlKeyBase = deriveOrganizationUrlKey(data.name);
+        let suffix = 1;
+        while (suffix < 10000) {
+            const candidate = `${base}${suffixForAttempt(suffix)}`;
+            const candidateUrlKey = `${urlKeyBase}${suffixForUrlKeyAttempt(suffix)}`;
+            try {
+                const created = await database.transaction(async (tx) => {
+                    const rows = await tx
+                        .insert(organizations)
+                        .values({ ...data, issuePrefix: candidate, urlKey: candidateUrlKey })
+                        .returning();
+                    return rows[0];
+                });
+                return created;
+            }
+            catch (error) {
+                if (!isUniqueConstraintConflict(error, "organizations_issue_prefix_idx")
+                    && !isUniqueConstraintConflict(error, "organizations_url_key_idx")) {
+                    throw error;
+                }
+            }
+            suffix += 1;
+        }
+        throw new Error("Unable to allocate unique organization url key");
+    }
+    return {
+        list: async () => {
+            const rows = await getCompanyQuery(db);
+            const hydrated = await hydrateCompanySpend(rows);
+            return hydrated.map((row) => enrichCompany(row));
+        },
+        getById: async (id) => {
+            const row = await getCompanyQuery(db)
+                .where(eq(organizations.id, id))
+                .then((rows) => rows[0] ?? null);
+            if (!row)
+                return null;
+            const [hydrated] = await hydrateCompanySpend([row], db);
+            return enrichCompany(hydrated);
+        },
+        create: (data) => db.transaction(async (tx) => {
+            const { workspace, ...organizationData } = data;
+            void workspace;
+            const created = await createCompanyWithUniqueKeys(tx, {
+                ...organizationData,
+            });
+            await tx.insert(labels).values(DEFAULT_ISSUE_LABELS.map((label) => ({
+                orgId: created.id,
+                name: label.name,
+                color: label.color,
+            })));
+            await ensureOrganizationWorkspaceLayout(created.id);
+            const row = await getCompanyQuery(tx)
+                .where(eq(organizations.id, created.id))
+                .then((rows) => rows[0] ?? null);
+            if (!row)
+                throw notFound("Organization not found after creation");
+            const [hydrated] = await hydrateCompanySpend([row], tx);
+            return enrichCompany(hydrated);
+        }),
+        update: (id, data) => db.transaction(async (tx) => {
+            const existing = await getCompanyQuery(tx)
+                .where(eq(organizations.id, id))
+                .then((rows) => rows[0] ?? null);
+            if (!existing)
+                return null;
+            const { logoAssetId, urlKey: _ignoredUrlKey, workspace, ...companyPatch } = data;
+            void workspace;
+            if (logoAssetId !== undefined && logoAssetId !== null) {
+                const nextLogoAsset = await tx
+                    .select({ id: assets.id, orgId: assets.orgId })
+                    .from(assets)
+                    .where(eq(assets.id, logoAssetId))
+                    .then((rows) => rows[0] ?? null);
+                if (!nextLogoAsset)
+                    throw notFound("Logo asset not found");
+                if (nextLogoAsset.orgId !== existing.id) {
+                    throw unprocessable("Logo asset must belong to the same organization");
+                }
+            }
+            const updated = await tx
+                .update(organizations)
+                .set({
+                ...companyPatch,
+                updatedAt: new Date(),
+            })
+                .where(eq(organizations.id, id))
+                .returning()
+                .then((rows) => rows[0] ?? null);
+            if (!updated)
+                return null;
+            if (logoAssetId === null) {
+                await tx.delete(organizationLogos).where(eq(organizationLogos.orgId, id));
+            }
+            else if (logoAssetId !== undefined) {
+                await tx
+                    .insert(organizationLogos)
+                    .values({
+                    orgId: id,
+                    assetId: logoAssetId,
+                })
+                    .onConflictDoUpdate({
+                    target: organizationLogos.orgId,
+                    set: {
+                        assetId: logoAssetId,
+                        updatedAt: new Date(),
+                    },
+                });
+            }
+            if (logoAssetId !== undefined && existing.logoAssetId && existing.logoAssetId !== logoAssetId) {
+                await tx.delete(assets).where(eq(assets.id, existing.logoAssetId));
+            }
+            const [hydrated] = await hydrateCompanySpend([{
+                    ...updated,
+                    logoAssetId: logoAssetId === undefined ? existing.logoAssetId : logoAssetId,
+                }], tx);
+            return enrichCompany(hydrated);
+        }),
+        archive: (id) => db.transaction(async (tx) => {
+            const updated = await tx
+                .update(organizations)
+                .set({ status: "archived", updatedAt: new Date() })
+                .where(eq(organizations.id, id))
+                .returning()
+                .then((rows) => rows[0] ?? null);
+            if (!updated)
+                return null;
+            const row = await getCompanyQuery(tx)
+                .where(eq(organizations.id, id))
+                .then((rows) => rows[0] ?? null);
+            if (!row)
+                return null;
+            const [hydrated] = await hydrateCompanySpend([row], tx);
+            return enrichCompany(hydrated);
+        }),
+        remove: (id) => db.transaction(async (tx) => {
+            // Delete from child tables in dependency order
+            await tx.delete(heartbeatRunEvents).where(eq(heartbeatRunEvents.orgId, id));
+            await tx.delete(workspaceOperations).where(eq(workspaceOperations.orgId, id));
+            await tx.delete(workspaceRuntimeServices).where(eq(workspaceRuntimeServices.orgId, id));
+            await tx.delete(executionWorkspaces).where(eq(executionWorkspaces.orgId, id));
+            await tx.delete(projectWorkspaces).where(eq(projectWorkspaces.orgId, id));
+            await tx.delete(agentTaskSessions).where(eq(agentTaskSessions.orgId, id));
+            await tx.delete(heartbeatRuns).where(eq(heartbeatRuns.orgId, id));
+            await tx.delete(agentWakeupRequests).where(eq(agentWakeupRequests.orgId, id));
+            await tx.delete(agentConfigRevisions).where(eq(agentConfigRevisions.orgId, id));
+            await tx.delete(agentApiKeys).where(eq(agentApiKeys.orgId, id));
+            await tx.delete(agentRuntimeState).where(eq(agentRuntimeState.orgId, id));
+            await tx.delete(issueApprovals).where(eq(issueApprovals.orgId, id));
+            await tx.delete(issueAttachments).where(eq(issueAttachments.orgId, id));
+            await tx.delete(issueDocuments).where(eq(issueDocuments.orgId, id));
+            await tx.delete(issueComments).where(eq(issueComments.orgId, id));
+            await tx.delete(issueReadStates).where(eq(issueReadStates.orgId, id));
+            await tx.delete(issueWorkProducts).where(eq(issueWorkProducts.orgId, id));
+            await tx.delete(costEvents).where(eq(costEvents.orgId, id));
+            await tx.delete(financeEvents).where(eq(financeEvents.orgId, id));
+            await tx.delete(documentRevisions).where(eq(documentRevisions.orgId, id));
+            await tx.delete(documents).where(eq(documents.orgId, id));
+            await tx.delete(approvalComments).where(eq(approvalComments.orgId, id));
+            await tx.delete(approvals).where(eq(approvals.orgId, id));
+            await tx.delete(chatAttachments).where(eq(chatAttachments.orgId, id));
+            await tx.delete(chatMessages).where(eq(chatMessages.orgId, id));
+            await tx.delete(chatContextLinks).where(eq(chatContextLinks.orgId, id));
+            await tx.delete(chatConversations).where(eq(chatConversations.orgId, id));
+            await tx.delete(organizationSecrets).where(eq(organizationSecrets.orgId, id));
+            await tx.delete(organizationSkills).where(eq(organizationSkills.orgId, id));
+            await tx.delete(joinRequests).where(eq(joinRequests.orgId, id));
+            await tx.delete(invites).where(eq(invites.orgId, id));
+            await tx.delete(budgetIncidents).where(eq(budgetIncidents.orgId, id));
+            await tx.delete(budgetPolicies).where(eq(budgetPolicies.orgId, id));
+            await tx.delete(principalPermissionGrants).where(eq(principalPermissionGrants.orgId, id));
+            await tx.delete(organizationMemberships).where(eq(organizationMemberships.orgId, id));
+            await tx.delete(issues).where(eq(issues.orgId, id));
+            await tx.delete(organizationLogos).where(eq(organizationLogos.orgId, id));
+            await tx.delete(assets).where(eq(assets.orgId, id));
+            await tx.delete(projectGoals).where(eq(projectGoals.orgId, id));
+            await tx.delete(goals).where(eq(goals.orgId, id));
+            await tx.delete(projects).where(eq(projects.orgId, id));
+            await tx.delete(agents).where(eq(agents.orgId, id));
+            await tx.delete(activityLog).where(eq(activityLog.orgId, id));
+            const rows = await tx
+                .delete(organizations)
+                .where(eq(organizations.id, id))
+                .returning();
+            return rows[0] ?? null;
+        }).then(async (removed) => {
+            if (!removed)
+                return null;
+            try {
+                await removeOrganizationStorage(id);
+            }
+            catch (err) {
+                logger.warn({ err, orgId: id }, "removed organization record but failed to prune local organization storage");
+            }
+            return removed;
+        }),
+        stats: () => Promise.all([
+            db
+                .select({ orgId: agents.orgId, count: count() })
+                .from(agents)
+                .groupBy(agents.orgId),
+            db
+                .select({ orgId: issues.orgId, count: count() })
+                .from(issues)
+                .groupBy(issues.orgId),
+        ]).then(([agentRows, issueRows]) => {
+            const result = {};
+            for (const row of agentRows) {
+                result[row.orgId] = { agentCount: row.count, issueCount: 0 };
+            }
+            for (const row of issueRows) {
+                if (result[row.orgId]) {
+                    result[row.orgId].issueCount = row.count;
+                }
+                else {
+                    result[row.orgId] = { agentCount: 0, issueCount: row.count };
+                }
+            }
+            return result;
+        }),
+    };
+}
+//# sourceMappingURL=orgs.js.map

package/dist/services/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/services/orgs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEpE,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,MAAM,EACN,MAAM,EACN,MAAM,EACN,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,MAAM,EACN,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,OAAO,EACP,eAAe,EACf,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iCAAiC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,UAAU,mBAAmB,CAAC,EAAM;IACxC,MAAM,qBAAqB,GAAG,KAAK,CAAC;IACpC,MAAM,oBAAoB,GAAG;QAC3B,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;QACjC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE;KACxB,CAAC;IAEX,MAAM,gBAAgB,GAAG;QACvB,EAAE,EAAE,aAAa,CAAC,EAAE;QACpB,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,IAAI,EAAE,aAAa,CAAC,IAAI;QACxB,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;QACpD,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;QAClD,gCAAgC,EAAE,aAAa,CAAC,gCAAgC;QAChF,4BAA4B,EAAE,aAAa,CAAC,4BAA4B;QACxE,2BAA2B,EAAE,aAAa,CAAC,2BAA2B;QACtE,6BAA6B,EAAE,aAAa,CAAC,6BAA6B;QAC1E,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,WAAW,EAAE,iBAAiB,CAAC,OAAO;QACtC,SAAS,EAAE,aAAa,CAAC,SAAS;QAClC,SAAS,EAAE,aAAa,CAAC,SAAS;KACnC,CAAC;IAEF,SAAS,aAAa,CAA2C,YAAe;QAC9E,OAAO;YACL,GAAG,YAAY;YACf,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,YAAY,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,IAAI;SAC7F,CAAC;IACJ,CAAC;IAED,SAAS,qBAAqB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,2BAA2B,CACxC,MAAgB,EAChB,WAA+B,EAAE;QAEjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAkB,CAAC;QAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ;aACxB,MAAM,CAAC;YACN,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,iBAAiB,EAAE,GAAG,CAAQ,gBAAgB,UAAU,CAAC,SAAS,YAAY;SAC/E,CAAC;aACD,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CACJ,GAAG,CACD,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EACjC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,EACjC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAC/B,CACF;aACA,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,UAAU,mBAAmB,CAChC,IAAS,EACT,WAA+B,EAAE;QAEjC,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,GAAG;YACN,iBAAiB,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC;SACrD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,SAAS,eAAe,CAAC,QAA4B;QACnD,OAAO,QAAQ;aACZ,MAAM,CAAC,gBAAgB,CAAC;aACxB,IAAI,CAAC,aAAa,CAAC;aACnB,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,SAAS,qBAAqB,CAAC,IAAY;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,qBAAqB,CAAC;IACzD,CAAC;IAED,SAAS,gBAAgB,CAAC,OAAe;QACvC,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,SAAS,sBAAsB,CAAC,OAAe;QAC7C,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,cAAsB;QACxE,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,IAAI,KAAK;YACrF,CAAC,CAAE,KAAiC,CAAC,UAAU;YAC/C,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,IAAI,KAAK;gBACzE,CAAC,CAAE,KAAsC,CAAC,eAAe;gBACzD,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,OAAO,KAAK,KAAK,QAAQ;eAC3B,KAAK,KAAK,IAAI;eACd,MAAM,IAAI,KAAK;eACd,KAA2B,CAAC,IAAI,KAAK,OAAO;eAC7C,UAAU,KAAK,cAAc,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,2BAA2B,CACxC,QAAiC,EACjC,IAAuC;QAEvC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,GAAG,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,eAAe,GAAG,GAAG,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACtD,MAAM,IAAI,GAAG,MAAM,EAAE;yBAClB,MAAM,CAAC,aAAa,CAAC;yBACrB,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;yBACpE,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;gBACH,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,CAAC,0BAA0B,CAAC,KAAK,EAAE,gCAAgC,CAAC;uBACjE,CAAC,0BAA0B,CAAC,KAAK,EAAE,2BAA2B,CAAC,EAClE,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QAED,MAAM,EAAE,CAAC,IAAuC,EAAE,EAAE,CAClD,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,GAAG,IAE1C,CAAC;YACF,KAAK,SAAS,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC,EAAE,EAAE;gBACpD,GAAG,gBAAgB;aACpB,CAAC,CAAC;YAEH,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAC5B,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACnC,KAAK,EAAE,OAAO,CAAC,EAAE;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC,CACJ,CAAC;YAEF,MAAM,iCAAiC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAEpD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;iBACvC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,MAAM,QAAQ,CAAC,uCAAuC,CAAC,CAAC;YAClE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC;QAEJ,MAAM,EAAE,CACN,EAAU,EACV,IAAkF,EAClF,EAAE,CACF,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC;iBACvC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE3B,MAAM,EACJ,WAAW,EACX,MAAM,EAAE,cAAc,EACtB,SAAS,EACT,GAAG,YAAY,EAChB,GAAG,IAGH,CAAC;YACF,KAAK,SAAS,CAAC;YAEf,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,MAAM,EAAE;qBAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBAC9C,IAAI,CAAC,MAAM,CAAC;qBACZ,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;qBACjC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,aAAa;oBAAE,MAAM,QAAQ,CAAC,sBAAsB,CAAC,CAAC;gBAC3D,IAAI,aAAa,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACxC,MAAM,aAAa,CAAC,iDAAiD,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,aAAa,CAAC;iBACrB,GAAG,CAAC;gBACH,GAAG,YAAY;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC;iBAAM,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,EAAE;qBACL,MAAM,CAAC,iBAAiB,CAAC;qBACzB,MAAM,CAAC;oBACN,KAAK,EAAE,EAAE;oBACT,OAAO,EAAE,WAAW;iBACrB,CAAC;qBACD,kBAAkB,CAAC;oBAClB,MAAM,EAAE,iBAAiB,CAAC,KAAK;oBAC/B,GAAG,EAAE;wBACH,OAAO,EAAE,WAAW;wBACpB,SAAS,EAAE,IAAI,IAAI,EAAE;qBACtB;iBACF,CAAC,CAAC;YACP,CAAC;YAED,IAAI,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAC9F,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC;oBAC5C,GAAG,OAAO;oBACV,WAAW,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;iBAC5E,CAAC,EAAE,EAAE,CAAC,CAAC;YAER,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC,EAAU,EAAE,EAAE,CACtB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,aAAa,CAAC;iBACrB,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBAClD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,SAAS,EAAE;iBACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,EAAE,CAAC;iBAClC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,CAAC;QAEJ,MAAM,EAAE,CAAC,EAAU,EAAE,EAAE,CACrB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1B,+CAA+C;YAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5E,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACxF,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAChF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5D,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5E,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,yBAAyB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1F,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACtF,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAChE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,aAAa,CAAC;iBACrB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBAC/B,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACzB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,4EAA4E,CAAC,CAAC;YAChH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QAEJ,KAAK,EAAE,GAAG,EAAE,CACV,OAAO,CAAC,GAAG,CAAC;YACV,EAAE;iBACC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC/C,IAAI,CAAC,MAAM,CAAC;iBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YACxB,EAAE;iBACC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC/C,IAAI,CAAC,MAAM,CAAC;iBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE;YACjC,MAAM,MAAM,GAA+D,EAAE,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC/D,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/services/plugin-capability-validator.d.ts

@@ -0,0 +1,108 @@
+/**
+ * PluginCapabilityValidator — enforces the capability model at both
+ * install-time and runtime.
+ *
+ * Every plugin declares the capabilities it requires in its manifest
+ * (`manifest.capabilities`). This service checks those declarations
+ * against a mapping of operations → required capabilities so that:
+ *
+ * 1. **Install-time validation** — `validateManifestCapabilities()`
+ *    ensures that declared features (tools, jobs, webhooks, UI slots)
+ *    have matching capability entries, giving operators clear feedback
+ *    before a plugin is activated.
+ *
+ * 2. **Runtime gating** — `checkOperation()` / `assertOperation()` are
+ *    called on every worker→host bridge call to enforce least-privilege
+ *    access. If a plugin attempts an operation it did not declare, the
+ *    call is rejected with a 403 error.
+ *
+ * @see PLUGIN_SPEC.md §15 — Capability Model
+ * @see host-client-factory.ts — SDK-side capability gating
+ */
+import type { PluginCapability, PaperclipPluginManifestV1, PluginUiSlotType } from "@rudderhq/shared";
+/**
+ * Result of a capability check. When `allowed` is false, `missing` contains
+ * the capabilities that the plugin does not declare but the operation requires.
+ */
+export interface CapabilityCheckResult {
+    allowed: boolean;
+    missing: PluginCapability[];
+    operation?: string;
+    pluginId?: string;
+}
+export interface PluginCapabilityValidator {
+    /**
+     * Check whether a plugin has a specific capability.
+     */
+    hasCapability(manifest: PaperclipPluginManifestV1, capability: PluginCapability): boolean;
+    /**
+     * Check whether a plugin has all of the specified capabilities.
+     */
+    hasAllCapabilities(manifest: PaperclipPluginManifestV1, capabilities: PluginCapability[]): CapabilityCheckResult;
+    /**
+     * Check whether a plugin has at least one of the specified capabilities.
+     */
+    hasAnyCapability(manifest: PaperclipPluginManifestV1, capabilities: PluginCapability[]): boolean;
+    /**
+     * Check whether a plugin is allowed to perform the named operation.
+     *
+     * Operations are mapped to required capabilities via OPERATION_CAPABILITIES.
+     * Unknown operations are rejected by default.
+     */
+    checkOperation(manifest: PaperclipPluginManifestV1, operation: string): CapabilityCheckResult;
+    /**
+     * Assert that a plugin is allowed to perform an operation.
+     * Throws a 403 HttpError if the capability check fails.
+     */
+    assertOperation(manifest: PaperclipPluginManifestV1, operation: string): void;
+    /**
+     * Assert that a plugin has a specific capability.
+     * Throws a 403 HttpError if the capability is missing.
+     */
+    assertCapability(manifest: PaperclipPluginManifestV1, capability: PluginCapability): void;
+    /**
+     * Check whether a plugin can register the given UI slot type.
+     */
+    checkUiSlot(manifest: PaperclipPluginManifestV1, slotType: PluginUiSlotType): CapabilityCheckResult;
+    /**
+     * Validate that a manifest's declared capabilities are consistent with its
+     * declared features (tools, jobs, webhooks, UI slots).
+     *
+     * Returns all missing capabilities rather than failing on the first one.
+     * This is useful for install-time validation to give comprehensive feedback.
+     */
+    validateManifestCapabilities(manifest: PaperclipPluginManifestV1): CapabilityCheckResult;
+    /**
+     * Get the capabilities required for a named operation.
+     * Returns an empty array if the operation is unknown.
+     */
+    getRequiredCapabilities(operation: string): readonly PluginCapability[];
+    /**
+     * Get the capability required for a UI slot type.
+     */
+    getUiSlotCapability(slotType: PluginUiSlotType): PluginCapability;
+}
+/**
+ * Create a PluginCapabilityValidator.
+ *
+ * This service enforces capability gates for plugin operations.  The host
+ * uses it to verify that a plugin's declared capabilities permit the
+ * operation it is attempting, both at install time (manifest validation)
+ * and at runtime (bridge call gating).
+ *
+ * Usage:
+ * ```ts
+ * const validator = pluginCapabilityValidator();
+ *
+ * // Runtime: gate a bridge call
+ * validator.assertOperation(plugin.manifestJson, "issues.create");
+ *
+ * // Install time: validate manifest consistency
+ * const result = validator.validateManifestCapabilities(manifest);
+ * if (!result.allowed) {
+ *   throw badRequest("Missing capabilities", result.missing);
+ * }
+ * ```
+ */
+export declare function pluginCapabilityValidator(): PluginCapabilityValidator;
+//# sourceMappingURL=plugin-capability-validator.d.ts.map

package/dist/services/plugin-capability-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-capability-validator.d.ts","sourceRoot":"","sources":["../../src/services/plugin-capability-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAEjB,MAAM,kBAAkB,CAAC;AA0H1B;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAAC;IAEX;;OAEG;IACH,kBAAkB,CAChB,QAAQ,EAAE,yBAAyB,EACnC,YAAY,EAAE,gBAAgB,EAAE,GAC/B,qBAAqB,CAAC;IAEzB;;OAEG;IACH,gBAAgB,CACd,QAAQ,EAAE,yBAAyB,EACnC,YAAY,EAAE,gBAAgB,EAAE,GAC/B,OAAO,CAAC;IAEX;;;;;OAKG;IACH,cAAc,CACZ,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,qBAAqB,CAAC;IAEzB;;;OAGG;IACH,eAAe,CACb,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAAC;IAER;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,yBAAyB,EACnC,UAAU,EAAE,gBAAgB,GAC3B,IAAI,CAAC;IAER;;OAEG;IACH,WAAW,CACT,QAAQ,EAAE,yBAAyB,EACnC,QAAQ,EAAE,gBAAgB,GACzB,qBAAqB,CAAC;IAEzB;;;;;;OAMG;IACH,4BAA4B,CAC1B,QAAQ,EAAE,yBAAyB,GAClC,qBAAqB,CAAC;IAEzB;;;OAGG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,gBAAgB,EAAE,CAAC;IAExE;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,CAAC;CACnE;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,IAAI,yBAAyB,CA8KrE"}