@synoikia/core 0.1.0

package/dist/catalog/groups.js

@@ -0,0 +1,363 @@
+import { randomUUID } from 'node:crypto';
+import { and, asc, eq, inArray } from 'drizzle-orm';
+import { writeAudit } from '../audit.js';
+import { operationGroupAliases, operationGroups, operations, pluginInstances } from '../db/schema.js';
+import { ConflictError, NotFoundError, ValidationError } from '../errors.js';
+import { ACCESS_LEVELS, FULL_ACCESS, effectiveAccess, isAccessLevel, minLevel } from '../gate/access.js';
+function assertLevel(level) {
+    if (!isAccessLevel(level)) {
+        throw new ValidationError('invalid_level', `Level must be one of ${ACCESS_LEVELS.join(', ')}`);
+    }
+}
+export const accessInput = (op) => ({
+    classification: op.classification,
+    locked: op.locked,
+    levelOverride: op.levelOverride,
+    writeAcknowledged: op.writeAcknowledged,
+});
+const isPlainWrite = (op) => !op.stale && !op.locked && op.classification === 'write';
+/**
+ * Writes that would run without asking once their group is at `write`: plain writes that follow the
+ * group. Raising a group to `write` must acknowledge exactly these (locked ops never auto-run).
+ */
+const followsGroupWrite = (op) => isPlainWrite(op) && op.levelOverride === null;
+/** Writes whose effective level is `write` but that nobody acknowledged yet: they ask until someone does. */
+function isPendingWrite(op, group) {
+    return isPlainWrite(op) && !op.writeAcknowledged && (op.levelOverride ?? group?.level) === 'write';
+}
+const sameSet = (a = [], b) => a.length === b.length && new Set(a).size === b.length && b.every((x) => a.includes(x));
+function getGroup(db, instanceId, key) {
+    const group = db
+        .select()
+        .from(operationGroups)
+        .where(and(eq(operationGroups.instanceId, instanceId), eq(operationGroups.key, key)))
+        .get();
+    if (!group)
+        throw new NotFoundError('group_not_found', `No group "${key}" on this instance`);
+    return group;
+}
+function opsInGroups(db, groupIds) {
+    if (groupIds.length === 0)
+        return [];
+    return db.select().from(operations).where(inArray(operations.groupId, groupIds)).orderBy(asc(operations.key)).all();
+}
+function acknowledge(db, opIds, actor, now) {
+    if (opIds.length === 0)
+        return;
+    db.update(operations)
+        .set({ writeAcknowledged: true, acknowledgedAt: now, acknowledgedBy: actor.userId ?? null })
+        .where(inArray(operations.id, opIds))
+        .run();
+}
+export function listGroups(db, instanceId) {
+    const groups = db
+        .select()
+        .from(operationGroups)
+        .where(eq(operationGroups.instanceId, instanceId))
+        .orderBy(asc(operationGroups.key))
+        .all();
+    const ops = opsInGroups(db, groups.map((g) => g.id)).filter((o) => !o.stale);
+    return groups.map((g) => {
+        const mine = ops.filter((o) => o.groupId === g.id);
+        return {
+            key: g.key,
+            label: g.label,
+            level: g.level,
+            stale: g.stale,
+            counts: {
+                read: mine.filter((o) => !o.locked && o.classification === 'read').length,
+                write: mine.filter((o) => !o.locked && o.classification === 'write').length,
+                locked: mine.filter((o) => o.locked).length,
+                pendingReview: mine.filter((o) => isPendingWrite(o, g)).length,
+                overridden: mine.filter((o) => o.levelOverride !== null).length,
+            },
+        };
+    });
+}
+/** Access decision for one operation key; unknown or stale operations are unreachable. */
+export function resolveAccess(db, instanceId, key, principal = FULL_ACCESS) {
+    const op = db
+        .select()
+        .from(operations)
+        .where(and(eq(operations.instanceId, instanceId), eq(operations.key, key)))
+        .get();
+    if (!op || op.stale)
+        return { reachable: false, reason: 'unknown_operation' };
+    const group = db.select().from(operationGroups).where(eq(operationGroups.id, op.groupId)).get();
+    return effectiveAccess(accessInput(op), group, principal);
+}
+// ── group level ──────────────────────────────────────────────────────────────────────────────────
+/**
+ * Sets one group's level; operations with their own level keep it. Raising to `write` must carry
+ * `acknowledge` = exactly the writes that will then run without asking (the list the admin was
+ * shown); if a sync changed that list in between, this fails with 409 and the fresh list.
+ */
+export function setGroupLevel(db, instanceId, key, level, opts = {}) {
+    assertLevel(level);
+    const now = opts.now ?? new Date();
+    const actor = opts.actor ?? {};
+    db.transaction((tx) => {
+        const group = getGroup(tx, instanceId, key);
+        let acknowledged = [];
+        if (level === 'write') {
+            const autoRun = opsInGroups(tx, [group.id]).filter(followsGroupWrite);
+            const expected = autoRun.map((o) => o.id);
+            if (!sameSet(opts.acknowledge, expected)) {
+                throw new ConflictError('acknowledgement_mismatch', 'Acknowledge exactly the writes that will run without asking', {
+                    expected: autoRun.map((o) => ({ id: o.id, key: o.key })),
+                });
+            }
+            const fresh = autoRun.filter((o) => !o.writeAcknowledged);
+            acknowledge(tx, fresh.map((o) => o.id), actor, now);
+            acknowledged = fresh.map((o) => o.key);
+        }
+        if (group.level === level && acknowledged.length === 0)
+            return;
+        tx.update(operationGroups)
+            .set({ level, levelChangedAt: now, levelChangedBy: actor.userId ?? null })
+            .where(eq(operationGroups.id, group.id))
+            .run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'group_level_changed',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: { group: key, from: group.level, to: level, acknowledged },
+        }, now);
+    });
+    return listGroups(db, instanceId).find((g) => g.key === key);
+}
+export function previewBulkLevel(db, instanceId, level) {
+    assertLevel(level);
+    const groups = db
+        .select()
+        .from(operationGroups)
+        .where(eq(operationGroups.instanceId, instanceId))
+        .orderBy(asc(operationGroups.key))
+        .all();
+    const pending = level === 'write'
+        ? opsInGroups(db, groups.map((g) => g.id)).filter(followsGroupWrite)
+        : [];
+    const preview = groups.map((g) => ({
+        key: g.key,
+        label: g.label,
+        from: g.level,
+        exposes: pending.filter((o) => o.groupId === g.id).map((o) => ({ id: o.id, key: o.key })),
+    }));
+    return { level, groups: preview, acknowledge: pending.map((o) => o.id) };
+}
+/**
+ * Sets every group of an instance to one level (operations with their own level keep it).
+ * `none`/`read`/`ask` apply directly. `write` requires `confirm` = the instance slug and
+ * `acknowledge` = the current preview's list. Locked operations never auto-run.
+ */
+export function applyBulkLevel(db, instanceId, level, opts = {}) {
+    assertLevel(level);
+    const now = opts.now ?? new Date();
+    const actor = opts.actor ?? {};
+    return db.transaction((tx) => {
+        const instance = tx.select().from(pluginInstances).where(eq(pluginInstances.id, instanceId)).get();
+        if (!instance)
+            throw new NotFoundError('instance_not_found', 'No such instance');
+        const preview = previewBulkLevel(tx, instanceId, level);
+        if (level === 'write') {
+            if (opts.confirm !== instance.slug) {
+                throw new ConflictError('confirmation_required', `Type the endpoint slug "${instance.slug}" to confirm`);
+            }
+            if (!sameSet(opts.acknowledge, preview.acknowledge)) {
+                throw new ConflictError('acknowledgement_mismatch', 'The list of exposed writes changed; review it again', {
+                    preview,
+                });
+            }
+            acknowledge(tx, opsInGroups(tx, tx
+                .select({ id: operationGroups.id })
+                .from(operationGroups)
+                .where(eq(operationGroups.instanceId, instanceId))
+                .all()
+                .map((g) => g.id))
+                .filter((o) => followsGroupWrite(o) && !o.writeAcknowledged)
+                .map((o) => o.id), actor, now);
+        }
+        tx.update(operationGroups)
+            .set({ level, levelChangedAt: now, levelChangedBy: actor.userId ?? null })
+            .where(eq(operationGroups.instanceId, instanceId))
+            .run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'group_level_bulk_changed',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: {
+                to: level,
+                groups: preview.groups.map((g) => ({ key: g.key, from: g.from, to: level })),
+                acknowledged: preview.groups.flatMap((g) => g.exposes.map((o) => o.key)),
+            },
+        }, now);
+        return preview.groups;
+    });
+}
+// ── regrouping ───────────────────────────────────────────────────────────────────────────────────
+export function renameGroup(db, instanceId, key, label, opts = {}) {
+    const trimmed = label.trim();
+    if (!trimmed)
+        throw new ValidationError('invalid_label', 'Label must not be empty');
+    db.transaction((tx) => {
+        const group = getGroup(tx, instanceId, key);
+        tx.update(operationGroups).set({ label: trimmed }).where(eq(operationGroups.id, group.id)).run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'group_renamed',
+            actorKind: 'user',
+            actorId: opts.actor?.userId,
+            detail: { group: key, from: group.label, to: trimmed },
+        });
+    });
+}
+/**
+ * Merges groups into `into` (created if new). Stored as aliases so future syncs keep the grouping.
+ * The merged group takes the lowest level involved, so merging never widens access.
+ */
+export function mergeGroups(db, instanceId, input, opts = {}) {
+    const now = opts.now ?? new Date();
+    const into = input.into.trim();
+    if (!/^[a-z0-9][a-z0-9._-]*$/.test(into))
+        throw new ValidationError('invalid_group_key', 'Invalid group key');
+    const fromKeys = [...new Set(input.from)].filter((k) => k !== into);
+    if (fromKeys.length === 0)
+        throw new ValidationError('nothing_to_merge', 'Pick at least one other group to merge');
+    db.transaction((tx) => {
+        const sources = fromKeys.map((k) => getGroup(tx, instanceId, k));
+        let target = tx
+            .select()
+            .from(operationGroups)
+            .where(and(eq(operationGroups.instanceId, instanceId), eq(operationGroups.key, into)))
+            .get();
+        const level = [...sources, ...(target ? [target] : [])].map((g) => g.level).reduce(minLevel);
+        if (!target) {
+            target = {
+                id: randomUUID(),
+                instanceId,
+                key: into,
+                label: input.label?.trim() || into,
+                level,
+                levelChangedAt: now,
+                levelChangedBy: opts.actor?.userId ?? null,
+                firstSeenAt: now,
+                stale: false,
+            };
+            tx.insert(operationGroups).values(target).run();
+        }
+        else {
+            tx.update(operationGroups)
+                .set({
+                level,
+                stale: false,
+                ...(input.label?.trim() ? { label: input.label.trim() } : {}),
+                ...(level !== target.level ? { levelChangedAt: now, levelChangedBy: opts.actor?.userId ?? null } : {}),
+            })
+                .where(eq(operationGroups.id, target.id))
+                .run();
+        }
+        const sourceIds = sources.map((g) => g.id);
+        const pluginGroups = new Set(opsInGroups(tx, sourceIds).map((o) => o.pluginGroup));
+        // Aliases that pointed at a merged group now point at the target.
+        for (const a of tx
+            .select()
+            .from(operationGroupAliases)
+            .where(and(eq(operationGroupAliases.instanceId, instanceId), inArray(operationGroupAliases.groupKey, fromKeys)))
+            .all()) {
+            pluginGroups.add(a.pluginGroup);
+        }
+        for (const k of fromKeys)
+            pluginGroups.add(k);
+        for (const pluginGroup of pluginGroups) {
+            tx.insert(operationGroupAliases)
+                .values({ instanceId, pluginGroup, groupKey: into })
+                .onConflictDoUpdate({
+                target: [operationGroupAliases.instanceId, operationGroupAliases.pluginGroup],
+                set: { groupKey: into },
+            })
+                .run();
+        }
+        tx.update(operations).set({ groupId: target.id }).where(inArray(operations.groupId, sourceIds)).run();
+        tx.delete(operationGroups).where(inArray(operationGroups.id, sourceIds)).run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            decision: 'groups_merged',
+            actorKind: 'user',
+            actorId: opts.actor?.userId,
+            detail: { from: sources.map((g) => ({ key: g.key, level: g.level })), into, level },
+        }, now);
+    });
+    return listGroups(db, instanceId).find((g) => g.key === into);
+}
+/**
+ * Per-operation level, acknowledgement and classification override. Locked operations can't be set
+ * to `write` and can't change classification (409). Setting a write to `write`, or overriding an
+ * operation's classification to write, acknowledges it.
+ */
+export function updateOperation(db, instanceId, opId, patch, opts = {}) {
+    const now = opts.now ?? new Date();
+    const actor = opts.actor ?? {};
+    db.transaction((tx) => {
+        const op = tx
+            .select()
+            .from(operations)
+            .where(and(eq(operations.id, opId), eq(operations.instanceId, instanceId)))
+            .get();
+        if (!op)
+            throw new NotFoundError('operation_not_found', 'No such operation on this instance');
+        const set = {};
+        if (patch.classification !== undefined && patch.classification !== op.classification) {
+            if (op.locked)
+                throw new ConflictError('operation_locked', `${op.key} is locked; its classification can't change`);
+            set.classification = patch.classification;
+            set.classificationSource = 'override';
+        }
+        if (patch.level !== undefined && patch.level !== op.levelOverride) {
+            if (patch.level !== null)
+                assertLevel(patch.level);
+            if (patch.level === 'write' && op.locked) {
+                throw new ConflictError('operation_locked', `${op.key} is locked; it always asks for approval`);
+            }
+            set.levelOverride = patch.level;
+        }
+        const isWrite = (set.classification ?? op.classification) === 'write';
+        const acknowledges = patch.acknowledged === true || set.classification === 'write' || (patch.level === 'write' && isWrite);
+        if (acknowledges && !op.writeAcknowledged) {
+            Object.assign(set, { writeAcknowledged: true, acknowledgedAt: now, acknowledgedBy: actor.userId ?? null });
+        }
+        if (patch.attestationRequired !== undefined && patch.attestationRequired !== op.attestationRequired) {
+            set.attestationRequired = patch.attestationRequired;
+            set.attestationWaived = !patch.attestationRequired;
+        }
+        if (patch.acknowledged === false) {
+            Object.assign(set, { writeAcknowledged: false, acknowledgedAt: null, acknowledgedBy: null });
+        }
+        if (Object.keys(set).length === 0)
+            return;
+        tx.update(operations).set(set).where(eq(operations.id, op.id)).run();
+        writeAudit(tx, {
+            kind: 'config',
+            instanceId,
+            operationKey: op.key,
+            decision: 'operation_updated',
+            actorKind: 'user',
+            actorId: actor.userId,
+            detail: {
+                before: {
+                    level: op.levelOverride,
+                    writeAcknowledged: op.writeAcknowledged,
+                    classification: op.classification,
+                    attestationRequired: op.attestationRequired,
+                },
+                after: set,
+            },
+        }, now);
+    });
+}
+//# sourceMappingURL=groups.js.map

package/dist/catalog/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/catalog/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAezG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,wBAAwB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAgB,EAAE,EAAE,CAAC,CAAC;IAChD,cAAc,EAAE,EAAE,CAAC,cAAc;IACjC,MAAM,EAAE,EAAE,CAAC,MAAM;IACjB,aAAa,EAAE,EAAE,CAAC,aAAa;IAC/B,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;CACxC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,EAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,cAAc,KAAK,OAAO,CAAC;AAEpG;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CAAC,EAAgB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,KAAK,IAAI,CAAC;AAE9F,6GAA6G;AAC7G,SAAS,cAAc,CAAC,EAAgB,EAAE,KAA2B;IACnE,OAAO,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC,aAAa,IAAI,KAAK,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC;AACrG,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAAoB,EAAE,EAAE,CAClE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzF,SAAS,QAAQ,CAAC,EAAU,EAAE,UAAkB,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,EAAE;SACb,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SACpF,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,aAAa,GAAG,oBAAoB,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,QAAkB;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACtH,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAe,EAAE,KAAY,EAAE,GAAS;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;SAClB,GAAG,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;SAC3F,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;SACpC,GAAG,EAAE,CAAC;AACX,CAAC;AAYD,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,UAAkB;IACvD,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SACjD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,WAAW,CACrB,EAAE,EACF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,MAAM;gBACzE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC,MAAM;gBAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM;gBAC3C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM;gBAC9D,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,MAAM;aAChE;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,UAAkB,EAClB,GAAW,EACX,YAA6B,WAAW;IAExC,MAAM,EAAE,GAAG,EAAE;SACV,MAAM,EAAE;SACR,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;SAC1E,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAChG,OAAO,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED,oGAAoG;AAEpG;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAM,EACN,UAAkB,EAClB,GAAW,EACX,KAAa,EACb,OAA8D,EAAE;IAEhE,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,YAAY,GAAa,EAAE,CAAC;QAChC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CACrB,0BAA0B,EAC1B,6DAA6D,EAC7D;oBACE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;iBACzD,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC1D,WAAW,CACT,EAAE,EACF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACtB,KAAK,EACL,GAAG,CACJ,CAAC;YACF,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/D,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACvC,GAAG,EAAE,CAAC;QACT,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,qBAAqB;YAC/B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;SACnE,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAE,CAAC;AAChE,CAAC;AAUD,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,UAAkB,EAAE,KAAa;IAC5E,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,EAAE;SACd,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SACjD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,EAAE,CAAC;IACT,MAAM,OAAO,GACX,KAAK,KAAK,OAAO;QACf,CAAC,CAAC,WAAW,CACT,EAAE,EACF,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,KAAK;QACb,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;KAC1F,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,EAAM,EACN,UAAkB,EAClB,KAAa,EACb,OAAgF,EAAE;IAElF,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,aAAa,CAAC,uBAAuB,EAAE,2BAA2B,QAAQ,CAAC,IAAI,cAAc,CAAC,CAAC;YAC3G,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,qDAAqD,EAAE;oBACzG,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,WAAW,CACT,EAAE,EACF,WAAW,CACT,EAAE,EACF,EAAE;iBACC,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;iBACjD,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACpB;iBACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;iBAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnB,KAAK,EACL,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aACjD,GAAG,EAAE,CAAC;QACT,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,0BAA0B;YACpC,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE;gBACN,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5E,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aACzE;SACF,EACD,GAAG,CACJ,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AAEpG,MAAM,UAAU,WAAW,CAAC,EAAM,EAAE,UAAkB,EAAE,GAAW,EAAE,KAAa,EAAE,OAA0B,EAAE;IAC9G,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACpF,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC5C,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACjG,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE;SACvD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,EAAM,EACN,UAAkB,EAClB,KAAuD,EACvD,OAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IAEnH,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,MAAM,GAAG,EAAE;aACZ,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;aACrF,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG;gBACP,EAAE,EAAE,UAAU,EAAE;gBAChB,UAAU;gBACV,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI;gBAClC,KAAK;gBACL,cAAc,EAAE,GAAG;gBACnB,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;gBAC1C,WAAW,EAAE,GAAG;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC;YACF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC;gBACH,KAAK;gBACL,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvG,CAAC;iBACD,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;iBACxC,GAAG,EAAE,CAAC;QACX,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,kEAAkE;QAClE,KAAK,MAAM,CAAC,IAAI,EAAE;aACf,MAAM,EAAE;aACR,IAAI,CAAC,qBAAqB,CAAC;aAC3B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC/G,GAAG,EAAE,EAAE,CAAC;YACT,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACvC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC;iBAC7B,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;iBACnD,kBAAkB,CAAC;gBAClB,MAAM,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,qBAAqB,CAAC,WAAW,CAAC;gBAC7E,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;aACxB,CAAC;iBACD,GAAG,EAAE,CAAC;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACtG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ,EAAE,eAAe;YACzB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;SACpF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAE,CAAC;AACjE,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,EAAM,EACN,UAAkB,EAClB,IAAY,EACZ,KAAqB,EACrB,OAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,MAAM,EAAE,GAAG,EAAE;aACV,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;aAC1E,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;QAE9F,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC,cAAc,EAAE,CAAC;YACrF,IAAI,EAAE,CAAC,MAAM;gBACX,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,6CAA6C,CAAC,CAAC;YACtG,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;YAC1C,GAAG,CAAC,oBAAoB,GAAG,UAAU,CAAC;QACxC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC,aAAa,EAAE,CAAC;YAClE,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAAE,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,GAAG,yCAAyC,CAAC,CAAC;YAClG,CAAC;YACD,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,cAAc,CAAC,KAAK,OAAO,CAAC;QACtE,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC;QACxG,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,mBAAmB,EAAE,CAAC;YACpG,GAAG,CAAC,mBAAmB,GAAG,KAAK,CAAC,mBAAmB,CAAC;YACpD,GAAG,CAAC,iBAAiB,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE1C,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACrE,UAAU,CACR,EAAE,EACF;YACE,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,YAAY,EAAE,EAAE,CAAC,GAAG;YACpB,QAAQ,EAAE,mBAAmB;YAC7B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE;gBACN,MAAM,EAAE;oBACN,KAAK,EAAE,EAAE,CAAC,aAAa;oBACvB,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;oBACvC,cAAc,EAAE,EAAE,CAAC,cAAc;oBACjC,mBAAmB,EAAE,EAAE,CAAC,mBAAmB;iBAC5C;gBACD,KAAK,EAAE,GAAG;aACX;SACF,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/catalog/registry.d.ts

@@ -0,0 +1,25 @@
+import type { Db, DbLike } from '../db/index.js';
+/**
+ * Registry mirror (design §2.4 / HA §2.4): pickable upstream objects — HA areas, devices, entities —
+ * mirrored locally so pickers and `search` never pull the whole registry from the upstream.
+ */
+export declare function applyRegistrySync(db: Db, instanceId: string, raw: unknown, now?: Date): {
+    upserted: number;
+    staled: number;
+};
+export interface RegistryQuery {
+    kind?: string;
+    text?: string;
+    parent?: string;
+    domain?: string;
+    limit?: number;
+    offset?: number;
+}
+export declare function findRegistryEntries(db: DbLike, instanceId: string, q?: RegistryQuery): {
+    kind: string;
+    id: string;
+    name: string;
+    parentId: string | null;
+    domain: string | null;
+    attrs: unknown;
+}[];

package/dist/catalog/registry.js

@@ -0,0 +1,80 @@
+import { randomUUID } from 'node:crypto';
+import { RegistryEntrySchema } from '@synoikia/plugin-sdk';
+import { and, asc, eq, or, sql } from 'drizzle-orm';
+import { z } from 'zod';
+import { registryEntries } from '../db/schema.js';
+/**
+ * Registry mirror (design §2.4 / HA §2.4): pickable upstream objects — HA areas, devices, entities —
+ * mirrored locally so pickers and `search` never pull the whole registry from the upstream.
+ */
+export function applyRegistrySync(db, instanceId, raw, now = new Date()) {
+    const entries = z.array(RegistryEntrySchema).parse(raw);
+    return db.transaction((tx) => {
+        const existing = new Map(tx
+            .select()
+            .from(registryEntries)
+            .where(eq(registryEntries.instanceId, instanceId))
+            .all()
+            .map((e) => [`${e.kind}\u0000${e.extId}`, e]));
+        const seen = new Set();
+        for (const e of entries) {
+            const k = `${e.kind}\u0000${e.id}`;
+            if (seen.has(k))
+                continue;
+            seen.add(k);
+            const fields = {
+                name: e.name,
+                parentExtId: e.parentId ?? null,
+                domain: e.domain ?? null,
+                attrs: e.attrs ?? null,
+                stale: false,
+                lastSyncedAt: now,
+            };
+            const prev = existing.get(k);
+            if (prev)
+                tx.update(registryEntries).set(fields).where(eq(registryEntries.id, prev.id)).run();
+            else
+                tx.insert(registryEntries)
+                    .values({ id: randomUUID(), instanceId, kind: e.kind, extId: e.id, ...fields })
+                    .run();
+        }
+        let staled = 0;
+        for (const [k, prev] of existing) {
+            if (!seen.has(k) && !prev.stale) {
+                tx.update(registryEntries).set({ stale: true }).where(eq(registryEntries.id, prev.id)).run();
+                staled++;
+            }
+        }
+        return { upserted: seen.size, staled };
+    });
+}
+export function findRegistryEntries(db, instanceId, q = {}) {
+    const limit = Math.min(Math.max(1, Number(q.limit) || 50), 500);
+    const conditions = [eq(registryEntries.instanceId, instanceId), eq(registryEntries.stale, false)];
+    if (q.kind)
+        conditions.push(eq(registryEntries.kind, q.kind));
+    if (q.parent)
+        conditions.push(eq(registryEntries.parentExtId, q.parent));
+    if (q.domain)
+        conditions.push(eq(registryEntries.domain, q.domain));
+    if (q.text) {
+        const pattern = `%${q.text.replace(/[%_\\]/g, (c) => `\\${c}`)}%`;
+        conditions.push(or(sql `${registryEntries.name} LIKE ${pattern} ESCAPE '\\'`, sql `${registryEntries.extId} LIKE ${pattern} ESCAPE '\\'`));
+    }
+    return db
+        .select({
+        kind: registryEntries.kind,
+        id: registryEntries.extId,
+        name: registryEntries.name,
+        parentId: registryEntries.parentExtId,
+        domain: registryEntries.domain,
+        attrs: registryEntries.attrs,
+    })
+        .from(registryEntries)
+        .where(and(...conditions))
+        .orderBy(asc(registryEntries.kind), asc(registryEntries.name))
+        .limit(limit)
+        .offset(Math.max(0, Number(q.offset) || 0))
+        .all();
+}
+//# sourceMappingURL=registry.js.map

package/dist/catalog/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/catalog/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AAEH,MAAM,UAAU,iBAAiB,CAC/B,EAAM,EACN,UAAkB,EAClB,GAAY,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,EAAE;aACC,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;aACjD,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAChD,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;gBAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;gBACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;gBACtB,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,GAAG;aAClB,CAAC;YACF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI;gBAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;;gBAE5F,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;qBACvB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;qBAC9E,GAAG,EAAE,CAAC;QACb,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC7F,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAWD,MAAM,UAAU,mBAAmB,CAAC,EAAU,EAAE,UAAkB,EAAE,IAAmB,EAAE;IACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,CAAC,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;QAClE,UAAU,CAAC,IAAI,CACb,EAAE,CACA,GAAG,CAAA,GAAG,eAAe,CAAC,IAAI,SAAS,OAAO,cAAc,EACxD,GAAG,CAAA,GAAG,eAAe,CAAC,KAAK,SAAS,OAAO,cAAc,CACzD,CACH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE;SACN,MAAM,CAAC;QACN,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,EAAE,EAAE,eAAe,CAAC,KAAK;QACzB,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,QAAQ,EAAE,eAAe,CAAC,WAAW;QACrC,MAAM,EAAE,eAAe,CAAC,MAAM;QAC9B,KAAK,EAAE,eAAe,CAAC,KAAK;KAC7B,CAAC;SACD,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;SAC7D,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SAC1C,GAAG,EAAE,CAAC;AACX,CAAC"}

package/dist/catalog/rules.d.ts

@@ -0,0 +1,128 @@
+import type { Manifest } from '@synoikia/plugin-sdk';
+import { z } from 'zod';
+import type { Db } from '../db/index.js';
+import { operations } from '../db/schema.js';
+import { ValidationError } from '../errors.js';
+/**
+ * Pre-approval rules (design §5.2, TN §3.5): picked from the synced catalog, never free text; a
+ * required reason; structured match; optional rate limit and expiry. Locked operations can never be
+ * referenced (409), enforced here regardless of what the UI offers.
+ */
+export declare const RuleInputSchema: z.ZodObject<{
+    operationId: z.ZodString;
+    match: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        field: z.ZodLiteral<"$targets">;
+        areas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        entities: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        domains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        field: z.ZodString;
+        op: z.ZodEnum<{
+            any: "any";
+            in: "in";
+            eq: "eq";
+            prefix: "prefix";
+            range: "range";
+            bool: "bool";
+        }>;
+        value: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strip>]>>>;
+    rateLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    windowSeconds: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodCoercedDate<unknown>>>;
+    reason: z.ZodString;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RuleInput = z.infer<typeof RuleInputSchema>;
+type OperationRow = typeof operations.$inferSelect;
+/** Why a rule's match doesn't fit the operation's declared fields (design §8.3), or null if it does. */
+export declare function matchMisfit(manifest: Pick<Manifest, 'matchProfiles'>, op: Pick<OperationRow, 'key' | 'matchProfile'>, match: RuleInput['match']): ValidationError | null;
+export declare function listRules(db: Db, instanceId: string): {
+    operation: {
+        id: string;
+        key: string;
+        locked: boolean;
+        matchProfile: string | null;
+    };
+    /**
+     * Rules only apply at level `ask`: on an unreachable operation, or one at level `write`, a rule
+     * never fires; the UI flags it (design §5.2.1).
+     */
+    inert: string | null;
+    id: string;
+    match: unknown;
+    createdAt: Date;
+    expiresAt: Date | null;
+    enabled: boolean;
+    instanceId: string;
+    operationId: string;
+    rateLimit: number | null;
+    windowSeconds: number | null;
+    reason: string;
+    createdBy: string | null;
+    updatedAt: Date | null;
+    lastTriggeredAt: Date | null;
+    strictMissAt: Date | null;
+}[];
+export declare function createRule(db: Db, manifest: Manifest, instanceId: string, raw: unknown, actor?: {
+    userId?: string;
+}): {
+    operation: {
+        id: string;
+        key: string;
+        locked: boolean;
+        matchProfile: string | null;
+    };
+    /**
+     * Rules only apply at level `ask`: on an unreachable operation, or one at level `write`, a rule
+     * never fires; the UI flags it (design §5.2.1).
+     */
+    inert: string | null;
+    id: string;
+    match: unknown;
+    createdAt: Date;
+    expiresAt: Date | null;
+    enabled: boolean;
+    instanceId: string;
+    operationId: string;
+    rateLimit: number | null;
+    windowSeconds: number | null;
+    reason: string;
+    createdBy: string | null;
+    updatedAt: Date | null;
+    lastTriggeredAt: Date | null;
+    strictMissAt: Date | null;
+};
+export declare function updateRule(db: Db, manifest: Manifest, instanceId: string, ruleId: string, raw: unknown, actor?: {
+    userId?: string;
+}): {
+    operation: {
+        id: string;
+        key: string;
+        locked: boolean;
+        matchProfile: string | null;
+    };
+    /**
+     * Rules only apply at level `ask`: on an unreachable operation, or one at level `write`, a rule
+     * never fires; the UI flags it (design §5.2.1).
+     */
+    inert: string | null;
+    id: string;
+    match: unknown;
+    createdAt: Date;
+    expiresAt: Date | null;
+    enabled: boolean;
+    instanceId: string;
+    operationId: string;
+    rateLimit: number | null;
+    windowSeconds: number | null;
+    reason: string;
+    createdBy: string | null;
+    updatedAt: Date | null;
+    lastTriggeredAt: Date | null;
+    strictMissAt: Date | null;
+};
+export declare function deleteRule(db: Db, instanceId: string, ruleId: string, actor?: {
+    userId?: string;
+}): void;
+export {};