@treenity/core 1.0.48 → 3.0.1

package/dist/server/actions.js

@@ -0,0 +1,170 @@
+// Treenity Actions — Layer 4
+// Server-specific: ActionCtx, SchemaHandler, client proxy
+// Component registration lives in @/comp
+import { chain } from '#chain';
+import { makeTypedProxy } from '#comp/handle';
+import { collectDeps as _collectDeps } from '#comp/needs';
+import { getComponentField, isComponent, register, resolve } from '#core';
+import { createDraft, enablePatches, finishDraft } from 'immer';
+import { OpError } from './errors';
+export function createNodeHandle(execute, stream, getNode) {
+    return (path) => ({
+        get(cls, key) {
+            return chain(makeTypedProxy(getNode?.(path), cls, path, execute, stream, key));
+        },
+    });
+}
+// Server-side typed node client: wraps executeAction/executeStream into createNodeHandle.
+// Usage: const nc = serverNodeHandle(store); await nc(path).get(MyComp).myMethod();
+export function serverNodeHandle(store) {
+    return createNodeHandle((input) => executeAction(store, input.path, input.type, input.key, input.action, input.data), (input) => executeStream(store, input.path, input.type, input.key, input.action, input.data));
+}
+export { collectSiblings, collectDeps } from '#comp/needs';
+export { registerActionNeeds, getActionNeeds } from '#comp/needs';
+// ── Server-side operations ──
+// Single entry point for tRPC, MCP, cook-bot, services — no boilerplate.
+// All ops throw OpError for domain errors (NOT_FOUND, BAD_REQUEST, CONFLICT).
+enablePatches();
+// Action timeout: env-configurable, default 5 min (was 30s)
+const ACTION_TIMEOUT = Number(process.env.ACTION_TIMEOUT) || 300_000;
+const STREAM_TIMEOUT = Number(process.env.STREAM_TIMEOUT) || 600_000;
+// Dynamic actions: load from /sys/types/{ns}/{name} node's `actions` component.
+// Code is compiled with new Function, registered for future calls.
+// Format: actions.{name} = "const node = ...; return result;"  (async function body)
+async function loadDynamicAction(store, type, action) {
+    if (!type.includes('.'))
+        return null;
+    const typePath = `/sys/types/${type.replace(/\./g, '/')}`;
+    const typeNode = await store.get(typePath);
+    const actionCode = typeNode?.actions?.[action];
+    if (!actionCode || typeof actionCode !== 'string')
+        return null;
+    try {
+        const fn = new Function('ctx', 'data', `return (async () => { ${actionCode} })()`);
+        register(type, `action:${action}`, fn);
+        console.log(`[uix] loaded dynamic action "${action}" for "${type}"`);
+        return fn;
+    }
+    catch (err) {
+        console.warn(`[uix] failed to compile action "${action}" for "${type}":`, err.message);
+        return null;
+    }
+}
+async function resolveActionHandler(store, path, componentType, componentKey, action) {
+    const node = await store.get(path);
+    if (!node)
+        throw new OpError('NOT_FOUND', `Node not found: ${path}`);
+    const [comp, fieldKey] = getComponentField(node, componentType ?? 't.any', componentKey) ?? [];
+    if (!isComponent(comp))
+        throw new OpError('NOT_FOUND', `Component "${componentKey ?? componentType}" not found on ${path}`);
+    const type = comp.$type;
+    let deps = await _collectDeps(node, fieldKey, action, store);
+    let handler = resolve(type, `action:${action}`);
+    // Fallback: try loading dynamic action from type definition node
+    if (!handler)
+        handler = await loadDynamicAction(store, type, action);
+    if (!handler)
+        throw new OpError('BAD_REQUEST', `No action "${action}" for type "${type}"`);
+    return { node, handler, type, comp, deps, fieldKey };
+}
+// ── executeAction: mutating action with Immer draft + patch collection ──
+// Patches attached as $patches for subscription layer (CDC Matrix in sub.ts).
+// Pure actions (no state changes) skip persist — patches.length === 0.
+export async function executeAction(store, path, componentType, componentKey, action, data) {
+    const { node, handler, type, deps, fieldKey } = await resolveActionHandler(store, path, componentType, componentKey, action);
+    // Pre/post condition checking (Design by Contract)
+    const schemaHandler = resolve(type, 'schema');
+    const methodSchema = schemaHandler?.()?.methods?.[action];
+    const preFields = methodSchema?.pre ?? [];
+    const postFields = methodSchema?.post ?? [];
+    const target = fieldKey ? node[fieldKey] : node;
+    for (const f of preFields) {
+        const v = target[f];
+        if (v === undefined || v === null || v === '' || v === 0) {
+            console.warn(`[pre] ${type}.${action}: field "${f}" is empty`);
+        }
+    }
+    const postSnap = Object.fromEntries(postFields.map(f => [f, target[f]]));
+    const draft = createDraft(node);
+    // comp must be the draft version so Immer captures mutations via `this.*`
+    const dc = fieldKey ? draft[fieldKey] : undefined;
+    const draftComp = isComponent(dc) ? dc : undefined;
+    const nc = serverNodeHandle(store);
+    const actx = { node: draft, comp: draftComp, deps, store, signal: AbortSignal.timeout(ACTION_TIMEOUT), nc };
+    const result = await handler(actx, data ?? {});
+    let patches = [];
+    const nextNode = finishDraft(draft, (p) => { patches = p; });
+    const postTarget = fieldKey ? nextNode[fieldKey] : nextNode;
+    for (const f of postFields) {
+        if (postTarget[f] === postSnap[f]) {
+            console.warn(`[post] ${type}.${action}: field "${f}" unchanged`);
+        }
+    }
+    if (patches.length > 0)
+        await store.set({ ...nextNode, $patches: patches });
+    return result;
+}
+// ── executeStream: generator action — yields multiple values, no Immer draft ──
+// Generator actions persist via store.set() directly inside the generator body.
+export async function* executeStream(store, path, componentType, componentKey, action, data, signal) {
+    const { node, handler, comp, deps } = await resolveActionHandler(store, path, componentType, componentKey, action);
+    // comp is already node[fieldKey] from resolution — no Immer draft needed for generators
+    const nc = serverNodeHandle(store);
+    const actx = { node, comp, deps, store, signal: signal ?? AbortSignal.timeout(STREAM_TIMEOUT), nc };
+    const result = handler(actx, data ?? {});
+    if (!result || typeof result[Symbol.asyncIterator] !== 'function')
+        throw new OpError('BAD_REQUEST', `Action "${action}" is not a generator`);
+    yield* result;
+}
+// ── setComponent: single component update with OCC ──
+export async function setComponent(store, path, name, data, rev) {
+    const node = await store.get(path);
+    if (!node)
+        throw new OpError('NOT_FOUND', `Node not found: ${path}`);
+    if (rev != null && node.$rev != null && rev !== node.$rev)
+        throw new OpError('CONFLICT', `Stale revision: expected ${rev}, got ${node.$rev}`);
+    node[name] = data;
+    await store.set(node);
+}
+// ── applyTemplate: copy template children to target path ──
+export async function applyTemplate(store, templatePath, targetPath) {
+    const tmpl = await store.get(templatePath);
+    if (!tmpl)
+        throw new OpError('NOT_FOUND', `Template not found: ${templatePath}`);
+    const { items: blocks } = await store.getChildren(templatePath);
+    const { items: existing } = await store.getChildren(targetPath);
+    for (const child of existing)
+        await store.remove(child.$path);
+    for (const block of blocks) {
+        const bname = block.$path.slice(block.$path.lastIndexOf('/') + 1);
+        const bpath = targetPath === '/' ? `/${bname}` : `${targetPath}/${bname}`;
+        const { $rev, ...rest } = block;
+        await store.set({ ...rest, $path: bpath });
+    }
+    return { applied: tmpl.$path, blocks: blocks.length };
+}
+// ── Generic patch action — deep merge data into node (Immer draft) ──
+// Registered on 'default' so every type inherits it via resolve fallback.
+// Guards $ fields. Deep-merges objects, replaces arrays/primitives.
+function deepAssign(target, source) {
+    for (const [k, v] of Object.entries(source)) {
+        if (k.startsWith('$'))
+            continue;
+        if (v && typeof v === 'object' && !Array.isArray(v)
+            && target[k] && typeof target[k] === 'object' && !Array.isArray(target[k])) {
+            deepAssign(target[k], v);
+        }
+        else {
+            target[k] = v;
+        }
+    }
+}
+export function registerBuiltinActions() {
+    register('default', 'action:patch', (ctx, data) => {
+        if (!data || typeof data !== 'object')
+            throw new OpError('BAD_REQUEST', 'patch: data must be an object');
+        deepAssign(ctx.node, data);
+    });
+}
+registerBuiltinActions();
+//# sourceMappingURL=actions.js.map

package/dist/server/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,0DAA0D;AAC1D,yCAAyC;AAEzC,OAAO,EAAE,KAAK,EAAc,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAiC,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,WAAW,IAAI,YAAY,EAAqB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAsB,iBAAiB,EAAE,WAAW,EAAiB,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE7G,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAc,MAAM,OAAO,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAmBnC,MAAM,UAAU,gBAAgB,CAC9B,OAAkB,EAClB,MAAgB,EAChB,OAAgD;IAEhD,OAAO,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,CAAmB,GAAa,EAAE,GAAY;YAC/C,OAAO,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAwB,CAAC;QACxG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AACD,0FAA0F;AAC1F,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,KAAW;IAC1C,OAAO,gBAAgB,CACrB,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAC5F,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,+BAA+B;AAC/B,yEAAyE;AACzE,8EAA8E;AAC9E,aAAa,EAAE,CAAC;AAEhB,4DAA4D;AAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC;AACrE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC;AAiBrE,gFAAgF;AAChF,mEAAmE;AACnE,qFAAqF;AACrF,KAAK,UAAU,iBAAiB,CAC9B,KAAW,EAAE,IAAY,EAAE,MAAc;IAEzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAI,QAAgB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,UAAU,OAAO,CACrC,CAAC;QAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,UAAU,IAAI,GAAG,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,mCAAmC,MAAM,UAAU,IAAI,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAW,EACX,IAAY,EACZ,aAAiC,EACjC,YAAgC,EAChC,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,aAAa,IAAI,OAAO,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;IAC/F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,cAAc,YAAY,IAAI,aAAa,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAE5H,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;IAExB,IAAI,IAAI,GAAiB,MAAM,YAAY,CAAC,IAAI,EAAE,QAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAE5E,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;IAEhD,iEAAiE;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,cAAc,MAAM,eAAe,IAAI,GAAG,CAAC,CAAC;IAE3F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,uEAAuE;AAEvE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAW,EACX,IAAY,EACZ,aAAiC,EACjC,YAAgC,EAChC,MAAc,EACd,IAAc;IAEd,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,oBAAoB,CACxE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,CACjD,CAAC;IAEF,mDAAmD;IACnD,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAuB,CAAC;IACpE,MAAM,YAAY,GAAG,aAAa,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAa,YAAY,EAAE,GAAG,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAAa,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAA4B,CAAC,CAAC,CAAC,IAA+B,CAAC;IAEtG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC;IACvH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IAE/C,IAAI,OAAO,GAAY,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,OAAO,GAAG,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAA4B,CAAC,CAAC,CAAC,QAAmC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAc,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,aAAa,CAClC,KAAW,EACX,IAAY,EACZ,aAAiC,EACjC,YAAgC,EAChC,MAAc,EACd,IAAc,EACd,MAAoB;IAEpB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CAC9D,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,CACjD,CAAC;IACF,wFAAwF;IACxF,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC;IAC/G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,OAAQ,MAAc,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU;QACxE,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,WAAW,MAAM,sBAAsB,CAAC,CAAC;IAC5E,KAAK,CAAC,CAAC,MAAgC,CAAC;AAC1C,CAAC;AAED,uDAAuD;AAEvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAW,EACX,IAAY,EACZ,IAAY,EACZ,IAA6B,EAC7B,GAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAErE,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI;QACvD,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,4BAA4B,GAAG,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAErF,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClB,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,6DAA6D;AAE7D,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAW,EACX,YAAoB,EACpB,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,uBAAuB,YAAY,EAAE,CAAC,CAAC;IAEjF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAEhE,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,EAAE,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,0EAA0E;AAC1E,oEAAoE;AAEpE,SAAS,UAAU,CAAC,MAAW,EAAE,MAA+B;IAC9D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;eAC9C,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC,GAAc,EAAE,IAAa,EAAE,EAAE;QACpE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACzG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,IAA+B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sBAAsB,EAAE,CAAC"}

package/dist/server/agent.d.ts

@@ -0,0 +1,6 @@
+export declare const AGENT_SESSION_TTL: number;
+/** SHA-256 hex hash — fast, sufficient for high-entropy agent keys */
+export declare function hashAgentKey(key: string): string;
+/** Constant-time comparison of two hex hashes */
+export declare function timingSafeCompare(a: string, b: string): boolean;
+//# sourceMappingURL=agent.d.ts.map

package/dist/server/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/server/agent.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,iBAAiB,QAA0B,CAAC;AAEzD,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,iDAAiD;AACjD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAG/D"}

package/dist/server/agent.js

@@ -0,0 +1,15 @@
+// Agent Port — TOFU (Trust On First Use) connection system
+// Utilities for agent key hashing and session management.
+import { createHash, timingSafeEqual } from 'node:crypto';
+export const AGENT_SESSION_TTL = 7 * 24 * 60 * 60 * 1000; // 7 days
+/** SHA-256 hex hash — fast, sufficient for high-entropy agent keys */
+export function hashAgentKey(key) {
+    return createHash('sha256').update(key).digest('hex');
+}
+/** Constant-time comparison of two hex hashes */
+export function timingSafeCompare(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+}
+//# sourceMappingURL=agent.js.map

package/dist/server/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/server/agent.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,0DAA0D;AAE1D,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAEnE,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/server/auth.d.ts

@@ -0,0 +1,39 @@
+import { type ComponentData, type GroupPerm, type NodeData } from '#core';
+import { type Tree } from '#tree';
+export type AclHandler = () => GroupPerm[];
+declare module '#core/context' {
+    interface ContextHandlers {
+        acl: AclHandler;
+    }
+}
+export type Session = {
+    userId: string;
+    claims?: string[];
+};
+export declare function createSession(store: Tree, userId: string, opts?: {
+    ttlMs?: number;
+    claims?: string[];
+}): Promise<string>;
+export declare function resolveToken(store: Tree, token: string): Promise<Session | null>;
+export declare function revokeSession(store: Tree, token: string): Promise<boolean>;
+export declare function hashPassword(password: string): Promise<string>;
+export declare const DUMMY_HASH: string;
+export declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+export declare function ancestorPaths(path: string): string[];
+type AclState = {
+    groupPerms: Map<string, number>;
+    denied: Set<string>;
+    deniedBits: Map<string, number>;
+    owner: string | undefined;
+};
+export declare function resolvePermission(store: Tree, path: string, userId: string | null, claims: string[], cache?: Map<string, number>, nodeCache?: Map<string, NodeData | null>, stateCache?: Map<string, AclState>): Promise<number>;
+export declare function componentPerm(comp: ComponentData, userId: string | null, claims: string[], owner: string | undefined): number;
+export declare function stripComponents(node: NodeData, userId: string | null, claims: string[]): NodeData;
+export declare function buildClaims(store: Tree, userId: string): Promise<string[]>;
+export type AclStore = Tree & {
+    /** Cached after get/getChildren — O(1) for already-resolved paths */
+    getPerm(path: string): Promise<number>;
+};
+export declare function withAcl(rawStore: Tree, userId: string | null, claims: string[]): AclStore;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,SAAS,EAEd,KAAK,QAAQ,EAId,MAAM,OAAO,CAAC;AACf,OAAO,EAAY,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC;AAG5C,MAAM,MAAM,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC;AAE3C,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,eAAe;QACvB,GAAG,EAAE,UAAU,CAAC;KACjB;CACF;AAID,MAAM,MAAM,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAS5D,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,EACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3C,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAatF;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhF;AAID,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpE;AAGD,eAAO,MAAM,UAAU,QAA0E,CAAC;AAElG,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASrF;AAID,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD;AAMD,KAAK,QAAQ,GAAG;IACd,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,CAAC;AAkBF,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,IAAI,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC,EACxC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,CAkEjB;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,EAAE,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAiCR;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAajG;AAID,wBAAsB,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUhF;AAID,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG;IAC5B,qEAAqE;IACrE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;AAEF,wBAAgB,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAgGzF"}

package/dist/server/auth.js

@@ -0,0 +1,336 @@
+// Treenity Auth — ACL on nodes
+// Group-based permissions, tree inheritance, deny-is-sticky.
+// Tree wrapper: resolves ACL per path, strips forbidden components.
+import { A, isComponent, R, resolve as resolveHandler, W, } from '#core';
+import { paginate } from '#tree';
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+// ── Sessions (store-backed, /auth/sessions/{token}) ──
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+export async function createSession(store, userId, opts) {
+    const token = randomBytes(32).toString('hex');
+    const now = Date.now();
+    const sessionNode = {
+        $path: `/auth/sessions/${token}`, $type: 'session',
+        userId, createdAt: now, expiresAt: now + (opts?.ttlMs ?? SESSION_TTL_MS),
+        ...(opts?.claims && { claims: opts.claims }),
+    };
+    await store.set(sessionNode);
+    return token;
+}
+export async function resolveToken(store, token) {
+    const node = await store.get(`/auth/sessions/${token}`);
+    if (!node)
+        return null;
+    if (!node.userId || !node.expiresAt) {
+        console.error(`[auth] corrupt session: ${token} (missing userId or expiresAt)`);
+        await store.remove(`/auth/sessions/${token}`);
+        return null;
+    }
+    if (Date.now() > node.expiresAt) {
+        await store.remove(`/auth/sessions/${token}`);
+        return null;
+    }
+    return { userId: node.userId, ...(node.claims && { claims: node.claims }) };
+}
+export async function revokeSession(store, token) {
+    return store.remove(`/auth/sessions/${token}`);
+}
+// ── Password hashing ──
+export async function hashPassword(password) {
+    const salt = randomBytes(16);
+    const key = await new Promise((resolve, reject) => scrypt(password, salt, 64, (err, key) => (err ? reject(err) : resolve(key))));
+    return salt.toString('hex') + ':' + key.toString('hex');
+}
+// Pre-computed dummy hash for constant-time login (prevents timing-based user enumeration)
+export const DUMMY_HASH = randomBytes(16).toString('hex') + ':' + randomBytes(64).toString('hex');
+export async function verifyPassword(password, hash) {
+    const [saltHex, keyHex] = hash.split(':');
+    if (!saltHex || !keyHex)
+        throw new Error('Malformed password hash');
+    const salt = Buffer.from(saltHex, 'hex');
+    const stored = Buffer.from(keyHex, 'hex');
+    const key = await new Promise((resolve, reject) => scrypt(password, salt, 64, (err, key) => (err ? reject(err) : resolve(key))));
+    return timingSafeEqual(stored, key);
+}
+// ── Path utils ──
+export function ancestorPaths(path) {
+    if (path === '/')
+        return ['/'];
+    const parts = path.split('/').filter(Boolean);
+    const result = ['/'];
+    let current = '';
+    for (const part of parts) {
+        current += '/' + part;
+        result.push(current);
+    }
+    return result;
+}
+function cloneAclState(s) {
+    return {
+        groupPerms: new Map(s.groupPerms),
+        denied: new Set(s.denied),
+        deniedBits: new Map(s.deniedBits),
+        owner: s.owner,
+    };
+}
+// Walk ancestors, carry forward per-group.
+// p=0: deny all (sticky), p<0: deny bits (sticky), p>0: allow bits.
+// "owner" pseudo-group: matches if userId === $owner on node (or inherited).
+//
+// nodeCache: avoids re-fetching already-seen nodes (keyed by path, null = not found)
+// stateCache: accumulated ACL state at each tree level — on sibling paths, start
+//   from the deepest cached ancestor instead of walking from root again.
+export async function resolvePermission(store, path, userId, claims, cache, nodeCache, stateCache) {
+    if (cache?.has(path))
+        return cache.get(path);
+    const ancestors = ancestorPaths(path);
+    // Start from deepest cached ancestor state (skip already-accumulated prefix)
+    let startIdx = 0;
+    let state = { groupPerms: new Map(), denied: new Set(), deniedBits: new Map(), owner: undefined };
+    if (stateCache) {
+        for (let i = ancestors.length - 1; i >= 0; i--) {
+            const cached = stateCache.get(ancestors[i]);
+            if (cached) {
+                state = cloneAclState(cached);
+                startIdx = i + 1;
+                break;
+            }
+        }
+    }
+    for (let i = startIdx; i < ancestors.length; i++) {
+        const p = ancestors[i];
+        let node;
+        if (nodeCache?.has(p)) {
+            node = nodeCache.get(p);
+        }
+        else {
+            const fetched = await store.get(p);
+            node = fetched ?? null;
+            nodeCache?.set(p, node);
+        }
+        if (node) {
+            if (node.$owner)
+                state.owner = node.$owner;
+            if (node.$acl) {
+                for (const { g, p: perm } of node.$acl) {
+                    const matches = g === 'owner' ? userId !== null && userId === state.owner : claims.includes(g);
+                    if (!matches)
+                        continue;
+                    if (state.denied.has(g))
+                        continue;
+                    if (perm < 0) {
+                        // Sticky deny specific bits
+                        const bits = -perm;
+                        state.deniedBits.set(g, (state.deniedBits.get(g) || 0) | bits);
+                    }
+                    else if (perm === 0) {
+                        // Deny all (sticky)
+                        state.denied.add(g);
+                        state.groupPerms.set(g, 0);
+                    }
+                    else {
+                        // Allow bits, mask out denied
+                        const allowed = perm & ~(state.deniedBits.get(g) || 0);
+                        state.groupPerms.set(g, allowed);
+                    }
+                }
+            }
+        }
+        // Cache accumulated state at this level — future sibling paths start here
+        stateCache?.set(p, cloneAclState(state));
+    }
+    let effective = 0;
+    for (const v of state.groupPerms.values()) {
+        if (v > effective)
+            effective = v;
+    }
+    cache?.set(path, effective);
+    return effective;
+}
+// ── Component ACL ──
+export function componentPerm(comp, userId, claims, owner) {
+    const typeAcl = resolveHandler(comp.$type, 'acl');
+    const acls = [];
+    if (typeAcl)
+        acls.push(typeAcl());
+    if (comp.$acl)
+        acls.push(comp.$acl);
+    if (acls.length === 0)
+        return R | W | A; // no ACL = full access
+    let effective = R | W | A;
+    for (const aclList of acls) {
+        const groupPerms = new Map();
+        const deniedBits = new Map();
+        for (const { g, p } of aclList) {
+            const matches = g === 'owner' ? userId !== null && userId === owner : claims.includes(g);
+            if (!matches)
+                continue;
+            if (p < 0) {
+                // Sticky deny specific bits
+                const bits = -p;
+                deniedBits.set(g, (deniedBits.get(g) || 0) | bits);
+            }
+            else if (p === 0) {
+                groupPerms.set(g, 0);
+            }
+            else {
+                // Allow bits, mask out denied
+                const allowed = p & ~(deniedBits.get(g) || 0);
+                groupPerms.set(g, allowed);
+            }
+        }
+        let best = 0;
+        for (const p of groupPerms.values()) {
+            if (p > best)
+                best = p;
+        }
+        effective &= best;
+    }
+    return effective;
+}
+export function stripComponents(node, userId, claims) {
+    const out = { $path: node.$path, $type: node.$type };
+    if (node.$acl)
+        out.$acl = node.$acl;
+    if (node.$owner)
+        out.$owner = node.$owner;
+    if (node.$rev !== undefined)
+        out.$rev = node.$rev;
+    if ('$ref' in node)
+        out['$ref'] = node['$ref'];
+    if ('$patches' in node)
+        out['$patches'] = node['$patches'];
+    for (const [key, val] of Object.entries(node)) {
+        if (key.startsWith('$'))
+            continue;
+        if (!isComponent(val)) {
+            out[key] = val;
+            continue;
+        }
+        if (componentPerm(val, userId, claims, node.$owner) & R)
+            out[key] = val;
+    }
+    return out;
+}
+// ── Build claims ──
+export async function buildClaims(store, userId) {
+    const group = userId.startsWith('anon:') ? 'public' : 'authenticated';
+    const claims = [`u:${userId}`, group];
+    const userNode = await store.get(`/auth/users/${userId}`);
+    if (userNode) {
+        const gv = userNode['groups'];
+        const groups = isComponent(gv) ? gv : undefined;
+        if (Array.isArray(groups?.['list']))
+            claims.push(...groups['list']);
+    }
+    return claims;
+}
+export function withAcl(rawStore, userId, claims) {
+    const cache = new Map();
+    // stateCache: accumulated ACL state per tree level — avoids re-walking shared ancestors
+    // within a single request. nodeCache is handled by withCache in the store pipeline.
+    const stateCache = new Map();
+    async function getPerm(path) {
+        return resolvePermission(rawStore, path, userId, claims, cache, undefined, stateCache);
+    }
+    return {
+        getPerm,
+        async get(path, ctx) {
+            const perm = await getPerm(path);
+            if (!(perm & R))
+                return undefined;
+            const node = await rawStore.get(path, ctx);
+            if (!node)
+                return undefined;
+            const out = stripComponents(node, userId, claims);
+            if (!(perm & A)) {
+                delete out.$acl;
+                delete out.$owner;
+            }
+            return out;
+        },
+        async getChildren(path, opts, ctx) {
+            const MAX_ACL_SCAN = 10_000;
+            // Fetch up to limit from underlying — ACL filters first, then paginate
+            const raw = await rawStore.getChildren(path, { depth: opts?.depth, limit: MAX_ACL_SCAN }, ctx);
+            if (raw.items.length >= MAX_ACL_SCAN) {
+                console.warn(`[acl] getChildren(${path}): hit scan limit ${MAX_ACL_SCAN}, results may be incomplete`);
+            }
+            const filtered = [];
+            for (const child of raw.items) {
+                const perm = await getPerm(child.$path);
+                if (!(perm & R))
+                    continue;
+                const out = stripComponents(child, userId, claims);
+                if (!(perm & A)) {
+                    delete out.$acl;
+                    delete out.$owner;
+                }
+                filtered.push(out);
+            }
+            // Preserve queryMount for CDC Matrix (sub.ts active query registration)
+            const result = paginate(filtered, opts);
+            if (raw.queryMount)
+                result.queryMount = raw.queryMount;
+            return result;
+        },
+        async set(node, ctx) {
+            const perm = await getPerm(node.$path);
+            if (!(perm & W))
+                throw new Error(`Access denied: ${node.$path}`);
+            const existing = await rawStore.get(node.$path, ctx);
+            const safe = { ...node };
+            // Non-admin: preserve existing $acl/$owner
+            if (!(perm & A)) {
+                if (existing?.$acl)
+                    safe.$acl = existing.$acl;
+                else
+                    delete safe.$acl;
+                if (existing?.$owner)
+                    safe.$owner = existing.$owner;
+                else
+                    delete safe.$owner;
+            }
+            // Protect components: if user lacks W on a component, keep old value
+            const owner = safe.$owner ?? existing?.$owner;
+            for (const [key, val] of Object.entries(safe)) {
+                if (key.startsWith('$'))
+                    continue;
+                if (!isComponent(val))
+                    continue;
+                if (!(componentPerm(val, userId, claims, owner) & W)) {
+                    // User can't write this component — restore old value or remove
+                    if (existing && key in existing)
+                        safe[key] = existing[key];
+                    else
+                        delete safe[key];
+                }
+            }
+            // Also restore protected components the user may have omitted
+            if (existing) {
+                for (const [key, val] of Object.entries(existing)) {
+                    if (key.startsWith('$'))
+                        continue;
+                    if (!isComponent(val))
+                        continue;
+                    if (!(componentPerm(val, userId, claims, owner) & W) && !(key in safe))
+                        safe[key] = val;
+                }
+            }
+            return rawStore.set(safe, ctx);
+        },
+        async remove(path, ctx) {
+            const perm = await getPerm(path);
+            if (!(perm & W))
+                throw new Error(`Access denied: ${path}`);
+            return rawStore.remove(path, ctx);
+        },
+        async patch(path, ops, ctx) {
+            const perm = await getPerm(path);
+            if (!(perm & W))
+                throw new Error(`Access denied: ${path}`);
+            return rawStore.patch(path, ops, ctx);
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/server/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,6DAA6D;AAC7D,oEAAoE;AAEpE,OAAO,EACL,CAAC,EAGD,WAAW,EAEX,CAAC,EACD,OAAO,IAAI,cAAc,EACzB,CAAC,GACF,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,QAAQ,EAAa,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiBnE,wDAAwD;AAExD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAEvD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAW,EACX,MAAc,EACd,IAA4C;IAE5C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,WAAW,GAAgB;QAC/B,KAAK,EAAE,kBAAkB,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS;QAClD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,cAAc,CAAC;QACxE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAW,EAAE,KAAa;IAC3D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,CAA4B,CAAC;IACnF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,2BAA2B,KAAK,gCAAgC,CAAC,CAAC;QAChF,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAW,EAAE,KAAa;IAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,yBAAyB;AAEzB,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACxD,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAElG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IACjE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACxD,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,mBAAmB;AAEnB,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,GAAG,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD,SAAS,aAAa,CAAC,CAAW;IAChC,OAAO;QACL,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,oEAAoE;AACpE,6EAA6E;AAC7E,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAW,EACX,IAAY,EACZ,MAAqB,EACrB,MAAgB,EAChB,KAA2B,EAC3B,SAAwC,EACxC,UAAkC;IAElC,IAAI,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAE9C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEtC,6EAA6E;IAC7E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,KAAK,GAAa,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE5G,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9B,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAEvB,IAAI,IAAiC,CAAC;QACtC,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,OAAO,IAAI,IAAI,CAAC;YACvB,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACvC,MAAM,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;oBAC/F,IAAI,CAAC,OAAO;wBAAE,SAAS;oBACvB,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;wBAAE,SAAS;oBAClC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;wBACb,4BAA4B;wBAC5B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC;wBACnB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;oBACjE,CAAC;yBAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;wBACtB,oBAAoB;wBACpB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACpB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC7B,CAAC;yBAAM,CAAC;wBACN,8BAA8B;wBAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;wBACvD,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,GAAG,SAAS;YAAE,SAAS,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sBAAsB;AAEtB,MAAM,UAAU,aAAa,CAC3B,IAAmB,EACnB,MAAqB,EACrB,MAAgB,EAChB,KAAyB;IAEzB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB;IAEhE,IAAI,SAAS,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACV,4BAA4B;gBAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC;gBAChB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,8BAA8B;gBAC9B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9C,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI;gBAAE,IAAI,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,SAAS,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,MAAqB,EAAE,MAAgB;IACrF,MAAM,GAAG,GAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAClD,IAAI,MAAM,IAAI,IAAI;QAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,UAAU,IAAI,IAAI;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YAAC,SAAS;QAAC,CAAC;QACpD,IAAI,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qBAAqB;AAErB,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAW,EAAE,MAAc;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,KAAK,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,MAAM,UAAU,OAAO,CAAC,QAAc,EAAE,MAAqB,EAAE,MAAgB;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,wFAAwF;IACxF,oFAAoF;IACpF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,UAAU,OAAO,CAAC,IAAY;QACjC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACzF,CAAC;IAED,OAAO;QACL,OAAO;QACP,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG;YACjB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChB,OAAO,GAAG,CAAC,IAAI,CAAC;gBAChB,OAAO,GAAG,CAAC,MAAM,CAAC;YACpB,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC/B,MAAM,YAAY,GAAG,MAAM,CAAC;YAC5B,uEAAuE;YACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/F,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,YAAY,6BAA6B,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,QAAQ,GAAe,EAAE,CAAC;YAChC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;oBAAE,SAAS;gBAC1B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACnD,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChB,OAAO,GAAG,CAAC,IAAI,CAAC;oBAChB,OAAO,GAAG,CAAC,MAAM,CAAC;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;YACD,wEAAwE;YACxE,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,UAAU;gBAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;YACvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG;YACjB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACzB,2CAA2C;YAC3C,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChB,IAAI,QAAQ,EAAE,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;;oBACzC,OAAO,IAAI,CAAC,IAAI,CAAC;gBACtB,IAAI,QAAQ,EAAE,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;;oBAC/C,OAAO,IAAI,CAAC,MAAM,CAAC;YAC1B,CAAC;YACD,qEAAqE;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,MAAM,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAChC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACrD,gEAAgE;oBAChE,IAAI,QAAQ,IAAI,GAAG,IAAI,QAAQ;wBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;;wBACtD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YACD,8DAA8D;YAC9D,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;wBAAE,SAAS;oBAChC,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBACpE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;YACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;YACxB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}