happy2 0.0.12 → 0.0.14

package/packages/happy2-server/dist/modules/permission/userPermissionGet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionGet.js","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionGet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,QAAyB,EACzB,KAA8C;IAM9C,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7E,MAAM,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ;aACH,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;aAClD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,QAAQ;aACH,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;aACpC,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,GAAG,CACrB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAwB,CAAC,CAC/D,CAAC;IACF,OAAO;QACH,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC;QAC7C,SAAS;KACZ,CAAC;AACN,CAAC"}

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { Permission, PermissionMutation } from "./types.js";
+/**
+ * Replaces an active user's complete userPermissions allow-list without altering grants inherited from assigned roles.
+ * The replacement and targeted invalidation share one transaction so `/v0/me` can be safely refetched as soon as clients receive the hint.
+ */
+export declare function userPermissionUpdate(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+    permissions: Permission[];
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=userPermissionUpdate.d.ts.map

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionUpdate.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionUpdate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGjE;;;GAGG;AACH,wBAAsB,oBAAoB,CACtC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAC1E,OAAO,CAAC,kBAAkB,CAAC,CAiC7B"}

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.js

@@ -0,0 +1,44 @@
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { withTransaction } from "../drizzle.js";
+import { userPermissions } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Replaces an active user's complete userPermissions allow-list without altering grants inherited from assigned roles.
+ * The replacement and targeted invalidation share one transaction so `/v0/me` can be safely refetched as soon as clients receive the hint.
+ */
+export async function userPermissionUpdate(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        await userRequireActiveHuman(tx, input.userId);
+        const before = await tx
+            .select({ permission: userPermissions.permission })
+            .from(userPermissions)
+            .where(eq(userPermissions.userId, input.userId));
+        await tx.delete(userPermissions).where(eq(userPermissions.userId, input.userId));
+        if (input.permissions.length)
+            await tx.insert(userPermissions).values(input.permissions.map((permission) => ({
+                userId: input.userId,
+                permission,
+                grantedByUserId: input.actorUserId,
+            })));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "user.permissions_updated",
+            targetType: "user",
+            targetId: input.userId,
+            before: { permissions: before.map(({ permission }) => permission) },
+            after: { permissions: input.permissions },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [input.userId],
+            broadcast: false,
+            entityId: input.userId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=userPermissionUpdate.js.map

package/packages/happy2-server/dist/modules/permission/userPermissionUpdate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userPermissionUpdate.js","sourceRoot":"","sources":["../../../sources/modules/permission/userPermissionUpdate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,QAAyB,EACzB,KAAyE;IAEzE,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC;aAClD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU;gBACV,eAAe,EAAE,KAAK,CAAC,WAAW;aACrC,CAAC,CAAC,CACN,CAAC;QACN,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;YACnE,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SAC5C,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { Permission } from "./types.js";
+/**
+ * Requires at least one permission from an explicit set for shared read surfaces used by adjacent management capabilities.
+ * The owner remains allow-all, while ordinary users must receive one listed grant directly or through a role.
+ */
+export declare function userRequireAnyPermission(executor: DrizzleExecutor, userId: string, required: readonly Permission[]): Promise<void>;
+//# sourceMappingURL=userRequireAnyPermission.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequireAnyPermission.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRequireAnyPermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAsB,wBAAwB,CAC1C,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,UAAU,EAAE,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.js

@@ -0,0 +1,12 @@
+import { CollaborationError } from "../chat/types.js";
+import { permissionEffectiveDb } from "./impl/permissionEffectiveDb.js";
+/**
+ * Requires at least one permission from an explicit set for shared read surfaces used by adjacent management capabilities.
+ * The owner remains allow-all, while ordinary users must receive one listed grant directly or through a role.
+ */
+export async function userRequireAnyPermission(executor, userId, required) {
+    const effective = await permissionEffectiveDb(executor, userId);
+    if (!effective || !required.some((permission) => effective.allowed.includes(permission)))
+        throw new CollaborationError("forbidden", `${required.join(" or ")} permission is required`);
+}
+//# sourceMappingURL=userRequireAnyPermission.js.map

package/packages/happy2-server/dist/modules/permission/userRequireAnyPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequireAnyPermission.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRequireAnyPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,QAAyB,EACzB,MAAc,EACd,QAA+B;IAE/B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACpF,MAAM,IAAI,kBAAkB,CACxB,WAAW,EACX,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,yBAAyB,CACpD,CAAC;AACV,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRequirePermission.d.ts

@@ -0,0 +1,8 @@
+import type { DrizzleExecutor } from "../drizzle.js";
+import type { Permission } from "./types.js";
+/**
+ * Requires one effective permission from an active human user, treating the durable server owner as an explicit allow-all principal.
+ * Centralizing this check prevents feature routes from confusing legacy administrator labels with narrowly delegated authority.
+ */
+export declare function userRequirePermission(executor: DrizzleExecutor, userId: string, permission: Permission): Promise<void>;
+//# sourceMappingURL=userRequirePermission.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRequirePermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequirePermission.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRequirePermission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;GAGG;AACH,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/packages/happy2-server/dist/modules/permission/userRequirePermission.js

@@ -0,0 +1,12 @@
+import { CollaborationError } from "../chat/types.js";
+import { permissionEffectiveDb } from "./impl/permissionEffectiveDb.js";
+/**
+ * Requires one effective permission from an active human user, treating the durable server owner as an explicit allow-all principal.
+ * Centralizing this check prevents feature routes from confusing legacy administrator labels with narrowly delegated authority.
+ */
+export async function userRequirePermission(executor, userId, permission) {
+    const effective = await permissionEffectiveDb(executor, userId);
+    if (!effective?.allowed.includes(permission))
+        throw new CollaborationError("forbidden", `${permission} permission is required`);
+}
+//# sourceMappingURL=userRequirePermission.js.map

package/packages/happy2-server/dist/modules/permission/userRequirePermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRequirePermission.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRequirePermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAyB,EACzB,MAAc,EACd,UAAsB;IAEtB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,UAAU,yBAAyB,CAAC,CAAC;AAC1F,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRoleAssign.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PermissionMutation } from "./types.js";
+/**
+ * Inserts one userRoles assignment for an active human user, synchronizing users when the durable admin marker is assigned.
+ * The grant, audit record, and targeted permission invalidation commit atomically so authorization never changes silently.
+ */
+export declare function userRoleAssign(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+    roleId: string;
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=userRoleAssign.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRoleAssign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleAssign.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleAssign.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CA+B7B"}

package/packages/happy2-server/dist/modules/permission/userRoleAssign.js

@@ -0,0 +1,46 @@
+import { eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { CollaborationError } from "../chat/types.js";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { withTransaction } from "../drizzle.js";
+import { roles, userRoles, users } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Inserts one userRoles assignment for an active human user, synchronizing users when the durable admin marker is assigned.
+ * The grant, audit record, and targeted permission invalidation commit atomically so authorization never changes silently.
+ */
+export async function userRoleAssign(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        await userRequireActiveHuman(tx, input.userId);
+        const [role] = await tx.select().from(roles).where(eq(roles.id, input.roleId)).limit(1);
+        if (!role)
+            throw new CollaborationError("not_found", "Role was not found");
+        await tx
+            .insert(userRoles)
+            .values({
+            userId: input.userId,
+            roleId: input.roleId,
+            assignedByUserId: input.actorUserId,
+        })
+            .onConflictDoNothing();
+        if (role.builtinKind === "admin")
+            await tx.update(users).set({ role: "admin" }).where(eq(users.id, input.userId));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "user.role_assigned",
+            targetType: "user",
+            targetId: input.userId,
+            after: { roleId: input.roleId },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [input.userId],
+            broadcast: false,
+            entityId: input.userId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=userRoleAssign.js.map

package/packages/happy2-server/dist/modules/permission/userRoleAssign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleAssign.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleAssign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,KAA8D;IAE9D,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3E,MAAM,EAAE;aACH,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,WAAW;SACtC,CAAC;aACD,mBAAmB,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;YAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,oBAAoB;YAC5B,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SAClC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/permission/userRoleUnassign.d.ts

@@ -0,0 +1,12 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import type { PermissionMutation } from "./types.js";
+/**
+ * Deletes one userRoles assignment while preserving universal member membership and the owner's built-in administrator membership.
+ * Removing the admin marker also updates the coarse user projection before emitting the targeted permission invalidation.
+ */
+export declare function userRoleUnassign(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    userId: string;
+    roleId: string;
+}): Promise<PermissionMutation>;
+//# sourceMappingURL=userRoleUnassign.d.ts.map

package/packages/happy2-server/dist/modules/permission/userRoleUnassign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleUnassign.d.ts","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleUnassign.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAGtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD;;;GAGG;AACH,wBAAsB,gBAAgB,CAClC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,kBAAkB,CAAC,CAyC7B"}

package/packages/happy2-server/dist/modules/permission/userRoleUnassign.js

@@ -0,0 +1,53 @@
+import { and, eq } from "drizzle-orm";
+import { chatAppendAudit } from "../chat/chatAppendAudit.js";
+import { CollaborationError } from "../chat/types.js";
+import { userRequireActiveHuman } from "../chat/userRequireActiveHuman.js";
+import { withTransaction } from "../drizzle.js";
+import { roles, serverSetupState, userRoles, users } from "../schema.js";
+import { permissionMutationRecord } from "./impl/permissionMutationRecord.js";
+import { userRequirePermission } from "./userRequirePermission.js";
+/**
+ * Deletes one userRoles assignment while preserving universal member membership and the owner's built-in administrator membership.
+ * Removing the admin marker also updates the coarse user projection before emitting the targeted permission invalidation.
+ */
+export async function userRoleUnassign(executor, input) {
+    return withTransaction(executor, async (tx) => {
+        await userRequirePermission(tx, input.actorUserId, "manageAdminRoles");
+        await userRequireActiveHuman(tx, input.userId);
+        const [role] = await tx.select().from(roles).where(eq(roles.id, input.roleId)).limit(1);
+        if (!role)
+            throw new CollaborationError("not_found", "Role was not found");
+        if (role.builtinKind === "member")
+            throw new CollaborationError("invalid", "The built-in member role is required");
+        if (role.builtinKind === "admin") {
+            if (input.actorUserId === input.userId)
+                throw new CollaborationError("invalid", "An administrator cannot demote themselves");
+            const [setup] = await tx
+                .select({ ownerUserId: serverSetupState.bootstrapAdminUserId })
+                .from(serverSetupState)
+                .where(eq(serverSetupState.id, 1));
+            if (setup?.ownerUserId === input.userId)
+                throw new CollaborationError("invalid", "The owner must remain an administrator");
+        }
+        await tx
+            .delete(userRoles)
+            .where(and(eq(userRoles.userId, input.userId), eq(userRoles.roleId, input.roleId)));
+        if (role.builtinKind === "admin")
+            await tx.update(users).set({ role: "member" }).where(eq(users.id, input.userId));
+        await chatAppendAudit(tx, {
+            actorUserId: input.actorUserId,
+            action: "user.role_unassigned",
+            targetType: "user",
+            targetId: input.userId,
+            before: { roleId: input.roleId },
+        });
+        return permissionMutationRecord(tx, {
+            actorUserId: input.actorUserId,
+            affectedUserIds: [input.userId],
+            broadcast: false,
+            entityId: input.userId,
+            kind: "permissions.changed",
+        });
+    });
+}
+//# sourceMappingURL=userRoleUnassign.js.map

package/packages/happy2-server/dist/modules/permission/userRoleUnassign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userRoleUnassign.js","sourceRoot":"","sources":["../../../sources/modules/permission/userRoleUnassign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,QAAyB,EACzB,KAA8D;IAE9D,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,sBAAsB,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;YAC7B,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;QACpF,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,MAAM;gBAClC,MAAM,IAAI,kBAAkB,CACxB,SAAS,EACT,2CAA2C,CAC9C,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,WAAW,EAAE,gBAAgB,CAAC,oBAAoB,EAAE,CAAC;iBAC9D,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,KAAK,EAAE,WAAW,KAAK,KAAK,CAAC,MAAM;gBACnC,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE;aACH,MAAM,CAAC,SAAS,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO;YAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,MAAM,eAAe,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,sBAAsB;YAC9B,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;SACnC,CAAC,CAAC;QACH,OAAO,wBAAwB,CAAC,EAAE,EAAE;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,eAAe,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,IAAI,EAAE,qBAAqB;SAC9B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/plugin/archive.d.ts

@@ -0,0 +1,7 @@
+export interface PluginArchiveCandidate {
+    directory: string;
+    packagePath: string;
+}
+/** Extracts only eligible plugin package roots from a bounded ZIP, rejecting links, bombs, traversal, and ambiguous generic archives. */
+export declare function pluginArchiveExtract(archive: Buffer, destination: string, kind: "github" | "zip"): Promise<PluginArchiveCandidate[]>;
+//# sourceMappingURL=archive.d.ts.map

package/packages/happy2-server/dist/modules/plugin/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/archive.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,sBAAsB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED,yIAAyI;AACzI,wBAAsB,oBAAoB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,QAAQ,GAAG,KAAK,GACvB,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAmEnC"}

package/packages/happy2-server/dist/modules/plugin/archive.js

@@ -0,0 +1,222 @@
+import { inflateRawSync } from "node:zlib";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, posix, resolve, sep } from "node:path";
+const CENTRAL_SIGNATURE = 0x02014b50;
+const END_SIGNATURE = 0x06054b50;
+const LOCAL_SIGNATURE = 0x04034b50;
+const MAX_ARCHIVE_BYTES = 50 * 1024 * 1024;
+const MAX_ENTRIES = 10_000;
+const MAX_PACKAGE_FILES = 1_000;
+const MAX_PACKAGE_BYTES = 20 * 1024 * 1024;
+const MAX_FILE_BYTES = 5 * 1024 * 1024;
+/** Extracts only eligible plugin package roots from a bounded ZIP, rejecting links, bombs, traversal, and ambiguous generic archives. */
+export async function pluginArchiveExtract(archive, destination, kind) {
+    if (archive.byteLength === 0 || archive.byteLength > MAX_ARCHIVE_BYTES)
+        throw new Error("Plugin ZIP must be between 1 byte and 50 MiB");
+    const entries = zipEntries(archive);
+    const files = entries.filter((entry) => !entry.name.endsWith("/"));
+    const wrapper = commonWrapper(entries.map(({ name }) => name));
+    const manifests = files
+        .map((entry) => ({ entry, path: stripWrapper(entry.name, wrapper) }))
+        .filter(({ path }) => path === "plugin.json" || path.endsWith("/plugin.json"));
+    let roots;
+    if (kind === "github") {
+        const root = manifests.find(({ path }) => path === "plugin.json");
+        const nested = manifests.filter(({ path }) => /^plugins\/[^/]+\/plugin\.json$/.test(path));
+        const selected = root ? [root] : nested;
+        if (selected.length === 0)
+            throw new Error("GitHub repository must contain plugin.json at its root or in plugins/<name>");
+        roots = selected.map(({ entry, path }) => ({
+            packagePath: posix.dirname(path) === "." ? "" : posix.dirname(path),
+            rawPrefix: posix.dirname(entry.name) === "." ? "" : `${posix.dirname(entry.name)}/`,
+        }));
+    }
+    else {
+        if (manifests.length !== 1)
+            throw new Error("A plugin ZIP must contain exactly one plugin.json");
+        const [{ entry, path }] = manifests;
+        roots = [
+            {
+                packagePath: posix.dirname(path) === "." ? "" : posix.dirname(path),
+                rawPrefix: posix.dirname(entry.name) === "." ? "" : `${posix.dirname(entry.name)}/`,
+            },
+        ];
+    }
+    await mkdir(destination, { recursive: true, mode: 0o700 });
+    const results = [];
+    for (const [index, root] of roots.entries()) {
+        const candidateDirectory = resolve(destination, `candidate-${index}`);
+        await mkdir(candidateDirectory, { recursive: true, mode: 0o700 });
+        const selected = files.filter(({ name }) => root.rawPrefix ? name.startsWith(root.rawPrefix) : true);
+        if (selected.length > MAX_PACKAGE_FILES)
+            throw new Error("Plugin package has too many files");
+        let totalBytes = 0;
+        const names = new Set();
+        for (const entry of selected) {
+            const relativeName = root.rawPrefix
+                ? entry.name.slice(root.rawPrefix.length)
+                : entry.name;
+            const safeName = safeRelativePath(relativeName);
+            if (!safeName || names.has(safeName))
+                throw new Error("Plugin ZIP contains duplicate or invalid package paths");
+            names.add(safeName);
+            if (entry.uncompressedSize > MAX_FILE_BYTES)
+                throw new Error(`Plugin package file is too large: ${safeName}`);
+            totalBytes += entry.uncompressedSize;
+            if (totalBytes > MAX_PACKAGE_BYTES)
+                throw new Error("Plugin package is too large");
+            const output = resolve(candidateDirectory, safeName.split("/").join(sep));
+            if (!output.startsWith(`${candidateDirectory}${sep}`))
+                throw new Error("Plugin ZIP path escapes its package directory");
+            await mkdir(dirname(output), { recursive: true, mode: 0o700 });
+            await writeFile(output, zipEntryBody(archive, entry), { mode: 0o600 });
+        }
+        results.push({ directory: candidateDirectory, packagePath: root.packagePath });
+    }
+    return results;
+}
+function zipEntries(archive) {
+    const endOffset = findEnd(archive);
+    const entryCount = archive.readUInt16LE(endOffset + 10);
+    const centralSize = archive.readUInt32LE(endOffset + 12);
+    const centralOffset = archive.readUInt32LE(endOffset + 16);
+    if (entryCount === 0xffff || centralSize === 0xffffffff || centralOffset === 0xffffffff)
+        throw new Error("ZIP64 plugin archives are not supported");
+    if (entryCount === 0 || entryCount > MAX_ENTRIES)
+        throw new Error("Plugin ZIP has an invalid number of entries");
+    if (centralOffset + centralSize > endOffset)
+        throw new Error("Plugin ZIP central directory is invalid");
+    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const result = [];
+    let offset = centralOffset;
+    for (let index = 0; index < entryCount; index += 1) {
+        if (offset + 46 > archive.byteLength || archive.readUInt32LE(offset) !== CENTRAL_SIGNATURE)
+            throw new Error("Plugin ZIP central directory is malformed");
+        const flags = archive.readUInt16LE(offset + 8);
+        const method = archive.readUInt16LE(offset + 10);
+        const nameLength = archive.readUInt16LE(offset + 28);
+        const extraLength = archive.readUInt16LE(offset + 30);
+        const commentLength = archive.readUInt16LE(offset + 32);
+        const next = offset + 46 + nameLength + extraLength + commentLength;
+        if (next > archive.byteLength)
+            throw new Error("Plugin ZIP entry is truncated");
+        if ((flags & 0x1) !== 0)
+            throw new Error("Encrypted plugin ZIP entries are not supported");
+        if (method !== 0 && method !== 8)
+            throw new Error("Plugin ZIP uses an unsupported compression method");
+        let name;
+        try {
+            name = decoder.decode(archive.subarray(offset + 46, offset + 46 + nameLength));
+        }
+        catch {
+            throw new Error("Plugin ZIP entry names must use valid UTF-8");
+        }
+        name = safeArchivePath(name);
+        const externalAttributes = archive.readUInt32LE(offset + 38);
+        const unixMode = externalAttributes >>> 16;
+        if ((unixMode & 0o170000) === 0o120000)
+            throw new Error("Plugin ZIP packages may not contain symbolic links");
+        result.push({
+            compressedSize: archive.readUInt32LE(offset + 20),
+            crc32: archive.readUInt32LE(offset + 16),
+            externalAttributes,
+            flags,
+            localOffset: archive.readUInt32LE(offset + 42),
+            method,
+            name,
+            uncompressedSize: archive.readUInt32LE(offset + 24),
+        });
+        offset = next;
+    }
+    if (offset !== centralOffset + centralSize)
+        throw new Error("Plugin ZIP central directory size does not match its entries");
+    return result;
+}
+function zipEntryBody(archive, entry) {
+    const offset = entry.localOffset;
+    if (offset + 30 > archive.byteLength || archive.readUInt32LE(offset) !== LOCAL_SIGNATURE)
+        throw new Error("Plugin ZIP local entry is malformed");
+    const nameLength = archive.readUInt16LE(offset + 26);
+    const extraLength = archive.readUInt16LE(offset + 28);
+    let localName;
+    try {
+        localName = new TextDecoder("utf-8", { fatal: true }).decode(archive.subarray(offset + 30, offset + 30 + nameLength));
+    }
+    catch {
+        throw new Error("Plugin ZIP local entry names must use valid UTF-8");
+    }
+    if (safeArchivePath(localName) !== entry.name)
+        throw new Error("Plugin ZIP local and central entry names do not match");
+    const start = offset + 30 + nameLength + extraLength;
+    const end = start + entry.compressedSize;
+    if (end > archive.byteLength)
+        throw new Error("Plugin ZIP entry data is truncated");
+    const compressed = archive.subarray(start, end);
+    let body;
+    try {
+        body =
+            entry.method === 0
+                ? Buffer.from(compressed)
+                : inflateRawSync(compressed, {
+                    maxOutputLength: Math.max(1, entry.uncompressedSize + 1),
+                });
+    }
+    catch (error) {
+        throw new Error(`Plugin ZIP entry cannot be safely decompressed: ${entry.name}`, {
+            cause: error,
+        });
+    }
+    if (body.byteLength !== entry.uncompressedSize)
+        throw new Error(`Plugin ZIP entry size is invalid: ${entry.name}`);
+    if (crc32(body) !== entry.crc32)
+        throw new Error(`Plugin ZIP entry checksum is invalid: ${entry.name}`);
+    return body;
+}
+function findEnd(archive) {
+    const minimum = Math.max(0, archive.byteLength - 65_557);
+    for (let offset = archive.byteLength - 22; offset >= minimum; offset -= 1)
+        if (archive.readUInt32LE(offset) === END_SIGNATURE) {
+            const commentLength = archive.readUInt16LE(offset + 20);
+            if (offset + 22 + commentLength === archive.byteLength)
+                return offset;
+        }
+    throw new Error("Plugin upload is not a valid ZIP archive");
+}
+function commonWrapper(names) {
+    const firstParts = names.map((name) => name.split("/", 1)[0]).filter(Boolean);
+    if (!firstParts.length || !firstParts.every((part) => part === firstParts[0]))
+        return "";
+    return names.some((name) => name === firstParts[0]) ? "" : `${firstParts[0]}/`;
+}
+function stripWrapper(name, wrapper) {
+    return wrapper && name.startsWith(wrapper) ? name.slice(wrapper.length) : name;
+}
+function safeArchivePath(value) {
+    if (!value || value.includes("\0") || value.includes("\\") || value.startsWith("/"))
+        throw new Error("Plugin ZIP contains an unsafe entry path");
+    const directory = value.endsWith("/");
+    const normalized = posix.normalize(value);
+    if (normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/"))
+        throw new Error("Plugin ZIP contains an unsafe entry path");
+    return directory && !normalized.endsWith("/") ? `${normalized}/` : normalized;
+}
+function safeRelativePath(value) {
+    if (!value || value.endsWith("/"))
+        return undefined;
+    const normalized = safeArchivePath(value);
+    return normalized === "." ? undefined : normalized;
+}
+let crcTable;
+function crc32(value) {
+    crcTable ??= Uint32Array.from({ length: 256 }, (_, index) => {
+        let current = index;
+        for (let bit = 0; bit < 8; bit += 1)
+            current = (current & 1) !== 0 ? 0xedb88320 ^ (current >>> 1) : current >>> 1;
+        return current >>> 0;
+    });
+    let result = 0xffffffff;
+    for (const byte of value)
+        result = crcTable[(result ^ byte) & 0xff] ^ (result >>> 8);
+    return (result ^ 0xffffffff) >>> 0;
+}
+//# sourceMappingURL=archive.js.map

package/packages/happy2-server/dist/modules/plugin/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../../sources/modules/plugin/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,MAAM,iBAAiB,GAAG,UAAU,CAAC;AACrC,MAAM,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAkBvC,yIAAyI;AACzI,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,OAAe,EACf,WAAmB,EACnB,IAAsB;IAEtB,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,GAAG,iBAAiB;QAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;IACnF,IAAI,KAAwD,CAAC;IAC7D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,6EAA6E,CAChF,CAAC;QACN,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;SACtF,CAAC,CAAC,CAAC;IACR,CAAC;SAAM,CAAC;QACJ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACzE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC;QACpC,KAAK,GAAG;YACJ;gBACI,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBACnE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;aACtF;SACJ,CAAC;IACN,CAAC;IAED,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,EAAE,aAAa,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACvC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB;YACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS;gBAC/B,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YACjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC9E,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpB,IAAI,KAAK,CAAC,gBAAgB,GAAG,cAAc;gBACvC,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;YACrE,UAAU,IAAI,KAAK,CAAC,gBAAgB,CAAC;YACrC,IAAI,UAAU,GAAG,iBAAiB;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,GAAG,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACrE,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3D,IAAI,UAAU,KAAK,MAAM,IAAI,WAAW,KAAK,UAAU,IAAI,aAAa,KAAK,UAAU;QACnF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,IAAI,UAAU,KAAK,CAAC,IAAI,UAAU,GAAG,WAAW;QAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,IAAI,aAAa,GAAG,WAAW,GAAG,SAAS;QACvC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,iBAAiB;YACtF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACtD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;QACpE,IAAI,IAAI,GAAG,OAAO,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3F,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACzE,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,kBAAkB,KAAK,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,QAAQ;YAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACR,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;YACjD,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;YACxC,kBAAkB;YAClB,KAAK;YACL,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;YAC9C,MAAM;YACN,IAAI;YACJ,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,GAAG,WAAW;QACtC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAe;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC;IACjC,IAAI,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,eAAe;QACpF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACtD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACD,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,GAAG,UAAU,CAAC,CAC1D,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,eAAe,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,IAAI;QACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAM,GAAG,EAAE,GAAG,UAAU,GAAG,WAAW,CAAC;IACrD,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC;IACzC,IAAI,GAAG,GAAG,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,IAAI;YACA,KAAK,CAAC,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACzB,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE;oBACvB,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,gBAAgB,GAAG,CAAC,CAAC;iBAC3D,CAAC,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,CAAC,IAAI,EAAE,EAAE;YAC7E,KAAK,EAAE,KAAK;SACf,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,gBAAgB;QAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK;QAC3B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;IACzD,KAAK,IAAI,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC;QACrE,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;YACjD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,MAAM,GAAG,EAAE,GAAG,aAAa,KAAK,OAAO,CAAC,UAAU;gBAAE,OAAO,MAAM,CAAC;QAC1E,CAAC;IACL,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;AACnF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,OAAe;IAC/C,OAAO,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,OAAO,SAAS,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;AAClF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,IAAI,QAAiC,CAAC;AAEtC,SAAS,KAAK,CAAC,KAAa;IACxB,QAAQ,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE;QACxD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;YAC/B,OAAO,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC;QACjF,OAAO,OAAO,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,UAAU,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC"}

package/packages/happy2-server/dist/modules/plugin/catalog.d.ts

@@ -1,4 +1,4 @@
-import type { PluginPackage } from "./types.js";
+import type { PluginPackage, PluginSource } from "./types.js";
 /** Immutable lookup over validated plugin packages supplied by the built-in catalog. */
 export declare class PluginCatalog {
     private readonly packages;
@@ -10,4 +10,8 @@ export declare class PluginCatalog {
 export declare function pluginCatalogLoad(root: string): Promise<PluginCatalog>;
 /** Loads one built-in package while rejecting unsafe paths, malformed manifests, invalid skills, and non-square icons. */
 export declare function pluginPackageLoad(directory: string, sourceReference?: string): Promise<PluginPackage>;
+/** Loads one downloaded package with the same validation as a built-in package without coupling its short name to an archive directory. */
+export declare function pluginPackageLoadSource(directory: string, source: PluginSource, requireDirectoryName?: boolean): Promise<PluginPackage>;
+/** Revalidates an installed package while excluding Happy's reserved writable data subtree from its immutable package digest. */
+export declare function pluginPackageLoadInstalled(directory: string, source: PluginSource, expectedShortName: string): Promise<PluginPackage>;
 //# sourceMappingURL=catalog.d.ts.map

package/packages/happy2-server/dist/modules/plugin/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/catalog.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,aAAa,EAKhB,MAAM,YAAY,CAAC;AA+BpB,wFAAwF;AACxF,qBAAa,aAAa;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAE9D,YAAY,QAAQ,EAAE,SAAS,aAAa,EAAE,EAQ7C;IAED,IAAI,IAAI,aAAa,EAAE,CAItB;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEhD;CACJ;AAED,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc5E;AAED,0HAA0H;AAC1H,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,eAAe,SAAsB,GACtC,OAAO,CAAC,aAAa,CAAC,CAwDxB"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../sources/modules/plugin/catalog.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGR,aAAa,EACb,YAAY,EAKf,MAAM,YAAY,CAAC;AA8BpB,wFAAwF;AACxF,qBAAa,aAAa;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAE9D,YAAY,QAAQ,EAAE,SAAS,aAAa,EAAE,EAQ7C;IAED,IAAI,IAAI,aAAa,EAAE,CAItB;IAED,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEhD;CACJ;AAED,qFAAqF;AACrF,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc5E;AAED,0HAA0H;AAC1H,wBAAsB,iBAAiB,CACnC,SAAS,EAAE,MAAM,EACjB,eAAe,SAAsB,GACtC,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,2IAA2I;AAC3I,wBAAsB,uBAAuB,CACzC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,oBAAoB,UAAQ,GAC7B,OAAO,CAAC,aAAa,CAAC,CAOxB;AAED,iIAAiI;AACjI,wBAAsB,0BAA0B,CAC5C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,EACpB,iBAAiB,EAAE,MAAM,GAC1B,OAAO,CAAC,aAAa,CAAC,CAKxB"}