hazo_admin 0.7.1 → 0.11.0

package/CHANGE_LOG.md

@@ -1,5 +1,65 @@
 # hazo_admin Changelog
 
+## [0.11.0] - 2026-07-04
+
+### Added
+- **"On Hold" status** — issues now have an `on_hold` status alongside `new`/`wip`/`closed`. It renders as a parked lane at the end of the active board (New → WIP → Closed → On Hold) and appears in the facet sidebar's Status filter. The `hazo_admin_issues.status` column is a bare `TEXT`/enum-free string, so no migration is required.
+- **"Assign to me" button** — each card's owner control gets a compact **Me** button. It POSTs the new `POST /issues/:id/assign-to-me`, which assigns the issue to the **authenticated actor derived from the admin gate** (never a client-supplied id), so the client needs no identity of its own to claim an issue.
+- **Age filter facet** — a single-select **Age** section in the sidebar (`Under 1 day` / `1–7 days` / `7–30 days` / `Over 30 days`), bucketed on `first_seen_at` and combined with the other facets via AND. Exposed as `ageBucket()` in `filter.ts`.
+- **Manual archive sweep** — an **Archive old** button in the panel header POSTs `POST /issues/archive-sweep`, moving closed issues older than the configured cutoff to `archived` and refreshing both boards. Restricted to **global admins** server-side (the sweep is not scope-filtered), returning `403` otherwise.
+
+- **Horizontal filter bar** — the Issues panel's facet controls moved from a fixed 240 px left rail into a single top bar (`facet_topbar.tsx`), giving the Kanban board its full width. Search sits inline; **Type**, **Severity**, and **Age** collapse to dropdown chips with active-count badges (hazo_ui `Popover`); a **Clear · N** button and **Manage types** round out the row. Status is no longer a facet here (it's already the board's columns).
+
+### Changed
+- **Owner picker → hazo_auth `UserPickerSelect`** — the per-card **Owner** control now uses the shared avatar + username dropdown from `hazo_auth/client` (≥ 10.5.0) and `GET /issues/assignees` now lists **all users** (name/email label + `profile_picture_url`) instead of only resolvable admins, so real names and profile pictures show in place of raw user ids. The picker's portalled list is pinned to `LIGHT_THEME_VARS`; the **Me** button is unchanged. Also fixes the trigger overflowing its card (missing `min-w-0` on the flex child).
+- **Free-form status transitions** — the issue state machine no longer restricts moves. Any known status may transition to any other known status (only an *unknown* target is rejected as an illegal transition), so admins can reopen a closed issue (Closed → New / In progress), park one (→ On Hold), etc. The `→ wip` auto-assign side effect is unchanged.
+- **Default archive age is now 1 month** (was 3) — both the `admin.issue_archive` job handler (`cutoffMonths` default) and `cfg.issues.archiveAfterMonths` default to `1`. Consumers running the archive job on a cron therefore auto-archive issues closed for more than a month by default.
+- **Transparency fix** — the per-card **Owner**/**Type** `Select` popovers and the **Manage issue types** dialog were rendering with a see-through background: hazo_ui portals their content to `document.body`, escaping the panel root that carries `LIGHT_THEME_VARS`, so `--popover`/`--background` resolved empty. They now carry an explicit opaque background (`bg-white`) plus the pinned light-theme vars on the portaled node.
+
+### Migrating (cron auto-archive)
+To auto-archive on a schedule, register the existing archive job with a hazo_jobs worker and schedule it (e.g. daily):
+```ts
+import { registerIssueArchiveJob, ADMIN_ISSUE_ARCHIVE_JOB_TYPE } from 'hazo_admin';
+registerIssueArchiveJob(worker, { getHazoConnect });
+// then schedule ADMIN_ISSUE_ARCHIVE_JOB_TYPE ('admin.issue_archive') via your supervisor/cron.
+```
+The manual **Archive old** button covers the same sweep on demand.
+
+## [0.10.0] - 2026-07-03
+
+### Added
+- **`IssuesPanel` is now a first-class `hazo_admin/ui` export** — consuming apps can drop the Issues triage board in directly (`import { IssuesPanel } from 'hazo_admin/ui'`) without mounting the full `AdminApp` shell.
+- **Per-card reassign UI** — each issue card now renders a `CardAssigneeControl` dropdown (hazo_ui `Select` with a native `<select>` fallback, mirroring the type control). Picking an admin POSTs `/issues/:id/assign`; picking "Unassigned" clears it. Local board state updates optimistically.
+- **`GET /issues/assignees`** — returns `{ assignees: [{ user_id, label }] }`, the admins assignable to issues. Global admins get `resolveGlobalAdmins`; scoped admins get the union of `resolveScopeAdmins` over their admin scopes. Gated by the same `admin_issue_triage` permission as the rest of the issues group; results are deduped by `user_id`. Display labels are resolved through hazo_auth's `hazo_get_user_profiles` batch lookup (`label = name || email`). **hazo_auth is required** — if it is unavailable the endpoint returns `500` (`hazo_auth_required` / `hazo_auth_profile_lookup_failed`) rather than emitting bare `user_id`s; ids with no resolvable profile are dropped.
+- **test-app** — new autotest scenarios exercising the "raise → see it on the board" flow (raise a global/scoped issue via `raiseIssue`, then assert it appears in the same `listIssues` query the kanban runs) and an assign/unassign store round-trip. The `/raise-issue` page raises global/scoped issues and links straight to the `/admin/issues` kanban; the seed adds triage-permissioned demo users so the reassign picker is populated.
+
+## [0.9.0] - 2026-07-03
+
+### Added
+- **Type-grouped board mode** for the Issues Kanban — toggle between the existing status columns (new/wip/closed) and a new type-grouped view. In type mode, columns are the issue type catalog (by `sort_order`) plus a trailing "uncatalogued" column for any in-use type with no catalog row; dragging a card between type columns reclassifies its `type`.
+- **Facet sidebar** — a left `<aside>` (status + type + severity + search) replaces the thin top `HazoUiKanbanFilter` bar, filtering the board client-side. Also opens the "Manage types" dialog.
+- **Per-card type control** — a small `Select` on each card lets an admin reclassify a single issue's type without dragging.
+- **Issue type catalog** — new persistent table `hazo_admin_issue_types` (`migrations/003_hazo_admin_issue_types.sql`) holding label/color/description/sort-order metadata, separate from the in-memory behavioral `registry.ts`. `createIssueTypeCatalogStore`/`createIssueTypeCatalogStoreFromConnect` (mirrors the `store.ts` two-impl pattern) manage it; a "Manage types" dialog provides CRUD from the panel.
+- **`setType(id, type)`** on `IssueStore` (both raw-SQL and connect impls) — dedupe-safe, since the partial unique index is on `dedupe_key` only.
+- **New API routes**: `POST /issues/:id/type` (reclassify an issue) and an `/issue-types` CRUD group (`GET` list, `POST` create, `PATCH /:key` update, `DELETE /:key`). Catalog reads reuse the existing `admin_issue_triage` permission; catalog mutations gate on a manage permission (defaults to the same) and additionally enforce scope-ownership — scoped admins may only touch rows in their own scope, while global/cross-scope rows require a global admin.
+- **Note:** deleting a type from the catalog is non-destructive — existing issues keep their `type` string and simply render in the "uncatalogued" column instead of disappearing.
+
+## [0.8.0] - 2026-07-02
+
+### Added
+- **`raiseIssue(connect, input, opts?)`** — the single documented ingest protocol for raising an issue into the `/admin` Kanban. Trusted-by-construction server-side seam (no HTTP ingest endpoint). Validates `type` against the `registerIssueType` registry, auto-derives `title`/`summary` from the type's `buildDescriptor(payload)` and `dedupe_key` from `${source ?? 'unknown'}:${type}:${title}` when omitted, and persists via `createIssueStoreFromConnect`.
+  - Scope routing is inferred: `scope_id` present ⇒ scoped issue (scope admins); omitted/`null` ⇒ global issue (super admins), stored under sentinel scope id `GLOBAL_ISSUE_SCOPE_ID` (`'global'`).
+  - `RaiseIssueInput` adds `severity` (`'low'|'medium'|'high'|'critical'`, default `'medium'`) and `source` (raising package/app id); `subject_user_id` is now nullable.
+- **Async, best-effort notify job** — `raiseIssue` enqueues a `hazo_admin.issue.notify` job (`ADMIN_ISSUE_NOTIFY_JOB_TYPE`) only when the issue is newly created (`isNew`); dedupe bumps do not re-notify. `issueNotifyJobHandler` / `registerIssueNotifyJob(worker, { getHazoConnect })` load the issue, resolve recipients (the type's optional `resolveRecipients` hook first, else the new recipient helpers), and dispatch via `hazo_notify`. Silent no-op if `hazo_jobs`/`hazo_notify` are absent.
+- **Recipient helpers** — `resolveGlobalAdmins(connect)` (users holding `hazo_org_global_admin`) and `resolveScopeAdmins(connect, scope_id, permission?)` (scope-local admins, default `admin_issue_triage`), plus `GLOBAL_ADMIN_PERMISSION`, `SCOPE_ADMIN_PERMISSION`, `GLOBAL_ISSUE_SCOPE_ID` constants.
+- **Relaxed `IssueTypeDef`** — `actions`, `resolveRecipients`, `buildResolutionNotice` are now optional, so a triage-only type with no resolution workflow is valid. `POST /issues/:id/resolve` returns `422` (`"has no resolution actions"`) for such a type.
+- **Migration `002_add_issue_severity_source.sql`** — adds `severity` and `source` columns and drops the `NOT NULL` constraint on `subject_user_id` (PostgreSQL) on `hazo_admin_issues`. Migration `001`'s `CREATE TABLE` updated in place for fresh installs (both PostgreSQL and SQLite).
+- `design/issue_raising_protocol.md` — full protocol doc for the above.
+
+### Fixed
+- Global-admin detection in the issues list API filter standardized from `admin_system` to `hazo_org_global_admin` (the real hazo_auth super-admin permission), so global-scope visibility works as documented.
+- `IssuesPanel` now reads the `{ issues: [...] }` API response shape (was reading `.data`, so the Kanban board rendered empty).
+
 ## [0.6.4] - 2026-06-26
 
 ### Fixed

package/README.md

@@ -217,23 +217,48 @@ auth_permission = nearest_scope_admin
 |---|---|---|
 | `GET` | `/issues` | List issues (filtered by admin's scope) |
 | `GET` | `/issues/:id` | Get single issue |
-| `POST` | `/issues/:id/transition` | Transition status (`new`→`wip`→`closed`) |
+| `POST` | `/issues/:id/transition` | Transition status — free-form: any known status → any other known status |
 | `POST` | `/issues/:id/assign` | Assign to a user |
+| `POST` | `/issues/:id/assign-to-me` | Assign to the authenticated actor (derived from the admin gate, not client input) |
 | `POST` | `/issues/:id/resolve` | Run an action + close the issue |
+| `POST` | `/issues/archive-sweep` | Move closed issues older than the configured cutoff to `archived` — **global admins only** (`403` otherwise) |
+| `GET` | `/issues/assignees` | List all users assignable to issues (`{ user_id, label, avatarUrl }`, for the reassign picker) |
 
 Scoped admins only see issues within their assigned scopes. Global admins (`admin_system`) see all.
 
+Statuses: `new` / `wip` / `on_hold` / `closed` / `archived`. `on_hold` renders as a parked lane after Closed on the board. Transitions are unrestricted (only an unknown target status is rejected); `→ wip` still auto-assigns the actor.
+
+### Drop-in `IssuesPanel` (v0.10.0, filter bar + owner picker updated in v0.11.0)
+
+Mount the Issues triage board on its own, without the full `AdminApp` shell:
+
+```tsx
+import { IssuesPanel } from 'hazo_admin/ui';
+
+export default function AdminIssuesPage() {
+  return <IssuesPanel basePath="/api/admin" currentUserId={currentUserId} />;
+}
+```
+
+`basePath` defaults to `/api/admin`. The board has four columns (New → WIP → Closed → On Hold). Filter controls live in a horizontal top bar above the board — search inline, plus **Type**, **Severity**, and **Age** (`Under 1 day` / `1–7 days` / `7–30 days` / `Over 30 days`) as dropdown chips with active-count badges, a **Clear · N** button, and **Manage types**. Status isn't a facet here since it's already the board's columns.
+
+Each card shows per-card **type** and **owner** controls. The owner control uses `UserPickerSelect` from `hazo_auth/client` (≥ 10.5.0) — avatar + name/email dropdown — populated from `GET {basePath}/issues/assignees` (now every user, not just resolvable admins); selecting one POSTs `{basePath}/issues/:id/assign`. A compact **Me** button next to it POSTs `{basePath}/issues/:id/assign-to-me` to self-claim.
+
+The panel header also has an **Archive old** button that POSTs `{basePath}/issues/archive-sweep` (global admins only) and refreshes both boards.
+
 ### Archive job
 
-Register the built-in archive job to sweep old closed issues:
+Register the built-in archive job to sweep old closed issues (default cutoff is now **1 month**, was 3):
 
 ```ts
 import { registerIssueArchiveJob, ADMIN_ISSUE_ARCHIVE_JOB_TYPE } from 'hazo_admin';
 import { createJobQueue } from 'hazo_jobs';
 
-registerIssueArchiveJob(jobQueue, { getHazoConnect, archiveAfterMonths: 3 });
+registerIssueArchiveJob(jobQueue, { getHazoConnect, archiveAfterMonths: 1 });
 ```
 
+The **Archive old** button in `IssuesPanel` covers the same sweep on demand, without needing the job scheduled.
+
 ### `createIssueStoreFromConnect(adapter)` — PostgREST-native store (v0.6.0)
 
 Use this factory when the consuming app connects via a PostgREST adapter (no direct SQL access). It builds the same `IssueStore` interface using `createCrudService` + `adapter.claimRows` so no raw SQL is issued.
@@ -251,6 +276,42 @@ const { issue, isNew } = await store.createOrBumpIssue({ ... });
 
 **Async:** returns a `Promise<IssueStore>` (lazy `hazo_connect/server` import on the CRUD path).
 
+### Raising issues (v0.8.0)
+
+`raiseIssue(connect, input, opts?)` is the single documented ingest protocol for
+creating an issue from server-side code — a trusted-by-construction seam (no
+HTTP ingest endpoint). See [design/issue_raising_protocol.md](./design/issue_raising_protocol.md)
+for the full contract.
+
+```ts
+import { raiseIssue } from 'hazo_admin';
+
+const { issue, isNew } = await raiseIssue(connect, {
+  type: 'auth_permission',   // must be a registered IssueTypeDef.typeKey
+  scope_id: orgId,           // omit/null for a global (super-admin) issue
+  severity: 'high',
+  source: 'hazo_files',
+  payload: { requestedPermission: 'files.manage' },
+});
+```
+
+`scope_id` presence infers routing: present ⇒ scoped issue (scope admins),
+omitted/`null` ⇒ global issue (super admins only). `title`/`summary` are
+auto-derived from the type's `buildDescriptor(payload)` when not supplied.
+
+Notify-on-raise is **optional and async** — only newly-created issues enqueue
+a `hazo_admin.issue.notify` job, and only if `hazo_jobs` + `hazo_notify` are
+installed and wired. Register the worker handler once at boot:
+
+```ts
+import { registerIssueNotifyJob } from 'hazo_admin';
+
+registerIssueNotifyJob(worker, { getHazoConnect });
+```
+
+Without this wiring, issues still raise and show up in the Kanban — only the
+notification is skipped.
+
 ---
 
 ## v0.2.0 Breaking changes
@@ -275,7 +336,7 @@ Consumers of this endpoint (e.g. `EnvMigrationPanel`) must read the `role` field
 
 | Import path | Contents | Server-safe |
 |---|---|---|
-| `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult`, `createIssueStore`, `createIssueStoreFromConnect`, `registerIssueType`, `getIssueType`, `listIssueTypes`, `loadIssueRoutingConfig`, `registerIssueArchiveJob`, `ADMIN_ISSUE_ARCHIVE_JOB_TYPE` | Server only |
+| `hazo_admin` | `adminGate`, `withAdminGate`, `HAZO_ADMIN_PERMISSIONS`, `AdminGateResult`, `createIssueStore`, `createIssueStoreFromConnect`, `registerIssueType`, `getIssueType`, `listIssueTypes`, `loadIssueRoutingConfig`, `registerIssueArchiveJob`, `ADMIN_ISSUE_ARCHIVE_JOB_TYPE`, `raiseIssue`, `registerIssueNotifyJob`, `issueNotifyJobHandler`, `ADMIN_ISSUE_NOTIFY_JOB_TYPE`, `resolveGlobalAdmins`, `resolveScopeAdmins` | Server only |
 | `hazo_admin/client` | `HAZO_ADMIN_PERMISSIONS`, `registerIssueCardRenderer`, `getIssueCardRenderer`, `listIssueCardRenderers`, `DefaultIssueCard`, types | Yes |
 | `hazo_admin/api` | `createAdminPresetRoutes` | Server only |
 | `hazo_admin/jobs` | `ENV_MIGRATE_JOB_TYPE`, `envMigrateJobHandler` | Server only (no React) |

package/SETUP_CHECKLIST.md

@@ -6,6 +6,8 @@
 npm install hazo_admin hazo_auth hazo_core hazo_ui
 ```
 
+If mounting `IssuesPanel`, `hazo_auth` must be `>= 10.5.0` — the per-card owner control uses its `UserPickerSelect`.
+
 ## 2. Seed permission rows
 
 In your app's database migration, seed the permission strings that `hazo_admin` depends on:
@@ -45,3 +47,25 @@ export const GET = withAdminGate(
 ## 4. Configure (optional)
 
 Copy `config/hazo_admin_config.ini.sample` to `hazo_admin_config.ini` and adjust as needed.
+
+## 5. Apply migration 002 (issues: severity/source, nullable subject) — if upgrading
+
+If you already applied `migrations/001_hazo_admin_issues.sql` (PostgreSQL), also apply
+`migrations/002_add_issue_severity_source.sql` — it adds `severity`/`source` columns and
+drops the `NOT NULL` constraint on `subject_user_id`. Fresh installs (PostgreSQL or
+SQLite) get these via the updated `001` `CREATE TABLE` and don't need `002` at all.
+
+## 6. Wire issue-raised notifications (optional)
+
+If you use `raiseIssue()` (see [design/issue_raising_protocol.md](./design/issue_raising_protocol.md))
+and want admins notified when a new issue is raised, install `hazo_jobs` + `hazo_notify`
+and register the notify job handler on your worker once at boot:
+
+```ts
+import { registerIssueNotifyJob } from 'hazo_admin';
+
+registerIssueNotifyJob(worker, { getHazoConnect });
+```
+
+Without this, `raiseIssue()` still works and issues still show up in the Kanban — only
+the notification is skipped.

package/dist/api/index.d.ts

@@ -20,7 +20,7 @@ export type AdminPresetRoutesConfig = {
         progressDir?: string;
     };
     issues?: {
-        /** Months before closed issues are archived. Default 3. */
+        /** Months a closed issue must age before it is archived. Default 1. */
         archiveAfterMonths?: number;
     };
 };
@@ -40,6 +40,11 @@ export declare function createAdminPresetRoutes(manifest: AdminManifest, cfg: Ad
             path: string[];
         }>;
     }) => Promise<Response>;
+    PATCH: (request: Request, ctx: {
+        params: Promise<{
+            path: string[];
+        }>;
+    }) => Promise<Response>;
     DELETE: (request: Request, ctx: {
         params: Promise<{
             path: string[];

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,2DAA2D;QAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBAmiBlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAuGnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAKhE,MAAM,MAAM,uBAAuB,GAAG;IACpC;;;;OAIG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QACL,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wFAAwF;QACxF,OAAO,CAAC,EAAE,IAAI,GAAG,QAAQ,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE;QACJ,gFAAgF;QAChF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,MAAM,CAAC,EAAE;QACP,uEAAuE;QACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH,CAAC;AAuBF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,uBAAuB;mBAosBlE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;oBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;mBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;qBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAAzE,OAAO,OAAO;QAAE,MAAM,EAAE,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAA;KAAE,KAAG,OAAO,CAAC,QAAQ,CAAC;EAgHnG;AAGD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC"}

package/dist/api/index.js

@@ -2,6 +2,8 @@ import 'server-only';
 import path from 'node:path';
 import fs from 'node:fs';
 import { withAdminGate } from '../lib/admin_gate.server.js';
+/** Permission that grants global (cross-scope) admin access to the issues queue. */
+const GLOBAL_ADMIN_PERMISSION = 'hazo_org_global_admin';
 function notFound() {
     return new Response(JSON.stringify({ error: { reason: 'not_found' } }), {
         status: 404,
@@ -43,6 +45,7 @@ export function createAdminPresetRoutes(manifest, cfg) {
     const feedbackPermission = feedbackSection?.permission ?? 'admin.feedback.review';
     const issuesSection = manifest.sections.find((s) => s.kind === 'issues');
     const issuesPermission = issuesSection?.permission ?? 'admin_issue_triage';
+    const issuesManagePermission = issuesSection?.managePermission ?? issuesPermission;
     async function handleJobs(request, method, segments) {
         const jobsMod = await import('hazo_jobs/server').catch(() => null);
         if (!jobsMod)
@@ -384,7 +387,7 @@ export function createAdminPresetRoutes(manifest, cfg) {
         // Derive actor identity from the authenticated gate result (never from the client).
         const actorUserId = gateResult?.user?.id ?? gateResult?.user?.user_id ?? '';
         // Derive admin scope from the gate result — never trust client-supplied params.
-        const isGlobalAdmin = (gateResult?.permissions ?? []).includes('admin_system');
+        const isGlobalAdmin = (gateResult?.permissions ?? []).includes(GLOBAL_ADMIN_PERMISSION);
         let adminScopeIds = [];
         if (!isGlobalAdmin) {
             // Try to get user scopes from hazo_auth.
@@ -426,7 +429,7 @@ export function createAdminPresetRoutes(manifest, cfg) {
             const status = url.searchParams.get('status');
             const assignedTo = url.searchParams.get('assignedTo');
             const type = url.searchParams.get('type');
-            const statusFilter = status ? status.split(',') : ['new', 'wip', 'closed'];
+            const statusFilter = status ? status.split(',') : ['new', 'wip', 'on_hold', 'closed'];
             const issues = await store.listIssues({
                 adminScopeIds: isGlobalAdmin ? undefined : adminScopeIds,
                 isGlobalAdmin,
@@ -436,6 +439,27 @@ export function createAdminPresetRoutes(manifest, cfg) {
             });
             return Response.json({ issues });
         }
+        // GET /issues/assignees — every user, for the reassign picker. Each row
+        // carries the display name and profile picture URL so the picker can render
+        // an avatar + username (falls back to tinted initials when no picture).
+        if (method === 'GET' && segments.length === 1 && segments[0] === 'assignees') {
+            let assignees = [];
+            try {
+                const { createCrudService } = await import('hazo_connect/server');
+                const users = await createCrudService(connect, 'hazo_users').list();
+                assignees = (Array.isArray(users) ? users : [])
+                    .map((u) => ({
+                    user_id: u.id,
+                    label: (u.name || u.email_address || u.id),
+                    avatarUrl: u.profile_picture_url ?? null,
+                }))
+                    .filter((a) => Boolean(a.user_id));
+            }
+            catch {
+                return Response.json({ error: { reason: 'assignee_lookup_failed' } }, { status: 500 });
+            }
+            return Response.json({ assignees });
+        }
         // GET /issues/:id
         if (method === 'GET' && segments.length === 1) {
             const issue = await store.getIssue(segments[0]);
@@ -476,6 +500,34 @@ export function createAdminPresetRoutes(manifest, cfg) {
             const updated = await store.setAssignee(segments[0], body.userId ?? null);
             return Response.json({ issue: updated });
         }
+        // POST /issues/:id/assign-to-me — assign to the authenticated actor.
+        // The actor is derived from the gate, never the client, so no identity is
+        // needed on the client to "grab" an issue.
+        if (method === 'POST' && segments.length === 2 && segments[1] === 'assign-to-me') {
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            if (!actorUserId) {
+                return Response.json({ error: { reason: 'no_actor_identity' } }, { status: 403 });
+            }
+            const updated = await store.setAssignee(segments[0], actorUserId);
+            return Response.json({ issue: updated });
+        }
+        // POST /issues/archive-sweep — move closed issues older than the configured
+        // cutoff to `archived`. archiveClosedOlderThan is not scope-filtered, so this
+        // is restricted to global admins to avoid a scoped admin archiving every
+        // scope's issues.
+        if (method === 'POST' && segments.length === 1 && segments[0] === 'archive-sweep') {
+            if (!isGlobalAdmin)
+                return forbidden();
+            const months = cfg.issues?.archiveAfterMonths ?? 1;
+            const cutoff = new Date();
+            cutoff.setMonth(cutoff.getMonth() - months);
+            const archivedCount = await store.archiveClosedOlderThan(cutoff);
+            return Response.json({ archivedCount, cutoff: cutoff.toISOString() });
+        }
         // POST /issues/:id/resolve
         if (method === 'POST' && segments.length === 2 && segments[1] === 'resolve') {
             const body = await request.json().catch(() => ({}));
@@ -492,6 +544,9 @@ export function createAdminPresetRoutes(manifest, cfg) {
             if (!typeDef) {
                 return Response.json({ error: { reason: `Unknown issue type: ${issue.type}` } }, { status: 422 });
             }
+            if (!typeDef.actions || typeDef.actions.length === 0) {
+                return Response.json({ error: { reason: `Issue type '${issue.type}' has no resolution actions` } }, { status: 422 });
+            }
             const action = typeDef.actions.find((a) => a.key === actionKey);
             if (!action) {
                 return Response.json({ error: { reason: `Unknown action: ${actionKey}` } }, { status: 422 });
@@ -542,6 +597,110 @@ export function createAdminPresetRoutes(manifest, cfg) {
                 return Response.json({ error: { reason: err.message } }, { status: 500 });
             }
         }
+        // POST /issues/:id/type — reclassify an issue's type
+        if (method === 'POST' && segments.length === 2 && segments[1] === 'type') {
+            const body = await request.json().catch(() => ({}));
+            const { type } = body;
+            if (!type) {
+                return Response.json({ error: { reason: 'type required' } }, { status: 400 });
+            }
+            const issue = await store.getIssue(segments[0]);
+            if (!issue)
+                return notFound();
+            if (!canAccessIssue(issue))
+                return forbidden();
+            const updated = await store.setType(segments[0], type);
+            return Response.json({ issue: updated });
+        }
+        return notFound();
+    }
+    async function handleIssueTypes(request, method, segments, gateResult) {
+        const { createIssueTypeCatalogStore } = await import('../issues/index.js');
+        const connect = await cfg.getHazoConnect();
+        const store = createIssueTypeCatalogStore(connect);
+        // Derive actor identity from the authenticated gate result (never from the client).
+        const actorUserId = gateResult?.user?.id ?? gateResult?.user?.user_id ?? '';
+        // Derive admin scope from the gate result — never trust client-supplied params.
+        const isGlobalAdmin = (gateResult?.permissions ?? []).includes(GLOBAL_ADMIN_PERMISSION);
+        let adminScopeIds = [];
+        if (!isGlobalAdmin) {
+            // Try to get user scopes from hazo_auth.
+            const authLib = await import('hazo_auth/server-lib').catch(() => null);
+            if (authLib?.get_user_scope_assignments) {
+                const scopeAssignments = await authLib.get_user_scope_assignments(actorUserId, connect).catch(() => []);
+                adminScopeIds = scopeAssignments.map((a) => a.scope_id).filter(Boolean);
+                // Also include descendants if the helper is available.
+                if (authLib.get_scope_descendants && adminScopeIds.length > 0) {
+                    const descendants = await authLib.get_scope_descendants(adminScopeIds, connect).catch(() => []);
+                    adminScopeIds = [...new Set([...adminScopeIds, ...descendants.map((d) => d.id ?? d.scope_id)])];
+                }
+            }
+            // If hazo_auth not available OR user has no scope assignments → adminScopeIds stays [].
+        }
+        /** Returns a 403 forbidden response. */
+        function forbidden() {
+            return new Response(JSON.stringify({ error: { reason: 'forbidden' } }), {
+                status: 403,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        // GET /issue-types — list catalog
+        if (method === 'GET' && segments.length === 0) {
+            const types = await store.listTypes({ scopeIds: isGlobalAdmin ? undefined : adminScopeIds, isGlobalAdmin });
+            return Response.json({ issueTypes: types });
+        }
+        // All non-GET routes require the manage permission.
+        if (!(gateResult?.permissions ?? []).includes(issuesManagePermission))
+            return forbidden();
+        /**
+         * A scoped admin may only touch catalog rows that live inside one of their
+         * scopes. Global (scope_id null) and cross-scope rows are reserved for
+         * global admins. Prevents scope-bypass on catalog writes.
+         */
+        function canManageScope(scopeId) {
+            if (isGlobalAdmin)
+                return true;
+            return !!scopeId && adminScopeIds.includes(scopeId);
+        }
+        // POST /issue-types — create a catalog entry
+        if (method === 'POST' && segments.length === 0) {
+            const body = await request.json().catch(() => ({}));
+            const { type_key, label, color, description, scope_id, sort_order } = body;
+            if (!type_key || !label) {
+                return Response.json({ error: { reason: 'type_key and label required' } }, { status: 400 });
+            }
+            // Scoped admins can only create rows within their own scope (never global/cross-scope).
+            if (!canManageScope(scope_id))
+                return forbidden();
+            const created = await store.createType({ type_key, label, color, description, scope_id, sort_order });
+            return Response.json({ issueType: created });
+        }
+        // PATCH /issue-types/:key — update a catalog entry
+        if (method === 'PATCH' && segments.length === 1) {
+            const existing = await store.getType(segments[0]);
+            if (!existing)
+                return notFound();
+            if (!canManageScope(existing.scope_id))
+                return forbidden();
+            const patch = await request.json().catch(() => ({}));
+            try {
+                const updated = await store.updateType(segments[0], patch);
+                return Response.json({ issueType: updated });
+            }
+            catch (err) {
+                return Response.json({ error: { reason: err.message } }, { status: 404 });
+            }
+        }
+        // DELETE /issue-types/:key — remove a catalog entry (non-destructive to issues)
+        if (method === 'DELETE' && segments.length === 1) {
+            const existing = await store.getType(segments[0]);
+            if (!existing)
+                return notFound();
+            if (!canManageScope(existing.scope_id))
+                return forbidden();
+            await store.deleteType(segments[0]);
+            return Response.json({ ok: true });
+        }
         return notFound();
     }
     function makeHandler(method) {
@@ -593,6 +752,10 @@ export function createAdminPresetRoutes(manifest, cfg) {
                 const gated = withAdminGate((_req, _gate) => handleIssues(_req, method, rest, _gate), { required_permissions: [issuesPermission] });
                 return gated(request);
             }
+            if (group === 'issue-types') {
+                const gated = withAdminGate((_req, _gate) => handleIssueTypes(_req, method, rest, _gate), { required_permissions: [issuesPermission] });
+                return gated(request);
+            }
             return notFound();
         };
     }
@@ -600,6 +763,7 @@ export function createAdminPresetRoutes(manifest, cfg) {
         GET: makeHandler('GET'),
         POST: makeHandler('POST'),
         PUT: makeHandler('PUT'),
+        PATCH: makeHandler('PATCH'),
         DELETE: makeHandler('DELETE'),
     };
 }

package/dist/components/issues_panel/board_columns.d.ts

@@ -0,0 +1,17 @@
+import type { IssueCardData } from '../../issues/registry.client.js';
+import type { IssueTypeCatalogRecord } from '../../issues/type_catalog.js';
+export type BoardMode = 'status' | 'type';
+export interface KanbanColumn {
+    key: string;
+    title: string;
+    color?: string | null;
+}
+export type KanbanItem = IssueCardData & {
+    columnKey: string;
+};
+export declare const ACTIVE_STATUS_COLUMNS: KanbanColumn[];
+export declare const ARCHIVED_COLUMNS: KanbanColumn[];
+export declare function statusColumns(tab: 'active' | 'archived'): KanbanColumn[];
+export declare function typeColumns(catalog: Pick<IssueTypeCatalogRecord, 'type_key' | 'label' | 'color'>[], issues: IssueCardData[]): KanbanColumn[];
+export declare function toKanbanItem(issue: IssueCardData, boardMode: BoardMode): KanbanItem;
+//# sourceMappingURL=board_columns.d.ts.map

package/dist/components/issues_panel/board_columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"board_columns.d.ts","sourceRoot":"","sources":["../../../src/components/issues_panel/board_columns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,eAAO,MAAM,qBAAqB,EAAE,YAAY,EAK/C,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,YAAY,EAA6C,CAAC;AAGzF,wBAAgB,aAAa,CAAC,GAAG,EAAE,QAAQ,GAAG,UAAU,GAAG,YAAY,EAAE,CAExE;AAQD,wBAAgB,WAAW,CACzB,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC,EAAE,EACvE,MAAM,EAAE,aAAa,EAAE,GACtB,YAAY,EAAE,CAahB;AAID,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,GAAG,UAAU,CAEnF"}

package/dist/components/issues_panel/board_columns.js

@@ -0,0 +1,37 @@
+export const ACTIVE_STATUS_COLUMNS = [
+    { key: 'new', title: 'New' },
+    { key: 'wip', title: 'WIP' },
+    { key: 'closed', title: 'Closed' },
+    { key: 'on_hold', title: 'On Hold' },
+];
+export const ARCHIVED_COLUMNS = [{ key: 'archived', title: 'Archived' }];
+// Status columns for a given tab.
+export function statusColumns(tab) {
+    return tab === 'active' ? ACTIVE_STATUS_COLUMNS : ARCHIVED_COLUMNS;
+}
+// Type columns = catalog rows (ordered) UNION distinct types on the loaded issues.
+// Catalog rows come first (key=type_key, title=label, color), in the order they
+// arrive (already sorted by sort_order from the API). Any issue.type not already
+// a column key is appended as its own column, titled by the raw type string, with
+// color null, in first-seen order. Dedupe so a type that is both catalogued and
+// in-use appears once.
+export function typeColumns(catalog, issues) {
+    const columns = catalog.map((entry) => ({
+        key: entry.type_key,
+        title: entry.label,
+        color: entry.color ?? null,
+    }));
+    const seen = new Set(columns.map((c) => c.key));
+    for (const issue of issues) {
+        if (seen.has(issue.type))
+            continue;
+        seen.add(issue.type);
+        columns.push({ key: issue.type, title: issue.type, color: null });
+    }
+    return columns;
+}
+// Map an issue to a KanbanItem for the given board mode: columnKey = issue.status
+// in status mode, issue.type in type mode.
+export function toKanbanItem(issue, boardMode) {
+    return { ...issue, columnKey: boardMode === 'status' ? issue.status : issue.type };
+}

package/dist/components/issues_panel/card_assignee_control.d.ts

@@ -0,0 +1,17 @@
+import type { IssueCardData } from '../../issues/registry.client.js';
+export interface Assignee {
+    user_id: string;
+    label: string;
+    /** Profile picture URL from the hazo_auth profile; null → initials fallback. */
+    avatarUrl?: string | null;
+}
+export interface CardAssigneeControlProps {
+    issue: IssueCardData;
+    basePath: string;
+    assignees: Assignee[];
+    onChanged?: (issueId: string, userId: string | null) => void;
+    /** Claim the issue for the authenticated actor (server derives identity). */
+    onAssignToMe?: (issueId: string) => void | Promise<void>;
+}
+export declare function CardAssigneeControl({ issue, basePath, assignees, onChanged, onAssignToMe }: CardAssigneeControlProps): import("react").JSX.Element;
+//# sourceMappingURL=card_assignee_control.d.ts.map

package/dist/components/issues_panel/card_assignee_control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card_assignee_control.d.ts","sourceRoot":"","sources":["../../../src/components/issues_panel/card_assignee_control.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAUD,wBAAgB,mBAAmB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,wBAAwB,+BAgEpH"}

package/dist/components/issues_panel/card_assignee_control.js

@@ -0,0 +1,51 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { UserPickerSelect } from 'hazo_auth/client';
+import { LIGHT_THEME_VARS } from './ui_helpers.js';
+function toPickable(a) {
+    return { user_id: a.user_id, name: a.label, profile_picture_url: a.avatarUrl ?? null };
+}
+// Reassign control under an issue card. The owner dropdown is hazo_auth's shared
+// UserPickerSelect (avatar + username); the "Me" button claims the issue for the
+// authenticated actor. The dropdown portals to <body>, so LIGHT_THEME_VARS is
+// pinned on its content to keep it light under the host app's OS dark mode.
+export function CardAssigneeControl({ issue, basePath, assignees, onChanged, onAssignToMe }) {
+    const [saving, setSaving] = useState(false);
+    const [claiming, setClaiming] = useState(false);
+    const users = assignees.map(toPickable);
+    // Surface a current assignee not among the candidates so the trigger isn't blank.
+    if (issue.assigned_to && !users.some((u) => u.user_id === issue.assigned_to)) {
+        users.push({ user_id: issue.assigned_to, name: issue.assigned_to, profile_picture_url: null });
+    }
+    const commitAssignee = async (userId) => {
+        if ((userId ?? null) === (issue.assigned_to ?? null))
+            return;
+        setSaving(true);
+        try {
+            const res = await fetch(`${basePath}/issues/${issue.id}/assign`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ userId }),
+            });
+            if (res.ok)
+                onChanged?.(issue.id, userId);
+        }
+        finally {
+            setSaving(false);
+        }
+    };
+    const claimToMe = async () => {
+        if (!onAssignToMe || claiming)
+            return;
+        setClaiming(true);
+        try {
+            await onAssignToMe(issue.id);
+        }
+        finally {
+            setClaiming(false);
+        }
+    };
+    const stop = (e) => e.stopPropagation();
+    return (_jsxs("div", { className: "mt-1.5 flex items-center gap-2", onPointerDown: stop, onMouseDown: stop, onClick: stop, children: [_jsx("span", { className: "w-14 shrink-0 text-[10px] font-medium uppercase tracking-wide text-slate-400", children: "Owner" }), _jsx(UserPickerSelect, { users: users, value: issue.assigned_to ?? null, onChange: commitAssignee, disabled: saving, size: "sm", "aria-label": "Issue owner", className: "flex-1 rounded-md border-slate-200", contentStyle: LIGHT_THEME_VARS, contentClassName: "border border-slate-200 bg-white text-slate-900 shadow-lg" }), onAssignToMe ? (_jsx("button", { type: "button", onClick: claimToMe, disabled: claiming || saving, title: "Assign this issue to me", className: "shrink-0 rounded-md border border-slate-200 px-2 py-1 text-[10px] font-semibold uppercase tracking-wide text-slate-500 transition-colors hover:border-indigo-300 hover:bg-indigo-50 hover:text-indigo-700 disabled:cursor-not-allowed disabled:opacity-50", children: claiming ? '…' : 'Me' })) : null] }));
+}

package/dist/components/issues_panel/card_type_control.d.ts

@@ -0,0 +1,18 @@
+import type { IssueCardData } from '../../issues/registry.client.js';
+import type { CatalogType } from './use_issue_types.js';
+export interface CardTypeControlUi {
+    Select?: any;
+    SelectTrigger?: any;
+    SelectContent?: any;
+    SelectItem?: any;
+    SelectValue?: any;
+}
+export interface CardTypeControlProps {
+    issue: IssueCardData;
+    basePath: string;
+    catalog: CatalogType[];
+    ui: CardTypeControlUi | null;
+    onChanged?: (issueId: string, newType: string) => void;
+}
+export declare function CardTypeControl({ issue, basePath, catalog, ui, onChanged }: CardTypeControlProps): import("react").JSX.Element;
+//# sourceMappingURL=card_type_control.d.ts.map

package/dist/components/issues_panel/card_type_control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card_type_control.d.ts","sourceRoot":"","sources":["../../../src/components/issues_panel/card_type_control.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,WAAW,CAAC,EAAE,GAAG,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,EAAE,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxD;AAKD,wBAAgB,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,oBAAoB,+BA2FhG"}