libre-webui 0.25.0 → 0.26.0

package/backend/dist/services/promptService.js

@@ -0,0 +1,513 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Prompt library (PROMPT-01): versioned, shareable prompt templates.
+ *
+ * Titles, descriptions, bodies, variable declarations, and tags are
+ * encrypted at the service boundary. Slugs stay in plaintext: they carry the
+ * per-owner uniqueness constraint and are the lookup key, neither of which
+ * survives encryption.
+ */
+import { v4 as uuidv4 } from 'uuid';
+import { encryptionService } from './encryptionService.js';
+import { getPersistence } from '../persistence/index.js';
+import { PersistenceResourceLimitError } from '../persistence/resourceTypes.js';
+import { authorize, requireAuthorized, } from './authorizationService.js';
+import { deleteGrantsForResource } from './resourceGrantService.js';
+import { grantedResourceIdsFor, sharedMetaFor, } from './sharedResourceAccess.js';
+import { recordAuditEvent } from './securityAuditService.js';
+import { MAX_PROMPT_CONTENT_LENGTH, MAX_PROMPT_DESCRIPTION_LENGTH, MAX_PROMPT_SLUG_LENGTH, MAX_PROMPT_TAGS, MAX_PROMPT_TITLE_LENGTH, MAX_PROMPT_VARIABLES, MAX_PROMPT_VERSIONS, MAX_PROMPTS_PER_USER, ResourcePolicyError, } from '../utils/resourceLimits.js';
+export const PROMPT_EXPORT_FORMAT = 'libre-prompt.v1';
+const SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const VARIABLE_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]{0,63}$/;
+const PLACEHOLDER_PATTERN = /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+const VARIABLE_TYPES = [
+    'text',
+    'number',
+    'select',
+    'boolean',
+];
+const MAX_TAG_LENGTH = 64;
+const prompts = () => getPersistence(encryptionService).repositories.resources.prompts;
+const readText = (value, field, maximum, required) => {
+    if (value === undefined || value === null || value === '') {
+        if (required)
+            throw new ResourcePolicyError(`${field} is required`, 400);
+        return undefined;
+    }
+    if (typeof value !== 'string') {
+        throw new ResourcePolicyError(`${field} must be a string`, 400);
+    }
+    if (value.length > maximum) {
+        throw new ResourcePolicyError(`${field} exceeds the maximum length of ${maximum} characters`, 400);
+    }
+    return value;
+};
+const readSlug = (value) => {
+    const slug = readText(value, 'slug', MAX_PROMPT_SLUG_LENGTH, true);
+    if (!SLUG_PATTERN.test(slug)) {
+        throw new ResourcePolicyError('slug must be lowercase alphanumeric with hyphens and start with a letter or digit', 400);
+    }
+    return slug;
+};
+const readVariables = (value) => {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new ResourcePolicyError('variables must be an array', 400);
+    }
+    if (value.length > MAX_PROMPT_VARIABLES) {
+        throw new ResourcePolicyError(`A prompt may declare at most ${MAX_PROMPT_VARIABLES} variables`, 400);
+    }
+    const seen = new Set();
+    return value.map(entry => {
+        if (typeof entry !== 'object' || entry === null) {
+            throw new ResourcePolicyError('each variable must be an object', 400);
+        }
+        const raw = entry;
+        const name = raw.name;
+        if (typeof name !== 'string' || !VARIABLE_NAME_PATTERN.test(name)) {
+            throw new ResourcePolicyError('variable names must be identifiers of at most 64 characters', 400);
+        }
+        if (seen.has(name)) {
+            throw new ResourcePolicyError(`duplicate variable "${name}"`, 400);
+        }
+        seen.add(name);
+        const type = raw.type;
+        if (typeof type !== 'string' ||
+            !VARIABLE_TYPES.includes(type)) {
+            throw new ResourcePolicyError(`variable "${name}" must declare one of: ${VARIABLE_TYPES.join(', ')}`, 400);
+        }
+        const label = readText(raw.label, `variable "${name}" label`, 200, false);
+        const defaultValue = readText(raw.default, `variable "${name}" default`, 1000, false);
+        let options;
+        if (raw.options !== undefined && raw.options !== null) {
+            if (!Array.isArray(raw.options) ||
+                raw.options.some(option => typeof option !== 'string' || !option)) {
+                throw new ResourcePolicyError(`variable "${name}" options must be non-empty strings`, 400);
+            }
+            if (raw.options.length > MAX_PROMPT_VARIABLES) {
+                throw new ResourcePolicyError(`variable "${name}" declares too many options`, 400);
+            }
+            options = raw.options;
+        }
+        if (type === 'select' && (!options || options.length === 0)) {
+            throw new ResourcePolicyError(`variable "${name}" is a select and needs at least one option`, 400);
+        }
+        return {
+            name,
+            type: type,
+            ...(label !== undefined ? { label } : {}),
+            ...(raw.required === true ? { required: true } : {}),
+            ...(defaultValue !== undefined ? { default: defaultValue } : {}),
+            ...(options !== undefined ? { options } : {}),
+        };
+    });
+};
+const readTags = (value) => {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value)) {
+        throw new ResourcePolicyError('tags must be an array', 400);
+    }
+    if (value.length > MAX_PROMPT_TAGS) {
+        throw new ResourcePolicyError(`A prompt may carry at most ${MAX_PROMPT_TAGS} tags`, 400);
+    }
+    const tags = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string' || !entry) {
+            throw new ResourcePolicyError('each tag must be a non-empty string', 400);
+        }
+        if (entry.length > MAX_TAG_LENGTH) {
+            throw new ResourcePolicyError(`tags may be at most ${MAX_TAG_LENGTH} characters`, 400);
+        }
+        if (!tags.includes(entry))
+            tags.push(entry);
+    }
+    return tags;
+};
+/** Every `{{token}}` in the body must resolve to a declared variable. */
+const assertPlaceholdersDeclared = (content, variables) => {
+    const declared = new Set(variables.map(variable => variable.name));
+    PLACEHOLDER_PATTERN.lastIndex = 0;
+    let match = PLACEHOLDER_PATTERN.exec(content);
+    while (match !== null) {
+        const name = match[1];
+        if (!declared.has(name)) {
+            throw new ResourcePolicyError(`content references undeclared variable "${name}"`, 400);
+        }
+        match = PLACEHOLDER_PATTERN.exec(content);
+    }
+};
+const normalize = (input) => {
+    const slug = readSlug(input.slug);
+    const title = readText(input.title, 'title', MAX_PROMPT_TITLE_LENGTH, true);
+    const description = readText(input.description, 'description', MAX_PROMPT_DESCRIPTION_LENGTH, false);
+    const content = readText(input.content, 'content', MAX_PROMPT_CONTENT_LENGTH, true);
+    const variables = readVariables(input.variables);
+    const tags = readTags(input.tags);
+    assertPlaceholdersDeclared(content, variables);
+    return {
+        slug,
+        title,
+        ...(description !== undefined ? { description } : {}),
+        content,
+        variables,
+        tags,
+    };
+};
+const parseVariables = (value) => {
+    if (!value)
+        return [];
+    try {
+        const parsed = JSON.parse(encryptionService.decrypt(value));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+};
+const parseTags = (value) => {
+    if (!value)
+        return [];
+    try {
+        const parsed = JSON.parse(encryptionService.decrypt(value));
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+};
+const mapPromptRow = (row) => ({
+    id: row.id,
+    slug: row.slug,
+    title: encryptionService.decrypt(row.title),
+    ...(row.description
+        ? { description: encryptionService.decrypt(row.description) }
+        : {}),
+    content: encryptionService.decrypt(row.content),
+    variables: parseVariables(row.variables),
+    tags: parseTags(row.tags),
+    version: row.version,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ownerUserId: row.user_id,
+});
+const toRow = (prompt, normalized) => ({
+    id: prompt.id,
+    user_id: prompt.ownerUserId,
+    slug: normalized.slug,
+    title: encryptionService.encrypt(normalized.title),
+    description: normalized.description !== undefined
+        ? encryptionService.encrypt(normalized.description)
+        : null,
+    content: encryptionService.encrypt(normalized.content),
+    variables: encryptionService.encrypt(JSON.stringify(normalized.variables)),
+    tags: encryptionService.encrypt(JSON.stringify(normalized.tags)),
+    version: prompt.version,
+    created_at: prompt.createdAt,
+    updated_at: prompt.updatedAt,
+});
+const archiveRowOf = (row) => ({
+    id: uuidv4(),
+    prompt_id: row.id,
+    version: row.version,
+    content: row.content,
+    variables: row.variables,
+    created_at: row.updated_at,
+});
+const persist = async (row, archived) => {
+    try {
+        await prompts().replaceWithLimit(row, MAX_PROMPTS_PER_USER, archived);
+    }
+    catch (error) {
+        if (error instanceof PersistenceResourceLimitError) {
+            throw new ResourcePolicyError(`A user may store at most ${MAX_PROMPTS_PER_USER} prompts`, 409);
+        }
+        throw error;
+    }
+};
+const assertSlugAvailable = async (userId, slug, currentId) => {
+    const existing = await prompts().findBySlug(userId, slug);
+    if (existing && existing.id !== currentId) {
+        throw new ResourcePolicyError(`A prompt already uses the slug "${slug}"`, 409);
+    }
+};
+/** Read access resolved through ownership or a grant; null hides existence. */
+const readable = async (promptId, actor) => {
+    const row = await prompts().findById(promptId);
+    if (!row)
+        return null;
+    if (row.user_id === actor.userId)
+        return row;
+    const decision = await authorize(actor, 'read', {
+        type: 'prompt',
+        id: promptId,
+        ownerUserId: row.user_id,
+    });
+    return decision.allowed ? row : null;
+};
+export const listPrompts = async (userId) => {
+    const rows = await prompts().listByOwner(userId, MAX_PROMPTS_PER_USER);
+    return rows.map(mapPromptRow);
+};
+/** Own prompts followed by prompts shared with the actor. */
+export const listPromptsWithShared = async (actor) => {
+    const own = (await prompts().listByOwner(actor.userId, MAX_PROMPTS_PER_USER)).map(mapPromptRow);
+    const sharedIds = await grantedResourceIdsFor(actor, 'prompt', new Set(own.map(prompt => prompt.id)));
+    const shared = [];
+    for (const promptId of sharedIds) {
+        const row = await prompts().findById(promptId);
+        if (!row || row.user_id === actor.userId)
+            continue;
+        const meta = await sharedMetaFor(actor, 'prompt', promptId, row.user_id);
+        if (!meta)
+            continue;
+        shared.push({ ...mapPromptRow(row), shared: meta });
+    }
+    shared.sort((left, right) => right.updatedAt - left.updatedAt);
+    return [...own, ...shared];
+};
+export const getPrompt = async (promptId, actor) => {
+    const row = await readable(promptId, actor);
+    return row ? mapPromptRow(row) : null;
+};
+export const getPromptBySlug = async (userId, slug) => {
+    const row = await prompts().findBySlug(userId, slug);
+    return row ? mapPromptRow(row) : null;
+};
+export const createPrompt = async (userId, input) => {
+    const normalized = normalize(input);
+    await assertSlugAvailable(userId, normalized.slug);
+    const now = Date.now();
+    const prompt = {
+        id: uuidv4(),
+        ...normalized,
+        version: 1,
+        createdAt: now,
+        updatedAt: now,
+        ownerUserId: userId,
+    };
+    await persist(toRow(prompt, normalized), null);
+    await recordAuditEvent({
+        action: 'prompt.create',
+        result: 'success',
+        actorUserId: userId,
+        targetType: 'prompt',
+        targetId: prompt.id,
+        details: { slug: prompt.slug, version: prompt.version },
+    });
+    return prompt;
+};
+export const updatePrompt = async (promptId, actor, input) => {
+    const existing = await readable(promptId, actor);
+    if (!existing)
+        return null;
+    await requireAuthorized(actor, 'write', {
+        type: 'prompt',
+        id: promptId,
+        ownerUserId: existing.user_id,
+    });
+    const normalized = normalize({
+        slug: input.slug ?? existing.slug,
+        title: input.title,
+        description: input.description,
+        content: input.content,
+        variables: input.variables,
+        tags: input.tags,
+    });
+    await assertSlugAvailable(existing.user_id, normalized.slug, promptId);
+    const prompt = {
+        id: existing.id,
+        ...normalized,
+        version: existing.version + 1,
+        createdAt: existing.created_at,
+        updatedAt: Date.now(),
+        ownerUserId: existing.user_id,
+    };
+    await persist(toRow(prompt, normalized), archiveRowOf(existing));
+    await recordAuditEvent({
+        action: 'prompt.update',
+        result: 'success',
+        actorUserId: actor.userId,
+        targetType: 'prompt',
+        targetId: prompt.id,
+        details: { slug: prompt.slug, version: prompt.version },
+    });
+    return prompt;
+};
+export const deletePrompt = async (promptId, userId) => {
+    const deleted = await prompts().deleteByOwner(promptId, userId);
+    if (!deleted)
+        return false;
+    await deleteGrantsForResource('prompt', promptId);
+    await recordAuditEvent({
+        action: 'prompt.delete',
+        result: 'success',
+        actorUserId: userId,
+        targetType: 'prompt',
+        targetId: promptId,
+    });
+    return true;
+};
+export const listVersions = async (promptId, actor) => {
+    const row = await readable(promptId, actor);
+    if (!row)
+        return null;
+    const versions = await prompts().listVersions(promptId, MAX_PROMPT_VERSIONS);
+    return versions.map(version => ({
+        version: version.version,
+        content: encryptionService.decrypt(version.content),
+        variables: parseVariables(version.variables),
+        createdAt: version.created_at,
+    }));
+};
+/** A rollback replays an archived revision forward as the next version. */
+export const rollbackPrompt = async (promptId, actor, version) => {
+    const existing = await readable(promptId, actor);
+    if (!existing)
+        return null;
+    await requireAuthorized(actor, 'write', {
+        type: 'prompt',
+        id: promptId,
+        ownerUserId: existing.user_id,
+    });
+    if (!Number.isSafeInteger(version) || version < 1) {
+        throw new ResourcePolicyError('version must be a positive integer', 400);
+    }
+    const revision = await prompts().findVersion(promptId, version);
+    if (!revision) {
+        throw new ResourcePolicyError(`Version ${version} is not archived`, 400);
+    }
+    const restored = {
+        ...existing,
+        content: revision.content,
+        variables: revision.variables,
+        version: existing.version + 1,
+        updated_at: Date.now(),
+    };
+    await persist(restored, archiveRowOf(existing));
+    await recordAuditEvent({
+        action: 'prompt.rollback',
+        result: 'success',
+        actorUserId: actor.userId,
+        targetType: 'prompt',
+        targetId: promptId,
+        details: { restoredFrom: version, version: restored.version },
+    });
+    return mapPromptRow(restored);
+};
+export const exportPrompt = async (promptId, actor) => {
+    const prompt = await getPrompt(promptId, actor);
+    if (!prompt)
+        return null;
+    return {
+        slug: prompt.slug,
+        title: prompt.title,
+        ...(prompt.description !== undefined
+            ? { description: prompt.description }
+            : {}),
+        content: prompt.content,
+        variables: prompt.variables,
+        tags: prompt.tags,
+        version: prompt.version,
+        exportedAt: Date.now(),
+        format: PROMPT_EXPORT_FORMAT,
+    };
+};
+export const importPrompt = async (userId, payload, options = {}) => {
+    if (typeof payload !== 'object' || payload === null) {
+        throw new ResourcePolicyError('An import payload is required', 400);
+    }
+    const raw = payload;
+    if (raw.format !== undefined && raw.format !== PROMPT_EXPORT_FORMAT) {
+        throw new ResourcePolicyError(`Unsupported import format; expected ${PROMPT_EXPORT_FORMAT}`, 400);
+    }
+    const normalized = normalize(raw);
+    const existing = await prompts().findBySlug(userId, normalized.slug);
+    if (existing && !options.overwriteSlug) {
+        throw new ResourcePolicyError(`A prompt already uses the slug "${normalized.slug}"`, 409);
+    }
+    const now = Date.now();
+    const prompt = {
+        id: existing?.id ?? uuidv4(),
+        ...normalized,
+        version: existing ? existing.version + 1 : 1,
+        createdAt: existing?.created_at ?? now,
+        updatedAt: now,
+        ownerUserId: userId,
+    };
+    await persist(toRow(prompt, normalized), existing ? archiveRowOf(existing) : null);
+    await recordAuditEvent({
+        action: 'prompt.import',
+        result: 'success',
+        actorUserId: userId,
+        targetType: 'prompt',
+        targetId: prompt.id,
+        details: {
+            slug: prompt.slug,
+            version: prompt.version,
+            overwrote: Boolean(existing),
+        },
+    });
+    return prompt;
+};
+/**
+ * Pure substitution used by the chat surface: validates the supplied values
+ * against the declarations, then replaces every `{{name}}` token.
+ */
+export const renderPrompt = (content, variables, values) => {
+    const resolved = new Map();
+    for (const variable of variables) {
+        const supplied = values[variable.name];
+        const raw = supplied === undefined || supplied === null || supplied === ''
+            ? variable.default
+            : supplied;
+        if (raw === undefined || raw === null || raw === '') {
+            if (variable.required) {
+                throw new ResourcePolicyError(`variable "${variable.name}" is required`, 400);
+            }
+            resolved.set(variable.name, '');
+            continue;
+        }
+        if (variable.type === 'number') {
+            const parsed = typeof raw === 'number' ? raw : Number(raw);
+            if (!Number.isFinite(parsed)) {
+                throw new ResourcePolicyError(`variable "${variable.name}" must be a number`, 400);
+            }
+            resolved.set(variable.name, String(parsed));
+            continue;
+        }
+        if (variable.type === 'boolean') {
+            const truthy = raw === true || raw === 'true';
+            const falsy = raw === false || raw === 'false';
+            if (!truthy && !falsy) {
+                throw new ResourcePolicyError(`variable "${variable.name}" must be a boolean`, 400);
+            }
+            resolved.set(variable.name, truthy ? 'true' : 'false');
+            continue;
+        }
+        const text = String(raw);
+        if (variable.type === 'select' &&
+            !(variable.options ?? []).includes(text)) {
+            throw new ResourcePolicyError(`variable "${variable.name}" must be one of the declared options`, 400);
+        }
+        resolved.set(variable.name, text);
+    }
+    return content.replace(PLACEHOLDER_PATTERN, (match, name) => resolved.get(name) ?? match);
+};
+//# sourceMappingURL=promptService.js.map

package/backend/dist/services/promptService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptService.js","sourceRoot":"","sources":["../../src/services/promptService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAKhF,OAAO,EACL,SAAS,EACT,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EACL,qBAAqB,EACrB,aAAa,GAEd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AA2CpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AActD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,MAAM,cAAc,GAAkC;IACpD,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,SAAS;CACV,CAAC;AACF,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,iBAAiB,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC;AAEnE,MAAM,QAAQ,GAAG,CACf,KAAc,EACd,KAAa,EACb,OAAe,EACf,QAAiB,EACG,EAAE;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,cAAc,EAAE,GAAG,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,mBAAmB,CAAC,GAAG,KAAK,mBAAmB,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,GAAG,KAAK,kCAAkC,OAAO,aAAa,EAC9D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAU,EAAE;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,CAAW,CAAC;IAC7E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAC3B,mFAAmF,EACnF,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoB,EAAE;IACzD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,oBAAoB,YAAY,EAChE,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,mBAAmB,CAC3B,6DAA6D,EAC7D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IACE,OAAO,IAAI,KAAK,QAAQ;YACxB,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,0BAA0B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,IAAI,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,QAAQ,CAC3B,GAAG,CAAC,OAAO,EACX,aAAa,IAAI,WAAW,EAC5B,IAAI,EACJ,KAAK,CACN,CAAC;QACF,IAAI,OAA6B,CAAC;QAClC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACtD,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,EACjE,CAAC;gBACD,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,qCAAqC,EACtD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;gBAC9C,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,6BAA6B,EAC9C,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,GAAG,CAAC,OAAmB,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,6CAA6C,EAC9D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,IAA0B;YAChC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAY,EAAE;IAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAC3B,8BAA8B,eAAe,OAAO,EACpD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,uBAAuB,cAAc,aAAa,EAClD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,0BAA0B,GAAG,CACjC,OAAe,EACf,SAA2B,EACrB,EAAE;IACR,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,mBAAmB,CAAC,SAAS,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,IAAI,GAAG,EAClD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC,CAAC;AAWF,MAAM,SAAS,GAAG,CAAC,KAAkB,EAAoB,EAAE;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CACpB,KAAK,CAAC,KAAK,EACX,OAAO,EACP,uBAAuB,EACvB,IAAI,CACK,CAAC;IACZ,MAAM,WAAW,GAAG,QAAQ,CAC1B,KAAK,CAAC,WAAW,EACjB,aAAa,EACb,6BAA6B,EAC7B,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CACtB,KAAK,CAAC,OAAO,EACb,SAAS,EACT,yBAAyB,EACzB,IAAI,CACK,CAAC;IACZ,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI;QACJ,KAAK;QACL,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO;QACP,SAAS;QACT,IAAI;KACL,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAAoB,EAAoB,EAAE;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAY,CAAC;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAoB,EAAY,EAAE;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAY,CAAC;QACvE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,GAAuB,EAAU,EAAE,CAAC,CAAC;IACzD,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,WAAW;QACjB,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;QAC7D,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAC/C,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;IACxC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;IACzB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,UAAU;IACzB,WAAW,EAAE,GAAG,CAAC,OAAO;CACzB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CACZ,MAAc,EACd,UAA4B,EACR,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC,EAAE;IACb,OAAO,EAAE,MAAM,CAAC,WAAW;IAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;IACrB,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;IAClD,WAAW,EACT,UAAU,CAAC,WAAW,KAAK,SAAS;QAClC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,IAAI;IACV,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IACtD,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC1E,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,MAAM,CAAC,OAAO;IACvB,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,UAAU,EAAE,MAAM,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,GAAuB,EAA6B,EAAE,CAAC,CAAC;IAC5E,EAAE,EAAE,MAAM,EAAE;IACZ,SAAS,EAAE,GAAG,CAAC,EAAE;IACjB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,UAAU,EAAE,GAAG,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,KAAK,EACnB,GAAuB,EACvB,QAA0C,EAC3B,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;YACnD,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,oBAAoB,UAAU,EAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,KAAK,EAC/B,MAAc,EACd,IAAY,EACZ,SAAkB,EACH,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,IAAI,GAAG,EAC1C,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAgB,EAChB,KAAiB,EACmB,EAAE;IACtC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;QAC9C,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,GAAG,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAqB,EAAE;IACrE,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AAChC,CAAC,CAAC;AAMF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,KAAiB,EACY,EAAE;IAC/B,MAAM,GAAG,GAAuB,CAC9B,MAAM,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAChE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,KAAK,EACL,QAAQ,EACR,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACtC,CAAC;IACF,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM;YAAE,SAAS;QACnD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,QAAgB,EAChB,KAAiB,EACO,EAAE;IAC1B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAc,EACd,IAAY,EACY,EAAE;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,KAAkB,EACD,EAAE;IACnB,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAW;QACrB,EAAE,EAAE,MAAM,EAAE;QACZ,GAAG,UAAU;QACb,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;KACxD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAgB,EAChB,KAAiB,EACjB,KAAkB,EACM,EAAE;IAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE;QACtC,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,QAAQ,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAW;QACrB,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,GAAG,UAAU;QACb,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;QAC7B,SAAS,EAAE,QAAQ,CAAC,UAAU;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,WAAW,EAAE,QAAQ,CAAC,OAAO;KAC9B,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;KACxD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAgB,EAChB,MAAc,EACI,EAAE;IACpB,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAgB,EAChB,KAAiB,EACiB,EAAE;IACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACnD,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5C,SAAS,EAAE,OAAO,CAAC,UAAU;KAC9B,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,QAAgB,EAChB,KAAiB,EACjB,OAAe,EACS,EAAE;IAC1B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE;QACtC,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,QAAQ,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAAC,WAAW,OAAO,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAuB;QACnC,GAAG,QAAQ;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO,GAAG,CAAC;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;IACF,MAAM,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;KAC9D,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAgB,EAChB,KAAiB,EACa,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,MAAM,EAAE,oBAAoB;KAC7B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAAc,EACd,OAAgB,EAChB,OAAO,GAAgC,EAAE,EACxB,EAAE;IACnB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,oBAAoB,EAAE,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,SAAS,CAAC,GAAkB,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,IAAI,mBAAmB,CAC3B,mCAAmC,UAAU,CAAC,IAAI,GAAG,EACrD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAW;QACrB,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,EAAE;QAC5B,GAAG,UAAU;QACb,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,SAAS,EAAE,QAAQ,EAAE,UAAU,IAAI,GAAG;QACtC,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,MAAM;KACpB,CAAC;IACF,MAAM,OAAO,CACX,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,EACzB,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC;IACF,MAAM,gBAAgB,CAAC;QACrB,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;SAC7B;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAe,EACf,SAA2B,EAC3B,MAA+B,EACvB,EAAE;IACV,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,GAAG,GACP,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE;YAC5D,CAAC,CAAC,QAAQ,CAAC,OAAO;YAClB,CAAC,CAAC,QAAQ,CAAC;QACf,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,QAAQ,CAAC,IAAI,eAAe,EACzC,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,mBAAmB,CAC3B,aAAa,QAAQ,CAAC,IAAI,oBAAoB,EAC9C,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,CAAC;YAC9C,MAAM,KAAK,GAAG,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,QAAQ,CAAC,IAAI,qBAAqB,EAC/C,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IACE,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAC1B,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,aAAa,QAAQ,CAAC,IAAI,uCAAuC,EACjE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CACpB,mBAAmB,EACnB,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CACrD,CAAC;AACJ,CAAC,CAAC"}

package/backend/dist/services/resourceGrantService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resourceGrantService.d.ts","sourceRoot":"","sources":["../../src/services/resourceGrantService.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAGV,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AAGnC,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAaD;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,UAAU,gBACH,qBAAqB,cACvB,MAAM,KACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAU1D,CAAC;AAEF,eAAO,MAAM,qBAAqB,UACzB,UAAU,gBACH,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,yBAAyB,EAAE,CAUrC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,SACV;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,KACA,OAAO,CAAC,yBAAyB,CAsEnC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,WACR,MAAM,KACd,OAAO,CAAC,OAAO,CA2CjB,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,UACtB,UAAU,KAChB,OAAO,CAAC,yBAAyB,EAAE,CAWrC,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,iBACpB,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,MAAM,CAC8C,CAAC"}
+{"version":3,"file":"resourceGrantService.d.ts","sourceRoot":"","sources":["../../src/services/resourceGrantService.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAGV,yBAAyB,EAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAC;AA4DnC,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAF7B,YACE,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAI5B;CACF;AAaD;;;GAGG;AACH,eAAO,MAAM,eAAe,UACnB,UAAU,gBACH,qBAAqB,cACvB,MAAM,KACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAU1D,CAAC;AAEF,eAAO,MAAM,qBAAqB,UACzB,UAAU,gBACH,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,yBAAyB,EAAE,CAUrC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,SACV;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,KACA,OAAO,CAAC,yBAAyB,CAuEnC,CAAC;AAEF,eAAO,MAAM,WAAW,UACf,UAAU,WACR,MAAM,KACd,OAAO,CAAC,OAAO,CA6CjB,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,UACtB,UAAU,KAChB,OAAO,CAAC,yBAAyB,EAAE,CAWrC,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB,iBACpB,MAAM,cACR,MAAM,KACjB,OAAO,CAAC,MAAM,CAC8C,CAAC"}

package/backend/dist/services/resourceGrantService.js

@@ -30,6 +30,47 @@ import { encryptionService } from './encryptionService.js';
 import { buildAuditEvent } from './securityAuditService.js';
 import { authorize, isShareableResourceType, } from './authorizationService.js';
 import { userModel } from '../models/userModel.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('resource-grants');
+/**
+ * Post-commit propagation for a grant change. Knowledge shares re-publish
+ * the vector ACL so retrieval reflects the new grant set immediately.
+ * Failures are logged, never thrown: the SQL grant rows stay authoritative
+ * and the next index publication converges the ACL.
+ */
+const propagateGrantChange = async (record, change) => {
+    if (record.resource_type === 'document' ||
+        record.resource_type === 'knowledge-collection') {
+        try {
+            const { default: documentService } = await import('./documentService.js');
+            await documentService.syncShareGrants(record.resource_type, record.resource_id, record.owner_user_id);
+        }
+        catch (error) {
+            logger.error('Failed to propagate a share change to the vector ACL', {
+                resourceType: record.resource_type,
+                error,
+            });
+        }
+    }
+    if (change === 'created' && record.principal_type === 'user') {
+        try {
+            const [{ notificationService }, { userModel }] = await Promise.all([
+                import('./notificationService.js'),
+                import('../models/userModel.js'),
+            ]);
+            const owner = await userModel.getUserById(record.owner_user_id);
+            await notificationService.publish({
+                userId: record.principal_id,
+                type: 'share',
+                title: `${owner?.username ?? 'Someone'} shared a ${record.resource_type.replace(/-/g, ' ')} with you`,
+                sourceKey: `share:${record.id}`,
+            });
+        }
+        catch (error) {
+            logger.warn('Share notification failed', { error });
+        }
+    }
+};
 export class ResourceGrantError extends Error {
     constructor(message, statusCode) {
         super(message);
@@ -127,12 +168,14 @@ export const createGrant = async (actor, input) => {
             tx.audit.insert(audit);
             return undefined;
         });
-        return record;
     }
-    await persistence.transaction(async ({ security: tx }) => {
-        await tx.grants.upsert(record);
-        await tx.audit.insert(audit);
-    });
+    else {
+        await persistence.transaction(async ({ security: tx }) => {
+            await tx.grants.upsert(record);
+            await tx.audit.insert(audit);
+        });
+    }
+    await propagateGrantChange(record, 'created');
     return record;
 };
 export const deleteGrant = async (actor, grantId) => {
@@ -161,20 +204,22 @@ export const deleteGrant = async (actor, grantId) => {
         },
     });
     const persistence = getPersistence(encryptionService);
-    if (persistence.dialect === 'sqlite') {
-        return persistence.transaction(({ security: tx }) => {
-            const deleted = tx.grants.delete(grantId);
-            if (deleted)
+    const deleted = persistence.dialect === 'sqlite'
+        ? await persistence.transaction(({ security: tx }) => {
+            const removed = tx.grants.delete(grantId);
+            if (removed)
                 tx.audit.insert(audit);
-            return deleted;
+            return removed;
+        })
+        : await persistence.transaction(async ({ security: tx }) => {
+            const removed = await tx.grants.delete(grantId);
+            if (removed)
+                await tx.audit.insert(audit);
+            return removed;
         });
-    }
-    return persistence.transaction(async ({ security: tx }) => {
-        const deleted = await tx.grants.delete(grantId);
-        if (deleted)
-            await tx.audit.insert(audit);
-        return deleted;
-    });
+    if (deleted)
+        await propagateGrantChange(record, 'revoked');
+    return deleted;
 };
 /** Resources shared with the actor (directly or via groups). */
 export const listGrantsForActor = async (actor) => {