studiograph 1.3.48-next.2 → 1.3.48-next.201

package/dist/server/routes/asset-api.js

@@ -0,0 +1,593 @@
+/**
+ * Asset upload and serving API routes.
+ *
+ * POST /api/repos/:repo/entities/:type/:id/assets — multipart image upload
+ * GET  /api/assets/*                               — serve local assets
+ */
+import { reqGitUser } from './graph-api-access.js';
+import * as access from '../../services/access-control.js';
+import { listRepoAssets, listWorkspaceAssets, clearLegacyBucketCache, isFreeStandingOwner } from '../../services/asset-listing.js';
+import { createEntityFromAsset } from '../../services/asset-import-service.js';
+import { assetDeleteDenial, assetDeleteDenialByAssetId } from '../../services/asset-delete-authz.js';
+import { resolveWorkspaceAssetsRepo } from '../../services/workspace-assets-folder.js';
+import { Workspace } from '../../core/workspace.js';
+import { existsSync, createReadStream, statSync } from 'fs';
+import { join, extname } from 'path';
+const MIME_TYPES = {
+    '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml',
+    '.ico': 'image/x-icon', '.avif': 'image/avif',
+};
+function hasRepoAccess(req, repoName, workspaceManager, authService) {
+    const user = req.user;
+    return access.hasRepoAccess(user, repoName, workspaceManager, authService);
+}
+/**
+ * Serve an immutable-key asset's bytes once authorization has already been
+ * decided by the caller. This is the shared serving primitive behind BOTH the
+ * authed `/api/assets/:assetId/:filename` route (authz = hasRepoAccess) and the
+ * public `/api/share/:token/asset/...` route (authz = valid token + repo scope).
+ *
+ * It does serving ONLY — R2 302-redirect vs local stream, path-segment
+ * hardening, and cache headers. The index lookup, filename match, and the
+ * access decision stay in each route so neither surface can drift into serving
+ * a file the other wouldn't authorize.
+ *
+ * The owning `repo` must be resolved by the caller (from the asset index) so the
+ * correct graph/backend is selected. Always fail-closed with 404 — never leak
+ * existence.
+ */
+export async function serveIndexedAsset(workspaceManager, reply, opts) {
+    const { assetId, filename, repo, isHead } = opts;
+    let graph;
+    try {
+        graph = workspaceManager.getGraph(repo);
+    }
+    catch {
+        return reply.status(404).send({ error: 'Asset not found' });
+    }
+    if (graph.getAssetStorage() === 'r2') {
+        try {
+            const signed = await graph.getAssetSignedUrlByAssetId(assetId, filename, isHead ? 'HEAD' : 'GET');
+            reply.header('Cache-Control', 'private, max-age=14400');
+            return reply.redirect(signed, 302);
+        }
+        catch (err) {
+            reply.log?.warn?.({ err, assetId, filename }, 'asset r2 signed-url generation failed');
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+    }
+    // Local backend: stream from .studiograph/assets/{assetId}/{filename}.
+    // Defense-in-depth segment validation (Fastify already blocks `/`).
+    if (filename.includes('..') || filename.includes('/') || filename.includes('\\') || filename.startsWith('.') ||
+        assetId.includes('..') || assetId.includes('/') || assetId.includes('\\')) {
+        return reply.status(404).send({ error: 'Asset not found' });
+    }
+    const localBase = workspaceManager.workspacePath ?? process.cwd();
+    const filePath = join(localBase, '.studiograph', 'assets', assetId, filename);
+    if (!existsSync(filePath)) {
+        return reply.status(404).send({ error: 'Asset not found' });
+    }
+    const ext = extname(filename).toLowerCase();
+    reply.header('Content-Type', MIME_TYPES[ext] || 'application/octet-stream');
+    reply.header('Content-Length', statSync(filePath).size);
+    reply.header('Cache-Control', 'public, max-age=31536000, immutable');
+    // Neutralize active content served from the app origin. SVG uploads are
+    // blocked, but legacy/migrated/indexed SVGs would otherwise run script when
+    // opened directly as image/svg+xml — now reachable anonymously via the share
+    // route. A sandbox CSP blocks script + plugins on direct navigation (img
+    // embeds still render, since <img> never executes SVG script), and nosniff
+    // stops a mislabeled asset from being re-interpreted as HTML.
+    reply.header('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox");
+    reply.header('X-Content-Type-Options', 'nosniff');
+    if (isHead)
+        return reply.send();
+    return reply.send(createReadStream(filePath));
+}
+export async function registerAssetApiRoutes(fastify, workspaceManager, authService) {
+    // POST /api/repos/:repo/entities/:type/:id/assets — upload an image
+    fastify.post('/api/repos/:repo/entities/:type/:id/assets', async (req, reply) => {
+        const { repo, type, id } = req.params;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        const file = await req.file();
+        if (!file)
+            return reply.status(400).send({ error: 'No file uploaded' });
+        if (!file.mimetype.startsWith('image/')) {
+            return reply.status(400).send({ error: 'Only image files are supported' });
+        }
+        // Block SVG: stored XSS — SVG can contain <script> and the GET route
+        // serves it inline as image/svg+xml, executing in the app origin.
+        if (file.mimetype === 'image/svg+xml' || file.filename?.toLowerCase().endsWith('.svg')) {
+            return reply.status(415).send({ error: 'SVG uploads are not supported (stored XSS risk).' });
+        }
+        const buffer = await file.toBuffer();
+        const filename = `${Date.now()}-${file.filename.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+        const uploader = req.user;
+        try {
+            const asset = await graph.uploadAsset(type, id, filename, buffer, undefined, {
+                uploaderUserId: uploader?.id != null ? String(uploader.id) : null,
+            });
+            // uploadAsset returns the canonical public URL (immutable-key scheme
+            // when the index is wired, legacy otherwise) — don't re-derive it.
+            return reply.send({ url: asset.publicUrl, filename: asset.filename, size: asset.size });
+        }
+        catch (err) {
+            if (err.message?.includes('not configured')) {
+                return reply.status(501).send({ error: 'Image uploads are not available. Configure R2 or local storage.' });
+            }
+            return reply.status(400).send({ error: err.message });
+        }
+    });
+    // GET / HEAD /api/assets/:assetId/:filename — IMMUTABLE-KEY serve route.
+    //
+    // New scheme: assets are keyed `{assetId}/{filename}` (assetId = UUIDv4) and
+    // ownership/authz lives in the AssetIndexService, not in the URL. Two path
+    // segments after /api/assets/ vs three for the legacy route below — Fastify
+    // disambiguates by arity, so both coexist during the migration cutover.
+    //
+    // Authz: index.get(assetId) → repo → hasRepoAccess. Fail-closed on a miss.
+    // The filename in the URL MUST match the indexed filename, otherwise a valid
+    // assetId would authorize arbitrary keys under that UUID directory.
+    fastify.route({
+        method: ['GET', 'HEAD'],
+        url: '/api/assets/:assetId/:filename',
+        handler: async (req, reply) => {
+            const { assetId, filename } = req.params;
+            const isHead = req.method === 'HEAD';
+            const row = workspaceManager.getAssetIndex().get(assetId);
+            // Fail-closed: unknown id, or a filename that doesn't match the indexed
+            // one, both 404 (never leak existence; never authorize a sibling key).
+            if (!row || row.filename !== filename) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            if (!hasRepoAccess(req, row.repo, workspaceManager, authService)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // Authz decided above (folder access); shared helper does the serving.
+            return serveIndexedAsset(workspaceManager, reply, { assetId, filename, repo: row.repo, isHead });
+        },
+    });
+    // GET / HEAD /api/assets/:type/:id/:filename — LEGACY serve route (kept for
+    // the migration cutover window; removed once legacy-hit logs drain to 0).
+    //
+    // Per-repo authz: the asset storage layout is workspace-global
+    // (`.studiograph/assets/{type}/{id}/{filename}` for local;
+    // `{type}/{id}/{filename}` keys for R2) — the path doesn't carry repo
+    // information. To enforce that a user with access to folder A can't
+    // read assets owned by folder B, we resolve the owning repo from the
+    // entity ID via workspaceManager.findEntityById (the same primitive
+    // the agent's create_entity uses for cross-repo dedup checks), then
+    // run hasRepoAccess against that repo. Both miss and forbid return 404
+    // — never leak entity IDs as an existence oracle.
+    //
+    // Stage 2 (this commit): the route is now the single chokepoint for
+    // both backends. Local files stream directly. R2-backed assets get a
+    // 302 redirect to a short-lived pre-signed URL, so the underlying
+    // bucket can be flipped to private without breaking the workflow.
+    // Both GET and HEAD are registered — link unfurlers, OpenGraph
+    // crawlers, and CDN healthchecks issue HEAD against this URL and
+    // expect the same 302 (signed for HEAD) or local headers.
+    fastify.route({
+        method: ['GET', 'HEAD'],
+        url: '/api/assets/:type/:id/:filename',
+        handler: async (req, reply) => {
+            const { type, id, filename } = req.params;
+            const isHead = req.method === 'HEAD';
+            // Legacy-scheme hit. Monitored during cutover: once this drains to 0
+            // (all bodies migrated to /api/assets/{assetId}/...), this route is
+            // removed. Tagged so it's greppable in logs / metrics.
+            req.log?.info?.({ type, id, filename }, 'asset legacy-scheme route hit');
+            // Legacy keys carry NO repo identity, and entity IDs are unique within
+            // (repo, type) but NOT across the workspace — a case-study in `portfolio`
+            // and a reference in `analogous-experiences` can share an id. The old
+            // first-match `findEntityByTypeAndId` would authorize against an arbitrary
+            // owner, so on a slug collision a request could be authorized via an
+            // accessible repo yet serve a *different* repo's blob (codex P1). FAIL
+            // CLOSED: resolve every repo that owns (type,id); serve only when exactly
+            // one repo owns it AND that repo is accessible. (Immutable assets use the
+            // /api/assets/{assetId}/... route and are unaffected.)
+            const owners = [];
+            for (const cfg of workspaceManager.getAllRepoConfigs()) {
+                let g;
+                try {
+                    g = workspaceManager.getGraph(cfg.name);
+                }
+                catch {
+                    continue;
+                }
+                if (g.getEntityFilePath(type, id))
+                    owners.push(cfg.name);
+            }
+            if (owners.length !== 1) {
+                return reply.status(404).send({ error: 'Asset not found' }); // ambiguous / none → fail closed
+            }
+            const repoName = owners[0];
+            if (!hasRepoAccess(req, repoName, workspaceManager, authService)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            let graph;
+            try {
+                graph = workspaceManager.getGraph(repoName);
+            }
+            catch {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            // R2 backend: 302 to a short-lived pre-signed URL. Cache the 302
+            // for the lifetime of the signed URL (4 hours) — this is the
+            // load-bearing perf optimization. Signed URLs are unique per
+            // request (each carries its own X-Amz-Signature), so without
+            // caching the redirect, every <img> tag fires a fresh proxy
+            // roundtrip AND a fresh R2 download (the signed URL is different
+            // each time, so the browser's image cache miss-matches and
+            // re-downloads bytes it already has). Caching the 302 means
+            // subsequent requests in the same 4-hour window resolve to the
+            // SAME signed URL → cached image bytes → zero network. Single
+            // line, multi-second page-load improvement.
+            //
+            // Trade-off: a signed URL cached in the browser keeps working
+            // for up to 4 hours after the user loses folder access. Same
+            // threat model the 4-hour signed-URL TTL already accepted —
+            // fresh URLs lived 4 hours, now cached URLs do too. `private`
+            // keeps shared caches (CDNs, corporate proxies) from holding
+            // the 302; only the originating browser does.
+            //
+            // Pre-signed URLs are method-bound, so HEAD requests need a
+            // HEAD-signed URL.
+            if (graph.getAssetStorage() === 'r2') {
+                try {
+                    const signed = await graph.getAssetSignedUrl(type, id, filename, undefined, undefined, isHead ? 'HEAD' : 'GET');
+                    reply.header('Cache-Control', 'private, max-age=14400');
+                    return reply.redirect(signed, 302);
+                }
+                catch (err) {
+                    // Surface SDK / network failures so credential rotation issues,
+                    // R2 outages, etc. aren't silently presented to users as
+                    // 'Asset not found'. The user-facing response stays 404 so
+                    // entity IDs aren't leaked as an existence oracle.
+                    req.log?.warn?.({ err, type, id, filename }, 'asset r2 signed-url generation failed');
+                    return reply.status(404).send({ error: 'Asset not found' });
+                }
+            }
+            // Local backend: stream the file directly. Defense-in-depth — the
+            // R2 branch already validates filename inside AssetService, so
+            // hold the local branch to the same standard. Fastify's segment
+            // matcher blocks `/` in path params, but a literal `..` or hidden
+            // dotfile would otherwise be passed through to `join` here.
+            if (filename.includes('..') || filename.includes('/') || filename.includes('\\') || filename.startsWith('.') ||
+                id.includes('..') || id.includes('/') || id.includes('\\') ||
+                type.includes('..') || type.includes('/') || type.includes('\\')) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            const workspacePath = workspaceManager.workspacePath ?? process.cwd();
+            const filePath = join(workspacePath, '.studiograph', 'assets', type, id, filename);
+            if (!existsSync(filePath)) {
+                return reply.status(404).send({ error: 'Asset not found' });
+            }
+            const ext = extname(filename).toLowerCase();
+            const contentType = MIME_TYPES[ext] || 'application/octet-stream';
+            const stats = statSync(filePath);
+            reply.header('Content-Type', contentType);
+            reply.header('Content-Length', stats.size);
+            reply.header('Cache-Control', 'public, max-age=31536000, immutable');
+            // HEAD: send headers without a body. Fastify auto-strips body on
+            // HEAD, but being explicit keeps the file handle from opening.
+            if (isHead)
+                return reply.send();
+            return reply.send(createReadStream(filePath));
+        },
+    });
+    // GET /api/repos/:repo/assets — list all assets in a folder. The listing
+    // logic (backend walk + immutable-index merge + name resolution) lives in
+    // listRepoAssets() so the MCP `list_assets` tool returns an identical shape.
+    fastify.get('/api/repos/:repo/assets', async (req, reply) => {
+        const { repo } = req.params;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Verify the repo exists before delegating; listRepoAssets swallows
+        // missing-graph errors as [], which is right for the bulk endpoint but
+        // wrong for the single-repo one (we want a 404).
+        try {
+            workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        return { assets: await listRepoAssets(repo, workspaceManager) };
+    });
+    // GET /api/workspace/assets — bulk asset lists for ALL accessible repos in
+    // one round-trip. Replaces 15+ parallel /api/repos/:repo/assets calls so
+    // GalleryView's thumbnail effect doesn't saturate the browser HTTP/1.1
+    // 6-slot queue and block other navigation fetches.
+    // Response shape: `{ [repoName]: RepoAsset[] }`.
+    fastify.get('/api/workspace/assets', async (req, reply) => {
+        const user = req.user;
+        // Use the shared access-control helper so personal-folder restrictions
+        // and workspace-owner-on-shared-folder semantics apply consistently.
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService).map(r => r.name);
+        // One bucket walk for the whole workspace (see listWorkspaceAssets) rather
+        // than a per-repo listAll fan-out. Seed every accessible repo so folders
+        // with no assets still appear as empty arrays (shape-stable for callers).
+        const result = {};
+        for (const repo of accessible)
+            result[repo] = [];
+        const flat = await listWorkspaceAssets(accessible, workspaceManager);
+        for (const { repo, ...asset } of flat)
+            (result[repo] ??= []).push(asset);
+        return reply.send(result);
+    });
+    // GET /api/workspace/assets/manager — the dedicated asset-manager view.
+    //
+    // Distinct from /api/workspace/assets (kept shape-stable for GalleryView's
+    // thumbnail effect). This composes the SAME primitives (getAccessibleRepos +
+    // listRepoAssets + assetDeleteDenial) into the shape the /assets UI needs:
+    //   - `folders`: every accessible folder's metadata (display name +
+    //     workspace_wide + system flags) so the client can render the folder
+    //     filter, group headers, the Workspace/folder-scoped visibility badge,
+    //     and pin the shared store first — the system store is excluded from
+    //     /api/repos so the client can't get this elsewhere.
+    //   - `assets`: a FLAT list annotated with the owning `repo` and a per-asset
+    //     `canDelete` decision (uploader/owner gate, via the same authz primitive
+    //     the DELETE route enforces) so the UI can disable delete with a reason
+    //     instead of letting the user hit a 403.
+    fastify.get('/api/workspace/assets/manager', async (req, reply) => {
+        const user = req.user;
+        workspaceManager.reloadConfig();
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService);
+        const index = workspaceManager.getAssetIndex?.();
+        const folders = accessible.map(r => ({
+            repo: r.name,
+            displayName: r.display_name ?? null,
+            workspaceWide: r.workspace_wide === true,
+            system: r.system === true,
+        }));
+        const configByRepo = new Map(accessible.map(r => [r.name, r]));
+        // listWorkspaceAssets does ONE bucket walk for the whole workspace (instead
+        // of one per folder) and already dedupes legacy/immutable pairs per repo.
+        // Here we just layer on the per-asset delete decision so the UI can disable
+        // delete with a reason instead of letting the user hit a 403.
+        const flat = await listWorkspaceAssets(accessible.map(r => r.name), workspaceManager);
+        const assets = flat.map((a) => {
+            const r = configByRepo.get(a.repo);
+            // Index-tracked assets (incl. free-standing folder/workspace-owned ones)
+            // carry an assetId — gate per-asset on that id. Legacy un-indexed blobs
+            // fall back to the entity-coordinate gate, keyed to the exact filename.
+            const denial = a.assetId
+                ? assetDeleteDenialByAssetId(index, r, user, a.assetId)
+                : assetDeleteDenial(index, r, user, a.repo, a.entityType, a.entityId, a.filename);
+            return { ...a, canDelete: denial === null, denialReason: denial };
+        });
+        return reply.send({ folders, assets });
+    });
+    // GET /api/workspace/assets/:assetId/references — entries whose markdown
+    // body (or frontmatter) references this asset's URL. Scans accessible
+    // repos via graph.search, which already includes body-content scanning,
+    // so no schema change is needed. Filters self-reference: a STANDALONE
+    // asset's own wrapper entity has the URL in its `asset_url` frontmatter
+    // and would self-match — drop it. Embedded assets keep their parent
+    // entity in results (the parent IS the only "use", and clicking it is
+    // the user's path to managing the image's context).
+    fastify.get('/api/workspace/assets/:assetId/references', async (req, reply) => {
+        const { assetId } = req.params;
+        const user = req.user;
+        const index = workspaceManager.getAssetIndex?.();
+        const owner = index?.get(assetId) ?? null;
+        const accessible = access.getAccessibleRepos(user, workspaceManager, authService);
+        // The immutable-asset URL pattern. assetId is a UUID so this string
+        // is unique enough that a substring match across markdown bodies is
+        // a reliable "this entry references the asset" signal.
+        const pattern = `/api/assets/${assetId}/`;
+        const references = [];
+        for (const repo of accessible) {
+            let graph;
+            try {
+                graph = workspaceManager.getGraph(repo.name);
+            }
+            catch {
+                continue;
+            }
+            const matches = graph.search({ query: pattern });
+            for (const e of matches) {
+                // Skip self: a standalone asset's own entity holds the URL in
+                // its `asset_url` frontmatter so it always matches its own
+                // search. Embedded assets fall through (their owner is the
+                // parent entry, which IS a legitimate reference to show).
+                if (owner &&
+                    owner.ownerType === 'asset' &&
+                    owner.repo === repo.name &&
+                    e.id === owner.ownerId)
+                    continue;
+                const data = e.data;
+                const title = typeof data.name === 'string' && data.name.trim() !== ''
+                    ? data.name
+                    : e.id;
+                references.push({
+                    repo: repo.name,
+                    entityType: e.entityType,
+                    entityId: e.id,
+                    title,
+                });
+            }
+        }
+        return reply.send({ references });
+    });
+    // GET /api/workspace/assets/store — resolve (lazy-create) the reserved
+    // Workspace Assets store and return its repo name. The manager's upload
+    // affordance calls this, then POSTs the file to /api/repos/<repo>/assets.
+    // This is how an existing workspace backfills the store on first use (D3 /
+    // resolveWorkspaceAssetsRepo) — never a boot sweep. Authed users only; the
+    // store is workspace_wide so any member can upload once it exists.
+    fastify.get('/api/workspace/assets/store', async (_req, reply) => {
+        // Match the upload route's auth posture: open-mode (no user) is allowed.
+        const workspace = new Workspace(workspaceManager.getWorkspacePath());
+        const repo = await resolveWorkspaceAssetsRepo(workspace, workspaceManager);
+        return reply.send({ repo });
+    });
+    // DELETE /api/repos/:repo/entities/:type/:id/assets/:filename — delete an asset
+    fastify.delete('/api/repos/:repo/entities/:type/:id/assets/:filename', async (req, reply) => {
+        const { repo, type, id, filename } = req.params;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Workspace Assets store delete gate (codex P1 / D2): workspace_wide grants
+        // every member write, so this filename delete needs the same uploader/owner
+        // gate the entity-delete route applies — otherwise a direct API call deletes
+        // a shared/legacy file asset the manager already marks canDelete:false.
+        const denial = assetDeleteDenial(workspaceManager.getAssetIndex?.(), workspaceManager.getRepoConfig(repo), req.user, repo, type, id, filename);
+        if (denial)
+            return reply.status(403).send({ error: denial });
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        try {
+            await graph.deleteAsset(type, id, filename);
+            // A legacy blob just disappeared — drop the cached bucket walk so the
+            // manager stops listing it before the next process restart (P2).
+            clearLegacyBucketCache();
+            return { success: true };
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+    });
+    // DELETE /api/repos/:repo/assets/:assetId/:filename — delete a free-standing
+    // (folder/workspace-owned) asset by its immutable id. Folder-owned assets
+    // have no owning entity, so the entity-coordinate route above can't address
+    // them (it rejects 'folder' as an EntityType). This removes the blob + index
+    // row in one step.
+    fastify.delete('/api/repos/:repo/assets/:assetId/:filename', async (req, reply) => {
+        const { repo, assetId, filename } = req.params;
+        if (!hasRepoAccess(req, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        // Confirm the asset exists and actually belongs to this folder — don't let
+        // access to one folder delete another folder's asset by id.
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // Same uploader/owner gate as the filename route, keyed on the asset row.
+        const denial = assetDeleteDenialByAssetId(index, workspaceManager.getRepoConfig(repo), req.user, assetId);
+        if (denial)
+            return reply.status(403).send({ error: denial });
+        // Filename must match the stored row — the key is `{assetId}/{filename}`.
+        if (row.filename !== filename) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        try {
+            await graph.deleteAssetById(assetId, filename);
+            return { success: true };
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+    });
+    // POST /api/repos/:repo/assets/:assetId/create-entry — the second import
+    // "door": create a typed entity (auto-derived type, re-extracted body) that
+    // embeds an EXISTING free-standing asset, in the asset's own folder. Makes
+    // deletion reversible — a surviving asset can be re-embedded into a new entry.
+    fastify.post('/api/repos/:repo/assets/:assetId/create-entry', async (req, reply) => {
+        const { repo, assetId } = req.params;
+        const user = req.user;
+        // Creating an entry is a write — require folder write access.
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: 'Editor access required to create an entry here.' });
+        }
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        // Only free-standing assets get the second import door (parity with the
+        // delete-by-id + move routes). Re-embedding an entity-OWNED asset would
+        // leave the new entry's embed deletable by the owning entity's
+        // cleanupOwnedAssets — so refuse it here, not just in the UI.
+        if (!isFreeStandingOwner(row.ownerType)) {
+            return reply.status(400).send({ error: 'Only free-standing assets can be made into a new entry.' });
+        }
+        let graph;
+        try {
+            graph = workspaceManager.getGraph(repo);
+        }
+        catch (err) {
+            return reply.status(404).send({ error: err.message });
+        }
+        try {
+            const result = await createEntityFromAsset({
+                graph,
+                assetId,
+                name: req.body?.name,
+                user: reqGitUser(req),
+            });
+            return { entities: result.entities, assetId: result.assetId, asset_url: result.asset_url };
+        }
+        catch (err) {
+            return reply.status(400).send({ error: err.message ?? 'Could not create entry from asset' });
+        }
+    });
+    // POST /api/repos/:repo/assets/:assetId/move — relocate a free-standing asset
+    // to another folder. Index-only (the blob key is repo-independent). Requires
+    // write access to BOTH the source and target folders; only free-standing
+    // (folder/workspace-owned) assets can move — entity-embedded assets move with
+    // their owning entry.
+    fastify.post('/api/repos/:repo/assets/:assetId/move', async (req, reply) => {
+        const { repo, assetId } = req.params;
+        const targetRepo = req.body?.targetRepo;
+        const user = req.user;
+        if (!targetRepo)
+            return reply.status(400).send({ error: 'targetRepo is required' });
+        if (!access.canWriteRepo(user, repo, workspaceManager, authService)) {
+            return reply.status(404).send({ error: `Folder "${repo}" not found` });
+        }
+        if (!access.canWriteRepo(user, targetRepo, workspaceManager, authService)) {
+            return reply.status(403).send({ error: `Editor access required to move into "${targetRepo}".` });
+        }
+        const index = workspaceManager.getAssetIndex?.();
+        const row = index?.get(assetId);
+        if (!index || !row || row.repo !== repo) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        if (!isFreeStandingOwner(row.ownerType)) {
+            return reply.status(400).send({ error: 'Only free-standing assets can be moved on their own.' });
+        }
+        // Moving OUT of a workspace_wide store reassigns the asset's repo, after
+        // which the tighter uploader/owner delete rule no longer applies — so the
+        // move itself must honor that rule (mirrors the entity-move guard in
+        // graph-api). A no-op for non-workspace_wide sources, so normal
+        // folder→folder moves are unaffected.
+        const denial = assetDeleteDenialByAssetId(index, workspaceManager.getRepoConfig(repo), user, assetId);
+        if (denial)
+            return reply.status(403).send({ error: denial });
+        if (targetRepo === repo)
+            return { success: true }; // no-op
+        // Honor the result — a concurrent delete/move could have removed the row
+        // between the get() above and here; reporting success then would make the
+        // asset appear moved when it wasn't.
+        if (!index.moveByAssetId(assetId, targetRepo)) {
+            return reply.status(404).send({ error: 'Asset not found' });
+        }
+        return { success: true };
+    });
+}
+//# sourceMappingURL=asset-api.js.map

package/dist/server/routes/asset-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-api.js","sourceRoot":"","sources":["../../../src/server/routes/asset-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,kCAAkC,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAuC,MAAM,iCAAiC,CAAC;AACxK,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AACrG,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAErC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY;IAChE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe;IACnE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY;CAC9C,CAAC;AAEF,SAAS,aAAa,CAAC,GAAmB,EAAE,QAAgB,EAAE,gBAAkC,EAAE,WAAwB;IACxH,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;IACvD,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,gBAAkC,EAClC,KAAmB,EACnB,IAA0E;IAE1E,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEjD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAChD,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAAC,CAAC;IAEtE,IAAI,KAAK,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAClG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;YACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QACxG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,SAAS,GAAI,gBAAwB,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC,CAAC;IAC5E,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;IACrE,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,wDAAwD,CAAC,CAAC;IAClG,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,gBAAkC,EAClC,WAAwB;IAGxB,oEAAoE;IACpE,OAAO,CAAC,IAAI,CAGV,4CAA4C,EAC5C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEtC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,IAAI,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;QAEnF,MAAM,QAAQ,GAAI,GAAW,CAAC,IAA4B,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE;gBACzF,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;aAClE,CAAC,CAAC;YACH,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,yEAAyE;IACzE,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,oEAAoE;IACpE,OAAO,CAAC,KAAK,CAEV;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,GAAG,EAAE,gCAAgC;QACrC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YAErC,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1D,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,uEAAuE;YACvE,OAAO,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,0EAA0E;IAC1E,EAAE;IACF,+DAA+D;IAC/D,2DAA2D;IAC3D,sEAAsE;IACtE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,kDAAkD;IAClD,EAAE;IACF,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,iEAAiE;IACjE,0DAA0D;IAC1D,OAAO,CAAC,KAAK,CAEV;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,GAAG,EAAE,iCAAiC;QACtC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;YACrC,qEAAqE;YACrE,oEAAoE;YACpE,uDAAuD;YACtD,GAAW,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,+BAA+B,CAAC,CAAC;YAElF,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,2EAA2E;YAC3E,qEAAqE;YACrE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC,CAAC;gBACN,IAAI,CAAC;oBAAC,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACpE,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAkB,EAAE,EAAE,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,iCAAiC;YAChG,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YACpD,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAAC,CAAC;YAEtE,iEAAiE;YACjE,6DAA6D;YAC7D,6DAA6D;YAC7D,6DAA6D;YAC7D,4DAA4D;YAC5D,iEAAiE;YACjE,2DAA2D;YAC3D,4DAA4D;YAC5D,+DAA+D;YAC/D,8DAA8D;YAC9D,4CAA4C;YAC5C,EAAE;YACF,8DAA8D;YAC9D,6DAA6D;YAC7D,4DAA4D;YAC5D,8DAA8D;YAC9D,6DAA6D;YAC7D,8CAA8C;YAC9C,EAAE;YACF,4DAA4D;YAC5D,mBAAmB;YACnB,IAAI,KAAK,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAC1C,IAAkB,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EACtD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CACxB,CAAC;oBACF,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;oBACxD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,gEAAgE;oBAChE,yDAAyD;oBACzD,2DAA2D;oBAC3D,mDAAmD;oBAClD,GAAW,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,uCAAuC,CAAC,CAAC;oBAC/F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;YAED,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;gBACxG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,aAAa,GAAI,gBAAwB,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEnF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjC,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACrE,iEAAiE;YACjE,+DAA+D;YAC/D,IAAI,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;IAEH,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,iDAAiD;QACjD,IAAI,CAAC;YAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACxC,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAClE,CAAC,CACF,CAAC;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,mDAAmD;IACnD,iDAAiD;IACjD,OAAO,CAAC,GAAG,CACT,uBAAuB,EACvB,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnG,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,MAAM,GAAgC,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACrE,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,IAAI,IAAI;YAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CACF,CAAC;IAEF,wEAAwE;IACxE,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,yDAAyD;IACzD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAChE,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;QAEjD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI;YACnC,aAAa,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI;YACxC,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAG/D,4EAA4E;QAC5E,0EAA0E;QAC1E,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACtF,MAAM,MAAM,GAAmB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC;YACpC,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO;gBACtB,CAAC,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;gBACvD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;YACpF,OAAO,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,sEAAsE;IACtE,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,oDAAoD;IACpD,OAAO,CAAC,GAAG,CACT,2CAA2C,EAC3C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC/B,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAE1C,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QAClF,oEAAoE;QACpE,oEAAoE;QACpE,uDAAuD;QACvD,MAAM,OAAO,GAAG,eAAe,OAAO,GAAG,CAAC;QAG1C,MAAM,UAAU,GAAgB,EAAE,CAAC;QAEnC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACrD,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACjD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,8DAA8D;gBAC9D,2DAA2D;gBAC3D,2DAA2D;gBAC3D,0DAA0D;gBAC1D,IACE,KAAK;oBACL,KAAK,CAAC,SAAS,KAAK,OAAO;oBAC3B,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;oBACxB,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO;oBACtB,SAAS;gBACX,MAAM,IAAI,GAAG,CAAC,CAAC,IAA+B,CAAC;gBAC/C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;oBACpE,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACT,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,QAAQ,EAAE,CAAC,CAAC,EAAE;oBACd,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IACpC,CAAC,CACF,CAAC;IAEF,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/D,yEAAyE;QACzE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAGZ,sDAAsD,EACtD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,MAAM,GAAG,iBAAiB,CAC9B,gBAAgB,CAAC,aAAa,EAAE,EAAE,EAClC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EACnC,GAAW,CAAC,IAA4B,EACzC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,CACzB,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,WAAW,CAAC,IAAkB,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC1D,sEAAsE;YACtE,iEAAiE;YACjE,sBAAsB,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,mBAAmB;IACnB,OAAO,CAAC,MAAM,CAGZ,4CAA4C,EAC5C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,0BAA0B,CACvC,KAAK,EACL,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EACnC,GAAW,CAAC,IAA4B,EACzC,OAAO,CACR,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,0EAA0E;QAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CACF,CAAC;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,+EAA+E;IAC/E,OAAO,CAAC,IAAI,CAIV,+CAA+C,EAC/C,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACrC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,wEAAwE;QACxE,wEAAwE;QACxE,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YAAC,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChD,OAAO,GAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,KAAK;gBACL,OAAO;gBACP,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI;gBACpB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;aACtB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,mCAAmC,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,8EAA8E;IAC9E,sBAAsB;IACtB,OAAO,CAAC,IAAI,CAIV,uCAAuC,EACvC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC;QACxC,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,IAAI,aAAa,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,UAAU,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,gEAAgE;QAChE,sCAAsC;QACtC,MAAM,MAAM,GAAG,0BAA0B,CACvC,KAAK,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAC3D,CAAC;QACF,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ;QAE3D,yEAAyE;QACzE,0EAA0E;QAC1E,qCAAqC;QACrC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}