studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/services/user-person-bridge.d.ts

@@ -0,0 +1,136 @@
+/**
+ * User ↔ Person bridge
+ *
+ * Resolves between auth.db user accounts and person entities. The pointer
+ * lives on the person side as `user_handle` (scalar handle, not a wikilink —
+ * users are out-of-graph identities). Workspace-unique: at most one person
+ * entity per auth handle, workspace-wide.
+ *
+ * The lookup primitives here are intentionally cheap (in-memory scan of
+ * already-loaded person entities). No persistent cache in v1 — if profiling
+ * later shows this is hot, add one with explicit invalidation on entity
+ * writes and on createUser/deleteUser.
+ */
+import type { WorkspaceManager } from '../core/workspace-manager.js';
+import { type AuthService, type AuthUser } from './auth-service.js';
+import type { GitUser } from './git.js';
+/** Stable reference to a person entity in the workspace graph. */
+export interface PersonRef {
+    repo: string;
+    entityId: string;
+}
+/** Reason codes returned by `assertUserHandleUnique` / linking flows. */
+export type BridgeErrorCode = 'USER_HANDLE_CONFLICT' | 'USER_HANDLE_UNKNOWN' | 'PERSON_ALREADY_LINKED' | 'PERSON_NOT_FOUND' | 'OWNER_REQUIRED';
+export declare class BridgeError extends Error {
+    readonly code: BridgeErrorCode;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: BridgeErrorCode, message: string, details?: Record<string, unknown> | undefined);
+}
+/**
+ * Forward lookup: given an auth user handle, return the person entity that
+ * represents them. Returns null when the user has no linked entity (legacy,
+ * unprovisioned, or explicitly unlinked).
+ */
+export declare function findPersonRefForUser(workspace: WorkspaceManager, userHandle: string): PersonRef | null;
+/**
+ * Reverse lookup: given a person-entity target ID (the wikilink target, e.g.
+ * `fritz` from `[[fritz]]`), return the auth user that entity is linked to.
+ * Returns null when the entity isn't linked, doesn't exist, or refers to a
+ * non-existent user (pre-link case).
+ */
+export declare function findUserForPersonRef(workspace: WorkspaceManager, authService: AuthService, targetId: string): AuthUser | null;
+/**
+ * Bulk forward map: handle → personRef for every linked person in the
+ * workspace. Useful for `list_workspace_users` and for migration reporting.
+ */
+export declare function getHandleToPersonRefMap(workspace: WorkspaceManager): ReadonlyMap<string, PersonRef>;
+/**
+ * Workspace-wide uniqueness check. Throws BridgeError(USER_HANDLE_CONFLICT)
+ * when another person entity already carries `userHandle`. The `exceptRef`
+ * lets update paths skip the check for the entity being written.
+ *
+ * Called from the write path (graph-api create/update, agent graph-tools
+ * create/update) before delegating to graph.create/update.
+ */
+export declare function assertUserHandleUnique(workspace: WorkspaceManager, userHandle: string, exceptRef?: PersonRef): void;
+/**
+ * Authz gate: only workspace owners can stamp or change `user_handle` on a
+ * person entity. Mirrors the `ownerOnly()` gate on the dedicated
+ * `link_person_to_user` / `unlink_person_from_user` agent tools — without
+ * this, a non-owner member with folder-write access could rewrite the
+ * bridge via the generic update_entity REST/agent path, "claiming"
+ * another user's auth identity through the agent's Current User prompt.
+ *
+ * Rules:
+ *   - Payload doesn't include `user_handle` → no-op (caller wasn't trying
+ *     to change the bridge).
+ *   - Payload's value equals the current stored value → no-op (a form
+ *     resubmit including the unchanged field shouldn't 403).
+ *   - Caller is a workspace owner → allowed.
+ *   - Anyone else → throw OWNER_REQUIRED.
+ *
+ * Pass `currentHandle = ''` for create paths (no prior entity).
+ */
+export declare function assertCanChangeUserHandle(authUser: AuthUser | null | undefined, currentHandle: string, newHandle: unknown): void;
+/**
+ * Inspect a frontmatter payload for `user_handle` and, if present, validate
+ * uniqueness against the current workspace state. No-op when the field is
+ * absent or empty.
+ *
+ * `exceptRef` is the entity being written (for updates) so the check
+ * doesn't reject an entity for clashing with itself.
+ */
+export declare function validateUserHandleInPayload(workspace: WorkspaceManager, data: Record<string, unknown>, exceptRef?: PersonRef): void;
+/**
+ * Map an AuthUser to a GitUser for commit attribution. Mirrors `reqGitUser`
+ * in graph-api-access.ts — kept here so the registration / CLI sites
+ * (which don't have a Fastify request) can call into the bridge without
+ * importing the request-scoped helper.
+ */
+export declare function authUserToGitUser(user: AuthUser): GitUser;
+/** Result returned by `ensurePersonForUser` so callers can log/UX the action. */
+export type EnsurePersonResult = {
+    action: 'already-linked';
+    ref: PersonRef;
+} | {
+    action: 'linked';
+    ref: PersonRef;
+} | {
+    action: 'created';
+    ref: PersonRef;
+} | {
+    action: 'skipped';
+    reason: string;
+};
+/**
+ * Resolve a person entity for a freshly-registered (or existing) user.
+ *
+ *   1. If the user is already linked, return.
+ *   2. If a person entity carries `email === user.email` and no `user_handle`,
+ *      stamp the handle onto it ("linked" — preserves the user-edited record).
+ *   3. Otherwise auto-create a person entity in the workspace's team repo
+ *      with the user's name/email and the new handle.
+ *
+ * Returns `{ action: 'skipped' }` when no suitable team repo exists and no
+ * email-matchable entity is available — the caller can warn the operator
+ * but should never block user creation on this.
+ */
+export declare function ensurePersonForUser(workspace: WorkspaceManager, authService: AuthService, authUser: AuthUser, gitUser: GitUser): Promise<EnsurePersonResult>;
+/**
+ * Self-service link: stamp `authUser.handle` onto a SPECIFIC person entity the
+ * user picked (the home "which record is you?" picker). Unlike the owner-gated
+ * `link_person_to_user` (which can target ANY user's account), this only ever
+ * writes the CALLER's OWN handle onto an UNLINKED person — so it's safe without
+ * an owner gate: it can't claim another user's identity (their record already
+ * carries a handle → rejected) and confers no privileges (auth role comes from
+ * the account, not the entity).
+ *
+ * Throws `BridgeError`:
+ *   - `PERSON_ALREADY_LINKED` — the target already carries a different handle.
+ *   - `USER_HANDLE_CONFLICT`  — the caller's handle is already on another person.
+ * No-op when the target already carries the caller's handle (idempotent).
+ *
+ * The caller resolves `ref` (including read-access) and the "already linked
+ * elsewhere" precheck before calling.
+ */
+export declare function linkChosenPersonToUser(workspace: WorkspaceManager, authUser: AuthUser, ref: PersonRef, gitUser: GitUser): Promise<void>;

package/dist/services/user-person-bridge.js

@@ -0,0 +1,340 @@
+/**
+ * User ↔ Person bridge
+ *
+ * Resolves between auth.db user accounts and person entities. The pointer
+ * lives on the person side as `user_handle` (scalar handle, not a wikilink —
+ * users are out-of-graph identities). Workspace-unique: at most one person
+ * entity per auth handle, workspace-wide.
+ *
+ * The lookup primitives here are intentionally cheap (in-memory scan of
+ * already-loaded person entities). No persistent cache in v1 — if profiling
+ * later shows this is hot, add one with explicit invalidation on entity
+ * writes and on createUser/deleteUser.
+ */
+import { isWorkspaceOwner } from './auth-service.js';
+import { log } from '../utils/log.js';
+export class BridgeError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'BridgeError';
+    }
+}
+/**
+ * Forward lookup: given an auth user handle, return the person entity that
+ * represents them. Returns null when the user has no linked entity (legacy,
+ * unprovisioned, or explicitly unlinked).
+ */
+export function findPersonRefForUser(workspace, userHandle) {
+    for (const entity of workspace.list('person')) {
+        const data = entity.data;
+        if (data.user_handle === userHandle) {
+            return { repo: entity.repoName, entityId: data.entity_id };
+        }
+    }
+    return null;
+}
+/**
+ * Reverse lookup: given a person-entity target ID (the wikilink target, e.g.
+ * `fritz` from `[[fritz]]`), return the auth user that entity is linked to.
+ * Returns null when the entity isn't linked, doesn't exist, or refers to a
+ * non-existent user (pre-link case).
+ */
+export function findUserForPersonRef(workspace, authService, targetId) {
+    // The wikilink target ID alone isn't unique across repos — multiple repos
+    // can have a `person/fritz`. We scan for the first match carrying a
+    // user_handle. In practice the team-repo entity is the canonical one and
+    // satellite copies don't carry the handle, so the first match is right.
+    for (const entity of workspace.list('person')) {
+        const data = entity.data;
+        if (data.entity_id === targetId && typeof data.user_handle === 'string') {
+            return authService.findUserByHandle(data.user_handle) ?? null;
+        }
+    }
+    return null;
+}
+/**
+ * Bulk forward map: handle → personRef for every linked person in the
+ * workspace. Useful for `list_workspace_users` and for migration reporting.
+ */
+export function getHandleToPersonRefMap(workspace) {
+    const map = new Map();
+    for (const entity of workspace.list('person')) {
+        const data = entity.data;
+        if (typeof data.user_handle === 'string') {
+            // First write wins. If two entities somehow carry the same handle,
+            // the uniqueness check at write time should have blocked it; if it
+            // slipped through (e.g. seeded data), we surface only one and the
+            // migration script's ambiguous-skip path catches the rest.
+            if (!map.has(data.user_handle)) {
+                map.set(data.user_handle, {
+                    repo: entity.repoName,
+                    entityId: data.entity_id,
+                });
+            }
+        }
+    }
+    return map;
+}
+/**
+ * Workspace-wide uniqueness check. Throws BridgeError(USER_HANDLE_CONFLICT)
+ * when another person entity already carries `userHandle`. The `exceptRef`
+ * lets update paths skip the check for the entity being written.
+ *
+ * Called from the write path (graph-api create/update, agent graph-tools
+ * create/update) before delegating to graph.create/update.
+ */
+export function assertUserHandleUnique(workspace, userHandle, exceptRef) {
+    for (const entity of workspace.list('person')) {
+        const data = entity.data;
+        if (data.user_handle !== userHandle)
+            continue;
+        const entityId = data.entity_id;
+        if (exceptRef && exceptRef.repo === entity.repoName && exceptRef.entityId === entityId) {
+            continue;
+        }
+        throw new BridgeError('USER_HANDLE_CONFLICT', `user_handle "${userHandle}" is already linked to ${entity.repoName}/${entityId}`, { conflictingRef: { repo: entity.repoName, entityId } });
+    }
+}
+/**
+ * Authz gate: only workspace owners can stamp or change `user_handle` on a
+ * person entity. Mirrors the `ownerOnly()` gate on the dedicated
+ * `link_person_to_user` / `unlink_person_from_user` agent tools — without
+ * this, a non-owner member with folder-write access could rewrite the
+ * bridge via the generic update_entity REST/agent path, "claiming"
+ * another user's auth identity through the agent's Current User prompt.
+ *
+ * Rules:
+ *   - Payload doesn't include `user_handle` → no-op (caller wasn't trying
+ *     to change the bridge).
+ *   - Payload's value equals the current stored value → no-op (a form
+ *     resubmit including the unchanged field shouldn't 403).
+ *   - Caller is a workspace owner → allowed.
+ *   - Anyone else → throw OWNER_REQUIRED.
+ *
+ * Pass `currentHandle = ''` for create paths (no prior entity).
+ */
+export function assertCanChangeUserHandle(authUser, currentHandle, newHandle) {
+    if (newHandle === undefined)
+        return;
+    const normalized = typeof newHandle === 'string' ? newHandle : '';
+    if (normalized === currentHandle)
+        return;
+    if (authUser && isWorkspaceOwner(authUser.role))
+        return;
+    throw new BridgeError('OWNER_REQUIRED', 'Workspace owner role required to change the linked account on a person entity.', { currentHandle, attemptedHandle: normalized });
+}
+/**
+ * Inspect a frontmatter payload for `user_handle` and, if present, validate
+ * uniqueness against the current workspace state. No-op when the field is
+ * absent or empty.
+ *
+ * `exceptRef` is the entity being written (for updates) so the check
+ * doesn't reject an entity for clashing with itself.
+ */
+export function validateUserHandleInPayload(workspace, data, exceptRef) {
+    const handle = data.user_handle;
+    if (typeof handle !== 'string' || handle.length === 0)
+        return;
+    assertUserHandleUnique(workspace, handle, exceptRef);
+}
+/**
+ * Map an AuthUser to a GitUser for commit attribution. Mirrors `reqGitUser`
+ * in graph-api-access.ts — kept here so the registration / CLI sites
+ * (which don't have a Fastify request) can call into the bridge without
+ * importing the request-scoped helper.
+ */
+export function authUserToGitUser(user) {
+    return {
+        id: user.handle,
+        name: user.displayName,
+        email: `${user.handle}@studiograph.local`,
+    };
+}
+/**
+ * Resolve a person entity for a freshly-registered (or existing) user.
+ *
+ *   1. If the user is already linked, return.
+ *   2. If a person entity carries `email === user.email` and no `user_handle`,
+ *      stamp the handle onto it ("linked" — preserves the user-edited record).
+ *   3. Otherwise auto-create a person entity in the workspace's team repo
+ *      with the user's name/email and the new handle.
+ *
+ * Returns `{ action: 'skipped' }` when no suitable team repo exists and no
+ * email-matchable entity is available — the caller can warn the operator
+ * but should never block user creation on this.
+ */
+export async function ensurePersonForUser(workspace, authService, authUser, gitUser) {
+    // 1. Already linked? No-op.
+    const existing = findPersonRefForUser(workspace, authUser.handle);
+    if (existing) {
+        return { action: 'already-linked', ref: existing };
+    }
+    // 2. Email-match an existing entity that has no handle yet. Don't touch
+    //    entities that already carry a different handle — that's the
+    //    multi-match case the migration script logs as ambiguous.
+    if (authUser.email) {
+        const normalized = authUser.email.toLowerCase().trim();
+        const candidates = [];
+        for (const entity of workspace.list('person')) {
+            const data = entity.data;
+            const entityEmail = typeof data.email === 'string' ? data.email.toLowerCase().trim() : '';
+            if (entityEmail !== normalized)
+                continue;
+            if (typeof data.user_handle === 'string' && data.user_handle.length > 0)
+                continue;
+            candidates.push({ repo: entity.repoName, entityId: data.entity_id });
+        }
+        if (candidates.length === 1) {
+            const target = candidates[0];
+            const graph = workspace.getGraph(target.repo);
+            // graph.update merges the supplied data over the current frontmatter,
+            // so we only need to write the new field + audit metadata.
+            await graph.update({
+                entityType: 'person',
+                entityId: target.entityId,
+                data: {
+                    user_handle: authUser.handle,
+                    updated_at: new Date().toISOString(),
+                    updated_by: gitUser.id,
+                },
+                commitMessage: `Link person/${target.entityId} to user ${authUser.handle}`,
+                user: gitUser,
+            });
+            log.info(`[user-person-bridge] linked person ${target.repo}/${target.entityId} to user ${authUser.handle}`);
+            return { action: 'linked', ref: target };
+        }
+        if (candidates.length > 1) {
+            log.warn(`[user-person-bridge] ${candidates.length} person entities match email ${normalized} for user ${authUser.handle}; ` +
+                `skipping auto-link. Resolve via the agent's link_person_to_user tool or the Profile settings.`);
+            // Fall through to auto-create — the user still gets a record, and the
+            // ambiguous matches can be reconciled later.
+        }
+    }
+    // 3. Auto-create in a writable repo. If none can be chosen, skip with a
+    //    warning — never block user creation on this. The user can link or
+    //    create a record themselves later (home CTA / Settings → Profile).
+    const targetRepo = pickProvisioningRepo(workspace, authService, authUser.id, authUser.role);
+    if (!targetRepo) {
+        log.warn(`[user-person-bridge] no writable repo available for user ${authUser.handle}; ` +
+            `person entity NOT auto-provisioned. They can link/create one from Settings → Profile.`);
+        return { action: 'skipped', reason: 'no-writable-repo' };
+    }
+    const graph = workspace.getGraph(targetRepo);
+    const entityId = allocateEntityId(workspace, authUser.handle);
+    const now = new Date().toISOString();
+    await graph.create({
+        entityType: 'person',
+        entityId,
+        data: {
+            entity_type: 'person',
+            entity_id: entityId,
+            name: authUser.displayName,
+            email: authUser.email,
+            category: 'employee',
+            status: 'current',
+            user_handle: authUser.handle,
+            created_at: now,
+            updated_at: now,
+            created_by: gitUser.id,
+            updated_by: gitUser.id,
+        },
+        content: '',
+        commitMessage: `Auto-provision person/${entityId} for user ${authUser.handle}`,
+        user: gitUser,
+    });
+    log.info(`[user-person-bridge] auto-provisioned person ${targetRepo}/${entityId} for user ${authUser.handle}`);
+    return { action: 'created', ref: { repo: targetRepo, entityId } };
+}
+/**
+ * Self-service link: stamp `authUser.handle` onto a SPECIFIC person entity the
+ * user picked (the home "which record is you?" picker). Unlike the owner-gated
+ * `link_person_to_user` (which can target ANY user's account), this only ever
+ * writes the CALLER's OWN handle onto an UNLINKED person — so it's safe without
+ * an owner gate: it can't claim another user's identity (their record already
+ * carries a handle → rejected) and confers no privileges (auth role comes from
+ * the account, not the entity).
+ *
+ * Throws `BridgeError`:
+ *   - `PERSON_ALREADY_LINKED` — the target already carries a different handle.
+ *   - `USER_HANDLE_CONFLICT`  — the caller's handle is already on another person.
+ * No-op when the target already carries the caller's handle (idempotent).
+ *
+ * The caller resolves `ref` (including read-access) and the "already linked
+ * elsewhere" precheck before calling.
+ */
+export async function linkChosenPersonToUser(workspace, authUser, ref, gitUser) {
+    const entity = workspace.getGraph(ref.repo).get('person', ref.entityId);
+    const current = entity.data.user_handle;
+    if (typeof current === 'string' && current.length > 0) {
+        if (current === authUser.handle)
+            return; // already linked to me — idempotent
+        throw new BridgeError('PERSON_ALREADY_LINKED', `Person ${ref.repo}/${ref.entityId} is already linked to user "${current}".`, { currentHandle: current });
+    }
+    // Workspace-wide uniqueness: my handle must not already sit on another person.
+    assertUserHandleUnique(workspace, authUser.handle, ref);
+    await workspace.getGraph(ref.repo).update({
+        entityType: 'person',
+        entityId: ref.entityId,
+        data: {
+            user_handle: authUser.handle,
+            updated_at: new Date().toISOString(),
+            updated_by: gitUser.id,
+        },
+        commitMessage: `Link person/${ref.entityId} to user ${authUser.handle} (self-service)`,
+        user: gitUser,
+    });
+}
+/**
+ * Pick the repo where a registering user's person entity should be
+ * auto-provisioned (the email-match path links in place; only the create
+ * branch needs a destination).
+ *
+ *   1. First non-private repo the user actually has write access to
+ *      (covers the first-owner bootstrap path where every non-personal
+ *      repo gets admin granted before this runs).
+ *   2. User's personal repo as last-resort.
+ *
+ * The access check closes the squat vector: a non-owner member no longer
+ * silently plants a person entity in a shared repo they have no
+ * folder-access to.
+ */
+function pickProvisioningRepo(workspace, authService, userId, userRole) {
+    // Workspace owners + folder-admins-of-shared-repos can plant records in
+    // shared space; others can't. Iterate non-private repos and pick the
+    // first one the user can write to.
+    for (const repo of workspace.getAllRepoConfigs()) {
+        if (repo.personal)
+            continue;
+        if (userRole === 'owner')
+            return repo.name;
+        const folderRole = authService.getFolderRole(userId, repo.name);
+        if (folderRole === 'admin' || folderRole === 'editor')
+            return repo.name;
+    }
+    const personal = workspace.getUserPersonalRepo(userId);
+    return personal ? personal.name : null;
+}
+/**
+ * Choose an entity ID for the auto-provisioned person. Defaults to the
+ * user's handle (already kebab-case and workspace-unique among users), but
+ * falls back to `<handle>-2`, `<handle>-3`, … if a non-user person entity
+ * already occupies that slug somewhere in the workspace. Mirrors
+ * `AuthService.allocateHandle`'s collision strategy.
+ */
+function allocateEntityId(workspace, handle) {
+    if (!workspace.findEntityById(handle))
+        return handle;
+    for (let suffix = 2; suffix < 1000; suffix++) {
+        const candidate = `${handle}-${suffix}`;
+        if (!workspace.findEntityById(candidate))
+            return candidate;
+    }
+    // Pathological. Defer to the handle (graph.create will reject and we'll
+    // surface the conflict to the caller).
+    return handle;
+}
+//# sourceMappingURL=user-person-bridge.js.map

package/dist/services/user-person-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-person-bridge.js","sourceRoot":"","sources":["../../src/services/user-person-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,gBAAgB,EAAmC,MAAM,mBAAmB,CAAC;AAEtF,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAgBtC,MAAM,OAAO,WAAY,SAAQ,KAAK;IAElB;IAEA;IAHlB,YACkB,IAAqB,EACrC,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAiB;QAErB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA2B,EAC3B,UAAkB;IAElB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAmB,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA2B,EAC3B,WAAwB,EACxB,QAAgB;IAEhB,0EAA0E;IAC1E,oEAAoE;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QACpD,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACxE,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACzC,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,2DAA2D;YAC3D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE;oBACxB,IAAI,EAAE,MAAM,CAAC,QAAQ;oBACrB,QAAQ,EAAE,IAAI,CAAC,SAAmB;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAA2B,EAC3B,UAAkB,EAClB,SAAqB;IAErB,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QACpD,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;YAAE,SAAS;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAmB,CAAC;QAC1C,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,WAAW,CACnB,sBAAsB,EACtB,gBAAgB,UAAU,0BAA0B,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,EACjF,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAqC,EACrC,aAAqB,EACrB,SAAkB;IAElB,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IACpC,MAAM,UAAU,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,UAAU,KAAK,aAAa;QAAE,OAAO;IACzC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IACxD,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAChB,gFAAgF,EAChF,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAA2B,EAC3B,IAA6B,EAC7B,SAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9D,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,MAAM;QACf,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,oBAAoB;KAC1C,CAAC;AACJ,CAAC;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA2B,EAC3B,WAAwB,EACxB,QAAkB,EAClB,OAAgB;IAEhB,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACrD,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,8DAA8D;IAC9D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,UAAU,GAA8C,EAAE,CAAC;QACjE,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;YACpD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,IAAI,WAAW,KAAK,UAAU;gBAAE,SAAS;YACzC,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAClF,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAmB,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,KAAK,CAAC,MAAM,CAAC;gBACjB,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE;oBACJ,WAAW,EAAE,QAAQ,CAAC,MAAM;oBAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACpC,UAAU,EAAE,OAAO,CAAC,EAAE;iBACvB;gBACD,aAAa,EAAE,eAAe,MAAM,CAAC,QAAQ,YAAY,QAAQ,CAAC,MAAM,EAAE;gBAC1E,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,YAAY,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5G,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CACN,wBAAwB,UAAU,CAAC,MAAM,gCAAgC,UAAU,aAAa,QAAQ,CAAC,MAAM,IAAI;gBACnH,+FAA+F,CAChG,CAAC;YACF,sEAAsE;YACtE,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CACN,4DAA4D,QAAQ,CAAC,MAAM,IAAI;YAC/E,uFAAuF,CACxF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,MAAM,CAAC;QACjB,UAAU,EAAE,QAAQ;QACpB,QAAQ;QACR,IAAI,EAAE;YACJ,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,QAAQ,CAAC,WAAW;YAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,QAAQ,CAAC,MAAM;YAC5B,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,EAAE;SACvB;QACD,OAAO,EAAE,EAAE;QACX,aAAa,EAAE,yBAAyB,QAAQ,aAAa,QAAQ,CAAC,MAAM,EAAE;QAC9E,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,gDAAgD,UAAU,IAAI,QAAQ,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA2B,EAC3B,QAAkB,EAClB,GAAc,EACd,OAAgB;IAEhB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxE,MAAM,OAAO,GAAI,MAAM,CAAC,IAAgC,CAAC,WAAW,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,oCAAoC;QAC7E,MAAM,IAAI,WAAW,CACnB,uBAAuB,EACvB,UAAU,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,+BAA+B,OAAO,IAAI,EAC5E,EAAE,aAAa,EAAE,OAAO,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,+EAA+E;IAC/E,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACxC,UAAU,EAAE,QAAQ;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI,EAAE;YACJ,WAAW,EAAE,QAAQ,CAAC,MAAM;YAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,UAAU,EAAE,OAAO,CAAC,EAAE;SACvB;QACD,aAAa,EAAE,eAAe,GAAG,CAAC,QAAQ,YAAY,QAAQ,CAAC,MAAM,iBAAiB;QACtF,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAC3B,SAA2B,EAC3B,WAAwB,EACxB,MAAc,EACd,QAAgB;IAEhB,wEAAwE;IACxE,qEAAqE;IACrE,mCAAmC;IACnC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC5B,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,SAA2B,EAAE,MAAc;IACnE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7D,CAAC;IACD,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC"}