studiograph 1.3.48-next.21 → 1.3.48-next.210

package/dist/services/asset-caption-service.js

@@ -0,0 +1,186 @@
+/**
+ * Asset caption + OCR service (P3b — indexing pillar).
+ *
+ * Turns an image asset's bytes into searchable text: a concise factual
+ * description plus an OCR transcription of any legible text. The sweep
+ * (asset-index-sweep.ts) stores that text in `assets.db.caption`, keyed by the
+ * immutable assetId (asset-as-embed, decision D1 — DB column, no sidecar), and
+ * folds it into the search text of every entry that embeds the image, so a
+ * captioned image becomes findable by its content, not just its filename.
+ *
+ * This module owns ONLY the model call + the bounded fan-out. It does NOT touch
+ * disk, git, or LanceDB — the sweep wires those so the service stays a pure,
+ * unit-testable transform over `(bytes) → text`.
+ *
+ * Guardrails (decision A3 + Codex):
+ *  - **Bounded concurrency** (default 2): vision is not a free background
+ *    service; a bulk import / first-boot migration must not fan out unbounded.
+ *  - **Per-call timeout**: a hung provider call can't wedge the pool.
+ *  - **Retry cap → permanent `failed`**: transient errors retry up to a cap,
+ *    then the asset is honestly marked filename-only.
+ *  - **Failure isolation**: one image's failure never aborts the batch.
+ *  - **Gateway degrade (option a)**: `completeSimple()` cannot reach the
+ *    Studiograph Credits gateway (it routes through its own client), so in
+ *    gateway mode captioning is skipped and the image stays honestly
+ *    filename-only — NOT routed through the gateway here.
+ */
+import { getModel, completeSimple } from '@mariozechner/pi-ai';
+import { isStudiographCreditsMode } from './cloud-inference-billing.js';
+import { supportsVision } from './model-capabilities.js';
+import { bufferToImageContent } from './scratch-attachment-service.js';
+const DEFAULT_TIMEOUT_MS = 60_000;
+const DEFAULT_MAX_ATTEMPTS = 2;
+const DEFAULT_MAX_TOKENS = 1024;
+/**
+ * Bytes above which we skip captioning. Base64-encoding inflates the buffer
+ * ~33% into the request body, and most vision providers reject large payloads
+ * (413) or time out — both of which would otherwise burn the retry cap and
+ * mark a perfectly valid image permanently `failed`. The doc extractor has the
+ * analogous `SIDECAR_EXTRACT_BYTES_CAP` guard; this is its image-path peer.
+ * An oversized image stays honestly filename-only.
+ */
+const DEFAULT_CAPTION_MAX_BYTES = 8 * 1024 * 1024;
+/**
+ * Image MIME types vision models actually accept. The presign allowlist was
+ * widened (P4) to png/jpeg/gif/webp/avif/heic, but Anthropic + most providers
+ * only decode png/jpeg/gif/webp; shipping image/avif or image/heic returns a
+ * 400 that would burn the retry cap and land terminal `failed` for a
+ * perfectly real image. Skip those up-front so they read honestly as
+ * filename-only (reason `unsupported-mime`) instead of a wasted vision call.
+ * Note `application/octet-stream` is intentionally absent — an asset whose
+ * mime wasn't classified shouldn't be guessed as captionable.
+ */
+const CAPTIONABLE_MIME = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+/** Bounded caption fan-out — vision is metered, keep it small (A3). */
+export const DEFAULT_CAPTION_CONCURRENCY = 2;
+const CAPTION_SYSTEM_PROMPT = 'You index images for full-text search. Given one image, output plain text ' +
+    'with two parts and nothing else:\n' +
+    '1. A concise, factual description (subjects, setting, document/diagram/chart ' +
+    'type, notable colors). One short paragraph.\n' +
+    '2. On a new line starting with "OCR:", transcribe ALL legible text in the ' +
+    'image verbatim. If there is no text, write "OCR: (none)".\n' +
+    'No preamble, no markdown, no commentary. Keep it under ~250 words.';
+const CAPTION_USER_PROMPT = 'Describe this image and transcribe any text it contains, following the ' +
+    'system instructions exactly.';
+/**
+ * Is captioning reachable for this model config right now? Separate from
+ * `supportsVision` because the gateway IS vision-capable yet unreachable via
+ * `completeSimple` (decision A6 + the gateway-degrade note).
+ */
+export function canCaption(config) {
+    if (isStudiographCreditsMode())
+        return { ok: false, reason: 'gateway' };
+    if (!config.apiKey)
+        return { ok: false, reason: 'no-api-key' };
+    if (!supportsVision(config.provider, config.modelId))
+        return { ok: false, reason: 'no-vision' };
+    return { ok: true };
+}
+/** Reject a promise that outruns `ms`. */
+function withTimeout(p, ms) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error(`caption call timed out after ${ms}ms`)), ms);
+        p.then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });
+    });
+}
+/**
+ * Caption + OCR a single image. Gated by `canCaption`; never throws — a
+ * permanent failure resolves to `{ status: 'failed', reason }` so the caller
+ * can record honest index state.
+ */
+export async function captionImage(buffer, mimeType, config, opts = {}) {
+    const gate = canCaption(config);
+    if (!gate.ok)
+        return { status: 'failed', reason: gate.reason };
+    // The model can only decode a subset of the (widened) presign image set.
+    // Skip avif/heic/etc. before spending a vision call that would 400.
+    if (!CAPTIONABLE_MIME.has(mimeType.toLowerCase())) {
+        return { status: 'failed', reason: 'unsupported-mime' };
+    }
+    const maxBytes = opts.maxBytes ?? DEFAULT_CAPTION_MAX_BYTES;
+    if (buffer.length > maxBytes) {
+        // Too large to ship to the vision model — skip rather than 413/timeout into
+        // a permanent failure. `oversize` reads honestly as filename-only.
+        return { status: 'failed', reason: 'oversize' };
+    }
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxAttempts = Math.max(1, opts.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    const maxTokens = opts.maxTokens ?? DEFAULT_MAX_TOKENS;
+    const complete = opts.completeFn ?? completeSimple;
+    // Resolve a pi-ai model. Unknown-to-pi-ai models still pass canCaption via
+    // the capability map; completeSimple would then reject them, which surfaces
+    // as a (correct) failure below. A best-effort placeholder keeps the call
+    // shape intact and lets an injected completeFn ignore it.
+    let model;
+    try {
+        model = getModel(config.provider, config.modelId);
+    }
+    catch {
+        model = { provider: config.provider, id: config.modelId };
+    }
+    const context = {
+        systemPrompt: CAPTION_SYSTEM_PROMPT,
+        messages: [
+            {
+                role: 'user',
+                content: [
+                    bufferToImageContent(buffer, mimeType),
+                    { type: 'text', text: CAPTION_USER_PROMPT },
+                ],
+                timestamp: Date.now(),
+            },
+        ],
+    };
+    let lastReason = 'error';
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
+            const result = await withTimeout(complete(model, context, { apiKey: config.apiKey, maxTokens }), timeoutMs);
+            if (result.stopReason === 'error') {
+                lastReason = 'error';
+                continue;
+            }
+            const text = (result.content ?? [])
+                .filter((c) => c.type === 'text')
+                .map((c) => c.text ?? '')
+                .join('')
+                .trim();
+            if (text)
+                return { status: 'full', text };
+            lastReason = 'empty';
+        }
+        catch (err) {
+            lastReason = err instanceof Error && /timed out/.test(err.message) ? 'timeout' : 'error';
+        }
+    }
+    return { status: 'failed', reason: lastReason };
+}
+/**
+ * Caption a batch of images with bounded concurrency and full failure
+ * isolation — a single image throwing or timing out never sinks the batch.
+ * Results come back in input order, each tagged with its job key.
+ */
+export async function captionImages(jobs, config, opts = {}) {
+    const concurrency = Math.max(1, opts.concurrency ?? DEFAULT_CAPTION_CONCURRENCY);
+    const results = new Array(jobs.length);
+    let next = 0;
+    async function worker() {
+        while (true) {
+            const i = next++;
+            if (i >= jobs.length)
+                return;
+            const job = jobs[i];
+            try {
+                const r = await captionImage(job.buffer, job.mimeType, config, opts);
+                results[i] = { key: job.key, ...r };
+            }
+            catch {
+                // captionImage is designed not to throw, but isolate regardless.
+                results[i] = { key: job.key, status: 'failed', reason: 'error' };
+            }
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, jobs.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
+}
+//# sourceMappingURL=asset-caption-service.js.map

package/dist/services/asset-caption-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-caption-service.js","sourceRoot":"","sources":["../../src/services/asset-caption-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AA8CvE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AACzF,uEAAuE;AACvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,qBAAqB,GACzB,4EAA4E;IAC5E,oCAAoC;IACpC,+EAA+E;IAC/E,+CAA+C;IAC/C,4EAA4E;IAC5E,6DAA6D;IAC7D,oEAAoE,CAAC;AAEvE,MAAM,mBAAmB,GACvB,yEAAyE;IACzE,8BAA8B,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAA0B;IACnD,IAAI,wBAAwB,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC/D,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,0CAA0C;AAC1C,SAAS,WAAW,CAAI,CAAa,EAAE,EAAU;IAC/C,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC3C,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,QAAgB,EAChB,MAA0B,EAC1B,OAAuB,EAAE;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAE/D,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,mEAAmE;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAK,cAA+C,CAAC;IAErF,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAe,EAAE,MAAM,CAAC,OAAc,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,qBAAqB;QACnC,QAAQ,EAAE;YACR;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC;oBACtC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE;iBAC5C;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB;SACF;KACF,CAAC;IAEF,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC5G,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAClC,UAAU,GAAG,OAAO,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;iBAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC;iBAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;iBACxB,IAAI,CAAC,EAAE,CAAC;iBACR,IAAI,EAAE,CAAC;YACV,IAAI,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1C,UAAU,GAAG,OAAO,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,GAAG,YAAY,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAkB,EAClB,MAA0B,EAC1B,OAAkD,EAAE;IAEpD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,2BAA2B,CAAC,CAAC;IACjF,MAAM,OAAO,GAAyB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,KAAK,UAAU,MAAM;QACnB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBACrE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/services/asset-delete-authz.d.ts

@@ -0,0 +1,31 @@
+import type { RepoConfig } from '../core/types.js';
+import type { AssetIndexService } from './assets/asset-index-service.js';
+import { type AuthUser } from './auth-service.js';
+/**
+ * Delete authorization for the workspace-wide Assets store (codex-review P1 / D2).
+ *
+ * `workspace_wide` grants every member write (upload) access, so deletion needs
+ * a tighter rule than folder-write: only the asset's uploader (recorded
+ * `uploader_user_id`) or a workspace owner may delete it. Returns a denial
+ * message, or `null` when the delete is allowed.
+ *
+ * Pass `filename` for single-file deletes (the filename route): the gate then
+ * keys on the row for THAT file, and a legacy file with no index row is
+ * owner-only — so a member can't delete a co-located legacy blob just by owning
+ * a different indexed asset under the same entity (codex P1). Omit `filename`
+ * for whole-entity deletes (gate on every indexed row).
+ *
+ * Scope: only gates `workspace_wide` folders. Non-workspace_wide folders return
+ * `null` here (normal folder-write semantics already applied upstream).
+ * Open-mode / API-key callers (`user` undefined) are unrestricted. An entity
+ * with no indexed assets in the shared store is unexpected → owner-only.
+ */
+export declare function assetDeleteDenial(index: AssetIndexService | undefined, repoConfig: RepoConfig | undefined, user: AuthUser | undefined, repo: string, entityType: string, entityId: string, filename?: string): string | null;
+/**
+ * Delete authorization for a free-standing asset addressed by its immutable
+ * `assetId` (the asset-manager delete-by-id route). Same uploader/owner gate as
+ * {@link assetDeleteDenial}, but keyed directly on the asset row rather than an
+ * entity coordinate. Only gates `workspace_wide` folders; open-mode callers are
+ * unrestricted. A missing row resolves owner-only via `index.canDelete`.
+ */
+export declare function assetDeleteDenialByAssetId(index: AssetIndexService | undefined, repoConfig: RepoConfig | undefined, user: AuthUser | undefined, assetId: string): string | null;

package/dist/services/asset-delete-authz.js

@@ -0,0 +1,61 @@
+import { isWorkspaceOwner } from './auth-service.js';
+const DENIAL = 'Only the uploader or a workspace owner can delete assets in the shared Assets folder.';
+/**
+ * Delete authorization for the workspace-wide Assets store (codex-review P1 / D2).
+ *
+ * `workspace_wide` grants every member write (upload) access, so deletion needs
+ * a tighter rule than folder-write: only the asset's uploader (recorded
+ * `uploader_user_id`) or a workspace owner may delete it. Returns a denial
+ * message, or `null` when the delete is allowed.
+ *
+ * Pass `filename` for single-file deletes (the filename route): the gate then
+ * keys on the row for THAT file, and a legacy file with no index row is
+ * owner-only — so a member can't delete a co-located legacy blob just by owning
+ * a different indexed asset under the same entity (codex P1). Omit `filename`
+ * for whole-entity deletes (gate on every indexed row).
+ *
+ * Scope: only gates `workspace_wide` folders. Non-workspace_wide folders return
+ * `null` here (normal folder-write semantics already applied upstream).
+ * Open-mode / API-key callers (`user` undefined) are unrestricted. An entity
+ * with no indexed assets in the shared store is unexpected → owner-only.
+ */
+export function assetDeleteDenial(index, repoConfig, user, repo, entityType, entityId, filename) {
+    if (!repoConfig?.workspace_wide)
+        return null;
+    if (!user)
+        return null;
+    const owner = isWorkspaceOwner(user.role);
+    if (!index)
+        return owner ? null : DENIAL;
+    let rows = index.listByOwner(repo, entityType, entityId);
+    if (filename !== undefined) {
+        // Single-file delete: only the row for this exact file is relevant. No
+        // matching row = a legacy/un-indexed blob → owner-only (can't be claimed
+        // by owning a sibling asset under the same entity).
+        rows = rows.filter(r => r.filename === filename);
+        if (rows.length === 0)
+            return owner ? null : DENIAL;
+    }
+    else if (rows.length === 0) {
+        return owner ? null : DENIAL;
+    }
+    return rows.every(r => index.canDelete(r.assetId, user.id, owner)) ? null : DENIAL;
+}
+/**
+ * Delete authorization for a free-standing asset addressed by its immutable
+ * `assetId` (the asset-manager delete-by-id route). Same uploader/owner gate as
+ * {@link assetDeleteDenial}, but keyed directly on the asset row rather than an
+ * entity coordinate. Only gates `workspace_wide` folders; open-mode callers are
+ * unrestricted. A missing row resolves owner-only via `index.canDelete`.
+ */
+export function assetDeleteDenialByAssetId(index, repoConfig, user, assetId) {
+    if (!repoConfig?.workspace_wide)
+        return null;
+    if (!user)
+        return null;
+    const owner = isWorkspaceOwner(user.role);
+    if (!index)
+        return owner ? null : DENIAL;
+    return index.canDelete(assetId, user.id, owner) ? null : DENIAL;
+}
+//# sourceMappingURL=asset-delete-authz.js.map

package/dist/services/asset-delete-authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-delete-authz.js","sourceRoot":"","sources":["../../src/services/asset-delete-authz.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAiB,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,GAAG,uFAAuF,CAAC;AAEvG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAoC,EACpC,UAAkC,EAClC,IAA0B,EAC1B,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,QAAiB;IAEjB,IAAI,CAAC,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,uEAAuE;QACvE,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAoC,EACpC,UAAkC,EAClC,IAA0B,EAC1B,OAAe;IAEf,IAAI,CAAC,UAAU,EAAE,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC"}

package/dist/services/asset-finalize-service.d.ts

@@ -0,0 +1,58 @@
+/**
+ * MCP pre-signed asset upload — STEP 3 of 3.
+ *
+ * The agent has PUT bytes to the pre-signed URL minted by presign; this
+ * verifies the upload landed, validates content-type + size at the wire,
+ * promotes the blob from `pending/` to canonical keyspace, creates the
+ * asset entity, and writes the ownership index row.
+ *
+ * Layered guarantees (every one mapped to a plan decision):
+ *  - Tamper-proof (T2):    verifyAssetUploadToken throws TokenInvalidError on
+ *                           tamper / wrong-secret / expiry.
+ *  - Identity-pin (R1):    String(user.id) === payload.uploaderUserId.
+ *                           Leaked token cannot be replayed by another
+ *                           folder-writer (and workspace owner is NOT exempt).
+ *  - Idempotent (plan):    assetIndex.get(assetId) → existing row's URL.
+ *                           Safe retries on transient network errors at the
+ *                           agent's end.
+ *  - Authz freshness:      Re-check canWriteRepo. 15-min token outlives a
+ *                           folder-access revoke.
+ *  - Wire-level validation: HEAD pending and assert stored Content-Type
+ *                           matches the token's `mime`, and Content-Length
+ *                           ≤ 20MB. On mismatch, delete pending immediately
+ *                           so the user doesn't get charged for it.
+ *  - Atomic-ish promote:   r2.copy (pending → canonical) is server-side.
+ *  - Compensating delete (R5): if entity-create OR index.put throws AFTER
+ *                           the canonical copy succeeded, delete the
+ *                           canonical blob so we don't leave a body-less
+ *                           asset entity OR an entity-less blob. If THAT
+ *                           also fails, log CRITICAL with the orphaned key.
+ *  - Audit log (R3):       single structured line at every outcome (success
+ *                           and each reject reason). Forensics + post-
+ *                           incident reconstruction.
+ *
+ * See ~/.claude/plans/mcp-presigned-asset-upload.md.
+ */
+import type { WorkspaceManager } from '../core/workspace-manager.js';
+import type { AuthService, AuthUser } from './auth-service.js';
+export interface FinalizeAssetInput {
+    workspaceManager: WorkspaceManager;
+    authService: AuthService;
+    user: AuthUser;
+    /** HMAC token minted by `presignAssetUpload`. */
+    token: string;
+    /** Optional display name for the asset entity. Defaults to a title-cased
+     *  version of the filename stem. */
+    name?: string;
+}
+export interface FinalizeAssetOutput {
+    assetId: string;
+    /** `/api/assets/{assetId}/{filename}` — the proxied URL that resolves
+     *  per-request to a short-lived signed R2 URL via the asset-api route. */
+    url: string;
+    ownerType: string;
+    ownerId: string;
+    /** Resolved repo (echoed from the token for the MCP tool to surface). */
+    repo: string;
+}
+export declare function finalizeAssetUpload(input: FinalizeAssetInput): Promise<FinalizeAssetOutput>;

package/dist/services/asset-finalize-service.js

@@ -0,0 +1,216 @@
+/**
+ * MCP pre-signed asset upload — STEP 3 of 3.
+ *
+ * The agent has PUT bytes to the pre-signed URL minted by presign; this
+ * verifies the upload landed, validates content-type + size at the wire,
+ * promotes the blob from `pending/` to canonical keyspace, creates the
+ * asset entity, and writes the ownership index row.
+ *
+ * Layered guarantees (every one mapped to a plan decision):
+ *  - Tamper-proof (T2):    verifyAssetUploadToken throws TokenInvalidError on
+ *                           tamper / wrong-secret / expiry.
+ *  - Identity-pin (R1):    String(user.id) === payload.uploaderUserId.
+ *                           Leaked token cannot be replayed by another
+ *                           folder-writer (and workspace owner is NOT exempt).
+ *  - Idempotent (plan):    assetIndex.get(assetId) → existing row's URL.
+ *                           Safe retries on transient network errors at the
+ *                           agent's end.
+ *  - Authz freshness:      Re-check canWriteRepo. 15-min token outlives a
+ *                           folder-access revoke.
+ *  - Wire-level validation: HEAD pending and assert stored Content-Type
+ *                           matches the token's `mime`, and Content-Length
+ *                           ≤ 20MB. On mismatch, delete pending immediately
+ *                           so the user doesn't get charged for it.
+ *  - Atomic-ish promote:   r2.copy (pending → canonical) is server-side.
+ *  - Compensating delete (R5): if entity-create OR index.put throws AFTER
+ *                           the canonical copy succeeded, delete the
+ *                           canonical blob so we don't leave a body-less
+ *                           asset entity OR an entity-less blob. If THAT
+ *                           also fails, log CRITICAL with the orphaned key.
+ *  - Audit log (R3):       single structured line at every outcome (success
+ *                           and each reject reason). Forensics + post-
+ *                           incident reconstruction.
+ *
+ * See ~/.claude/plans/mcp-presigned-asset-upload.md.
+ */
+import { canWriteRepo } from './access-control.js';
+import { verifyAssetUploadToken } from './asset-upload-token.js';
+import { publicUrlForAssetId } from './assets/index.js';
+import { deriveAssetDisplayName } from '../core/embeds.js';
+import { getMediaType } from './assets/base.js';
+import { ForbiddenError, LocalBackendNotSupportedError, UploadNotReceivedError, UploadValidationError, } from './asset-upload-errors.js';
+import { log } from '../utils/log.js';
+const MAX_BYTES = 20 * 1024 * 1024;
+export async function finalizeAssetUpload(input) {
+    // 1. Token verify (throws TokenInvalidError on any failure).
+    const payload = verifyAssetUploadToken(input.token, input.authService.getJwtSecret());
+    // Common audit-log scaffold so every outcome carries the same fields.
+    const auditBase = {
+        event: 'asset-finalize',
+        userId: String(input.user.id),
+        repo: payload.repo,
+        ownerType: payload.ownerType,
+        ownerId: payload.ownerId,
+        assetId: payload.assetId,
+    };
+    const reject = (reason, error) => {
+        log.info('[asset-finalize]', { ...auditBase, outcome: 'rejected', reason });
+        throw error;
+    };
+    // 2. R1 identity bind: token leak isn't replayable by another user.
+    //    Workspace owner is NOT exempt — the uploaderUserId rule applies to
+    //    everyone, mirroring the canDelete rule on the workspace assets store.
+    if (String(input.user.id) !== payload.uploaderUserId) {
+        reject('identity_mismatch', new ForbiddenError('finalize_asset_upload may only be called by the user who created the upload token'));
+    }
+    const assetIndex = input.workspaceManager.getAssetIndex();
+    // 3. Idempotency. A repeat finalize with the same token returns the
+    //    existing asset row — covers agent retries on network hiccup between
+    //    "201 from R2" and "response from finalize".
+    const existing = assetIndex.get(payload.assetId);
+    if (existing) {
+        log.info('[asset-finalize]', { ...auditBase, outcome: 'idempotent' });
+        return {
+            assetId: existing.assetId,
+            url: publicUrlForAssetId(existing.assetId, existing.filename),
+            ownerType: existing.ownerType,
+            ownerId: existing.ownerId,
+            repo: existing.repo,
+        };
+    }
+    // 4. Re-check folder authz. 15-min token may outlive a folder-access
+    //    revoke; closes the "demoted-mid-flow" gap.
+    if (!canWriteRepo(input.user, payload.repo, input.workspaceManager, input.authService)) {
+        reject('forbidden_repo', new ForbiddenError(`No write access to folder "${payload.repo}"`));
+    }
+    // 5. Resolve the graph + asset service for the target repo.
+    let graph;
+    try {
+        graph = input.workspaceManager.getGraph(payload.repo);
+    }
+    catch {
+        reject('repo_not_found', new ForbiddenError(`Folder "${payload.repo}" not found`));
+    }
+    const assetService = graph.getAssetService();
+    if (!assetService || !assetService.supportsPresignedUploads()) {
+        reject('local_backend', new LocalBackendNotSupportedError('Pre-signed uploads require an R2-backed asset store'));
+    }
+    // 6. HEAD pending — covers "agent never PUT", wrong CT, oversize. On
+    //    mismatch, delete pending immediately so a misbehaving agent's bytes
+    //    don't sit on the lifecycle clock at our cost.
+    const head = await assetService.headPending(payload.assetId, payload.filename);
+    if (!head) {
+        log.info('[asset-finalize]', { ...auditBase, outcome: 'rejected', reason: 'upload_not_received' });
+        throw new UploadNotReceivedError(`No upload received at pending/${payload.assetId}/${payload.filename}. PUT may have failed or the 15-min window expired.`);
+    }
+    if (head.contentType !== payload.mime) {
+        await safeDeletePending(assetService, payload.assetId, payload.filename);
+        log.info('[asset-finalize]', {
+            ...auditBase, outcome: 'rejected', reason: 'content_type_mismatch',
+            expected: payload.mime, actual: head.contentType,
+        });
+        throw new UploadValidationError(`Stored Content-Type "${head.contentType}" does not match presign mime "${payload.mime}".`);
+    }
+    if (head.size > MAX_BYTES) {
+        await safeDeletePending(assetService, payload.assetId, payload.filename);
+        log.info('[asset-finalize]', {
+            ...auditBase, outcome: 'rejected', reason: 'oversize', size: head.size, max: MAX_BYTES,
+        });
+        throw new UploadValidationError(`Upload size ${head.size} bytes exceeds ${MAX_BYTES} byte limit.`);
+    }
+    if (head.size === 0) {
+        await safeDeletePending(assetService, payload.assetId, payload.filename);
+        log.info('[asset-finalize]', { ...auditBase, outcome: 'rejected', reason: 'empty' });
+        throw new UploadValidationError('Upload is empty (0 bytes).');
+    }
+    // 7. Server-side promote pending → canonical. CopyObject is atomic at
+    //    R2; on failure, leave pending for the lifecycle rule.
+    await assetService.copyPendingToCanonical(payload.assetId, payload.filename);
+    // 8. From here on, the canonical blob EXISTS. Any failure below must
+    //    delete it (R5) so we don't leave an orphan with no entity owner.
+    const url = publicUrlForAssetId(payload.assetId, payload.filename);
+    const name = input.name?.trim() || deriveAssetDisplayName(payload.filename) || payload.assetId;
+    const mediaType = getMediaType(payload.mime);
+    // Asset-as-embed (B2): presign produces a FREE-STANDING, folder-owned asset —
+    // NO `asset` entity. The agent embeds it into an entry via
+    // attach_asset_to_entity, or a user re-embeds it via the manager / "create
+    // entry from asset". The folder-owned index row is the asset's record of
+    // existence. Image caption/OCR indexing IS derived for it: the trigger below
+    // seeds an assetId-keyed index-state row + notifies the live caption drain
+    // (see ensureInitialAssetIndexState); the caption folds into any entry that
+    // embeds the asset.
+    try {
+        assetIndex.put({
+            assetId: payload.assetId,
+            repo: payload.repo,
+            ownerType: 'folder',
+            ownerId: payload.repo,
+            filename: payload.filename,
+            contentType: payload.mime,
+            mediaType,
+            name,
+            uploaderUserId: String(input.user.id),
+            size: head.size,
+        });
+    }
+    catch (err) {
+        // R5: index.put failed after the canonical blob was copied — delete the
+        // blob so no orphan remains; the original error propagates. (No entity to
+        // roll back under the asset-as-embed model.)
+        try {
+            await assetService.deleteByAssetId(payload.assetId, payload.filename);
+        }
+        catch (cleanupErr) {
+            log.warn('[asset-finalize] CRITICAL: compensating delete failed, canonical blob orphaned', {
+                assetId: payload.assetId,
+                canonicalKey: `${payload.assetId}/${payload.filename}`,
+                cleanupErr: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr),
+            });
+        }
+        log.info('[asset-finalize]', { ...auditBase, outcome: 'rejected', reason: 'app_layer_failure' });
+        throw err;
+    }
+    // Caption/OCR trigger: the vector service ignores non-captionable media
+    // types, so presigned fonts remain filename-only while raster images become
+    // content-searchable. Fire-and-forget — never block finalize on best-effort
+    // search enrichment.
+    void input.workspaceManager.vectorService?.ensureInitialAssetIndexState(payload.assetId, {
+        mediaType,
+        filename: payload.filename,
+        repo: payload.repo,
+    });
+    // 9. Pending cleanup — non-fatal. Canonical exists; lifecycle catches
+    //    a missed delete.
+    try {
+        await assetService.deletePending(payload.assetId, payload.filename);
+    }
+    catch (err) {
+        log.warn('[asset-finalize] pending delete failed (canonical exists; lifecycle backstop will reap)', {
+            assetId: payload.assetId,
+            err: err instanceof Error ? err.message : String(err),
+        });
+    }
+    // 10. Success audit log.
+    log.info('[asset-finalize]', { ...auditBase, outcome: 'success', size: head.size, mime: payload.mime });
+    return {
+        assetId: payload.assetId,
+        url,
+        ownerType: 'folder',
+        ownerId: payload.repo,
+        repo: payload.repo,
+    };
+}
+/** Best-effort pending delete on validation rejects. Errors here are
+ *  swallowed — the lifecycle rule is the backstop and we don't want a
+ *  cleanup failure to mask the user-facing validation error. */
+async function safeDeletePending(assetService, assetId, filename) {
+    try {
+        await assetService.deletePending(assetId, filename);
+    }
+    catch (err) {
+        log.warn('[asset-finalize] best-effort pending delete failed', {
+            assetId, filename, err: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+//# sourceMappingURL=asset-finalize-service.js.map

package/dist/services/asset-finalize-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-finalize-service.js","sourceRoot":"","sources":["../../src/services/asset-finalize-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAEL,cAAc,EACd,6BAA6B,EAC7B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAwBnC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAyB;IAEzB,6DAA6D;IAC7D,MAAM,OAAO,GAAG,sBAAsB,CACpC,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,CACjC,CAAC;IAEF,sEAAsE;IACtE,MAAM,SAAS,GAAG;QAChB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,MAAM,GAAG,CACb,MAAc,EACd,KAAuB,EAChB,EAAE;QACT,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC;IACd,CAAC,CAAC;IAEF,oEAAoE;IACpE,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QACrD,MAAM,CAAC,mBAAmB,EAAE,IAAI,cAAc,CAC5C,mFAAmF,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC;IAE1D,oEAAoE;IACpE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QACtE,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC;YAC7D,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,gDAAgD;IAChD,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvF,MAAM,CAAC,gBAAgB,EAAE,IAAI,cAAc,CACzC,8BAA8B,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,4DAA4D;IAC5D,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,gBAAgB,EAAE,IAAI,cAAc,CAAC,WAAW,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,YAAY,GAAG,KAAM,CAAC,eAAe,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAC9D,MAAM,CAAC,eAAe,EAAE,IAAI,6BAA6B,CACvD,qDAAqD,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,mDAAmD;IACnD,MAAM,IAAI,GAAG,MAAM,YAAa,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,sBAAsB,CAC9B,iCAAiC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,qDAAqD,CAC1H,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,iBAAiB,CAAC,YAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,uBAAuB;YAClE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW;SACjD,CAAC,CAAC;QACH,MAAM,IAAI,qBAAqB,CAC7B,wBAAwB,IAAI,CAAC,WAAW,kCAAkC,OAAO,CAAC,IAAI,IAAI,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CAAC,YAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS;SACvF,CAAC,CAAC;QACH,MAAM,IAAI,qBAAqB,CAC7B,eAAe,IAAI,CAAC,IAAI,kBAAkB,SAAS,cAAc,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,iBAAiB,CAAC,YAAa,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC;IAED,sEAAsE;IACtE,2DAA2D;IAC3D,MAAM,YAAa,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9E,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,8EAA8E;IAC9E,2DAA2D;IAC3D,2EAA2E;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,oBAAoB;IACpB,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC;YACb,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,OAAO,CAAC,IAAI;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,SAAS;YACT,IAAI;YACJ,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,6CAA6C;QAC7C,IAAI,CAAC;YACH,MAAM,YAAa,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CACN,gFAAgF,EAChF;gBACE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE;gBACtD,UAAU,EAAE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;aAClF,CACF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACjG,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,qBAAqB;IACrB,KAAK,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,EAAE;QACvF,SAAS;QACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,sEAAsE;IACtE,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,YAAa,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,yFAAyF,EAAE;YAClG,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IACzB,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExG,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG;QACH,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;gEAEgE;AAChE,KAAK,UAAU,iBAAiB,CAC9B,YAAwE,EACxE,OAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;YAC7D,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}