studiograph 1.3.48-next.26 → 1.3.48-next.261

package/dist/server/routes/oauth-api.d.ts

@@ -0,0 +1,67 @@
+/**
+ * OAuth 2.0 Authorization Server routes
+ *
+ * Makes Studiograph's `/mcp` server connectable by Claude Desktop's Chat/Cowork
+ * connector pipeline (OAuth-only). Implements the minimal authorization-server
+ * surface an MCP client drives:
+ *
+ *   GET  /.well-known/oauth-protected-resource[/mcp]  — resource metadata
+ *   GET  /.well-known/oauth-authorization-server      — AS metadata
+ *   POST /oauth/register                              — Dynamic Client Registration
+ *   GET  /oauth/authorize                             — consent screen
+ *   POST /oauth/authorize                             — consent submit → code
+ *   POST /oauth/token                                 — code + refresh grants
+ *   POST /oauth/revoke                                — revoke a refresh token
+ *
+ * Security posture (see plan reflective-sprouting-turtle):
+ *   - Issuer + endpoint URLs are PINNED to a configured canonical base URL,
+ *     never the inbound Host header (metadata-spoofing defense).
+ *   - DCR is unauthenticated (the client has no user yet) but rate-limited,
+ *     and redirect URIs are validated (https-only, no fragments/wildcards).
+ *   - PKCE S256 is mandatory; authorization codes are single-use, ≤60s.
+ *   - The consent form carries an HMAC-signed blob of the authorize params
+ *     (incl. `state` + the logged-in userId) so the POST can't be forged.
+ *   - All values rendered into the consent HTML are escaped (DCR is attacker-
+ *     controlled). Token responses are `Cache-Control: no-store`.
+ *   - Access tokens are minted with `aud = <canonical>/mcp`; the global auth
+ *     hook scopes them to `/mcp` + `/oauth/*`.
+ */
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { AuthService } from '../../services/auth-service.js';
+interface WorkspaceConfigLike {
+    server_url?: unknown;
+    [k: string]: unknown;
+}
+/** Thrown when no canonical URL is pinned in a proxied/production-like deployment. */
+export declare class CanonicalUrlError extends Error {
+    constructor();
+}
+/**
+ * Resolve the canonical public base URL for this tenant, in priority order:
+ *   1. STUDIOGRAPH_PUBLIC_URL env (explicit operator override)
+ *   2. workspace config `server_url`
+ *   3. RAILWAY_PUBLIC_DOMAIN env → https://<domain>
+ *   4. request origin (LOCAL DEV ONLY fallback)
+ * Trailing slash stripped. Pinning to a configured value (not the inbound
+ * Host header) is what prevents discovery-metadata spoofing behind a proxy.
+ *
+ * **Fails closed:** in a proxied/production-like deployment (`mustPinIssuer`)
+ * with no pinned value, throws `CanonicalUrlError` rather than trusting the
+ * (spoofable) forwarded Host. The dev fallback to request origin only applies
+ * locally, where there is no untrusted proxy in front.
+ */
+export declare function resolveCanonicalBaseUrl(workspaceConfig: WorkspaceConfigLike, req: FastifyRequest): string;
+/** True if a stable canonical URL is configured (not relying on the dev fallback). */
+export declare function hasCanonicalUrl(workspaceConfig: WorkspaceConfigLike): boolean;
+/**
+ * Same-origin guard for post-login `returnTo` paths. Returns the path only if
+ * it is a safe root-relative path on this origin, else `/`.
+ *
+ * Must reject: absolute/protocol-relative URLs (`//evil`, `https://evil`) AND
+ * backslash variants (`/\evil`, `/\/evil`) — browsers normalize `\` to `/` in a
+ * `Location` header, so `/\evil.com` becomes `//evil.com` → an off-origin
+ * redirect. Also reject control characters.
+ */
+export declare function safeReturnTo(raw: string | undefined | null): string;
+export declare function registerOAuthApiRoutes(fastify: FastifyInstance, authService: AuthService, workspaceConfig: WorkspaceConfigLike): Promise<void>;
+export {};

package/dist/server/routes/oauth-api.js

@@ -0,0 +1,421 @@
+/**
+ * OAuth 2.0 Authorization Server routes
+ *
+ * Makes Studiograph's `/mcp` server connectable by Claude Desktop's Chat/Cowork
+ * connector pipeline (OAuth-only). Implements the minimal authorization-server
+ * surface an MCP client drives:
+ *
+ *   GET  /.well-known/oauth-protected-resource[/mcp]  — resource metadata
+ *   GET  /.well-known/oauth-authorization-server      — AS metadata
+ *   POST /oauth/register                              — Dynamic Client Registration
+ *   GET  /oauth/authorize                             — consent screen
+ *   POST /oauth/authorize                             — consent submit → code
+ *   POST /oauth/token                                 — code + refresh grants
+ *   POST /oauth/revoke                                — revoke a refresh token
+ *
+ * Security posture (see plan reflective-sprouting-turtle):
+ *   - Issuer + endpoint URLs are PINNED to a configured canonical base URL,
+ *     never the inbound Host header (metadata-spoofing defense).
+ *   - DCR is unauthenticated (the client has no user yet) but rate-limited,
+ *     and redirect URIs are validated (https-only, no fragments/wildcards).
+ *   - PKCE S256 is mandatory; authorization codes are single-use, ≤60s.
+ *   - The consent form carries an HMAC-signed blob of the authorize params
+ *     (incl. `state` + the logged-in userId) so the POST can't be forged.
+ *   - All values rendered into the consent HTML are escaped (DCR is attacker-
+ *     controlled). Token responses are `Cache-Control: no-store`.
+ *   - Access tokens are minted with `aud = <canonical>/mcp`; the global auth
+ *     hook scopes them to `/mcp` + `/oauth/*`.
+ */
+import { OAuthServerStore, OAuthRegistrationError } from '../../services/oauth-server-store.js';
+import { log } from '../../utils/log.js';
+/** v1 ships a single full-access scope (granular scopes deferred — TODOS.md). */
+const OAUTH_SCOPE = 'mcp:full';
+const CONSENT_TTL_MS = 10 * 60 * 1000;
+/** httpOnly cookie carrying the signed consent blob between authorize GET, the
+ *  consent screen's context fetch, and the Allow POST. Never exposed to JS. */
+const CONSENT_COOKIE = '__sg_oauth_consent';
+/** Thrown when no canonical URL is pinned in a proxied/production-like deployment. */
+export class CanonicalUrlError extends Error {
+    constructor() {
+        super('OAuth issuer URL is not configured (set STUDIOGRAPH_PUBLIC_URL / server_url)');
+        this.name = 'CanonicalUrlError';
+    }
+}
+/**
+ * True in a deployment where the server sits behind a proxy and the inbound
+ * Host header cannot be trusted. In these modes the issuer MUST be pinned to a
+ * configured value, or the OAuth-AS fails closed (no spoofable metadata).
+ */
+function mustPinIssuer() {
+    if (process.env.NODE_ENV === 'production')
+        return true;
+    if (process.env.RAILWAY_ENVIRONMENT)
+        return true;
+    const managed = (process.env.STUDIOGRAPH_MANAGED_AUTH || '').toLowerCase();
+    return managed === '1' || managed === 'true' || managed === 'yes';
+}
+/**
+ * Resolve the canonical public base URL for this tenant, in priority order:
+ *   1. STUDIOGRAPH_PUBLIC_URL env (explicit operator override)
+ *   2. workspace config `server_url`
+ *   3. RAILWAY_PUBLIC_DOMAIN env → https://<domain>
+ *   4. request origin (LOCAL DEV ONLY fallback)
+ * Trailing slash stripped. Pinning to a configured value (not the inbound
+ * Host header) is what prevents discovery-metadata spoofing behind a proxy.
+ *
+ * **Fails closed:** in a proxied/production-like deployment (`mustPinIssuer`)
+ * with no pinned value, throws `CanonicalUrlError` rather than trusting the
+ * (spoofable) forwarded Host. The dev fallback to request origin only applies
+ * locally, where there is no untrusted proxy in front.
+ */
+export function resolveCanonicalBaseUrl(workspaceConfig, req) {
+    const fromEnv = process.env.STUDIOGRAPH_PUBLIC_URL?.trim();
+    if (fromEnv)
+        return stripSlash(fromEnv);
+    const fromConfig = typeof workspaceConfig.server_url === 'string' ? workspaceConfig.server_url.trim() : '';
+    if (fromConfig)
+        return stripSlash(fromConfig);
+    const railway = process.env.RAILWAY_PUBLIC_DOMAIN?.trim();
+    if (railway)
+        return `https://${stripSlash(railway)}`;
+    // No pinned value. Behind a proxy this is unsafe (Host is attacker-influenced)
+    // — fail closed. Locally, fall back to the request origin.
+    if (mustPinIssuer())
+        throw new CanonicalUrlError();
+    const proto = req.headers['x-forwarded-proto'] || req.protocol || 'http';
+    const host = req.headers['x-forwarded-host'] || req.headers.host || req.hostname;
+    return stripSlash(`${proto}://${host}`);
+}
+/** True if a stable canonical URL is configured (not relying on the dev fallback). */
+export function hasCanonicalUrl(workspaceConfig) {
+    return Boolean(process.env.STUDIOGRAPH_PUBLIC_URL?.trim() ||
+        (typeof workspaceConfig.server_url === 'string' && workspaceConfig.server_url.trim()) ||
+        process.env.RAILWAY_PUBLIC_DOMAIN?.trim());
+}
+function stripSlash(s) {
+    return s.replace(/\/+$/, '');
+}
+/**
+ * Same-origin guard for post-login `returnTo` paths. Returns the path only if
+ * it is a safe root-relative path on this origin, else `/`.
+ *
+ * Must reject: absolute/protocol-relative URLs (`//evil`, `https://evil`) AND
+ * backslash variants (`/\evil`, `/\/evil`) — browsers normalize `\` to `/` in a
+ * `Location` header, so `/\evil.com` becomes `//evil.com` → an off-origin
+ * redirect. Also reject control characters.
+ */
+export function safeReturnTo(raw) {
+    if (!raw || typeof raw !== 'string')
+        return '/';
+    if (!raw.startsWith('/'))
+        return '/'; // must be root-relative
+    if (raw.startsWith('//'))
+        return '/'; // protocol-relative -> off-origin
+    if (raw.includes('\\'))
+        return '/'; // backslash -> browser-normalized off-origin
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f\x7f]/.test(raw))
+        return '/'; // control chars
+    return raw;
+}
+function redirectError(reply, redirectUri, error, state, description) {
+    const url = new URL(redirectUri);
+    url.searchParams.set('error', error);
+    if (description)
+        url.searchParams.set('error_description', description);
+    if (state)
+        url.searchParams.set('state', state);
+    reply.redirect(url.toString());
+}
+function noStore(reply) {
+    reply.header('Cache-Control', 'no-store');
+    reply.header('Pragma', 'no-cache');
+}
+export async function registerOAuthApiRoutes(fastify, authService, workspaceConfig) {
+    const store = authService.oauthServer;
+    const allowLoopback = process.env.NODE_ENV !== 'production';
+    // Boot-time check: managed tenants must have a pinned canonical URL, else
+    // discovery metadata would fall back to the spoofable request origin.
+    if (!hasCanonicalUrl(workspaceConfig)) {
+        const managed = (process.env.STUDIOGRAPH_MANAGED_AUTH || '').toLowerCase();
+        const isManaged = managed === '1' || managed === 'true' || managed === 'yes';
+        const msg = '[oauth-as] No canonical public URL configured (STUDIOGRAPH_PUBLIC_URL / server_url / RAILWAY_PUBLIC_DOMAIN). OAuth discovery metadata will use the request origin.';
+        if (isManaged)
+            log.warn(`${msg} This is unsafe on a managed/proxied tenant.`);
+        else
+            log.info(`${msg} OK for local dev.`);
+    }
+    const resourceUrl = (base) => `${base}/mcp`;
+    // Resolve the pinned canonical base URL, or fail closed: in a proxied/
+    // production-like deployment with no pinned URL we return null + send 503
+    // rather than emit spoofable metadata built from the inbound Host header.
+    const requireCanonical = (req, reply) => {
+        try {
+            return resolveCanonicalBaseUrl(workspaceConfig, req);
+        }
+        catch (err) {
+            if (err instanceof CanonicalUrlError) {
+                log.error('[oauth-as] refusing OAuth request: no canonical issuer URL configured');
+                reply.status(503).send({ error: 'server_error', error_description: 'issuer not configured' });
+                return null;
+            }
+            throw err;
+        }
+    };
+    // ── Discovery: protected-resource metadata (RFC 9728) ──
+    // Serve both the root and the `/mcp`-suffixed form — MCP clients differ on
+    // which they fetch (the SDK's helper suffixes the resource path).
+    const protectedResource = (req, reply) => {
+        const base = requireCanonical(req, reply);
+        if (!base)
+            return;
+        reply.send({
+            resource: resourceUrl(base),
+            authorization_servers: [base],
+        });
+    };
+    fastify.get('/.well-known/oauth-protected-resource', protectedResource);
+    fastify.get('/.well-known/oauth-protected-resource/mcp', protectedResource);
+    // ── Discovery: authorization-server metadata (RFC 8414) ──
+    fastify.get('/.well-known/oauth-authorization-server', (req, reply) => {
+        const base = requireCanonical(req, reply);
+        if (!base)
+            return;
+        reply.send({
+            issuer: base,
+            authorization_endpoint: `${base}/oauth/authorize`,
+            token_endpoint: `${base}/oauth/token`,
+            registration_endpoint: `${base}/oauth/register`,
+            revocation_endpoint: `${base}/oauth/revoke`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            scopes_supported: [OAUTH_SCOPE],
+        });
+    });
+    // ── Dynamic Client Registration (RFC 7591) ──
+    fastify.post('/oauth/register', { config: { rateLimit: { max: 10, timeWindow: '1 hour' } } }, (req, reply) => {
+        const body = (req.body ?? {});
+        try {
+            const client = store.registerClient({ client_name: body.client_name ?? '', redirect_uris: body.redirect_uris ?? [] }, { allowLoopback });
+            noStore(reply);
+            reply.status(201).send({
+                client_id: client.client_id,
+                client_name: client.client_name,
+                redirect_uris: client.redirect_uris,
+                token_endpoint_auth_method: 'none',
+                grant_types: ['authorization_code', 'refresh_token'],
+                response_types: ['code'],
+            });
+        }
+        catch (err) {
+            if (err instanceof OAuthRegistrationError) {
+                log.warn(`[oauth-as] registration rejected: ${err.code} ${err.message}`);
+                return reply.status(400).send({ error: err.code, error_description: err.message });
+            }
+            throw err;
+        }
+    });
+    // ── Authorization endpoint — consent screen (GET) ──
+    // The global auth hook resolves the logged-in user (cookie) BEFORE this runs,
+    // and bounces to /login?returnTo= when there's none. We re-assert that here
+    // as defense-in-depth.
+    fastify.get('/oauth/authorize', { config: { rateLimit: { max: 60, timeWindow: '1 minute' } } }, (req, reply) => {
+        const user = req.user;
+        const q = req.query;
+        const base = requireCanonical(req, reply);
+        if (!base)
+            return;
+        if (!user) {
+            const returnTo = `/oauth/authorize${req.raw.url?.includes('?') ? req.raw.url.slice(req.raw.url.indexOf('?')) : ''}`;
+            return reply.redirect(`/login?returnTo=${encodeURIComponent(safeReturnTo(returnTo))}`);
+        }
+        const clientId = q.client_id ?? '';
+        const redirectUri = q.redirect_uri ?? '';
+        const client = store.getClient(clientId);
+        // Client / redirect_uri problems must NOT redirect to the (untrusted)
+        // client redirect_uri (open-redirect risk, RFC 6749 §4.1.2.1). Bounce to
+        // our OWN branded consent page in its error state instead — same-origin,
+        // so no open-redirect concern.
+        if (!client || !redirectUri || !store.clientAllowsRedirect(clientId, redirectUri)) {
+            log.warn(`[oauth-as] authorize rejected: bad client_id/redirect_uri (client=${clientId})`);
+            return reply.redirect('/oauth/consent?error=invalid_request');
+        }
+        const state = q.state;
+        // From here, errors can be safely redirected back to the (validated) URI.
+        if (q.response_type !== 'code') {
+            return redirectError(reply, redirectUri, 'unsupported_response_type', state);
+        }
+        if (q.code_challenge_method && q.code_challenge_method !== 'S256') {
+            return redirectError(reply, redirectUri, 'invalid_request', state, 'code_challenge_method must be S256');
+        }
+        if (!q.code_challenge) {
+            return redirectError(reply, redirectUri, 'invalid_request', state, 'code_challenge (PKCE) required');
+        }
+        if (q.resource && q.resource !== resourceUrl(base)) {
+            return redirectError(reply, redirectUri, 'invalid_target', state, 'unknown resource');
+        }
+        // Bind the authorize params + the logged-in user into a signed blob the
+        // POST handler will verify. Includes `state` so it can't be substituted.
+        const consent = store.signConsent({
+            client_id: clientId,
+            redirect_uri: redirectUri,
+            code_challenge: q.code_challenge,
+            scope: OAUTH_SCOPE,
+            resource: resourceUrl(base),
+            userId: user.id,
+            state: state ?? '',
+        });
+        // Hand off to the branded SvelteKit consent screen. The signed blob rides
+        // in an httpOnly cookie (never the DOM): the consent page only fetches
+        // display fields from /api/oauth/consent-context, and the Allow POST reads
+        // the blob back from this cookie. Short TTL matches the signer's window.
+        reply.setCookie(CONSENT_COOKIE, consent, {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: req.headers['x-forwarded-proto'] === 'https',
+            maxAge: CONSENT_TTL_MS / 1000,
+        });
+        return reply.redirect('/oauth/consent');
+    });
+    // ── Consent display context (for the SvelteKit consent screen) ──
+    // Session-authed (global hook sets req.user). Returns ONLY display fields
+    // resolved from the httpOnly consent cookie — never the signed blob itself.
+    fastify.get('/api/oauth/consent-context', (req, reply) => {
+        noStore(reply);
+        const user = req.user;
+        if (!user)
+            return reply.status(401).send({ error: 'login_required' });
+        const raw = req.cookies?.[CONSENT_COOKIE];
+        const payload = raw ? store.verifyConsent(raw) : null;
+        if (!payload || payload.userId !== user.id) {
+            return reply.status(410).send({ error: 'consent_expired' });
+        }
+        const client = store.getClient(String(payload.client_id));
+        if (!client || !store.clientAllowsRedirect(client.client_id, String(payload.redirect_uri))) {
+            return reply.status(410).send({ error: 'invalid_client' });
+        }
+        let redirectHost = String(payload.redirect_uri);
+        try {
+            redirectHost = new URL(String(payload.redirect_uri)).host;
+        }
+        catch { /* keep raw */ }
+        return reply.send({
+            client_name: client.client_name,
+            redirect_host: redirectHost,
+            scope: String(payload.scope ?? OAUTH_SCOPE),
+            user_label: user.displayName || user.email,
+        });
+    });
+    // ── Authorization endpoint — consent submit (POST) ──
+    // The signed blob comes from the httpOnly consent cookie (set by the GET
+    // handler), NOT a form field — the browser only submits `decision`. A
+    // cross-site POST can't carry the Lax cookie, so this is CSRF-safe.
+    fastify.post('/oauth/authorize', { config: { rateLimit: { max: 60, timeWindow: '1 minute' } } }, (req, reply) => {
+        const user = req.user;
+        const body = (req.body ?? {});
+        if (!user)
+            return reply.status(401).send({ error: 'login_required' });
+        const rawConsent = req.cookies?.[CONSENT_COOKIE];
+        const payload = rawConsent ? store.verifyConsent(rawConsent) : null;
+        // Consume the cookie regardless of outcome (single-use).
+        reply.clearCookie(CONSENT_COOKIE, { path: '/' });
+        // Pre-consent failures bounce to the branded consent page's error state
+        // (same-origin redirect — see the GET handler).
+        if (!payload) {
+            return reply.redirect('/oauth/consent?error=expired');
+        }
+        // The signed blob must belong to THIS logged-in user.
+        if (payload.userId !== user.id) {
+            log.warn('[oauth-as] consent userId mismatch — rejecting');
+            return reply.redirect('/oauth/consent?error=expired');
+        }
+        const clientId = String(payload.client_id);
+        const redirectUri = String(payload.redirect_uri);
+        const state = String(payload.state ?? '');
+        // Re-check the client + redirect_uri still valid (could have changed/been
+        // deleted between the GET render and this POST).
+        if (!store.clientAllowsRedirect(clientId, redirectUri)) {
+            return reply.redirect('/oauth/consent?error=invalid_request');
+        }
+        if (body.decision !== 'allow') {
+            return redirectError(reply, redirectUri, 'access_denied', state || undefined);
+        }
+        const code = store.saveCode({
+            client_id: clientId,
+            user_id: user.id,
+            redirect_uri: redirectUri,
+            code_challenge: String(payload.code_challenge),
+            scope: String(payload.scope ?? OAUTH_SCOPE),
+            resource: String(payload.resource),
+        });
+        const url = new URL(redirectUri);
+        url.searchParams.set('code', code);
+        if (state)
+            url.searchParams.set('state', state);
+        reply.redirect(url.toString());
+    });
+    // ── Token endpoint ──
+    fastify.post('/oauth/token', { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } }, (req, reply) => {
+        noStore(reply);
+        const body = (req.body ?? {});
+        const base = requireCanonical(req, reply);
+        if (!base)
+            return;
+        // Opportunistic GC on this low-frequency endpoint (never per-request).
+        store.gcStale();
+        const grant = body.grant_type;
+        if (grant === 'authorization_code') {
+            const { code, code_verifier, redirect_uri, client_id } = body;
+            if (!code || !code_verifier || !redirect_uri || !client_id) {
+                return reply.status(400).send({ error: 'invalid_request' });
+            }
+            const consumed = store.consumeCode(code);
+            if (!consumed)
+                return reply.status(400).send({ error: 'invalid_grant' });
+            if (consumed.client_id !== client_id || consumed.redirect_uri !== redirect_uri) {
+                return reply.status(400).send({ error: 'invalid_grant' });
+            }
+            if (!OAuthServerStore.verifyPkce(consumed.code_challenge, code_verifier)) {
+                return reply.status(400).send({ error: 'invalid_grant', error_description: 'PKCE verification failed' });
+            }
+            const user = authService.findUserById(consumed.user_id);
+            if (!user)
+                return reply.status(400).send({ error: 'invalid_grant' });
+            const tokens = store.issueTokens(user, consumed.client_id, consumed.scope, consumed.resource);
+            return reply.send(tokens);
+        }
+        if (grant === 'refresh_token') {
+            const { refresh_token, client_id } = body;
+            // Public clients MUST identify themselves (RFC 6749 §3.2.1). Require
+            // client_id and validate it BEFORE the token is consumed, so a stolen
+            // refresh token presented with the wrong client_id can't grief the
+            // victim's grant into invalidation (rotation deletes the old token).
+            if (!refresh_token || !client_id)
+                return reply.status(400).send({ error: 'invalid_request' });
+            const rotated = store.rotateRefreshToken(refresh_token, client_id);
+            if (!rotated)
+                return reply.status(400).send({ error: 'invalid_grant' });
+            const access_token = store.createAccessToken(rotated.user, rotated.clientId, resourceUrl(base));
+            return reply.send({
+                access_token,
+                refresh_token: rotated.refreshToken,
+                token_type: 'Bearer',
+                expires_in: 3600,
+                scope: rotated.scope,
+            });
+        }
+        return reply.status(400).send({ error: 'unsupported_grant_type' });
+    });
+    // ── Revocation (RFC 7009) — always 200, no token-scanning oracle ──
+    fastify.post('/oauth/revoke', { config: { rateLimit: { max: 30, timeWindow: '1 minute' } } }, (req, reply) => {
+        noStore(reply);
+        const body = (req.body ?? {});
+        if (body.token)
+            store.revokeRefreshToken(body.token);
+        reply.status(200).send({});
+    });
+}
+//# sourceMappingURL=oauth-api.js.map

package/dist/server/routes/oauth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-api.js","sourceRoot":"","sources":["../../../src/server/routes/oauth-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAChG,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,iFAAiF;AACjF,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC;+EAC+E;AAC/E,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAO5C,sFAAsF;AACtF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,eAAoC,EAAE,GAAmB;IAC/F,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,OAAO;QAAE,OAAO,WAAW,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAErD,+EAA+E;IAC/E,2DAA2D;IAC3D,IAAI,aAAa,EAAE;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAY,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC;IACrF,MAAM,IAAI,GAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAY,IAAK,GAAG,CAAC,OAAO,CAAC,IAAe,IAAI,GAAG,CAAC,QAAQ,CAAC;IACzG,OAAO,UAAU,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,eAAoC;IAClE,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE;QAC1C,CAAC,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,IAAI,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAA8B;IACzD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAK,wBAAwB;IAClE,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAK,kCAAkC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,CAAO,6CAA6C;IACvF,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,gBAAgB;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,WAAmB,EAAE,KAAa,EAAE,KAAyB,EAAE,WAAoB;IAC7H,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,WAAW;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB;IAClC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAwB,EACxB,WAAwB,EACxB,eAAoC;IAEpC,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAE5D,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,CAAC;QAC7E,MAAM,GAAG,GAAG,oKAAoK,CAAC;QACjL,IAAI,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,8CAA8C,CAAC,CAAC;;YACzE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC;IACpD,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,gBAAgB,GAAG,CAAC,GAAmB,EAAE,KAAmB,EAAiB,EAAE;QACnF,IAAI,CAAC;YACH,OAAO,uBAAuB,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;gBACnF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBAC9F,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,0DAA0D;IAC1D,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,CAAC,GAAmB,EAAE,KAAmB,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;YAC3B,qBAAqB,EAAE,CAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,uCAAuC,EAAE,iBAAiB,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,2CAA2C,EAAE,iBAAiB,CAAC,CAAC;IAE5E,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACpE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,IAAI;YACZ,sBAAsB,EAAE,GAAG,IAAI,kBAAkB;YACjD,cAAc,EAAE,GAAG,IAAI,cAAc;YACrC,qBAAqB,EAAE,GAAG,IAAI,iBAAiB;YAC/C,mBAAmB,EAAE,GAAG,IAAI,eAAe;YAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,gBAAgB,EAAE,CAAC,WAAW,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,OAAO,CAAC,IAAI,CACV,iBAAiB,EACjB,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,EAC5D,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuD,CAAC;QACpF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,cAAc,CACjC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,EAChF,EAAE,aAAa,EAAE,CAClB,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,0BAA0B,EAAE,MAAM;gBAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;gBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,qCAAqC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,sDAAsD;IACtD,8EAA8E;IAC9E,4EAA4E;IAC5E,uBAAuB;IACvB,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7G,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,CAAC,GAAG,GAAG,CAAC,KAA2C,CAAC;QAC1D,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,QAAQ,GAAG,mBAAmB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACpH,OAAO,KAAK,CAAC,QAAQ,CAAC,mBAAmB,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEzC,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,+BAA+B;QAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,qEAAqE,QAAQ,GAAG,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,0EAA0E;QAC1E,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC;QACxF,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC;YAChC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,KAAK,IAAI,EAAE;SACnB,CAAC,CAAC;QAEH,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE;YACvC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO;YACpD,MAAM,EAAE,cAAc,GAAG,IAAI;SAC9B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,0EAA0E;IAC1E,4EAA4E;IAC5E,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QACvD,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,GAAI,GAAG,CAAC,OAA8C,EAAE,CAAC,cAAc,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC;YAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC3F,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;YAC3C,UAAU,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK;SAC3C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC9G,MAAM,IAAI,GAAI,GAAW,CAAC,IAA4B,CAAC;QACvD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA0B,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEtE,MAAM,UAAU,GAAI,GAAG,CAAC,OAA8C,EAAE,CAAC,cAAc,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,yDAAyD;QACzD,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,wEAAwE;QACxE,gDAAgD;QAChD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QACxD,CAAC;QACD,sDAAsD;QACtD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAE1C,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,KAAK,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC1B,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;YAC9C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;YAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC1G,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuC,CAAC;QACpE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,uEAAuE;QACvE,KAAK,CAAC,OAAO,EAAE,CAAC;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC;QAC9B,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YAC9D,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACzE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBAC/E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC9B,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YAC1C,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,qEAAqE;YACrE,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACxE,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAChG,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,YAAY;gBACZ,aAAa,EAAE,OAAO,CAAC,YAAY;gBACnC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3G,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/routes/permissions-api.d.ts

@@ -1,9 +1,14 @@
 /**
  * Permissions API routes
  *
- * Per-folder membership management. Any folder admin (or the workspace
- * owner) can grant/revoke access to their folder; everyone can list the
- * folders they're a member of.
+ * Per-folder membership management. A folder admin (member with role='admin')
+ * can grant/revoke access to their folder; a workspace owner can manage members
+ * of ANY folder (workspace administration). This is administration only — it
+ * does NOT grant the owner content access to folders they aren't a member of
+ * (see docs/agents/auth-access.md: content visibility/write stay membership-
+ * only). GET /api/permissions/folders is the Manage Folders surface, scoped by
+ * `isFolderAdminOrOwner` — so the owner sees every folder's metadata (members +
+ * entry count) to administer it, while never being able to read its entries.
  */
 import type { FastifyInstance } from 'fastify';
 import { AuthService } from '../../services/auth-service.js';

package/dist/server/routes/permissions-api.js

@@ -1,27 +1,43 @@
 /**
  * Permissions API routes
  *
- * Per-folder membership management. Any folder admin (or the workspace
- * owner) can grant/revoke access to their folder; everyone can list the
- * folders they're a member of.
+ * Per-folder membership management. A folder admin (member with role='admin')
+ * can grant/revoke access to their folder; a workspace owner can manage members
+ * of ANY folder (workspace administration). This is administration only — it
+ * does NOT grant the owner content access to folders they aren't a member of
+ * (see docs/agents/auth-access.md: content visibility/write stay membership-
+ * only). GET /api/permissions/folders is the Manage Folders surface, scoped by
+ * `isFolderAdminOrOwner` — so the owner sees every folder's metadata (members +
+ * entry count) to administer it, while never being able to read its entries.
  */
 import { isWorkspaceOwner } from '../../services/auth-service.js';
-/** True if the user is a folder admin on the folder, or the workspace owner. */
+import { isArchivedRepo } from '../../core/types.js';
+import { isFolderAdminOrOwner, isOpenMode } from '../../services/access-control.js';
+import { resolveFolderDisplayName } from '../../core/seed-folder.js';
+/** True if the user may manage the folder's membership — a member-admin on the
+ *  folder, OR a workspace owner (who can administer any folder). Mirrors
+ *  `isFolderAdminOrOwner`; administration only, never content access. */
 function canManageFolder(user, folder, authService) {
+    // FAIL CLOSED outside local open mode (matches the access-control helpers).
     if (!user)
-        return true; // API key / open mode
-    if (isWorkspaceOwner(user.role))
-        return true;
-    return authService.isFolderAdmin(user.id, folder);
+        return isOpenMode(authService);
+    return authService.isFolderAdmin(user.id, folder) || isWorkspaceOwner(user.role);
 }
 export async function registerPermissionsApiRoutes(fastify, authService, workspaceManager, wsHub) {
-    // GET /api/permissions/folders — folders the caller can manage, with
-    // the members and entry count of each. Workspace owner sees all folders;
-    // everyone else sees only folders where they are a folder admin.
+    // GET /api/permissions/folders — folders the caller can manage in the Manage
+    // Folders tab, with each folder's members + entry count (metadata only, never
+    // content). A folder admin sees the folders they admin; a workspace owner
+    // sees EVERY folder (administration god-view) via isFolderAdminOrOwner. This
+    // visibility is metadata-only — the mutation endpoints below gate the same
+    // way, and content read/write stays membership-only elsewhere.
     fastify.get('/api/permissions/folders', async (req, reply) => {
         const user = req.user;
         const allRepos = workspaceManager.getAllRepoConfigs();
-        const visible = allRepos.filter(repo => canManageFolder(user, repo.name, authService));
+        const users = authService.listUsers();
+        // Exclude archived folders — they surface only via GET /api/repos/archived
+        // (the Settings "Archived folders" section). Showing them here would double-
+        // list them and expose rename/member controls on a hidden folder.
+        const visible = allRepos.filter(repo => !isArchivedRepo(repo) && isFolderAdminOrOwner(user, repo.name, workspaceManager, authService));
         const result = visible.map(repo => {
             // `listEntityIds()` just walks the folder's subdirectories — no
             // markdown parse, no zod validation. Previously we called
@@ -35,6 +51,9 @@ export async function registerPermissionsApiRoutes(fastify, authService, workspa
             catch { /* skip */ }
             return {
                 folder: repo.name,
+                // Derived so a seed folder reads as its owner's name ("Sumin's Folder")
+                // even when shown to an owner who isn't in the workspace.repos store.
+                display_name: resolveFolderDisplayName(repo, users),
                 members: authService.getFolderMembers(repo.name),
                 entry_count: entryCount,
             };
@@ -51,6 +70,13 @@ export async function registerPermissionsApiRoutes(fastify, authService, workspa
         if (!canManageFolder(user, folder, authService)) {
             return reply.status(403).send({ error: 'Folder admin access required' });
         }
+        // The folder must exist. Without this, a workspace owner (who can manage
+        // ANY folder name) could pre-seed a grant on a not-yet-created folder;
+        // when someone later creates that folder, the stale grant would silently
+        // hand the grantee access. Checked AFTER authz so existence isn't leaked.
+        if (!workspaceManager.getRepoConfig(folder)) {
+            return reply.status(404).send({ error: `Folder "${folder}" not found` });
+        }
         if (role && role !== 'admin' && role !== 'editor') {
             return reply.status(400).send({ error: `Invalid role "${role}" — must be "admin" or "editor"` });
         }
@@ -64,6 +90,10 @@ export async function registerPermissionsApiRoutes(fastify, authService, workspa
             }
         }
         authService.grantFolderAccess(userId, folder, desired);
+        // Patch the recipient's WS folder cache before the event fires —
+        // otherwise canReceive() keeps dropping `entity_change` broadcasts
+        // for entities in this folder until they reconnect.
+        wsHub.addUserFolder(String(userId), folder);
         wsHub.broadcastToUser(String(userId), {
             type: 'access_granted',
             repo: folder,
@@ -92,6 +122,7 @@ export async function registerPermissionsApiRoutes(fastify, authService, workspa
             }
         }
         authService.revokeFolderAccess(userId, folder);
+        wsHub.removeUserFolder(String(userId), folder);
         wsHub.broadcastToUser(String(userId), {
             type: 'access_revoked',
             repo: folder,