@adminiumjs/adminium 0.1.0-rc.1

package/dist/backup/snapshot.js

@@ -0,0 +1,142 @@
+/**
+ * SQLite snapshotting for the §9 backup (11-electron.md §9), and the discovery
+ * of what there is to snapshot.
+ *
+ * ─── Why `backup()` and not `copyFile()` ─────────────────────────────────────
+ *
+ * §9 is specific — "the server snapshots each SQLite file with the
+ * `better-sqlite3` online `backup()` API (WAL-safe, no locking of live writers)"
+ * — and the alternative it rules out is not merely inferior, it is silently
+ * wrong. Every local database runs `journal_mode = WAL` (§9's pragma block), so
+ * a committed row lives in `<db>-wal` until a checkpoint folds it back. Copying
+ * the `.sqlite` file therefore copies a database that is missing its most recent
+ * commits; copying all three files copies them at three different instants, so
+ * the WAL can describe pages the main file does not have yet. Both produce an
+ * archive that unzips, opens, passes `PRAGMA integrity_check`, and has lost
+ * data — the worst failure a backup can have, because it is invisible until the
+ * restore.
+ *
+ * `backup()` runs SQLite's own online backup: it reads through the same page
+ * cache and WAL a reader would, restarts itself if a writer changes the source
+ * mid-copy, and lands a self-contained, checkpointed file. The destination is
+ * complete at whatever instant the copy finished, and live writers are never
+ * blocked.
+ *
+ * ─── Why a second connection ─────────────────────────────────────────────────
+ *
+ * The obvious move is to reach through `ConnectionManager` for the handle the
+ * server already holds. It is the wrong move: those handles are role-branded
+ * (01 §3's privilege model), pooled, and owned by request-scoped code, and a
+ * backup that borrowed one would serialize itself behind whatever CRUD is in
+ * flight — the exact locking §9 says not to do. A second connection to a WAL
+ * database is the normal, supported thing (WAL exists so readers and a writer
+ * coexist), so this module opens its own, READONLY, and closes it. `readonly`
+ * is belt and braces: a backup is the one operation in the product with no
+ * reason whatsoever to be able to write to a source database, and
+ * `fileMustExist` keeps a stale DSN from CREATING an empty database and
+ * cheerfully backing it up.
+ */
+import { mkdir } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { normalizeSqliteFile } from '@adminium/adapter-sqlite';
+import { connectionsRepo } from '@adminium/meta';
+import Database from 'better-sqlite3';
+import { deriveDatabaseSlug, uniqueSlug } from './format.js';
+/**
+ * `:memory:` and a relative path are both "not a file on this disk we can
+ * snapshot", for different reasons, and both must be classified rather than
+ * crashed on.
+ *
+ * `:memory:` is a real, supported SQLite target (`adapter-sqlite`'s own file
+ * normalizer names it for demos and tests) that has no bytes to copy. A relative
+ * path is a DSN whose meaning depends on the server's cwd — which, for a
+ * utilityProcess forked by Electron, is not a place anybody chose. Backing up
+ * "whatever `./app.db` resolves to from the app bundle's working directory"
+ * would be worse than not backing it up, because the manifest would claim it.
+ */
+function localFileOf(dsn) {
+    if (dsn === null)
+        return null;
+    const file = normalizeSqliteFile({ dsn });
+    if (file === null || file === ':memory:')
+        return null;
+    return isAbsolute(file) ? file : null;
+}
+/**
+ * Split every configured connection into "we dump this" and "we list this".
+ *
+ * §9's rule is about the ENGINE, not about reachability: a Postgres on
+ * `localhost` is still external (we do not have a byte-level snapshot mechanism
+ * for it, and `pg_dump` is not a thing this process may assume exists), and a
+ * SQLite file on a network share is still local. Anything that is neither — a
+ * `sqlite:` connection whose DSN is `:memory:` or relative — is listed as
+ * external too, which is the honest answer: the manifest says the connection
+ * existed and says its bytes are not in this archive.
+ */
+export async function discoverSources(meta, crypto) {
+    const repo = connectionsRepo(meta, crypto);
+    const connections = await repo.list();
+    const local = [];
+    const external = [];
+    const taken = new Set();
+    const claim = (candidate) => {
+        const slug = uniqueSlug(candidate, taken);
+        taken.add(slug);
+        return slug;
+    };
+    for (const connection of connections) {
+        const file = connection.engine === 'sqlite' ? localFileOf(await dataDsnOf(repo, connection)) : null;
+        if (file === null) {
+            external.push({
+                connectionId: connection.id,
+                slug: claim(deriveDatabaseSlug(connection.name, connection.id)),
+                engine: connection.engine,
+            });
+            continue;
+        }
+        local.push({
+            connectionId: connection.id,
+            slug: claim(deriveDatabaseSlug(file, connection.id)),
+            path: resolve(file),
+        });
+    }
+    return { local, external };
+}
+/**
+ * The data DSN, or `null` when it cannot be read.
+ *
+ * A decrypt failure means `ADMINIUM_SECRET` no longer opens this row — the
+ * keyring case `config.ts`'s {@link SecretUnavailableError} exists for, seen from
+ * the other side. It must NOT become an exception here: a backup is precisely
+ * what a user with one unreadable connection needs to take before touching
+ * anything, and failing the whole archive over one row would deny them the copy
+ * of the other nine. The row still appears in the manifest, as external — i.e.
+ * "this connection existed and its bytes are not in here", which is true.
+ */
+async function dataDsnOf(repo, connection) {
+    try {
+        return (await repo.getDsns(connection.id))?.dataDsn ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Snapshot `sourcePath` to `destPath` with SQLite's online backup.
+ *
+ * Awaited rather than fire-and-forget: better-sqlite3's `backup()` returns a
+ * promise that resolves when `remainingPages` hits 0, and a caller that hashed
+ * the destination without waiting would hash a partial file and write a checksum
+ * for a database that does not exist yet.
+ */
+export async function snapshotSqliteFile(sourcePath, destPath) {
+    await mkdir(dirname(destPath), { recursive: true });
+    const db = new Database(sourcePath, { readonly: true, fileMustExist: true });
+    try {
+        await db.backup(destPath);
+    }
+    finally {
+        db.close();
+    }
+}
+//# sourceMappingURL=snapshot.js.map

package/dist/backup/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../src/backup/snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAgD,MAAM,gBAAgB,CAAC;AAC/F,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAsB7D;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,GAAkB;IACrC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,MAAiB;IAEjB,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAEpD,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAAU,EAAE;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEpG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC/D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,KAAK,CAAC,IAAI,CAAC;YACT,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,IAAI,EAAE,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,SAAS,CACtB,IAAwC,EACxC,UAAsB;IAEtB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAgB;IAC3E,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/capabilities/catalog.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The host-capability vocabulary the desktop shell can be granted (11-electron.md
+ * §12 / 13-marketplace.md §2.11).
+ *
+ * A CLOSED set, and that is the point. A capability grant is an authorization to
+ * reach real hardware on the user's machine, so the route that writes one
+ * validates its `capabilityId` against this list rather than trusting the caller
+ * — an unknown id is a bad request (a typo, a manifest for a driver this build
+ * does not have), not a grant for a capability that cannot exist. v1 ships one
+ * concrete id, the ESC/POS receipt printer the POS micro-SaaS (13-marketplace.md
+ * §10) will use; the list grows with the drivers.
+ *
+ * WHAT THIS FILE DOES NOT OWN: the DESCRIPTOR — a capability's status
+ * (`available` / `stub` / `unavailable`) and method list. Those belong to the
+ * main-process `CapabilityHost`, which holds the providers and is the only thing
+ * that ever sees a device (§1 principle 2: the server owns data, not hardware).
+ * The server owns the id vocabulary — enough to validate a grant — and the grant
+ * table itself (`adminium_settings`, reached over the loopback REST API by main).
+ */
+import { z } from 'zod';
+/**
+ * The dotted capability ids this build knows how to grant. Reverse-mapped from
+ * 13-marketplace.md's advisory `capabilities` vocabulary: a manifest declaring
+ * `receipt-printer` needs `printer.escpos`.
+ */
+export declare const capabilityIdSchema: z.ZodEnum<{
+    "printer.escpos": "printer.escpos";
+}>;
+export type KnownCapabilityId = z.infer<typeof capabilityIdSchema>;
+/** The known ids as a tuple, for callers that want to iterate the vocabulary. */
+export declare const KNOWN_CAPABILITY_IDS: "printer.escpos"[];
+export declare function isKnownCapabilityId(id: string): id is KnownCapabilityId;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/capabilities/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/capabilities/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;EAA6B,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,oBAA6B,CAAC;AAE/D,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,iBAAiB,CAEvE"}

package/dist/capabilities/catalog.js

@@ -0,0 +1,32 @@
+/**
+ * The host-capability vocabulary the desktop shell can be granted (11-electron.md
+ * §12 / 13-marketplace.md §2.11).
+ *
+ * A CLOSED set, and that is the point. A capability grant is an authorization to
+ * reach real hardware on the user's machine, so the route that writes one
+ * validates its `capabilityId` against this list rather than trusting the caller
+ * — an unknown id is a bad request (a typo, a manifest for a driver this build
+ * does not have), not a grant for a capability that cannot exist. v1 ships one
+ * concrete id, the ESC/POS receipt printer the POS micro-SaaS (13-marketplace.md
+ * §10) will use; the list grows with the drivers.
+ *
+ * WHAT THIS FILE DOES NOT OWN: the DESCRIPTOR — a capability's status
+ * (`available` / `stub` / `unavailable`) and method list. Those belong to the
+ * main-process `CapabilityHost`, which holds the providers and is the only thing
+ * that ever sees a device (§1 principle 2: the server owns data, not hardware).
+ * The server owns the id vocabulary — enough to validate a grant — and the grant
+ * table itself (`adminium_settings`, reached over the loopback REST API by main).
+ */
+import { z } from 'zod';
+/**
+ * The dotted capability ids this build knows how to grant. Reverse-mapped from
+ * 13-marketplace.md's advisory `capabilities` vocabulary: a manifest declaring
+ * `receipt-printer` needs `printer.escpos`.
+ */
+export const capabilityIdSchema = z.enum(['printer.escpos']);
+/** The known ids as a tuple, for callers that want to iterate the vocabulary. */
+export const KNOWN_CAPABILITY_IDS = capabilityIdSchema.options;
+export function isKnownCapabilityId(id) {
+    return capabilityIdSchema.safeParse(id).success;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/capabilities/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/capabilities/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAI7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,OAAO,CAAC;AAE/D,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC"}

package/dist/capabilities/grants.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The desktop capability grant table (11-electron.md §12), over `adminium_settings`.
+ *
+ * §1 principle 2 puts the meta store on the server's side of the process
+ * boundary, so grant reads and writes live here and the main-process
+ * `CapabilityHost` reaches them over the loopback REST API (`routes/
+ * desktop-capabilities`). Grants are a SET keyed by `{ manifestId, capabilityId }`:
+ *
+ *  - granting twice is idempotent — the consent step records an authorization,
+ *    not a counter, so a re-install of the same app must not stack rows;
+ *  - revoking removes exactly the one identity;
+ *  - the whole array round-trips through `settingsRepo`, so its Zod schema
+ *    (`capabilityGrantsSchema`) validates every write and a corrupt row can never
+ *    be persisted.
+ *
+ * CONCURRENCY: each mutation is a read-modify-write of the single settings row.
+ * Two truly-simultaneous grants could lose one. That is acceptable here and only
+ * here — consent and revoke are deliberate, one-at-a-time admin actions on a
+ * single-user desktop reached over loopback, not a hot write path — and it is the
+ * same read-modify-write every other array-valued setting already accepts.
+ */
+import { type CapabilityGrant, type MetaDb } from '@adminium/meta';
+/** The identity of a grant — everything but its timestamp. */
+export interface GrantRef {
+    manifestId: string;
+    capabilityId: string;
+}
+/** Every consented grant, newest write order preserved. */
+export declare function listGrants(meta: MetaDb): Promise<CapabilityGrant[]>;
+/** True when `ref` is already granted — the check `CapabilityHost.invoke` makes. */
+export declare function isGranted(meta: MetaDb, ref: GrantRef): Promise<boolean>;
+/**
+ * Idempotent add. Returns the grant that is now in the table — the existing one
+ * if this identity was already granted, otherwise the newly written one.
+ */
+export declare function addGrant(meta: MetaDb, ref: GrantRef, opts?: {
+    now?: number;
+    updatedBy?: string | null;
+}): Promise<CapabilityGrant>;
+/** Remove a grant. Returns true when a row was actually removed (revoke is a no-op otherwise). */
+export declare function removeGrant(meta: MetaDb, ref: GrantRef, opts?: {
+    updatedBy?: string | null;
+}): Promise<boolean>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/capabilities/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/capabilities/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAKjF,8DAA8D;AAC9D,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD,2DAA2D;AAC3D,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAEzE;AAED,oFAAoF;AACpF,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAG7E;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACrD,OAAO,CAAC,eAAe,CAAC,CAY1B;AAED,kGAAkG;AAClG,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACvC,OAAO,CAAC,OAAO,CAAC,CAOlB"}

package/dist/capabilities/grants.js

@@ -0,0 +1,65 @@
+/**
+ * The desktop capability grant table (11-electron.md §12), over `adminium_settings`.
+ *
+ * §1 principle 2 puts the meta store on the server's side of the process
+ * boundary, so grant reads and writes live here and the main-process
+ * `CapabilityHost` reaches them over the loopback REST API (`routes/
+ * desktop-capabilities`). Grants are a SET keyed by `{ manifestId, capabilityId }`:
+ *
+ *  - granting twice is idempotent — the consent step records an authorization,
+ *    not a counter, so a re-install of the same app must not stack rows;
+ *  - revoking removes exactly the one identity;
+ *  - the whole array round-trips through `settingsRepo`, so its Zod schema
+ *    (`capabilityGrantsSchema`) validates every write and a corrupt row can never
+ *    be persisted.
+ *
+ * CONCURRENCY: each mutation is a read-modify-write of the single settings row.
+ * Two truly-simultaneous grants could lose one. That is acceptable here and only
+ * here — consent and revoke are deliberate, one-at-a-time admin actions on a
+ * single-user desktop reached over loopback, not a hot write path — and it is the
+ * same read-modify-write every other array-valued setting already accepts.
+ */
+import { settingsRepo } from '@adminium/meta';
+/** The `adminium_settings` key; camelCased per the registry convention (§12 note). */
+const GRANTS_KEY = 'desktop.capabilityGrants';
+function isSameGrant(grant, ref) {
+    return grant.manifestId === ref.manifestId && grant.capabilityId === ref.capabilityId;
+}
+/** Every consented grant, newest write order preserved. */
+export async function listGrants(meta) {
+    return [...(await settingsRepo(meta).get(GRANTS_KEY))];
+}
+/** True when `ref` is already granted — the check `CapabilityHost.invoke` makes. */
+export async function isGranted(meta, ref) {
+    const grants = await settingsRepo(meta).get(GRANTS_KEY);
+    return grants.some((grant) => isSameGrant(grant, ref));
+}
+/**
+ * Idempotent add. Returns the grant that is now in the table — the existing one
+ * if this identity was already granted, otherwise the newly written one.
+ */
+export async function addGrant(meta, ref, opts = {}) {
+    const repo = settingsRepo(meta);
+    const current = await repo.get(GRANTS_KEY);
+    const existing = current.find((grant) => isSameGrant(grant, ref));
+    if (existing !== undefined)
+        return existing;
+    const grant = {
+        manifestId: ref.manifestId,
+        capabilityId: ref.capabilityId,
+        grantedAt: opts.now ?? Date.now(),
+    };
+    await repo.set(GRANTS_KEY, [...current, grant], { updatedBy: opts.updatedBy ?? null });
+    return grant;
+}
+/** Remove a grant. Returns true when a row was actually removed (revoke is a no-op otherwise). */
+export async function removeGrant(meta, ref, opts = {}) {
+    const repo = settingsRepo(meta);
+    const current = await repo.get(GRANTS_KEY);
+    const next = current.filter((grant) => !isSameGrant(grant, ref));
+    if (next.length === current.length)
+        return false;
+    await repo.set(GRANTS_KEY, next, { updatedBy: opts.updatedBy ?? null });
+    return true;
+}
+//# sourceMappingURL=grants.js.map

package/dist/capabilities/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/capabilities/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAqC,MAAM,gBAAgB,CAAC;AAEjF,sFAAsF;AACtF,MAAM,UAAU,GAAG,0BAAmC,CAAC;AAQvD,SAAS,WAAW,CAAC,KAAsB,EAAE,GAAa;IACxD,OAAO,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC;AACxF,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,OAAO,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAa;IACzD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,GAAa,EACb,OAAoD,EAAE;IAEtD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAoB;QAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;KAClC,CAAC;IACF,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,GAAa,EACb,OAAsC,EAAE;IAExC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/allowlist.d.ts

@@ -0,0 +1,46 @@
+/**
+ * LLM allowed-vocabulary loading for the CLI.
+ *
+ * `LLM_ALLOWED_TEMPLATES` / `LLM_ALLOWED_WIDGETS` live in `@adminium/widgets`,
+ * which **the server tree may never import** (01-architecture.md §2.3, enforced
+ * by `.dependency-cruiser.cjs` `server-no-ui-widgets-charts`). Routes solve this
+ * by having the app-wiring layer inject them (`LlmRoutesDeps.allowed`); the CLI
+ * has no wiring layer above it, so it reads them as DATA at runtime. Every
+ * specifier below is computed, so no static import edge exists for the rule to
+ * catch and none is created — the ban is about the compiled import graph, and
+ * this respects it.
+ *
+ * THE CANDIDATE ORDER IS THE WHOLE POINT. `@adminium/widgets` is not a
+ * dependency of `@adminium/server` and cannot become one: it is `private: true`,
+ * so it can never be published, and `pnpm deploy --filter=@adminium/server
+ * --prod` (the Dockerfile) injects only declared workspace deps. Probing
+ * node_modules or a monorepo `packages/` path therefore finds NOTHING in any
+ * deployed artifact — the image and the tarball both — and both LLM subcommands
+ * died there with a "run `pnpm --filter @adminium/widgets build`" hint that a
+ * container or npm user cannot act on. So the build SNAPSHOTS the two lists into
+ * the package itself (`scripts/bundle-allowlists.mjs`, run at `prepack` beside
+ * the dashboard bundling) and that snapshot is probed FIRST. The dist paths
+ * remain as the dev-checkout fallback, where they do work and where nobody
+ * should have to run a bundling step to use the CLI.
+ */
+import type { AllowedVocabularies } from '@adminium/llm';
+/**
+ * The build-emitted snapshot inside the published package. Kept next to the
+ * resolver so `scripts/bundle-allowlists.mjs` and this lookup share one path.
+ */
+export declare const BUNDLED_VOCABULARY_FILE: string;
+/**
+ * Candidate allow-list sources, in precedence order. Exported for the test — the
+ * point of the resolver is the ORDER, and asserting on it beats asserting on
+ * whichever candidate happens to exist on the machine running the suite.
+ */
+export declare function allowlistCandidates(moduleUrl?: string): string[];
+/**
+ * Load the allow-lists. Throws a {@link CliError} when no candidate resolves —
+ * in a shipped artifact that means the `prepack` bundling step did not run,
+ * which is a packaging bug; in a dev tree it means the widgets dist is unbuilt.
+ * The hint names both, because the message has to be actionable for whichever
+ * of the two the reader is holding.
+ */
+export declare function loadAllowedVocabularies(moduleUrl?: string): Promise<AllowedVocabularies>;
+//# sourceMappingURL=allowlist.d.ts.map

package/dist/cli/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../../src/cli/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAOzD;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAA2C,CAAC;AAMhF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,GAAE,MAAwB,GAAG,MAAM,EAAE,CAWjF;AA2BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,GAAE,MAAwB,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAW9B"}

package/dist/cli/allowlist.js

@@ -0,0 +1,99 @@
+/**
+ * LLM allowed-vocabulary loading for the CLI.
+ *
+ * `LLM_ALLOWED_TEMPLATES` / `LLM_ALLOWED_WIDGETS` live in `@adminium/widgets`,
+ * which **the server tree may never import** (01-architecture.md §2.3, enforced
+ * by `.dependency-cruiser.cjs` `server-no-ui-widgets-charts`). Routes solve this
+ * by having the app-wiring layer inject them (`LlmRoutesDeps.allowed`); the CLI
+ * has no wiring layer above it, so it reads them as DATA at runtime. Every
+ * specifier below is computed, so no static import edge exists for the rule to
+ * catch and none is created — the ban is about the compiled import graph, and
+ * this respects it.
+ *
+ * THE CANDIDATE ORDER IS THE WHOLE POINT. `@adminium/widgets` is not a
+ * dependency of `@adminium/server` and cannot become one: it is `private: true`,
+ * so it can never be published, and `pnpm deploy --filter=@adminium/server
+ * --prod` (the Dockerfile) injects only declared workspace deps. Probing
+ * node_modules or a monorepo `packages/` path therefore finds NOTHING in any
+ * deployed artifact — the image and the tarball both — and both LLM subcommands
+ * died there with a "run `pnpm --filter @adminium/widgets build`" hint that a
+ * container or npm user cannot act on. So the build SNAPSHOTS the two lists into
+ * the package itself (`scripts/bundle-allowlists.mjs`, run at `prepack` beside
+ * the dashboard bundling) and that snapshot is probed FIRST. The dist paths
+ * remain as the dev-checkout fallback, where they do work and where nobody
+ * should have to run a bundling step to use the CLI.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { CliError } from './exit.js';
+/** Path inside the widgets package that exports the two allow-lists. */
+const ALLOWLIST_SUBPATH = join('dist', 'registry', 'llm-allowlist.js');
+/**
+ * The build-emitted snapshot inside the published package. Kept next to the
+ * resolver so `scripts/bundle-allowlists.mjs` and this lookup share one path.
+ */
+export const BUNDLED_VOCABULARY_FILE = join('vocabulary', 'llm-allowlist.json');
+function packageRoot(moduleUrl) {
+    return resolve(dirname(fileURLToPath(moduleUrl)), '..', '..');
+}
+/**
+ * Candidate allow-list sources, in precedence order. Exported for the test — the
+ * point of the resolver is the ORDER, and asserting on it beats asserting on
+ * whichever candidate happens to exist on the machine running the suite.
+ */
+export function allowlistCandidates(moduleUrl = import.meta.url) {
+    const root = packageRoot(moduleUrl);
+    return [
+        // Published/deployed: the JSON snapshot this package carries. FIRST, because
+        // it is the only one that exists in the Docker image or an npm install.
+        join(root, BUNDLED_VOCABULARY_FILE),
+        // Dev checkout: apps/server/../../packages/widgets/… (what demo-v01.mjs uses).
+        join(root, '..', '..', 'packages', 'widgets', ALLOWLIST_SUBPATH),
+        // A hoisted node_modules layout that happens to expose the package.
+        join(root, 'node_modules', '@adminium', 'widgets', ALLOWLIST_SUBPATH),
+    ].map((candidate) => resolve(candidate));
+}
+/** Read one candidate; `null` when it is absent or does not carry both lists. */
+async function readCandidate(candidate) {
+    if (!existsSync(candidate))
+        return null;
+    let mod;
+    if (candidate.endsWith('.json')) {
+        try {
+            mod = JSON.parse(readFileSync(candidate, 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    }
+    else {
+        // Computed specifier: a file URL, never a package name — no static edge.
+        mod = (await import(pathToFileURL(candidate).href));
+    }
+    const templates = mod.LLM_ALLOWED_TEMPLATES;
+    const widgets = mod.LLM_ALLOWED_WIDGETS;
+    if (templates === undefined || widgets === undefined)
+        return null;
+    return { templates, widgets };
+}
+/**
+ * Load the allow-lists. Throws a {@link CliError} when no candidate resolves —
+ * in a shipped artifact that means the `prepack` bundling step did not run,
+ * which is a packaging bug; in a dev tree it means the widgets dist is unbuilt.
+ * The hint names both, because the message has to be actionable for whichever
+ * of the two the reader is holding.
+ */
+export async function loadAllowedVocabularies(moduleUrl = import.meta.url) {
+    for (const candidate of allowlistCandidates(moduleUrl)) {
+        const loaded = await readCandidate(candidate);
+        if (loaded !== null)
+            return loaded;
+    }
+    throw new CliError('The widget vocabulary is missing, so no AI prompt can be built.', {
+        hint: 'In a source checkout, build it: `pnpm --filter @adminium/widgets build`.\n' +
+            'In a released build this is a packaging bug — please report it, quoting your ' +
+            '`adminium --version`.',
+    });
+}
+//# sourceMappingURL=allowlist.js.map

package/dist/cli/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../src/cli/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIxD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AAEhF,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,MAAM,CAAC,IAAI,CAAC,GAAG;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,OAAO;QACL,6EAA6E;QAC7E,wEAAwE;QACxE,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACnC,+EAA+E;QAC/E,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,CAAC;QAChE,oEAAoE;QACpE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC;KACtE,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3C,CAAC;AAOD,iFAAiF;AACjF,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAoB,CAAC;IACzB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAoB,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAoB,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACxC,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,MAAM,CAAC,IAAI,CAAC,GAAG;IAEnC,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,iEAAiE,EAAE;QACpF,IAAI,EACF,4EAA4E;YAC5E,+EAA+E;YAC/E,uBAAuB;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/args.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Argument parsing for the `adminium` CLI (01-architecture.md §4.1).
+ *
+ * WHY NO CLI FRAMEWORK. `npx adminium` is advertised as "a complete install"
+ * — the published tarball already carries the server, the dashboard build, and
+ * the meta migrations, so every extra runtime dependency is weight on the very
+ * first thing a new user does. Node 22's built-in `node:util` `parseArgs`
+ * covers the whole surface this CLI needs (long flags, `--flag=value`, short
+ * aliases, repeatables, `--` passthrough, strict unknown-flag rejection) at
+ * zero dependencies, and Zod — already a dependency, already the house rule for
+ * external input — does the typing and coercion `parseArgs` deliberately omits.
+ * A framework would buy help-text formatting we want to control anyway.
+ *
+ * The shape below is deliberately declarative: a command's flags are data, so
+ * `--help` renders from the same spec the parser enforces and the two cannot
+ * drift.
+ */
+export type FlagType = 'string' | 'boolean';
+export interface FlagSpec {
+    type: FlagType;
+    /** Single-character alias, e.g. `-p` for `--port`. */
+    short?: string;
+    /** Repeatable → the parsed value is an array (`--sections a --sections b`). */
+    multiple?: boolean;
+    /** Rendered in `--help`. */
+    describe: string;
+    /** Placeholder for the value in `--help`, e.g. `<id>`; string flags only. */
+    placeholder?: string;
+    /** Shown in `--help` as `(default: …)`. Documentation only — commands own defaults. */
+    defaultDescription?: string;
+}
+export type FlagSpecs = Readonly<Record<string, FlagSpec>>;
+/** What `parseArgs` hands back, before a command's Zod schema refines it. */
+export interface ParsedArgs {
+    /** Flag values keyed by the long flag name (no leading `--`). */
+    values: Record<string, string | boolean | string[] | undefined>;
+    /** Non-flag operands, in order. */
+    positionals: string[];
+}
+/**
+ * Parse `argv` against `specs`. Unknown flags are rejected (strict) and
+ * re-thrown as a {@link CliUsageError} so the dispatcher can print help rather
+ * than a raw Node error — `parseArgs`'s own message is good but its stack is not
+ * something a user should ever see.
+ */
+export declare function parseFlags(argv: readonly string[], specs: FlagSpecs, command?: string | null): ParsedArgs;
+/**
+ * Split a repeatable-or-CSV flag into items. 06-llm-assist.md §10.4 writes
+ * `--sections labels,enums,…` and `--locales en_US,de_DE`; supporting the
+ * repeated form too costs nothing and is what people reflexively try.
+ * `--sections a,b --sections c` → `['a','b','c']`.
+ */
+export declare function splitList(value: string | boolean | string[] | undefined): string[];
+/** A string flag's value, or `undefined`. Repeated flags take the LAST value. */
+export declare function stringFlag(value: string | boolean | string[] | undefined): string | undefined;
+/** A boolean flag's presence. */
+export declare function boolFlag(value: string | boolean | string[] | undefined): boolean;
+/**
+ * A numeric flag, validated. `--port banana` must say so in one line rather
+ * than surface later as `NaN` from `app.listen`.
+ */
+export declare function numberFlag(value: string | boolean | string[] | undefined, flagName: string, command?: string | null): number | undefined;
+//# sourceMappingURL=args.d.ts.map

package/dist/cli/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAChE,mCAAmC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAeD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,MAAM,GAAG,IAAW,GAAG,UAAU,CAa/G;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAOlF;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG7F;AAED,iCAAiC;AACjC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,EAC9C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,MAAM,GAAG,IAAW,GAC5B,MAAM,GAAG,SAAS,CAQpB"}