@adminiumjs/adminium 0.1.0-rc.1

package/dist/cli/runtime.d.ts

@@ -0,0 +1,116 @@
+/**
+ * The CLI's composition root.
+ *
+ * THE GOVERNING RULE (16-milestones.md, M10 risk register): "CLI subcommands
+ * share the same server services as the Studio routes; **one code path, two
+ * front doors**." This module is where that is made true — it builds the exact
+ * service graph `scripts/demo-v01.mjs` and the route wiring build
+ * (`ConnectionManager`, `runIntrospection`, `runGeneration`, the run/apply/prompt
+ * services), and the subcommands consume nothing else. A command that reached
+ * past this into its own query or its own HTTP call would be the drift the risk
+ * register warns about.
+ *
+ * Everything is injectable ({@link CliDeps}) so the subcommand tests drive the
+ * dispatcher against fakes: no meta store, no source database, no listening
+ * socket.
+ */
+import type { AllowedVocabularies } from '@adminium/llm';
+import type { AdminiumServer } from '../app.js';
+import { type Env } from '../config/env.js';
+import { ConnectionManager } from '../connections/manager.js';
+import { type ImportZip } from '../export/import-service.js';
+import { type ExportZip } from '../export/zip-service.js';
+import { type ApplyService } from '../llm/apply-service.js';
+import { type PromptService } from '../llm/prompt-service.js';
+import { type RunService } from '../llm/run-service.js';
+import type { CollectRunStats } from '../llm/prompt-service.js';
+import { type MetaStoreHandle } from '../meta/store.js';
+/**
+ * Flag overrides applied ON TOP of the process environment. 01 §7.1 makes env
+ * the configuration substrate; the CLI's contract is that an explicit flag beats
+ * an inherited variable, so they are merged BEFORE the Zod schema runs and the
+ * result is validated exactly once, by exactly the existing schema.
+ */
+export interface EnvOverrides {
+    port?: number | undefined;
+    host?: string | undefined;
+    dataDir?: string | undefined;
+    metaUrl?: string | undefined;
+    logLevel?: string | undefined;
+}
+/**
+ * Merge overrides into `env` and validate through the existing
+ * {@link envSchema}. A missing/short `ADMINIUM_SECRET` is called out on its own
+ * because it gates the AES-256-GCM helper that every stored DSN and provider key
+ * depends on — booting without it would mean a store that cannot be read back.
+ */
+export declare function loadCliEnv(env: Record<string, string | undefined>, overrides?: EnvOverrides): Env;
+export interface CliRuntime {
+    env: Env;
+    metaStore: MetaStoreHandle;
+    manager: ConnectionManager;
+    runService: RunService;
+    applyService: ApplyService;
+    /** Present only when the widgets allow-lists could be loaded (LLM commands). */
+    promptService: PromptService | null;
+    /** The `@adminium/widgets` allow-lists backing {@link promptService}. */
+    allowed: AllowedVocabularies | null;
+    /** Why {@link promptService} is null, for the command's error message. */
+    promptServiceError: Error | null;
+    /** §4.2 aggregates over the connection's data role — what `--sampling` needs. */
+    collectStats: CollectRunStats;
+    close(): Promise<void>;
+}
+export interface OpenRuntimeOptions {
+    /** Loopback DSNs are legitimate for a local self-host install (demo-v01 does this). */
+    blockLoopback?: boolean;
+}
+/**
+ * Open the meta store and compose the services. Does NOT bootstrap — `migrate`
+ * owns that explicitly, and `start`/`init` call `firstRun` deliberately.
+ *
+ * The widgets allow-lists are loaded UNCONDITIONALLY (they used to be gated on a
+ * `withLlm` flag only the two LLM subcommands passed). `startServer` needs them
+ * to register the `/llm` resource, so gating them on the subcommand meant
+ * `adminium start` — the actual product — could never serve AI assist, failing
+ * M10's "LLM assist available (creds or BYO)" exit criterion. The load is one
+ * `existsSync` plus one dynamic import, and a failure is recorded rather than
+ * thrown: the LLM subcommands surface it, `start` degrades to no `/llm` routes.
+ */
+export declare function openRuntime(env: Env, opts?: OpenRuntimeOptions): Promise<CliRuntime>;
+export interface StartedServer {
+    /** The URL to open — what `start` and the wizard print. */
+    url: string;
+    app: AdminiumServer;
+    close(): Promise<void>;
+}
+/** Boot + listen. Injected ({@link CliDeps.startServer}) so tests never bind a port. */
+export type StartServer = (runtime: CliRuntime) => Promise<StartedServer>;
+/** Loopback and 0.0.0.0 are not clickable — print something a browser can open. */
+export declare function displayUrl(host: string, port: number): string;
+/**
+ * The real boot: the shared composition root (`../compose.ts`) plus `listen`.
+ *
+ * It used to be `buildServer` alone, which is only the Fastify SKELETON — six of
+ * the seventeen `/api/v1` namespaces the dashboard calls. `adminium start`,
+ * `adminium init`'s final boot and the Docker CMD therefore all served an API
+ * whose connect wizard 404'd; the full wiring existed only inside
+ * `scripts/demo-v01.mjs`. `composeServer` is that wiring, moved somewhere the
+ * shipped artifact actually reaches (01 §4: "All four deployment modes run the
+ * identical `@adminium/server` process; only the wrapper differs").
+ */
+export declare const startServer: StartServer;
+export interface CliDeps {
+    env: Record<string, string | undefined>;
+    cwd: string;
+    /** Opens the shared service graph. */
+    openRuntime: (env: Env, opts?: OpenRuntimeOptions) => Promise<CliRuntime>;
+    /** Boots + listens. */
+    startServer: StartServer;
+    /** M10-T03's bundler. */
+    exportZip: ExportZip;
+    /** M10-T03's restore path — the same service a Studio upload route would call. */
+    importZip: ImportZip;
+}
+export declare function defaultCliDeps(): CliDeps;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/cli/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/cli/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAkC,KAAK,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAG9D,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEzF,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAOvE;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,SAAS,GAAE,YAAiB,GAC3B,GAAG,CAyBL;AAID,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,GAAG,CAAC;IACT,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,gFAAgF;IAChF,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,yEAAyE;IACzE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACpC,0EAA0E;IAC1E,kBAAkB,EAAE,KAAK,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,YAAY,EAAE,eAAe,CAAC;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC,CA+D9F;AAID,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wFAAwF;AACxF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAE1E,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,EAAE,WAqBzB,CAAC;AAIF,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,uBAAuB;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,yBAAyB;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,kFAAkF;IAClF,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,wBAAgB,cAAc,IAAI,OAAO,CASxC"}

package/dist/cli/runtime.js

@@ -0,0 +1,181 @@
+/**
+ * The CLI's composition root.
+ *
+ * THE GOVERNING RULE (16-milestones.md, M10 risk register): "CLI subcommands
+ * share the same server services as the Studio routes; **one code path, two
+ * front doors**." This module is where that is made true — it builds the exact
+ * service graph `scripts/demo-v01.mjs` and the route wiring build
+ * (`ConnectionManager`, `runIntrospection`, `runGeneration`, the run/apply/prompt
+ * services), and the subcommands consume nothing else. A command that reached
+ * past this into its own query or its own HTTP call would be the drift the risk
+ * register warns about.
+ *
+ * Everything is injectable ({@link CliDeps}) so the subcommand tests drive the
+ * dispatcher against fakes: no meta store, no source database, no listening
+ * socket.
+ */
+import { adapterRegistry } from '@adminium/engine/adapter';
+import { composeServer } from '../compose.js';
+import { envSchema, formatEnvErrorTable } from '../config/env.js';
+import { ConnectionManager } from '../connections/manager.js';
+import { dsnCryptoFromSecret } from '../connections/crypto.js';
+import { registerAdapters } from '../connections/register-adapters.js';
+import { importZip as defaultImportZip } from '../export/import-service.js';
+import { exportZip as defaultExportZip } from '../export/zip-service.js';
+import { runGeneration } from '../generate/run.js';
+import { createApplyService } from '../llm/apply-service.js';
+import { createPromptService } from '../llm/prompt-service.js';
+import { createRunService } from '../llm/run-service.js';
+import { createConnectionStatsCollector } from '../llm/stats-collector.js';
+import { openMetaStore } from '../meta/store.js';
+import { loadAllowedVocabularies } from './allowlist.js';
+import { CliError } from './exit.js';
+import { resolveStaticRoot } from './static-root.js';
+/**
+ * Merge overrides into `env` and validate through the existing
+ * {@link envSchema}. A missing/short `ADMINIUM_SECRET` is called out on its own
+ * because it gates the AES-256-GCM helper that every stored DSN and provider key
+ * depends on — booting without it would mean a store that cannot be read back.
+ */
+export function loadCliEnv(env, overrides = {}) {
+    const merged = {
+        ...env,
+        ...(overrides.port === undefined ? {} : { PORT: String(overrides.port) }),
+        ...(overrides.host === undefined ? {} : { HOST: overrides.host }),
+        ...(overrides.dataDir === undefined ? {} : { ADMINIUM_DATA_DIR: overrides.dataDir }),
+        ...(overrides.metaUrl === undefined ? {} : { ADMINIUM_META_URL: overrides.metaUrl }),
+        ...(overrides.logLevel === undefined ? {} : { ADMINIUM_LOG_LEVEL: overrides.logLevel }),
+    };
+    const result = envSchema.safeParse(merged);
+    if (result.success)
+        return result.data;
+    const secretIssue = result.error.issues.some((issue) => issue.path[0] === 'ADMINIUM_SECRET');
+    const table = formatEnvErrorTable(result.error.issues);
+    throw new CliError(secretIssue
+        ? 'ADMINIUM_SECRET is required — it derives the key that encrypts every stored DSN and API key.'
+        : 'Invalid environment configuration.', {
+        hint: secretIssue
+            ? 'Generate one and re-run, e.g.\n  export ADMINIUM_SECRET=$(openssl rand -hex 32)\n\n' + table
+            : table,
+    });
+}
+/**
+ * Open the meta store and compose the services. Does NOT bootstrap — `migrate`
+ * owns that explicitly, and `start`/`init` call `firstRun` deliberately.
+ *
+ * The widgets allow-lists are loaded UNCONDITIONALLY (they used to be gated on a
+ * `withLlm` flag only the two LLM subcommands passed). `startServer` needs them
+ * to register the `/llm` resource, so gating them on the subcommand meant
+ * `adminium start` — the actual product — could never serve AI assist, failing
+ * M10's "LLM assist available (creds or BYO)" exit criterion. The load is one
+ * `existsSync` plus one dynamic import, and a failure is recorded rather than
+ * thrown: the LLM subcommands surface it, `start` degrades to no `/llm` routes.
+ */
+export async function openRuntime(env, opts = {}) {
+    const metaStore = await openMetaStore({
+        metaUrl: env.ADMINIUM_META_URL,
+        dataDir: env.ADMINIUM_DATA_DIR,
+        secret: env.ADMINIUM_SECRET,
+    });
+    await registerAdapters(adapterRegistry);
+    const manager = new ConnectionManager({
+        meta: metaStore.meta,
+        crypto: dsnCryptoFromSecret(env.ADMINIUM_SECRET),
+        // The embedded fallback has no DSN to collide with (01 §3.1).
+        metaDsn: metaStore.source === 'embedded' ? null : metaStore.url,
+        ...(opts.blockLoopback === undefined ? {} : { blockLoopback: opts.blockLoopback }),
+    });
+    const runService = createRunService({ meta: metaStore.meta });
+    const applyService = createApplyService({
+        meta: metaStore.meta,
+        runService,
+        // §8.3 step 3 — the real runGeneration-backed hook (both front doors share
+        // this service graph): pages pick up the freshly applied overrides, and the
+        // apply's `origin: 'llm'` seed rows are expanded into envelopes
+        // (generate/materialize-llm.ts). Failures propagate to the caller AFTER the
+        // apply is durable — applyRun fires the hook post-commit by design.
+        regenerate: async ({ connectionId, appliedBy }) => {
+            await runGeneration({ manager, meta: metaStore.meta, connectionId, createdBy: appliedBy });
+        },
+    });
+    // The real §4.2 collector, not the `NO_STATS` default: `generate-prompt
+    // --sampling` promises "sampled example values in the prompt" in its own
+    // `--help`, and the prompt service silently omits every aggregate when nobody
+    // injects one. Both front doors now inject the same collector (see
+    // `startServer` below, which passes it to `composeServer`).
+    const collectStats = createConnectionStatsCollector({ manager });
+    let promptService = null;
+    let allowed = null;
+    let promptServiceError = null;
+    try {
+        allowed = await loadAllowedVocabularies();
+        promptService = createPromptService({ meta: metaStore.meta, runService, allowed, collectStats });
+    }
+    catch (error) {
+        promptServiceError = error instanceof Error ? error : new Error(String(error));
+    }
+    return {
+        env,
+        metaStore,
+        manager,
+        runService,
+        applyService,
+        promptService,
+        allowed,
+        promptServiceError,
+        collectStats,
+        async close() {
+            await manager.disposeAll().catch(() => undefined);
+            await metaStore.close();
+        },
+    };
+}
+/** Loopback and 0.0.0.0 are not clickable — print something a browser can open. */
+export function displayUrl(host, port) {
+    const hostname = host === '0.0.0.0' || host === '::' ? 'localhost' : host;
+    return `http://${hostname}:${String(port)}`;
+}
+/**
+ * The real boot: the shared composition root (`../compose.ts`) plus `listen`.
+ *
+ * It used to be `buildServer` alone, which is only the Fastify SKELETON — six of
+ * the seventeen `/api/v1` namespaces the dashboard calls. `adminium start`,
+ * `adminium init`'s final boot and the Docker CMD therefore all served an API
+ * whose connect wizard 404'd; the full wiring existed only inside
+ * `scripts/demo-v01.mjs`. `composeServer` is that wiring, moved somewhere the
+ * shipped artifact actually reaches (01 §4: "All four deployment modes run the
+ * identical `@adminium/server` process; only the wrapper differs").
+ */
+export const startServer = async (runtime) => {
+    const { env } = runtime;
+    const staticRoot = resolveStaticRoot();
+    const { app } = await composeServer({
+        env,
+        metaStore: runtime.metaStore,
+        manager: runtime.manager,
+        runService: runtime.runService,
+        applyService: runtime.applyService,
+        allowed: runtime.allowed,
+        collectStats: runtime.collectStats,
+        ...(staticRoot === undefined ? {} : { staticRoot }),
+    });
+    await app.listen({ port: env.PORT, host: env.HOST });
+    return {
+        url: displayUrl(env.HOST, env.PORT),
+        app,
+        async close() {
+            await app.close();
+        },
+    };
+};
+export function defaultCliDeps() {
+    return {
+        env: process.env,
+        cwd: process.cwd(),
+        openRuntime,
+        startServer,
+        exportZip: defaultExportZip,
+        importZip: defaultImportZip,
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/cli/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/cli/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAY,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAkB,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,SAAS,IAAI,gBAAgB,EAAkB,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAqB,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAsB,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAE3E,OAAO,EAAE,aAAa,EAAwB,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAkBrD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,GAAuC,EACvC,YAA0B,EAAE;IAE5B,MAAM,MAAM,GAAuC;QACjD,GAAG,GAAG;QACN,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACpF,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACpF,GAAG,CAAC,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;KACxF,CAAC;IAEF,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,QAAQ,CAChB,WAAW;QACT,CAAC,CAAC,8FAA8F;QAChG,CAAC,CAAC,oCAAoC,EACxC;QACE,IAAI,EAAE,WAAW;YACf,CAAC,CAAC,qFAAqF,GAAG,KAAK;YAC/F,CAAC,CAAC,KAAK;KACV,CACF,CAAC;AACJ,CAAC;AA0BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,OAA2B,EAAE;IACvE,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC;QACpC,OAAO,EAAE,GAAG,CAAC,iBAAiB;QAC9B,OAAO,EAAE,GAAG,CAAC,iBAAiB;QAC9B,MAAM,EAAE,GAAG,CAAC,eAAe;KAC5B,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAExC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC;QAChD,8DAA8D;QAC9D,OAAO,EAAE,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;QAC/D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,UAAU;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,gEAAgE;QAChE,4EAA4E;QAC5E,oEAAoE;QACpE,UAAU,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE;YAChD,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC,CAAC;IAEH,wEAAwE;IACxE,yEAAyE;IACzE,8EAA8E;IAC9E,mEAAmE;IACnE,4DAA4D;IAC5D,MAAM,YAAY,GAAG,8BAA8B,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAEjE,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,OAAO,GAA+B,IAAI,CAAC;IAC/C,IAAI,kBAAkB,GAAiB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,uBAAuB,EAAE,CAAC;QAC1C,aAAa,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO;QACL,GAAG;QACH,SAAS;QACT,OAAO;QACP,UAAU;QACV,YAAY;QACZ,aAAa;QACb,OAAO;QACP,kBAAkB;QAClB,YAAY;QACZ,KAAK,CAAC,KAAK;YACT,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO,UAAU,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB,KAAK,EAAE,OAAO,EAAE,EAAE;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC;QAClC,GAAG;QACH,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QACnC,GAAG;QACH,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAiBF,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,WAAW;QACX,WAAW;QACX,SAAS,EAAE,gBAAgB;QAC3B,SAAS,EAAE,gBAAgB;KAC5B,CAAC;AACJ,CAAC"}

package/dist/cli/static-root.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Locating the dashboard build (01-architecture.md §4.1: the published package
+ * "bundles the server, the dashboard `dist/`, and the meta migrations").
+ *
+ * `buildServer({ staticRoot })` wants a directory containing `index.html`; the
+ * static plugin no-ops cleanly when the directory is absent, so a miss here
+ * degrades to an API-only server rather than a crash — the same contract
+ * `scripts/demo-v01.mjs` relies on.
+ *
+ * Two layouts must both work, hence the candidate list:
+ *  - **published tarball** — `<package>/dashboard/` (the `files` allow-list ships
+ *    it; `scripts/bundle-dashboard.mjs` copies it in at build time),
+ *  - **monorepo checkout** — `<repo>/apps/dashboard/dist/`, exactly where
+ *    demo-v01.mjs looks, so `pnpm --filter @adminium/server exec …` works from a
+ *    dev tree with no extra step.
+ */
+/**
+ * Directory name the dashboard build is bundled under inside the published
+ * package. Kept next to the resolver so the bundling script and the runtime
+ * lookup share one constant.
+ */
+export declare const BUNDLED_DASHBOARD_DIR = "dashboard";
+export interface ResolveStaticRootOptions {
+    /** Explicit override (`--static-root`, `ADMINIUM_STATIC_ROOT`) — wins outright. */
+    override?: string | undefined;
+    /** Test seam; defaults to this module's own location. */
+    moduleUrl?: string;
+    /** Test seam. */
+    exists?: (path: string) => boolean;
+}
+/**
+ * The candidate directories, in precedence order. Exported for the test — the
+ * point of the resolver is the ORDER, and asserting on it beats asserting on
+ * whichever candidate happens to exist on the machine running the suite.
+ */
+export declare function staticRootCandidates(opts?: ResolveStaticRootOptions): string[];
+/**
+ * First candidate that actually holds an `index.html`, else `undefined` (→ the
+ * static plugin serves nothing and the API still boots).
+ */
+export declare function resolveStaticRoot(opts?: ResolveStaticRootOptions): string | undefined;
+//# sourceMappingURL=static-root.d.ts.map

package/dist/cli/static-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-root.d.ts","sourceRoot":"","sources":["../../src/cli/static-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAOjD,MAAM,WAAW,wBAAwB;IACvC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,wBAA6B,GAAG,MAAM,EAAE,CASlF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,MAAM,GAAG,SAAS,CAMzF"}

package/dist/cli/static-root.js

@@ -0,0 +1,58 @@
+/**
+ * Locating the dashboard build (01-architecture.md §4.1: the published package
+ * "bundles the server, the dashboard `dist/`, and the meta migrations").
+ *
+ * `buildServer({ staticRoot })` wants a directory containing `index.html`; the
+ * static plugin no-ops cleanly when the directory is absent, so a miss here
+ * degrades to an API-only server rather than a crash — the same contract
+ * `scripts/demo-v01.mjs` relies on.
+ *
+ * Two layouts must both work, hence the candidate list:
+ *  - **published tarball** — `<package>/dashboard/` (the `files` allow-list ships
+ *    it; `scripts/bundle-dashboard.mjs` copies it in at build time),
+ *  - **monorepo checkout** — `<repo>/apps/dashboard/dist/`, exactly where
+ *    demo-v01.mjs looks, so `pnpm --filter @adminium/server exec …` works from a
+ *    dev tree with no extra step.
+ */
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Directory name the dashboard build is bundled under inside the published
+ * package. Kept next to the resolver so the bundling script and the runtime
+ * lookup share one constant.
+ */
+export const BUNDLED_DASHBOARD_DIR = 'dashboard';
+/** The package root — `dist/cli/…` and `src/cli/…` are both two levels down. */
+function packageRoot(moduleUrl) {
+    return resolve(dirname(fileURLToPath(moduleUrl)), '..', '..');
+}
+/**
+ * The candidate directories, in precedence order. Exported for the test — the
+ * point of the resolver is the ORDER, and asserting on it beats asserting on
+ * whichever candidate happens to exist on the machine running the suite.
+ */
+export function staticRootCandidates(opts = {}) {
+    const root = packageRoot(opts.moduleUrl ?? import.meta.url);
+    const candidates = [];
+    if (opts.override !== undefined && opts.override !== '')
+        candidates.push(resolve(opts.override));
+    // Published tarball: apps/server/dashboard/.
+    candidates.push(join(root, BUNDLED_DASHBOARD_DIR));
+    // Monorepo checkout: apps/server/../dashboard/dist.
+    candidates.push(join(root, '..', 'dashboard', 'dist'));
+    return candidates.map((candidate) => resolve(candidate));
+}
+/**
+ * First candidate that actually holds an `index.html`, else `undefined` (→ the
+ * static plugin serves nothing and the API still boots).
+ */
+export function resolveStaticRoot(opts = {}) {
+    const exists = opts.exists ?? existsSync;
+    for (const candidate of staticRootCandidates(opts)) {
+        if (exists(join(candidate, 'index.html')))
+            return candidate;
+    }
+    return undefined;
+}
+//# sourceMappingURL=static-root.js.map

package/dist/cli/static-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-root.js","sourceRoot":"","sources":["../../src/cli/static-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD,gFAAgF;AAChF,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAiC,EAAE;IACtE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,6CAA6C;IAC7C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACnD,oDAAoD;IACpD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/compose.d.ts

@@ -0,0 +1,135 @@
+/**
+ * THE COMPOSITION ROOT (01-architecture.md §4: "All four deployment modes run
+ * the identical `@adminium/server` process; only the wrapper differs").
+ *
+ * `buildServer` is the Fastify *skeleton* — logger, error envelope, auth, static,
+ * and the handful of resources that need no injected services (system/auth/me/
+ * bootstrap/setup/about). Every other resource is a FACTORY over injected
+ * services (`connectionsRoutes({ manager, meta })`, `llmRoutes({ … })`, …),
+ * because 01 §2.3 forbids the route tree from reaching out and constructing a
+ * `ConnectionManager` or importing `@adminium/widgets` on its own. Somebody has
+ * to do that construction. This module is that somebody, and it is the ONLY one.
+ *
+ * WHY IT EXISTS. It used to be `scripts/demo-v01.mjs` — a demo script — which
+ * meant `adminium start`, `adminium init`'s final boot and the Docker CMD all
+ * served a hollow API: the SPA loaded, setup created the super admin, and then
+ * the connect wizard's `POST /api/v1/connections` 404'd, because the plugin that
+ * answers it was only ever registered by a script nobody runs in production. The
+ * dashboard calls 17 `/api/v1` namespaces; the skeleton serves 6. This module
+ * closes that gap so the M10 exit criterion — "`npx adminium` (or `docker run`)
+ * on a clean machine → first-run wizard → create super admin → connect any of the
+ * 3 engines → generated app" — is met by the shipped artifact and not only by a
+ * script in the repo.
+ *
+ * DEGRADATION. The LLM surface is the one optional part: `LLM_ALLOWED_TEMPLATES`
+ * / `LLM_ALLOWED_WIDGETS` come from `@adminium/widgets` (01 §2.3: the server tree
+ * may not import it), loaded by file path at runtime. When that load fails the
+ * `/llm` routes are skipped and everything else boots — the demo script's
+ * behavior, kept, because a missing AI vocabulary must not cost you your CRUD.
+ */
+import { type AllowedVocabularies } from '@adminium/llm';
+import { type AdminiumServer } from './app.js';
+import type { Env } from './config/env.js';
+import type { ConnectionManager } from './connections/manager.js';
+import { type JobsAndRealtime } from './jobs/register.js';
+import type { ApplyService } from './llm/apply-service.js';
+import type { CollectRunStats } from './llm/prompt-service.js';
+import type { RunService } from './llm/run-service.js';
+import { type MetaStoreHandle } from './meta/store.js';
+/**
+ * Daily, at 04:00 UTC, with an hour of jitter (below). Telemetry is the least
+ * urgent thing this process does; a daily ping is what the payload documents
+ * (`telemetry/payload.ts`) and nothing downstream reads it sooner. Runs on the
+ * existing croner scheduler rather than a `setInterval`, per BRIEF §3 (no
+ * external scheduler, and no second timing mechanism either).
+ */
+export declare const TELEMETRY_SCHEDULE_NAME = "telemetry-ping";
+export declare const TELEMETRY_CRON = "0 4 * * *";
+/** De-synchronize a fleet so a self-host cohort does not ping in lockstep. */
+export declare const TELEMETRY_JITTER_MS: number;
+/**
+ * Daily export-retention sweep (M7-T07): flips `ready` → `expired` on
+ * `adminium_exports` rows past `expires_at`, then GCs the expired artifacts'
+ * BYTES (`filesRepo.markDeleted` + `storage.remove`) so a snapshot never
+ * outlives the "kept for 30 days, then expire" promise on disk. Offset from
+ * the telemetry ping so the two dailies never contend.
+ */
+export declare const EXPORTS_RETENTION_SCHEDULE_NAME = "exports-retention-sweep";
+export declare const EXPORTS_RETENTION_CRON = "30 4 * * *";
+export interface ComposeServerOptions {
+    env: Env;
+    /** The opened meta store — `meta` for the services, `url` for §3.1 checks. */
+    metaStore: MetaStoreHandle;
+    /** The shared source-database connection pool/registry (01 §3). */
+    manager: ConnectionManager;
+    runService: RunService;
+    applyService: ApplyService;
+    /**
+     * The `@adminium/widgets` allow-lists. `null` ⇒ the `/llm` resource is skipped
+     * (see the module header) — everything else is registered regardless.
+     */
+    allowed: AllowedVocabularies | null;
+    /** §4.2 statistics collector for the prompt builder. */
+    collectStats?: CollectRunStats | undefined;
+    /** Dashboard build directory; omitted ⇒ API only. */
+    staticRoot?: string | undefined;
+    /** Passed through to {@link buildServer} (tests silence it with `false`). */
+    logger?: boolean | undefined;
+    /** Report telemetry on the scheduler. Default true; tests turn it off. */
+    telemetry?: boolean | undefined;
+}
+export interface ComposedServer {
+    app: AdminiumServer;
+    /** The jobs/realtime handle — hub, worker, scheduler (see `jobs/register.ts`). */
+    jobs: JobsAndRealtime;
+    /** True when the `/llm` resource was registered (i.e. `allowed` was present). */
+    llmEnabled: boolean;
+    /**
+     * True when `POST /auth/desktop-session` was registered (11-electron.md §5).
+     * Reported rather than inferred: whether that route exists is the single most
+     * security-relevant fact about a composed server, and a caller (or a test)
+     * asking "did the boot-token door get opened?" should not have to re-derive
+     * the answer from the same two env vars this module already read.
+     */
+    desktopSessionEnabled: boolean;
+    /**
+     * True when `GET /desktop/lan-share` was registered (11-electron.md §8.3) —
+     * i.e. this is the Electron shell's child. Mirrors
+     * {@link ComposedServer.desktopSessionEnabled} and is reported for the same
+     * reason: which desktop-only doors a composed server opened is a fact a caller
+     * should read rather than re-derive.
+     */
+    desktopLanEnabled: boolean;
+    /**
+     * True when `POST /desktop/local-database` was registered (§6 step 2 card 1).
+     */
+    desktopLocalDbEnabled: boolean;
+    /**
+     * True when `POST /desktop/demo-database` was registered (§6 step 2 card 4) —
+     * i.e. desktop runtime AND a seed script to run. The wizard hides the card
+     * when this is false, which is why the two flags are reported separately
+     * rather than as one "desktop extras" boolean.
+     */
+    desktopDemoEnabled: boolean;
+    /**
+     * True when `POST /desktop/backup` was registered (§9). Reported for the same
+     * reason as its siblings: the shell's BackupCoordinator drives the File menu
+     * and the 03:00 scheduler off this route, so "does the door exist" is a fact a
+     * caller reads rather than re-derives.
+     */
+    desktopBackupEnabled: boolean;
+    /**
+     * True when the §12 capability grant routes were registered. Reported for the
+     * same reason as its siblings: the dashboard's consent/revoke UI and the
+     * main-process `CapabilityHost` both reach `adminium_settings` through this
+     * door, so whether it exists is a fact a caller reads rather than re-derives.
+     */
+    desktopCapabilitiesEnabled: boolean;
+}
+/**
+ * Build the COMPLETE server: skeleton + RBAC + jobs/realtime + every resource
+ * the dashboard calls. Does not listen — the caller decides that (`startServer`
+ * for the CLI, a test's `inject` for the suites).
+ */
+export declare function composeServer(opts: ComposeServerOptions): Promise<ComposedServer>;
+//# sourceMappingURL=compose.d.ts.map

package/dist/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAA0B,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAMnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAkCvD,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AACxD,eAAO,MAAM,cAAc,cAAc,CAAC;AAC1C,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,4BAA4B,CAAC;AACzE,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,8EAA8E;IAC9E,SAAS,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,OAAO,EAAE,iBAAiB,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACpC,wDAAwD;IACxD,YAAY,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IAC3C,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,0EAA0E;IAC1E,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,cAAc,CAAC;IACpB,kFAAkF;IAClF,IAAI,EAAE,eAAe,CAAC;IACtB,iFAAiF;IACjF,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;OAEG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,0BAA0B,EAAE,OAAO,CAAC;CACrC;AAgBD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkTvF"}