@adminiumjs/adminium 0.1.0-rc.1

package/dist/desktop/lan-share.d.ts

@@ -0,0 +1,94 @@
+/**
+ * LAN share, as the SERVER can see it (11-electron.md §8.3, §8.1).
+ *
+ * The desktop shell owns the DECISION — `config.json`'s `lanShare` is main's
+ * file (§2.3), and main is what re-forks this process with `ADMINIUM_HOST=0.0.0.0`
+ * — so nothing here toggles anything. What lives here are the two questions only
+ * a process holding the meta store and its own listening socket can answer:
+ *
+ *  1. {@link lanShareActive} — am I bound wide, or to loopback? §8.1's runtime
+ *     chip needs this, and §8.1 forbids it the obvious source: "The chip is a
+ *     `@adminium/ui` component fed by `GET /api/v1/system/info` + a lightweight
+ *     connection-health poll — **no preload involvement**." So the answer has to
+ *     come off this process's own boot environment.
+ *  2. {@link readLanShareStatus} — who is actually connected, and is there
+ *     anyone but the super admin to connect? Both are meta-store reads, and §1
+ *     principle 2 makes this process the only thing allowed to make them.
+ *
+ * ─── Why the bind address is the honest signal ───────────────────────────────
+ *
+ * `config.lanShare.enabled` is a statement of INTENT that the user can change at
+ * any moment; the bind address is the state of the world. They disagree for a
+ * whole server lifetime whenever the rebind fails or has not happened yet —
+ * exactly the window in which a chip saying "Sharing on LAN" over a
+ * loopback-only server, or the reverse, is a lie with a security consequence.
+ * §2.4 states the invariant in the same terms ("The server binds 127.0.0.1
+ * unless LAN share is on"), so reporting the bind is reporting the promise.
+ */
+import type { MetaDb } from '@adminium/meta';
+import type { Env } from '../config/env.js';
+/** Is `host` a bind-every-interface address? */
+export declare function isWildcardBindHost(host: string): boolean;
+/**
+ * §8.3's toggle, as observed rather than as configured: is THIS process reachable
+ * from the LAN because the desktop shell asked it to be?
+ *
+ * The `desktop` runtime clause is not decoration. Self-host, Docker and `npx
+ * adminium` all default `HOST` to `0.0.0.0` — that is the normal, correct bind
+ * for a server behind a reverse proxy, and it is not "LAN share". §8.3 is a
+ * DESKTOP feature: an app that is normally a single-user local tool and has been
+ * deliberately opened up. Reporting `true` for every Docker deployment would
+ * make §8.1's chip meaningless on the one runtime that renders it and wrong on
+ * every other.
+ */
+export declare function lanShareActive(env: Pick<Env, 'ADMINIUM_RUNTIME' | 'HOST'>): boolean;
+/** What §8.3's share panel shows, minus the URLs (which only main can enumerate). */
+export interface LanShareStatus {
+    /** {@link lanShareActive} — the bind, not the config. */
+    active: boolean;
+    /** Sessions currently held by a peer that is NOT this machine. */
+    lanSessions: number;
+    /**
+     * Active users who are not super admins — §8.3's precondition ("at least one
+     * non-super-admin user exists *or* the admin acknowledges they'll invite users
+     * next").
+     */
+    otherUsers: number;
+}
+/**
+ * §8.3's "connected-session count (from `adminium_sessions` with non-loopback
+ * IPs)".
+ *
+ * ─── "Active" has to mean the same thing here as at the front door ───────────
+ *
+ * Three conditions, and they are `resolveSessionByToken`'s three, deliberately:
+ * un-revoked, before `expires_at`, and inside the 7-day idle window. A count
+ * that used fewer would report sessions that the very next request would refuse
+ * as expired — a panel telling an admin "3 devices connected" when two of them
+ * were signed out last week is worse than no panel, because the number is the
+ * only reason the panel exists.
+ *
+ * ─── Non-loopback, and what a NULL ip means ──────────────────────────────────
+ *
+ * `adminium_sessions.ip` is nullable, and `null` is not "loopback": it is "we
+ * were not told". It cannot be counted as a LAN peer (that would inflate the
+ * number on any install whose sessions predate an ip being recorded), and it is
+ * not counted here. In practice the desktop path always records one —
+ * `routes/auth/handlers.ts`'s `requestMeta` passes `request.ip` on every login —
+ * so this is a defensive read, not a common case.
+ *
+ * `isLoopbackAddress` rather than a `!== '127.0.0.1'` comparison: loopback is a
+ * whole /8 plus `::1` plus the IPv4-mapped spellings a dual-stack listener hands
+ * out, and `::ffff:127.0.0.1` is this machine however much it looks like it is
+ * not.
+ */
+export declare function readLanShareStatus(env: Pick<Env, 'ADMINIUM_RUNTIME' | 'HOST'>, meta: MetaDb, at?: number): Promise<LanShareStatus>;
+/**
+ * The built-in role `@adminium/meta`'s `bootstrap.ts` seeds and the RBAC
+ * resolver short-circuits on. Restated here rather than imported because meta
+ * exports the seed shape and not the slug; `desktop-lan-route.test.ts` pins the
+ * two together, since a typo would silently make every super admin count as an
+ * "other user" and wave the §8.3 precondition through.
+ */
+export declare const SUPER_ADMIN_ROLE_SLUG = "super-admin";
+//# sourceMappingURL=lan-share.d.ts.map

package/dist/desktop/lan-share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-share.d.ts","sourceRoot":"","sources":["../../src/desktop/lan-share.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAI7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAkB5C,gDAAgD;AAChD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAAC,GAAG,OAAO,CAEnF;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,MAAM,EAAE,OAAO,CAAC;IAChB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAAC,EAC3C,IAAI,EAAE,MAAM,EACZ,EAAE,GAAE,MAAmB,GACtB,OAAO,CAAC,cAAc,CAAC,CAMzB;AAiDD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC"}

package/dist/desktop/lan-share.js

@@ -0,0 +1,150 @@
+/**
+ * LAN share, as the SERVER can see it (11-electron.md §8.3, §8.1).
+ *
+ * The desktop shell owns the DECISION — `config.json`'s `lanShare` is main's
+ * file (§2.3), and main is what re-forks this process with `ADMINIUM_HOST=0.0.0.0`
+ * — so nothing here toggles anything. What lives here are the two questions only
+ * a process holding the meta store and its own listening socket can answer:
+ *
+ *  1. {@link lanShareActive} — am I bound wide, or to loopback? §8.1's runtime
+ *     chip needs this, and §8.1 forbids it the obvious source: "The chip is a
+ *     `@adminium/ui` component fed by `GET /api/v1/system/info` + a lightweight
+ *     connection-health poll — **no preload involvement**." So the answer has to
+ *     come off this process's own boot environment.
+ *  2. {@link readLanShareStatus} — who is actually connected, and is there
+ *     anyone but the super admin to connect? Both are meta-store reads, and §1
+ *     principle 2 makes this process the only thing allowed to make them.
+ *
+ * ─── Why the bind address is the honest signal ───────────────────────────────
+ *
+ * `config.lanShare.enabled` is a statement of INTENT that the user can change at
+ * any moment; the bind address is the state of the world. They disagree for a
+ * whole server lifetime whenever the rebind fails or has not happened yet —
+ * exactly the window in which a chip saying "Sharing on LAN" over a
+ * loopback-only server, or the reverse, is a lie with a security consequence.
+ * §2.4 states the invariant in the same terms ("The server binds 127.0.0.1
+ * unless LAN share is on"), so reporting the bind is reporting the promise.
+ */
+import { isLoopbackAddress } from '../auth/desktop-session.js';
+import { SESSION_IDLE_TTL_MS } from '../auth/sessions.js';
+/**
+ * Bind addresses that mean "every interface", i.e. reachable from the LAN.
+ *
+ * `0.0.0.0` is what §2.2 step 5's env block names and what the shell sends.
+ * `::` (and its bracketed spelling) is the IPv6 wildcard, which reaches the
+ * same conclusion by the same mechanism — and which a fleet admin or a
+ * hand-edited launch could produce. Anything else — a loopback literal, a
+ * single NIC's address, a hostname — is not a wildcard. Note that a specific
+ * LAN address like `192.168.1.5` is deliberately NOT here: it is reachable, but
+ * the desktop shell never produces it (§8.3 flips between loopback and
+ * `0.0.0.0` and nothing else), and treating an arbitrary literal as "sharing"
+ * would require this module to enumerate interfaces — which is main's job (`os`
+ * lives there, and this process may be in a container).
+ */
+const WILDCARD_BIND_HOSTS = new Set(['0.0.0.0', '::', '[::]', '*']);
+/** Is `host` a bind-every-interface address? */
+export function isWildcardBindHost(host) {
+    return WILDCARD_BIND_HOSTS.has(host.trim());
+}
+/**
+ * §8.3's toggle, as observed rather than as configured: is THIS process reachable
+ * from the LAN because the desktop shell asked it to be?
+ *
+ * The `desktop` runtime clause is not decoration. Self-host, Docker and `npx
+ * adminium` all default `HOST` to `0.0.0.0` — that is the normal, correct bind
+ * for a server behind a reverse proxy, and it is not "LAN share". §8.3 is a
+ * DESKTOP feature: an app that is normally a single-user local tool and has been
+ * deliberately opened up. Reporting `true` for every Docker deployment would
+ * make §8.1's chip meaningless on the one runtime that renders it and wrong on
+ * every other.
+ */
+export function lanShareActive(env) {
+    return env.ADMINIUM_RUNTIME === 'desktop' && isWildcardBindHost(env.HOST);
+}
+/**
+ * §8.3's "connected-session count (from `adminium_sessions` with non-loopback
+ * IPs)".
+ *
+ * ─── "Active" has to mean the same thing here as at the front door ───────────
+ *
+ * Three conditions, and they are `resolveSessionByToken`'s three, deliberately:
+ * un-revoked, before `expires_at`, and inside the 7-day idle window. A count
+ * that used fewer would report sessions that the very next request would refuse
+ * as expired — a panel telling an admin "3 devices connected" when two of them
+ * were signed out last week is worse than no panel, because the number is the
+ * only reason the panel exists.
+ *
+ * ─── Non-loopback, and what a NULL ip means ──────────────────────────────────
+ *
+ * `adminium_sessions.ip` is nullable, and `null` is not "loopback": it is "we
+ * were not told". It cannot be counted as a LAN peer (that would inflate the
+ * number on any install whose sessions predate an ip being recorded), and it is
+ * not counted here. In practice the desktop path always records one —
+ * `routes/auth/handlers.ts`'s `requestMeta` passes `request.ip` on every login —
+ * so this is a defensive read, not a common case.
+ *
+ * `isLoopbackAddress` rather than a `!== '127.0.0.1'` comparison: loopback is a
+ * whole /8 plus `::1` plus the IPv4-mapped spellings a dual-stack listener hands
+ * out, and `::ffff:127.0.0.1` is this machine however much it looks like it is
+ * not.
+ */
+export async function readLanShareStatus(env, meta, at = Date.now()) {
+    const [lanSessions, otherUsers] = await Promise.all([
+        countLanSessions(meta, at),
+        countNonSuperAdminUsers(meta),
+    ]);
+    return { active: lanShareActive(env), lanSessions, otherUsers };
+}
+async function countLanSessions(meta, at) {
+    const rows = await meta.db
+        .selectFrom('adminium_sessions')
+        .select(['ip'])
+        .where('revokedAt', 'is', null)
+        .where('expiresAt', '>', at)
+        .where('lastSeenAt', '>', at - SESSION_IDLE_TTL_MS)
+        .execute();
+    // The loopback test is applied in TypeScript rather than SQL on purpose: the
+    // rule is "is this address one of the several shapes that mean this machine",
+    // which is `isLoopbackAddress`'s job and not something three dialects of
+    // `LIKE` should be asked to re-implement between them. The row set is bounded
+    // by the number of live sessions on a desktop install.
+    return rows.filter((row) => row.ip !== null && !isLoopbackAddress(row.ip)).length;
+}
+/**
+ * §8.3's precondition input: is there anybody to invite, or has the admin only
+ * got themselves?
+ *
+ * "Non-super-admin" is asked of the ROLE ASSIGNMENT rather than of the user row,
+ * because super-admin is not a column — it is a row in `adminium_user_roles`
+ * pointing at the `super-admin` role (`@adminium/meta`'s `bootstrap.ts` seeds
+ * it, and the RBAC resolver short-circuits on that slug). A second super admin
+ * therefore does NOT count: §8.3's precondition exists so the admin does not
+ * open their machine to a network on which nobody but them has an account, and
+ * another copy of themselves does not change that.
+ *
+ * Suspended and invited users do not count either — `status: 'active'` is the
+ * set that can actually log in.
+ */
+async function countNonSuperAdminUsers(meta) {
+    const superAdmins = meta.db
+        .selectFrom('adminium_user_roles')
+        .innerJoin('adminium_roles', 'adminium_roles.id', 'adminium_user_roles.roleId')
+        .select('adminium_user_roles.userId')
+        .where('adminium_roles.slug', '=', SUPER_ADMIN_ROLE_SLUG);
+    const rows = await meta.db
+        .selectFrom('adminium_users')
+        .select('id')
+        .where('status', '=', 'active')
+        .where('id', 'not in', superAdmins)
+        .execute();
+    return rows.length;
+}
+/**
+ * The built-in role `@adminium/meta`'s `bootstrap.ts` seeds and the RBAC
+ * resolver short-circuits on. Restated here rather than imported because meta
+ * exports the seed shape and not the slug; `desktop-lan-route.test.ts` pins the
+ * two together, since a typo would silently make every super admin count as an
+ * "other user" and wave the §8.3 precondition through.
+ */
+export const SUPER_ADMIN_ROLE_SLUG = 'super-admin';
+//# sourceMappingURL=lan-share.js.map

package/dist/desktop/lan-share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-share.js","sourceRoot":"","sources":["../../src/desktop/lan-share.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzF,gDAAgD;AAChD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,GAA2C;IACxE,OAAO,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAA2C,EAC3C,IAAY,EACZ,KAAa,IAAI,CAAC,GAAG,EAAE;IAEvB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,uBAAuB,CAAC,IAAI,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,EAAU;IACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;SACvB,UAAU,CAAC,mBAAmB,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;SACd,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;SAC9B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;SAC3B,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,GAAG,mBAAmB,CAAC;SAClD,OAAO,EAAE,CAAC;IACb,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAC9E,uDAAuD;IACvD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,uBAAuB,CAAC,IAAY;IACjD,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE;SACxB,UAAU,CAAC,qBAAqB,CAAC;SACjC,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC;SAC9E,MAAM,CAAC,4BAA4B,CAAC;SACpC,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;SACvB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,MAAM,CAAC,IAAI,CAAC;SACZ,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC;SAC9B,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;SAClC,OAAO,EAAE,CAAC;IACb,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Application errors + the one non-2xx envelope (08-server-api.md §1.4).
+ *
+ * Every non-2xx response has the shape
+ * `{ error: { code, message, requestId, details? } }` with a SCREAMING_SNAKE
+ * `code` from the canonical table. Handlers throw `AppError` subclasses; the
+ * global error handler in `app.ts` serializes them.
+ */
+/** Canonical error codes relevant to the M2 skeleton (08-server-api.md §1.4). */
+export type ErrorCode = 'VALIDATION_FAILED' | 'UNAUTHENTICATED' | 'SESSION_EXPIRED' | 'FORBIDDEN' | 'TABLE_FORBIDDEN' | 'COLUMN_FORBIDDEN' | 'PAGE_FORBIDDEN' | 'CSRF_FAILED' | 'READ_ONLY_MODE' | 'NOT_FOUND' | 'CONFLICT' | 'UNIQUE_VIOLATION' | 'FK_VIOLATION' | 'PAYLOAD_TOO_LARGE' | 'UNKNOWN_IDENTIFIER' | 'RATE_LIMITED' | 'SOURCE_DB_UNREACHABLE' | 'INTERNAL';
+/** The wire shape of every non-2xx response. */
+export interface ErrorEnvelope {
+    error: {
+        code: string;
+        message: string;
+        requestId: string;
+        details?: unknown;
+    };
+}
+/**
+ * Builds the §1.4 envelope. `details` is included only when defined so
+ * successful `JSON.stringify` output never carries a `"details": undefined`
+ * hole (and `exactOptionalPropertyTypes` stays happy).
+ */
+export declare function errorEnvelope(code: string, message: string, requestId: string, details?: unknown): ErrorEnvelope;
+/**
+ * Base class for expected, route-throwable errors. Carries the HTTP status,
+ * the SCREAMING_SNAKE code, and optional Zod-safe JSON `details`.
+ */
+export declare class AppError extends Error {
+    readonly name: string;
+    readonly statusCode: number;
+    readonly code: string;
+    readonly details: unknown;
+    constructor(statusCode: number, code: string, message: string, details?: unknown);
+}
+/** 404 — resource or record absent. */
+export declare class NotFoundError extends AppError {
+    readonly name = "NotFoundError";
+    constructor(message?: string, details?: unknown);
+}
+/** 422 — Zod schema rejection or semantically invalid input. */
+export declare class ValidationFailedError extends AppError {
+    readonly name = "ValidationFailedError";
+    constructor(message?: string, details?: unknown);
+}
+/** 401 — no/invalid session (`UNAUTHENTICATED`) or expired (`SESSION_EXPIRED`). */
+export declare class UnauthorizedError extends AppError {
+    readonly name = "UnauthorizedError";
+    constructor(code?: 'UNAUTHENTICATED' | 'SESSION_EXPIRED', message?: string, details?: unknown);
+}
+/** 403 — RBAC/CSRF denial; `code` narrows the flavor (08-server-api.md §1.4). */
+export declare class ForbiddenError extends AppError {
+    readonly name = "ForbiddenError";
+    constructor(message?: string, code?: 'FORBIDDEN' | 'TABLE_FORBIDDEN' | 'COLUMN_FORBIDDEN' | 'PAGE_FORBIDDEN' | 'CSRF_FAILED' | 'READ_ONLY_MODE', details?: unknown);
+}
+/** 409 — optimistic-concurrency/state conflict or mapped constraint violation. */
+export declare class ConflictError extends AppError {
+    readonly name = "ConflictError";
+    constructor(message?: string, code?: 'CONFLICT' | 'UNIQUE_VIOLATION' | 'FK_VIOLATION', details?: unknown);
+}
+/**
+ * 429 — thrown by the §6 limiter in `plugins/core.ts` when a bucket is
+ * exhausted (08-server-api.md §6); the plugin sets `Retry-After` on the reply
+ * before the global handler serializes this envelope. `details` carries
+ * `{ bucket, limit, resetAt }` when known.
+ */
+export declare class RateLimitedError extends AppError {
+    readonly name = "RateLimitedError";
+    constructor(message?: string, details?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iFAAiF;AACjF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,iBAAiB,GACjB,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,aAAa,GACb,gBAAgB,GAChB,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,cAAc,GACd,mBAAmB,GACnB,oBAAoB,GACpB,cAAc,GACd,uBAAuB,GACvB,UAAU,CAAC;AAEf,gDAAgD;AAChD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,OAAO,GAChB,aAAa,CAIf;AAED;;;GAGG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAkB,IAAI,EAAE,MAAM,CAAc;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;gBAEd,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO;CAMjF;AAED,uCAAuC;AACvC,qBAAa,aAAc,SAAQ,QAAQ;IACzC,SAAkB,IAAI,mBAAmB;gBAE7B,OAAO,SAAwB,EAAE,OAAO,CAAC,EAAE,OAAO;CAG/D;AAED,gEAAgE;AAChE,qBAAa,qBAAsB,SAAQ,QAAQ;IACjD,SAAkB,IAAI,2BAA2B;gBAErC,OAAO,SAA+B,EAAE,OAAO,CAAC,EAAE,OAAO;CAGtE;AAED,mFAAmF;AACnF,qBAAa,iBAAkB,SAAQ,QAAQ;IAC7C,SAAkB,IAAI,uBAAuB;gBAG3C,IAAI,GAAE,iBAAiB,GAAG,iBAAqC,EAC/D,OAAO,SAAwF,EAC/F,OAAO,CAAC,EAAE,OAAO;CAIpB;AAED,iFAAiF;AACjF,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,SAAkB,IAAI,oBAAoB;gBAGxC,OAAO,SAA6C,EACpD,IAAI,GACA,WAAW,GACX,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,GAChB,aAAa,GACb,gBAA8B,EAClC,OAAO,CAAC,EAAE,OAAO;CAIpB;AAED,kFAAkF;AAClF,qBAAa,aAAc,SAAQ,QAAQ;IACzC,SAAkB,IAAI,mBAAmB;gBAGvC,OAAO,SAA8C,EACrD,IAAI,GAAE,UAAU,GAAG,kBAAkB,GAAG,cAA2B,EACnE,OAAO,CAAC,EAAE,OAAO;CAIpB;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ;IAC5C,SAAkB,IAAI,sBAAsB;gBAEhC,OAAO,SAA0C,EAAE,OAAO,CAAC,EAAE,OAAO;CAGjF"}

package/dist/errors.js

@@ -0,0 +1,82 @@
+/**
+ * Application errors + the one non-2xx envelope (08-server-api.md §1.4).
+ *
+ * Every non-2xx response has the shape
+ * `{ error: { code, message, requestId, details? } }` with a SCREAMING_SNAKE
+ * `code` from the canonical table. Handlers throw `AppError` subclasses; the
+ * global error handler in `app.ts` serializes them.
+ */
+/**
+ * Builds the §1.4 envelope. `details` is included only when defined so
+ * successful `JSON.stringify` output never carries a `"details": undefined`
+ * hole (and `exactOptionalPropertyTypes` stays happy).
+ */
+export function errorEnvelope(code, message, requestId, details) {
+    return details === undefined
+        ? { error: { code, message, requestId } }
+        : { error: { code, message, requestId, details } };
+}
+/**
+ * Base class for expected, route-throwable errors. Carries the HTTP status,
+ * the SCREAMING_SNAKE code, and optional Zod-safe JSON `details`.
+ */
+export class AppError extends Error {
+    name = 'AppError';
+    statusCode;
+    code;
+    details;
+    constructor(statusCode, code, message, details) {
+        super(message);
+        this.statusCode = statusCode;
+        this.code = code;
+        this.details = details;
+    }
+}
+/** 404 — resource or record absent. */
+export class NotFoundError extends AppError {
+    name = 'NotFoundError';
+    constructor(message = 'Resource not found.', details) {
+        super(404, 'NOT_FOUND', message, details);
+    }
+}
+/** 422 — Zod schema rejection or semantically invalid input. */
+export class ValidationFailedError extends AppError {
+    name = 'ValidationFailedError';
+    constructor(message = 'Request validation failed.', details) {
+        super(422, 'VALIDATION_FAILED', message, details);
+    }
+}
+/** 401 — no/invalid session (`UNAUTHENTICATED`) or expired (`SESSION_EXPIRED`). */
+export class UnauthorizedError extends AppError {
+    name = 'UnauthorizedError';
+    constructor(code = 'UNAUTHENTICATED', message = code === 'SESSION_EXPIRED' ? 'Your session has expired.' : 'Authentication required.', details) {
+        super(401, code, message, details);
+    }
+}
+/** 403 — RBAC/CSRF denial; `code` narrows the flavor (08-server-api.md §1.4). */
+export class ForbiddenError extends AppError {
+    name = 'ForbiddenError';
+    constructor(message = 'You do not have access to this resource.', code = 'FORBIDDEN', details) {
+        super(403, code, message, details);
+    }
+}
+/** 409 — optimistic-concurrency/state conflict or mapped constraint violation. */
+export class ConflictError extends AppError {
+    name = 'ConflictError';
+    constructor(message = 'The resource changed since you loaded it.', code = 'CONFLICT', details) {
+        super(409, code, message, details);
+    }
+}
+/**
+ * 429 — thrown by the §6 limiter in `plugins/core.ts` when a bucket is
+ * exhausted (08-server-api.md §6); the plugin sets `Retry-After` on the reply
+ * before the global handler serializes this envelope. `details` carries
+ * `{ bucket, limit, resetAt }` when known.
+ */
+export class RateLimitedError extends AppError {
+    name = 'RateLimitedError';
+    constructor(message = 'Too many requests. Try again shortly.', details) {
+        super(429, 'RATE_LIMITED', message, details);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiCH;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAAe,EACf,SAAiB,EACjB,OAAiB;IAEjB,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;QACzC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACf,IAAI,GAAW,UAAU,CAAC;IACnC,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,OAAO,CAAU;IAE1B,YAAY,UAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,OAAiB;QAC9E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,uCAAuC;AACvC,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACvB,IAAI,GAAG,eAAe,CAAC;IAEzC,YAAY,OAAO,GAAG,qBAAqB,EAAE,OAAiB;QAC5D,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IAC/B,IAAI,GAAG,uBAAuB,CAAC;IAEjD,YAAY,OAAO,GAAG,4BAA4B,EAAE,OAAiB;QACnE,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC3B,IAAI,GAAG,mBAAmB,CAAC;IAE7C,YACE,OAA8C,iBAAiB,EAC/D,OAAO,GAAG,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,0BAA0B,EAC/F,OAAiB;QAEjB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,iFAAiF;AACjF,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACxB,IAAI,GAAG,gBAAgB,CAAC;IAE1C,YACE,OAAO,GAAG,0CAA0C,EACpD,OAMuB,WAAW,EAClC,OAAiB;QAEjB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACvB,IAAI,GAAG,eAAe,CAAC;IAEzC,YACE,OAAO,GAAG,2CAA2C,EACrD,OAAyD,UAAU,EACnE,OAAiB;QAEjB,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IAC1B,IAAI,GAAG,kBAAkB,CAAC;IAE5C,YAAY,OAAO,GAAG,uCAAuC,EAAE,OAAiB;QAC9E,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/export/bundle.d.ts

@@ -0,0 +1,235 @@
+/**
+ * The bundle format: layout, manifest, and the Zod schemas both front doors
+ * (export, import) validate against (M10-T03; 01-architecture.md §6.1, §8.2).
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHAT THIS IS, STATED ONCE SO IT CANNOT DRIFT: an Adminium bundle is
+ * **configuration for a server, not a server and not source code**. Adminium
+ * interprets config at runtime; it never emits an app. The bundle therefore
+ * carries the instance's `adminium_*` config content as portable JSON, plus a
+ * manifest that pins the versions needed to replay it, plus a README saying
+ * exactly this. `package.json` in the bundle pins the `@adminiumjs/adminium` npm package at
+ * the exporting version — per 01 §4.1 that single package *is* the complete
+ * install (server + dashboard dist + meta migrations), so pinning it is how the
+ * bundle names its runtime without shipping (unshippable, platform-specific,
+ * natively-compiled) copies of it.
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * VERSION REPLAY (§8.2): the manifest embeds `{ appVersion, configVersion,
+ * metaVersion }`. On import the meta migrator brings the target schema up, and
+ * `runConfigMigrations` from `@adminium/engine/config` replays every config
+ * document's `v` up to the running build's — so a bundle exported at N imports
+ * into any instance at ≥ N. A bundle from a *newer* build is refused rather
+ * than silently half-read.
+ */
+import { z } from 'zod';
+/** Bundle root inside the archive — one directory, so unzipping is tidy. */
+export declare const BUNDLE_ROOT = "adminium-export";
+export declare const MANIFEST_PATH = "adminium-export/manifest.json";
+export declare const README_PATH = "adminium-export/README.md";
+export declare const PACKAGE_JSON_PATH = "adminium-export/package.json";
+export declare const CONFIG_DIR = "adminium-export/config";
+/** The config resources the bundle carries, in import (FK-safe) order. */
+export declare const BUNDLE_RESOURCES: readonly ["settings", "roles", "rolePermissions", "connections", "snapshots", "overrides", "pages", "views"];
+export type BundleResource = (typeof BUNDLE_RESOURCES)[number];
+export declare function resourcePath(resource: BundleResource): string;
+/**
+ * How secrets were treated. `omitted` is the default and means the target must
+ * re-enter DSNs and provider keys. `encrypted` means the ciphertext travelled
+ * and only the *same* `ADMINIUM_SECRET` can re-open it — stated explicitly so a
+ * bundle can never be mistaken for a self-contained credential store.
+ */
+export declare const secretsPolicySchema: z.ZodEnum<{
+    omitted: "omitted";
+    encrypted: "encrypted";
+}>;
+export type SecretsPolicy = z.infer<typeof secretsPolicySchema>;
+export declare const bundleManifestSchema: z.ZodObject<{
+    formatVersion: z.ZodNumber;
+    appVersion: z.ZodString;
+    configVersion: z.ZodNumber;
+    metaVersion: z.ZodString;
+    exportedAt: z.ZodNumber;
+    connectionId: z.ZodNullable<z.ZodString>;
+    secrets: z.ZodObject<{
+        policy: z.ZodEnum<{
+            omitted: "omitted";
+            encrypted: "encrypted";
+        }>;
+        encrypted: z.ZodArray<z.ZodString>;
+        omitted: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    counts: z.ZodRecord<z.ZodString, z.ZodNumber>;
+}, z.core.$strip>;
+export type BundleManifest = z.infer<typeof bundleManifestSchema>;
+export declare const settingsRowSchema: z.ZodObject<{
+    key: z.ZodString;
+    value: z.ZodUnknown;
+}, z.core.$strip>;
+export declare const roleRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    isBuiltin: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const rolePermissionRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    roleId: z.ZodString;
+    resourceKind: z.ZodString;
+    resourceRef: z.ZodString;
+    actions: z.ZodUnknown;
+}, z.core.$strip>;
+export declare const connectionRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    engine: z.ZodString;
+    sourceKind: z.ZodString;
+    readOnly: z.ZodBoolean;
+    ssl: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+    settings: z.ZodUnknown;
+    introspectDsnEncrypted: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    dataDsnEncrypted: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const snapshotRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodString;
+    source: z.ZodString;
+    importFormat: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    engineVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    schema: z.ZodUnknown;
+    stats: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+    checksum: z.ZodString;
+    isActive: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const overrideRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodString;
+    op: z.ZodString;
+    tableName: z.ZodString;
+    columnName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    value: z.ZodUnknown;
+    origin: z.ZodString;
+    status: z.ZodString;
+    confidence: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+export declare const pageRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    connectionId: z.ZodNullable<z.ZodString>;
+    slug: z.ZodString;
+    type: z.ZodString;
+    title: z.ZodString;
+    icon: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    navGroup: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    navOrder: z.ZodNumber;
+    config: z.ZodUnknown;
+    origin: z.ZodString;
+    generatedFromSnapshotId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    isEnabled: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const viewRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    pageId: z.ZodString;
+    kind: z.ZodString;
+    name: z.ZodString;
+    config: z.ZodUnknown;
+    isDefault: z.ZodBoolean;
+}, z.core.$strip>;
+/** Resource name → row schema. The import iterates this, so a resource without
+ *  a schema cannot be imported by accident. */
+export declare const RESOURCE_SCHEMAS: {
+    readonly settings: z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodUnknown;
+    }, z.core.$strip>;
+    readonly roles: z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        isBuiltin: z.ZodBoolean;
+    }, z.core.$strip>;
+    readonly rolePermissions: z.ZodObject<{
+        id: z.ZodString;
+        roleId: z.ZodString;
+        resourceKind: z.ZodString;
+        resourceRef: z.ZodString;
+        actions: z.ZodUnknown;
+    }, z.core.$strip>;
+    readonly connections: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        engine: z.ZodString;
+        sourceKind: z.ZodString;
+        readOnly: z.ZodBoolean;
+        ssl: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+        settings: z.ZodUnknown;
+        introspectDsnEncrypted: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        dataDsnEncrypted: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>;
+    readonly snapshots: z.ZodObject<{
+        id: z.ZodString;
+        connectionId: z.ZodString;
+        source: z.ZodString;
+        importFormat: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        engineVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        schema: z.ZodUnknown;
+        stats: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+        checksum: z.ZodString;
+        isActive: z.ZodBoolean;
+    }, z.core.$strip>;
+    readonly overrides: z.ZodObject<{
+        id: z.ZodString;
+        connectionId: z.ZodString;
+        op: z.ZodString;
+        tableName: z.ZodString;
+        columnName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        value: z.ZodUnknown;
+        origin: z.ZodString;
+        status: z.ZodString;
+        confidence: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>;
+    readonly pages: z.ZodObject<{
+        id: z.ZodString;
+        connectionId: z.ZodNullable<z.ZodString>;
+        slug: z.ZodString;
+        type: z.ZodString;
+        title: z.ZodString;
+        icon: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        navGroup: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        navOrder: z.ZodNumber;
+        config: z.ZodUnknown;
+        origin: z.ZodString;
+        generatedFromSnapshotId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        isEnabled: z.ZodBoolean;
+    }, z.core.$strip>;
+    readonly views: z.ZodObject<{
+        id: z.ZodString;
+        pageId: z.ZodString;
+        kind: z.ZodString;
+        name: z.ZodString;
+        config: z.ZodUnknown;
+        isDefault: z.ZodBoolean;
+    }, z.core.$strip>;
+};
+export type SettingsRow = z.infer<typeof settingsRowSchema>;
+export type RoleRow = z.infer<typeof roleRowSchema>;
+export type RolePermissionRow = z.infer<typeof rolePermissionRowSchema>;
+export type ConnectionRow = z.infer<typeof connectionRowSchema>;
+export type SnapshotRow = z.infer<typeof snapshotRowSchema>;
+export type OverrideRow = z.infer<typeof overrideRowSchema>;
+export type PageRow = z.infer<typeof pageRowSchema>;
+export type ViewRow = z.infer<typeof viewRowSchema>;
+/** The in-memory shape of a whole bundle — what export writes and import reads. */
+export interface ConfigBundle {
+    manifest: BundleManifest;
+    settings: SettingsRow[];
+    roles: RoleRow[];
+    rolePermissions: RolePermissionRow[];
+    connections: ConnectionRow[];
+    snapshots: SnapshotRow[];
+    overrides: OverrideRow[];
+    pages: PageRow[];
+    views: ViewRow[];
+}
+//# sourceMappingURL=bundle.d.ts.map

package/dist/export/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/export/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,eAAO,MAAM,aAAa,kCAAiC,CAAC;AAC5D,eAAO,MAAM,WAAW,8BAA6B,CAAC;AACtD,eAAO,MAAM,iBAAiB,iCAAgC,CAAC;AAC/D,eAAO,MAAM,UAAU,2BAA0B,CAAC;AAElD,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,8GASnB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAE7D;AAID;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;EAAmC,CAAC;AACpE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;iBAuB/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAelE,eAAO,MAAM,iBAAiB;;;iBAAyD,CAAC;AAExF,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;iBAMlC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAW9B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBAU5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;iBAU5B,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;iBAaxB,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;iBAOxB,CAAC;AAEH;+CAC+C;AAC/C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASyB,CAAC;AAEvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AACpD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB"}