@adminiumjs/adminium 0.1.0-rc.1

package/dist/llm/run-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-service.js","sourceRoot":"","sources":["../../src/llm/run-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,gBAAgB,GAWjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,KAAK,EAA+C,MAAM,gBAAgB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAE7D;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA4D;IAC5F,KAAK,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC9D,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;IAC7C,iBAAiB,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC;IACvD,SAAS,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC;IACxD,OAAO,EAAE,EAAE;IACX,iBAAiB,EAAE,EAAE;IACrB,MAAM,EAAE,EAAE;IACV,SAAS,EAAE,EAAE;CACd,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,EAAgB;IAChE,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAEhF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEpB;IADZ,IAAI,GAAG,kBAAkB,CAAC;IACnC,YAAqB,KAAa;QAChC,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QADlB,UAAK,GAAL,KAAK,CAAQ;IAElC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAErB;IAAwB;IADpC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAqB,KAAa,EAAW,MAAoB;QAC/D,KAAK,CAAC,WAAW,KAAK,OAAO,MAAM,gBAAgB,CAAC,CAAC;QADlC,UAAK,GAAL,KAAK,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAc;IAEjE,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAE7B;IAAwB;IAA6B;IADjE,IAAI,GAAG,2BAA2B,CAAC;IAC5C,YAAqB,KAAa,EAAW,IAAkB,EAAW,EAAgB;QACxF,KAAK,CAAC,8BAA8B,IAAI,MAAM,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC;QADhD,UAAK,GAAL,KAAK,CAAQ;QAAW,SAAI,GAAJ,IAAI,CAAc;QAAW,OAAE,GAAF,EAAE,CAAc;IAE1F,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,mBAAmB,CAAC;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAiHD,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEjC,KAAK,UAAU,WAAW,CAAC,KAAa;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,EAAgB;QACrD,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,EAAgB;QACrD,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,yEAAyE;YACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,KAAa,EAA0B,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvE,QAAQ,EAAE,CAAC,YAAoB,EAAqB,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;QAE3F;;;;WAIG;QACH,KAAK,CAAC,SAAS,CAAC,KAAqB;YACnC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxE,MAAM,IAAI,iBAAiB,CACzB,qEAAqE,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,QAAQ,GAAG,WAAW,CAC1B;gBACE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,EAAE;aACV,EACD;gBACE,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CACF,CAAC;YAEF,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAC3B;gBACE,EAAE;gBACF,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAC9D,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI;gBACxD,aAAa,EAAE,cAAc;gBAC7B,UAAU;gBACV,UAAU;gBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACnC,cAAc,EAAE,CAAC;gBACjB,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;aACnC,EACD,GAAG,EAAE,CACN,CAAC;YAEF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC3B,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,gFAAgF;QAChF,KAAK,CAAC,oBAAoB,CAAC,KAAa;YACtC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC9C,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,eAAe,CACnB,KAAa,EACb,KAA2B;YAE3B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrF,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;gBACvC,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAiB;gBACnD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,KAAK,EAAE,GAAG,CAAC,EAAE;aACd,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC;YAErC,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACtC,4EAA4E;gBAC5E,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO;wBACL,GAAG,EAAE;4BACH,GAAG,GAAG;4BACN,gBAAgB,EAAE,SAAS;4BAC3B,WAAW,EAAE,KAAK,CAAC,IAAI;4BACvB,gBAAgB,EAAE,UAAU,CAAC,MAAM;yBACpC;wBACD,UAAU;qBACX,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE;oBAChC,MAAM,EAAE,mBAAmB;oBAC3B,gBAAgB,EAAE,SAAS;oBAC3B,WAAW,EAAE,KAAK,CAAC,IAAI;oBACvB,gBAAgB,EAAE,UAAU,CAAC,MAAM;iBACpC,CAAC,CAAC;gBACH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;YACxD,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACzE,MAAM,WAAW,GAAG,cAAc,IAAI,GAAG,CAAC,WAAW,CAAC;YACtD,MAAM,UAAU,GAAiB,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACjF,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YAE5E,IAAI,MAAM,EAAE,CAAC;gBACX,wEAAwE;gBACxE,wEAAwE;gBACxE,OAAO;oBACL,GAAG,EAAE;wBACH,GAAG,GAAG;wBACN,MAAM,EAAE,UAAU;wBAClB,gBAAgB;wBAChB,WAAW,EAAE,KAAK,CAAC,IAAI;wBACvB,YAAY,EAAE,UAAU,CAAC,QAAQ;wBACjC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;wBACzE,cAAc;qBACf;oBACD,UAAU;iBACX,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE;gBAChC,MAAM,EAAE,UAAU;gBAClB,gBAAgB;gBAChB,WAAW,EAAE,KAAK,CAAC,IAAI;gBACvB,YAAY,EAAE,UAAU,CAAC,QAAQ;gBACjC,gBAAgB,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;gBACzE,cAAc;aACf,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QACxD,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,MAAoB;YACpD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrF,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,QAA0B,EAAE;YAC3D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,EAAE,GAAiB,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1B,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,EACN;gBACE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,MAAM,EAAE,EAAE;gBACV,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,EACD,GAAG,EAAE,CACN,CAAC;YACF,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,KAA8B;YAE9B,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACrF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,aAAa,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE;gBAChC,MAAM,EAAE,WAAW;gBACnB,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBACrD,YAAY,EAAE,KAAK,CAAC,QAAQ;gBAC5B,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;gBACvE,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,cAAsB;YAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO;YACrD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE;gBAC/B,MAAM,EAAE,SAAS;gBACjB,gBAAgB,EAAE,SAAS;gBAC3B,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QAED,sFAAsF;QACtF,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAyB,EAAE;YACzD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAChC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE;gBAChC,MAAM,EAAE,QAAQ;gBAChB,gBAAgB,EAAE,SAAS;gBAC3B,gBAAgB,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBACtC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC,CAAC;YACH,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,4DAA4D;QAC5D,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,OAAO,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/llm/stats-collector.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The §4.2 statistics collector, backed by a live {@link ConnectionManager}.
+ *
+ * `createPromptService` takes `collectStats` as an INJECTED dependency and falls
+ * back to `NO_STATS` (an empty array) when nobody supplies one — which is the
+ * correct default for a service that must stay testable without a source
+ * database, and the wrong behavior for a front door that advertises
+ * `--sampling` in its `--help`. Both doors (the CLI's `generate-prompt` and the
+ * Studio's `POST /llm/runs`) inject THIS, so `--sampling` and the Studio toggle
+ * mean the same thing: the same aggregates, from the same query, through the
+ * same privacy rules.
+ *
+ * PRIVACY (06 §4.2, and why this file passes the classified model down rather
+ * than a bare column list): the adapter decides what is safe to look at, and it
+ * can only do that if it knows which columns the classifier flagged
+ * `secret`/`pii`. Sample-free is the default — with `sampling` null NO cell
+ * value leaves the database, only row counts, null fractions and distinct
+ * counts. Under sampling opt-in the adapter still refuses sampled values and
+ * min/max for PII-suspected or secret columns; that refusal is the adapter's,
+ * and this module's job is simply to hand it the flags it needs to make it.
+ *
+ * DEGRADATION. A table that cannot be profiled (dropped since introspection, a
+ * permission gap, a timeout) is SKIPPED, not fatal: the prompt is an
+ * enrichment aid, and losing aggregates for one table must not fail the run
+ * that would have enriched the other forty.
+ */
+import type { ConnectionManager } from '../connections/manager.js';
+import type { CollectRunStats } from './prompt-service.js';
+export interface ConnectionStatsCollectorDeps {
+    manager: ConnectionManager;
+    /** Cap on tables profiled per run — a 500-table schema must not stall a boot. */
+    maxTables?: number | undefined;
+}
+/**
+ * §4.2 aggregates for every non-system table in the run's model, collected over
+ * the connection's DATA role (the introspect role may not read rows at all).
+ */
+export declare const DEFAULT_MAX_STATS_TABLES = 200;
+export declare function createConnectionStatsCollector(deps: ConnectionStatsCollectorDeps): CollectRunStats;
+//# sourceMappingURL=stats-collector.d.ts.map

package/dist/llm/stats-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats-collector.d.ts","sourceRoot":"","sources":["../../src/llm/stats-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiB3D,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,4BAA4B,GACjC,eAAe,CA6BjB"}

package/dist/llm/stats-collector.js

@@ -0,0 +1,74 @@
+/**
+ * The §4.2 statistics collector, backed by a live {@link ConnectionManager}.
+ *
+ * `createPromptService` takes `collectStats` as an INJECTED dependency and falls
+ * back to `NO_STATS` (an empty array) when nobody supplies one — which is the
+ * correct default for a service that must stay testable without a source
+ * database, and the wrong behavior for a front door that advertises
+ * `--sampling` in its `--help`. Both doors (the CLI's `generate-prompt` and the
+ * Studio's `POST /llm/runs`) inject THIS, so `--sampling` and the Studio toggle
+ * mean the same thing: the same aggregates, from the same query, through the
+ * same privacy rules.
+ *
+ * PRIVACY (06 §4.2, and why this file passes the classified model down rather
+ * than a bare column list): the adapter decides what is safe to look at, and it
+ * can only do that if it knows which columns the classifier flagged
+ * `secret`/`pii`. Sample-free is the default — with `sampling` null NO cell
+ * value leaves the database, only row counts, null fractions and distinct
+ * counts. Under sampling opt-in the adapter still refuses sampled values and
+ * min/max for PII-suspected or secret columns; that refusal is the adapter's,
+ * and this module's job is simply to hand it the flags it needs to make it.
+ *
+ * DEGRADATION. A table that cannot be profiled (dropped since introspection, a
+ * permission gap, a timeout) is SKIPPED, not fatal: the prompt is an
+ * enrichment aid, and losing aggregates for one table must not fail the run
+ * that would have enriched the other forty.
+ */
+/** Tables Adminium owns are never profiled — they are not the user's schema. */
+function isProfilable(table) {
+    return !table.system;
+}
+/** The classified column set, in the shape the adapter's privacy rules read. */
+function statsColumns(table) {
+    return table.columns.map((column) => ({
+        name: column.name,
+        logicalType: column.logicalType,
+        piiSuspected: column.semantics?.flags.pii != null,
+        secret: column.semantics?.flags.secret === true,
+    }));
+}
+/**
+ * §4.2 aggregates for every non-system table in the run's model, collected over
+ * the connection's DATA role (the introspect role may not read rows at all).
+ */
+export const DEFAULT_MAX_STATS_TABLES = 200;
+export function createConnectionStatsCollector(deps) {
+    const maxTables = deps.maxTables ?? DEFAULT_MAX_STATS_TABLES;
+    return async ({ connectionId, model, sampling }) => {
+        const tables = model.tables.filter(isProfilable).slice(0, maxTables);
+        if (tables.length === 0)
+            return [];
+        const adapter = await deps.manager.dataAdapter(connectionId);
+        try {
+            const results = [];
+            for (const table of tables) {
+                const opts = {
+                    columns: statsColumns(table),
+                    sampling: sampling ?? null,
+                };
+                try {
+                    results.push(await adapter.collectTableStats({ schema: table.schema, name: table.name }, opts));
+                }
+                catch {
+                    // See the module header: one unprofilable table is not a failed run.
+                    continue;
+                }
+            }
+            return results;
+        }
+        finally {
+            await adapter.close().catch(() => undefined);
+        }
+    };
+}
+//# sourceMappingURL=stats-collector.js.map

package/dist/llm/stats-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stats-collector.js","sourceRoot":"","sources":["../../src/llm/stats-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH,gFAAgF;AAChF,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACjD,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI;KAChD,CAAC,CAAC,CAAC;AACN,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C,MAAM,UAAU,8BAA8B,CAC5C,IAAkC;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAE7D,OAAO,KAAK,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAmC,EAAE;QAClF,MAAM,MAAM,GAAI,KAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAkB,EAAE,CAAC;YAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAwB;oBAChC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;oBAC5B,QAAQ,EAAE,QAAQ,IAAI,IAAI;iBAC3B,CAAC;gBACF,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CACV,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAClF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;oBACrE,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/log-scrub.d.ts

@@ -0,0 +1,58 @@
+/**
+ * URL scrubbing for the request log (08-server-api.md §1.3 redaction, and
+ * 11-electron.md §2.2 step 8 for why it had to exist).
+ *
+ * ─── The leak this closes ────────────────────────────────────────────────────
+ *
+ * pino's `redact` works on OBJECT PATHS: `*.password` censors a field. It cannot
+ * reach INSIDE a string, and `req.url` is a string. So a credential that travels
+ * in a query string is invisible to every redaction rule this server has —
+ * `redact: ['req.url']` would drop the whole URL, which is most of the value of
+ * having a request log at all.
+ *
+ * §2.2 step 8 navigates the desktop window to
+ * `http://127.0.0.1:<port>/?bootToken=<32 random bytes>`. That is a GET the
+ * server answers with `index.html` and logs like any other — and the desktop
+ * shell pipes those logs to a ROTATING FILE ON DISK (§9), where the token would
+ * then sit, in cleartext, long after the boot that minted it. The SPA stripping
+ * the token from `window.location` (§5) fixes the browser's history; it does
+ * nothing about the request that already happened.
+ *
+ * So: scrub the value, keep the URL. `/?bootToken=[REDACTED]` still tells you
+ * which request this was, that a token was presented, and nothing usable.
+ *
+ * ─── Why an allow-list of names, not a pattern ───────────────────────────────
+ *
+ * Guessing at "things that look secret" in arbitrary query strings would both
+ * miss (a token named `t`) and over-redact (`?filter=token`). The named set is
+ * small, and every entry is a parameter THIS product defines and can therefore
+ * be sure about.
+ */
+/** The pino censor string used everywhere else (`app.ts` `REDACT_PATHS`). */
+export declare const REDACTED = "[REDACTED]";
+/**
+ * Query parameters whose VALUE is a credential. Compared case-insensitively —
+ * `bootToken` and `boottoken` are the same parameter to a careless caller, and a
+ * scrubber that only catches the spelling we happen to emit is a scrubber that
+ * fails exactly when someone gets it wrong.
+ */
+export declare const SENSITIVE_QUERY_PARAMS: readonly string[];
+/**
+ * Replace the value of every sensitive query parameter in `url` with
+ * {@link REDACTED}, leaving the path, the parameter order, and every other
+ * parameter byte-for-byte intact.
+ *
+ * Takes and returns the RAW origin-relative string, exactly as `req.url` carries
+ * it (`/p/x?a=1`), and rewrites it by hand rather than through `new URL(...)` +
+ * `searchParams`. That is not squeamishness about the parser — it is that the
+ * round trip does not preserve its input: `searchParams` re-encodes on
+ * serialization (`[REDACTED]` comes back out as `%5BREDACTED%5D`, so the censor
+ * would not even be greppable), `+` becomes `%20`, and the path gets normalized.
+ * A request log whose URLs silently differ from the URLs that were requested is
+ * worse than no scrubbing, because you would not know to distrust it.
+ *
+ * Fast path: no `?`, nothing to do — which is every request in the product but
+ * the handful that carry a query.
+ */
+export declare function scrubUrlForLog(url: string): string;
+//# sourceMappingURL=log-scrub.d.ts.map

package/dist/log-scrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-scrub.d.ts","sourceRoot":"","sources":["../src/log-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAQnD,CAAC;AAgBF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAuBlD"}

package/dist/log-scrub.js

@@ -0,0 +1,103 @@
+/**
+ * URL scrubbing for the request log (08-server-api.md §1.3 redaction, and
+ * 11-electron.md §2.2 step 8 for why it had to exist).
+ *
+ * ─── The leak this closes ────────────────────────────────────────────────────
+ *
+ * pino's `redact` works on OBJECT PATHS: `*.password` censors a field. It cannot
+ * reach INSIDE a string, and `req.url` is a string. So a credential that travels
+ * in a query string is invisible to every redaction rule this server has —
+ * `redact: ['req.url']` would drop the whole URL, which is most of the value of
+ * having a request log at all.
+ *
+ * §2.2 step 8 navigates the desktop window to
+ * `http://127.0.0.1:<port>/?bootToken=<32 random bytes>`. That is a GET the
+ * server answers with `index.html` and logs like any other — and the desktop
+ * shell pipes those logs to a ROTATING FILE ON DISK (§9), where the token would
+ * then sit, in cleartext, long after the boot that minted it. The SPA stripping
+ * the token from `window.location` (§5) fixes the browser's history; it does
+ * nothing about the request that already happened.
+ *
+ * So: scrub the value, keep the URL. `/?bootToken=[REDACTED]` still tells you
+ * which request this was, that a token was presented, and nothing usable.
+ *
+ * ─── Why an allow-list of names, not a pattern ───────────────────────────────
+ *
+ * Guessing at "things that look secret" in arbitrary query strings would both
+ * miss (a token named `t`) and over-redact (`?filter=token`). The named set is
+ * small, and every entry is a parameter THIS product defines and can therefore
+ * be sure about.
+ */
+/** The pino censor string used everywhere else (`app.ts` `REDACT_PATHS`). */
+export const REDACTED = '[REDACTED]';
+/**
+ * Query parameters whose VALUE is a credential. Compared case-insensitively —
+ * `bootToken` and `boottoken` are the same parameter to a careless caller, and a
+ * scrubber that only catches the spelling we happen to emit is a scrubber that
+ * fails exactly when someone gets it wrong.
+ */
+export const SENSITIVE_QUERY_PARAMS = [
+    // 11-electron.md §2.2 step 8 / §5 — the desktop boot token.
+    'bootToken',
+    // 08-server-api.md §2.1 — password-reset and 2FA-challenge tokens. They ride
+    // in bodies today; the day one lands in a link's query, this is already here.
+    'token',
+    'challengeToken',
+    'apiKey',
+];
+const SENSITIVE_LOWER = new Set(SENSITIVE_QUERY_PARAMS.map((name) => name.toLowerCase()));
+/** `%2A` → `*`, tolerating the malformed escapes a hostile query can contain. */
+function decodeParamName(raw) {
+    try {
+        return decodeURIComponent(raw.replaceAll('+', ' '));
+    }
+    catch {
+        // `decodeURIComponent('%')` throws. A name we cannot decode is a name we
+        // cannot match against the list, so compare the raw bytes instead — the
+        // spellings we care about have no escapes anyway.
+        return raw;
+    }
+}
+/**
+ * Replace the value of every sensitive query parameter in `url` with
+ * {@link REDACTED}, leaving the path, the parameter order, and every other
+ * parameter byte-for-byte intact.
+ *
+ * Takes and returns the RAW origin-relative string, exactly as `req.url` carries
+ * it (`/p/x?a=1`), and rewrites it by hand rather than through `new URL(...)` +
+ * `searchParams`. That is not squeamishness about the parser — it is that the
+ * round trip does not preserve its input: `searchParams` re-encodes on
+ * serialization (`[REDACTED]` comes back out as `%5BREDACTED%5D`, so the censor
+ * would not even be greppable), `+` becomes `%20`, and the path gets normalized.
+ * A request log whose URLs silently differ from the URLs that were requested is
+ * worse than no scrubbing, because you would not know to distrust it.
+ *
+ * Fast path: no `?`, nothing to do — which is every request in the product but
+ * the handful that carry a query.
+ */
+export function scrubUrlForLog(url) {
+    const mark = url.indexOf('?');
+    if (mark === -1)
+        return url;
+    const path = url.slice(0, mark);
+    const query = url.slice(mark + 1);
+    let touched = false;
+    const scrubbed = query
+        .split('&')
+        .map((pair) => {
+        if (pair === '')
+            return pair;
+        const eq = pair.indexOf('=');
+        // `?bootToken` with no `=` carries no value to leak; leave it alone.
+        if (eq === -1)
+            return pair;
+        const rawName = pair.slice(0, eq);
+        if (!SENSITIVE_LOWER.has(decodeParamName(rawName).toLowerCase()))
+            return pair;
+        touched = true;
+        return `${rawName}=${REDACTED}`;
+    })
+        .join('&');
+    return touched ? `${path}?${scrubbed}` : url;
+}
+//# sourceMappingURL=log-scrub.js.map

package/dist/log-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-scrub.js","sourceRoot":"","sources":["../src/log-scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,4DAA4D;IAC5D,WAAW;IACX,6EAA6E;IAC7E,8EAA8E;IAC9E,OAAO;IACP,gBAAgB;IAChB,QAAQ;CACT,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE1F,iFAAiF;AACjF,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wEAAwE;QACxE,kDAAkD;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IAE5B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,QAAQ,GAAG,KAAK;SACnB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,qEAAqE;QACrE,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/C,CAAC"}

package/dist/meta/store.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Meta-store resolution + connection (01-architecture.md §3.1, §7.1, §7.2).
+ *
+ * The single place that answers "where does the meta store live, and how do I
+ * open it?" — shared by every front door (`adminium start`, `adminium migrate`,
+ * the init wizard, and, later, Docker/Electron wrappers), so none of them can
+ * disagree about precedence.
+ *
+ * Precedence (§7.2 "Environment always wins over this file"):
+ *   1. `ADMINIUM_META_URL`                       → source `env`
+ *   2. `<dataDir>/adminium.json` `metaUrl`       → source `bootstrap`
+ *      (AES-256-GCM token, decrypted with the ADMINIUM_SECRET-derived key)
+ *   3. embedded SQLite `<dataDir>/meta.db`       → source `embedded`
+ *      — the §3.1 OD-1 fallback for a bare non-interactive `adminium start`;
+ *      callers surface the documented startup warning.
+ *
+ * Drivers are imported dynamically and only for the dialect actually in use: a
+ * SQLite install must not need `pg` on disk, and a missing driver has to say
+ * which package to install rather than throw a bare MODULE_NOT_FOUND.
+ */
+import { type MetaDb } from '@adminium/meta';
+/**
+ * HKDF purpose scope for the bootstrap `metaUrl` token. Distinct from
+ * `adminium:dsn:v1` (source DSNs) and the LLM key salt so the three ciphertexts
+ * can never be decrypted with each other's key (01 §7.1 purpose-scoping).
+ */
+export declare const META_URL_KEY_SALT = "adminium:meta-url:v1";
+export interface MetaUrlCrypto {
+    encrypt(plaintext: string): string;
+    decrypt(token: string): string;
+}
+/** The AES-256-GCM closures the bootstrap `metaUrl` is stored under. */
+export declare function metaUrlCryptoFromSecret(masterSecret: string): MetaUrlCrypto;
+/** Meta dialects the v1 self-host build supports (BRIEF §3). */
+export type MetaEngine = 'postgres' | 'mysql' | 'sqlite';
+/** Which layer supplied the meta DSN — drives the §3.1 OD-1 startup warning. */
+export type MetaUrlSource = 'env' | 'bootstrap' | 'embedded';
+export interface ResolvedMetaUrl {
+    /** The DSN to connect with (`sqlite:<path>` for the embedded fallback). */
+    url: string;
+    engine: MetaEngine;
+    source: MetaUrlSource;
+}
+export declare class MetaUrlError extends Error {
+    readonly name = "MetaUrlError";
+}
+export declare class MetaDriverMissingError extends Error {
+    readonly engine: MetaEngine;
+    readonly pkg: string;
+    readonly name = "MetaDriverMissingError";
+    constructor(engine: MetaEngine, pkg: string, cause?: unknown);
+}
+/** `sqlite:./data/meta.db`, `sqlite::memory:`, `file:./meta.db` → the file path. */
+export declare function sqlitePathFromUrl(url: string): string;
+/**
+ * Classify a meta DSN by scheme. Unknown/unsupported schemes fail fast with the
+ * three supported forms spelled out — the CLI prints this verbatim.
+ */
+export declare function metaEngineFromUrl(url: string): MetaEngine;
+export interface ResolveMetaUrlOptions {
+    /** `ADMINIUM_META_URL`, when set. */
+    metaUrl?: string | undefined;
+    /** `ADMINIUM_DATA_DIR` — hosts the bootstrap file and the embedded meta.db. */
+    dataDir: string;
+    /** `ADMINIUM_SECRET` — derives the key that decrypts the bootstrap `metaUrl`. */
+    secret: string;
+}
+/**
+ * Apply the §7.2 precedence and return the DSN to connect with. Never connects
+ * and never writes — the wizard decides whether to persist a chosen placement.
+ */
+export declare function resolveMetaUrl(opts: ResolveMetaUrlOptions): Promise<ResolvedMetaUrl>;
+/** The §3.1 OD-1 warning callers print when the embedded fallback is in play. */
+export declare function embeddedMetaWarning(url: string): string;
+export interface MetaStoreHandle {
+    meta: MetaDb;
+    /** The DSN this handle was opened with (fed to ConnectionManager `metaDsn`). */
+    url: string;
+    engine: MetaEngine;
+    source: MetaUrlSource;
+    /** Release the pool/handle. Safe to call twice. */
+    close(): Promise<void>;
+}
+export interface ConnectMetaStoreOptions {
+    /** Postgres/MySQL pool size; the single-process topology stays small (01 §4.1). */
+    poolSize?: number | undefined;
+}
+/**
+ * Open the meta store named by `resolved` and run {@link initMetaDb} (the SQLite
+ * FK pragma). Does NOT migrate — `adminium migrate` and the boot sequence decide
+ * when the ledger runs.
+ */
+export declare function connectMetaStore(resolved: ResolvedMetaUrl, opts?: ConnectMetaStoreOptions): Promise<MetaStoreHandle>;
+/** Resolve + connect in one step — what every front door actually calls. */
+export declare function openMetaStore(opts: ResolveMetaUrlOptions & ConnectMetaStoreOptions): Promise<MetaStoreHandle>;
+//# sourceMappingURL=store.d.ts.map

package/dist/meta/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/meta/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAML,KAAK,MAAM,EACZ,MAAM,gBAAgB,CAAC;AAKxB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AAExD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CAChC;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAM3E;AAED,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEzD,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,qBAAa,YAAa,SAAQ,KAAK;IACrC,SAAkB,IAAI,kBAAkB;CACzC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAG7C,QAAQ,CAAC,MAAM,EAAE,UAAU;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM;IAHtB,SAAkB,IAAI,4BAA4B;gBAEvC,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,OAAO;CAQlB;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkBzD;AAED,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAiB1F;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,mDAAmD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAoCD,MAAM,WAAW,uBAAuB;IACtC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,eAAe,CAAC,CA6C1B;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,IAAI,EAAE,qBAAqB,GAAG,uBAAuB,GACpD,OAAO,CAAC,eAAe,CAAC,CAG1B"}

package/dist/meta/store.js

@@ -0,0 +1,192 @@
+/**
+ * Meta-store resolution + connection (01-architecture.md §3.1, §7.1, §7.2).
+ *
+ * The single place that answers "where does the meta store live, and how do I
+ * open it?" — shared by every front door (`adminium start`, `adminium migrate`,
+ * the init wizard, and, later, Docker/Electron wrappers), so none of them can
+ * disagree about precedence.
+ *
+ * Precedence (§7.2 "Environment always wins over this file"):
+ *   1. `ADMINIUM_META_URL`                       → source `env`
+ *   2. `<dataDir>/adminium.json` `metaUrl`       → source `bootstrap`
+ *      (AES-256-GCM token, decrypted with the ADMINIUM_SECRET-derived key)
+ *   3. embedded SQLite `<dataDir>/meta.db`       → source `embedded`
+ *      — the §3.1 OD-1 fallback for a bare non-interactive `adminium start`;
+ *      callers surface the documented startup warning.
+ *
+ * Drivers are imported dynamically and only for the dialect actually in use: a
+ * SQLite install must not need `pg` on disk, and a missing driver has to say
+ * which package to install rather than throw a bare MODULE_NOT_FOUND.
+ */
+import { mkdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { createMysqlMetaDb, createPostgresMetaDb, createSqliteMetaDb, destroyMetaDb, initMetaDb, } from '@adminium/meta';
+import { readBootstrap } from '../config/bootstrap.js';
+import { decryptSecret, deriveKey, encryptSecret } from '../config/secrets.js';
+/**
+ * HKDF purpose scope for the bootstrap `metaUrl` token. Distinct from
+ * `adminium:dsn:v1` (source DSNs) and the LLM key salt so the three ciphertexts
+ * can never be decrypted with each other's key (01 §7.1 purpose-scoping).
+ */
+export const META_URL_KEY_SALT = 'adminium:meta-url:v1';
+/** The AES-256-GCM closures the bootstrap `metaUrl` is stored under. */
+export function metaUrlCryptoFromSecret(masterSecret) {
+    const key = deriveKey(masterSecret, META_URL_KEY_SALT);
+    return {
+        encrypt: (plaintext) => encryptSecret(plaintext, key),
+        decrypt: (token) => decryptSecret(token, key),
+    };
+}
+export class MetaUrlError extends Error {
+    name = 'MetaUrlError';
+}
+export class MetaDriverMissingError extends Error {
+    engine;
+    pkg;
+    name = 'MetaDriverMissingError';
+    constructor(engine, pkg, cause) {
+        super(`The ${engine} meta store needs the "${pkg}" package, which is not installed. ` +
+            `Install it (\`npm install ${pkg}\`) or point ADMINIUM_META_URL at a different engine.`, cause === undefined ? undefined : { cause });
+        this.engine = engine;
+        this.pkg = pkg;
+    }
+}
+/** `sqlite:./data/meta.db`, `sqlite::memory:`, `file:./meta.db` → the file path. */
+export function sqlitePathFromUrl(url) {
+    const withoutScheme = url.replace(/^(sqlite3?|file):(\/\/)?/, '');
+    return withoutScheme === '' ? ':memory:' : withoutScheme;
+}
+/**
+ * Classify a meta DSN by scheme. Unknown/unsupported schemes fail fast with the
+ * three supported forms spelled out — the CLI prints this verbatim.
+ */
+export function metaEngineFromUrl(url) {
+    const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(url)?.[1]?.toLowerCase();
+    switch (scheme) {
+        case 'postgres':
+        case 'postgresql':
+            return 'postgres';
+        case 'mysql':
+        case 'mariadb':
+            return 'mysql';
+        case 'sqlite':
+        case 'sqlite3':
+        case 'file':
+            return 'sqlite';
+        default:
+            throw new MetaUrlError(`Unsupported meta-store DSN "${url}". Use postgres://…, mysql://…, or sqlite:<path>.`);
+    }
+}
+/**
+ * Apply the §7.2 precedence and return the DSN to connect with. Never connects
+ * and never writes — the wizard decides whether to persist a chosen placement.
+ */
+export async function resolveMetaUrl(opts) {
+    if (opts.metaUrl !== undefined && opts.metaUrl !== '') {
+        return { url: opts.metaUrl, engine: metaEngineFromUrl(opts.metaUrl), source: 'env' };
+    }
+    const bootstrap = await readBootstrap(opts.dataDir);
+    if (bootstrap?.metaUrl !== undefined) {
+        const url = metaUrlCryptoFromSecret(opts.secret).decrypt(bootstrap.metaUrl);
+        return { url, engine: metaEngineFromUrl(url), source: 'bootstrap' };
+    }
+    // §3.1 OD-1: nothing configured → embedded SQLite under the data dir.
+    return {
+        url: `sqlite:${join(resolve(opts.dataDir), 'meta.db')}`,
+        engine: 'sqlite',
+        source: 'embedded',
+    };
+}
+/** The §3.1 OD-1 warning callers print when the embedded fallback is in play. */
+export function embeddedMetaWarning(url) {
+    return (`Using embedded SQLite meta store at ${sqlitePathFromUrl(url)} — ` +
+        'set ADMINIUM_META_URL for production.');
+}
+/**
+ * Dynamic driver import. The specifier is computed so the module graph carries
+ * no static edge to a driver an install may not have (01 §2.3 keeps `@adminium/meta`
+ * driver-free; the composing layer — this one — injects them).
+ */
+async function importDriver(pkg, engine) {
+    const specifier = pkg;
+    try {
+        return (await import(specifier));
+    }
+    catch (error) {
+        throw new MetaDriverMissingError(engine, pkg, error);
+    }
+}
+function defaultExport(mod) {
+    return (mod.default ?? mod);
+}
+/**
+ * Pick a named export off a CJS driver, tolerating both the namespace and the
+ * `default` interop shapes (`pg` and `mysql2` differ under NodeNext ESM).
+ * Returns `never`-typed factories: the drivers are untyped here on purpose —
+ * `@adminium/meta` owns the real Kysely config contract.
+ */
+function driverExport(mod, name, engine, pkg) {
+    const direct = mod[name];
+    const viaDefault = mod.default?.[name];
+    const found = direct ?? viaDefault;
+    if (typeof found !== 'function') {
+        throw new MetaDriverMissingError(engine, pkg);
+    }
+    return found;
+}
+/**
+ * Open the meta store named by `resolved` and run {@link initMetaDb} (the SQLite
+ * FK pragma). Does NOT migrate — `adminium migrate` and the boot sequence decide
+ * when the ledger runs.
+ */
+export async function connectMetaStore(resolved, opts = {}) {
+    const poolSize = opts.poolSize ?? 10;
+    let meta;
+    switch (resolved.engine) {
+        case 'postgres': {
+            const mod = await importDriver('pg', 'postgres');
+            const Pool = driverExport(mod, 'Pool', 'postgres', 'pg');
+            meta = createPostgresMetaDb({
+                pool: new Pool({ connectionString: resolved.url, max: poolSize }),
+            });
+            break;
+        }
+        case 'mysql': {
+            const mod = await importDriver('mysql2', 'mysql');
+            const createPool = driverExport(mod, 'createPool', 'mysql', 'mysql2');
+            meta = createMysqlMetaDb({ pool: createPool({ uri: resolved.url, connectionLimit: poolSize }) });
+            break;
+        }
+        case 'sqlite': {
+            const mod = await importDriver('better-sqlite3', 'sqlite');
+            const Database = defaultExport(mod);
+            const file = sqlitePathFromUrl(resolved.url);
+            // A first `adminium start` points at <dataDir>/meta.db before <dataDir>
+            // exists; better-sqlite3 will not create the parent directory itself.
+            if (file !== ':memory:')
+                mkdirSync(dirname(resolve(file)), { recursive: true });
+            meta = createSqliteMetaDb({ database: new Database(file) });
+            break;
+        }
+    }
+    await initMetaDb(meta);
+    let closed = false;
+    return {
+        meta,
+        url: resolved.url,
+        engine: resolved.engine,
+        source: resolved.source,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            await destroyMetaDb(meta);
+        },
+    };
+}
+/** Resolve + connect in one step — what every front door actually calls. */
+export async function openMetaStore(opts) {
+    const resolved = await resolveMetaUrl(opts);
+    return connectMetaStore(resolved, { poolSize: opts.poolSize });
+}
+//# sourceMappingURL=store.js.map

package/dist/meta/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/meta/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,UAAU,GAEX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAOxD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC;QACrD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC;KAC9C,CAAC;AACJ,CAAC;AAeD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,cAAc,CAAC;CACzC;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGpC;IACA;IAHO,IAAI,GAAG,wBAAwB,CAAC;IAClD,YACW,MAAkB,EAClB,GAAW,EACpB,KAAe;QAEf,KAAK,CACH,OAAO,MAAM,0BAA0B,GAAG,qCAAqC;YAC7E,6BAA6B,GAAG,uDAAuD,EACzF,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAC5C,CAAC;QARO,WAAM,GAAN,MAAM,CAAY;QAClB,QAAG,GAAH,GAAG,CAAQ;IAQtB,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACtE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,UAAU,CAAC;QACpB,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB;YACE,MAAM,IAAI,YAAY,CACpB,+BAA+B,GAAG,mDAAmD,CACtF,CAAC;IACN,CAAC;AACH,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA2B;IAC9D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,SAAS,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtE,CAAC;IAED,sEAAsE;IACtE,OAAO;QACL,GAAG,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE;QACvD,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,CACL,uCAAuC,iBAAiB,CAAC,GAAG,CAAC,KAAK;QAClE,uCAAuC,CACxC,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,MAAkB;IACzD,MAAM,SAAS,GAAG,GAAG,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAA4B,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAI,GAA4B;IACpD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAM,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAI,GAA4B,EAAE,IAAY,EAAE,MAAkB,EAAE,GAAW;IAClG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,UAAU,GAAI,GAAG,CAAC,OAA+C,EAAE,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAyB,EACzB,OAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,IAAI,IAAY,CAAC;IAEjB,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,YAAY,CAAiC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YACzF,IAAI,GAAG,oBAAoB,CAAC;gBAC1B,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,YAAY,CAA6B,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClG,IAAI,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,MAAM;QACR,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,aAAa,CAA8B,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7C,wEAAwE;YACxE,sEAAsE;YACtE,IAAI,IAAI,KAAK,UAAU;gBAAE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,IAAI,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK,CAAC,KAAK;YACT,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAqD;IAErD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AACjE,CAAC"}