@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/widget-data/index.js

@@ -0,0 +1,152 @@
+/**
+ * Widget-data API (04-widget-registry.md §5.2, M4-T04 subset):
+ *
+ * - `POST /api/v1/widget-data/query` — one descriptor → one shaped payload;
+ * - `POST /api/v1/widget-data/batch` — ≤40 `{ instanceId, descriptor }`
+ *   items resolved in parallel with per-item error isolation, so a
+ *   dashboard loads in one round trip and one failing widget never takes
+ *   the page down (acceptance criterion #6).
+ *
+ * Pipeline per item: Zod validation (route schema) → snapshot identifier
+ * resolution → per-table RBAC read check (403 TABLE_FORBIDDEN + audit on
+ * denial) → PII column refusal (403 COLUMN_FORBIDDEN, in the compiler) →
+ * dynamic-Kysely execution on the data connection → §3 envelope shaping →
+ * 30 s in-memory cache keyed on descriptor+params+connection+role scope.
+ */
+import { overridesRepo, snapshotsRepo } from '@adminium/meta';
+import { AppError, ForbiddenError, NotFoundError } from '../../errors.js';
+import { applyOverrides } from '../../connections/effective-schema.js';
+import { SnapshotView } from '../../crud/identifiers.js';
+import { canReadPii } from '../../crud/mask.js';
+import { WidgetDataCache, cacheKeyOf } from '../../widget-data/cache.js';
+import { compileWidgetQuery, resolveSource } from '../../widget-data/compiler.js';
+import { shapeRows, toNumber } from '../../widget-data/shapers.js';
+import { widgetBatchBody, widgetBatchReply, widgetQueryBody, widgetQueryReply } from './schema.js';
+export function widgetDataRoutes(deps) {
+    const { manager, meta } = deps;
+    const cache = deps.cache ?? new WidgetDataCache();
+    const snapshots = snapshotsRepo(meta);
+    const overrides = overridesRepo(meta);
+    const viewCache = new Map();
+    // Same snapshot-view resolution as routes/data — stamped on snapshot id +
+    // active-override set so remaps/masks invalidate immediately.
+    async function viewFor(connectionId) {
+        const snapshot = await snapshots.latest(connectionId);
+        if (snapshot === null) {
+            throw new NotFoundError('No schema snapshot — introspect the connection first.', {
+                connectionId,
+            });
+        }
+        const active = await overrides.listForConnection(connectionId, { status: 'active' });
+        const last = active.at(-1);
+        const stamp = `${snapshot.id}:${String(active.length)}:${last?.id ?? ''}:${String(last?.updatedAt ?? 0)}`;
+        const cached = viewCache.get(connectionId);
+        if (cached !== undefined && cached.stamp === stamp)
+            return cached.view;
+        const view = new SnapshotView(connectionId, applyOverrides(snapshot.schema, active));
+        viewCache.set(connectionId, { stamp, view });
+        return view;
+    }
+    return async (app) => {
+        async function runDescriptor(request, descriptor, params) {
+            const connectionId = descriptor.connectionId;
+            await manager.mustFind(connectionId);
+            const view = await viewFor(connectionId);
+            // Identifier resolution FIRST, then RBAC on the resolved name (08 §5.2).
+            const table = resolveSource(view, descriptor);
+            const permission = `table:${connectionId}:${table.id}:read`;
+            if (!(await request.can(permission))) {
+                await app.rbac.audit(request, {
+                    category: 'rbac',
+                    action: 'permission.denied',
+                    connectionId,
+                    changes: { after: { permission, method: request.method, url: request.url } },
+                });
+                throw new ForbiddenError('You do not have access to this table.', 'TABLE_FORBIDDEN', {
+                    permission,
+                });
+            }
+            const unmasked = await canReadPii(request);
+            const resolution = await app.rbac.resolve(request);
+            const roleScope = `${[...resolution.roleIds].sort().join(',')}${resolution.superAdmin ? '+sa' : ''}:${unmasked ? 'pii' : 'masked'}`;
+            const key = cacheKeyOf({ descriptor, params: params ?? null, connectionId, roleScope });
+            const hit = cache.get(key);
+            if (hit !== undefined)
+                return { result: hit, cached: true };
+            const { db, dialect } = await manager.data(connectionId);
+            const compiled = compileWidgetQuery({
+                db,
+                view,
+                descriptor,
+                params,
+                canReadPii: unmasked,
+                dialect,
+                now: deps.now,
+            });
+            const startedAt = Date.now();
+            const rows = (await compiled.query.execute());
+            const priorRows = compiled.prior === null ? undefined : (await compiled.prior.execute());
+            let total;
+            if (compiled.count !== null) {
+                const countRow = (await compiled.count.executeTakeFirst());
+                total = toNumber(countRow?.total);
+            }
+            const result = shapeRows({ compiled, rows, priorRows, total, canReadPii: unmasked, connectionId });
+            // Execution metrics for the Studio slow-query panel (04 §5.2) — the
+            // structured log line is the v1 sink.
+            request.log.info({
+                widgetData: {
+                    connectionId,
+                    table: compiled.table.id,
+                    shape: compiled.shape,
+                    ms: Date.now() - startedAt,
+                    rows: rows.length,
+                },
+            }, 'widget-data query');
+            cache.set(key, result, connectionId, compiled.table.id);
+            return { result, cached: false };
+        }
+        app.post('/widget-data/query', { schema: { body: widgetQueryBody, response: { 200: widgetQueryReply } } }, async (request) => {
+            await app.rbac.resolve(request); // 401 without a principal
+            return runDescriptor(request, request.body.descriptor, request.body.params);
+        });
+        app.post('/widget-data/batch', { schema: { body: widgetBatchBody, response: { 200: widgetBatchReply } } }, async (request) => {
+            await app.rbac.resolve(request); // 401 without a principal
+            const { requests, params } = request.body;
+            const settled = await Promise.all(requests.map(async (item) => {
+                try {
+                    const outcome = await runDescriptor(request, item.descriptor, params);
+                    return {
+                        instanceId: item.instanceId,
+                        value: { ok: true, result: outcome.result, cached: outcome.cached },
+                    };
+                }
+                catch (error) {
+                    if (error instanceof AppError) {
+                        return {
+                            instanceId: item.instanceId,
+                            value: {
+                                ok: false,
+                                error: { code: error.code, message: error.message, statusCode: error.statusCode },
+                            },
+                        };
+                    }
+                    // Never leak raw driver/SQL text to widgets (04 §4 error state).
+                    request.log.error({ err: error }, 'widget-data batch item failed');
+                    return {
+                        instanceId: item.instanceId,
+                        value: {
+                            ok: false,
+                            error: { code: 'INTERNAL', message: 'The widget query failed.', statusCode: 500 },
+                        },
+                    };
+                }
+            }));
+            const results = {};
+            for (const item of settled)
+                results[item.instanceId] = item.value;
+            return { results };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/widget-data/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/widget-data/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAe,MAAM,gBAAgB,CAAC;AAI3E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAsB,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAgBnG,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,eAAe,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;IAE3E,0EAA0E;IAC1E,8DAA8D;IAC9D,KAAK,UAAU,OAAO,CAAC,YAAoB;QACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,uDAAuD,EAAE;gBAC/E,YAAY;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,QAAQ,CAAC,MAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;QACtG,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,KAAK,UAAU,aAAa,CAC1B,OAAuB,EACvB,UAA2B,EAC3B,MAA2C;YAE3C,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;YAC7C,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;YAEzC,yEAAyE;YACzE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,SAAS,YAAY,IAAI,KAAK,CAAC,EAAE,OAAO,CAAC;YAC5D,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBAC5B,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,mBAAmB;oBAC3B,YAAY;oBACZ,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;iBAC7E,CAAC,CAAC;gBACH,MAAM,IAAI,cAAc,CAAC,uCAAuC,EAAE,iBAAiB,EAAE;oBACnF,UAAU;iBACX,CAAC,CAAC;YACL,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpI,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAE7E,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC;gBAClC,EAAE;gBACF,IAAI;gBACJ,UAAU;gBACV,MAAM;gBACN,UAAU,EAAE,QAAQ;gBACpB,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAU,CAAC;YACvD,MAAM,SAAS,GACb,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAW,CAAC;YACpF,IAAI,KAAyB,CAAC;YAC9B,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAoC,CAAC;gBAC9F,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;YAEnG,oEAAoE;YACpE,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,UAAU,EAAE;oBACV,YAAY;oBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE;oBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAC1B,IAAI,EAAE,IAAI,CAAC,MAAM;iBAClB;aACF,EACD,mBAAmB,CACpB,CAAC;YAEF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;QAED,GAAG,CAAC,IAAI,CACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAC1E,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC3D,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAC1E,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;YAC3D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;oBACtE,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;qBAC7E,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;wBAC9B,OAAO;4BACL,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,KAAK,EAAE;gCACL,EAAE,EAAE,KAAc;gCAClB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;6BAClF;yBACF,CAAC;oBACJ,CAAC;oBACD,iEAAiE;oBACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;oBACnE,OAAO;wBACL,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,KAAK,EAAE;4BACL,EAAE,EAAE,KAAc;4BAClB,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,UAAU,EAAE,GAAG,EAAE;yBAClF;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CACH,CAAC;YACF,MAAM,OAAO,GAAsD,EAAE,CAAC;YACtE,KAAK,MAAM,IAAI,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/widget-data/schema.d.ts

@@ -0,0 +1,252 @@
+/**
+ * Zod schemas for the widget-data routes (04-widget-registry.md §5.2).
+ * The descriptor schema is the shared pure-Zod leaf re-exported through
+ * `@adminium/engine/config` — one validation authority for client bindings,
+ * stored page configs, and this API surface.
+ */
+import { z } from 'zod';
+/** Page-control params for late-bound `filters[].param` references. */
+export declare const widgetParamsSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const widgetQueryBody: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        kind: z.ZodDefault<z.ZodLiteral<"table-query">>;
+        connectionId: z.ZodString;
+        source: z.ZodObject<{
+            schema: z.ZodOptional<z.ZodString>;
+            name: z.ZodString;
+            type: z.ZodDefault<z.ZodEnum<{
+                table: "table";
+                view: "view";
+            }>>;
+        }, z.core.$strip>;
+        shape: z.ZodEnum<{
+            "single-metric": "single-metric";
+            "metric+delta": "metric+delta";
+            timeseries: "timeseries";
+            "multi-timeseries": "multi-timeseries";
+            categorical: "categorical";
+            "record-list": "record-list";
+            record: "record";
+            matrix: "matrix";
+            "hierarchy/tree": "hierarchy/tree";
+            "calendar-events": "calendar-events";
+            "geo-points": "geo-points";
+            flows: "flows";
+            ohlc: "ohlc";
+            distribution: "distribution";
+            "boolean-map": "boolean-map";
+            stream: "stream";
+            "form-state": "form-state";
+            static: "static";
+        }>;
+        select: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        aggregations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            fn: z.ZodEnum<{
+                count: "count";
+                sum: "sum";
+                avg: "avg";
+                min: "min";
+                max: "max";
+                count_distinct: "count_distinct";
+                percentile: "percentile";
+            }>;
+            column: z.ZodOptional<z.ZodString>;
+            p: z.ZodOptional<z.ZodNumber>;
+            alias: z.ZodString;
+        }, z.core.$strip>>>;
+        groupBy: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        bucket: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            unit: z.ZodEnum<{
+                hour: "hour";
+                day: "day";
+                week: "week";
+                month: "month";
+                quarter: "quarter";
+                year: "year";
+            }>;
+        }, z.core.$strip>>;
+        filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            column: z.ZodString;
+            op: z.ZodEnum<{
+                eq: "eq";
+                neq: "neq";
+                gt: "gt";
+                gte: "gte";
+                lt: "lt";
+                lte: "lte";
+                in: "in";
+                like: "like";
+                ilike: "ilike";
+                is_null: "is_null";
+                not_null: "not_null";
+                between: "between";
+            }>;
+            value: z.ZodOptional<z.ZodUnknown>;
+            param: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+        window: z.ZodOptional<z.ZodObject<{
+            column: z.ZodString;
+            last: z.ZodNumber;
+            unit: z.ZodEnum<{
+                hour: "hour";
+                day: "day";
+                week: "week";
+                month: "month";
+                quarter: "quarter";
+                year: "year";
+            }>;
+            compareToPrior: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        orderBy: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            column: z.ZodString;
+            dir: z.ZodEnum<{
+                asc: "asc";
+                desc: "desc";
+            }>;
+        }, z.core.$strip>>>;
+        limit: z.ZodOptional<z.ZodNumber>;
+        cursor: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/** Shaped envelopes are dynamic per shape — validated by the shaper, not here. */
+export declare const shapedPayloadSchema: z.ZodUnknown;
+export declare const widgetQueryReply: z.ZodObject<{
+    result: z.ZodUnknown;
+    cached: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const BATCH_MAX_REQUESTS = 40;
+export declare const widgetBatchBody: z.ZodObject<{
+    requests: z.ZodArray<z.ZodObject<{
+        instanceId: z.ZodString;
+        descriptor: z.ZodObject<{
+            kind: z.ZodDefault<z.ZodLiteral<"table-query">>;
+            connectionId: z.ZodString;
+            source: z.ZodObject<{
+                schema: z.ZodOptional<z.ZodString>;
+                name: z.ZodString;
+                type: z.ZodDefault<z.ZodEnum<{
+                    table: "table";
+                    view: "view";
+                }>>;
+            }, z.core.$strip>;
+            shape: z.ZodEnum<{
+                "single-metric": "single-metric";
+                "metric+delta": "metric+delta";
+                timeseries: "timeseries";
+                "multi-timeseries": "multi-timeseries";
+                categorical: "categorical";
+                "record-list": "record-list";
+                record: "record";
+                matrix: "matrix";
+                "hierarchy/tree": "hierarchy/tree";
+                "calendar-events": "calendar-events";
+                "geo-points": "geo-points";
+                flows: "flows";
+                ohlc: "ohlc";
+                distribution: "distribution";
+                "boolean-map": "boolean-map";
+                stream: "stream";
+                "form-state": "form-state";
+                static: "static";
+            }>;
+            select: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            aggregations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                fn: z.ZodEnum<{
+                    count: "count";
+                    sum: "sum";
+                    avg: "avg";
+                    min: "min";
+                    max: "max";
+                    count_distinct: "count_distinct";
+                    percentile: "percentile";
+                }>;
+                column: z.ZodOptional<z.ZodString>;
+                p: z.ZodOptional<z.ZodNumber>;
+                alias: z.ZodString;
+            }, z.core.$strip>>>;
+            groupBy: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            bucket: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                unit: z.ZodEnum<{
+                    hour: "hour";
+                    day: "day";
+                    week: "week";
+                    month: "month";
+                    quarter: "quarter";
+                    year: "year";
+                }>;
+            }, z.core.$strip>>;
+            filters: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                column: z.ZodString;
+                op: z.ZodEnum<{
+                    eq: "eq";
+                    neq: "neq";
+                    gt: "gt";
+                    gte: "gte";
+                    lt: "lt";
+                    lte: "lte";
+                    in: "in";
+                    like: "like";
+                    ilike: "ilike";
+                    is_null: "is_null";
+                    not_null: "not_null";
+                    between: "between";
+                }>;
+                value: z.ZodOptional<z.ZodUnknown>;
+                param: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+            window: z.ZodOptional<z.ZodObject<{
+                column: z.ZodString;
+                last: z.ZodNumber;
+                unit: z.ZodEnum<{
+                    hour: "hour";
+                    day: "day";
+                    week: "week";
+                    month: "month";
+                    quarter: "quarter";
+                    year: "year";
+                }>;
+                compareToPrior: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            orderBy: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                column: z.ZodString;
+                dir: z.ZodEnum<{
+                    asc: "asc";
+                    desc: "desc";
+                }>;
+            }, z.core.$strip>>>;
+            limit: z.ZodOptional<z.ZodNumber>;
+            cursor: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const widgetBatchItemResult: z.ZodUnion<readonly [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    result: z.ZodUnknown;
+    cached: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        statusCode: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>]>;
+export declare const widgetBatchReply: z.ZodObject<{
+    results: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        result: z.ZodUnknown;
+        cached: z.ZodBoolean;
+    }, z.core.$strip>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        error: z.ZodObject<{
+            code: z.ZodString;
+            message: z.ZodString;
+            statusCode: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/widget-data/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/widget-data/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,wCAAoC,CAAC;AAEpE,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1B,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C,eAAO,MAAM,gBAAgB;;;iBAI3B,CAAC;AAEH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW1B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;mBAMhC,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;iBAG3B,CAAC"}

package/dist/routes/widget-data/schema.js

@@ -0,0 +1,44 @@
+/**
+ * Zod schemas for the widget-data routes (04-widget-registry.md §5.2).
+ * The descriptor schema is the shared pure-Zod leaf re-exported through
+ * `@adminium/engine/config` — one validation authority for client bindings,
+ * stored page configs, and this API surface.
+ */
+import { z } from 'zod';
+import { queryDescriptorSchema } from '@adminium/engine/config';
+/** Page-control params for late-bound `filters[].param` references. */
+export const widgetParamsSchema = z.record(z.string(), z.unknown());
+export const widgetQueryBody = z.object({
+    descriptor: queryDescriptorSchema,
+    params: widgetParamsSchema.optional(),
+});
+/** Shaped envelopes are dynamic per shape — validated by the shaper, not here. */
+export const shapedPayloadSchema = z.unknown();
+export const widgetQueryReply = z.object({
+    result: shapedPayloadSchema,
+    /** True when served from the in-memory TTL cache. */
+    cached: z.boolean(),
+});
+export const BATCH_MAX_REQUESTS = 40;
+export const widgetBatchBody = z.object({
+    requests: z
+        .array(z.object({
+        instanceId: z.string().min(1).max(64),
+        descriptor: queryDescriptorSchema,
+    }))
+        .min(1)
+        .max(BATCH_MAX_REQUESTS),
+    params: widgetParamsSchema.optional(),
+});
+export const widgetBatchItemResult = z.union([
+    z.object({ ok: z.literal(true), result: shapedPayloadSchema, cached: z.boolean() }),
+    z.object({
+        ok: z.literal(false),
+        error: z.object({ code: z.string(), message: z.string(), statusCode: z.number() }),
+    }),
+]);
+export const widgetBatchReply = z.object({
+    /** Keyed by `instanceId`; failures are per-item, never all-or-nothing. */
+    results: z.record(z.string(), widgetBatchItemResult),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/widget-data/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/widget-data/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,qBAAqB;IACjC,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAE/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,mBAAmB;IAC3B,qDAAqD;IACrD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,UAAU,EAAE,qBAAqB;KAClC,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,kBAAkB,CAAC;IAC1B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACnF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC;CACrD,CAAC,CAAC"}

package/dist/setup/service.d.ts

@@ -0,0 +1,63 @@
+/**
+ * First-run setup service (M10-T04, 16-milestones.md M10 + 01-architecture.md
+ * §6). The ONE code path behind both front doors: the `/api/v1/setup/*` routes
+ * the dashboard's first-run wizard drives, and the `adminium init` CLI wizard.
+ * Neither reimplements any of this (M10 risk mitigation: "CLI subcommands share
+ * the same server services as the Studio routes; one code path, two front
+ * doors").
+ *
+ * Framework-free on purpose — no Fastify types cross this boundary. It throws
+ * domain errors (`SetupClosedError`, `WeakPasswordError`) that each front door
+ * maps to its own vocabulary (HTTP envelope / CLI exit code).
+ *
+ * SECURITY (the whole attack surface of a self-hosted first boot): creating the
+ * super admin is once-only by construction. `createFirstSuperAdmin`
+ * (@adminium/meta) claims `system.superAdminCreatedAt` — a PRIMARY KEY row —
+ * inside the same transaction that inserts the user, so a second or concurrent
+ * attempt loses atomically on every dialect. This service adds no second,
+ * weaker gate of its own: it asks meta and reports what meta decided.
+ */
+import { type MetaDb, type User } from '@adminium/meta';
+/** The consent answers the wizard collects (both default OFF — see below). */
+export interface SetupConsent {
+    /** `telemetry.enabled` — anonymous telemetry. Exit criterion: off by default. */
+    telemetry: boolean;
+    /** `updates.checkEnabled` — the release check's outbound call. */
+    updateCheck: boolean;
+}
+export interface CreateSuperAdminInput {
+    email: string;
+    password: string;
+    name?: string | undefined;
+    /** Omitted ⇒ both stay at their registry defaults (false). */
+    consent?: SetupConsent | undefined;
+}
+export interface SetupState {
+    /** True only on a never-bootstrapped instance: zero users AND no claim. */
+    required: boolean;
+    /** Password policy the wizard should enforce client-side too. */
+    passwordMinLength: number;
+}
+/** Bootstrap already happened — permanently closed. Front doors map this to 409. */
+export declare class SetupClosedError extends Error {
+    readonly name = "SetupClosedError";
+    constructor(message?: string);
+}
+/** Password fails the `auth.passwordMinLength` policy. Front doors map to 422. */
+export declare class WeakPasswordError extends Error {
+    readonly name = "WeakPasswordError";
+    readonly minLength: number;
+    constructor(minLength: number);
+}
+export interface SetupServiceDeps {
+    meta: MetaDb;
+    /** argon2id hasher — injected so this module stays free of the auth tree. */
+    hashPassword: (plain: string) => Promise<string>;
+    now?: (() => number) | undefined;
+}
+export interface SetupService {
+    state(): Promise<SetupState>;
+    createSuperAdmin(input: CreateSuperAdminInput): Promise<User>;
+}
+export declare function createSetupService(deps: SetupServiceDeps): SetupService;
+//# sourceMappingURL=service.d.ts.map

package/dist/setup/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/setup/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAOL,KAAK,MAAM,EACX,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAExB,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,SAAS,EAAE,OAAO,CAAC;IACnB,kEAAkE;IAClE,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,8DAA8D;IAC9D,OAAO,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,oFAAoF;AACpF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;gBAChC,OAAO,SAAsC;CAG1D;AAED,kFAAkF;AAClF,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAkB,IAAI,uBAAuB;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,SAAS,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CA0EvE"}

package/dist/setup/service.js

@@ -0,0 +1,103 @@
+/**
+ * First-run setup service (M10-T04, 16-milestones.md M10 + 01-architecture.md
+ * §6). The ONE code path behind both front doors: the `/api/v1/setup/*` routes
+ * the dashboard's first-run wizard drives, and the `adminium init` CLI wizard.
+ * Neither reimplements any of this (M10 risk mitigation: "CLI subcommands share
+ * the same server services as the Studio routes; one code path, two front
+ * doors").
+ *
+ * Framework-free on purpose — no Fastify types cross this boundary. It throws
+ * domain errors (`SetupClosedError`, `WeakPasswordError`) that each front door
+ * maps to its own vocabulary (HTTP envelope / CLI exit code).
+ *
+ * SECURITY (the whole attack surface of a self-hosted first boot): creating the
+ * super admin is once-only by construction. `createFirstSuperAdmin`
+ * (@adminium/meta) claims `system.superAdminCreatedAt` — a PRIMARY KEY row —
+ * inside the same transaction that inserts the user, so a second or concurrent
+ * attempt loses atomically on every dialect. This service adds no second,
+ * weaker gate of its own: it asks meta and reports what meta decided.
+ */
+import { FirstUserExistsError, createFirstSuperAdmin, isBootstrapRequired, seedBuiltinRoles, seedSystemSettings, settingsRepo, } from '@adminium/meta';
+/** Bootstrap already happened — permanently closed. Front doors map this to 409. */
+export class SetupClosedError extends Error {
+    name = 'SetupClosedError';
+    constructor(message = 'Setup has already been completed.') {
+        super(message);
+    }
+}
+/** Password fails the `auth.passwordMinLength` policy. Front doors map to 422. */
+export class WeakPasswordError extends Error {
+    name = 'WeakPasswordError';
+    minLength;
+    constructor(minLength) {
+        super(`Password must be at least ${String(minLength)} characters.`);
+        this.minLength = minLength;
+    }
+}
+export function createSetupService(deps) {
+    const { meta, hashPassword } = deps;
+    const now = deps.now ?? (() => Date.now());
+    const settings = settingsRepo(meta);
+    async function state() {
+        const [required, passwordMinLength] = await Promise.all([
+            isBootstrapRequired(meta),
+            settings.get('auth.passwordMinLength'),
+        ]);
+        return { required, passwordMinLength };
+    }
+    return {
+        state,
+        async createSuperAdmin(input) {
+            const passwordMinLength = await settings.get('auth.passwordMinLength');
+            if (input.password.length < passwordMinLength)
+                throw new WeakPasswordError(passwordMinLength);
+            // Cheap, friendly pre-check. NOT the guard — the guard is the claim
+            // inside createFirstSuperAdmin's transaction, which is what makes a
+            // racing double-submit safe. This only spares the argon2 hash on the
+            // common already-set-up call.
+            if (!(await isBootstrapRequired(meta)))
+                throw new SetupClosedError();
+            const at = now();
+            // Defense in depth for the ONE state that bricks an install permanently:
+            // `createFirstSuperAdmin` needs the `super-admin` role row, no migration
+            // seeds it, and its failure rolls the claim back — so every retry re-fails
+            // and no account can ever be created, by any door. Every boot path now runs
+            // `firstRun` (cli/commands/start.ts), which is where the seed belongs; this
+            // is the backstop for the paths that bypass it (`start --skip-migrate`, an
+            // embedder calling `buildServer` directly, a future front door). Both seeds
+            // are idempotent natural-key upserts and cost one indexed read per key when
+            // already seeded — and they are only reachable while bootstrap is still
+            // open (checked above), so an already-set-up instance never runs them.
+            await seedBuiltinRoles(meta, at);
+            // Seeds `system.instanceId`, which telemetry's payload builder requires:
+            // without it a consenting instance silently reports nothing.
+            await seedSystemSettings(meta, at);
+            let user;
+            try {
+                user = await createFirstSuperAdmin(meta, {
+                    email: input.email,
+                    ...(input.name === undefined ? {} : { name: input.name }),
+                    passwordHash: await hashPassword(input.password),
+                }, at);
+            }
+            catch (error) {
+                // The racer that lost the PK claim lands here.
+                if (error instanceof FirstUserExistsError)
+                    throw new SetupClosedError();
+                throw error;
+            }
+            // Consent is recorded only AFTER the claim is won, so a losing racer can
+            // never rewrite the winner's telemetry answer. Absent ⇒ registry
+            // defaults (both false) stand: telemetry is opt-in, never opt-out.
+            if (input.consent !== undefined) {
+                await settings.set('telemetry.enabled', input.consent.telemetry, { updatedBy: user.id, at });
+                await settings.set('updates.checkEnabled', input.consent.updateCheck, {
+                    updatedBy: user.id,
+                    at,
+                });
+            }
+            return user;
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/setup/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/setup/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,gBAAgB,CAAC;AAyBxB,oFAAoF;AACpF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IAC5C,YAAY,OAAO,GAAG,mCAAmC;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACxB,IAAI,GAAG,mBAAmB,CAAC;IACpC,SAAS,CAAS;IAC3B,YAAY,SAAiB;QAC3B,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAcD,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,UAAU,KAAK;QAClB,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtD,mBAAmB,CAAC,IAAI,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK;QAEL,KAAK,CAAC,gBAAgB,CAAC,KAA4B;YACjD,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;YAE9F,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,8BAA8B;YAC9B,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAErE,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YAEjB,yEAAyE;YACzE,yEAAyE;YACzE,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,uEAAuE;YACvE,MAAM,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjC,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEnC,IAAI,IAAU,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,qBAAqB,CAChC,IAAI,EACJ;oBACE,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;oBACzD,YAAY,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC;iBACjD,EACD,EAAE,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,+CAA+C;gBAC/C,IAAI,KAAK,YAAY,oBAAoB;oBAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;gBACxE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,yEAAyE;YACzE,iEAAiE;YACjE,mEAAmE;YACnE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC7F,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE;oBACpE,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,EAAE;iBACH,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}