@adminiumjs/adminium 0.1.0-rc.1

package/dist/widget-data/cache.d.ts

@@ -0,0 +1,35 @@
+/**
+ * In-memory widget-data result cache (04-widget-registry.md §5.2 step 6).
+ *
+ * Keyed on `sha256(descriptor + params + connection + role scope)` so two
+ * callers with different role sets (or unmask grants) never share entries.
+ * TTL defaults to 30 s (constructor-configurable; 04 specifies
+ * `min(binding.refreshInterval ?? 60, 60)` — the binding's interval lives
+ * client-side, so the server applies a flat conservative TTL for now).
+ *
+ * `invalidateTable(connectionId, tableId)` drops a table's entries — the
+ * CRUD mutation hook wires into it when the widget-data plugin and data
+ * routes share one composition root (start.ts wiring, M4 exit). No
+ * cross-process cache by design (works identically inside Electron).
+ */
+export declare const WIDGET_CACHE_TTL_MS = 30000;
+export declare function cacheKeyOf(input: {
+    descriptor: unknown;
+    params: unknown;
+    connectionId: string;
+    roleScope: string;
+}): string;
+export declare class WidgetDataCache {
+    #private;
+    constructor(opts?: {
+        ttlMs?: number | undefined;
+        now?: (() => number) | undefined;
+    });
+    get(key: string): unknown | undefined;
+    set(key: string, value: unknown, connectionId: string, tableId: string): void;
+    /** Drop every cached result over one table (CRUD mutation invalidation). */
+    invalidateTable(connectionId: string, tableId: string): void;
+    clear(): void;
+    get size(): number;
+}
+//# sourceMappingURL=cache.d.ts.map

package/dist/widget-data/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/widget-data/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAU1C,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAET;AAED,qBAAa,eAAe;;gBAKd,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAA;KAAO;IAKvF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAUrC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAa7E,4EAA4E;IAC5E,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAO5D,KAAK,IAAI,IAAI;IAIb,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/widget-data/cache.js

@@ -0,0 +1,67 @@
+/**
+ * In-memory widget-data result cache (04-widget-registry.md §5.2 step 6).
+ *
+ * Keyed on `sha256(descriptor + params + connection + role scope)` so two
+ * callers with different role sets (or unmask grants) never share entries.
+ * TTL defaults to 30 s (constructor-configurable; 04 specifies
+ * `min(binding.refreshInterval ?? 60, 60)` — the binding's interval lives
+ * client-side, so the server applies a flat conservative TTL for now).
+ *
+ * `invalidateTable(connectionId, tableId)` drops a table's entries — the
+ * CRUD mutation hook wires into it when the widget-data plugin and data
+ * routes share one composition root (start.ts wiring, M4 exit). No
+ * cross-process cache by design (works identically inside Electron).
+ */
+import { createHash } from 'node:crypto';
+export const WIDGET_CACHE_TTL_MS = 30_000;
+const MAX_ENTRIES = 500;
+export function cacheKeyOf(input) {
+    return createHash('sha256').update(JSON.stringify(input)).digest('hex');
+}
+export class WidgetDataCache {
+    #ttlMs;
+    #now;
+    #entries = new Map();
+    constructor(opts = {}) {
+        this.#ttlMs = opts.ttlMs ?? WIDGET_CACHE_TTL_MS;
+        this.#now = opts.now ?? Date.now;
+    }
+    get(key) {
+        const entry = this.#entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        if (entry.expiresAt <= this.#now()) {
+            this.#entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    set(key, value, connectionId, tableId) {
+        // FIFO eviction at the cap — Map iteration order is insertion order.
+        if (!this.#entries.has(key) && this.#entries.size >= MAX_ENTRIES) {
+            const oldest = this.#entries.keys().next().value;
+            if (oldest !== undefined)
+                this.#entries.delete(oldest);
+        }
+        this.#entries.set(key, {
+            value,
+            expiresAt: this.#now() + this.#ttlMs,
+            tableKey: `${connectionId}:${tableId}`,
+        });
+    }
+    /** Drop every cached result over one table (CRUD mutation invalidation). */
+    invalidateTable(connectionId, tableId) {
+        const tableKey = `${connectionId}:${tableId}`;
+        for (const [key, entry] of this.#entries) {
+            if (entry.tableKey === tableKey)
+                this.#entries.delete(key);
+        }
+    }
+    clear() {
+        this.#entries.clear();
+    }
+    get size() {
+        return this.#entries.size;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/widget-data/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/widget-data/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,MAAM,WAAW,GAAG,GAAG,CAAC;AASxB,MAAM,UAAU,UAAU,CAAC,KAK1B;IACC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,OAAO,eAAe;IACjB,MAAM,CAAS;IACf,IAAI,CAAe;IACnB,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAElD,YAAY,OAAyE,EAAE;QACrF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,YAAoB,EAAE,OAAe;QACpE,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;YACrB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM;YACpC,QAAQ,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;IAED,4EAA4E;IAC5E,eAAe,CAAC,YAAoB,EAAE,OAAe;QACnD,MAAM,QAAQ,GAAG,GAAG,YAAY,IAAI,OAAO,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;CACF"}

package/dist/widget-data/compiler.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Query-descriptor compiler (04-widget-registry.md §5.2, M4-T04 subset).
+ *
+ * Turns a validated `QueryDescriptor` (the pure-Zod leaf shared through
+ * `@adminium/engine/config`) into dynamic Kysely over the data connection.
+ * Invariants, identical to the CRUD layer (08-server-api.md §7 item 1):
+ *
+ * - every table/column string that reaches SQL is the schema snapshot's own
+ *   (`SnapshotView` resolution → 422 `UNKNOWN_IDENTIFIER` otherwise);
+ * - PII-masked columns may not be selected, filtered, grouped, bucketed,
+ *   aggregated, or sorted by callers without the unmask grant → 403
+ *   `COLUMN_FORBIDDEN` (04 §5.2 step 3);
+ * - all values bind as parameters; the only inlined token is the bucket
+ *   unit, drawn from a closed Zod enum.
+ *
+ * M4 scope notes: shapes compiled here are `single-metric`, `metric+delta`,
+ * `timeseries`, `categorical`, and `record-list` (the M4 widget set).
+ * `percentile` aggregations and the remaining shapes reject with 422 until
+ * 04-T09/T10.
+ *
+ * Dialect divergence (04 §5.2 step 4): time bucketing and rolling-window
+ * bounds are the two clauses whose SQL differs per engine. Rather than a
+ * kysely-typed adapter hook (the `@adminium/engine/adapter` `QueryEngine`
+ * contract must stay free of a `kysely` dependency — it types the dialect
+ * opaquely), the compiler branches on the connection's engine here, where
+ * kysely and the rest of the SQL compilation already live: `bucketExpr()`
+ * emits `date_trunc` / `strftime` / `DATE_FORMAT` per dialect, and window
+ * boundaries bind as a `Date` on Postgres but as a UTC `'YYYY-MM-DD
+ * HH:MM:SS'` string on MySQL/SQLite (better-sqlite3 refuses to bind a
+ * `Date`).
+ */
+import { type Kysely, type SelectQueryBuilder } from 'kysely';
+import type { BucketUnit, QueryDescriptor } from '@adminium/engine/config';
+import type { Dialect } from '@adminium/engine';
+import type { SourceDatabase } from '../connections/manager.js';
+import { type FilterCondition } from '../crud/filters.js';
+import type { ResolvedColumn, ResolvedTable, SnapshotView } from '../crud/identifiers.js';
+/** Hard row cap on any compiled query (04 §5.2 guardrails). */
+export declare const WIDGET_LIMIT_MAX = 1000;
+/** Default page size for `record-list` descriptors without a `limit`. */
+export declare const RECORD_LIST_LIMIT_DEFAULT = 50;
+/** Group-by cardinality cap — excess folds into `__other` (04 §5.2). */
+export declare const GROUP_BUCKET_CAP = 500;
+/** Reserved output aliases the shaper relies on. */
+export declare const BUCKET_ALIAS = "__bucket";
+export declare const GROUP_ALIAS = "__group";
+type Qb = SelectQueryBuilder<SourceDatabase, string, Record<string, unknown>>;
+export interface CompileWidgetQueryOptions {
+    db: Kysely<SourceDatabase>;
+    view: SnapshotView;
+    descriptor: QueryDescriptor;
+    /** Page-control params for late-bound filters (`filters[].param`). */
+    params?: Record<string, unknown> | undefined;
+    canReadPii: boolean;
+    /** Source dialect — threads into the shared filter compiler (`ilike` per dialect). */
+    dialect: Dialect;
+    /** Injectable clock for `window` bounds (tests). */
+    now?: (() => Date) | undefined;
+}
+export interface CompiledWidgetQuery {
+    table: ResolvedTable;
+    shape: QueryDescriptor['shape'];
+    /** The main query, ready to `.execute()`. */
+    query: Qb;
+    /** Prior-window twin (`window.compareToPrior`) — same shape, shifted back. */
+    prior: Qb | null;
+    /** Output aliases of the requested aggregations, in order. */
+    aggregationAliases: string[];
+    /** Set when the query buckets by time (`timeseries`). */
+    bucketAlias: string | null;
+    /** Set when the query groups by a column (`categorical`). */
+    groupAlias: string | null;
+    /** Resolved columns of a `record-list` SELECT (masking metadata). */
+    selectedColumns: ResolvedColumn[];
+    /** Exact-count twin for `record-list` (fills `RecordList.total`). */
+    count: Qb | null;
+    /** Effective LIMIT after the hard cap. */
+    limit: number;
+}
+/** Resolve the descriptor's source against the snapshot (422 on unknown). */
+export declare function resolveSource(view: SnapshotView, descriptor: QueryDescriptor): ResolvedTable;
+/**
+ * UTC window boundaries for `window: { last, unit }` plus the immediately
+ * preceding window of the same span (04 §5.2 step 5). Calendar units go
+ * through UTC calendar arithmetic so month/quarter/year windows stay exact.
+ */
+export declare function windowBounds(last: number, unit: BucketUnit, now: Date): {
+    start: Date;
+    end: Date;
+    priorStart: Date;
+    priorEnd: Date;
+};
+/**
+ * Late-bound `param` resolution (04 §5.1): a filter carrying `param` reads
+ * its value from the page-control params; an unset param drops the filter
+ * (the control is not active). Filters with neither value nor param pass
+ * through — `is_null`/`not_null` need no value.
+ */
+export declare function resolveFilterParams(filters: NonNullable<QueryDescriptor['filters']>, params: Record<string, unknown>): FilterCondition[];
+/**
+ * Compile one descriptor to dynamic Kysely. Identifier resolution and PII
+ * checks happen here; RBAC on the resolved table is the route's job (it
+ * needs the request principal).
+ */
+export declare function compileWidgetQuery(opts: CompileWidgetQueryOptions): CompiledWidgetQuery;
+export {};
+//# sourceMappingURL=compiler.d.ts.map

package/dist/widget-data/compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../src/widget-data/compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAA2B,KAAK,MAAM,EAAmB,KAAK,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AACxG,OAAO,KAAK,EAAe,UAAU,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAA4C,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE1F,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAC5C,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,oDAAoD;AACpD,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,WAAW,YAAY,CAAC;AAerC,KAAK,EAAE,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE9E,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3B,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,eAAe,CAAC;IAC5B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;IAChC,6CAA6C;IAC7C,KAAK,EAAE,EAAE,CAAC;IACV,8EAA8E;IAC9E,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC;IACjB,8DAA8D;IAC9D,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,yDAAyD;IACzD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,6DAA6D;IAC7D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,qEAAqE;IACrE,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,qEAAqE;IACrE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,GAAG,aAAa,CAG5F;AAMD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,IAAI,GACR;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,CA2B9D;AAsHD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,EAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,eAAe,EAAE,CAgBnB;AAgCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,mBAAmB,CAwHvF"}

package/dist/widget-data/compiler.js

@@ -0,0 +1,362 @@
+/**
+ * Query-descriptor compiler (04-widget-registry.md §5.2, M4-T04 subset).
+ *
+ * Turns a validated `QueryDescriptor` (the pure-Zod leaf shared through
+ * `@adminium/engine/config`) into dynamic Kysely over the data connection.
+ * Invariants, identical to the CRUD layer (08-server-api.md §7 item 1):
+ *
+ * - every table/column string that reaches SQL is the schema snapshot's own
+ *   (`SnapshotView` resolution → 422 `UNKNOWN_IDENTIFIER` otherwise);
+ * - PII-masked columns may not be selected, filtered, grouped, bucketed,
+ *   aggregated, or sorted by callers without the unmask grant → 403
+ *   `COLUMN_FORBIDDEN` (04 §5.2 step 3);
+ * - all values bind as parameters; the only inlined token is the bucket
+ *   unit, drawn from a closed Zod enum.
+ *
+ * M4 scope notes: shapes compiled here are `single-metric`, `metric+delta`,
+ * `timeseries`, `categorical`, and `record-list` (the M4 widget set).
+ * `percentile` aggregations and the remaining shapes reject with 422 until
+ * 04-T09/T10.
+ *
+ * Dialect divergence (04 §5.2 step 4): time bucketing and rolling-window
+ * bounds are the two clauses whose SQL differs per engine. Rather than a
+ * kysely-typed adapter hook (the `@adminium/engine/adapter` `QueryEngine`
+ * contract must stay free of a `kysely` dependency — it types the dialect
+ * opaquely), the compiler branches on the connection's engine here, where
+ * kysely and the rest of the SQL compilation already live: `bucketExpr()`
+ * emits `date_trunc` / `strftime` / `DATE_FORMAT` per dialect, and window
+ * boundaries bind as a `Date` on Postgres but as a UTC `'YYYY-MM-DD
+ * HH:MM:SS'` string on MySQL/SQLite (better-sqlite3 refuses to bind a
+ * `Date`).
+ */
+import { sql } from 'kysely';
+import { ValidationFailedError } from '../errors.js';
+import { compileFilter } from '../crud/filters.js';
+/** Hard row cap on any compiled query (04 §5.2 guardrails). */
+export const WIDGET_LIMIT_MAX = 1000;
+/** Default page size for `record-list` descriptors without a `limit`. */
+export const RECORD_LIST_LIMIT_DEFAULT = 50;
+/** Group-by cardinality cap — excess folds into `__other` (04 §5.2). */
+export const GROUP_BUCKET_CAP = 500;
+/** Reserved output aliases the shaper relies on. */
+export const BUCKET_ALIAS = '__bucket';
+export const GROUP_ALIAS = '__group';
+const ALIAS_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]{0,62}$/;
+const SUPPORTED_SHAPES = new Set([
+    'single-metric',
+    'metric+delta',
+    'timeseries',
+    'categorical',
+    'record-list',
+    // Live feed snapshot (04 §5.3): compiled exactly like `record-list` (recent
+    // rows, DESC), shaped into a `StreamShape` with the resolved WS channel.
+    'stream',
+]);
+/** Resolve the descriptor's source against the snapshot (422 on unknown). */
+export function resolveSource(view, descriptor) {
+    const { schema, name } = descriptor.source;
+    return view.table(schema === undefined ? name : `${schema}.${name}`);
+}
+function reject(message, details) {
+    throw new ValidationFailedError(message, details);
+}
+/**
+ * UTC window boundaries for `window: { last, unit }` plus the immediately
+ * preceding window of the same span (04 §5.2 step 5). Calendar units go
+ * through UTC calendar arithmetic so month/quarter/year windows stay exact.
+ */
+export function windowBounds(last, unit, now) {
+    const shift = (from, steps) => {
+        const d = new Date(from.getTime());
+        switch (unit) {
+            case 'hour':
+                d.setTime(d.getTime() - steps * 3_600_000);
+                return d;
+            case 'day':
+                d.setTime(d.getTime() - steps * 86_400_000);
+                return d;
+            case 'week':
+                d.setTime(d.getTime() - steps * 7 * 86_400_000);
+                return d;
+            case 'month':
+                d.setUTCMonth(d.getUTCMonth() - steps);
+                return d;
+            case 'quarter':
+                d.setUTCMonth(d.getUTCMonth() - steps * 3);
+                return d;
+            case 'year':
+                d.setUTCFullYear(d.getUTCFullYear() - steps);
+                return d;
+        }
+    };
+    const end = now;
+    const start = shift(end, last);
+    return { start, end, priorStart: shift(start, last), priorEnd: start };
+}
+/**
+ * Time-bucket expression, compiled per dialect (04 §5.2 step 4). Every bucket
+ * evaluates to the ISO-lexicographic start of its period, so `GROUP BY` /
+ * `ORDER BY` over the raw expression sort chronologically and the shaper's
+ * `toIso` parses the result the same way for all three engines. The unit is a
+ * closed Zod enum and every format token is a source constant — no caller
+ * string is inlined; the only interpolation is the snapshot's own column ref.
+ */
+function bucketExpr(dialect, ref, unit) {
+    switch (dialect) {
+        case 'mysql':
+            return mysqlBucketExpr(ref, unit);
+        case 'sqlite':
+            return sqliteBucketExpr(ref, unit);
+        // 'postgres' and the schema-only 'generic' fall through to date_trunc,
+        // which covers every unit natively.
+        default:
+            return sql `date_trunc(${sql.lit(unit)}, ${ref})`;
+    }
+}
+/** MySQL bucket start (`DATE_FORMAT` / calendar arithmetic). */
+function mysqlBucketExpr(ref, unit) {
+    switch (unit) {
+        case 'hour':
+            return sql `date_format(${ref}, '%Y-%m-%d %H:00:00')`;
+        case 'day':
+            return sql `date_format(${ref}, '%Y-%m-%d')`;
+        case 'week':
+            // WEEKDAY() is 0=Monday…6=Sunday, so subtracting it lands on the ISO
+            // Monday — matching Postgres `date_trunc('week', …)`.
+            return sql `date_sub(date(${ref}), interval weekday(${ref}) day)`;
+        case 'month':
+            return sql `date_format(${ref}, '%Y-%m-01')`;
+        case 'quarter':
+            return sql `date(makedate(year(${ref}), 1) + interval (quarter(${ref}) - 1) quarter)`;
+        case 'year':
+            return sql `date_format(${ref}, '%Y-01-01')`;
+    }
+}
+/** SQLite bucket start (`strftime` over ISO-text/epoch storage). */
+function sqliteBucketExpr(ref, unit) {
+    switch (unit) {
+        case 'hour':
+            return sql `strftime('%Y-%m-%d %H:00:00', ${ref})`;
+        case 'day':
+            return sql `strftime('%Y-%m-%d', ${ref})`;
+        case 'week':
+            // (%w + 6) % 7 remaps SQLite's 0=Sunday…6=Saturday to 0=Monday, so the
+            // offset subtracted lands on the ISO Monday (as Postgres/MySQL do).
+            return sql `date(${ref}, '-' || ((strftime('%w', ${ref}) + 6) % 7) || ' days')`;
+        case 'month':
+            return sql `strftime('%Y-%m-01', ${ref})`;
+        case 'quarter':
+            return sql `strftime('%Y', ${ref}) || '-' || printf('%02d', ((cast(strftime('%m', ${ref}) as integer) - 1) / 3) * 3 + 1) || '-01'`;
+        case 'year':
+            return sql `strftime('%Y-01-01', ${ref})`;
+    }
+}
+/**
+ * A rolling-window boundary as the source driver expects it: Postgres binds
+ * the `Date` directly (timestamptz), but MySQL and SQLite take a UTC
+ * `'YYYY-MM-DD HH:MM:SS'` string — `windowBounds` computes in UTC, and
+ * better-sqlite3 refuses to bind a `Date` at all (it accepts only numbers,
+ * strings, bigints, buffers and null).
+ */
+function windowBoundValue(date, dialect) {
+    if (dialect === 'mysql' || dialect === 'sqlite') {
+        return date.toISOString().slice(0, 19).replace('T', ' ');
+    }
+    return date;
+}
+/** Validate + resolve one aggregation; returns its select expression factory. */
+function compileAggregation(db, view, table, canReadPii, aggregation) {
+    if (!ALIAS_PATTERN.test(aggregation.alias) || aggregation.alias.startsWith('__')) {
+        reject('Aggregation aliases must be simple identifiers.', { alias: aggregation.alias });
+    }
+    if (aggregation.fn === 'percentile') {
+        reject('`percentile` aggregations are not supported yet (04-T09).', {});
+    }
+    if (aggregation.column === undefined) {
+        if (aggregation.fn !== 'count') {
+            reject(`Aggregation "${aggregation.fn}" requires a column.`, { alias: aggregation.alias });
+        }
+        return { alias: aggregation.alias, expr: sql `count(*)` };
+    }
+    // 403 COLUMN_FORBIDDEN when masked and the caller lacks the unmask grant.
+    const column = view.readableColumn(table, aggregation.column, canReadPii);
+    const ref = db.dynamic.ref(column.name);
+    switch (aggregation.fn) {
+        case 'count':
+            return { alias: aggregation.alias, expr: sql `count(${ref})` };
+        case 'count_distinct':
+            return { alias: aggregation.alias, expr: sql `count(distinct ${ref})` };
+        case 'sum':
+            return { alias: aggregation.alias, expr: sql `sum(${ref})` };
+        case 'avg':
+            return { alias: aggregation.alias, expr: sql `avg(${ref})` };
+        case 'min':
+            return { alias: aggregation.alias, expr: sql `min(${ref})` };
+        case 'max':
+            return { alias: aggregation.alias, expr: sql `max(${ref})` };
+    }
+}
+/**
+ * Late-bound `param` resolution (04 §5.1): a filter carrying `param` reads
+ * its value from the page-control params; an unset param drops the filter
+ * (the control is not active). Filters with neither value nor param pass
+ * through — `is_null`/`not_null` need no value.
+ */
+export function resolveFilterParams(filters, params) {
+    const out = [];
+    for (const filter of filters) {
+        if (filter.param !== undefined) {
+            const value = params[filter.param];
+            if (value === undefined)
+                continue; // control unset — filter inactive
+            out.push({ column: filter.column, op: filter.op, value });
+            continue;
+        }
+        out.push(filter.value === undefined
+            ? { column: filter.column, op: filter.op }
+            : { column: filter.column, op: filter.op, value: filter.value });
+    }
+    return out;
+}
+/** Shape ⇄ descriptor structural rules (04 §5.2 step 1 semantics). */
+function assertShapeRules(descriptor) {
+    const { shape } = descriptor;
+    if (!SUPPORTED_SHAPES.has(shape)) {
+        reject(`Shape "${shape}" is not supported by the widget-data compiler yet.`, { shape });
+    }
+    const hasAgg = (descriptor.aggregations?.length ?? 0) > 0;
+    const hasGroup = (descriptor.groupBy?.length ?? 0) > 0;
+    const hasBucket = descriptor.bucket !== undefined;
+    if (shape === 'single-metric' || shape === 'metric+delta') {
+        if (!hasAgg)
+            reject(`Shape "${shape}" requires at least one aggregation.`, { shape });
+        if (hasGroup || hasBucket)
+            reject(`Shape "${shape}" cannot group or bucket.`, { shape });
+    }
+    if (shape === 'timeseries') {
+        if (!hasAgg || !hasBucket)
+            reject('Shape "timeseries" requires a `bucket` and an aggregation.', {});
+        if (hasGroup)
+            reject('Grouped timeseries is `multi-timeseries` (not supported yet).', {});
+    }
+    if (shape === 'categorical') {
+        if (!hasAgg)
+            reject('Shape "categorical" requires an aggregation.', {});
+        if ((descriptor.groupBy?.length ?? 0) !== 1) {
+            reject('Shape "categorical" requires exactly one groupBy column.', {});
+        }
+        if (hasBucket)
+            reject('Shape "categorical" cannot time-bucket; use "timeseries".', {});
+    }
+    if ((shape === 'record-list' || shape === 'stream') && (hasAgg || hasGroup || hasBucket)) {
+        reject(`Shape "${shape}" selects rows — aggregations/grouping are not allowed.`, {});
+    }
+}
+/**
+ * Compile one descriptor to dynamic Kysely. Identifier resolution and PII
+ * checks happen here; RBAC on the resolved table is the route's job (it
+ * needs the request principal).
+ */
+export function compileWidgetQuery(opts) {
+    const { db, view, descriptor, canReadPii, dialect } = opts;
+    const params = opts.params ?? {};
+    const now = opts.now ?? (() => new Date());
+    assertShapeRules(descriptor);
+    const table = resolveSource(view, descriptor);
+    const dynamic = db.dynamic;
+    const filterCtx = { view, table, canReadPii, dynamic, dialect };
+    // --- WHERE: descriptor filters (CRUD DSL compiler) + rolling window -------
+    const conditions = descriptor.filters === undefined ? [] : resolveFilterParams(descriptor.filters, params);
+    // Column resolution happens inside compileFilter via readableColumn.
+    const windowColumn = descriptor.window === undefined
+        ? null
+        : view.readableColumn(table, descriptor.window.column, canReadPii);
+    const bounds = descriptor.window === undefined
+        ? null
+        : windowBounds(descriptor.window.last, descriptor.window.unit, now());
+    const applyWhere = (qb, window) => {
+        let out = qb;
+        if (conditions.length > 0) {
+            out = out.where((eb) => compileFilter(eb, filterCtx, { and: conditions }));
+        }
+        if (window !== null && windowColumn !== null) {
+            const ref = dynamic.ref(windowColumn.name);
+            out = out
+                .where((eb) => eb(ref, '>=', windowBoundValue(window.start, dialect)))
+                .where((eb) => eb(ref, '<', windowBoundValue(window.end, dialect)));
+        }
+        return out;
+    };
+    // --- SELECT ----------------------------------------------------------------
+    const aggregations = descriptor.aggregations ?? [];
+    const seenAliases = new Set();
+    const compiledAggs = aggregations.map((aggregation) => {
+        if (seenAliases.has(aggregation.alias)) {
+            reject('Duplicate aggregation alias.', { alias: aggregation.alias });
+        }
+        seenAliases.add(aggregation.alias);
+        return compileAggregation(db, view, table, canReadPii, aggregation);
+    });
+    const shape = descriptor.shape;
+    const rowShape = shape === 'record-list' || shape === 'stream';
+    let selectedColumns = [];
+    const requestedLimit = descriptor.limit ?? (rowShape ? RECORD_LIST_LIMIT_DEFAULT : WIDGET_LIMIT_MAX);
+    const limit = Math.min(Math.max(requestedLimit, 1), WIDGET_LIMIT_MAX);
+    const build = (window) => {
+        let qb = applyWhere(db.selectFrom(table.id), window);
+        if (rowShape) {
+            selectedColumns =
+                descriptor.select !== undefined && descriptor.select.length > 0
+                    ? descriptor.select.map((name) => view.readableColumn(table, name, canReadPii))
+                    : view.selectableColumns(table);
+            qb = qb.select(selectedColumns.map((column) => dynamic.ref(column.name)));
+        }
+        else {
+            qb = qb.select(compiledAggs.map(({ expr, alias }) => expr.as(alias)));
+        }
+        if (shape === 'timeseries' && descriptor.bucket !== undefined) {
+            const bucketColumn = view.readableColumn(table, descriptor.bucket.column, canReadPii);
+            const bucket = bucketExpr(dialect, dynamic.ref(bucketColumn.name), descriptor.bucket.unit);
+            qb = qb.select(bucket.as(BUCKET_ALIAS)).groupBy(bucket).orderBy(bucket, 'asc');
+        }
+        if (shape === 'categorical') {
+            const groupColumn = view.readableColumn(table, descriptor.groupBy[0], canReadPii);
+            const ref = dynamic.ref(groupColumn.name);
+            qb = qb.select(sql `${ref}`.as(GROUP_ALIAS)).groupBy(ref);
+            // Deterministic fold order: biggest buckets first, by the first alias.
+            const first = compiledAggs[0];
+            if (first !== undefined)
+                qb = qb.orderBy(sql.ref(first.alias), 'desc');
+        }
+        for (const key of descriptor.orderBy ?? []) {
+            const column = view.readableColumn(table, key.column, canReadPii);
+            qb = qb.orderBy(dynamic.ref(column.name), key.dir);
+        }
+        // Aggregate-only shapes need no LIMIT; grouped/row shapes get the cap.
+        if (rowShape || shape === 'categorical' || shape === 'timeseries') {
+            qb = qb.limit(limit);
+        }
+        return qb;
+    };
+    const query = build(bounds);
+    const wantsPrior = shape === 'metric+delta' || shape === 'timeseries'
+        ? descriptor.window?.compareToPrior === true
+        : false;
+    const prior = wantsPrior && bounds !== null ? build({ start: bounds.priorStart, end: bounds.priorEnd }) : null;
+    const count = shape === 'record-list'
+        ? applyWhere(db.selectFrom(table.id), bounds).select((eb) => eb.fn.countAll().as('total'))
+        : null;
+    return {
+        table,
+        shape,
+        query,
+        prior,
+        count,
+        aggregationAliases: compiledAggs.map(({ alias }) => alias),
+        bucketAlias: shape === 'timeseries' ? BUCKET_ALIAS : null,
+        groupAlias: shape === 'categorical' ? GROUP_ALIAS : null,
+        selectedColumns,
+        limit,
+    };
+}
+//# sourceMappingURL=compiler.js.map

package/dist/widget-data/compiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.js","sourceRoot":"","sources":["../../src/widget-data/compiler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,GAAG,EAA6E,MAAM,QAAQ,CAAC;AAIxG,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,OAAO,EAAE,aAAa,EAAmD,MAAM,oBAAoB,CAAC;AAGpG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,eAAe;IACf,cAAc;IACd,YAAY;IACZ,aAAa;IACb,aAAa;IACb,4EAA4E;IAC5E,yEAAyE;IACzE,QAAQ;CACT,CAAC,CAAC;AAsCH,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,UAA2B;IAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,OAAiB;IAChD,MAAM,IAAI,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAgB,EAChB,GAAS;IAET,MAAM,KAAK,GAAG,CAAC,IAAU,EAAE,KAAa,EAAQ,EAAE;QAChD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG,SAAS,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC;YACX,KAAK,KAAK;gBACR,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC;gBAC5C,OAAO,CAAC,CAAC;YACX,KAAK,MAAM;gBACT,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;gBAChD,OAAO,CAAC,CAAC;YACX,KAAK,OAAO;gBACV,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;gBACvC,OAAO,CAAC,CAAC;YACX,KAAK,SAAS;gBACZ,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC3C,OAAO,CAAC,CAAC;YACX,KAAK,MAAM;gBACT,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC;gBAC7C,OAAO,CAAC,CAAC;QACb,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAID;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,OAAgB,EAAE,GAAQ,EAAE,IAAgB;IAC9D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,uEAAuE;QACvE,oCAAoC;QACpC;YACE,OAAO,GAAG,CAAA,cAAc,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;IACrD,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,eAAe,CAAC,GAAQ,EAAE,IAAgB;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAA,eAAe,GAAG,wBAAwB,CAAC;QACvD,KAAK,KAAK;YACR,OAAO,GAAG,CAAA,eAAe,GAAG,eAAe,CAAC;QAC9C,KAAK,MAAM;YACT,qEAAqE;YACrE,sDAAsD;YACtD,OAAO,GAAG,CAAA,iBAAiB,GAAG,uBAAuB,GAAG,QAAQ,CAAC;QACnE,KAAK,OAAO;YACV,OAAO,GAAG,CAAA,eAAe,GAAG,eAAe,CAAC;QAC9C,KAAK,SAAS;YACZ,OAAO,GAAG,CAAA,sBAAsB,GAAG,6BAA6B,GAAG,iBAAiB,CAAC;QACvF,KAAK,MAAM;YACT,OAAO,GAAG,CAAA,eAAe,GAAG,eAAe,CAAC;IAChD,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,gBAAgB,CAAC,GAAQ,EAAE,IAAgB;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAA,iCAAiC,GAAG,GAAG,CAAC;QACpD,KAAK,KAAK;YACR,OAAO,GAAG,CAAA,wBAAwB,GAAG,GAAG,CAAC;QAC3C,KAAK,MAAM;YACT,uEAAuE;YACvE,oEAAoE;YACpE,OAAO,GAAG,CAAA,QAAQ,GAAG,6BAA6B,GAAG,yBAAyB,CAAC;QACjF,KAAK,OAAO;YACV,OAAO,GAAG,CAAA,wBAAwB,GAAG,GAAG,CAAC;QAC3C,KAAK,SAAS;YACZ,OAAO,GAAG,CAAA,kBAAkB,GAAG,oDAAoD,GAAG,2CAA2C,CAAC;QACpI,KAAK,MAAM;YACT,OAAO,GAAG,CAAA,wBAAwB,GAAG,GAAG,CAAC;IAC7C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAgB;IACpD,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CACzB,EAA0B,EAC1B,IAAkB,EAClB,KAAoB,EACpB,UAAmB,EACnB,WAAwB;IAExB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,iDAAiD,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,WAAW,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,CAAC,2DAA2D,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,gBAAgB,WAAW,CAAC,EAAE,sBAAsB,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,UAAU,EAAE,CAAC;IAC3D,CAAC;IACD,0EAA0E;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,QAAQ,WAAW,CAAC,EAAE,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,SAAS,GAAG,GAAG,EAAE,CAAC;QAChE,KAAK,gBAAgB;YACnB,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,kBAAkB,GAAG,GAAG,EAAE,CAAC;QACzE,KAAK,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,OAAO,GAAG,GAAG,EAAE,CAAC;QAC9D,KAAK,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,OAAO,GAAG,GAAG,EAAE,CAAC;QAC9D,KAAK,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,OAAO,GAAG,GAAG,EAAE,CAAC;QAC9D,KAAK,KAAK;YACR,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAA,OAAO,GAAG,GAAG,EAAE,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgD,EAChD,MAA+B;IAE/B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS,CAAC,kCAAkC;YACrE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;YAC1C,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,UAA2B;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC7B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,UAAU,KAAK,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC;IAElD,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,UAAU,KAAK,sCAAsC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,IAAI,QAAQ,IAAI,SAAS;YAAE,MAAM,CAAC,UAAU,KAAK,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,4DAA4D,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,QAAQ;YAAE,MAAM,CAAC,+DAA+D,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,0DAA0D,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,SAAS;YAAE,MAAM,CAAC,2DAA2D,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,IAAI,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,CAAC,UAAU,KAAK,yDAAyD,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE3C,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAyB,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAEtF,6EAA6E;IAC7E,MAAM,UAAU,GACd,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1F,qEAAqE;IAErE,MAAM,YAAY,GAChB,UAAU,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GACV,UAAU,CAAC,MAAM,KAAK,SAAS;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1E,MAAM,UAAU,GAAG,CAAC,EAAM,EAAE,MAAyC,EAAM,EAAE;QAC3E,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAW,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC3C,GAAG,GAAG,GAAG;iBACN,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;iBACrE,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACpD,IAAI,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,QAAQ,CAAC;IAC/D,IAAI,eAAe,GAAqB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,CAAC,MAAyC,EAAM,EAAE;QAC9D,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAkB,EAAE,MAAM,CAAC,CAAC;QAEtE,IAAI,QAAQ,EAAE,CAAC;YACb,eAAe;gBACb,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;oBAC7D,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;oBAC/E,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACpC,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,KAAK,KAAK,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3F,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAG,UAAU,CAAC,OAAoB,CAAC,CAAC,CAAW,EAAE,UAAU,CAAC,CAAC;YAC1G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC1C,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACzD,uEAAuE;YACvE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS;gBAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAClE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,uEAAuE;QACvE,IAAI,QAAQ,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAClE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,UAAU,GACd,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,YAAY;QAChD,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI;QAC5C,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,KAAK,GACT,UAAU,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,MAAM,KAAK,GACT,KAAK,KAAK,aAAa;QACrB,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAkB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CACzE,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAC7B;QACH,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC;QAC1D,WAAW,EAAE,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QACzD,UAAU,EAAE,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QACxD,eAAe;QACf,KAAK;KACN,CAAC;AACJ,CAAC"}