@adminiumjs/manifest 0.3.27 → 0.3.29

package/dist/app-grants.d.ts

@@ -0,0 +1,134 @@
+/**
+ * WHAT AN APP'S ROLE MAY BE GIVEN OF AN ADD-ON'S TABLE (`appGrants`).
+ *
+ * An app gives its roles a hold on an add-on's tables (`roles[].tables`): a
+ * hotel's housekeeping moves stock between places, a sales team reads what is
+ * in stock. The table is the add-on's, so the add-on says how far an app may
+ * go on it, on the table itself:
+ *
+ * ```json
+ * { "ref": "suppliers", "columns": [ … ],
+ *   "appGrants": { "actions": ["read"], "readable": ["id", "name", "lead_days", "active"] } }
+ * ```
+ *
+ *  - `actions`: the most an app's role is given here (read, create, update);
+ *  - `readable`: the only columns an app's read shows; absent, every column
+ *    but those `never` names;
+ *  - `writable` / `creatable`: the only columns an app's update may change
+ *    and a new row may be given — named whenever the action is allowed: a
+ *    write is never "every column";
+ *  - `never`: columns no app's grant reaches, whatever else is listed.
+ *
+ * An add-on that says this of one table says it of all of them: a table
+ * without `appGrants` is then given to no app's role. An add-on that says it
+ * of none is held only by its own shape, as before the word: no hold on a
+ * ledger's receipts, read only on a table a ledger's code writes.
+ *
+ * The grant an app asks for is cut to fit (`roleTableHold`): an action or a
+ * column outside the add-on's words is left out and said, by name; a grant on
+ * a table with `appGrants` is always written with its column lists, never
+ * whole. The key and the table's links to other rows are read with any read,
+ * as with every read limit: a link says which row, never what is in it.
+ *
+ * Pure: no I/O, and nothing imported from the manifest's own schema file, so
+ * that file may import this one.
+ */
+import { z } from 'zod';
+import { type ReferenceIssue } from './refs.js';
+import { ROLE_ADD_ON_ACTIONS, type RoleAddOnTable, type RoleLimit } from './roles.js';
+export type RoleAddOnAction = (typeof ROLE_ADD_ON_ACTIONS)[number];
+export declare const appGrantsSchema: z.ZodObject<{
+    actions: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        update: "update";
+        create: "create";
+    }>>;
+    readable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    writable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    creatable: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    never: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type AppGrants = z.infer<typeof appGrantsSchema>;
+/** One of the add-on's tables, as the ceiling reads it. */
+export interface AppGrantTableShape {
+    ref: string;
+    columns: readonly {
+        ref: string;
+        type: string;
+        role?: string | undefined;
+        rules?: {
+            secret?: boolean | undefined;
+        } | undefined;
+    }[];
+    appGrants?: AppGrants | undefined;
+}
+/** One of the add-on's ledgers, as the ceiling reads it. */
+export interface AppGrantLedgerShape {
+    receipts: string;
+    writes?: Readonly<Record<string, unknown>> | undefined;
+}
+/** Whether the add-on says, of any of its tables, what an app's role may be given. */
+export declare const declaresAppGrants: (tables: readonly AppGrantTableShape[]) => boolean;
+/** Everything wrong with an add-on's `appGrants`, against its own tables and ledgers. */
+export declare function appGrantsIssues(tables: readonly AppGrantTableShape[], ledgers: readonly AppGrantLedgerShape[]): ReferenceIssue[];
+/** Why an entry, or part of it, was left out. */
+export type RoleTableSkip = 'unknown-table' | 'unknown-column' | 'ledger-table' | 'not-offered' | 'ceiling';
+/** What an app asked of a table and does not get: whole actions, and columns of an action. */
+export interface RoleTableNarrowed {
+    actions: string[];
+    readable?: string[];
+    writable?: string[];
+    creatable?: string[];
+}
+/** What one app's grant on an add-on's table comes to, against the add-on's words. */
+/** What a settle gave one role of one add-on table: the role's key in the app, and what it holds now. */
+export interface RoleTableResult {
+    /** The role's key in the app. */
+    role: string;
+    addOn: string;
+    table: string;
+    /** What the role holds of the table now by this grant (after any narrowing below). */
+    actions: string[];
+    /** The columns each action reaches; absent, every column (only where the add-on sets no `appGrants`). */
+    readable?: string[];
+    writable?: string[];
+    creatable?: string[];
+    /** What the app asked for and does not get, by name. */
+    narrowed?: RoleTableNarrowed;
+    /** Why the entry, or part of it, was left out. */
+    skipped?: RoleTableSkip;
+}
+export interface RoleTableHold {
+    /** What the role holds of the table by this grant. */
+    actions: RoleAddOnAction[];
+    /** The columns each kept action reaches; absent, every column (only on a table of an add-on that sets no `appGrants`). */
+    readable?: string[];
+    writable?: string[];
+    creatable?: string[];
+    /** The limit the grant is written with: the app's, cut to fit. Absent, the grant is whole. */
+    limit?: RoleLimit;
+    /** What the app asked for and does not get: actions, and each kept or cut action's columns. */
+    narrowed?: RoleTableNarrowed;
+    skipped?: RoleTableSkip;
+}
+/**
+ * What an app's grant on one of an add-on's tables comes to: the add-on's
+ * shape (receipts, ledger tables), the columns it has, and its `appGrants`.
+ * Narrower than asked, never wider; whatever is cut is named.
+ */
+export declare function roleTableHold(entry: RoleAddOnTable, addOn: {
+    tables: readonly AppGrantTableShape[];
+    ledgers: readonly AppGrantLedgerShape[];
+}): RoleTableHold;
+/** Every column, in a list of what a grant reaches: the grant is whole there. */
+export declare const EVERY_COLUMN = "*";
+/**
+ * What `after` holds of a table that `before` did not: actions, and columns
+ * any of its actions reaches (`*`: every column, where before it was some or
+ * none). Null when it holds nothing more.
+ */
+export declare function holdWider(before: Pick<RoleTableHold, 'actions' | 'readable' | 'writable' | 'creatable'> | null, after: Pick<RoleTableHold, 'actions' | 'readable' | 'writable' | 'creatable'>): {
+    actions: string[];
+    columns: string[];
+} | null;
+//# sourceMappingURL=app-grants.d.ts.map

package/dist/app-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-grants.d.ts","sourceRoot":"","sources":["../src/app-grants.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAa,mBAAmB,EAAE,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,eAAO,MAAM,eAAe;;;;;;;;;;kBAajB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,EAAE,CAAC;IACnI,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAED,4DAA4D;AAC5D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,GAAI,QAAQ,SAAS,kBAAkB,EAAE,KAAG,OAAgE,CAAC;AAI3I,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,EAAE,OAAO,EAAE,SAAS,mBAAmB,EAAE,GAAG,cAAc,EAAE,CAsChI;AAED,iDAAiD;AACjD,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,gBAAgB,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,CAAC;AAE5G,8FAA8F;AAC9F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,sFAAsF;AACtF,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,kDAAkD;IAClD,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,8FAA8F;IAC9F,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AASD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,GAAG,aAAa,CA+G7J;AAED,iFAAiF;AACjF,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAiB/O"}

package/dist/app-grants.js

@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * WHAT AN APP'S ROLE MAY BE GIVEN OF AN ADD-ON'S TABLE (`appGrants`).
+ *
+ * An app gives its roles a hold on an add-on's tables (`roles[].tables`): a
+ * hotel's housekeeping moves stock between places, a sales team reads what is
+ * in stock. The table is the add-on's, so the add-on says how far an app may
+ * go on it, on the table itself:
+ *
+ * ```json
+ * { "ref": "suppliers", "columns": [ … ],
+ *   "appGrants": { "actions": ["read"], "readable": ["id", "name", "lead_days", "active"] } }
+ * ```
+ *
+ *  - `actions`: the most an app's role is given here (read, create, update);
+ *  - `readable`: the only columns an app's read shows; absent, every column
+ *    but those `never` names;
+ *  - `writable` / `creatable`: the only columns an app's update may change
+ *    and a new row may be given — named whenever the action is allowed: a
+ *    write is never "every column";
+ *  - `never`: columns no app's grant reaches, whatever else is listed.
+ *
+ * An add-on that says this of one table says it of all of them: a table
+ * without `appGrants` is then given to no app's role. An add-on that says it
+ * of none is held only by its own shape, as before the word: no hold on a
+ * ledger's receipts, read only on a table a ledger's code writes.
+ *
+ * The grant an app asks for is cut to fit (`roleTableHold`): an action or a
+ * column outside the add-on's words is left out and said, by name; a grant on
+ * a table with `appGrants` is always written with its column lists, never
+ * whole. The key and the table's links to other rows are read with any read,
+ * as with every read limit: a link says which row, never what is in it.
+ *
+ * Pure: no I/O, and nothing imported from the manifest's own schema file, so
+ * that file may import this one.
+ */
+import { z } from 'zod';
+import { refSchema } from './refs.js';
+import { reachList, ROLE_ADD_ON_ACTIONS } from './roles.js';
+export const appGrantsSchema = z
+    .object({
+    /** The most an app's role may be given on this table. */
+    actions: z.array(z.enum(ROLE_ADD_ON_ACTIONS)).min(1).max(3),
+    /** The only columns an app's read shows (with the key and the links); absent, every column but `never`'s. */
+    readable: z.array(refSchema).min(1).max(200).optional(),
+    /** The only columns an app's update may change. Named whenever `update` is allowed. */
+    writable: z.array(refSchema).min(1).max(200).optional(),
+    /** The only columns a new row an app's role makes may be given. Named whenever `create` is allowed. */
+    creatable: z.array(refSchema).min(1).max(200).optional(),
+    /** Columns no app's grant reaches, whatever else is listed. */
+    never: z.array(refSchema).min(1).max(200).optional(),
+})
+    .strict();
+/** Whether the add-on says, of any of its tables, what an app's role may be given. */
+export const declaresAppGrants = (tables) => tables.some((table) => table.appGrants !== undefined);
+const LIST_OF = { read: 'readable', update: 'writable', create: 'creatable' };
+/** Everything wrong with an add-on's `appGrants`, against its own tables and ledgers. */
+export function appGrantsIssues(tables, ledgers) {
+    const out = [];
+    tables.forEach((table, t) => {
+        const grants = table.appGrants;
+        if (grants === undefined)
+            return;
+        const at = (...rest) => ['requiredSchema', 'tables', t, 'appGrants', ...rest];
+        if (new Set(grants.actions).size !== grants.actions.length)
+            out.push({ path: at('actions'), message: 'an action is listed once' });
+        if (ledgers.some((ledger) => ledger.receipts === table.ref)) {
+            out.push({ path: at(), message: `"${table.ref}" is a ledger's receipt table, which no app's role ever holds: take "appGrants" off it` });
+            return;
+        }
+        if (ledgers.some((ledger) => Object.prototype.hasOwnProperty.call(ledger.writes ?? {}, table.ref))) {
+            grants.actions.forEach((action, a) => {
+                if (action !== 'read')
+                    out.push({ path: at('actions', a), message: `a ledger's code writes "${table.ref}": an app's role may only read it` });
+            });
+        }
+        const columns = new Map(table.columns.map((column) => [column.ref, column]));
+        for (const action of ROLE_ADD_ON_ACTIONS) {
+            const key = LIST_OF[action];
+            const listed = grants[key];
+            const allowed = grants.actions.includes(action);
+            if (listed !== undefined && !allowed)
+                out.push({ path: at(key), message: `"${action}" is not allowed here, so there is nothing for "${key}" to name` });
+            // A write is never "every column": the add-on names what an app may change.
+            if (listed === undefined && allowed && action !== 'read')
+                out.push({ path: at(key), message: `an app's role may ${action === 'update' ? 'change rows' : 'add rows'} here: name the columns it may ${action === 'update' ? 'change' : 'fill'} ("${key}")` });
+            (listed ?? []).forEach((ref, c) => {
+                if (!columns.has(ref))
+                    out.push({ path: at(key, c), message: `"${table.ref}" has no column "${ref}"` });
+                else if ((grants.never ?? []).includes(ref))
+                    out.push({ path: at(key, c), message: `"${ref}" is listed in "never" too` });
+            });
+            if (listed !== undefined && new Set(listed).size !== listed.length)
+                out.push({ path: at(key), message: 'a column is listed once' });
+        }
+        (grants.never ?? []).forEach((ref, c) => {
+            const column = columns.get(ref);
+            if (column === undefined)
+                out.push({ path: at('never', c), message: `"${table.ref}" has no column "${ref}"` });
+            // Every read shows the key and the links: naming one here would promise what no read keeps.
+            else if (column.role === 'pk' || column.type === 'fk')
+                out.push({ path: at('never', c), message: `"${ref}" is the table's key or a link, which every read shows: leave it out of "writable" and "creatable" instead` });
+        });
+    });
+    return out;
+}
+const kept = (asked, allowed) => [...new Set(asked)].filter((ref) => allowed.has(ref));
+const pickKeys = (record, keys) => {
+    if (record === undefined)
+        return undefined;
+    const out = Object.fromEntries(Object.entries(record).filter(([key]) => keys.includes(key)));
+    return Object.keys(out).length === 0 ? undefined : out;
+};
+/**
+ * What an app's grant on one of an add-on's tables comes to: the add-on's
+ * shape (receipts, ledger tables), the columns it has, and its `appGrants`.
+ * Narrower than asked, never wider; whatever is cut is named.
+ */
+export function roleTableHold(entry, addOn) {
+    const asked = [...new Set(entry.actions)];
+    const none = (skipped) => ({ actions: [], narrowed: { actions: asked }, skipped });
+    const shape = addOn.tables.find((table) => table.ref === entry.table);
+    if (shape === undefined)
+        return none('unknown-table');
+    // No hold at all on a receipt.
+    if (addOn.ledgers.some((ledger) => ledger.receipts === entry.table))
+        return none('ledger-table');
+    const limit = entry.limit;
+    const all = shape.columns.map((column) => column.ref);
+    const columns = new Set(all);
+    const named = [...(limit?.readable ?? []), ...(limit?.writable ?? []), ...(limit?.creatable ?? []), ...Object.keys(limit?.writableValues ?? {}), ...Object.keys(limit?.writableFrom ?? {}), ...Object.keys(limit?.creatableValues ?? {}), ...Object.values(limit?.rows ?? {}).flatMap((written) => reachList(written).flatMap((reach) => (reach.while === undefined ? [] : [reach.while.column])))];
+    // A grant is never written without its limit: a limit that names a column the table has not skips the whole entry.
+    const unknown = named.filter((column) => !columns.has(column));
+    if (unknown.length > 0)
+        return none('unknown-column');
+    const ceilinged = declaresAppGrants(addOn.tables);
+    const grants = shape.appGrants;
+    if (ceilinged && grants === undefined)
+        return none('not-offered');
+    const written = addOn.ledgers.some((ledger) => Object.prototype.hasOwnProperty.call(ledger.writes ?? {}, entry.table));
+    const cutByLedger = asked.filter((action) => written && action !== 'read');
+    const cutActions = new Set(cutByLedger);
+    const cutColumns = {};
+    let byCeiling = false;
+    let actions = asked.filter((action) => !cutActions.has(action));
+    if (grants !== undefined) {
+        for (const action of actions) {
+            if (!grants.actions.includes(action)) {
+                cutActions.add(action);
+                byCeiling = true;
+            }
+        }
+        actions = actions.filter((action) => !cutActions.has(action));
+    }
+    const never = new Set(grants?.never ?? []);
+    const secret = new Set(shape.columns.filter((column) => column.rules?.secret === true).map((column) => column.ref));
+    /** The columns the add-on lets an app's action reach: null, every column (an add-on with no `appGrants`). */
+    const ceilingOf = (action) => {
+        if (grants === undefined)
+            return null;
+        const listed = grants[LIST_OF[action]];
+        if (listed !== undefined)
+            return new Set(listed.filter((ref) => !never.has(ref)));
+        // Only a read may be "every column": every one but `never`'s and the secrets no response carries.
+        return action === 'read' ? new Set(all.filter((ref) => !never.has(ref) && !secret.has(ref))) : new Set();
+    };
+    /*
+     * Which rows an action reaches, by a column's value, tells what that column
+     * holds: a role that sees only the items whose cost is 0 has read their
+     * cost. A row limit (`rows`, `writableFrom`) on a column an app's read may
+     * not show leaves the whole entry out — dropping the limit would widen it.
+     */
+    if (grants !== undefined) {
+        const shown = grants.actions.includes('read') ? (ceilingOf('read') ?? new Set()) : new Set();
+        const judged = [...Object.keys(limit?.writableFrom ?? {}), ...Object.values(limit?.rows ?? {}).flatMap((written) => reachList(written).flatMap((reach) => (reach.while === undefined ? [] : [reach.while.column])))];
+        if (judged.some((column) => !shown.has(column)))
+            return none('ceiling');
+    }
+    const askedOf = (action) => (action === 'read' ? limit?.readable : action === 'update' ? limit?.writable : limit?.creatable);
+    const lists = {};
+    for (const action of [...actions]) {
+        const ceiling = ceilingOf(action);
+        const wanted = askedOf(action);
+        if (ceiling === null) {
+            if (wanted !== undefined)
+                lists[action] = [...new Set(wanted)];
+            continue;
+        }
+        // Asked for every column: given the add-on's, and what it keeps back is said.
+        const from = wanted ?? all;
+        const fits = kept(from, ceiling);
+        const cut = [...new Set(from)].filter((ref) => !ceiling.has(ref) && !(wanted === undefined && secret.has(ref)));
+        if (cut.length > 0) {
+            cutColumns[action] = cut;
+            byCeiling = true;
+        }
+        if (fits.length === 0) {
+            cutActions.add(action);
+            byCeiling = true;
+            actions = actions.filter((one) => one !== action);
+            continue;
+        }
+        lists[action] = fits;
+    }
+    const has = (action) => actions.includes(action);
+    const writable = has('update') ? lists.update : undefined;
+    const creatable = has('create') ? lists.create : undefined;
+    const writableValues = writable === undefined ? undefined : pickKeys(limit?.writableValues, writable);
+    const creatableValues = creatable === undefined ? undefined : pickKeys(limit?.creatableValues, creatable);
+    // Which rows an action reaches only ever narrows it: kept for the actions kept.
+    const rows = pickKeys(limit?.rows, actions);
+    const written_ = {
+        ...(has('read') && lists.read !== undefined ? { readable: lists.read } : {}),
+        ...(writable === undefined ? {} : { writable }),
+        ...(writableValues === undefined ? {} : { writableValues }),
+        ...(has('update') && limit?.writableFrom !== undefined ? { writableFrom: limit.writableFrom } : {}),
+        ...(creatable === undefined ? {} : { creatable }),
+        ...(creatableValues === undefined ? {} : { creatableValues }),
+        ...(rows === undefined ? {} : { rows }),
+    };
+    const narrowed = cutActions.size + Object.keys(cutColumns).length === 0
+        ? undefined
+        : { actions: asked.filter((action) => cutActions.has(action)), ...Object.fromEntries(ROLE_ADD_ON_ACTIONS.flatMap((action) => (cutColumns[action] === undefined ? [] : [[LIST_OF[action], cutColumns[action]]]))) };
+    const skipped = byCeiling ? 'ceiling' : cutByLedger.length > 0 ? 'ledger-table' : undefined;
+    return {
+        actions,
+        ...(has('read') && lists.read !== undefined ? { readable: lists.read } : {}),
+        ...(writable === undefined ? {} : { writable }),
+        ...(creatable === undefined ? {} : { creatable }),
+        ...(Object.keys(written_).length === 0 ? {} : { limit: written_ }),
+        ...(narrowed === undefined ? {} : { narrowed }),
+        ...(skipped === undefined ? {} : { skipped }),
+    };
+}
+/** Every column, in a list of what a grant reaches: the grant is whole there. */
+export const EVERY_COLUMN = '*';
+/**
+ * What `after` holds of a table that `before` did not: actions, and columns
+ * any of its actions reaches (`*`: every column, where before it was some or
+ * none). Null when it holds nothing more.
+ */
+export function holdWider(before, after) {
+    const had = new Set(before?.actions ?? []);
+    const actions = after.actions.filter((action) => !had.has(action));
+    const columns = new Set();
+    for (const action of after.actions) {
+        const key = LIST_OF[action];
+        const now = after[key];
+        const was = had.has(action) ? (before?.[key] ?? null) : [];
+        // null: every column.
+        if (was === null)
+            continue;
+        if (now === undefined) {
+            columns.add(EVERY_COLUMN);
+            continue;
+        }
+        for (const ref of now)
+            if (!was.includes(ref))
+                columns.add(ref);
+    }
+    return actions.length === 0 && columns.size === 0 ? null : { actions, columns: [...columns] };
+}
+//# sourceMappingURL=app-grants.js.map

package/dist/app-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-grants.js","sourceRoot":"","sources":["../src/app-grants.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAuB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAuC,MAAM,YAAY,CAAC;AAIjG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,yDAAyD;IACzD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,6GAA6G;IAC7G,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,uFAAuF;IACvF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD,uGAAuG;IACvG,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxD,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAgBZ,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAqC,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;AAE3I,MAAM,OAAO,GAAmE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAE9I,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,MAAqC,EAAE,OAAuC;IAC5G,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAyB,EAAuB,EAAE,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QACxH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,wFAAwF,EAAE,CAAC,CAAC;YACzI,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBACnC,IAAI,MAAM,KAAK,MAAM;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,GAAG,mCAAmC,EAAE,CAAC,CAAC;YAChJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,mDAAmD,GAAG,WAAW,EAAE,CAAC,CAAC;YACxJ,4EAA4E;YAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,MAAM,KAAK,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,qBAAqB,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,kCAAkC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;YAC5P,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;gBAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,oBAAoB,GAAG,GAAG,EAAE,CAAC,CAAC;qBACnG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,4BAA4B,EAAE,CAAC,CAAC;YAC5H,CAAC,CAAC,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,oBAAoB,GAAG,GAAG,EAAE,CAAC,CAAC;YAC/G,4FAA4F;iBACvF,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,4GAA4G,EAAE,CAAC,CAAC;QAC1N,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AA8CD,MAAM,IAAI,GAAG,CAAC,KAAwB,EAAE,OAA4B,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzI,MAAM,QAAQ,GAAG,CAAI,MAA+C,EAAE,IAAuB,EAAiC,EAAE;IAC9H,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACzD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAqB,EAAE,KAAyF;IAC5I,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAsB,CAAC;IAC/D,MAAM,IAAI,GAAG,CAAC,OAAsB,EAAiB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACjH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,+BAA+B;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpY,mHAAmH;IACnH,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEtD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IAC/B,IAAI,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAChD,MAAM,UAAU,GAA+C,EAAE,CAAC;IAClE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACvB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACpH,6GAA6G;IAC7G,MAAM,SAAS,GAAG,CAAC,MAAuB,EAA8B,EAAE;QACxE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,kGAAkG;QAClG,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAC3G,CAAC,CAAC;IACF;;;;;OAKG;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QAC7G,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrN,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAuB,EAAiC,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7K,MAAM,KAAK,GAA+C,EAAE,CAAC;IAC7D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,8EAA8E;QAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,GAAG,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,UAAU,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;YACzB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,MAAuB,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,MAAM,cAAc,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACtG,MAAM,eAAe,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAC1G,gFAAgF;IAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAqD,EAAE,OAAO,CAAsB,CAAC;IAClH,MAAM,QAAQ,GAAc;QAC1B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QACpD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvN,MAAM,OAAO,GAA8B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IACvH,OAAO;QACL,OAAO;QACP,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEhC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAqF,EAAE,KAA6E;IAC5L,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,sBAAsB;QACtB,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AAChG,CAAC"}