@fayz-ai/core 0.14.0 → 0.15.0

package/dist/access/engine.d.ts

@@ -12,6 +12,19 @@ export interface AccessSubject {
     profile: PermissionProfile | null;
     /** The tenant's currently-active plan. */
     plan: Plan | null;
+    /**
+     * Extra role a person has INSIDE a given unit, keyed by unit id.
+     *
+     * Additive, never subtractive: the org role applies everywhere and a unit role
+     * only adds inside its unit. That choice is what makes this shippable — the
+     * answer without a unit is a strict SUBSET of the answer with one, so every
+     * existing call site keeps its exact meaning and none of them had to change.
+     * The alternative (a unit role that overrides) can take access away by
+     * accident, and every screen would have to explain which role won.
+     */
+    unitProfiles?: Record<string, PermissionProfile>;
+    /** The unit the person is looking at, used when a check does not name one. */
+    activeUnitId?: string;
 }
 /**
  * The org owner has every permission implicitly. Owner is represented by the
@@ -41,6 +54,21 @@ export declare function profileHasSystemPermission(profile: PermissionProfile |
  * open rather than silently locking.
  */
 export declare function isEntitledByPlan(plan: Plan | null, feature: string): boolean;
+/**
+ * Union two profiles. Grants merge per feature, system permissions merge, and
+ * the result is never smaller than either input — the additive rule, in code.
+ *
+ * `manage` is not expanded here: {@link profileHasPermission} already treats it
+ * as satisfying any action, so expanding it would be a second implementation of
+ * the same rule waiting to disagree with the first.
+ */
+export declare function mergeProfiles(base: PermissionProfile | null, overlay: PermissionProfile | null): PermissionProfile | null;
+/**
+ * The profile that applies where the person is standing: their org role, plus
+ * whatever the unit adds. With no unit — or no binding in it — this is exactly
+ * the org role, which is why nothing that predates units changes behaviour.
+ */
+export declare function effectiveProfileFor(subject: AccessSubject, unitId?: string): PermissionProfile | null;
 /**
  * The single access decision: role FIRST, then plan.
  *
@@ -50,7 +78,9 @@ export declare function isEntitledByPlan(plan: Plan | null, feature: string): bo
  * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's
  *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.
  */
-export declare function resolveAccess(subject: AccessSubject, feature: string, action?: PermissionAction): AccessDecision;
+export declare function resolveAccess(subject: AccessSubject, feature: string, action?: PermissionAction, options?: {
+    unitId?: string;
+}): AccessDecision;
 /**
  * Pure numeric side of a limit: given the plan cap, whether a countable
  * declaration exists, and the current usage, derive the limit math. Unlimited

package/dist/access/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAe5C,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,0CAA0C;IAC1C,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,gBAAgB,GACxB,cAAc,CAQhB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACxG,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB,CAOA"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAe5C,+EAA+E;AAC/E,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjC,0CAA0C;IAC1C,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;IACjB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAChD,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAeT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,gBAAgB,GAC3B,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,GAAG,IAAI,EAC9B,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,iBAAiB,GAAG,IAAI,CAmB1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,aAAa,EACtB,MAAM,CAAC,EAAE,MAAM,GACd,iBAAiB,GAAG,IAAI,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,cAAc,CAShB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACxG,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;CACnB,CAOA"}

package/dist/access/index.d.ts

@@ -1,4 +1,4 @@
-export { isOwnerProfile, profileHasPermission, profileHasSystemPermission, isEntitledByPlan, resolveAccess, resolveLimit, } from './engine';
+export { isOwnerProfile, profileHasPermission, profileHasSystemPermission, isEntitledByPlan, resolveAccess, resolveLimit, mergeProfiles, effectiveProfileFor, } from './engine';
 export type { DenyReason, AccessDecision, AccessSubject } from './engine';
 export { UPGRADE_URL, agentDenial } from './denial';
 export type { AgentDenial, AgentDenialLimit, AgentGuardResult } from './denial';

package/dist/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,YAAY,GACb,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,0BAA0B,EAC1B,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACnD,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA"}

package/dist/access/index.js

@@ -18,8 +18,29 @@ function profileHasSystemPermission(profile, permission) {
 function isEntitledByPlan(plan, feature) {
   return plan?.entitlements?.features?.[feature] !== false;
 }
-function resolveAccess(subject, feature, action) {
-  if (!profileHasPermission(subject.profile, feature, action)) {
+function mergeProfiles(base, overlay) {
+  if (!overlay) return base;
+  if (!base) return overlay;
+  if (isOwnerProfile(base)) return base;
+  const grants = { ...base.grants };
+  for (const [feature, actions] of Object.entries(overlay.grants ?? {})) {
+    const merged = /* @__PURE__ */ new Set([...grants[feature] ?? [], ...actions]);
+    grants[feature] = [...merged];
+  }
+  const system = /* @__PURE__ */ new Set([...base.systemPermissions ?? [], ...overlay.systemPermissions ?? []]);
+  return {
+    ...base,
+    grants,
+    systemPermissions: system.size > 0 ? [...system] : void 0
+  };
+}
+function effectiveProfileFor(subject, unitId) {
+  if (!unitId) return subject.profile;
+  return mergeProfiles(subject.profile, subject.unitProfiles?.[unitId] ?? null);
+}
+function resolveAccess(subject, feature, action, options) {
+  const profile = effectiveProfileFor(subject, options?.unitId ?? subject.activeUnitId);
+  if (!profileHasPermission(profile, feature, action)) {
     return { allowed: false, reason: "role" };
   }
   if (!isEntitledByPlan(subject.plan, feature)) {
@@ -51,6 +72,6 @@ function mergeLimitDeclarations(...layers) {
   return Array.from(byKey.values());
 }
 
-export { UPGRADE_URL, agentDenial, isEntitledByPlan, isOwnerProfile, mergeLimitDeclarations, profileHasPermission, profileHasSystemPermission, resolveAccess, resolveLimit };
+export { UPGRADE_URL, agentDenial, effectiveProfileFor, isEntitledByPlan, isOwnerProfile, mergeLimitDeclarations, mergeProfiles, profileHasPermission, profileHasSystemPermission, resolveAccess, resolveLimit };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/access/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/access/engine.ts","../../src/access/denial.ts","../../src/access/limits.ts"],"names":[],"mappings":";AAuCO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,QAAQ,EAAA,KAAO,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAM,aAAY,KAAM,OAAA;AACnE;AAOO,SAAS,oBAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAMrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AAEpC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AAErB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA;AAErC,EAAA,OAAO,QAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC9D;AAQO,SAAS,0BAAA,CACd,SACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,OAAA,CAAQ,iBAAA,EAAmB,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AAC5D;AAQO,SAAS,gBAAA,CAAiB,MAAmB,OAAA,EAA0B;AAC5E,EAAA,OAAO,IAAA,EAAM,YAAA,EAAc,QAAA,GAAW,OAAO,CAAA,KAAM,KAAA;AACrD;AAWO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACgB;AAChB,EAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,CAAQ,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA,EAAG;AAC3D,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,EAAG;AAC5C,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAOO,SAAS,aAAa,MAAA,EAM3B;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAK,GAAI,MAAA;AACtC,EAAA,MAAM,SAAA,GAAY,CAAC,cAAA,IAAkB,GAAA,KAAQ,UAAa,GAAA,KAAQ,EAAA;AAClE,EAAA,MAAM,GAAA,GAAM,YAAY,QAAA,GAAW,GAAA;AACnC,EAAA,MAAM,YAAY,SAAA,GAAY,QAAA,GAAW,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,IAAI,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,CAAC,SAAA,IAAa,IAAA,IAAQ,GAAA;AACtC,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACpD;;;AC5HO,IAAM,WAAA,GAAc;AAmBpB,SAAS,WAAA,CAAY,QAAoB,KAAA,EAAuC;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,GAAI,KAAA,GAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAI,UAAA,EAAY,WAAA,EAAY;AACxF;;;ACvBO,SAAS,0BACX,MAAA,EACiB;AACpB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA8B;AAChD,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,EAAC,QAAS,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,CAAA;AAClC","file":"index.js","sourcesContent":["import type { PermissionProfile, PermissionAction, SystemPermission } from '../types/permissions'\nimport type { Plan } from '../types/billing'\n\n// ---------------------------------------------------------------------------\n// The access engine — the ONE implementation of the role × plan × limit\n// decision, shared by every runtime that gates anything:\n//\n//   - browser (saas AccessProvider / PermissionsProvider re-export from here)\n//   - headless client-plane (saas access/headless.ts)\n//   - the Fayz broker (server-side agent authorization imports this package)\n//\n// Hard constraint: this module (and everything under core/src/access) must stay\n// free of React, zustand and supabase — pure functions over plain data — so the\n// exact same code runs in Node/edge. Guarded by scripts/check-access-purity.mjs.\n// ---------------------------------------------------------------------------\n\n/** Why an access request was denied. `limit` only occurs on guarded writes. */\nexport type DenyReason = 'role' | 'plan' | 'limit'\n\nexport interface AccessDecision {\n  allowed: boolean\n  reason?: DenyReason\n}\n\n/** The minimal subject a decision needs — a projection of any richer session. */\nexport interface AccessSubject {\n  /** Effective RBAC profile — the previewed role during impersonation. */\n  profile: PermissionProfile | null\n  /** The tenant's currently-active plan. */\n  plan: Plan | null\n}\n\n/**\n * The org owner has every permission implicitly. Owner is represented by the\n * canonical role id `owner` across adapters (see org/adapters/supabase.ts\n * buildPermissionProfiles, which also grants owner all catalog perms, and the\n * mock adapter's `owner` fallback). We match by id first, falling back to the\n * (possibly localized) name for safety.\n */\nexport function isOwnerProfile(profile: PermissionProfile): boolean {\n  return profile.id === 'owner' || profile.name?.toLowerCase() === 'owner'\n}\n\n/**\n * The single role-side permission check. The plan axis composes ON TOP of it in\n * {@link resolveAccess} instead of reimplementing owner-bypass / `manage`\n * semantics.\n */\nexport function profileHasPermission(\n  profile: PermissionProfile | null,\n  feature: string,\n  action?: string,\n): boolean {\n  if (!profile) return true\n\n  // Owner bypass: never lock the owner out, even if the RBAC catalog is empty\n  // or still loading. Because permission checks read the *effective* profile,\n  // an owner previewing a non-owner role correctly loses this bypass — the\n  // preview stays honest.\n  if (isOwnerProfile(profile)) return true\n\n  const actions = profile.grants[feature]\n  if (!actions) return false\n\n  if (!action) return actions.length > 0\n\n  return actions.includes(action) || actions.includes('manage')\n}\n\n/**\n * The org-management side of a profile: managing team, billing, settings and\n * permissions themselves. Separate axis from `grants` — these gate the settings\n * tabs, not a feature's rows — and it follows the same owner bypass, so the one\n * person who can hand out access is never locked out of doing it.\n */\nexport function profileHasSystemPermission(\n  profile: PermissionProfile | null,\n  permission: SystemPermission,\n): boolean {\n  if (!profile) return true\n  if (isOwnerProfile(profile)) return true\n  return profile.systemPermissions?.includes(permission) ?? false\n}\n\n/**\n * Does the current plan entitle `feature`? A plan gates a feature ONLY with an\n * explicit `false`; absent means \"not gated by this plan\" (allowed). This keeps\n * entitlements additive and safe: a feature the plan has never heard of stays\n * open rather than silently locking.\n */\nexport function isEntitledByPlan(plan: Plan | null, feature: string): boolean {\n  return plan?.entitlements?.features?.[feature] !== false\n}\n\n/**\n * The single access decision: role FIRST, then plan.\n *\n * 1. Role — reuses `profileHasPermission` (owner bypass + `manage` semantics\n *    live there, and impersonation composes for free because `profile` is the\n *    previewed role). Denied → `{ allowed:false, reason:'role' }`.\n * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's\n *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.\n */\nexport function resolveAccess(\n  subject: AccessSubject,\n  feature: string,\n  action?: PermissionAction,\n): AccessDecision {\n  if (!profileHasPermission(subject.profile, feature, action)) {\n    return { allowed: false, reason: 'role' }\n  }\n  if (!isEntitledByPlan(subject.plan, feature)) {\n    return { allowed: false, reason: 'plan' }\n  }\n  return { allowed: true }\n}\n\n/**\n * Pure numeric side of a limit: given the plan cap, whether a countable\n * declaration exists, and the current usage, derive the limit math. Unlimited\n * when there's no declaration to count, no cap on the plan, or the cap is `-1`.\n */\nexport function resolveLimit(params: { cap: number | undefined; hasDeclaration: boolean; used: number }): {\n  max: number\n  used: number\n  remaining: number\n  atLimit: boolean\n  unlimited: boolean\n} {\n  const { cap, hasDeclaration, used } = params\n  const unlimited = !hasDeclaration || cap === undefined || cap === -1\n  const max = unlimited ? Infinity : cap\n  const remaining = unlimited ? Infinity : Math.max(0, max - used)\n  const atLimit = !unlimited && used >= max\n  return { max, used, remaining, atLimit, unlimited }\n}\n","import type { DenyReason } from './engine'\n\n// ---------------------------------------------------------------------------\n// The structured denial an AGENT surface returns instead of failing silently\n// (docs/saas/ENTITLEMENTS.md § \"Superfície de agentes de IA\"). One shape for every\n// executor — FAB client-plane, the Fayz broker, and the pool RPCs (which emit\n// its jsonb mirror in their `denial` field) — so the model can explain the\n// denial and offer the upgrade path conversationally.\n// ---------------------------------------------------------------------------\n\n/** Where a denied tenant goes to upgrade — the conversational UpgradeModal. */\nexport const UPGRADE_URL = '/settings/subscription'\n\nexport interface AgentDenialLimit {\n  key: string\n  max: number\n  used: number\n}\n\nexport interface AgentDenial {\n  allowed: false\n  reason: DenyReason\n  /** Present when `reason === 'limit'`. */\n  limit?: AgentDenialLimit\n  upgradeUrl: string\n}\n\nexport type AgentGuardResult = { allowed: true } | AgentDenial\n\n/** Build a denial with the canonical upgrade URL attached. */\nexport function agentDenial(reason: DenyReason, limit?: AgentDenialLimit): AgentDenial {\n  return { allowed: false, reason, ...(limit ? { limit } : {}), upgradeUrl: UPGRADE_URL }\n}\n","import type { LimitDeclaration } from '../types/entitlements'\n\n/**\n * The 4-layer limit-declaration merge, extracted so the browser AccessProvider\n * and the manifest derivation (`fayz manifest emit`) resolve the EXACT same\n * final set: core built-ins < entity-derived < plugin `declaredLimits` < app\n * overrides. Later layers win by key. Pure: pass the layers in, get the merge\n * out — deriving a declaration FROM an entity stays at the call site.\n */\nexport function mergeLimitDeclarations(\n  ...layers: Array<LimitDeclaration[] | undefined>\n): LimitDeclaration[] {\n  const byKey = new Map<string, LimitDeclaration>()\n  for (const layer of layers) {\n    for (const decl of layer ?? []) byKey.set(decl.key, decl)\n  }\n  return Array.from(byKey.values())\n}\n"]}
+{"version":3,"sources":["../../src/access/engine.ts","../../src/access/denial.ts","../../src/access/limits.ts"],"names":[],"mappings":";AAoDO,SAAS,eAAe,OAAA,EAAqC;AAClE,EAAA,OAAO,QAAQ,EAAA,KAAO,OAAA,IAAW,OAAA,CAAQ,IAAA,EAAM,aAAY,KAAM,OAAA;AACnE;AAOO,SAAS,oBAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAMrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AAEpC,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA;AACtC,EAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AAErB,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA;AAErC,EAAA,OAAO,QAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC9D;AAQO,SAAS,0BAAA,CACd,SACA,UAAA,EACS;AACT,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG,OAAO,IAAA;AACpC,EAAA,OAAO,OAAA,CAAQ,iBAAA,EAAmB,QAAA,CAAS,UAAU,CAAA,IAAK,KAAA;AAC5D;AAQO,SAAS,gBAAA,CAAiB,MAAmB,OAAA,EAA0B;AAC5E,EAAA,OAAO,IAAA,EAAM,YAAA,EAAc,QAAA,GAAW,OAAO,CAAA,KAAM,KAAA;AACrD;AAUO,SAAS,aAAA,CACd,MACA,OAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,EAAA,IAAI,CAAC,MAAM,OAAO,OAAA;AAElB,EAAA,IAAI,cAAA,CAAe,IAAI,CAAA,EAAG,OAAO,IAAA;AAEjC,EAAA,MAAM,MAAA,GAA6C,EAAE,GAAG,IAAA,CAAK,MAAA,EAAO;AACpE,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,OAAO,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,MAAA,IAAU,EAAE,CAAA,EAAG;AACrE,IAAA,MAAM,MAAA,mBAAS,IAAI,GAAA,CAAI,CAAC,GAAI,MAAA,CAAO,OAAO,CAAA,IAAK,EAAC,EAAI,GAAG,OAAO,CAAC,CAAA;AAC/D,IAAA,MAAA,CAAO,OAAO,CAAA,GAAI,CAAC,GAAG,MAAM,CAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,MAAA,mBAAS,IAAI,GAAA,CAAI,CAAC,GAAI,IAAA,CAAK,iBAAA,IAAqB,EAAC,EAAI,GAAI,OAAA,CAAQ,iBAAA,IAAqB,EAAG,CAAC,CAAA;AAEhG,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,MAAA;AAAA,IACA,mBAAmB,MAAA,CAAO,IAAA,GAAO,IAAI,CAAC,GAAG,MAAM,CAAA,GAAI;AAAA,GACrD;AACF;AAOO,SAAS,mBAAA,CACd,SACA,MAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAO,OAAA,CAAQ,OAAA;AAC5B,EAAA,OAAO,cAAc,OAAA,CAAQ,OAAA,EAAS,QAAQ,YAAA,GAAe,MAAM,KAAK,IAAI,CAAA;AAC9E;AAWO,SAAS,aAAA,CACd,OAAA,EACA,OAAA,EACA,MAAA,EACA,OAAA,EACgB;AAChB,EAAA,MAAM,UAAU,mBAAA,CAAoB,OAAA,EAAS,OAAA,EAAS,MAAA,IAAU,QAAQ,YAAY,CAAA;AACpF,EAAA,IAAI,CAAC,oBAAA,CAAqB,OAAA,EAAS,OAAA,EAAS,MAAM,CAAA,EAAG;AACnD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA,EAAG;AAC5C,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,MAAA,EAAO;AAAA,EAC1C;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAOO,SAAS,aAAa,MAAA,EAM3B;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,cAAA,EAAgB,IAAA,EAAK,GAAI,MAAA;AACtC,EAAA,MAAM,SAAA,GAAY,CAAC,cAAA,IAAkB,GAAA,KAAQ,UAAa,GAAA,KAAQ,EAAA;AAClE,EAAA,MAAM,GAAA,GAAM,YAAY,QAAA,GAAW,GAAA;AACnC,EAAA,MAAM,YAAY,SAAA,GAAY,QAAA,GAAW,KAAK,GAAA,CAAI,CAAA,EAAG,MAAM,IAAI,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,CAAC,SAAA,IAAa,IAAA,IAAQ,GAAA;AACtC,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,SAAA,EAAW,SAAS,SAAA,EAAU;AACpD;;;ACxLO,IAAM,WAAA,GAAc;AAmBpB,SAAS,WAAA,CAAY,QAAoB,KAAA,EAAuC;AACrF,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,MAAA,EAAQ,GAAI,KAAA,GAAQ,EAAE,KAAA,EAAM,GAAI,EAAC,EAAI,UAAA,EAAY,WAAA,EAAY;AACxF;;;ACvBO,SAAS,0BACX,MAAA,EACiB;AACpB,EAAA,MAAM,KAAA,uBAAY,GAAA,EAA8B;AAChD,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,KAAA,MAAW,IAAA,IAAQ,SAAS,EAAC,QAAS,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAAA,EAC1D;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ,CAAA;AAClC","file":"index.js","sourcesContent":["import type { PermissionProfile, PermissionAction, SystemPermission } from '../types/permissions'\nimport type { Plan } from '../types/billing'\n\n// ---------------------------------------------------------------------------\n// The access engine — the ONE implementation of the role × plan × limit\n// decision, shared by every runtime that gates anything:\n//\n//   - browser (saas AccessProvider / PermissionsProvider re-export from here)\n//   - headless client-plane (saas access/headless.ts)\n//   - the Fayz broker (server-side agent authorization imports this package)\n//\n// Hard constraint: this module (and everything under core/src/access) must stay\n// free of React, zustand and supabase — pure functions over plain data — so the\n// exact same code runs in Node/edge. Guarded by scripts/check-access-purity.mjs.\n// ---------------------------------------------------------------------------\n\n/** Why an access request was denied. `limit` only occurs on guarded writes. */\nexport type DenyReason = 'role' | 'plan' | 'limit'\n\nexport interface AccessDecision {\n  allowed: boolean\n  reason?: DenyReason\n}\n\n/** The minimal subject a decision needs — a projection of any richer session. */\nexport interface AccessSubject {\n  /** Effective RBAC profile — the previewed role during impersonation. */\n  profile: PermissionProfile | null\n  /** The tenant's currently-active plan. */\n  plan: Plan | null\n  /**\n   * Extra role a person has INSIDE a given unit, keyed by unit id.\n   *\n   * Additive, never subtractive: the org role applies everywhere and a unit role\n   * only adds inside its unit. That choice is what makes this shippable — the\n   * answer without a unit is a strict SUBSET of the answer with one, so every\n   * existing call site keeps its exact meaning and none of them had to change.\n   * The alternative (a unit role that overrides) can take access away by\n   * accident, and every screen would have to explain which role won.\n   */\n  unitProfiles?: Record<string, PermissionProfile>\n  /** The unit the person is looking at, used when a check does not name one. */\n  activeUnitId?: string\n}\n\n/**\n * The org owner has every permission implicitly. Owner is represented by the\n * canonical role id `owner` across adapters (see org/adapters/supabase.ts\n * buildPermissionProfiles, which also grants owner all catalog perms, and the\n * mock adapter's `owner` fallback). We match by id first, falling back to the\n * (possibly localized) name for safety.\n */\nexport function isOwnerProfile(profile: PermissionProfile): boolean {\n  return profile.id === 'owner' || profile.name?.toLowerCase() === 'owner'\n}\n\n/**\n * The single role-side permission check. The plan axis composes ON TOP of it in\n * {@link resolveAccess} instead of reimplementing owner-bypass / `manage`\n * semantics.\n */\nexport function profileHasPermission(\n  profile: PermissionProfile | null,\n  feature: string,\n  action?: string,\n): boolean {\n  if (!profile) return true\n\n  // Owner bypass: never lock the owner out, even if the RBAC catalog is empty\n  // or still loading. Because permission checks read the *effective* profile,\n  // an owner previewing a non-owner role correctly loses this bypass — the\n  // preview stays honest.\n  if (isOwnerProfile(profile)) return true\n\n  const actions = profile.grants[feature]\n  if (!actions) return false\n\n  if (!action) return actions.length > 0\n\n  return actions.includes(action) || actions.includes('manage')\n}\n\n/**\n * The org-management side of a profile: managing team, billing, settings and\n * permissions themselves. Separate axis from `grants` — these gate the settings\n * tabs, not a feature's rows — and it follows the same owner bypass, so the one\n * person who can hand out access is never locked out of doing it.\n */\nexport function profileHasSystemPermission(\n  profile: PermissionProfile | null,\n  permission: SystemPermission,\n): boolean {\n  if (!profile) return true\n  if (isOwnerProfile(profile)) return true\n  return profile.systemPermissions?.includes(permission) ?? false\n}\n\n/**\n * Does the current plan entitle `feature`? A plan gates a feature ONLY with an\n * explicit `false`; absent means \"not gated by this plan\" (allowed). This keeps\n * entitlements additive and safe: a feature the plan has never heard of stays\n * open rather than silently locking.\n */\nexport function isEntitledByPlan(plan: Plan | null, feature: string): boolean {\n  return plan?.entitlements?.features?.[feature] !== false\n}\n\n/**\n * Union two profiles. Grants merge per feature, system permissions merge, and\n * the result is never smaller than either input — the additive rule, in code.\n *\n * `manage` is not expanded here: {@link profileHasPermission} already treats it\n * as satisfying any action, so expanding it would be a second implementation of\n * the same rule waiting to disagree with the first.\n */\nexport function mergeProfiles(\n  base: PermissionProfile | null,\n  overlay: PermissionProfile | null,\n): PermissionProfile | null {\n  if (!overlay) return base\n  if (!base) return overlay\n  // An owner already has everything; merging onto it can only produce noise.\n  if (isOwnerProfile(base)) return base\n\n  const grants: Record<string, PermissionAction[]> = { ...base.grants }\n  for (const [feature, actions] of Object.entries(overlay.grants ?? {})) {\n    const merged = new Set([...(grants[feature] ?? []), ...actions])\n    grants[feature] = [...merged]\n  }\n\n  const system = new Set([...(base.systemPermissions ?? []), ...(overlay.systemPermissions ?? [])])\n\n  return {\n    ...base,\n    grants,\n    systemPermissions: system.size > 0 ? [...system] : undefined,\n  }\n}\n\n/**\n * The profile that applies where the person is standing: their org role, plus\n * whatever the unit adds. With no unit — or no binding in it — this is exactly\n * the org role, which is why nothing that predates units changes behaviour.\n */\nexport function effectiveProfileFor(\n  subject: AccessSubject,\n  unitId?: string,\n): PermissionProfile | null {\n  if (!unitId) return subject.profile\n  return mergeProfiles(subject.profile, subject.unitProfiles?.[unitId] ?? null)\n}\n\n/**\n * The single access decision: role FIRST, then plan.\n *\n * 1. Role — reuses `profileHasPermission` (owner bypass + `manage` semantics\n *    live there, and impersonation composes for free because `profile` is the\n *    previewed role). Denied → `{ allowed:false, reason:'role' }`.\n * 2. Plan — even the owner does NOT bypass the plan: upgrading is the tenant's\n *    decision, not a role power. Denied → `{ allowed:false, reason:'plan' }`.\n */\nexport function resolveAccess(\n  subject: AccessSubject,\n  feature: string,\n  action?: PermissionAction,\n  options?: { unitId?: string },\n): AccessDecision {\n  const profile = effectiveProfileFor(subject, options?.unitId ?? subject.activeUnitId)\n  if (!profileHasPermission(profile, feature, action)) {\n    return { allowed: false, reason: 'role' }\n  }\n  if (!isEntitledByPlan(subject.plan, feature)) {\n    return { allowed: false, reason: 'plan' }\n  }\n  return { allowed: true }\n}\n\n/**\n * Pure numeric side of a limit: given the plan cap, whether a countable\n * declaration exists, and the current usage, derive the limit math. Unlimited\n * when there's no declaration to count, no cap on the plan, or the cap is `-1`.\n */\nexport function resolveLimit(params: { cap: number | undefined; hasDeclaration: boolean; used: number }): {\n  max: number\n  used: number\n  remaining: number\n  atLimit: boolean\n  unlimited: boolean\n} {\n  const { cap, hasDeclaration, used } = params\n  const unlimited = !hasDeclaration || cap === undefined || cap === -1\n  const max = unlimited ? Infinity : cap\n  const remaining = unlimited ? Infinity : Math.max(0, max - used)\n  const atLimit = !unlimited && used >= max\n  return { max, used, remaining, atLimit, unlimited }\n}\n","import type { DenyReason } from './engine'\n\n// ---------------------------------------------------------------------------\n// The structured denial an AGENT surface returns instead of failing silently\n// (docs/saas/ENTITLEMENTS.md § \"Superfície de agentes de IA\"). One shape for every\n// executor — FAB client-plane, the Fayz broker, and the pool RPCs (which emit\n// its jsonb mirror in their `denial` field) — so the model can explain the\n// denial and offer the upgrade path conversationally.\n// ---------------------------------------------------------------------------\n\n/** Where a denied tenant goes to upgrade — the conversational UpgradeModal. */\nexport const UPGRADE_URL = '/settings/subscription'\n\nexport interface AgentDenialLimit {\n  key: string\n  max: number\n  used: number\n}\n\nexport interface AgentDenial {\n  allowed: false\n  reason: DenyReason\n  /** Present when `reason === 'limit'`. */\n  limit?: AgentDenialLimit\n  upgradeUrl: string\n}\n\nexport type AgentGuardResult = { allowed: true } | AgentDenial\n\n/** Build a denial with the canonical upgrade URL attached. */\nexport function agentDenial(reason: DenyReason, limit?: AgentDenialLimit): AgentDenial {\n  return { allowed: false, reason, ...(limit ? { limit } : {}), upgradeUrl: UPGRADE_URL }\n}\n","import type { LimitDeclaration } from '../types/entitlements'\n\n/**\n * The 4-layer limit-declaration merge, extracted so the browser AccessProvider\n * and the manifest derivation (`fayz manifest emit`) resolve the EXACT same\n * final set: core built-ins < entity-derived < plugin `declaredLimits` < app\n * overrides. Later layers win by key. Pure: pass the layers in, get the merge\n * out — deriving a declaration FROM an entity stays at the call site.\n */\nexport function mergeLimitDeclarations(\n  ...layers: Array<LimitDeclaration[] | undefined>\n): LimitDeclaration[] {\n  const byKey = new Map<string, LimitDeclaration>()\n  for (const layer of layers) {\n    for (const decl of layer ?? []) byKey.set(decl.key, decl)\n  }\n  return Array.from(byKey.values())\n}\n"]}

package/dist/{chunk-KFBEKFII.js → chunk-BCI743RH.js}

@@ -56,6 +56,31 @@ function applyRangeToQuery(query, column, range) {
   return q;
 }
 
+// src/data/unit-scope.ts
+var _scoped = {};
+function setScopedResources(map) {
+  _scoped = map;
+}
+function getScopedResource(table) {
+  if (!table) return void 0;
+  return _scoped[table];
+}
+function resolveUnitScope(config) {
+  if (!config.unitScoped) return null;
+  const id = config.unitId?.();
+  if (!id) return null;
+  return {
+    column: config.unitColumn ?? "unit_id",
+    id,
+    includeShared: config.includeSharedRows !== false
+  };
+}
+function applyUnitScope(builder, scope) {
+  if (!scope) return builder;
+  const q = builder;
+  return scope.includeShared ? q.or(`${scope.column}.eq.${scope.id},${scope.column}.is.null`) : q.eq(scope.column, scope.id);
+}
+
 // src/data/supabase.ts
 function camelToSnake(str) {
   return str.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
@@ -80,7 +105,7 @@ function mapEntity(entity, columnMap) {
   }
   const result = {};
   for (const [key, value] of Object.entries(entity)) {
-    if (key === "id" || key === "createdAt" || key === "updatedAt" || key === "tenantId" || key === "createdBy") continue;
+    if (key === "id" || key === "createdAt" || key === "updatedAt" || key === "tenantId" || key === "createdBy" || key === "ownerId") continue;
     const snakeKey = reverseMap[key] ?? camelToSnake(key);
     result[snakeKey] = value;
   }
@@ -103,6 +128,9 @@ function createSupabaseProvider(table, config) {
     if (!config?.tenantId) return void 0;
     return typeof config.tenantId === "function" ? config.tenantId() : config.tenantId;
   }
+  function unitScope() {
+    return resolveUnitScope(config ?? {});
+  }
   function getClient() {
     const supabase = config?.supabaseClient ?? _globalSupabaseClient;
     if (!supabase) throw new Error(`[@fayz-ai/core] Supabase client not available. Call createFayzApp with a provider first.`);
@@ -114,6 +142,7 @@ function createSupabaseProvider(table, config) {
       let q = getClient().from(table).select(selectCols, wantCount ? { count: "exact" } : void 0);
       const tenantId = resolveTenantId();
       if (tenantId) q = q.eq(tenantIdCol, tenantId);
+      q = applyUnitScope(q, unitScope());
       if (config?.filters) {
         for (const [col, val] of Object.entries(config.filters)) {
           q = q.eq(col, val);
@@ -161,6 +190,8 @@ function createSupabaseProvider(table, config) {
       const row = mapEntity(data, columnMap);
       const tenantId = resolveTenantId();
       if (tenantId) row[tenantIdCol] = tenantId;
+      const scope = unitScope();
+      if (scope && row[scope.column] === void 0) row[scope.column] = scope.id;
       if (config?.defaults) {
         for (const [col, val] of Object.entries(config.defaults)) {
           if (row[col] === void 0) row[col] = val;
@@ -173,9 +204,11 @@ function createSupabaseProvider(table, config) {
     async createMany(rows, options) {
       const tenantId = resolveTenantId();
       const size = Math.max(1, options?.chunkSize ?? 200);
+      const scope = unitScope();
       const prepared = rows.map((r) => {
         const row = mapEntity(r, columnMap);
         if (tenantId) row[tenantIdCol] = tenantId;
+        if (scope && row[scope.column] === void 0) row[scope.column] = scope.id;
         if (config?.defaults) {
           for (const [col, val] of Object.entries(config.defaults)) {
             if (row[col] === void 0) row[col] = val;
@@ -315,6 +348,6 @@ function useActiveTenantId() {
   return React.useSyncExternalStore(subscribeActiveTenant, getActiveTenantId, getActiveTenantId);
 }
 
-export { DEFAULT_CACHE_TTL, applyRangeToQuery, clearGlobalCache, createCacheStore, createSupabaseProvider, getActiveTenantId, getSupabaseClientOptional, globalCache, isFilterObject, matchesRange, parseRangeFilter, setActiveTenantId, setGlobalSupabaseClient, stableKey, subscribeActiveTenant, useActiveTenantId };
-//# sourceMappingURL=chunk-KFBEKFII.js.map
-//# sourceMappingURL=chunk-KFBEKFII.js.map
+export { DEFAULT_CACHE_TTL, applyRangeToQuery, applyUnitScope, clearGlobalCache, createCacheStore, createSupabaseProvider, getActiveTenantId, getScopedResource, getSupabaseClientOptional, globalCache, isFilterObject, matchesRange, parseRangeFilter, resolveUnitScope, setActiveTenantId, setGlobalSupabaseClient, setScopedResources, stableKey, subscribeActiveTenant, useActiveTenantId };
+//# sourceMappingURL=chunk-BCI743RH.js.map
+//# sourceMappingURL=chunk-BCI743RH.js.map

package/dist/chunk-BCI743RH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/data/filters.ts","../src/data/unit-scope.ts","../src/data/supabase.ts","../src/lib/cache.ts","../src/lib/tenant.ts"],"names":[],"mappings":";;;AAiBA,IAAM,kBAAkB,CAAC,MAAA,EAAQ,OAAO,OAAA,EAAS,OAAA,EAAS,SAAS,KAAK,CAAA;AACxE,IAAM,eAAA,GAAkB,CAAC,IAAI,CAAA;AAC7B,IAAM,kBAAkB,CAAC,IAAA,EAAM,OAAO,KAAA,EAAO,OAAA,EAAS,UAAU,KAAK,CAAA;AACrE,IAAM,eAAA,GAAkB,CAAC,IAAI,CAAA;AAE7B,SAAS,IAAA,CAAK,QAAiC,KAAA,EAA0B;AACvE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,MAAA,CAAO,IAAI,CAAA,KAAM,MAAA,IAAa,MAAA,CAAO,IAAI,CAAA,KAAM,IAAA,EAAM,OAAO,MAAA,CAAO,IAAI,CAAA;AAC3E,IAAA,MAAM,MAAA,GAAS,IAAI,IAAI,CAAA,CAAA;AACvB,IAAA,IAAI,MAAA,CAAO,MAAM,CAAA,KAAM,MAAA,IAAa,MAAA,CAAO,MAAM,CAAA,KAAM,IAAA,EAAM,OAAO,MAAA,CAAO,MAAM,CAAA;AAAA,EACnF;AACA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,iBAAiB,KAAA,EAAoC;AACnE,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,IAAA;AAChF,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,EAAQ,eAAe,CAAA;AACxC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,MAAA,EAAQ,eAAe,CAAA;AACvC,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,EAAQ,eAAe,CAAA;AACxC,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,MAAA,EAAQ,eAAe,CAAA;AACvC,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,KAAA,CAAM,GAAA,GAAM,GAAA;AACnC,EAAA,IAAI,EAAA,KAAO,MAAA,EAAW,KAAA,CAAM,EAAA,GAAK,EAAA;AACjC,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,KAAA,CAAM,GAAA,GAAM,GAAA;AACnC,EAAA,IAAI,EAAA,KAAO,MAAA,EAAW,KAAA,CAAM,EAAA,GAAK,EAAA;AACjC,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,SAAS,KAAA,GAAQ,IAAA;AAC7C;AAGO,SAAS,eAAe,KAAA,EAAyB;AACtD,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,WAAW,KAAA,EAAwB;AAC1C,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,KAAA,YAAiB,IAAA,EAAM,OAAO,KAAA,CAAM,OAAA,EAAQ;AAChD,EAAA,MAAM,EAAA,GAAK,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AACnC,EAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,EAAE,GAAG,OAAO,EAAA;AAC9B,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAGO,SAAS,YAAA,CAAa,KAAc,KAAA,EAA6B;AACtE,EAAA,MAAM,KAAA,GAAQ,WAAW,GAAG,CAAA;AAC5B,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,EAAG,OAAO,KAAA;AAChC,EAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,IAAa,KAAA,GAAQ,WAAW,KAAA,CAAM,GAAG,GAAG,OAAO,KAAA;AACrE,EAAA,IAAI,KAAA,CAAM,OAAO,MAAA,IAAa,KAAA,IAAS,WAAW,KAAA,CAAM,EAAE,GAAG,OAAO,KAAA;AACpE,EAAA,IAAI,KAAA,CAAM,QAAQ,MAAA,IAAa,KAAA,GAAQ,WAAW,KAAA,CAAM,GAAG,GAAG,OAAO,KAAA;AACrE,EAAA,IAAI,KAAA,CAAM,OAAO,MAAA,IAAa,KAAA,IAAS,WAAW,KAAA,CAAM,EAAE,GAAG,OAAO,KAAA;AACpE,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,iBAAA,CACd,KAAA,EACA,MAAA,EACA,KAAA,EACG;AACH,EAAA,IAAI,CAAA,GAAI,KAAA;AACR,EAAA,KAAA,MAAW,MAAM,CAAC,KAAA,EAAO,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA,EAAY;AACpD,IAAA,MAAM,KAAA,GAAQ,MAAM,EAAE,CAAA;AACtB,IAAA,IAAI,UAAU,MAAA,EAAW;AACzB,IAAA,CAAA,GAAI,CAAA,CAAE,EAAE,CAAA,CAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,CAAA;AACT;;;AC1DA,IAAI,UAA0C,EAAC;AAExC,SAAS,mBAAmB,GAAA,EAA2C;AAC5E,EAAA,OAAA,GAAU,GAAA;AACZ;AAEO,SAAS,kBAAkB,KAAA,EAAuD;AACvF,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,OAAO,QAAQ,KAAK,CAAA;AACtB;AAsBO,SAAS,iBAAiB,MAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,MAAA,CAAO,UAAA,EAAY,OAAO,IAAA;AAC/B,EAAA,MAAM,EAAA,GAAK,OAAO,MAAA,IAAS;AAC3B,EAAA,IAAI,CAAC,IAAI,OAAO,IAAA;AAChB,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAO,UAAA,IAAc,SAAA;AAAA,IAC7B,EAAA;AAAA,IACA,aAAA,EAAe,OAAO,iBAAA,KAAsB;AAAA,GAC9C;AACF;AAcO,SAAS,cAAA,CAAkB,SAAY,KAAA,EAA4B;AACxE,EAAA,IAAI,CAAC,OAAO,OAAO,OAAA;AACnB,EAAA,MAAM,CAAA,GAAI,OAAA;AAIV,EAAA,OAAQ,KAAA,CAAM,gBACV,CAAA,CAAE,EAAA,CAAG,GAAG,KAAA,CAAM,MAAM,OAAO,KAAA,CAAM,EAAE,IAAI,KAAA,CAAM,MAAM,UAAU,CAAA,GAC7D,CAAA,CAAE,GAAG,KAAA,CAAM,MAAA,EAAQ,MAAM,EAAE,CAAA;AACjC;;;ACzEA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,GAAA,CAAI,QAAQ,QAAA,EAAU,CAAC,MAAM,GAAA,GAAM,CAAA,CAAE,aAAa,CAAA;AAC3D;AAEA,SAAS,aAAa,GAAA,EAAqB;AACzC,EAAA,OAAO,GAAA,CAAI,QAAQ,WAAA,EAAa,CAAC,GAAG,CAAA,KAAc,CAAA,CAAE,aAAa,CAAA;AACnE;AAEA,SAAS,MAAA,CAAU,KAA8B,SAAA,EAAuC;AACtF,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC9C,IAAA,MAAM,QAAA,GAAW,SAAA,GAAY,GAAG,CAAA,IAAK,aAAa,GAAG,CAAA;AACrD,IAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,KAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,SAAA,CAAU,QAAiC,SAAA,EAA6D;AAC/G,EAAA,MAAM,aAAqC,EAAC;AAC5C,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtD,MAAA,UAAA,CAAW,KAAK,CAAA,GAAI,KAAA;AAAA,IACtB;AAAA,EACF;AACA,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAOjD,IAAA,IAAI,GAAA,KAAQ,IAAA,IAAQ,GAAA,KAAQ,WAAA,IAAe,GAAA,KAAQ,WAAA,IAAe,GAAA,KAAQ,UAAA,IAAc,GAAA,KAAQ,WAAA,IAAe,GAAA,KAAQ,SAAA,EAAW;AAClI,IAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAG,CAAA,IAAK,aAAa,GAAG,CAAA;AACpD,IAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,KAAA;AAAA,EACrB;AACA,EAAA,OAAO,MAAA;AACT;AAGA,IAAI,qBAAA,GAAwC,IAAA;AAErC,SAAS,wBAAwB,MAAA,EAAuB;AAC7D,EAAA,qBAAA,GAAwB,MAAA;AAC1B;AAEO,SAAS,yBAAA,GAA4C;AAC1D,EAAA,OAAO,qBAAA;AACT;AAEO,SAAS,sBAAA,CACd,OACA,MAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,QAAA;AACjC,EAAA,MAAM,WAAA,GAAc,QAAQ,cAAA,IAAkB,WAAA;AAC9C,EAAA,MAAM,UAAA,GAAa,MAAA,EAAQ,aAAA,IAAiB,EAAC;AAC7C,EAAA,MAAM,UAAA,GAAa,QAAQ,aAAA,IAAiB,GAAA;AAC5C,EAAA,MAAM,YAAY,MAAA,EAAQ,SAAA;AAE1B,EAAA,SAAS,eAAA,GAAsC;AAC7C,IAAA,IAAI,CAAC,MAAA,EAAQ,QAAA,EAAU,OAAO,MAAA;AAC9B,IAAA,OAAO,OAAO,MAAA,CAAO,QAAA,KAAa,aAAa,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,QAAA;AAAA,EAC5E;AAEA,EAAA,SAAS,SAAA,GAAY;AACnB,IAAA,OAAO,gBAAA,CAAiB,MAAA,IAAU,EAAE,CAAA;AAAA,EACtC;AAEA,EAAA,SAAS,SAAA,GAAY;AACnB,IAAA,MAAM,QAAA,GAAY,QAAQ,cAAA,IAAkB,qBAAA;AAI5C,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,MAAM,CAAA,wFAAA,CAA0F,CAAA;AACzH,IAAA,OAAO,MAAA,KAAW,QAAA,GAAY,QAAA,GAAiD,QAAA,CAAS,OAAO,MAAM,CAAA;AAAA,EACvG;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,KAAA,EAA0C;AAEnD,MAAA,MAAM,SAAA,GAAY,MAAM,SAAA,KAAc,MAAA;AACtC,MAAA,IAAI,CAAA,GAAK,SAAA,EAAU,CAAE,IAAA,CAAK,KAAK,CAAA,CAC5B,MAAA,CAAO,UAAA,EAAY,SAAA,GAAY,EAAE,KAAA,EAAO,OAAA,KAAY,MAAS,CAAA;AAEhE,MAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,MAAA,IAAI,QAAA,EAAU,CAAA,GAAK,CAAA,CAAoD,EAAA,CAAG,aAAa,QAAQ,CAAA;AAK/F,MAAA,CAAA,GAAI,cAAA,CAAe,CAAA,EAAG,SAAA,EAAW,CAAA;AAEjC,MAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,QAAA,KAAA,MAAW,CAAC,KAAK,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,OAAO,CAAA,EAAG;AACvD,UAAA,CAAA,GAAK,CAAA,CAAgD,EAAA,CAAG,GAAA,EAAK,GAAG,CAAA;AAAA,QAClE;AAAA,MACF;AAKA,MAAA,IAAI,MAAM,OAAA,EAAS;AACjB,QAAA,KAAA,MAAW,CAAC,KAAK,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,OAAO,CAAA,EAAG;AACtD,UAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,GAAA,KAAQ,EAAA,EAAI;AAC/B,UAAA,MAAM,GAAA,GAAM,SAAA,GAAY,GAAG,CAAA,IAAK,aAAa,GAAG,CAAA;AAChD,UAAA,MAAM,KAAA,GAAQ,iBAAiB,GAAG,CAAA;AAClC,UAAA,IAAI,KAAA,EAAO;AACT,YAAA,CAAA,GAAI,iBAAA,CAAkB,CAAA,EAAG,GAAA,EAAK,KAAK,CAAA;AACnC,YAAA;AAAA,UACF;AACA,UAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG;AACvB,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,2BAA2B,GAAG,CAAA,mHAAA;AAAA,aAEhC;AAAA,UACF;AACA,UAAA,CAAA,GAAK,CAAA,CAAiD,EAAA,CAAG,GAAA,EAAK,GAAG,CAAA;AAAA,QACnE;AAAA,MACF;AAEA,MAAA,IAAI,KAAA,CAAM,MAAA,IAAU,UAAA,CAAW,MAAA,GAAS,CAAA,EAAG;AACzC,QAAA,MAAM,IAAA,GAAO,CAAA,CAAA,EAAI,KAAA,CAAM,MAAM,CAAA,CAAA,CAAA;AAC7B,QAAA,MAAM,QAAA,GAAW,UAAA,CAAW,GAAA,CAAI,CAAC,QAAQ,CAAA,EAAG,YAAA,CAAa,GAAG,CAAC,CAAA,OAAA,EAAU,IAAI,CAAA,CAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AACvF,QAAA,CAAA,GAAK,CAAA,CAAqC,GAAG,QAAQ,CAAA;AAAA,MACvD;AAEA,MAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,QAAA,CAAA,GAAK,CAAA,CACF,KAAA,CAAM,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA,EAAG,EAAE,SAAA,EAAW,KAAA,CAAM,OAAA,KAAY,MAAA,EAAQ,CAAA;AAAA,MAC9E,CAAA,MAAO;AACL,QAAA,CAAA,GAAK,EACF,KAAA,CAAM,YAAA,EAAc,EAAE,SAAA,EAAW,OAAO,CAAA;AAAA,MAC7C;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,IAAA,IAAQ,CAAA;AAC3B,MAAA,MAAM,QAAA,GAAW,MAAM,QAAA,IAAY,EAAA;AACnC,MAAA,MAAM,IAAA,GAAA,CAAQ,OAAO,CAAA,IAAK,QAAA;AAC1B,MAAA,CAAA,GAAK,CAAA,CAAmD,KAAA,CAAM,IAAA,EAAM,IAAA,GAAO,WAAW,CAAC,CAAA;AAEvF,MAAA,MAAM,EAAE,IAAA,EAAM,KAAA,EAAO,KAAA,KAAU,MAAM,CAAA;AACrC,MAAA,IAAI,OAAO,MAAM,KAAA;AAEjB,MAAA,OAAO;AAAA,QACL,IAAA,EAAA,CAAO,IAAA,IAAQ,EAAC,EAAG,GAAA,CAAI,CAAC,GAAA,KAAQ,MAAA,CAAU,GAAA,EAAK,SAAS,CAAC,CAAA;AAAA,QACzD,OAAO,KAAA,IAAS;AAAA,OAClB;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,OAAO,IAAA,EAAM;AACjB,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,EAAiC,SAAS,CAAA;AAChE,MAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,MAAA,IAAI,QAAA,EAAU,GAAA,CAAI,WAAW,CAAA,GAAI,QAAA;AACjC,MAAA,MAAM,QAAQ,SAAA,EAAU;AACxB,MAAA,IAAI,KAAA,IAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,KAAM,QAAW,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,GAAI,KAAA,CAAM,EAAA;AACxE,MAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,QAAA,KAAA,MAAW,CAAC,KAAK,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxD,UAAA,IAAI,IAAI,GAAG,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AAAA,QACzC;AAAA,MACF;AAEA,MAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAM,GAAK,MAAO,SAAA,EAAU,CAAE,IAAA,CAAK,KAAK,EAE5D,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA,GAAS,MAAA,EAAO;AAE/B,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,OAAO,MAAA,CAAU,SAAU,SAAS,CAAA;AAAA,IACtC,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,IAAA,EAAM,OAAA,EAAS;AAC9B,MAAA,MAAM,WAAW,eAAA,EAAgB;AACjC,MAAA,MAAM,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,EAAS,aAAa,GAAG,CAAA;AAClD,MAAA,MAAM,QAAQ,SAAA,EAAU;AACxB,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM;AAC/B,QAAA,MAAM,GAAA,GAAM,SAAA,CAAU,CAAA,EAA8B,SAAS,CAAA;AAC7D,QAAA,IAAI,QAAA,EAAU,GAAA,CAAI,WAAW,CAAA,GAAI,QAAA;AACjC,QAAA,IAAI,KAAA,IAAS,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,KAAM,QAAW,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA,GAAI,KAAA,CAAM,EAAA;AACxE,QAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,UAAA,KAAA,MAAW,CAAC,KAAK,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxD,YAAA,IAAI,IAAI,GAAG,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,GAAG,CAAA,GAAI,GAAA;AAAA,UACzC;AAAA,QACF;AACA,QAAA,OAAO,GAAA;AAAA,MACT,CAAC,CAAA;AAED,MAAA,IAAI,OAAA,GAAU,CAAA;AACd,MAAA,MAAM,SAAoD,EAAC;AAC3D,MAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,QAAA,CAAS,MAAA,EAAQ,SAAS,IAAA,EAAM;AAC1D,QAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,KAAA,CAAM,KAAA,EAAO,QAAQ,IAAI,CAAA;AAChD,QAAA,MAAM,EAAE,KAAA,EAAM,GAAK,MAAO,SAAA,GAAY,IAAA,CAAK,KAAK,CAAA,CAE7C,MAAA,CAAO,KAAK,CAAA;AACf,QAAA,IAAI,CAAC,KAAA,EAAO;AACV,UAAA,OAAA,IAAW,KAAA,CAAM,MAAA;AAAA,QACnB,CAAA,MAAO;AAIL,UAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,UAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,YAAA,MAAM,EAAE,KAAA,EAAO,QAAA,EAAS,GAAK,MAAO,SAAA,EAAU,CAAE,IAAA,CAAK,KAAK,CAAA,CAEvD,MAAA,CAAO,KAAA,CAAM,CAAC,CAAC,CAAA;AAClB,YAAA,IAAI,QAAA,EAAU;AACZ,cAAA,MAAA,CAAO,IAAA,CAAK;AAAA,gBACV,OAAO,KAAA,GAAQ,CAAA;AAAA,gBACf,SAAS,QAAA,YAAoB,KAAA,GAAQ,SAAS,OAAA,GAAU,MAAA,CAAO,YAAY,OAAO;AAAA,eACnF,CAAA;AAAA,YACH,OAAO,OAAA,IAAW,CAAA;AAAA,UACpB;AAAA,QACF;AACA,QAAA,OAAA,EAAS,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,KAAA,GAAQ,KAAA,CAAM,QAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,QAAA,CAAS,MAAM,CAAA;AAAA,MACxF;AACA,MAAA,OAAO,EAAE,SAAS,MAAA,EAAO;AAAA,IAC3B,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,EAAA,EAAI,IAAA,EAAM;AACrB,MAAA,MAAM,GAAA,GAAM,SAAA,CAAU,IAAA,EAAiC,SAAS,CAAA;AAChE,MAAA,MAAM,EAAE,MAAM,OAAA,EAAS,KAAA,KAAW,MAAO,SAAA,GAAY,IAAA,CAAK,KAAK,EAE5D,MAAA,CAAO,GAAG,EAAE,EAAA,CAAG,IAAA,EAAM,EAAE,CAAA,CAAE,MAAA,GAAS,MAAA,EAAO;AAE5C,MAAA,IAAI,OAAO,MAAM,KAAA;AACjB,MAAA,OAAO,MAAA,CAAU,SAAU,SAAS,CAAA;AAAA,IACtC,CAAA;AAAA,IAEA,MAAM,OAAO,EAAA,EAAI;AACf,MAAA,MAAM,EAAE,KAAA,EAAM,GAAK,MAAO,SAAA,EAAU,CAAE,IAAA,CAAK,KAAK,CAAA,CAE7C,MAAA,EAAO,CAAE,EAAA,CAAG,MAAM,EAAE,CAAA;AACvB,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,WAAW,GAAA,EAAK;AACpB,MAAA,IAAI,CAAC,IAAI,MAAA,EAAQ;AACjB,MAAA,MAAM,EAAE,KAAA,EAAM,GAAK,MAAO,SAAA,EAAU,CAAE,IAAA,CAAK,KAAK,CAAA,CAE7C,MAAA,EAAO,CAAE,EAAA,CAAG,MAAM,GAAG,CAAA;AACxB,MAAA,IAAI,OAAO,MAAM,KAAA;AAAA,IACnB;AAAA,GACF;AACF;;;ACxOA,SAAS,SAAS,KAAA,EAAyB;AACzC,EAAA,IAAI,UAAU,IAAA,IAAQ,KAAA,KAAU,UAAa,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAC/E,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,QAAQ,CAAA;AACnD,EAAA,MAAM,SAAkC,EAAC;AACzC,EAAA,KAAA,MAAW,KAAK,MAAA,CAAO,IAAA,CAAK,KAAgC,CAAA,CAAE,MAAK,EAAG;AACpE,IAAA,MAAA,CAAO,CAAC,CAAA,GAAI,QAAA,CAAU,KAAA,CAAkC,CAAC,CAAC,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,aAAa,KAAA,EAA0B;AACrD,EAAA,OAAO,MAAM,GAAA,CAAI,CAAC,CAAA,KAAO,OAAO,MAAM,QAAA,GAAW,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,SAAS,CAAC,CAAC,CAAE,CAAA,CAAE,KAAK,GAAG,CAAA;AAC7F;AAOO,IAAM,iBAAA,GAAoB;AAE1B,SAAS,iBAAiB,MAAA,EAAkC;AACjE,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,iBAAA;AACzC,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,GAAA;AACzC,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAwB;AAE5C,EAAA,SAAS,QAAA,GAAW;AAClB,IAAA,IAAI,OAAA,CAAQ,QAAQ,UAAA,EAAY;AAEhC,IAAA,IAAI,SAAA,GAA2B,IAAA;AAC/B,IAAA,IAAI,YAAA,GAAe,QAAA;AACnB,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,OAAA,EAAS;AAClC,MAAA,IAAI,KAAA,CAAM,aAAa,YAAA,EAAc;AACnC,QAAA,YAAA,GAAe,KAAA,CAAM,UAAA;AACrB,QAAA,SAAA,GAAY,GAAA;AAAA,MACd;AAAA,IACF;AACA,IAAA,IAAI,SAAA,EAAW,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA;AAAA,EACzC;AAEA,EAAA,OAAO;AAAA,IACL,IAAO,GAAA,EAA4B;AACjC,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC7B,MAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,SAAA,EAAW;AAChC,QAAA,OAAA,CAAQ,OAAO,GAAG,CAAA;AAClB,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,KAAA,CAAM,UAAA,GAAa,KAAK,GAAA,EAAI;AAC5B,MAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IACf,CAAA;AAAA,IAEA,GAAA,CAAO,GAAA,EAAa,IAAA,EAAS,GAAA,EAAoB;AAC/C,MAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,MAAA,OAAA,CAAQ,IAAI,GAAA,EAAK;AAAA,QACf,IAAA;AAAA,QACA,SAAA,EAAW,OAAO,GAAA,IAAO,UAAA,CAAA;AAAA,QACzB,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,QAAA,EAAS;AAAA,IACX,CAAA;AAAA,IAEA,WAAW,MAAA,EAAsB;AAC/B,MAAA,KAAA,MAAW,GAAA,IAAO,OAAA,CAAQ,IAAA,EAAK,EAAG;AAChC,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,UAAA,OAAA,CAAQ,OAAO,GAAG,CAAA;AAAA,QACpB;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IAEA,KAAA,GAAc;AACZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AAAA,IAChB,CAAA;AAAA,IAEA,IAAA,GAAe;AACb,MAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,IACjB;AAAA,GACF;AACF;AAMO,IAAM,cAAc,gBAAA;AAIpB,SAAS,gBAAA,GAAyB;AACvC,EAAA,WAAA,CAAY,KAAA,EAAM;AACpB;ACjHA,IAAI,eAAA;AACJ,IAAM,SAAA,uBAAgB,GAAA,EAAgB;AAE/B,SAAS,kBAAkB,EAAA,EAA8B;AAC9D,EAAA,IAAI,OAAO,eAAA,EAAiB;AAC1B,IAAA,eAAA,GAAkB,EAAA;AAClB,IAAA,gBAAA,EAAiB;AACjB,IAAA,KAAA,MAAW,CAAA,IAAK,WAAW,CAAA,EAAE;AAAA,EAC/B;AACF;AAEO,SAAS,iBAAA,GAAwC;AACtD,EAAA,OAAO,eAAA;AACT;AAQO,SAAS,sBAAsB,QAAA,EAAkC;AACtE,EAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,EAAA,OAAO,MAAM;AAAE,IAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,EAAE,CAAA;AAC5C;AAIO,SAAS,iBAAA,GAAwC;AACtD,EAAA,OAAa,KAAA,CAAA,oBAAA,CAAqB,qBAAA,EAAuB,iBAAA,EAAmB,iBAAiB,CAAA;AAC/F","file":"chunk-BCI743RH.js","sourcesContent":["/**\n * ONE filter grammar, shared by the providers and by the agent's data tools.\n *\n * Models express ranges in whatever dialect they were trained on — `{from,to}`,\n * `{gte,lte}`, Mongo's `{$gte,$lt}`. When only some of those are recognised the\n * unrecognised one falls through to an equality compare against\n * \"[object Object]\", which matches nothing and reads as \"there are no\n * appointments today\" instead of \"I did not understand that filter\".\n */\n\nexport interface RangeFilter {\n  gte?: unknown\n  gt?: unknown\n  lte?: unknown\n  lt?: unknown\n}\n\nconst LOWER_INCLUSIVE = ['from', 'gte', 'start', 'after', 'since', 'min']\nconst LOWER_EXCLUSIVE = ['gt']\nconst UPPER_INCLUSIVE = ['to', 'lte', 'end', 'until', 'before', 'max']\nconst UPPER_EXCLUSIVE = ['lt']\n\nfunction pick(source: Record<string, unknown>, names: string[]): unknown {\n  for (const name of names) {\n    if (source[name] !== undefined && source[name] !== null) return source[name]\n    const dollar = `$${name}`\n    if (source[dollar] !== undefined && source[dollar] !== null) return source[dollar]\n  }\n  return undefined\n}\n\n/**\n * Parse a filter value into a range, or return null when it is a plain\n * (equality) value. An object that looks like a filter but carries no\n * recognised bound returns `null` too — callers treat that as \"invalid\",\n * never as \"matches nothing\".\n */\nexport function parseRangeFilter(value: unknown): RangeFilter | null {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return null\n  const source = value as Record<string, unknown>\n  const range: RangeFilter = {}\n  const gte = pick(source, LOWER_INCLUSIVE)\n  const gt = pick(source, LOWER_EXCLUSIVE)\n  const lte = pick(source, UPPER_INCLUSIVE)\n  const lt = pick(source, UPPER_EXCLUSIVE)\n  if (gte !== undefined) range.gte = gte\n  if (gt !== undefined) range.gt = gt\n  if (lte !== undefined) range.lte = lte\n  if (lt !== undefined) range.lt = lt\n  return Object.keys(range).length ? range : null\n}\n\n/** True for any object value — including ones no bound could be read from. */\nexport function isFilterObject(value: unknown): boolean {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nfunction comparable(value: unknown): number {\n  if (typeof value === 'number') return value\n  if (value instanceof Date) return value.getTime()\n  const ts = Date.parse(String(value))\n  if (!Number.isNaN(ts)) return ts\n  return Number(value)\n}\n\n/** Client-side counterpart of the range a provider would push to SQL. */\nexport function matchesRange(raw: unknown, range: RangeFilter): boolean {\n  const value = comparable(raw)\n  if (Number.isNaN(value)) return false\n  if (range.gte !== undefined && value < comparable(range.gte)) return false\n  if (range.gt !== undefined && value <= comparable(range.gt)) return false\n  if (range.lte !== undefined && value > comparable(range.lte)) return false\n  if (range.lt !== undefined && value >= comparable(range.lt)) return false\n  return true\n}\n\n/** Apply a range to a PostgREST query builder. */\nexport function applyRangeToQuery<Q>(\n  query: Q,\n  column: string,\n  range: RangeFilter,\n): Q {\n  let q = query as Record<string, (c: string, v: unknown) => unknown>\n  for (const op of ['gte', 'gt', 'lte', 'lt'] as const) {\n    const bound = range[op]\n    if (bound === undefined) continue\n    q = q[op](column, bound) as Record<string, (c: string, v: unknown) => unknown>\n  }\n  return q as Q\n}\n","// ---------------------------------------------------------------------------\n// The one place that turns \"the user is looking at Ipanema\" into a filter.\n//\n// This is a NARROWING and nothing else. Which units a person may reach is\n// decided by row-level security; if this file were deleted the app would show\n// more rows than the switcher promises, and still not one row the database\n// would have refused. That asymmetry is deliberate — it is what lets the filter\n// live in the client at all.\n// ---------------------------------------------------------------------------\n\nexport interface UnitScope {\n  column: string\n  id: string\n  /** Whether rows with no unit (\"belongs to the whole organization\") come too. */\n  includeShared: boolean\n}\n\n/** One row of `public.scoped_resources` — which tables carry a unit, and under\n *  which column. */\nexport interface ScopedResource {\n  unitColumn: string\n  shareable: boolean\n}\n\n// The registry, mirrored from the database rather than restated here.\n//\n// The list of scoped tables and their unit columns lives in ONE place —\n// `public.scoped_resources`, seeded by migration 041 — and the shell publishes\n// it at boot. A second copy in TypeScript would drift on the first table anyone\n// adds, and the failure mode of that drift is a screen that quietly stops\n// narrowing while the database still does.\nlet _scoped: Record<string, ScopedResource> = {}\n\nexport function setScopedResources(map: Record<string, ScopedResource>): void {\n  _scoped = map\n}\n\nexport function getScopedResource(table: string | undefined): ScopedResource | undefined {\n  if (!table) return undefined\n  return _scoped[table]\n}\n\nexport interface UnitScopeConfig {\n  unitScoped?: boolean\n  unitColumn?: string\n  /**\n   * Default true. A row with no unit belongs to the brand and must survive a\n   * unit selection — the Botox that is sold everywhere still shows in Ipanema.\n   *\n   * False for ledgers and aggregations, where a shared row summed into every\n   * unit is a wrong number stated confidently, which is worse than a missing\n   * one.\n   */\n  includeSharedRows?: boolean\n  unitId?: () => string | undefined\n}\n\n/**\n * `null` means \"do not narrow\" — unit mode off, \"todas as unidades\", or an\n * entity that never opted in. Callers treat null as a no-op, which is what\n * keeps every provider's behaviour identical for entities that are not scoped.\n */\nexport function resolveUnitScope(config: UnitScopeConfig): UnitScope | null {\n  if (!config.unitScoped) return null\n  const id = config.unitId?.()\n  if (!id) return null\n  return {\n    column: config.unitColumn ?? 'unit_id',\n    id,\n    includeShared: config.includeSharedRows !== false,\n  }\n}\n\n/**\n * Applies the scope to a PostgREST builder.\n *\n * The shared form is `or(unit.eq.X,unit.is.null)`. Multiple `or=` params AND\n * together in PostgREST, so this composes correctly with the search `.or()` the\n * providers already emit: (name matches) AND (unit is mine or nobody's).\n *\n * Note what is NOT here: an `.in(column, [...myUnits])`. Enumerating the user's\n * units in the browser is the exact mistake this whole design exists to avoid —\n * it would put the answer to \"which units may I see\" in the client, where it\n * can be edited.\n */\nexport function applyUnitScope<Q>(builder: Q, scope: UnitScope | null): Q {\n  if (!scope) return builder\n  const q = builder as unknown as {\n    or: (f: string) => unknown\n    eq: (c: string, v: unknown) => unknown\n  }\n  return (scope.includeShared\n    ? q.or(`${scope.column}.eq.${scope.id},${scope.column}.is.null`)\n    : q.eq(scope.column, scope.id)) as unknown as Q\n}\n","import type { DataProvider, CrudQuery, CrudResult } from './types'\nimport { applyRangeToQuery, isFilterObject, parseRangeFilter } from './filters'\nimport { applyUnitScope, resolveUnitScope } from './unit-scope'\n\nexport interface SupabaseProviderConfig {\n  schema?: string\n  tenantId?: string | (() => string | undefined)\n  tenantIdColumn?: string\n  searchColumns?: string[]\n  selectColumns?: string\n  columnMap?: Record<string, string>\n  filters?: Record<string, string>\n  defaults?: Record<string, unknown>\n  supabaseClient?: unknown\n  /** Franchise scoping. Absent (every entity today) ⇒ nothing below changes. */\n  unitScoped?: boolean\n  unitColumn?: string\n  includeSharedRows?: boolean\n  unitId?: () => string | undefined\n}\n\nfunction camelToSnake(str: string): string {\n  return str.replace(/[A-Z]/g, (c) => '_' + c.toLowerCase())\n}\n\nfunction snakeToCamel(str: string): string {\n  return str.replace(/_([a-z])/g, (_, c: string) => c.toUpperCase())\n}\n\nfunction mapRow<T>(row: Record<string, unknown>, columnMap?: Record<string, string>): T {\n  const result: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(row)) {\n    const camelKey = columnMap?.[key] ?? snakeToCamel(key)\n    result[camelKey] = value\n  }\n  return result as T\n}\n\nfunction mapEntity(entity: Record<string, unknown>, columnMap?: Record<string, string>): Record<string, unknown> {\n  const reverseMap: Record<string, string> = {}\n  if (columnMap) {\n    for (const [snake, camel] of Object.entries(columnMap)) {\n      reverseMap[camel] = snake\n    }\n  }\n  const result: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(entity)) {\n    // `createdBy` entra na lista: quem o escreve é o gatilho do banco, com\n    // `auth.uid()`. Deixá-lo passar daria à interface a chance de dizer quem\n    // cadastrou — e um autor que o próprio formulário pode escolher não vale\n    // como procedência. Ver packages/db/migrations/025_created_by.sql.\n    // `ownerId` for the same reason: 041's trigger decides who a record belongs\n    // to, and a form that could set it would be handing records to other people.\n    if (key === 'id' || key === 'createdAt' || key === 'updatedAt' || key === 'tenantId' || key === 'createdBy' || key === 'ownerId') continue\n    const snakeKey = reverseMap[key] ?? camelToSnake(key)\n    result[snakeKey] = value\n  }\n  return result\n}\n\n// Global Supabase client registry — set once via createFayzApp\nlet _globalSupabaseClient: unknown | null = null\n\nexport function setGlobalSupabaseClient(client: unknown): void {\n  _globalSupabaseClient = client\n}\n\nexport function getSupabaseClientOptional(): unknown | null {\n  return _globalSupabaseClient\n}\n\nexport function createSupabaseProvider<T extends { id: string }>(\n  table: string,\n  config?: SupabaseProviderConfig,\n): DataProvider<T> {\n  const schema = config?.schema ?? 'public'\n  const tenantIdCol = config?.tenantIdColumn ?? 'tenant_id'\n  const searchCols = config?.searchColumns ?? []\n  const selectCols = config?.selectColumns ?? '*'\n  const columnMap = config?.columnMap\n\n  function resolveTenantId(): string | undefined {\n    if (!config?.tenantId) return undefined\n    return typeof config.tenantId === 'function' ? config.tenantId() : config.tenantId\n  }\n\n  function unitScope() {\n    return resolveUnitScope(config ?? {})\n  }\n\n  function getClient() {\n    const supabase = (config?.supabaseClient ?? _globalSupabaseClient) as {\n      schema: (s: string) => unknown\n      from: (t: string) => unknown\n    } | null\n    if (!supabase) throw new Error(`[@fayz-ai/core] Supabase client not available. Call createFayzApp with a provider first.`)\n    return schema === 'public' ? (supabase as { from: (t: string) => unknown }) : (supabase.schema(schema) as { from: (t: string) => unknown })\n  }\n\n  return {\n    async list(query: CrudQuery): Promise<CrudResult<T>> {\n      // 'none' skips PostgREST's count aggregate entirely — see CrudQuery.countMode.\n      const wantCount = query.countMode !== 'none'\n      let q = (getClient().from(table) as { select: (...args: unknown[]) => unknown })\n        .select(selectCols, wantCount ? { count: 'exact' } : undefined) as Record<string, unknown>\n\n      const tenantId = resolveTenantId()\n      if (tenantId) q = (q as { eq: (col: string, val: string) => unknown }).eq(tenantIdCol, tenantId) as Record<string, unknown>\n\n      // Narrowing only — the boundary itself is the restrictive policy in the\n      // database. Placed before the search `.or()` because PostgREST ANDs the\n      // two `or=` params, which is what makes them compose.\n      q = applyUnitScope(q, unitScope()) as Record<string, unknown>\n\n      if (config?.filters) {\n        for (const [col, val] of Object.entries(config.filters)) {\n          q = (q as { eq: (c: string, v: string) => unknown }).eq(col, val) as Record<string, unknown>\n        }\n      }\n\n      // Faceted / dynamic filters from the query, mapped to columns. Equality\n      // by default; a range object ({from,to} / {gte,lt} / {$gte,$lt}) becomes\n      // real SQL bounds instead of an equality compare against \"[object Object]\".\n      if (query.filters) {\n        for (const [key, val] of Object.entries(query.filters)) {\n          if (val == null || val === '') continue\n          const col = columnMap?.[key] ?? camelToSnake(key)\n          const range = parseRangeFilter(val)\n          if (range) {\n            q = applyRangeToQuery(q, col, range)\n            continue\n          }\n          if (isFilterObject(val)) {\n            throw new Error(\n              `[@fayz-ai/core] Filter \"${key}\" is an object with no recognised bound. ` +\n                'Use {from,to} / {gte,lte,gt,lt} for ranges, or a plain value for equality.',\n            )\n          }\n          q = (q as { eq: (c: string, v: unknown) => unknown }).eq(col, val) as Record<string, unknown>\n        }\n      }\n\n      if (query.search && searchCols.length > 0) {\n        const term = `%${query.search}%`\n        const orClause = searchCols.map((col) => `${camelToSnake(col)}.ilike.${term}`).join(',')\n        q = (q as { or: (c: string) => unknown }).or(orClause) as Record<string, unknown>\n      }\n\n      if (query.sortBy) {\n        q = (q as { order: (col: string, opts: unknown) => unknown })\n          .order(camelToSnake(query.sortBy), { ascending: query.sortDir !== 'desc' }) as Record<string, unknown>\n      } else {\n        q = (q as { order: (col: string, opts: unknown) => unknown })\n          .order('created_at', { ascending: false }) as Record<string, unknown>\n      }\n\n      const page = query.page ?? 1\n      const pageSize = query.pageSize ?? 50\n      const from = (page - 1) * pageSize\n      q = (q as { range: (f: number, t: number) => unknown }).range(from, from + pageSize - 1) as Record<string, unknown>\n\n      const { data, error, count } = await q as { data: Record<string, unknown>[] | null; error: unknown; count: number | null }\n      if (error) throw error\n\n      return {\n        data: (data ?? []).map((row) => mapRow<T>(row, columnMap)),\n        total: count ?? 0,\n      }\n    },\n\n    async create(data) {\n      const row = mapEntity(data as Record<string, unknown>, columnMap)\n      const tenantId = resolveTenantId()\n      if (tenantId) row[tenantIdCol] = tenantId\n      const scope = unitScope()\n      if (scope && row[scope.column] === undefined) row[scope.column] = scope.id\n      if (config?.defaults) {\n        for (const [col, val] of Object.entries(config.defaults)) {\n          if (row[col] === undefined) row[col] = val\n        }\n      }\n\n      const { data: created, error } = (await (getClient().from(table) as {\n        insert: (r: unknown) => { select: () => { single: () => Promise<{ data: unknown; error: unknown }> } }\n      }).insert(row).select().single()) as { data: Record<string, unknown> | null; error: unknown }\n\n      if (error) throw error\n      return mapRow<T>(created!, columnMap)\n    },\n\n    async createMany(rows, options) {\n      const tenantId = resolveTenantId()\n      const size = Math.max(1, options?.chunkSize ?? 200)\n      const scope = unitScope()\n      const prepared = rows.map((r) => {\n        const row = mapEntity(r as Record<string, unknown>, columnMap)\n        if (tenantId) row[tenantIdCol] = tenantId\n        if (scope && row[scope.column] === undefined) row[scope.column] = scope.id\n        if (config?.defaults) {\n          for (const [col, val] of Object.entries(config.defaults)) {\n            if (row[col] === undefined) row[col] = val\n          }\n        }\n        return row\n      })\n\n      let created = 0\n      const failed: Array<{ index: number; message: string }> = []\n      for (let start = 0; start < prepared.length; start += size) {\n        const chunk = prepared.slice(start, start + size)\n        const { error } = (await (getClient().from(table) as {\n          insert: (r: unknown) => Promise<{ error: unknown }>\n        }).insert(chunk)) as { error: unknown }\n        if (!error) {\n          created += chunk.length\n        } else {\n          // One bad row rejects its whole chunk. Retrying it row by row keeps\n          // the other 199 — an import that loses 200 records over one malformed\n          // phone number is worse than no import.\n          const message = error instanceof Error ? error.message : String(error)\n          for (let i = 0; i < chunk.length; i++) {\n            const { error: rowError } = (await (getClient().from(table) as {\n              insert: (r: unknown) => Promise<{ error: unknown }>\n            }).insert(chunk[i])) as { error: unknown }\n            if (rowError) {\n              failed.push({\n                index: start + i,\n                message: rowError instanceof Error ? rowError.message : String(rowError ?? message),\n              })\n            } else created += 1\n          }\n        }\n        options?.onProgress?.(Math.min(start + chunk.length, prepared.length), prepared.length)\n      }\n      return { created, failed }\n    },\n\n    async update(id, data) {\n      const row = mapEntity(data as Record<string, unknown>, columnMap)\n      const { data: updated, error } = (await (getClient().from(table) as {\n        update: (r: unknown) => { eq: (c: string, v: string) => { select: () => { single: () => Promise<{ data: unknown; error: unknown }> } } }\n      }).update(row).eq('id', id).select().single()) as { data: Record<string, unknown> | null; error: unknown }\n\n      if (error) throw error\n      return mapRow<T>(updated!, columnMap)\n    },\n\n    async remove(id) {\n      const { error } = (await (getClient().from(table) as {\n        delete: () => { eq: (c: string, v: string) => Promise<{ error: unknown }> }\n      }).delete().eq('id', id)) as { error: unknown }\n      if (error) throw error\n    },\n\n    async removeMany(ids) {\n      if (!ids.length) return\n      const { error } = (await (getClient().from(table) as {\n        delete: () => { in: (c: string, v: string[]) => Promise<{ error: unknown }> }\n      }).delete().in('id', ids)) as { error: unknown }\n      if (error) throw error\n    },\n  }\n}\n","// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\ninterface CacheEntry<T = unknown> {\n  data: T\n  expiresAt: number\n  lastAccess: number\n}\n\nexport interface CacheStore {\n  get<T>(key: string): T | undefined\n  set<T>(key: string, data: T, ttl?: number): void\n  /** Clear all entries whose key starts with `prefix` */\n  invalidate(prefix: string): void\n  clear(): void\n  size(): number\n}\n\nexport interface CacheConfig {\n  /** Default time-to-live in ms (default: 60 000 — 1 minute) */\n  defaultTTL?: number\n  /** Maximum cached entries before LRU eviction (default: 500) */\n  maxEntries?: number\n}\n\n// ---------------------------------------------------------------------------\n// Stable key helper — deterministic JSON for cache keys\n// ---------------------------------------------------------------------------\n\nfunction sortDeep(value: unknown): unknown {\n  if (value === null || value === undefined || typeof value !== 'object') return value\n  if (Array.isArray(value)) return value.map(sortDeep)\n  const sorted: Record<string, unknown> = {}\n  for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n    sorted[k] = sortDeep((value as Record<string, unknown>)[k])\n  }\n  return sorted\n}\n\nexport function stableKey(...parts: unknown[]): string {\n  return parts.map((p) => (typeof p === 'string' ? p : JSON.stringify(sortDeep(p)))).join(':')\n}\n\n// ---------------------------------------------------------------------------\n// CacheStore implementation\n// ---------------------------------------------------------------------------\n\n/** Shared so the persistent layer can reconstruct the same `expiresAt` L1 computed. */\nexport const DEFAULT_CACHE_TTL = 60_000\n\nexport function createCacheStore(config?: CacheConfig): CacheStore {\n  const defaultTTL = config?.defaultTTL ?? DEFAULT_CACHE_TTL\n  const maxEntries = config?.maxEntries ?? 500\n  const entries = new Map<string, CacheEntry>()\n\n  function evictLRU() {\n    if (entries.size <= maxEntries) return\n    // Find the entry with the oldest lastAccess\n    let oldestKey: string | null = null\n    let oldestAccess = Infinity\n    for (const [key, entry] of entries) {\n      if (entry.lastAccess < oldestAccess) {\n        oldestAccess = entry.lastAccess\n        oldestKey = key\n      }\n    }\n    if (oldestKey) entries.delete(oldestKey)\n  }\n\n  return {\n    get<T>(key: string): T | undefined {\n      const entry = entries.get(key)\n      if (!entry) return undefined\n      if (Date.now() > entry.expiresAt) {\n        entries.delete(key)\n        return undefined\n      }\n      entry.lastAccess = Date.now()\n      return entry.data as T\n    },\n\n    set<T>(key: string, data: T, ttl?: number): void {\n      const now = Date.now()\n      entries.set(key, {\n        data,\n        expiresAt: now + (ttl ?? defaultTTL),\n        lastAccess: now,\n      })\n      evictLRU()\n    },\n\n    invalidate(prefix: string): void {\n      for (const key of entries.keys()) {\n        if (key.startsWith(prefix)) {\n          entries.delete(key)\n        }\n      }\n    },\n\n    clear(): void {\n      entries.clear()\n    },\n\n    size(): number {\n      return entries.size\n    },\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Global singleton — auto-flushes on tenant/org switch\n// ---------------------------------------------------------------------------\n\nexport const globalCache = createCacheStore()\n\n/** Flush the global cache — called by the tenant accessor when the active\n *  tenant changes (replaces the old org-store subscription). */\nexport function clearGlobalCache(): void {\n  globalCache.clear()\n}\n","// Active tenant context — a global accessor the data layer reads for tenant\n// scoping and cache keying. The host (saas shell / app) sets it from its org\n// store via setActiveTenantId; the data providers stay decoupled from any\n// specific org-store implementation (runtime DI).\nimport * as React from 'react'\nimport { clearGlobalCache } from './cache'\n\nlet _activeTenantId: string | undefined\nconst listeners = new Set<() => void>()\n\nexport function setActiveTenantId(id: string | undefined): void {\n  if (id !== _activeTenantId) {\n    _activeTenantId = id\n    clearGlobalCache()\n    for (const l of listeners) l()\n  }\n}\n\nexport function getActiveTenantId(): string | undefined {\n  return _activeTenantId\n}\n\n/**\n * Subscribes to tenant changes. A getter alone makes every read a race with the\n * shell: a view that mounts before the org store resolves reads `undefined`,\n * and a tenant-scoped fetch that answers \"no tenant\" looks exactly like \"no\n * rows\" — it never retries and the screen stays empty until a remount.\n */\nexport function subscribeActiveTenant(listener: () => void): () => void {\n  listeners.add(listener)\n  return () => { listeners.delete(listener) }\n}\n\n/** The active tenant, re-rendering when it resolves or changes. Use this to key\n *  effects that fetch tenant-scoped data. */\nexport function useActiveTenantId(): string | undefined {\n  return React.useSyncExternalStore(subscribeActiveTenant, getActiveTenantId, getActiveTenantId)\n}\n"]}

package/dist/{chunk-IKZR3WSK.js → chunk-KJUD6JA5.js}

@@ -1,4 +1,4 @@
-import { isConnectorCategory, CONNECTOR_CATEGORIES, requestPlaneSpec, connectorPlanes, invocationPlane, connectorSubscribes, permissionActions, isEventPermission, connectorEntities, connectorSubscribesTo } from './chunk-7GJTLBG3.js';
+import { isConnectorCategory, CONNECTOR_CATEGORIES, requestPlaneSpec, connectorPlanes, invocationPlane, connectorSubscribes, permissionActions, isEventPermission, connectorEntities, connectorSubscribesTo } from './chunk-OHH26S4N.js';
 
 // src/testing.ts
 var PluginContractError = class extends Error {
@@ -285,5 +285,5 @@ function assertConnectorContract(connector) {
 }
 
 export { PluginContractError, assertConnectorContract, assertPluginManifestContract, bespokeConnectorTables };
-//# sourceMappingURL=chunk-IKZR3WSK.js.map
-//# sourceMappingURL=chunk-IKZR3WSK.js.map
+//# sourceMappingURL=chunk-KJUD6JA5.js.map
+//# sourceMappingURL=chunk-KJUD6JA5.js.map

package/dist/{chunk-IKZR3WSK.js.map → chunk-KJUD6JA5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/testing.ts"],"names":[],"mappings":";;;AA0BO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEA,SAAS,IAAA,CAAK,OAAe,GAAA,EAAoB;AAC/C,EAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,CAAA,EAAI,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AACnD;AAEA,SAAS,eAAe,CAAA,EAAyB;AAC/C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,IAAA,GAAO,MAAA,GAAS,CAAA;AACpD;AAOO,SAAS,6BAA6B,QAAA,EAAgC;AAC3E,EAAA,MAAM,KAAK,QAAA,EAAU,EAAA;AACrB,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,EAAE,CAAA,GAAI,EAAA,GAAK,kBAAA;AAExC,EAAA,KAAA,MAAW,SAAS,CAAC,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,SAAS,CAAA,EAAY;AAC9D,IAAA,IAAI,CAAC,cAAA,CAAe,QAAA,GAAW,KAAK,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,KAAK,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,IAAA,CAAK,OAAO,yEAAyE,CAAA;AAC9H,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,qEAAqE,CAAA;AAGtH,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,QAAA,CAAS,UAAA,CAAW,SAAQ,EAAG;AACpD,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAAA,EAC3G;AACA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,KAAK,KAAK,QAAA,CAAS,MAAA,CAAO,SAAQ,EAAG;AAClD,IAAA,IAAI,CAAC,eAAgB,KAAA,EAAe,IAAI,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,OAAA,EAAU,CAAC,CAAA,iCAAA,CAAmC,CAAA;AACrG,IAAA,IAAI,OAAQ,OAAe,SAAA,KAAc,UAAA,OAAiB,KAAA,EAAO,CAAA,OAAA,EAAU,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,GAAA,CAAK,KAAA,CAAc,IAAI,CAAA,OAAQ,KAAA,EAAO,CAAA,sBAAA,EAA0B,KAAA,CAAc,IAAI,CAAA,CAAA,CAAG,CAAA;AACpG,IAAA,UAAA,CAAW,GAAA,CAAK,MAAc,IAAI,CAAA;AAAA,EACpC;AAEA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,QAAA,CAAS,UAAA,CAAW,SAAQ,EAAG;AACpD,IAAA,MAAM,IAAK,GAAA,CAAY,KAAA;AACvB,IAAA,IAAI,WAAW,IAAA,GAAO,CAAA,IAAK,CAAC,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,EAAG;AAC7C,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,SAAA,EAAY,CAAC,CAAA,0CAAA,CAA4C,CAAA;AAAA,IACtF;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,QAAA,IAAY,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC1D,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,+BAAA,CAAiC,CAAA;AACjG,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AACvG,IAAA,IAAI,OAAQ,KAAa,SAAA,KAAc,UAAA,OAAiB,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,GAAA,CAAK,GAAA,CAAY,EAAE,CAAA,OAAQ,KAAA,EAAO,CAAA,2BAAA,EAA+B,GAAA,CAAY,EAAE,CAAA,CAAA,CAAG,CAAA;AACjG,IAAA,UAAA,CAAW,GAAA,CAAK,IAAY,EAAE,CAAA;AAAA,EAChC;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,IAAI,CAAA,IAAA,CAAM,SAAS,gBAAA,IAAoB,EAAC,EAAG,OAAA,EAAQ,EAAG;AACnE,IAAA,IAAI,CAAC,eAAgB,IAAA,EAAc,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,iBAAA,EAAoB,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC5G;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC3D,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAC/F,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,SAAS,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sCAAA,CAAwC,CAAA;AACvG,IAAA,KAAA,MAAW,MAAA,IAAU,GAAA,CAAI,OAAA,IAAW,EAAC,EAAG;AACtC,MAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sBAAA,EAAyB,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9F;AAAA,EACF;AAEA,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAY;AACtC,EAAA,KAAA,MAAW,CAAC,GAAG,EAAE,CAAA,IAAA,CAAM,SAAS,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC1D,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,EAAA,EAAI,IAAA,IAAQ,EAAE,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sEAAA,CAAmE,CAAA;AAC7H,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,EAAA,CAAG,IAAI,CAAA,OAAQ,KAAA,EAAO,CAAA,yBAAA,EAA4B,EAAA,CAAG,IAAI,CAAA,CAAA,CAAG,CAAA;AAClF,IAAA,aAAA,CAAc,GAAA,CAAI,GAAG,IAAI,CAAA;AACzB,IAAA,IAAI,OAAO,GAAG,SAAA,KAAc,SAAA,OAAgB,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAChG,IAAA,IAAI,CAAC,iBAAiB,GAAA,CAAI,EAAA,CAAG,OAAO,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,UAAA,EAAa,CAAC,cAAc,EAAA,CAAG,OAAO,mBAAmB,CAAC,GAAG,gBAAgB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAE9I,IAAA,IAAI,EAAA,CAAG,YAAY,MAAA,IAAU,EAAA,CAAG,WAAW,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,iEAAA,CAAmE,CAAA;AACxI,IAAA,KAAA,MAAW,MAAA,IAAU,EAAA,CAAG,OAAA,IAAW,EAAC,EAAG;AAErC,MAAA,IAAI,CAAC,YAAY,IAAA,CAAK,MAAM,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,4EAAA,CAA8E,CAAA;AAAA,IACzI;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAG5D,IAAA,IAAI,IAAI,QAAA,KAAa,MAAA,IAAa,CAAC,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpE,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,CAAA,WAAA,EAAc,CAAC,CAAA,YAAA,EAAe,GAAA,CAAI,QAAQ,CAAA,gDAAA,EAC1B,oBAAA,CAAqB,IAAA,CAAK,IAAI,CAAC,CAAA,0DAAA;AAAA,OACjD;AAAA,IACF;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,GAAA,CAAI,YAAA,IAAgB,EAAC,EAAG;AAC5C,MAAA,IAAI,CAAC,eAAe,OAAO,CAAA,OAAQ,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,2CAAA,CAA6C,CAAA;AAEtG,MAAA,IAAI,OAAA,CAAQ,SAAS,GAAG,CAAA,IAAK,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACnD,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,gBAAA,EAAmB,OAAO,CAAA,wCAAA,CAAqC,CAAA;AAAA,MAC5F;AAAA,IACF;AAEA,IAAA,0BAAA,CAA2B,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AAIzD,IAAA,IAAA,CAAK,IAAI,MAAA,IAAU,EAAC,EAAG,QAAA,CAAS,SAAS,CAAA,EAAG;AAC1C,MAAA,IAAI;AACF,QAAA,gBAAA,CAAiB,GAAG,CAAA;AAAA,MACtB,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MAC1F;AAAA,IACF,WAAW,GAAA,CAAI,eAAA,KAAoB,MAAA,IAAa,GAAA,CAAI,cAAc,MAAA,EAAW;AAC3E,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,cAAc,CAAC,CAAA,mJAAA;AAAA,OAEjB;AAAA,IACF;AAIA,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAA,CAAK,GAAA,CAAI,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAC,CAAA;AAC9D,IAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,IAAA,KAAA,MAAW,CAAC,GAAG,OAAO,CAAA,IAAA,CAAM,IAAI,QAAA,IAAY,EAAC,EAAG,OAAA,EAAQ,EAAG;AACzD,MAAA,MAAM,EAAA,GAAK,CAAA,WAAA,EAAc,CAAC,CAAA,WAAA,EAAc,CAAC,CAAA,CAAA,CAAA;AACzC,MAAA,IAAI,CAAC,eAAe,OAAA,EAAS,GAAG,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AACrF,MAAA,IAAI,CAAC,eAAe,OAAA,EAAS,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iCAAA,CAAmC,CAAA;AACzF,MAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACpC,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,OAAA,EAAU,QAAQ,IAAI,CAAA,gBAAA,EAAmB,CAAC,GAAG,aAAa,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC3F;AACA,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,0BAAA,EAA6B,OAAA,CAAQ,GAAG,CAAA,CAAA,CAAG,CAAA;AAC9F,MAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,GAAG,CAAA;AAC3B,MAAA,IAAI,SAAA,CAAU,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC9B,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,EAAE,CAAA,MAAA,EAAS,OAAA,CAAQ,GAAG,CAAA,4HAAA;AAAA,SAE3B;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,SAAS,cAAA,EAAgB;AAChE,QAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,IAAK,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACnE,UAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,MAAA,EAAS,OAAA,CAAQ,IAAI,CAAA,sEAAA,CAAmE,CAAA;AAAA,QAC3G;AACA,QAAA,KAAA,MAAW,CAAC,CAAA,EAAG,MAAM,KAAK,OAAA,CAAQ,OAAA,CAAQ,SAAQ,EAAG;AACnD,UAAA,IAAI,CAAC,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AACtG,UAAA,IAAI,CAAC,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAAA,QACxG;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,YAAY,MAAA,EAAW;AACjC,QAAA,IAAI,QAAQ,IAAA,KAAS,MAAA,OAAa,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,uCAAA,CAAyC,CAAA;AACvF,QAAA,IAAI;AACF,UAAA,IAAI,MAAA,CAAO,QAAQ,OAAO,CAAA;AAAA,QAC5B,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,0CAAA,CAA4C,CAAA;AAAA,QAC/D;AAEA,QAAA,IAAI,CAAC,eAAe,OAAA,CAAQ,WAAW,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,mDAAA,CAAqD,CAAA;AAAA,MAClH;AAAA,IACF;AAEA,IAAA,IAAI,WAAA,CAAY,OAAO,CAAA,EAAG;AACxB,MAAA,IAAI,OAAO,IAAI,WAAA,KAAgB,UAAA,OAAiB,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,wCAAA,CAA0C,CAAA;AAChH,MAAA,IAAI,OAAO,IAAI,YAAA,KAAiB,UAAA,OAAiB,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,yCAAA,CAA2C,CAAA;AAAA,IACpH;AAIA,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAG,CAAC,CAAA;AAC3C,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,KAAA,MAAW,CAAC,GAAG,MAAM,CAAA,IAAA,CAAM,IAAI,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AACzD,MAAA,MAAM,EAAA,GAAK,CAAA,WAAA,EAAc,CAAC,CAAA,YAAA,EAAe,CAAC,CAAA,CAAA,CAAA;AAC1C,MAAA,IAAI,CAAC,eAAe,MAAA,EAAQ,GAAG,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AACpF,MAAA,IAAI,CAAC,eAAe,MAAA,EAAQ,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iCAAA,CAAmC,CAAA;AACxF,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iBAAA,EAAoB,MAAA,CAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAClF,MAAA,UAAA,CAAW,GAAA,CAAI,OAAO,GAAG,CAAA;AACzB,MAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AACpC,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,EAAG;AACtB,QAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,uBAAuB,KAAK,CAAA,yBAAA,EAA4B,CAAC,CAAA,yBAAA,CAA2B,CAAA;AAAA,MACvG;AACA,MAAA,IAAI,MAAA,CAAO,YAAY,MAAA,EAAW;AAChC,QAAA,IAAI,UAAU,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,sCAAA,CAAwC,CAAA;AAC/E,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AAGA,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAA,CAAK,GAAA,CAAI,WAAA,IAAe,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AACvE,MAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC3C,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC3B,UAAA,IAAA;AAAA,YACE,KAAA;AAAA,YACA,CAAA,EAAG,EAAE,CAAA,gBAAA,EAAmB,QAAQ,uBAAuB,CAAC,CAAA,kGAAA;AAAA,WAE1D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,CAAC,GAAG,IAAI,CAAA,IAAA,CAAM,IAAI,kBAAA,IAAsB,EAAC,EAAG,OAAA,EAAQ,EAAG;AAChE,MAAA,IAAI,CAAC,cAAA,CAAe,IAAA,EAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,qCAAA,CAAuC,CAAA;AAChI,MAAA,IAAI,CAAC,cAAA,CAAe,IAAA,EAAM,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAE1H,MAAA,IAAI,CAAC,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC5C,QAAA,IAAA,CAAK,KAAA,EAAO,cAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,YAAA,EAAe,IAAA,CAAK,QAAQ,CAAA,uCAAA,CAAyC,CAAA;AAAA,MAC3H;AAAA,IACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC5D,IAAA,KAAA,MAAW,KAAA,IAAS,sBAAA,CAAuB,GAAA,EAAK,GAAG,CAAA,EAAG;AACpD,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,cAAc,CAAC,CAAA,IAAA,EAAO,KAAK,EAAA,IAAM,GAAG,qBAAqB,KAAK,CAAA,mQAAA;AAAA,OAIhE;AAAA,IACF;AAAA,EACF;AAIA,EAAA,IACE,SAAS,UAAA,CAAW,MAAA,KAAW,KAC/B,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,IAAA,CAC1B,QAAA,CAAS,YAAY,EAAC,EAAG,WAAW,CAAA,IAAA,CACpC,QAAA,CAAS,cAAc,EAAC,EAAG,WAAW,CAAA,EACvC;AACA,IAAA,IAAA,CAAK,OAAO,wGAAmG,CAAA;AAAA,EACjH;AACF;AA0BA,SAAS,0BAAA,CACP,KAAA,EACA,IAAA,EACA,GAAA,EACM;AACN,EAAA,MAAM,cAAc,GAAA,CAAI,WAAA;AACxB,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC/B,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,WAAW,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,6BAAA,CAA+B,CAAA;AAEnF,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,UAAU,CAAA,IAAK,WAAA,CAAY,SAAQ,EAAG;AACnD,IAAA,MAAM,EAAA,GAAK,CAAA,EAAG,IAAI,CAAA,aAAA,EAAgB,CAAC,CAAA,CAAA,CAAA;AACnC,IAAA,IAAI,UAAA,EAAY,IAAA,KAAS,MAAA,IAAU,UAAA,EAAY,SAAS,OAAA,EAAS;AAC/D,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,CAAC,eAAe,UAAA,CAAW,QAAQ,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,oCAAA,CAAsC,CAAA;AAGjG,IAAA,IAAI,CAAC,cAAA,CAAe,UAAA,CAAW,MAAM,CAAA,EAAG;AACtC,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+EAAA,CAA4E,CAAA;AAAA,IAC/F;AACA,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA,IAAK,UAAA,CAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACzE,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,2FAAA,CAAwF,CAAA;AAAA,IAC3G;AACA,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,UAAA,CAAW,IAAI,CAAA;AAC/C,IAAA,KAAA,MAAW,MAAA,IAAU,WAAW,OAAA,EAAS;AACvC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,QAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,WAAA,EAAc,MAAM,YAAY,UAAA,CAAW,IAAI,CAAA,WAAA,EAAc,UAAA,CAAW,QAAQ,CAAA,qBAAA,EAAwB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC7I;AAAA,IACF;AACA,IAAA,IAAI,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,IAAK,CAAC,UAAA,CAAW,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5G,MAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,WAAA,EAAc,UAAA,CAAW,QAAQ,CAAA,wCAAA,CAAqC,CAAA;AAAA,IACzF;AACA,IAAA,MAAM,MAAM,CAAA,EAAG,UAAA,CAAW,IAAI,CAAA,CAAA,EAAI,WAAW,QAAQ,CAAA,CAAA;AACrD,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,UAAA,EAAa,GAAG,CAAA,0CAAA,CAAuC,CAAA;AAC3F,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EACd;AAGA,EAAA,IAAI,GAAA,CAAI,aAAa,MAAA,EAAW;AAC9B,IAAA,MAAM,WAAW,IAAI,GAAA,CAAI,kBAAkB,EAAE,WAAA,EAAa,CAAC,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AACnC,IAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA,EAAG;AACvB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,sBAAA,EAAyB,MAAM,YAAY,IAAI,CAAA,0HAAA;AAAA,SAExD;AAAA,MACF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,UAAU,MAAA,EAAQ;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACzB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,iBAAA,EAAoB,MAAM,CAAA,0IAAA;AAAA,SAEnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,GAAA,CAAI,iBAAiB,MAAA,EAAW;AAClC,IAAA,MAAM,WAAW,IAAI,GAAA,CAAI,sBAAsB,EAAE,WAAA,EAAa,CAAC,CAAA;AAC/D,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,YAAY,CAAA;AACvC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACxB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,yBAAA,EAA4B,OAAO,YAAY,IAAI,CAAA,yHAAA;AAAA,SAE5D;AAAA,MACF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,WAAW,MAAA,EAAQ;AAC5B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1B,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,wBAAA,EAA2B,OAAO,CAAA,+GAAA;AAAA,SAE3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAeA,IAAM,uBAAA,GACJ,gHAAA;AAGK,SAAS,uBAAuB,GAAA,EAAwB;AAC7D,EAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,GAAI,EAAA;AAC/D,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,uBAAuB,CAAA,EAAG,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,CAAC,CAAA,CAAE,WAAA,EAAa,CAAA;AACpF,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAEA,IAAM,gCAAgB,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAC/D,IAAM,mCAAmB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AACjD,IAAM,IAAA,GAAO,sBAAA;AACb,IAAM,WAAA,GAAc,mBAAA;AAEpB,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,cAAA,EAAgB,QAAQ,CAAC,CAAA;AAC1E,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,SAAA,EAAW,MAAM,CAAC,CAAA;AACvD,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,UAAA,EAAY,eAAe,CAAC,CAAA;AACnE,IAAM,QAAA,uBAAe,GAAA,CAAI,CAAC,YAAY,WAAA,EAAa,QAAA,EAAU,SAAS,CAAC,CAAA;AAQhE,SAAS,wBAAwB,SAAA,EAA4B;AAClE,EAAA,MAAM,KAAA,GAAQ,eAAe,SAAA,EAAW,EAAE,IAAI,CAAA,UAAA,EAAa,SAAA,CAAU,EAAE,CAAA,CAAA,GAAK,qBAAA;AAC5E,EAAA,KAAA,MAAW,KAAA,IAAS,CAAC,IAAA,EAAM,UAAA,EAAY,UAAU,CAAA,EAAY;AAC3D,IAAA,IAAI,CAAC,cAAA,CAAe,SAAA,GAAY,KAAK,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,KAAK,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACtG;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,UAAU,QAAQ,CAAA,OAAQ,KAAA,EAAO,CAAA,oBAAA,EAAuB,UAAU,QAAQ,CAAA,gBAAA,EAAmB,CAAC,GAAG,UAAU,EAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAC7I,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAA,CAAU,YAAY,CAAA,IAAK,SAAA,CAAU,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACjF,IAAA,IAAA,CAAK,OAAO,0DAA0D,CAAA;AAAA,EACxE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,SAAA,CAAU,YAAA,CAAa,SAAQ,EAAG;AACvD,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,MAAM,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,mCAAA,CAAqC,CAAA;AACpG,IAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,aAAA,EAAgB,GAAA,CAAI,SAAS,CAAA,YAAA,CAAc,CAAA;AAC5G,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,4BAAA,CAA8B,CAAA;AAC1H,IAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,QAAA,EAAU;AAC/B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACzF;AAAA,EACF;AACF","file":"chunk-IKZR3WSK.js","sourcesContent":["// ---------------------------------------------------------------------------\n// Plugin contract assertions — the integrity half of the deploy gate.\n// ---------------------------------------------------------------------------\n// Framework-agnostic runtime checks (no test-runner dependency) that any\n// plugin's *.test.ts calls to prove its manifest/connector conform to the\n// platform contract BEFORE it can ship. A plugin that fails these would break\n// the host app at mount time (missing route component, duplicate ids, malformed\n// settings tab). Pair with a capability test (does the plugin do its job?) — see\n// docs/plugins/PLUGIN-PATTERNS.md → capability anatomy. These throw on the first violation.\nimport type { PluginManifest } from './types/plugins'\nimport type { Connector } from './integrations'\nimport {\n  CONNECTOR_CATEGORIES,\n  connectorEntities,\n  connectorPlanes,\n  connectorSubscribes,\n  connectorSubscribesTo,\n  grants,\n  invocationPlane,\n  isConnectorCategory,\n  isEventPermission,\n  permissionActions,\n  requestPlaneSpec,\n} from './integrations'\nimport type { ConnectorPermission } from './integrations'\n\nexport class PluginContractError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'PluginContractError'\n  }\n}\n\nfunction fail(scope: string, msg: string): never {\n  throw new PluginContractError(`[${scope}] ${msg}`)\n}\n\nfunction nonEmptyString(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0\n}\n\n/**\n * Assert a PluginManifest is structurally sound enough to mount safely.\n * Checks identity, navigation/route wiring, settings tabs, declared features,\n * and id uniqueness. Throws PluginContractError on the first problem.\n */\nexport function assertPluginManifestContract(manifest: PluginManifest): void {\n  const id = manifest?.id\n  const scope = nonEmptyString(id) ? id : '<unknown plugin>'\n\n  for (const field of ['id', 'name', 'icon', 'version'] as const) {\n    if (!nonEmptyString(manifest?.[field])) fail(scope, `manifest.${field} must be a non-empty string`)\n  }\n\n  if (!Array.isArray(manifest.navigation)) fail(scope, 'manifest.navigation must be an array (use [] for settings-only plugins)')\n  if (!Array.isArray(manifest.routes)) fail(scope, 'manifest.routes must be an array (use [] for settings-only plugins)')\n\n  // Every nav entry must point at a route; every route needs a path + component.\n  for (const [i, nav] of manifest.navigation.entries()) {\n    if (!nonEmptyString((nav as any)?.route)) fail(scope, `navigation[${i}].route must be a non-empty string`)\n  }\n  const routePaths = new Set<string>()\n  for (const [i, route] of manifest.routes.entries()) {\n    if (!nonEmptyString((route as any)?.path)) fail(scope, `routes[${i}].path must be a non-empty string`)\n    if (typeof (route as any)?.component !== 'function') fail(scope, `routes[${i}].component must be a component`)\n    if (routePaths.has((route as any).path)) fail(scope, `duplicate route path \"${(route as any).path}\"`)\n    routePaths.add((route as any).path)\n  }\n  // A nav entry that links to a route the plugin doesn't declare is dead UI.\n  for (const [i, nav] of manifest.navigation.entries()) {\n    const r = (nav as any).route\n    if (routePaths.size > 0 && !routePaths.has(r)) {\n      fail(scope, `navigation[${i}].route \"${r}\" has no matching route in manifest.routes`)\n    }\n  }\n\n  // Settings tabs (the only UI surface integrations need) must be renderable.\n  const settingIds = new Set<string>()\n  for (const [i, tab] of (manifest.settings ?? []).entries()) {\n    if (!nonEmptyString((tab as any)?.id)) fail(scope, `settings[${i}].id must be a non-empty string`)\n    if (!nonEmptyString((tab as any)?.label)) fail(scope, `settings[${i}].label must be a non-empty string`)\n    if (typeof (tab as any)?.component !== 'function') fail(scope, `settings[${i}].component must be a component`)\n    if (settingIds.has((tab as any).id)) fail(scope, `duplicate settings tab id \"${(tab as any).id}\"`)\n    settingIds.add((tab as any).id)\n  }\n\n  for (const [i, feat] of (manifest.declaredFeatures ?? []).entries()) {\n    if (!nonEmptyString((feat as any)?.id)) fail(scope, `declaredFeatures[${i}].id must be a non-empty string`)\n  }\n\n  for (const [i, src] of (manifest.emitsFrom ?? []).entries()) {\n    if (!nonEmptyString(src?.table)) fail(scope, `emitsFrom[${i}].table must be a non-empty string`)\n    if (!nonEmptyString(src?.entityKey)) fail(scope, `emitsFrom[${i}].entityKey must be a non-empty string`)\n    for (const action of src.actions ?? []) {\n      if (!EVENT_ACTIONS.has(action)) fail(scope, `emitsFrom[${i}] has unknown action \"${action}\"`)\n    }\n  }\n\n  const functionSlugs = new Set<string>()\n  for (const [i, fn] of (manifest.functions ?? []).entries()) {\n    if (!SLUG.test(fn?.slug ?? '')) fail(scope, `functions[${i}].slug must be kebab-case — it becomes the deployed function name`)\n    if (functionSlugs.has(fn.slug)) fail(scope, `duplicate function slug \"${fn.slug}\"`)\n    functionSlugs.add(fn.slug)\n    if (typeof fn.verifyJwt !== 'boolean') fail(scope, `functions[${i}].verifyJwt must be a boolean`)\n    if (!FUNCTION_INGRESS.has(fn.ingress)) fail(scope, `functions[${i}].ingress \"${fn.ingress}\" is not one of ${[...FUNCTION_INGRESS].join(', ')}`)\n    // The ingress authenticates by signature, not by a caller JWT it does not have.\n    if (fn.ingress === 'fayz' && fn.verifyJwt) fail(scope, `functions[${i}] is reached through the Fayz ingress, so verifyJwt must be false`)\n    for (const secret of fn.secrets ?? []) {\n      // A name, never a value — this is the shape that keeps a key out of git.\n      if (!SECRET_NAME.test(secret)) fail(scope, `functions[${i}].secrets must name secrets (SCREAMING_SNAKE_CASE), never carry their values`)\n    }\n  }\n\n  for (const [i, def] of (manifest.connectors ?? []).entries()) {\n    // An unlisted category renders NO badge rather than a wrong one, so the\n    // mistake is invisible in a screenshot. Caught here instead.\n    if (def.category !== undefined && !isConnectorCategory(def.category)) {\n      fail(\n        scope,\n        `connectors[${i}].category \"${def.category}\" is not a catalogue category — ` +\n          `use one of ${CONNECTOR_CATEGORIES.join(', ')}, taken from the catalogue row with this connector's slug.`,\n      )\n    }\n    for (const pattern of def.subscribesTo ?? []) {\n      if (!nonEmptyString(pattern)) fail(scope, `connectors[${i}].subscribesTo must hold non-empty patterns`)\n      // Only a trailing star is honoured; see eventKeyMatches.\n      if (pattern.includes('*') && !pattern.endsWith('*')) {\n        fail(scope, `connectors[${i}].subscribesTo \"${pattern}\" — \"*\" is only honoured at the end`)\n      }\n    }\n\n    assertConnectorPermissions(scope, `connectors[${i}]`, def)\n    // The request plane's two fields are required THERE and meaningless\n    // elsewhere. Checked at the manifest so a connector cannot reach a buyer\n    // with an undeclared budget — the failure would otherwise be a spinner.\n    if ((def.planes ?? []).includes('request')) {\n      try {\n        requestPlaneSpec(def)\n      } catch (error) {\n        fail(scope, `connectors[${i}] ${error instanceof Error ? error.message : String(error)}`)\n      }\n    } else if (def.latencyBudgetMs !== undefined || def.onFailure !== undefined) {\n      fail(\n        scope,\n        `connectors[${i}] declares latencyBudgetMs/onFailure but is not on the request plane — ` +\n          `nothing enforces them, so they read as a guarantee that does not exist.`,\n      )\n    }\n    // Authorization vs configuration. Both declarations end up on the same row,\n    // and a key in both is a value with two owners: the connect form would write\n    // it and the settings form would overwrite it.\n    const fieldKeys = new Set((def.fields ?? []).map((f) => f.key))\n    const settingKeys = new Set<string>()\n    for (const [j, setting] of (def.settings ?? []).entries()) {\n      const at = `connectors[${i}].settings[${j}]`\n      if (!nonEmptyString(setting?.key)) fail(scope, `${at}.key must be a non-empty string`)\n      if (!nonEmptyString(setting?.label)) fail(scope, `${at}.label must be a non-empty string`)\n      if (!SETTING_TYPES.has(setting.type)) {\n        fail(scope, `${at}.type \"${setting.type}\" is not one of ${[...SETTING_TYPES].join(', ')}`)\n      }\n      if (settingKeys.has(setting.key)) fail(scope, `${at} duplicates settings key \"${setting.key}\"`)\n      settingKeys.add(setting.key)\n      if (fieldKeys.has(setting.key)) {\n        fail(\n          scope,\n          `${at}.key \"${setting.key}\" is also a credential field — a key either authorizes the ` +\n            `connection (fields) or configures it (settings), never both.`,\n        )\n      }\n      if (setting.type === 'select' || setting.type === 'multi-select') {\n        if (!Array.isArray(setting.options) || setting.options.length === 0) {\n          fail(scope, `${at} is a ${setting.type} and must declare options — that is what replaces a free-text box`)\n        }\n        for (const [k, option] of setting.options.entries()) {\n          if (!nonEmptyString(option?.value)) fail(scope, `${at}.options[${k}].value must be a non-empty string`)\n          if (!nonEmptyString(option?.label)) fail(scope, `${at}.options[${k}].label must be a non-empty string`)\n        }\n      }\n      if (setting.pattern !== undefined) {\n        if (setting.type !== 'text') fail(scope, `${at}.pattern only applies to a text setting`)\n        try {\n          new RegExp(setting.pattern)\n        } catch {\n          fail(scope, `${at}.pattern is not a valid regular expression`)\n        }\n        // A refusal with no sentence is a form that says no and not why.\n        if (!nonEmptyString(setting.patternHint)) fail(scope, `${at} declares a pattern, so it must declare patternHint`)\n      }\n    }\n    // Declared settings nobody can read or write are a screen that renders empty.\n    if (settingKeys.size > 0) {\n      if (typeof def.getSettings !== 'function') fail(scope, `connectors[${i}] declares settings but no getSettings()`)\n      if (typeof def.saveSettings !== 'function') fail(scope, `connectors[${i}] declares settings but no saveSettings()`)\n    }\n\n    // \"Acionado em quais momentos\" — a moment on a plane the connector does not\n    // have is a promise the code cannot keep.\n    const planes = new Set(connectorPlanes(def))\n    const momentKeys = new Set<string>()\n    for (const [j, moment] of (def.invokedAt ?? []).entries()) {\n      const at = `connectors[${i}].invokedAt[${j}]`\n      if (!nonEmptyString(moment?.key)) fail(scope, `${at}.key must be a non-empty string`)\n      if (!nonEmptyString(moment?.label)) fail(scope, `${at}.label must be a non-empty string`)\n      if (momentKeys.has(moment.key)) fail(scope, `${at} duplicates key \"${moment.key}\"`)\n      momentKeys.add(moment.key)\n      const plane = invocationPlane(moment)\n      if (!planes.has(plane)) {\n        fail(scope, `${at} is declared on the ${plane} plane, which connectors[${i}].planes does not include`)\n      }\n      if (moment.trigger !== undefined) {\n        if (plane !== 'sync') fail(scope, `${at}.trigger only applies to a sync moment`)\n        if (!TRIGGERS.has(moment.trigger)) fail(scope, `${at} has unknown trigger \"${moment.trigger}\"`)\n      }\n      // A moment that reaches something the connector never asked for is the\n      // screen answering \"quando ele age\" with access nobody consented to.\n      const declared = new Set((def.permissions ?? []).map((p) => p.resource))\n      for (const resource of moment.touches ?? []) {\n        if (!declared.has(resource)) {\n          fail(\n            scope,\n            `${at}.touches names \"${resource}\", which connectors[${i}].permissions does not declare — ` +\n              `a call site cannot reach what the consent view never showed.`,\n          )\n        }\n      }\n    }\n\n    for (const [j, auto] of (def.managedAutomations ?? []).entries()) {\n      if (!nonEmptyString(auto?.eventKey)) fail(scope, `connectors[${i}].managedAutomations[${j}].eventKey must be a non-empty string`)\n      if (!nonEmptyString(auto?.label)) fail(scope, `connectors[${i}].managedAutomations[${j}].label must be a non-empty string`)\n      // The screen would promise a reaction the ingress never delivers.\n      if (!connectorSubscribes(def, auto.eventKey)) {\n        fail(scope, `connectors[${i}].managedAutomations[${j}] fires on \"${auto.eventKey}\", which no subscribesTo pattern covers`)\n      }\n    }\n  }\n\n  // A connector brings a ConnectorDefinition, not a pair of tables.\n  for (const [i, mig] of (manifest.migrations ?? []).entries()) {\n    for (const table of bespokeConnectorTables(mig?.sql)) {\n      fail(\n        scope,\n        `migrations[${i}] (\"${mig?.id ?? '?'}\") creates public.${table} — a connector's own ` +\n          `*_integrations / *_sync_log table. Store the connection in plg_connections / ` +\n          `plg_sync_runs via createConnectionStore('<connector-id>'): two accounts are two ` +\n          `rows separated by instance_key, and connector-specific counters go in stats.`,\n      )\n    }\n  }\n\n  // A plugin that contributes nothing mountable is almost always a mistake.\n  // (Connector-only addon plugins contribute via `connectors` instead.)\n  if (\n    manifest.navigation.length === 0 &&\n    manifest.routes.length === 0 &&\n    (manifest.settings ?? []).length === 0 &&\n    (manifest.connectors ?? []).length === 0\n  ) {\n    fail(scope, 'plugin contributes no navigation, routes, settings, or connectors — it would mount but do nothing')\n  }\n}\n\n/**\n * What a connector says it needs — and the four ways that declaration can\n * contradict the ones that already existed.\n *\n * The feature this guards is a consent view. Its whole value is that the list it\n * shows is the list, so every way of ending up with two lists is refused here:\n *\n *   1. an action that does not exist for the resource kind (`listen` on a\n *      record type, `write` on an event) — a word the reader would have to guess at;\n *   2. a `data` permission naming a resource the legacy `entities` never listed,\n *      or an entity with no permission — the \"writes to an entity it never\n *      listed\" case, in both directions;\n *   3. a `listen` permission the legacy `subscribesTo` does not name, or a\n *      `subscribesTo` pattern no permission explains — the connector would be\n *      delivered facts the consent view never showed, or shown facts the ingress\n *      filters out;\n *   4. two permissions for the same resource — two rows, two reasons, and no\n *      answer to which one the tenant agreed to.\n *\n * Rules 2 and 3 only bite when BOTH declarations are present. A connector built\n * against an older core declares only the legacy fields and is unaffected; a\n * connector written today declares only `permissions` and both are derived from\n * it. What is refused is saying both things and saying them differently.\n */\nfunction assertConnectorPermissions(\n  scope: string,\n  path: string,\n  def: { permissions?: ConnectorPermission[]; entities?: string[]; subscribesTo?: string[] },\n): void {\n  const permissions = def.permissions\n  if (permissions === undefined) return\n  if (!Array.isArray(permissions)) fail(scope, `${path}.permissions must be an array`)\n\n  const seen = new Set<string>()\n  for (const [j, permission] of permissions.entries()) {\n    const at = `${path}.permissions[${j}]`\n    if (permission?.kind !== 'data' && permission?.kind !== 'event') {\n      fail(scope, `${at}.kind must be \"data\" or \"event\"`)\n    }\n    if (!nonEmptyString(permission.resource)) fail(scope, `${at}.resource must be a non-empty string`)\n    // The reason is the only part a tenant can actually judge; a blank one turns\n    // the screen back into the schema dump it exists to replace.\n    if (!nonEmptyString(permission.reason)) {\n      fail(scope, `${at} must declare a reason — the sentence the tenant judges before authorizing`)\n    }\n    if (!Array.isArray(permission.actions) || permission.actions.length === 0) {\n      fail(scope, `${at}.actions must name at least one action — a resource with no access is not a permission`)\n    }\n    const legal = permissionActions(permission.kind)\n    for (const action of permission.actions) {\n      if (!legal.includes(action)) {\n        fail(scope, `${at} asks for \"${action}\" on the ${permission.kind} resource \"${permission.resource}\", which only admits ${legal.join(', ')}`)\n      }\n    }\n    if (isEventPermission(permission) && permission.resource.includes('*') && !permission.resource.endsWith('*')) {\n      fail(scope, `${at}.resource \"${permission.resource}\" — \"*\" is only honoured at the end`)\n    }\n    const key = `${permission.kind}:${permission.resource}`\n    if (seen.has(key)) fail(scope, `${at} repeats \"${key}\" — one resource, one row, one reason`)\n    seen.add(key)\n  }\n\n  // (2) data permissions ↔ the legacy entities list.\n  if (def.entities !== undefined) {\n    const declared = new Set(connectorEntities({ permissions }))\n    const legacy = new Set(def.entities)\n    for (const entity of declared) {\n      if (!legacy.has(entity)) {\n        fail(\n          scope,\n          `${path}.permissions reaches \"${entity}\", which ${path}.entities does not list — ` +\n            `the two describe the same access and must name the same set (drop entities; it is derived).`,\n        )\n      }\n    }\n    for (const entity of legacy) {\n      if (!declared.has(entity)) {\n        fail(\n          scope,\n          `${path}.entities lists \"${entity}\" with no permission saying what it does with it — ` +\n            `a record type on the consent view with no read/write is a name, not a declaration.`,\n        )\n      }\n    }\n  }\n\n  // (3) listen permissions ↔ the legacy subscribesTo list.\n  if (def.subscribesTo !== undefined) {\n    const declared = new Set(connectorSubscribesTo({ permissions }))\n    const legacy = new Set(def.subscribesTo)\n    for (const pattern of declared) {\n      if (!legacy.has(pattern)) {\n        fail(\n          scope,\n          `${path}.permissions listens to \"${pattern}\", which ${path}.subscribesTo does not — ` +\n            `the ingress filters on that list, so the consent view would promise a fact never delivered.`,\n        )\n      }\n    }\n    for (const pattern of legacy) {\n      if (!declared.has(pattern)) {\n        fail(\n          scope,\n          `${path}.subscribesTo asks for \"${pattern}\" with no listen permission explaining it — ` +\n            `the connector would receive a fact the tenant was never shown.`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * `CREATE TABLE [IF NOT EXISTS] [schema.]name` where name ends in `_integrations`\n * or `_sync_log` — the pair four connectors each reinvented before\n * `plg_connections` / `plg_sync_runs` existed (FAY-1376). Neither generic table\n * matches, so a connector that stores its connection in them creates nothing.\n *\n * Deliberately duplicated in scripts/check-connector-tables.mjs, which scans the\n * .sql files themselves: that runs in the `contracts` CI job with no install and\n * no build, so it cannot import this. This half catches SQL declared inline on a\n * manifest, which no .sql walk would see. The two are held in agreement by one\n * case table, asserted from both sides — see\n * packages/core/test/integrations/connector-tables.test.ts.\n */\nconst BESPOKE_CONNECTOR_TABLE =\n  /\\bcreate\\s+table\\s+(?:if\\s+not\\s+exists\\s+)?(?:[a-z0-9_]+\\s*\\.\\s*)?([a-z0-9_]*(?:_integrations|_sync_log))\\b/gi\n\n/** Table names a CREATE TABLE in this SQL would bring back. Empty = conformant. */\nexport function bespokeConnectorTables(sql: unknown): string[] {\n  const text = typeof sql === 'string' ? sql.replace(/\"/g, '') : ''\n  const found = new Set<string>()\n  for (const m of text.matchAll(BESPOKE_CONNECTOR_TABLE)) found.add(m[1].toLowerCase())\n  return [...found]\n}\n\nconst EVENT_ACTIONS = new Set(['created', 'updated', 'deleted'])\nconst FUNCTION_INGRESS = new Set(['fayz', 'none'])\nconst SLUG = /^[a-z0-9][a-z0-9-]*$/\nconst SECRET_NAME = /^[A-Z][A-Z0-9_]*$/\n\nconst SETTING_TYPES = new Set(['text', 'select', 'multi-select', 'toggle'])\nconst AUTH_KINDS = new Set(['oauth', 'api-key', 'mtls'])\nconst DIRECTIONS = new Set(['inbound', 'outbound', 'bidirectional'])\nconst TRIGGERS = new Set(['on-write', 'scheduled', 'manual', 'webhook'])\n\n/**\n * Assert an integration Connector descriptor is well-formed: identity present,\n * a known auth kind, and at least one capability with a valid direction +\n * trigger set. This is the contract a connector must satisfy BEFORE its\n * data-plane (edge function) exists — the TDD anchor for an integration.\n */\nexport function assertConnectorContract(connector: Connector): void {\n  const scope = nonEmptyString(connector?.id) ? `connector:${connector.id}` : '<unknown connector>'\n  for (const field of ['id', 'provider', 'pluginId'] as const) {\n    if (!nonEmptyString(connector?.[field])) fail(scope, `connector.${field} must be a non-empty string`)\n  }\n  if (!AUTH_KINDS.has(connector.authKind)) fail(scope, `connector.authKind \"${connector.authKind}\" is not one of ${[...AUTH_KINDS].join(', ')}`)\n  if (!Array.isArray(connector.capabilities) || connector.capabilities.length === 0) {\n    fail(scope, 'connector.capabilities must list at least one capability')\n  }\n  for (const [i, cap] of connector.capabilities.entries()) {\n    if (!nonEmptyString(cap?.entity)) fail(scope, `capabilities[${i}].entity must be a non-empty string`)\n    if (!DIRECTIONS.has(cap.direction)) fail(scope, `capabilities[${i}].direction \"${cap.direction}\" is invalid`)\n    if (!Array.isArray(cap.triggers) || cap.triggers.length === 0) fail(scope, `capabilities[${i}].triggers must be non-empty`)\n    for (const trig of cap.triggers) {\n      if (!TRIGGERS.has(trig)) fail(scope, `capabilities[${i}] has unknown trigger \"${trig}\"`)\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/testing.ts"],"names":[],"mappings":";;;AA0BO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAEA,SAAS,IAAA,CAAK,OAAe,GAAA,EAAoB;AAC/C,EAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,CAAA,EAAI,KAAK,CAAA,EAAA,EAAK,GAAG,CAAA,CAAE,CAAA;AACnD;AAEA,SAAS,eAAe,CAAA,EAAyB;AAC/C,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,IAAY,CAAA,CAAE,IAAA,GAAO,MAAA,GAAS,CAAA;AACpD;AAOO,SAAS,6BAA6B,QAAA,EAAgC;AAC3E,EAAA,MAAM,KAAK,QAAA,EAAU,EAAA;AACrB,EAAA,MAAM,KAAA,GAAQ,cAAA,CAAe,EAAE,CAAA,GAAI,EAAA,GAAK,kBAAA;AAExC,EAAA,KAAA,MAAW,SAAS,CAAC,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,SAAS,CAAA,EAAY;AAC9D,IAAA,IAAI,CAAC,cAAA,CAAe,QAAA,GAAW,KAAK,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,KAAK,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACpG;AAEA,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,IAAA,CAAK,OAAO,yEAAyE,CAAA;AAC9H,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,EAAG,IAAA,CAAK,OAAO,qEAAqE,CAAA;AAGtH,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,QAAA,CAAS,UAAA,CAAW,SAAQ,EAAG;AACpD,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAAA,EAC3G;AACA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,KAAK,KAAK,QAAA,CAAS,MAAA,CAAO,SAAQ,EAAG;AAClD,IAAA,IAAI,CAAC,eAAgB,KAAA,EAAe,IAAI,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,OAAA,EAAU,CAAC,CAAA,iCAAA,CAAmC,CAAA;AACrG,IAAA,IAAI,OAAQ,OAAe,SAAA,KAAc,UAAA,OAAiB,KAAA,EAAO,CAAA,OAAA,EAAU,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,GAAA,CAAK,KAAA,CAAc,IAAI,CAAA,OAAQ,KAAA,EAAO,CAAA,sBAAA,EAA0B,KAAA,CAAc,IAAI,CAAA,CAAA,CAAG,CAAA;AACpG,IAAA,UAAA,CAAW,GAAA,CAAK,MAAc,IAAI,CAAA;AAAA,EACpC;AAEA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,QAAA,CAAS,UAAA,CAAW,SAAQ,EAAG;AACpD,IAAA,MAAM,IAAK,GAAA,CAAY,KAAA;AACvB,IAAA,IAAI,WAAW,IAAA,GAAO,CAAA,IAAK,CAAC,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,EAAG;AAC7C,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,SAAA,EAAY,CAAC,CAAA,0CAAA,CAA4C,CAAA;AAAA,IACtF;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,QAAA,IAAY,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC1D,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,+BAAA,CAAiC,CAAA;AACjG,IAAA,IAAI,CAAC,eAAgB,GAAA,EAAa,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AACvG,IAAA,IAAI,OAAQ,KAAa,SAAA,KAAc,UAAA,OAAiB,KAAA,EAAO,CAAA,SAAA,EAAY,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,GAAA,CAAK,GAAA,CAAY,EAAE,CAAA,OAAQ,KAAA,EAAO,CAAA,2BAAA,EAA+B,GAAA,CAAY,EAAE,CAAA,CAAA,CAAG,CAAA;AACjG,IAAA,UAAA,CAAW,GAAA,CAAK,IAAY,EAAE,CAAA;AAAA,EAChC;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,IAAI,CAAA,IAAA,CAAM,SAAS,gBAAA,IAAoB,EAAC,EAAG,OAAA,EAAQ,EAAG;AACnE,IAAA,IAAI,CAAC,eAAgB,IAAA,EAAc,EAAE,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,iBAAA,EAAoB,CAAC,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC5G;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC3D,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAC/F,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,SAAS,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sCAAA,CAAwC,CAAA;AACvG,IAAA,KAAA,MAAW,MAAA,IAAU,GAAA,CAAI,OAAA,IAAW,EAAC,EAAG;AACtC,MAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,MAAM,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sBAAA,EAAyB,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IAC9F;AAAA,EACF;AAEA,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAY;AACtC,EAAA,KAAA,MAAW,CAAC,GAAG,EAAE,CAAA,IAAA,CAAM,SAAS,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC1D,IAAA,IAAI,CAAC,IAAA,CAAK,IAAA,CAAK,EAAA,EAAI,IAAA,IAAQ,EAAE,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,sEAAA,CAAmE,CAAA;AAC7H,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,EAAA,CAAG,IAAI,CAAA,OAAQ,KAAA,EAAO,CAAA,yBAAA,EAA4B,EAAA,CAAG,IAAI,CAAA,CAAA,CAAG,CAAA;AAClF,IAAA,aAAA,CAAc,GAAA,CAAI,GAAG,IAAI,CAAA;AACzB,IAAA,IAAI,OAAO,GAAG,SAAA,KAAc,SAAA,OAAgB,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,6BAAA,CAA+B,CAAA;AAChG,IAAA,IAAI,CAAC,iBAAiB,GAAA,CAAI,EAAA,CAAG,OAAO,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,UAAA,EAAa,CAAC,cAAc,EAAA,CAAG,OAAO,mBAAmB,CAAC,GAAG,gBAAgB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAE9I,IAAA,IAAI,EAAA,CAAG,YAAY,MAAA,IAAU,EAAA,CAAG,WAAW,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,iEAAA,CAAmE,CAAA;AACxI,IAAA,KAAA,MAAW,MAAA,IAAU,EAAA,CAAG,OAAA,IAAW,EAAC,EAAG;AAErC,MAAA,IAAI,CAAC,YAAY,IAAA,CAAK,MAAM,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,CAAC,CAAA,4EAAA,CAA8E,CAAA;AAAA,IACzI;AAAA,EACF;AAEA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAG5D,IAAA,IAAI,IAAI,QAAA,KAAa,MAAA,IAAa,CAAC,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG;AACpE,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,CAAA,WAAA,EAAc,CAAC,CAAA,YAAA,EAAe,GAAA,CAAI,QAAQ,CAAA,gDAAA,EAC1B,oBAAA,CAAqB,IAAA,CAAK,IAAI,CAAC,CAAA,0DAAA;AAAA,OACjD;AAAA,IACF;AACA,IAAA,KAAA,MAAW,OAAA,IAAW,GAAA,CAAI,YAAA,IAAgB,EAAC,EAAG;AAC5C,MAAA,IAAI,CAAC,eAAe,OAAO,CAAA,OAAQ,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,2CAAA,CAA6C,CAAA;AAEtG,MAAA,IAAI,OAAA,CAAQ,SAAS,GAAG,CAAA,IAAK,CAAC,OAAA,CAAQ,QAAA,CAAS,GAAG,CAAA,EAAG;AACnD,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,gBAAA,EAAmB,OAAO,CAAA,wCAAA,CAAqC,CAAA;AAAA,MAC5F;AAAA,IACF;AAEA,IAAA,0BAAA,CAA2B,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,CAAA,CAAA,EAAK,GAAG,CAAA;AAIzD,IAAA,IAAA,CAAK,IAAI,MAAA,IAAU,EAAC,EAAG,QAAA,CAAS,SAAS,CAAA,EAAG;AAC1C,MAAA,IAAI;AACF,QAAA,gBAAA,CAAiB,GAAG,CAAA;AAAA,MACtB,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,MAC1F;AAAA,IACF,WAAW,GAAA,CAAI,eAAA,KAAoB,MAAA,IAAa,GAAA,CAAI,cAAc,MAAA,EAAW;AAC3E,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,cAAc,CAAC,CAAA,mJAAA;AAAA,OAEjB;AAAA,IACF;AAIA,IAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAA,CAAK,GAAA,CAAI,MAAA,IAAU,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,GAAG,CAAC,CAAA;AAC9D,IAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AACpC,IAAA,KAAA,MAAW,CAAC,GAAG,OAAO,CAAA,IAAA,CAAM,IAAI,QAAA,IAAY,EAAC,EAAG,OAAA,EAAQ,EAAG;AACzD,MAAA,MAAM,EAAA,GAAK,CAAA,WAAA,EAAc,CAAC,CAAA,WAAA,EAAc,CAAC,CAAA,CAAA,CAAA;AACzC,MAAA,IAAI,CAAC,eAAe,OAAA,EAAS,GAAG,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AACrF,MAAA,IAAI,CAAC,eAAe,OAAA,EAAS,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iCAAA,CAAmC,CAAA;AACzF,MAAA,IAAI,CAAC,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACpC,QAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,OAAA,EAAU,QAAQ,IAAI,CAAA,gBAAA,EAAmB,CAAC,GAAG,aAAa,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC3F;AACA,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,0BAAA,EAA6B,OAAA,CAAQ,GAAG,CAAA,CAAA,CAAG,CAAA;AAC9F,MAAA,WAAA,CAAY,GAAA,CAAI,QAAQ,GAAG,CAAA;AAC3B,MAAA,IAAI,SAAA,CAAU,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC9B,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,EAAE,CAAA,MAAA,EAAS,OAAA,CAAQ,GAAG,CAAA,4HAAA;AAAA,SAE3B;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,IAAA,KAAS,QAAA,IAAY,OAAA,CAAQ,SAAS,cAAA,EAAgB;AAChE,QAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA,IAAK,OAAA,CAAQ,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACnE,UAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,MAAA,EAAS,OAAA,CAAQ,IAAI,CAAA,sEAAA,CAAmE,CAAA;AAAA,QAC3G;AACA,QAAA,KAAA,MAAW,CAAC,CAAA,EAAG,MAAM,KAAK,OAAA,CAAQ,OAAA,CAAQ,SAAQ,EAAG;AACnD,UAAA,IAAI,CAAC,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AACtG,UAAA,IAAI,CAAC,cAAA,CAAe,MAAA,EAAQ,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,SAAA,EAAY,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAAA,QACxG;AAAA,MACF;AACA,MAAA,IAAI,OAAA,CAAQ,YAAY,MAAA,EAAW;AACjC,QAAA,IAAI,QAAQ,IAAA,KAAS,MAAA,OAAa,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,uCAAA,CAAyC,CAAA;AACvF,QAAA,IAAI;AACF,UAAA,IAAI,MAAA,CAAO,QAAQ,OAAO,CAAA;AAAA,QAC5B,CAAA,CAAA,MAAQ;AACN,UAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,0CAAA,CAA4C,CAAA;AAAA,QAC/D;AAEA,QAAA,IAAI,CAAC,eAAe,OAAA,CAAQ,WAAW,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,mDAAA,CAAqD,CAAA;AAAA,MAClH;AAAA,IACF;AAEA,IAAA,IAAI,WAAA,CAAY,OAAO,CAAA,EAAG;AACxB,MAAA,IAAI,OAAO,IAAI,WAAA,KAAgB,UAAA,OAAiB,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,wCAAA,CAA0C,CAAA;AAChH,MAAA,IAAI,OAAO,IAAI,YAAA,KAAiB,UAAA,OAAiB,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,yCAAA,CAA2C,CAAA;AAAA,IACpH;AAIA,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAG,CAAC,CAAA;AAC3C,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AACnC,IAAA,KAAA,MAAW,CAAC,GAAG,MAAM,CAAA,IAAA,CAAM,IAAI,SAAA,IAAa,EAAC,EAAG,OAAA,EAAQ,EAAG;AACzD,MAAA,MAAM,EAAA,GAAK,CAAA,WAAA,EAAc,CAAC,CAAA,YAAA,EAAe,CAAC,CAAA,CAAA,CAAA;AAC1C,MAAA,IAAI,CAAC,eAAe,MAAA,EAAQ,GAAG,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AACpF,MAAA,IAAI,CAAC,eAAe,MAAA,EAAQ,KAAK,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iCAAA,CAAmC,CAAA;AACxF,MAAA,IAAI,UAAA,CAAW,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,iBAAA,EAAoB,MAAA,CAAO,GAAG,CAAA,CAAA,CAAG,CAAA;AAClF,MAAA,UAAA,CAAW,GAAA,CAAI,OAAO,GAAG,CAAA;AACzB,MAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AACpC,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,EAAG;AACtB,QAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,uBAAuB,KAAK,CAAA,yBAAA,EAA4B,CAAC,CAAA,yBAAA,CAA2B,CAAA;AAAA,MACvG;AACA,MAAA,IAAI,MAAA,CAAO,YAAY,MAAA,EAAW;AAChC,QAAA,IAAI,UAAU,MAAA,EAAQ,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,sCAAA,CAAwC,CAAA;AAC/E,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,MAAA,CAAO,OAAO,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,sBAAA,EAAyB,MAAA,CAAO,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,MAChG;AAGA,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAA,CAAK,GAAA,CAAI,WAAA,IAAe,EAAC,EAAG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AACvE,MAAA,KAAA,MAAW,QAAA,IAAY,MAAA,CAAO,OAAA,IAAW,EAAC,EAAG;AAC3C,QAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC3B,UAAA,IAAA;AAAA,YACE,KAAA;AAAA,YACA,CAAA,EAAG,EAAE,CAAA,gBAAA,EAAmB,QAAQ,uBAAuB,CAAC,CAAA,kGAAA;AAAA,WAE1D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,CAAC,GAAG,IAAI,CAAA,IAAA,CAAM,IAAI,kBAAA,IAAsB,EAAC,EAAG,OAAA,EAAQ,EAAG;AAChE,MAAA,IAAI,CAAC,cAAA,CAAe,IAAA,EAAM,QAAQ,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,qCAAA,CAAuC,CAAA;AAChI,MAAA,IAAI,CAAC,cAAA,CAAe,IAAA,EAAM,KAAK,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,WAAA,EAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,kCAAA,CAAoC,CAAA;AAE1H,MAAA,IAAI,CAAC,mBAAA,CAAoB,GAAA,EAAK,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC5C,QAAA,IAAA,CAAK,KAAA,EAAO,cAAc,CAAC,CAAA,qBAAA,EAAwB,CAAC,CAAA,YAAA,EAAe,IAAA,CAAK,QAAQ,CAAA,uCAAA,CAAyC,CAAA;AAAA,MAC3H;AAAA,IACF;AAAA,EACF;AAGA,EAAA,KAAA,MAAW,CAAC,GAAG,GAAG,CAAA,IAAA,CAAM,SAAS,UAAA,IAAc,EAAC,EAAG,OAAA,EAAQ,EAAG;AAC5D,IAAA,KAAA,MAAW,KAAA,IAAS,sBAAA,CAAuB,GAAA,EAAK,GAAG,CAAA,EAAG;AACpD,MAAA,IAAA;AAAA,QACE,KAAA;AAAA,QACA,cAAc,CAAC,CAAA,IAAA,EAAO,KAAK,EAAA,IAAM,GAAG,qBAAqB,KAAK,CAAA,mQAAA;AAAA,OAIhE;AAAA,IACF;AAAA,EACF;AAIA,EAAA,IACE,SAAS,UAAA,CAAW,MAAA,KAAW,KAC/B,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,IAAA,CAC1B,QAAA,CAAS,YAAY,EAAC,EAAG,WAAW,CAAA,IAAA,CACpC,QAAA,CAAS,cAAc,EAAC,EAAG,WAAW,CAAA,EACvC;AACA,IAAA,IAAA,CAAK,OAAO,wGAAmG,CAAA;AAAA,EACjH;AACF;AA0BA,SAAS,0BAAA,CACP,KAAA,EACA,IAAA,EACA,GAAA,EACM;AACN,EAAA,MAAM,cAAc,GAAA,CAAI,WAAA;AACxB,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC/B,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,WAAW,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,6BAAA,CAA+B,CAAA;AAEnF,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,UAAU,CAAA,IAAK,WAAA,CAAY,SAAQ,EAAG;AACnD,IAAA,MAAM,EAAA,GAAK,CAAA,EAAG,IAAI,CAAA,aAAA,EAAgB,CAAC,CAAA,CAAA,CAAA;AACnC,IAAA,IAAI,UAAA,EAAY,IAAA,KAAS,MAAA,IAAU,UAAA,EAAY,SAAS,OAAA,EAAS;AAC/D,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+BAAA,CAAiC,CAAA;AAAA,IACpD;AACA,IAAA,IAAI,CAAC,eAAe,UAAA,CAAW,QAAQ,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,oCAAA,CAAsC,CAAA;AAGjG,IAAA,IAAI,CAAC,cAAA,CAAe,UAAA,CAAW,MAAM,CAAA,EAAG;AACtC,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,+EAAA,CAA4E,CAAA;AAAA,IAC/F;AACA,IAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA,IAAK,UAAA,CAAW,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG;AACzE,MAAA,IAAA,CAAK,KAAA,EAAO,CAAA,EAAG,EAAE,CAAA,2FAAA,CAAwF,CAAA;AAAA,IAC3G;AACA,IAAA,MAAM,KAAA,GAAQ,iBAAA,CAAkB,UAAA,CAAW,IAAI,CAAA;AAC/C,IAAA,KAAA,MAAW,MAAA,IAAU,WAAW,OAAA,EAAS;AACvC,MAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA,EAAG;AAC3B,QAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,WAAA,EAAc,MAAM,YAAY,UAAA,CAAW,IAAI,CAAA,WAAA,EAAc,UAAA,CAAW,QAAQ,CAAA,qBAAA,EAAwB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,MAC7I;AAAA,IACF;AACA,IAAA,IAAI,iBAAA,CAAkB,UAAU,CAAA,IAAK,UAAA,CAAW,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,IAAK,CAAC,UAAA,CAAW,QAAA,CAAS,QAAA,CAAS,GAAG,CAAA,EAAG;AAC5G,MAAA,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,WAAA,EAAc,UAAA,CAAW,QAAQ,CAAA,wCAAA,CAAqC,CAAA;AAAA,IACzF;AACA,IAAA,MAAM,MAAM,CAAA,EAAG,UAAA,CAAW,IAAI,CAAA,CAAA,EAAI,WAAW,QAAQ,CAAA,CAAA;AACrD,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,EAAG,EAAE,CAAA,UAAA,EAAa,GAAG,CAAA,0CAAA,CAAuC,CAAA;AAC3F,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EACd;AAGA,EAAA,IAAI,GAAA,CAAI,aAAa,MAAA,EAAW;AAC9B,IAAA,MAAM,WAAW,IAAI,GAAA,CAAI,kBAAkB,EAAE,WAAA,EAAa,CAAC,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,QAAQ,CAAA;AACnC,IAAA,KAAA,MAAW,UAAU,QAAA,EAAU;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA,EAAG;AACvB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,sBAAA,EAAyB,MAAM,YAAY,IAAI,CAAA,0HAAA;AAAA,SAExD;AAAA,MACF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,UAAU,MAAA,EAAQ;AAC3B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,MAAM,CAAA,EAAG;AACzB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,iBAAA,EAAoB,MAAM,CAAA,0IAAA;AAAA,SAEnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,EAAA,IAAI,GAAA,CAAI,iBAAiB,MAAA,EAAW;AAClC,IAAA,MAAM,WAAW,IAAI,GAAA,CAAI,sBAAsB,EAAE,WAAA,EAAa,CAAC,CAAA;AAC/D,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,YAAY,CAAA;AACvC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA,EAAG;AACxB,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,yBAAA,EAA4B,OAAO,YAAY,IAAI,CAAA,yHAAA;AAAA,SAE5D;AAAA,MACF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,WAAW,MAAA,EAAQ;AAC5B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA,EAAG;AAC1B,QAAA,IAAA;AAAA,UACE,KAAA;AAAA,UACA,CAAA,EAAG,IAAI,CAAA,wBAAA,EAA2B,OAAO,CAAA,+GAAA;AAAA,SAE3C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAeA,IAAM,uBAAA,GACJ,gHAAA;AAGK,SAAS,uBAAuB,GAAA,EAAwB;AAC7D,EAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,GAAI,EAAA;AAC/D,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,uBAAuB,CAAA,EAAG,KAAA,CAAM,GAAA,CAAI,CAAA,CAAE,CAAC,CAAA,CAAE,WAAA,EAAa,CAAA;AACpF,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAEA,IAAM,gCAAgB,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,SAAA,EAAW,SAAS,CAAC,CAAA;AAC/D,IAAM,mCAAmB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,MAAM,CAAC,CAAA;AACjD,IAAM,IAAA,GAAO,sBAAA;AACb,IAAM,WAAA,GAAc,mBAAA;AAEpB,IAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,QAAQ,QAAA,EAAU,cAAA,EAAgB,QAAQ,CAAC,CAAA;AAC1E,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,SAAA,EAAW,MAAM,CAAC,CAAA;AACvD,IAAM,6BAAa,IAAI,GAAA,CAAI,CAAC,SAAA,EAAW,UAAA,EAAY,eAAe,CAAC,CAAA;AACnE,IAAM,QAAA,uBAAe,GAAA,CAAI,CAAC,YAAY,WAAA,EAAa,QAAA,EAAU,SAAS,CAAC,CAAA;AAQhE,SAAS,wBAAwB,SAAA,EAA4B;AAClE,EAAA,MAAM,KAAA,GAAQ,eAAe,SAAA,EAAW,EAAE,IAAI,CAAA,UAAA,EAAa,SAAA,CAAU,EAAE,CAAA,CAAA,GAAK,qBAAA;AAC5E,EAAA,KAAA,MAAW,KAAA,IAAS,CAAC,IAAA,EAAM,UAAA,EAAY,UAAU,CAAA,EAAY;AAC3D,IAAA,IAAI,CAAC,cAAA,CAAe,SAAA,GAAY,KAAK,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,UAAA,EAAa,KAAK,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACtG;AACA,EAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,UAAU,QAAQ,CAAA,OAAQ,KAAA,EAAO,CAAA,oBAAA,EAAuB,UAAU,QAAQ,CAAA,gBAAA,EAAmB,CAAC,GAAG,UAAU,EAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAC7I,EAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,SAAA,CAAU,YAAY,CAAA,IAAK,SAAA,CAAU,YAAA,CAAa,MAAA,KAAW,CAAA,EAAG;AACjF,IAAA,IAAA,CAAK,OAAO,0DAA0D,CAAA;AAAA,EACxE;AACA,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,GAAG,KAAK,SAAA,CAAU,YAAA,CAAa,SAAQ,EAAG;AACvD,IAAA,IAAI,CAAC,eAAe,GAAA,EAAK,MAAM,GAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,mCAAA,CAAqC,CAAA;AACpG,IAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,aAAA,EAAgB,GAAA,CAAI,SAAS,CAAA,YAAA,CAAc,CAAA;AAC5G,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,4BAAA,CAA8B,CAAA;AAC1H,IAAA,KAAA,MAAW,IAAA,IAAQ,IAAI,QAAA,EAAU;AAC/B,MAAA,IAAI,CAAC,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG,IAAA,CAAK,KAAA,EAAO,CAAA,aAAA,EAAgB,CAAC,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACzF;AAAA,EACF;AACF","file":"chunk-KJUD6JA5.js","sourcesContent":["// ---------------------------------------------------------------------------\n// Plugin contract assertions — the integrity half of the deploy gate.\n// ---------------------------------------------------------------------------\n// Framework-agnostic runtime checks (no test-runner dependency) that any\n// plugin's *.test.ts calls to prove its manifest/connector conform to the\n// platform contract BEFORE it can ship. A plugin that fails these would break\n// the host app at mount time (missing route component, duplicate ids, malformed\n// settings tab). Pair with a capability test (does the plugin do its job?) — see\n// docs/plugins/PLUGIN-PATTERNS.md → capability anatomy. These throw on the first violation.\nimport type { PluginManifest } from './types/plugins'\nimport type { Connector } from './integrations'\nimport {\n  CONNECTOR_CATEGORIES,\n  connectorEntities,\n  connectorPlanes,\n  connectorSubscribes,\n  connectorSubscribesTo,\n  grants,\n  invocationPlane,\n  isConnectorCategory,\n  isEventPermission,\n  permissionActions,\n  requestPlaneSpec,\n} from './integrations'\nimport type { ConnectorPermission } from './integrations'\n\nexport class PluginContractError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'PluginContractError'\n  }\n}\n\nfunction fail(scope: string, msg: string): never {\n  throw new PluginContractError(`[${scope}] ${msg}`)\n}\n\nfunction nonEmptyString(v: unknown): v is string {\n  return typeof v === 'string' && v.trim().length > 0\n}\n\n/**\n * Assert a PluginManifest is structurally sound enough to mount safely.\n * Checks identity, navigation/route wiring, settings tabs, declared features,\n * and id uniqueness. Throws PluginContractError on the first problem.\n */\nexport function assertPluginManifestContract(manifest: PluginManifest): void {\n  const id = manifest?.id\n  const scope = nonEmptyString(id) ? id : '<unknown plugin>'\n\n  for (const field of ['id', 'name', 'icon', 'version'] as const) {\n    if (!nonEmptyString(manifest?.[field])) fail(scope, `manifest.${field} must be a non-empty string`)\n  }\n\n  if (!Array.isArray(manifest.navigation)) fail(scope, 'manifest.navigation must be an array (use [] for settings-only plugins)')\n  if (!Array.isArray(manifest.routes)) fail(scope, 'manifest.routes must be an array (use [] for settings-only plugins)')\n\n  // Every nav entry must point at a route; every route needs a path + component.\n  for (const [i, nav] of manifest.navigation.entries()) {\n    if (!nonEmptyString((nav as any)?.route)) fail(scope, `navigation[${i}].route must be a non-empty string`)\n  }\n  const routePaths = new Set<string>()\n  for (const [i, route] of manifest.routes.entries()) {\n    if (!nonEmptyString((route as any)?.path)) fail(scope, `routes[${i}].path must be a non-empty string`)\n    if (typeof (route as any)?.component !== 'function') fail(scope, `routes[${i}].component must be a component`)\n    if (routePaths.has((route as any).path)) fail(scope, `duplicate route path \"${(route as any).path}\"`)\n    routePaths.add((route as any).path)\n  }\n  // A nav entry that links to a route the plugin doesn't declare is dead UI.\n  for (const [i, nav] of manifest.navigation.entries()) {\n    const r = (nav as any).route\n    if (routePaths.size > 0 && !routePaths.has(r)) {\n      fail(scope, `navigation[${i}].route \"${r}\" has no matching route in manifest.routes`)\n    }\n  }\n\n  // Settings tabs (the only UI surface integrations need) must be renderable.\n  const settingIds = new Set<string>()\n  for (const [i, tab] of (manifest.settings ?? []).entries()) {\n    if (!nonEmptyString((tab as any)?.id)) fail(scope, `settings[${i}].id must be a non-empty string`)\n    if (!nonEmptyString((tab as any)?.label)) fail(scope, `settings[${i}].label must be a non-empty string`)\n    if (typeof (tab as any)?.component !== 'function') fail(scope, `settings[${i}].component must be a component`)\n    if (settingIds.has((tab as any).id)) fail(scope, `duplicate settings tab id \"${(tab as any).id}\"`)\n    settingIds.add((tab as any).id)\n  }\n\n  for (const [i, feat] of (manifest.declaredFeatures ?? []).entries()) {\n    if (!nonEmptyString((feat as any)?.id)) fail(scope, `declaredFeatures[${i}].id must be a non-empty string`)\n  }\n\n  for (const [i, src] of (manifest.emitsFrom ?? []).entries()) {\n    if (!nonEmptyString(src?.table)) fail(scope, `emitsFrom[${i}].table must be a non-empty string`)\n    if (!nonEmptyString(src?.entityKey)) fail(scope, `emitsFrom[${i}].entityKey must be a non-empty string`)\n    for (const action of src.actions ?? []) {\n      if (!EVENT_ACTIONS.has(action)) fail(scope, `emitsFrom[${i}] has unknown action \"${action}\"`)\n    }\n  }\n\n  const functionSlugs = new Set<string>()\n  for (const [i, fn] of (manifest.functions ?? []).entries()) {\n    if (!SLUG.test(fn?.slug ?? '')) fail(scope, `functions[${i}].slug must be kebab-case — it becomes the deployed function name`)\n    if (functionSlugs.has(fn.slug)) fail(scope, `duplicate function slug \"${fn.slug}\"`)\n    functionSlugs.add(fn.slug)\n    if (typeof fn.verifyJwt !== 'boolean') fail(scope, `functions[${i}].verifyJwt must be a boolean`)\n    if (!FUNCTION_INGRESS.has(fn.ingress)) fail(scope, `functions[${i}].ingress \"${fn.ingress}\" is not one of ${[...FUNCTION_INGRESS].join(', ')}`)\n    // The ingress authenticates by signature, not by a caller JWT it does not have.\n    if (fn.ingress === 'fayz' && fn.verifyJwt) fail(scope, `functions[${i}] is reached through the Fayz ingress, so verifyJwt must be false`)\n    for (const secret of fn.secrets ?? []) {\n      // A name, never a value — this is the shape that keeps a key out of git.\n      if (!SECRET_NAME.test(secret)) fail(scope, `functions[${i}].secrets must name secrets (SCREAMING_SNAKE_CASE), never carry their values`)\n    }\n  }\n\n  for (const [i, def] of (manifest.connectors ?? []).entries()) {\n    // An unlisted category renders NO badge rather than a wrong one, so the\n    // mistake is invisible in a screenshot. Caught here instead.\n    if (def.category !== undefined && !isConnectorCategory(def.category)) {\n      fail(\n        scope,\n        `connectors[${i}].category \"${def.category}\" is not a catalogue category — ` +\n          `use one of ${CONNECTOR_CATEGORIES.join(', ')}, taken from the catalogue row with this connector's slug.`,\n      )\n    }\n    for (const pattern of def.subscribesTo ?? []) {\n      if (!nonEmptyString(pattern)) fail(scope, `connectors[${i}].subscribesTo must hold non-empty patterns`)\n      // Only a trailing star is honoured; see eventKeyMatches.\n      if (pattern.includes('*') && !pattern.endsWith('*')) {\n        fail(scope, `connectors[${i}].subscribesTo \"${pattern}\" — \"*\" is only honoured at the end`)\n      }\n    }\n\n    assertConnectorPermissions(scope, `connectors[${i}]`, def)\n    // The request plane's two fields are required THERE and meaningless\n    // elsewhere. Checked at the manifest so a connector cannot reach a buyer\n    // with an undeclared budget — the failure would otherwise be a spinner.\n    if ((def.planes ?? []).includes('request')) {\n      try {\n        requestPlaneSpec(def)\n      } catch (error) {\n        fail(scope, `connectors[${i}] ${error instanceof Error ? error.message : String(error)}`)\n      }\n    } else if (def.latencyBudgetMs !== undefined || def.onFailure !== undefined) {\n      fail(\n        scope,\n        `connectors[${i}] declares latencyBudgetMs/onFailure but is not on the request plane — ` +\n          `nothing enforces them, so they read as a guarantee that does not exist.`,\n      )\n    }\n    // Authorization vs configuration. Both declarations end up on the same row,\n    // and a key in both is a value with two owners: the connect form would write\n    // it and the settings form would overwrite it.\n    const fieldKeys = new Set((def.fields ?? []).map((f) => f.key))\n    const settingKeys = new Set<string>()\n    for (const [j, setting] of (def.settings ?? []).entries()) {\n      const at = `connectors[${i}].settings[${j}]`\n      if (!nonEmptyString(setting?.key)) fail(scope, `${at}.key must be a non-empty string`)\n      if (!nonEmptyString(setting?.label)) fail(scope, `${at}.label must be a non-empty string`)\n      if (!SETTING_TYPES.has(setting.type)) {\n        fail(scope, `${at}.type \"${setting.type}\" is not one of ${[...SETTING_TYPES].join(', ')}`)\n      }\n      if (settingKeys.has(setting.key)) fail(scope, `${at} duplicates settings key \"${setting.key}\"`)\n      settingKeys.add(setting.key)\n      if (fieldKeys.has(setting.key)) {\n        fail(\n          scope,\n          `${at}.key \"${setting.key}\" is also a credential field — a key either authorizes the ` +\n            `connection (fields) or configures it (settings), never both.`,\n        )\n      }\n      if (setting.type === 'select' || setting.type === 'multi-select') {\n        if (!Array.isArray(setting.options) || setting.options.length === 0) {\n          fail(scope, `${at} is a ${setting.type} and must declare options — that is what replaces a free-text box`)\n        }\n        for (const [k, option] of setting.options.entries()) {\n          if (!nonEmptyString(option?.value)) fail(scope, `${at}.options[${k}].value must be a non-empty string`)\n          if (!nonEmptyString(option?.label)) fail(scope, `${at}.options[${k}].label must be a non-empty string`)\n        }\n      }\n      if (setting.pattern !== undefined) {\n        if (setting.type !== 'text') fail(scope, `${at}.pattern only applies to a text setting`)\n        try {\n          new RegExp(setting.pattern)\n        } catch {\n          fail(scope, `${at}.pattern is not a valid regular expression`)\n        }\n        // A refusal with no sentence is a form that says no and not why.\n        if (!nonEmptyString(setting.patternHint)) fail(scope, `${at} declares a pattern, so it must declare patternHint`)\n      }\n    }\n    // Declared settings nobody can read or write are a screen that renders empty.\n    if (settingKeys.size > 0) {\n      if (typeof def.getSettings !== 'function') fail(scope, `connectors[${i}] declares settings but no getSettings()`)\n      if (typeof def.saveSettings !== 'function') fail(scope, `connectors[${i}] declares settings but no saveSettings()`)\n    }\n\n    // \"Acionado em quais momentos\" — a moment on a plane the connector does not\n    // have is a promise the code cannot keep.\n    const planes = new Set(connectorPlanes(def))\n    const momentKeys = new Set<string>()\n    for (const [j, moment] of (def.invokedAt ?? []).entries()) {\n      const at = `connectors[${i}].invokedAt[${j}]`\n      if (!nonEmptyString(moment?.key)) fail(scope, `${at}.key must be a non-empty string`)\n      if (!nonEmptyString(moment?.label)) fail(scope, `${at}.label must be a non-empty string`)\n      if (momentKeys.has(moment.key)) fail(scope, `${at} duplicates key \"${moment.key}\"`)\n      momentKeys.add(moment.key)\n      const plane = invocationPlane(moment)\n      if (!planes.has(plane)) {\n        fail(scope, `${at} is declared on the ${plane} plane, which connectors[${i}].planes does not include`)\n      }\n      if (moment.trigger !== undefined) {\n        if (plane !== 'sync') fail(scope, `${at}.trigger only applies to a sync moment`)\n        if (!TRIGGERS.has(moment.trigger)) fail(scope, `${at} has unknown trigger \"${moment.trigger}\"`)\n      }\n      // A moment that reaches something the connector never asked for is the\n      // screen answering \"quando ele age\" with access nobody consented to.\n      const declared = new Set((def.permissions ?? []).map((p) => p.resource))\n      for (const resource of moment.touches ?? []) {\n        if (!declared.has(resource)) {\n          fail(\n            scope,\n            `${at}.touches names \"${resource}\", which connectors[${i}].permissions does not declare — ` +\n              `a call site cannot reach what the consent view never showed.`,\n          )\n        }\n      }\n    }\n\n    for (const [j, auto] of (def.managedAutomations ?? []).entries()) {\n      if (!nonEmptyString(auto?.eventKey)) fail(scope, `connectors[${i}].managedAutomations[${j}].eventKey must be a non-empty string`)\n      if (!nonEmptyString(auto?.label)) fail(scope, `connectors[${i}].managedAutomations[${j}].label must be a non-empty string`)\n      // The screen would promise a reaction the ingress never delivers.\n      if (!connectorSubscribes(def, auto.eventKey)) {\n        fail(scope, `connectors[${i}].managedAutomations[${j}] fires on \"${auto.eventKey}\", which no subscribesTo pattern covers`)\n      }\n    }\n  }\n\n  // A connector brings a ConnectorDefinition, not a pair of tables.\n  for (const [i, mig] of (manifest.migrations ?? []).entries()) {\n    for (const table of bespokeConnectorTables(mig?.sql)) {\n      fail(\n        scope,\n        `migrations[${i}] (\"${mig?.id ?? '?'}\") creates public.${table} — a connector's own ` +\n          `*_integrations / *_sync_log table. Store the connection in plg_connections / ` +\n          `plg_sync_runs via createConnectionStore('<connector-id>'): two accounts are two ` +\n          `rows separated by instance_key, and connector-specific counters go in stats.`,\n      )\n    }\n  }\n\n  // A plugin that contributes nothing mountable is almost always a mistake.\n  // (Connector-only addon plugins contribute via `connectors` instead.)\n  if (\n    manifest.navigation.length === 0 &&\n    manifest.routes.length === 0 &&\n    (manifest.settings ?? []).length === 0 &&\n    (manifest.connectors ?? []).length === 0\n  ) {\n    fail(scope, 'plugin contributes no navigation, routes, settings, or connectors — it would mount but do nothing')\n  }\n}\n\n/**\n * What a connector says it needs — and the four ways that declaration can\n * contradict the ones that already existed.\n *\n * The feature this guards is a consent view. Its whole value is that the list it\n * shows is the list, so every way of ending up with two lists is refused here:\n *\n *   1. an action that does not exist for the resource kind (`listen` on a\n *      record type, `write` on an event) — a word the reader would have to guess at;\n *   2. a `data` permission naming a resource the legacy `entities` never listed,\n *      or an entity with no permission — the \"writes to an entity it never\n *      listed\" case, in both directions;\n *   3. a `listen` permission the legacy `subscribesTo` does not name, or a\n *      `subscribesTo` pattern no permission explains — the connector would be\n *      delivered facts the consent view never showed, or shown facts the ingress\n *      filters out;\n *   4. two permissions for the same resource — two rows, two reasons, and no\n *      answer to which one the tenant agreed to.\n *\n * Rules 2 and 3 only bite when BOTH declarations are present. A connector built\n * against an older core declares only the legacy fields and is unaffected; a\n * connector written today declares only `permissions` and both are derived from\n * it. What is refused is saying both things and saying them differently.\n */\nfunction assertConnectorPermissions(\n  scope: string,\n  path: string,\n  def: { permissions?: ConnectorPermission[]; entities?: string[]; subscribesTo?: string[] },\n): void {\n  const permissions = def.permissions\n  if (permissions === undefined) return\n  if (!Array.isArray(permissions)) fail(scope, `${path}.permissions must be an array`)\n\n  const seen = new Set<string>()\n  for (const [j, permission] of permissions.entries()) {\n    const at = `${path}.permissions[${j}]`\n    if (permission?.kind !== 'data' && permission?.kind !== 'event') {\n      fail(scope, `${at}.kind must be \"data\" or \"event\"`)\n    }\n    if (!nonEmptyString(permission.resource)) fail(scope, `${at}.resource must be a non-empty string`)\n    // The reason is the only part a tenant can actually judge; a blank one turns\n    // the screen back into the schema dump it exists to replace.\n    if (!nonEmptyString(permission.reason)) {\n      fail(scope, `${at} must declare a reason — the sentence the tenant judges before authorizing`)\n    }\n    if (!Array.isArray(permission.actions) || permission.actions.length === 0) {\n      fail(scope, `${at}.actions must name at least one action — a resource with no access is not a permission`)\n    }\n    const legal = permissionActions(permission.kind)\n    for (const action of permission.actions) {\n      if (!legal.includes(action)) {\n        fail(scope, `${at} asks for \"${action}\" on the ${permission.kind} resource \"${permission.resource}\", which only admits ${legal.join(', ')}`)\n      }\n    }\n    if (isEventPermission(permission) && permission.resource.includes('*') && !permission.resource.endsWith('*')) {\n      fail(scope, `${at}.resource \"${permission.resource}\" — \"*\" is only honoured at the end`)\n    }\n    const key = `${permission.kind}:${permission.resource}`\n    if (seen.has(key)) fail(scope, `${at} repeats \"${key}\" — one resource, one row, one reason`)\n    seen.add(key)\n  }\n\n  // (2) data permissions ↔ the legacy entities list.\n  if (def.entities !== undefined) {\n    const declared = new Set(connectorEntities({ permissions }))\n    const legacy = new Set(def.entities)\n    for (const entity of declared) {\n      if (!legacy.has(entity)) {\n        fail(\n          scope,\n          `${path}.permissions reaches \"${entity}\", which ${path}.entities does not list — ` +\n            `the two describe the same access and must name the same set (drop entities; it is derived).`,\n        )\n      }\n    }\n    for (const entity of legacy) {\n      if (!declared.has(entity)) {\n        fail(\n          scope,\n          `${path}.entities lists \"${entity}\" with no permission saying what it does with it — ` +\n            `a record type on the consent view with no read/write is a name, not a declaration.`,\n        )\n      }\n    }\n  }\n\n  // (3) listen permissions ↔ the legacy subscribesTo list.\n  if (def.subscribesTo !== undefined) {\n    const declared = new Set(connectorSubscribesTo({ permissions }))\n    const legacy = new Set(def.subscribesTo)\n    for (const pattern of declared) {\n      if (!legacy.has(pattern)) {\n        fail(\n          scope,\n          `${path}.permissions listens to \"${pattern}\", which ${path}.subscribesTo does not — ` +\n            `the ingress filters on that list, so the consent view would promise a fact never delivered.`,\n        )\n      }\n    }\n    for (const pattern of legacy) {\n      if (!declared.has(pattern)) {\n        fail(\n          scope,\n          `${path}.subscribesTo asks for \"${pattern}\" with no listen permission explaining it — ` +\n            `the connector would receive a fact the tenant was never shown.`,\n        )\n      }\n    }\n  }\n}\n\n/**\n * `CREATE TABLE [IF NOT EXISTS] [schema.]name` where name ends in `_integrations`\n * or `_sync_log` — the pair four connectors each reinvented before\n * `plg_connections` / `plg_sync_runs` existed (FAY-1376). Neither generic table\n * matches, so a connector that stores its connection in them creates nothing.\n *\n * Deliberately duplicated in scripts/check-connector-tables.mjs, which scans the\n * .sql files themselves: that runs in the `contracts` CI job with no install and\n * no build, so it cannot import this. This half catches SQL declared inline on a\n * manifest, which no .sql walk would see. The two are held in agreement by one\n * case table, asserted from both sides — see\n * packages/core/test/integrations/connector-tables.test.ts.\n */\nconst BESPOKE_CONNECTOR_TABLE =\n  /\\bcreate\\s+table\\s+(?:if\\s+not\\s+exists\\s+)?(?:[a-z0-9_]+\\s*\\.\\s*)?([a-z0-9_]*(?:_integrations|_sync_log))\\b/gi\n\n/** Table names a CREATE TABLE in this SQL would bring back. Empty = conformant. */\nexport function bespokeConnectorTables(sql: unknown): string[] {\n  const text = typeof sql === 'string' ? sql.replace(/\"/g, '') : ''\n  const found = new Set<string>()\n  for (const m of text.matchAll(BESPOKE_CONNECTOR_TABLE)) found.add(m[1].toLowerCase())\n  return [...found]\n}\n\nconst EVENT_ACTIONS = new Set(['created', 'updated', 'deleted'])\nconst FUNCTION_INGRESS = new Set(['fayz', 'none'])\nconst SLUG = /^[a-z0-9][a-z0-9-]*$/\nconst SECRET_NAME = /^[A-Z][A-Z0-9_]*$/\n\nconst SETTING_TYPES = new Set(['text', 'select', 'multi-select', 'toggle'])\nconst AUTH_KINDS = new Set(['oauth', 'api-key', 'mtls'])\nconst DIRECTIONS = new Set(['inbound', 'outbound', 'bidirectional'])\nconst TRIGGERS = new Set(['on-write', 'scheduled', 'manual', 'webhook'])\n\n/**\n * Assert an integration Connector descriptor is well-formed: identity present,\n * a known auth kind, and at least one capability with a valid direction +\n * trigger set. This is the contract a connector must satisfy BEFORE its\n * data-plane (edge function) exists — the TDD anchor for an integration.\n */\nexport function assertConnectorContract(connector: Connector): void {\n  const scope = nonEmptyString(connector?.id) ? `connector:${connector.id}` : '<unknown connector>'\n  for (const field of ['id', 'provider', 'pluginId'] as const) {\n    if (!nonEmptyString(connector?.[field])) fail(scope, `connector.${field} must be a non-empty string`)\n  }\n  if (!AUTH_KINDS.has(connector.authKind)) fail(scope, `connector.authKind \"${connector.authKind}\" is not one of ${[...AUTH_KINDS].join(', ')}`)\n  if (!Array.isArray(connector.capabilities) || connector.capabilities.length === 0) {\n    fail(scope, 'connector.capabilities must list at least one capability')\n  }\n  for (const [i, cap] of connector.capabilities.entries()) {\n    if (!nonEmptyString(cap?.entity)) fail(scope, `capabilities[${i}].entity must be a non-empty string`)\n    if (!DIRECTIONS.has(cap.direction)) fail(scope, `capabilities[${i}].direction \"${cap.direction}\" is invalid`)\n    if (!Array.isArray(cap.triggers) || cap.triggers.length === 0) fail(scope, `capabilities[${i}].triggers must be non-empty`)\n    for (const trig of cap.triggers) {\n      if (!TRIGGERS.has(trig)) fail(scope, `capabilities[${i}] has unknown trigger \"${trig}\"`)\n    }\n  }\n}\n"]}