@iann29/rastro 0.1.0-alpha.10 → 0.1.0-alpha.12

package/dist/client/federation.d.ts

@@ -6,6 +6,13 @@ export declare const FEDERATED_ANALYTICS_CLAIMS: Readonly<{
     readonly permissions: "rastro_permissions";
 }>;
 export declare const FEDERATED_ANALYTICS_READ_PERMISSION = "analytics:read";
+/**
+ * The opt-in write scope. A token carries it only for organization owners and
+ * admins, and a host honors it only when its local grant lists it too: both
+ * sides must agree before any configuration function runs.
+ */
+export declare const FEDERATED_ANALYTICS_CONFIGURE_PERMISSION = "analytics:configure";
+export declare const FEDERATED_ANALYTICS_PERMISSIONS: readonly ["analytics:read", "analytics:configure"];
 export declare const FEDERATED_ANALYTICS_ERROR_CODES: Readonly<{
     readonly UNAUTHENTICATED: "FEDERATION_UNAUTHENTICATED";
     readonly ISSUER_MISMATCH: "FEDERATION_ISSUER_MISMATCH";
@@ -13,6 +20,7 @@ export declare const FEDERATED_ANALYTICS_ERROR_CODES: Readonly<{
     readonly CONNECTION_DENIED: "FEDERATION_CONNECTION_DENIED";
     readonly INVALID_SCOPE: "FEDERATION_INVALID_SCOPE";
     readonly SITE_DENIED: "FEDERATION_SITE_DENIED";
+    readonly CONFIGURE_FORBIDDEN: "FEDERATION_CONFIGURE_FORBIDDEN";
 }>;
 /**
  * The protocol-v1 baseline every compatible host must serve. Newer hosts may
@@ -35,6 +43,27 @@ export declare const FEDERATED_ANALYTICS_REQUIRED_FUNCTIONS: Readonly<{
     readonly dataCoverage: "dataCoverage";
 }>;
 export declare const FEDERATED_ANALYTICS_REQUIRED_CAPABILITIES: readonly ["siteSummaries", "overview", "liveVisitors", "sessions", "sessionJourney", "conversions", "visitorJourney", "goals", "funnels", "affiliates", "dataCoverage"];
+/**
+ * The optional configuration surface behind the `configure` capability. Every
+ * function here requires the configure permission on the token and on the
+ * host's grant; a host that keeps its grants read-only never runs them.
+ */
+export declare const FEDERATED_ANALYTICS_CONFIGURE_FUNCTIONS: Readonly<{
+    readonly siteSettings: "siteSettings";
+    readonly updateSite: "updateSite";
+    readonly listGoals: "listGoals";
+    readonly upsertGoal: "upsertGoal";
+    readonly removeGoal: "removeGoal";
+    readonly listFunnels: "listFunnels";
+    readonly upsertFunnel: "upsertFunnel";
+    readonly removeFunnel: "removeFunnel";
+    readonly listAffiliates: "listAffiliates";
+    readonly upsertAffiliate: "upsertAffiliate";
+    readonly removeAffiliate: "removeAffiliate";
+    readonly retentionStatus: "retentionStatus";
+    readonly setRetentionPolicy: "setRetentionPolicy";
+    readonly disableRetentionPolicy: "disableRetentionPolicy";
+}>;
 export declare const FEDERATED_ANALYTICS_CONNECTOR_MANIFEST: Readonly<{
     readonly protocol: "amage-rastro-analytics";
     readonly protocolVersion: 1;
@@ -53,10 +82,24 @@ export declare const FEDERATED_ANALYTICS_CONNECTOR_MANIFEST: Readonly<{
         readonly funnelsReport: "funnelsReport";
         readonly affiliatesReport: "affiliatesReport";
         readonly dataCoverage: "dataCoverage";
+        readonly siteSettings: "siteSettings";
+        readonly updateSite: "updateSite";
+        readonly listGoals: "listGoals";
+        readonly upsertGoal: "upsertGoal";
+        readonly removeGoal: "removeGoal";
+        readonly listFunnels: "listFunnels";
+        readonly upsertFunnel: "upsertFunnel";
+        readonly removeFunnel: "removeFunnel";
+        readonly listAffiliates: "listAffiliates";
+        readonly upsertAffiliate: "upsertAffiliate";
+        readonly removeAffiliate: "removeAffiliate";
+        readonly retentionStatus: "retentionStatus";
+        readonly setRetentionPolicy: "setRetentionPolicy";
+        readonly disableRetentionPolicy: "disableRetentionPolicy";
         readonly vitalsReport: "vitalsReport";
         readonly siteMap: "siteMap";
     }>;
-    readonly capabilities: readonly ["siteSummaries", "overview", "liveVisitors", "sessions", "sessionJourney", "conversions", "visitorJourney", "goals", "funnels", "affiliates", "dataCoverage", "vitals", "siteMap"];
+    readonly capabilities: readonly ["siteSummaries", "overview", "liveVisitors", "sessions", "sessionJourney", "conversions", "visitorJourney", "goals", "funnels", "affiliates", "dataCoverage", "vitals", "siteMap", "localDays", "configure"];
     readonly limits: Readonly<{
         readonly maxSitesPerRequest: 10;
         readonly maxSitesPerConnection: 10;
@@ -67,11 +110,18 @@ export declare const FEDERATED_ANALYTICS_CONNECTOR_MANIFEST: Readonly<{
 }>;
 export type FederatedAnalyticsErrorCode = (typeof FEDERATED_ANALYTICS_ERROR_CODES)[keyof typeof FEDERATED_ANALYTICS_ERROR_CODES];
 export type FederatedAnalyticsCapability = (typeof FEDERATED_ANALYTICS_CONNECTOR_MANIFEST.capabilities)[number];
+export type FederatedAnalyticsPermission = (typeof FEDERATED_ANALYTICS_PERMISSIONS)[number];
 export type FederatedAnalyticsManifest = ReturnType<typeof createFederatedAnalyticsManifest>;
 export interface FederatedAnalyticsConnection {
     connectionId: string;
     organizationId: string;
     siteIds: readonly string[];
+    /**
+     * What the host lets this connection do. Absent means read only; listing
+     * `analytics:configure` lets owners and admins of the dashboard organization
+     * manage goals, funnels, affiliates, site settings, and retention.
+     */
+    permissions?: readonly FederatedAnalyticsPermission[];
     revokedAt?: number;
 }
 export interface FederatedAnalyticsIdentity {
@@ -85,34 +135,65 @@ export interface FederatedSiteSummary {
     currency: string;
     timezone: string | null;
     cookieless: boolean;
+    /**
+     * The site's calendar days, when the host keeps them (alpha.11): the
+     * timezone its daily overview buckets follow and the instant from which
+     * they are complete. `null` for a site without a timezone, or whose zone
+     * never leaves UTC. Hosts before alpha.11 omit the field.
+     */
+    localDays: {
+        timezone: string;
+        since: number;
+    } | null;
 }
 export interface FederatedAnalyticsConnectionStatus {
     status: "connected";
     protocolVersion: 1;
     capabilities: FederatedAnalyticsCapability[];
+    /** The permissions both the token and the host's grant agree on. */
+    permissions: FederatedAnalyticsPermission[];
     siteCount: number;
 }
+/** A resolved connection plus the permissions this request may act with. */
+export type AuthorizedFederatedAnalyticsConnection = FederatedAnalyticsConnection & {
+    effectivePermissions: FederatedAnalyticsPermission[];
+};
 export type ResolveFederatedAnalyticsConnection = (ctx: AnalyticsAuthorizationContext, identity: FederatedAnalyticsIdentity) => FederatedAnalyticsConnection | null | Promise<FederatedAnalyticsConnection | null>;
 export interface FederatedAnalyticsAuthorizerOptions {
     issuer: string;
     resolveConnection: ResolveFederatedAnalyticsConnection;
 }
+export declare const federatedAnalyticsPermissionValidator: import("convex/values").VUnion<"analytics:configure" | "analytics:read", [import("convex/values").VLiteral<"analytics:read", "required">, import("convex/values").VLiteral<"analytics:configure", "required">], "required", never>;
 export declare const federatedAnalyticsManifestValidator: import("convex/values").VObject<{
-    capabilities: ("affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
+    capabilities: ("affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
     functions: {
         affiliatesReport: "affiliatesReport";
         connectionStatus: "connectionStatus";
         dataCoverage: "dataCoverage";
+        disableRetentionPolicy: "disableRetentionPolicy";
         funnelsReport: "funnelsReport";
         goalsReport: "goalsReport";
+        listAffiliates: "listAffiliates";
         listConversions: "listConversions";
+        listFunnels: "listFunnels";
+        listGoals: "listGoals";
         listSessions: "listSessions";
         listSites: "listSites";
         liveVisitors: "liveVisitors";
         manifest: "manifest";
         overview: "overview";
+        removeAffiliate: "removeAffiliate";
+        removeFunnel: "removeFunnel";
+        removeGoal: "removeGoal";
+        retentionStatus: "retentionStatus";
         sessionJourney: "sessionJourney";
+        setRetentionPolicy: "setRetentionPolicy";
         siteMap: "siteMap";
+        siteSettings: "siteSettings";
+        updateSite: "updateSite";
+        upsertAffiliate: "upsertAffiliate";
+        upsertFunnel: "upsertFunnel";
+        upsertGoal: "upsertGoal";
         visitorJourney: "visitorJourney";
         vitalsReport: "vitalsReport";
     };
@@ -134,16 +215,30 @@ export declare const federatedAnalyticsManifestValidator: import("convex/values"
         affiliatesReport: "affiliatesReport";
         connectionStatus: "connectionStatus";
         dataCoverage: "dataCoverage";
+        disableRetentionPolicy: "disableRetentionPolicy";
         funnelsReport: "funnelsReport";
         goalsReport: "goalsReport";
+        listAffiliates: "listAffiliates";
         listConversions: "listConversions";
+        listFunnels: "listFunnels";
+        listGoals: "listGoals";
         listSessions: "listSessions";
         listSites: "listSites";
         liveVisitors: "liveVisitors";
         manifest: "manifest";
         overview: "overview";
+        removeAffiliate: "removeAffiliate";
+        removeFunnel: "removeFunnel";
+        removeGoal: "removeGoal";
+        retentionStatus: "retentionStatus";
         sessionJourney: "sessionJourney";
+        setRetentionPolicy: "setRetentionPolicy";
         siteMap: "siteMap";
+        siteSettings: "siteSettings";
+        updateSite: "updateSite";
+        upsertAffiliate: "upsertAffiliate";
+        upsertFunnel: "upsertFunnel";
+        upsertGoal: "upsertGoal";
         visitorJourney: "visitorJourney";
         vitalsReport: "vitalsReport";
     }, {
@@ -162,8 +257,22 @@ export declare const federatedAnalyticsManifestValidator: import("convex/values"
         dataCoverage: import("convex/values").VLiteral<"dataCoverage", "required">;
         vitalsReport: import("convex/values").VLiteral<"vitalsReport", "required">;
         siteMap: import("convex/values").VLiteral<"siteMap", "required">;
-    }, "required", "affiliatesReport" | "connectionStatus" | "dataCoverage" | "funnelsReport" | "goalsReport" | "listConversions" | "listSessions" | "listSites" | "liveVisitors" | "manifest" | "overview" | "sessionJourney" | "siteMap" | "visitorJourney" | "vitalsReport">;
-    capabilities: import("convex/values").VArray<("affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[], import("convex/values").VUnion<"affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals", [import("convex/values").VLiteral<"siteSummaries", "required">, import("convex/values").VLiteral<"overview", "required">, import("convex/values").VLiteral<"liveVisitors", "required">, import("convex/values").VLiteral<"sessions", "required">, import("convex/values").VLiteral<"sessionJourney", "required">, import("convex/values").VLiteral<"conversions", "required">, import("convex/values").VLiteral<"visitorJourney", "required">, import("convex/values").VLiteral<"goals", "required">, import("convex/values").VLiteral<"funnels", "required">, import("convex/values").VLiteral<"affiliates", "required">, import("convex/values").VLiteral<"dataCoverage", "required">, import("convex/values").VLiteral<"vitals", "required">, import("convex/values").VLiteral<"siteMap", "required">], "required", never>, "required">;
+        siteSettings: import("convex/values").VLiteral<"siteSettings", "required">;
+        updateSite: import("convex/values").VLiteral<"updateSite", "required">;
+        listGoals: import("convex/values").VLiteral<"listGoals", "required">;
+        upsertGoal: import("convex/values").VLiteral<"upsertGoal", "required">;
+        removeGoal: import("convex/values").VLiteral<"removeGoal", "required">;
+        listFunnels: import("convex/values").VLiteral<"listFunnels", "required">;
+        upsertFunnel: import("convex/values").VLiteral<"upsertFunnel", "required">;
+        removeFunnel: import("convex/values").VLiteral<"removeFunnel", "required">;
+        listAffiliates: import("convex/values").VLiteral<"listAffiliates", "required">;
+        upsertAffiliate: import("convex/values").VLiteral<"upsertAffiliate", "required">;
+        removeAffiliate: import("convex/values").VLiteral<"removeAffiliate", "required">;
+        retentionStatus: import("convex/values").VLiteral<"retentionStatus", "required">;
+        setRetentionPolicy: import("convex/values").VLiteral<"setRetentionPolicy", "required">;
+        disableRetentionPolicy: import("convex/values").VLiteral<"disableRetentionPolicy", "required">;
+    }, "required", "affiliatesReport" | "connectionStatus" | "dataCoverage" | "disableRetentionPolicy" | "funnelsReport" | "goalsReport" | "listAffiliates" | "listConversions" | "listFunnels" | "listGoals" | "listSessions" | "listSites" | "liveVisitors" | "manifest" | "overview" | "removeAffiliate" | "removeFunnel" | "removeGoal" | "retentionStatus" | "sessionJourney" | "setRetentionPolicy" | "siteMap" | "siteSettings" | "updateSite" | "upsertAffiliate" | "upsertFunnel" | "upsertGoal" | "visitorJourney" | "vitalsReport">;
+    capabilities: import("convex/values").VArray<("affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[], import("convex/values").VUnion<"affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals", [import("convex/values").VLiteral<"siteSummaries", "required">, import("convex/values").VLiteral<"overview", "required">, import("convex/values").VLiteral<"liveVisitors", "required">, import("convex/values").VLiteral<"sessions", "required">, import("convex/values").VLiteral<"sessionJourney", "required">, import("convex/values").VLiteral<"conversions", "required">, import("convex/values").VLiteral<"visitorJourney", "required">, import("convex/values").VLiteral<"goals", "required">, import("convex/values").VLiteral<"funnels", "required">, import("convex/values").VLiteral<"affiliates", "required">, import("convex/values").VLiteral<"dataCoverage", "required">, import("convex/values").VLiteral<"vitals", "required">, import("convex/values").VLiteral<"siteMap", "required">, import("convex/values").VLiteral<"localDays", "required">, import("convex/values").VLiteral<"configure", "required">], "required", never>, "required">;
     limits: import("convex/values").VObject<{
         maxJourneyEvents: number;
         maxLiveVisitors: number;
@@ -177,21 +286,33 @@ export declare const federatedAnalyticsManifestValidator: import("convex/values"
         maxLiveVisitors: import("convex/values").VFloat64<number, "required">;
         maxJourneyEvents: import("convex/values").VFloat64<number, "required">;
     }, "required", "maxJourneyEvents" | "maxLiveVisitors" | "maxReportRangeDays" | "maxSitesPerConnection" | "maxSitesPerRequest">;
-}, "required", "capabilities" | "functions" | "functions.affiliatesReport" | "functions.connectionStatus" | "functions.dataCoverage" | "functions.funnelsReport" | "functions.goalsReport" | "functions.listConversions" | "functions.listSessions" | "functions.listSites" | "functions.liveVisitors" | "functions.manifest" | "functions.overview" | "functions.sessionJourney" | "functions.siteMap" | "functions.visitorJourney" | "functions.vitalsReport" | "limits" | "limits.maxJourneyEvents" | "limits.maxLiveVisitors" | "limits.maxReportRangeDays" | "limits.maxSitesPerConnection" | "limits.maxSitesPerRequest" | "moduleName" | "protocol" | "protocolVersion">;
+}, "required", "capabilities" | "functions" | "functions.affiliatesReport" | "functions.connectionStatus" | "functions.dataCoverage" | "functions.disableRetentionPolicy" | "functions.funnelsReport" | "functions.goalsReport" | "functions.listAffiliates" | "functions.listConversions" | "functions.listFunnels" | "functions.listGoals" | "functions.listSessions" | "functions.listSites" | "functions.liveVisitors" | "functions.manifest" | "functions.overview" | "functions.removeAffiliate" | "functions.removeFunnel" | "functions.removeGoal" | "functions.retentionStatus" | "functions.sessionJourney" | "functions.setRetentionPolicy" | "functions.siteMap" | "functions.siteSettings" | "functions.updateSite" | "functions.upsertAffiliate" | "functions.upsertFunnel" | "functions.upsertGoal" | "functions.visitorJourney" | "functions.vitalsReport" | "limits" | "limits.maxJourneyEvents" | "limits.maxLiveVisitors" | "limits.maxReportRangeDays" | "limits.maxSitesPerConnection" | "limits.maxSitesPerRequest" | "moduleName" | "protocol" | "protocolVersion">;
 export declare const federatedAnalyticsConnectionStatusValidator: import("convex/values").VObject<{
-    capabilities: ("affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
+    capabilities: ("affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
+    permissions: ("analytics:configure" | "analytics:read")[];
     protocolVersion: 1;
     siteCount: number;
     status: "connected";
 }, {
     status: import("convex/values").VLiteral<"connected", "required">;
     protocolVersion: import("convex/values").VLiteral<1, "required">;
-    capabilities: import("convex/values").VArray<("affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[], import("convex/values").VUnion<"affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals", [import("convex/values").VLiteral<"siteSummaries", "required">, import("convex/values").VLiteral<"overview", "required">, import("convex/values").VLiteral<"liveVisitors", "required">, import("convex/values").VLiteral<"sessions", "required">, import("convex/values").VLiteral<"sessionJourney", "required">, import("convex/values").VLiteral<"conversions", "required">, import("convex/values").VLiteral<"visitorJourney", "required">, import("convex/values").VLiteral<"goals", "required">, import("convex/values").VLiteral<"funnels", "required">, import("convex/values").VLiteral<"affiliates", "required">, import("convex/values").VLiteral<"dataCoverage", "required">, import("convex/values").VLiteral<"vitals", "required">, import("convex/values").VLiteral<"siteMap", "required">], "required", never>, "required">;
+    capabilities: import("convex/values").VArray<("affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[], import("convex/values").VUnion<"affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals", [import("convex/values").VLiteral<"siteSummaries", "required">, import("convex/values").VLiteral<"overview", "required">, import("convex/values").VLiteral<"liveVisitors", "required">, import("convex/values").VLiteral<"sessions", "required">, import("convex/values").VLiteral<"sessionJourney", "required">, import("convex/values").VLiteral<"conversions", "required">, import("convex/values").VLiteral<"visitorJourney", "required">, import("convex/values").VLiteral<"goals", "required">, import("convex/values").VLiteral<"funnels", "required">, import("convex/values").VLiteral<"affiliates", "required">, import("convex/values").VLiteral<"dataCoverage", "required">, import("convex/values").VLiteral<"vitals", "required">, import("convex/values").VLiteral<"siteMap", "required">, import("convex/values").VLiteral<"localDays", "required">, import("convex/values").VLiteral<"configure", "required">], "required", never>, "required">;
+    permissions: import("convex/values").VArray<("analytics:configure" | "analytics:read")[], import("convex/values").VUnion<"analytics:configure" | "analytics:read", [import("convex/values").VLiteral<"analytics:read", "required">, import("convex/values").VLiteral<"analytics:configure", "required">], "required", never>, "required">;
     siteCount: import("convex/values").VFloat64<number, "required">;
-}, "required", "capabilities" | "protocolVersion" | "siteCount" | "status">;
+}, "required", "capabilities" | "permissions" | "protocolVersion" | "siteCount" | "status">;
+/**
+ * The permissions a request may act with: those the token claims that the
+ * host's grant also lists. Reading needs no listing — a grant is a read grant
+ * by definition — so the read permission is always present.
+ */
+export declare function effectiveFederatedPermissions(claimed: readonly string[], connection: Pick<FederatedAnalyticsConnection, "permissions">): FederatedAnalyticsPermission[];
 export declare const federatedSiteSummaryValidator: import("convex/values").VObject<{
     cookieless: boolean;
     currency: string;
+    localDays: {
+        since: number;
+        timezone: string;
+    } | null;
     name: string;
     siteId: string;
     timezone: string | null;
@@ -201,7 +322,17 @@ export declare const federatedSiteSummaryValidator: import("convex/values").VObj
     currency: import("convex/values").VString<string, "required">;
     timezone: import("convex/values").VUnion<string | null, [import("convex/values").VString<string, "required">, import("convex/values").VNull<null, "required">], "required", never>;
     cookieless: import("convex/values").VBoolean<boolean, "required">;
-}, "required", "cookieless" | "currency" | "name" | "siteId" | "timezone">;
+    localDays: import("convex/values").VUnion<{
+        since: number;
+        timezone: string;
+    } | null, [import("convex/values").VObject<{
+        since: number;
+        timezone: string;
+    }, {
+        timezone: import("convex/values").VString<string, "required">;
+        since: import("convex/values").VFloat64<number, "required">;
+    }, "required", "since" | "timezone">, import("convex/values").VNull<null, "required">], "required", "since" | "timezone">;
+}, "required", "cookieless" | "currency" | "localDays" | "localDays.since" | "localDays.timezone" | "name" | "siteId" | "timezone">;
 export declare function createFederatedAnalyticsManifest(): {
     protocol: "amage-rastro-analytics";
     protocolVersion: 1;
@@ -220,10 +351,24 @@ export declare function createFederatedAnalyticsManifest(): {
         funnelsReport: "funnelsReport";
         affiliatesReport: "affiliatesReport";
         dataCoverage: "dataCoverage";
+        siteSettings: "siteSettings";
+        updateSite: "updateSite";
+        listGoals: "listGoals";
+        upsertGoal: "upsertGoal";
+        removeGoal: "removeGoal";
+        listFunnels: "listFunnels";
+        upsertFunnel: "upsertFunnel";
+        removeFunnel: "removeFunnel";
+        listAffiliates: "listAffiliates";
+        upsertAffiliate: "upsertAffiliate";
+        removeAffiliate: "removeAffiliate";
+        retentionStatus: "retentionStatus";
+        setRetentionPolicy: "setRetentionPolicy";
+        disableRetentionPolicy: "disableRetentionPolicy";
         vitalsReport: "vitalsReport";
         siteMap: "siteMap";
     };
-    capabilities: ("affiliates" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
+    capabilities: ("affiliates" | "configure" | "conversions" | "dataCoverage" | "funnels" | "goals" | "liveVisitors" | "localDays" | "overview" | "sessionJourney" | "sessions" | "siteMap" | "siteSummaries" | "visitorJourney" | "vitals")[];
     limits: {
         maxSitesPerRequest: 10;
         maxSitesPerConnection: 10;
@@ -232,5 +377,5 @@ export declare function createFederatedAnalyticsManifest(): {
         maxJourneyEvents: 500;
     };
 };
-export declare function createFederatedAnalyticsConnectionAuthorizer(options: FederatedAnalyticsAuthorizerOptions): (ctx: AnalyticsAuthorizationContext, requestedSiteIds?: readonly string[]) => Promise<FederatedAnalyticsConnection>;
+export declare function createFederatedAnalyticsConnectionAuthorizer(options: FederatedAnalyticsAuthorizerOptions): (ctx: AnalyticsAuthorizationContext, requestedSiteIds?: readonly string[], requiredPermission?: FederatedAnalyticsPermission) => Promise<AuthorizedFederatedAnalyticsConnection>;
 //# sourceMappingURL=federation.d.ts.map

package/dist/client/federation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/client/federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQlD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEhE,eAAO,MAAM,0BAA0B;2BACvB,sBAAsB;6BACpB,wBAAwB;0BAC3B,oBAAoB;EACxB,CAAC;AAEZ,eAAO,MAAM,mCAAmC,mBAAmB,CAAC;AAEpE,eAAO,MAAM,+BAA+B;8BACzB,4BAA4B;8BAC5B,4BAA4B;6BAC7B,2BAA2B;gCACxB,8BAA8B;4BAClC,0BAA0B;0BAC5B,wBAAwB;EAC5B,CAAC;AAGZ;;;;GAIG;AACH,eAAO,MAAM,sCAAsC;uBACvC,UAAU;+BACF,kBAAkB;wBACzB,WAAW;uBACZ,UAAU;2BACN,cAAc;2BACd,cAAc;6BACZ,gBAAgB;8BACf,iBAAiB;6BAClB,gBAAgB;0BACnB,aAAa;4BACX,eAAe;+BACZ,kBAAkB;2BACtB,cAAc;EACnB,CAAC;AACZ,eAAO,MAAM,yCAAyC,yKAY3C,CAAC;AAmBZ,eAAO,MAAM,sCAAsC;uBACvC,wBAAwB;8BACjB,CAAC;yBACN,kBAAkB;;2BAhDpB,UAAU;mCACF,kBAAkB;4BACzB,WAAW;2BACZ,UAAU;+BACN,cAAc;+BACd,cAAc;iCACZ,gBAAgB;kCACf,iBAAiB;iCAClB,gBAAgB;8BACnB,aAAa;gCACX,eAAe;mCACZ,kBAAkB;+BACtB,cAAc;+BAiBd,cAAc;0BACnB,SAAS;;;;;;;;;;EAsBT,CAAC;AAKZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,OAAO,+BAA+B,CAAC,CAAC;AACzF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,sCAAsC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvE,MAAM,MAAM,0BAA0B,GAAG,UAAU,CACjD,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,CAAC,CAAC;IACnB,YAAY,EAAE,4BAA4B,EAAE,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,mCAAmC,GAAG,CAChD,GAAG,EAAE,6BAA6B,EAClC,QAAQ,EAAE,0BAA0B,KAElC,4BAA4B,GAC5B,IAAI,GACJ,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;AAEjD,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,mCAAmC,CAAC;CACxD;AAkBD,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+oBA+B9C,CAAC;AAEH,eAAO,MAAM,2CAA2C;;;;;;;;;;2EAKtD,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;0EAMxC,CAAC;AAEH,wBAAgB,gCAAgC;cA5HpC,wBAAwB;qBACjB,CAAC;gBACN,kBAAkB;;kBAhDpB,UAAU;0BACF,kBAAkB;mBACzB,WAAW;kBACZ,UAAU;sBACN,cAAc;sBACd,cAAc;wBACZ,gBAAgB;yBACf,iBAAiB;wBAClB,gBAAgB;qBACnB,aAAa;uBACX,eAAe;0BACZ,kBAAkB;sBACtB,cAAc;sBAiBd,cAAc;iBACnB,SAAS;;;;;;;;;;EAmJnB;AAED,wBAAgB,4CAA4C,CAC1D,OAAO,EAAE,mCAAmC,SAUrC,6BAA6B,qBACf,SAAS,MAAM,EAAE,KACnC,OAAO,CAAC,4BAA4B,CAAC,CA0EzC"}
+{"version":3,"file":"federation.d.ts","sourceRoot":"","sources":["../../src/client/federation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAQlD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEhE,eAAO,MAAM,0BAA0B;2BACvB,sBAAsB;6BACpB,wBAAwB;0BAC3B,oBAAoB;EACxB,CAAC;AAEZ,eAAO,MAAM,mCAAmC,mBAAmB,CAAC;AACpE;;;;GAIG;AACH,eAAO,MAAM,wCAAwC,wBAAwB,CAAC;AAC9E,eAAO,MAAM,+BAA+B,oDAGjC,CAAC;AAEZ,eAAO,MAAM,+BAA+B;8BACzB,4BAA4B;8BAC5B,4BAA4B;6BAC7B,2BAA2B;gCACxB,8BAA8B;4BAClC,0BAA0B;0BAC5B,wBAAwB;kCAChB,gCAAgC;EAC5C,CAAC;AAGZ;;;;GAIG;AACH,eAAO,MAAM,sCAAsC;uBACvC,UAAU;+BACF,kBAAkB;wBACzB,WAAW;uBACZ,UAAU;2BACN,cAAc;2BACd,cAAc;6BACZ,gBAAgB;8BACf,iBAAiB;6BAClB,gBAAgB;0BACnB,aAAa;4BACX,eAAe;+BACZ,kBAAkB;2BACtB,cAAc;EACnB,CAAC;AACZ,eAAO,MAAM,yCAAyC,yKAY3C,CAAC;AACZ;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;2BACpC,cAAc;yBAChB,YAAY;wBACb,WAAW;yBACV,YAAY;yBACZ,YAAY;0BACX,aAAa;2BACZ,cAAc;2BACd,cAAc;6BACZ,gBAAgB;8BACf,iBAAiB;8BACjB,iBAAiB;8BACjB,iBAAiB;iCACd,oBAAoB;qCAChB,wBAAwB;EACvC,CAAC;AAwBZ,eAAO,MAAM,sCAAsC;uBACvC,wBAAwB;8BACjB,CAAC;yBACN,kBAAkB;;2BA1EpB,UAAU;mCACF,kBAAkB;4BACzB,WAAW;2BACZ,UAAU;+BACN,cAAc;+BACd,cAAc;iCACZ,gBAAgB;kCACf,iBAAiB;iCAClB,gBAAgB;8BACnB,aAAa;gCACX,eAAe;mCACZ,kBAAkB;+BACtB,cAAc;+BAqBd,cAAc;6BAChB,YAAY;4BACb,WAAW;6BACV,YAAY;6BACZ,YAAY;8BACX,aAAa;+BACZ,cAAc;+BACd,cAAc;iCACZ,gBAAgB;kCACf,iBAAiB;kCACjB,iBAAiB;kCACjB,iBAAiB;qCACd,oBAAoB;yCAChB,wBAAwB;+BAIlC,cAAc;0BACnB,SAAS;;;;;;;;;;EA2BT,CAAC;AAKZ,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,OAAO,+BAA+B,CAAC,CAAC;AACzF,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,sCAAsC,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvE,MAAM,MAAM,4BAA4B,GACtC,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,MAAM,MAAM,0BAA0B,GAAG,UAAU,CACjD,OAAO,gCAAgC,CACxC,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,CAAC,CAAC;IACnB,YAAY,EAAE,4BAA4B,EAAE,CAAC;IAC7C,oEAAoE;IACpE,WAAW,EAAE,4BAA4B,EAAE,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,4EAA4E;AAC5E,MAAM,MAAM,sCAAsC,GAChD,4BAA4B,GAAG;IAC7B,oBAAoB,EAAE,4BAA4B,EAAE,CAAC;CACtD,CAAC;AAEJ,MAAM,MAAM,mCAAmC,GAAG,CAChD,GAAG,EAAE,6BAA6B,EAClC,QAAQ,EAAE,0BAA0B,KAElC,4BAA4B,GAC5B,IAAI,GACJ,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAAC;AAEjD,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,mCAAmC,CAAC;CACxD;AAmBD,eAAO,MAAM,qCAAqC,oOAGjD,CAAC;AAEF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0hCA6C9C,CAAC;AAEH,eAAO,MAAM,2CAA2C;;;;;;;;;;;;2FAMtD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,UAAU,EAAE,IAAI,CAAC,4BAA4B,EAAE,aAAa,CAAC,GAC5D,4BAA4B,EAAE,CAOhC;AAED,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;mIAUxC,CAAC;AAEH,wBAAgB,gCAAgC;cA7LpC,wBAAwB;qBACjB,CAAC;gBACN,kBAAkB;;kBA1EpB,UAAU;0BACF,kBAAkB;mBACzB,WAAW;kBACZ,UAAU;sBACN,cAAc;sBACd,cAAc;wBACZ,gBAAgB;yBACf,iBAAiB;wBAClB,gBAAgB;qBACnB,aAAa;uBACX,eAAe;0BACZ,kBAAkB;sBACtB,cAAc;sBAqBd,cAAc;oBAChB,YAAY;mBACb,WAAW;oBACV,YAAY;oBACZ,YAAY;qBACX,aAAa;sBACZ,cAAc;sBACd,cAAc;wBACZ,gBAAgB;yBACf,iBAAiB;yBACjB,iBAAiB;yBACjB,iBAAiB;4BACd,oBAAoB;gCAChB,wBAAwB;sBAIlC,cAAc;iBACnB,SAAS;;;;;;;;;;EAyNnB;AAED,wBAAgB,4CAA4C,CAC1D,OAAO,EAAE,mCAAmC,SAUrC,6BAA6B,qBACf,SAAS,MAAM,EAAE,uBAChB,4BAA4B,KAC/C,OAAO,CAAC,sCAAsC,CAAC,CA0FnD"}

package/dist/client/federation.js

@@ -6,6 +6,16 @@ export const FEDERATED_ANALYTICS_CLAIMS = Object.freeze({
     permissions: "rastro_permissions",
 });
 export const FEDERATED_ANALYTICS_READ_PERMISSION = "analytics:read";
+/**
+ * The opt-in write scope. A token carries it only for organization owners and
+ * admins, and a host honors it only when its local grant lists it too: both
+ * sides must agree before any configuration function runs.
+ */
+export const FEDERATED_ANALYTICS_CONFIGURE_PERMISSION = "analytics:configure";
+export const FEDERATED_ANALYTICS_PERMISSIONS = Object.freeze([
+    FEDERATED_ANALYTICS_READ_PERMISSION,
+    FEDERATED_ANALYTICS_CONFIGURE_PERMISSION,
+]);
 export const FEDERATED_ANALYTICS_ERROR_CODES = Object.freeze({
     UNAUTHENTICATED: "FEDERATION_UNAUTHENTICATED",
     ISSUER_MISMATCH: "FEDERATION_ISSUER_MISMATCH",
@@ -13,6 +23,7 @@ export const FEDERATED_ANALYTICS_ERROR_CODES = Object.freeze({
     CONNECTION_DENIED: "FEDERATION_CONNECTION_DENIED",
     INVALID_SCOPE: "FEDERATION_INVALID_SCOPE",
     SITE_DENIED: "FEDERATION_SITE_DENIED",
+    CONFIGURE_FORBIDDEN: "FEDERATION_CONFIGURE_FORBIDDEN",
 });
 const MAX_CONNECTION_SITE_IDS = MAX_REPORT_SITES;
 /**
@@ -48,15 +59,41 @@ export const FEDERATED_ANALYTICS_REQUIRED_CAPABILITIES = Object.freeze([
     "affiliates",
     "dataCoverage",
 ]);
+/**
+ * The optional configuration surface behind the `configure` capability. Every
+ * function here requires the configure permission on the token and on the
+ * host's grant; a host that keeps its grants read-only never runs them.
+ */
+export const FEDERATED_ANALYTICS_CONFIGURE_FUNCTIONS = Object.freeze({
+    siteSettings: "siteSettings",
+    updateSite: "updateSite",
+    listGoals: "listGoals",
+    upsertGoal: "upsertGoal",
+    removeGoal: "removeGoal",
+    listFunnels: "listFunnels",
+    upsertFunnel: "upsertFunnel",
+    removeFunnel: "removeFunnel",
+    listAffiliates: "listAffiliates",
+    upsertAffiliate: "upsertAffiliate",
+    removeAffiliate: "removeAffiliate",
+    retentionStatus: "retentionStatus",
+    setRetentionPolicy: "setRetentionPolicy",
+    disableRetentionPolicy: "disableRetentionPolicy",
+});
 const FEDERATED_ANALYTICS_FUNCTION_NAMES = Object.freeze({
     ...FEDERATED_ANALYTICS_REQUIRED_FUNCTIONS,
     vitalsReport: "vitalsReport",
     siteMap: "siteMap",
+    ...FEDERATED_ANALYTICS_CONFIGURE_FUNCTIONS,
 });
 const FEDERATED_ANALYTICS_CAPABILITIES = Object.freeze([
     ...FEDERATED_ANALYTICS_REQUIRED_CAPABILITIES,
     "vitals",
     "siteMap",
+    // The daily overview answers whole calendar days in the site's timezone
+    // from its own buckets (alpha.11); dashboards must not require it.
+    "localDays",
+    "configure",
 ]);
 const FEDERATED_ANALYTICS_LIMITS = Object.freeze({
     maxSitesPerRequest: MAX_REPORT_SITES,
@@ -75,7 +112,8 @@ export const FEDERATED_ANALYTICS_CONNECTOR_MANIFEST = Object.freeze({
 });
 const MAX_CLAIM_LENGTH = 128;
 const MAX_PERMISSIONS = 16;
-const federatedAnalyticsCapabilityValidator = v.union(v.literal("siteSummaries"), v.literal("overview"), v.literal("liveVisitors"), v.literal("sessions"), v.literal("sessionJourney"), v.literal("conversions"), v.literal("visitorJourney"), v.literal("goals"), v.literal("funnels"), v.literal("affiliates"), v.literal("dataCoverage"), v.literal("vitals"), v.literal("siteMap"));
+const federatedAnalyticsCapabilityValidator = v.union(v.literal("siteSummaries"), v.literal("overview"), v.literal("liveVisitors"), v.literal("sessions"), v.literal("sessionJourney"), v.literal("conversions"), v.literal("visitorJourney"), v.literal("goals"), v.literal("funnels"), v.literal("affiliates"), v.literal("dataCoverage"), v.literal("vitals"), v.literal("siteMap"), v.literal("localDays"), v.literal("configure"));
+export const federatedAnalyticsPermissionValidator = v.union(v.literal(FEDERATED_ANALYTICS_READ_PERMISSION), v.literal(FEDERATED_ANALYTICS_CONFIGURE_PERMISSION));
 export const federatedAnalyticsManifestValidator = v.object({
     protocol: v.literal(FEDERATED_ANALYTICS_CONNECTOR_MANIFEST.protocol),
     protocolVersion: v.literal(FEDERATED_ANALYTICS_CONNECTOR_MANIFEST.protocolVersion),
@@ -96,6 +134,20 @@ export const federatedAnalyticsManifestValidator = v.object({
         dataCoverage: v.literal("dataCoverage"),
         vitalsReport: v.literal("vitalsReport"),
         siteMap: v.literal("siteMap"),
+        siteSettings: v.literal("siteSettings"),
+        updateSite: v.literal("updateSite"),
+        listGoals: v.literal("listGoals"),
+        upsertGoal: v.literal("upsertGoal"),
+        removeGoal: v.literal("removeGoal"),
+        listFunnels: v.literal("listFunnels"),
+        upsertFunnel: v.literal("upsertFunnel"),
+        removeFunnel: v.literal("removeFunnel"),
+        listAffiliates: v.literal("listAffiliates"),
+        upsertAffiliate: v.literal("upsertAffiliate"),
+        removeAffiliate: v.literal("removeAffiliate"),
+        retentionStatus: v.literal("retentionStatus"),
+        setRetentionPolicy: v.literal("setRetentionPolicy"),
+        disableRetentionPolicy: v.literal("disableRetentionPolicy"),
     }),
     capabilities: v.array(federatedAnalyticsCapabilityValidator),
     limits: v.object({
@@ -110,14 +162,26 @@ export const federatedAnalyticsConnectionStatusValidator = v.object({
     status: v.literal("connected"),
     protocolVersion: v.literal(1),
     capabilities: v.array(federatedAnalyticsCapabilityValidator),
+    permissions: v.array(federatedAnalyticsPermissionValidator),
     siteCount: v.number(),
 });
+/**
+ * The permissions a request may act with: those the token claims that the
+ * host's grant also lists. Reading needs no listing — a grant is a read grant
+ * by definition — so the read permission is always present.
+ */
+export function effectiveFederatedPermissions(claimed, connection) {
+    const granted = new Set(connection.permissions ?? []);
+    return FEDERATED_ANALYTICS_PERMISSIONS.filter((permission) => permission === FEDERATED_ANALYTICS_READ_PERMISSION ||
+        (claimed.includes(permission) && granted.has(permission)));
+}
 export const federatedSiteSummaryValidator = v.object({
     siteId: v.string(),
     name: v.string(),
     currency: v.string(),
     timezone: v.union(v.string(), v.null()),
     cookieless: v.boolean(),
+    localDays: v.union(v.object({ timezone: v.string(), since: v.number() }), v.null()),
 });
 export function createFederatedAnalyticsManifest() {
     return {
@@ -134,7 +198,7 @@ export function createFederatedAnalyticsConnectionAuthorizer(options) {
     if (typeof options.resolveConnection !== "function") {
         throw new Error("Federated analytics connection resolver is required");
     }
-    return async (ctx, requestedSiteIds) => {
+    return async (ctx, requestedSiteIds, requiredPermission = FEDERATED_ANALYTICS_READ_PERMISSION) => {
         const identity = await ctx.auth.getUserIdentity();
         if (!identity) {
             fail(FEDERATED_ANALYTICS_ERROR_CODES.UNAUTHENTICATED, "Federated analytics authentication is required");
@@ -162,9 +226,18 @@ export function createFederatedAnalyticsConnectionAuthorizer(options) {
             connection.organizationId !== organizationId ||
             !isStringArray(connection.siteIds, MAX_CONNECTION_SITE_IDS) ||
             connection.siteIds.length === 0 ||
-            new Set(connection.siteIds).size !== connection.siteIds.length) {
+            new Set(connection.siteIds).size !== connection.siteIds.length ||
+            (connection.permissions !== undefined &&
+                !isPermissionList(connection.permissions))) {
             fail(FEDERATED_ANALYTICS_ERROR_CODES.CONNECTION_DENIED, "Federated analytics connection is not active");
         }
+        // The permission is settled before the site scope, so a read-only token
+        // probing a configuration function learns nothing about which sites the
+        // grant covers.
+        const effectivePermissions = effectiveFederatedPermissions(permissions, connection);
+        if (!effectivePermissions.includes(requiredPermission)) {
+            fail(FEDERATED_ANALYTICS_ERROR_CODES.CONFIGURE_FORBIDDEN, "Federated analytics configuration is not permitted");
+        }
         if (requestedSiteIds !== undefined) {
             if (requestedSiteIds.length === 0 ||
                 requestedSiteIds.length > MAX_REPORT_SITES ||
@@ -177,7 +250,7 @@ export function createFederatedAnalyticsConnectionAuthorizer(options) {
                 fail(FEDERATED_ANALYTICS_ERROR_CODES.SITE_DENIED, "Federated analytics site is not authorized");
             }
         }
-        return connection;
+        return { ...connection, effectivePermissions };
     };
 }
 function isBoundedClaim(value) {
@@ -190,6 +263,11 @@ function isStringArray(value, maximumLength) {
         value.length <= maximumLength &&
         value.every(isBoundedClaim));
 }
+function isPermissionList(value) {
+    return (Array.isArray(value) &&
+        value.length <= FEDERATED_ANALYTICS_PERMISSIONS.length &&
+        value.every((entry) => FEDERATED_ANALYTICS_PERMISSIONS.includes(entry)));
+}
 function fail(code, message) {
     throw new ConvexError({ code, message });
 }

package/dist/client/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/client/federation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,YAAY,EAAE,sBAAsB;IACpC,cAAc,EAAE,wBAAwB;IACxC,WAAW,EAAE,oBAAoB;CACzB,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;AAEpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,eAAe,EAAE,4BAA4B;IAC7C,eAAe,EAAE,4BAA4B;IAC7C,cAAc,EAAE,2BAA2B;IAC3C,iBAAiB,EAAE,8BAA8B;IACjD,aAAa,EAAE,0BAA0B;IACzC,WAAW,EAAE,wBAAwB;CAC7B,CAAC,CAAC;AAEZ,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;CACpB,CAAC,CAAC;AACZ,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC,MAAM,CAAC;IACrE,eAAe;IACf,UAAU;IACV,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,YAAY;IACZ,cAAc;CACN,CAAC,CAAC;AACZ,MAAM,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,sCAAsC;IACzC,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC,CAAC;AACZ,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,GAAG,yCAAyC;IAC5C,QAAQ;IACR,SAAS;CACD,CAAC,CAAC;AACZ,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,kBAAkB,EAAE,gBAAgB;IACpC,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,qBAAqB;IACzC,eAAe,EAAE,iBAAiB;IAClC,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,wBAAwB;IAClC,eAAe,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,kCAAkC;IAC7C,YAAY,EAAE,gCAAgC;IAC9C,MAAM,EAAE,0BAA0B;CAC1B,CAAC,CAAC;AAEZ,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AAmD3B,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACnD,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAC1B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EACrB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EACzB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EACrB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC3B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC3B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAClB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EACpB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EACvB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EACzB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,QAAQ,CAAC;IACpE,eAAe,EAAE,CAAC,CAAC,OAAO,CACxB,sCAAsC,CAAC,eAAe,CACvD;IACD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/B,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QACrC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC/C,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KAC9B,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;QACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,GAAG,sCAAsC;QACzC,SAAS,EAAE,EAAE,GAAG,sCAAsC,CAAC,SAAS,EAAE;QAClE,YAAY,EAAE,CAAC,GAAG,sCAAsC,CAAC,YAAY,CAAC;QACtE,MAAM,EAAE,EAAE,GAAG,sCAAsC,CAAC,MAAM,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,OAA4C;IAE5C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,KAAK,EACV,GAAkC,EAClC,gBAAoC,EACG,EAAE;QACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CACF,+BAA+B,CAAC,eAAe,EAC/C,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CACF,+BAA+B,CAAC,eAAe,EAC/C,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,QAAQ,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACrE,IACE,CAAC,cAAc,CAAC,YAAY,CAAC;YAC7B,CAAC,cAAc,CAAC,cAAc,CAAC;YAC/B,CAAC,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC;YAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAC1D,CAAC;YACD,IAAI,CACF,+BAA+B,CAAC,cAAc,EAC9C,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACtD,YAAY;YACZ,cAAc;YACd,QAAQ;SACT,CAAC,CAAC;QACH,IACE,CAAC,UAAU;YACX,UAAU,CAAC,SAAS,KAAK,SAAS;YAClC,UAAU,CAAC,YAAY,KAAK,YAAY;YACxC,UAAU,CAAC,cAAc,KAAK,cAAc;YAC5C,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;YAC3D,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,EAC9D,CAAC;YACD,IAAI,CACF,+BAA+B,CAAC,iBAAiB,EACjD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,gBAAgB,CAAC,MAAM,GAAG,gBAAgB;gBAC1C,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM;gBAC1D,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAC1D,CAAC;gBACD,IAAI,CACF,+BAA+B,CAAC,aAAa,EAC7C,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACnE,IAAI,CACF,+BAA+B,CAAC,WAAW,EAC3C,4CAA4C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,gBAAgB,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,aAAqB;IAErB,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,aAAa;QAC7B,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,IAAiC,EAAE,OAAe;IAC9D,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/client/federation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAGnC,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,YAAY,EAAE,sBAAsB;IACpC,cAAc,EAAE,wBAAwB;IACxC,WAAW,EAAE,oBAAoB;CACzB,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,mCAAmC,GAAG,gBAAgB,CAAC;AACpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,qBAAqB,CAAC;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,mCAAmC;IACnC,wCAAwC;CAChC,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,eAAe,EAAE,4BAA4B;IAC7C,eAAe,EAAE,4BAA4B;IAC7C,cAAc,EAAE,2BAA2B;IAC3C,iBAAiB,EAAE,8BAA8B;IACjD,aAAa,EAAE,0BAA0B;IACzC,WAAW,EAAE,wBAAwB;IACrC,mBAAmB,EAAE,gCAAgC;CAC7C,CAAC,CAAC;AAEZ,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;AACjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,WAAW,EAAE,aAAa;IAC1B,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;CACpB,CAAC,CAAC;AACZ,MAAM,CAAC,MAAM,yCAAyC,GAAG,MAAM,CAAC,MAAM,CAAC;IACrE,eAAe;IACf,UAAU;IACV,cAAc;IACd,UAAU;IACV,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,OAAO;IACP,SAAS;IACT,YAAY;IACZ,cAAc;CACN,CAAC,CAAC;AACZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,MAAM,CAAC,MAAM,CAAC;IACnE,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;IAClC,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,wBAAwB;CACxC,CAAC,CAAC;AACZ,MAAM,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,GAAG,sCAAsC;IACzC,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,GAAG,uCAAuC;CAClC,CAAC,CAAC;AACZ,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,GAAG,yCAAyC;IAC5C,QAAQ;IACR,SAAS;IACT,wEAAwE;IACxE,mEAAmE;IACnE,WAAW;IACX,WAAW;CACH,CAAC,CAAC;AACZ,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,kBAAkB,EAAE,gBAAgB;IACpC,qBAAqB,EAAE,uBAAuB;IAC9C,kBAAkB,EAAE,qBAAqB;IACzC,eAAe,EAAE,iBAAiB;IAClC,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,wBAAwB;IAClC,eAAe,EAAE,CAAC;IAClB,UAAU,EAAE,kBAAkB;IAC9B,SAAS,EAAE,kCAAkC;IAC7C,YAAY,EAAE,gCAAgC;IAC9C,MAAM,EAAE,0BAA0B;CAC1B,CAAC,CAAC;AAEZ,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,eAAe,GAAG,EAAE,CAAC;AA0E3B,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACnD,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAC1B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EACrB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EACzB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EACrB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC3B,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EACxB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAC3B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAClB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EACpB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EACvB,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EACzB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EACpB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EACtB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CACvB,CAAC;AACF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAC1D,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,EAC9C,CAAC,CAAC,OAAO,CAAC,wCAAwC,CAAC,CACpD,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,QAAQ,CAAC;IACpE,eAAe,EAAE,CAAC,CAAC,OAAO,CACxB,sCAAsC,CAAC,eAAe,CACvD;IACD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/B,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QACrC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACzC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC/C,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACnC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACjC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACnC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACvC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC7C,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;KAC5D,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;QACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qCAAqC,CAAC;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA0B,EAC1B,UAA6D;IAE7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,+BAA+B,CAAC,MAAM,CAC3C,CAAC,UAAU,EAAE,EAAE,CACb,UAAU,KAAK,mCAAmC;QAClD,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,KAAK,CAChB,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EACrD,CAAC,CAAC,IAAI,EAAE,CACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC;IAC9C,OAAO;QACL,GAAG,sCAAsC;QACzC,SAAS,EAAE,EAAE,GAAG,sCAAsC,CAAC,SAAS,EAAE;QAClE,YAAY,EAAE,CAAC,GAAG,sCAAsC,CAAC,YAAY,CAAC;QACtE,MAAM,EAAE,EAAE,GAAG,sCAAsC,CAAC,MAAM,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4CAA4C,CAC1D,OAA4C;IAE5C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,KAAK,EACV,GAAkC,EAClC,gBAAoC,EACpC,kBAAkB,GAAiC,mCAAmC,EACrC,EAAE;QACnD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CACF,+BAA+B,CAAC,eAAe,EAC/C,gDAAgD,CACjD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CACF,+BAA+B,CAAC,eAAe,EAC/C,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,QAAQ,CAAC,0BAA0B,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,WAAW,GAAG,QAAQ,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACrE,IACE,CAAC,cAAc,CAAC,YAAY,CAAC;YAC7B,CAAC,cAAc,CAAC,cAAc,CAAC;YAC/B,CAAC,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC;YAC5C,CAAC,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAC1D,CAAC;YACD,IAAI,CACF,+BAA+B,CAAC,cAAc,EAC9C,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE;YACtD,YAAY;YACZ,cAAc;YACd,QAAQ;SACT,CAAC,CAAC;QACH,IACE,CAAC,UAAU;YACX,UAAU,CAAC,SAAS,KAAK,SAAS;YAClC,UAAU,CAAC,YAAY,KAAK,YAAY;YACxC,UAAU,CAAC,cAAc,KAAK,cAAc;YAC5C,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC;YAC3D,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM;YAC9D,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;gBACnC,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAC5C,CAAC;YACD,IAAI,CACF,+BAA+B,CAAC,iBAAiB,EACjD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,gBAAgB;QAChB,MAAM,oBAAoB,GAAG,6BAA6B,CACxD,WAAW,EACX,UAAU,CACX,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACvD,IAAI,CACF,+BAA+B,CAAC,mBAAmB,EACnD,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAC7B,gBAAgB,CAAC,MAAM,GAAG,gBAAgB;gBAC1C,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,MAAM;gBAC1D,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,EAC1D,CAAC;gBACD,IAAI,CACF,+BAA+B,CAAC,aAAa,EAC7C,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACnE,IAAI,CACF,+BAA+B,CAAC,WAAW,EAC3C,4CAA4C,CAC7C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,UAAU,EAAE,oBAAoB,EAAE,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,gBAAgB,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,KAAc,EACd,aAAqB;IAErB,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,aAAa;QAC7B,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc;IAEd,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,KAAK,CAAC,MAAM,IAAI,+BAA+B,CAAC,MAAM;QACtD,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,+BAAqD,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvE,CACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,IAAiC,EAAE,OAAe;IAC9D,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3C,CAAC"}