@percher/shared 1.1.0 → 1.3.0

package/dist/data-records.d.ts

@@ -0,0 +1,359 @@
+/**
+ * The data-tools contract: the record shapes, limits, path patterns and
+ * error codes shared by the API records routes, the MCP data tools, the
+ * client and the Connections editor (spec:
+ * docs/plans/IMPLEMENTING_data-tools-connector.md, §3–§5, §8, §10 and §11).
+ *
+ * Record operations run as an identity of the app (§10): a chosen app user,
+ * a visitor, or full access (the PocketBase superuser) as an explicit per-app
+ * opt-in. A grant covers all apps or selected apps (§11).
+ *
+ * Everything a record route returns came from the app's own users. Record
+ * contents, validation maps and `currentUpdated` are untrusted diagnostics:
+ * they never reach a recovery prompt or any other instruction field.
+ */
+/** A collection name in a data-route path (spec §4.1, `COLLECTION_RE`). */
+export declare const DATA_COLLECTION_RE: RegExp;
+/** A record id in a data-route path (spec §4.1, `RECORD_ID_RE`). */
+export declare const DATA_RECORD_ID_RE: RegExp;
+/** Request, response and expression bounds (spec §3, §4.1, §4.2). */
+export declare const DATA_LIMITS: {
+    /** Request body, read as a capped stream. */
+    readonly bodyBytes: 262144;
+    /** Outward JSON, and every upstream body on decoded bytes before parsing. */
+    readonly responseBytes: 1048576;
+    readonly maxPage: 1000;
+    readonly maxPerPage: 100;
+    /** Each of `filter`, `sort` and `fields`. */
+    readonly expressionChars: 1024;
+    readonly filterMaxDepth: 16;
+    readonly filterMaxComparisons: 64;
+    /** Apps one grant's data access may list. */
+    readonly accessMaxApps: 50;
+    /** `GET /api/collections` paging for the schema route. */
+    readonly schemaPerPage: 200;
+    readonly schemaMaxPages: 10;
+    /** PocketBase's `DefaultSortExprLimit` (v0.40.5 `tools/search/provider.go:25`). */
+    readonly sortMaxItems: 8;
+    /** `duration` sent to PocketBase's impersonate endpoint. */
+    readonly actAsTokenSeconds: 900;
+    /** Upper bound on an impersonate token's in-memory cache life. */
+    readonly actAsCacheMaxSeconds: 600;
+    /** Picker candidates per page. */
+    readonly identityCandidatesPerPage: 20;
+};
+export declare const DATA_ACCESS_MODES: readonly ["read", "readwrite"];
+/** `read` allows GET and `POST …/query`; `readwrite` allows every data route. */
+export type DataAccessMode = (typeof DATA_ACCESS_MODES)[number];
+export declare const DATA_IDENTITY_KINDS: readonly ["user", "visitor", "superuser"];
+/**
+ * Who a connection acts as in one app (§10.2). There is no "unset" value:
+ * an absent identity is unset, so the empty state is never the widest one.
+ */
+export type DataIdentity = 
+/** A record of a non-system auth collection, both named by id. */
+{
+    kind: "user";
+    collectionId: string;
+    recordId: string;
+}
+/** No Authorization header: the app's public rules. */
+ | {
+    kind: "visitor";
+}
+/** Explicit per-app opt-in: bypasses the app's rules. */
+ | {
+    kind: "superuser";
+};
+/** An identity kind, or `unset` where no identity is stored (reads as a visitor, refuses writes). */
+export declare const DATA_ACTING_AS: readonly ["user", "visitor", "superuser", "unset"];
+export type DataActingAs = (typeof DATA_ACTING_AS)[number];
+export declare const DATA_ACCESS_SCOPES: readonly ["selected", "all"];
+export type DataAccessScope = (typeof DATA_ACCESS_SCOPES)[number];
+/**
+ * `oauth_grants.data_access` (§11.1); NULL means no access and the revision
+ * is its own column. An absent identity is unset: under `selected` only after
+ * migration 0176 rewrote an older row, under `all` for every app missing from
+ * `identities`.
+ */
+export type DataAccess = 
+/** 1..50 entries. */
+{
+    scope: "selected";
+    apps: {
+        id: string;
+        mode: DataAccessMode;
+        identity?: DataIdentity;
+    }[];
+}
+/** Covers current and future apps; 0..50 identities, `superuser` only per app. */
+ | {
+    scope: "all";
+    mode: DataAccessMode;
+    identities: {
+        id: string;
+        identity: DataIdentity;
+    }[];
+};
+/** The setter form of {@link DataAccess}: every `selected` entry carries an identity (§10.2). */
+export type DataAccessSet = {
+    scope: "selected";
+    apps: {
+        id: string;
+        mode: DataAccessMode;
+        identity: DataIdentity;
+    }[];
+} | {
+    scope: "all";
+    mode: DataAccessMode;
+    identities: {
+        id: string;
+        identity: DataIdentity;
+    }[];
+};
+/** Body of `POST /internal/oauth-grants/:grantId/data-access`; `null` clears. */
+export interface DataAccessUpdate {
+    userId: string;
+    access: DataAccessSet | null;
+}
+/** Body of `POST /internal/apps/:appId/data-token-access` (§10.2a); `null` is unset. */
+export interface DataTokenAccessUpdate {
+    userId: string;
+    identity: DataIdentity | null;
+}
+/**
+ * One `oauth_grant_data_access_outbox` row's payload (§11.5): identity
+ * classes only, never a record id, email or label. Under `all`, `apps` lists
+ * the apps with a chosen identity and may be empty. A payload without `v` is
+ * a pending notice from before the identity cut-over; the API decodes it with
+ * its own frozen copy of that shape (§10.10).
+ */
+export type DataAccessNoticePayload = {
+    v: 6;
+    grantId: string;
+    revision: number;
+    apps: {
+        name: string;
+        mode: DataAccessMode;
+        identity: DataActingAs;
+    }[];
+} & ({
+    scope: "selected";
+} | {
+    scope: "all";
+    mode: DataAccessMode;
+});
+/** One `app_data_token_access_outbox` row's payload (§10.2a); the mode is fixed. */
+export interface DataTokenAccessNoticePayload {
+    v: 6;
+    appId: string;
+    revision: number;
+    appName: string;
+    identity: DataActingAs;
+}
+export declare const DATA_NOT_RUNNING_REASONS: readonly ["sleeping", "suspended", "stopped", "not_deployed"];
+/** `extra.reason` on 503 `PB_NOT_RUNNING`. */
+export type DataNotRunningReason = (typeof DATA_NOT_RUNNING_REASONS)[number];
+/** One field in the schema projection; never rules or auth config. */
+export interface DataFieldSummary {
+    name: string;
+    type: string;
+    required: boolean;
+    hidden: boolean;
+    /** Select and relation fields only. */
+    options?: {
+        values?: string[];
+        maxSelect?: number;
+        collectionId?: string;
+    };
+}
+/** The five PocketBase collection rules, and `extra.op` on `PB_RULE_DENIED`. */
+export declare const DATA_RULE_OPS: readonly ["list", "view", "create", "update", "delete"];
+export type DataRuleOp = (typeof DATA_RULE_OPS)[number];
+/**
+ * A rule's class (§10.6): null → `superuser_only`, non-empty → `rule` (the
+ * result depends on the rule, not that it is allowed), empty → `public`.
+ * The rule text itself is never returned.
+ */
+export declare const DATA_RULE_CLASSES: readonly ["superuser_only", "rule", "public"];
+export type DataRuleClass = (typeof DATA_RULE_CLASSES)[number];
+export type DataCollectionAccess = Record<DataRuleOp, DataRuleClass>;
+/** One reachable collection in `GET /apps/:appRef/data/schema` (§10.6). */
+export interface DataCollectionSummary {
+    name: string;
+    type: "base" | "auth" | "view";
+    /** False for auth and view collections, and when create, update and delete are all `superuser_only` (unless acting as superuser). */
+    writable: boolean;
+    fields: DataFieldSummary[];
+    access: DataCollectionAccess;
+}
+/** Body of `GET /apps/:appRef/data/schema` (§10.6). */
+export interface DataSchemaResponse {
+    collections: DataCollectionSummary[];
+    actingAs: DataActingAs;
+    /** Collections whose five rules are all `superuser_only`, left out unless acting as superuser; never named. */
+    omittedByRules: number;
+}
+/** A record with hidden fields projected out. */
+export interface DataRecord {
+    id: string;
+    [field: string]: unknown;
+}
+export interface DataPaginatedRecords {
+    items: DataRecord[];
+    page: number;
+    perPage: number;
+    totalItems: number;
+    totalPages: number;
+}
+/** Body of `POST …/records/query`; unknown keys are rejected. */
+export interface DataQueryOptions {
+    filter?: string;
+    sort?: string;
+    page?: number;
+    perPage?: number;
+    fields?: string;
+}
+export interface DataCreateInput {
+    data: Record<string, unknown>;
+    /** A client-chosen id makes a retried create duplicate-detectable. */
+    id?: string;
+}
+export interface DataUpdateInput {
+    data: Record<string, unknown>;
+    /** Best-effort timestamp precondition, not a compare-and-swap (spec §4.4). */
+    ifUpdated?: string;
+}
+/** PocketBase's per-field validation map, carried as `extra.fields` on `PB_VALIDATION`. */
+export type DataValidationFields = Record<string, {
+    code: string;
+    message: string;
+}>;
+/** `extra` on 409 `PB_CONFLICT`. */
+export interface DataConflictExtra {
+    currentUpdated?: string;
+    reason?: "id_exists";
+}
+/** `superuser_only`: a null rule. `refused`: PocketBase refused a create without detail, never a claim that a rule caused it (§10.4). */
+export declare const DATA_RULE_DENIED_REASONS: readonly ["superuser_only", "refused"];
+export type DataRuleDeniedReason = (typeof DATA_RULE_DENIED_REASONS)[number];
+/** `extra` on 403 `PB_RULE_DENIED` (diagnostics only). */
+export interface DataRuleDeniedExtra {
+    op: DataRuleOp;
+    reason: DataRuleDeniedReason;
+}
+export declare const DATA_ACT_AS_UNAVAILABLE_REASONS: readonly ["identity_missing", "auth_rule", "token_rejected"];
+export type DataActAsUnavailableReason = (typeof DATA_ACT_AS_UNAVAILABLE_REASONS)[number];
+/** `extra` on 403 `DATA_ACT_AS_UNAVAILABLE` (§10.3; diagnostics only). */
+export interface DataActAsUnavailableExtra {
+    reason: DataActAsUnavailableReason;
+}
+/** Whose limiter refused: Percher's own, or the app's PocketBase rate limits (§10.4). */
+export declare const DATA_RATE_LIMIT_SOURCES: readonly ["percher", "app"];
+export type DataRateLimitSource = (typeof DATA_RATE_LIMIT_SOURCES)[number];
+/**
+ * `extra` on 429 `DATA_RATE_LIMITED`; a server from before the identity
+ * cut-over sends no `source`. Both fields are diagnostics: no value here ever
+ * reaches a prompt.
+ */
+export interface DataRateLimitedExtra {
+    source?: DataRateLimitSource;
+    /** Seconds until Percher's own limiter admits the call again. */
+    retryAfterSec?: number;
+}
+/** Every error code a data-records route returns, with its HTTP status (spec §4.5, §10.5). */
+export declare const DATA_RECORD_ERROR_STATUS: {
+    readonly PB_VERSION_UNSUPPORTED: 503;
+    readonly PB_RECORD_NOT_FOUND: 404;
+    readonly PB_VALIDATION: 400;
+    readonly PB_CONFLICT: 409;
+    readonly PB_CONFLICT_UNSUPPORTED: 400;
+    readonly DATA_COLLECTION_FORBIDDEN: 403;
+    readonly DATA_FIELD_UNSUPPORTED: 400;
+    readonly DATA_RATE_LIMITED: 429;
+    readonly DATA_RESPONSE_TOO_LARGE: 413;
+    readonly OAUTH_DATA_ACCESS_REQUIRED: 403;
+    readonly DATA_TOOLS_NOT_ENABLED: 403;
+    readonly PB_AUTH_FAILED: 503;
+    readonly PB_NOT_RUNNING: 503;
+    readonly PB_BRIDGE_UNAVAILABLE: 502;
+    readonly NOT_POCKETBASE: 400;
+    /** A filter, sort or fields rejection; `extra` is a `DataQueryInvalidExtra` (diagnostics only). */
+    readonly DATA_QUERY_INVALID: 400;
+    /** The schema route hit its page ceiling. */
+    readonly DATA_SCHEMA_TOO_LARGE: 413;
+    /** A read or query passed its deadline. */
+    readonly DATA_QUERY_TIMEOUT: 504;
+    /** A write timed out or its reply was oversize: it may have completed. Never replayed. */
+    readonly DATA_WRITE_OUTCOME_UNKNOWN: 502;
+    /** The app's rules refused the identity; `extra` is a `DataRuleDeniedExtra`. */
+    readonly PB_RULE_DENIED: 403;
+    /** A write under an unset identity, refused before PocketBase is called. */
+    readonly DATA_ACT_AS_REQUIRED: 403;
+    /** The chosen app user cannot be acted as; `extra` is a `DataActAsUnavailableExtra`. Never falls back. */
+    readonly DATA_ACT_AS_UNAVAILABLE: 403;
+};
+export type DataRecordErrorCode = keyof typeof DATA_RECORD_ERROR_STATUS;
+/** The card, editor and email text for each state (§10.7). */
+export declare const DATA_IDENTITY_LABELS: Readonly<Record<DataActingAs, string>>;
+/** Who an owner's API tokens act as in one app (§10.2a); `null` is unset. */
+export interface DataTokenAccessRow {
+    appId: string;
+    identity: DataIdentity | null;
+}
+/**
+ * The fields `GET /account/oauth-grants` returns beside `grants` (§11.7):
+ * the user's app ids on the activation gate, and one token-access row per app
+ * that has one (an app without a row is unset).
+ */
+export interface OAuthGrantsDataTools {
+    dataToolsApps: string[];
+    dataTokenAccess: DataTokenAccessRow[];
+}
+/** Field types a picker label may come from (§10.9); never email, password or token key. */
+export declare const DATA_IDENTITY_LABEL_FIELD_TYPES: readonly ["text", "number", "select"];
+export type DataIdentityLabelFieldType = (typeof DATA_IDENTITY_LABEL_FIELD_TYPES)[number];
+/** Body of `POST /internal/apps/:appId/data/identity-candidates` (§10.9). */
+export interface DataIdentityCandidatesRequest {
+    userId: string;
+    collectionId?: string;
+    displayField?: string;
+    q?: string;
+    page?: number;
+}
+/** One non-system auth collection the picker offers, with its label-eligible fields. */
+export interface DataIdentityCollection {
+    id: string;
+    name: string;
+    fields: {
+        name: string;
+        type: DataIdentityLabelFieldType;
+    }[];
+}
+/**
+ * Reply of the picker route (§10.9). `candidates` (≤ 20) and `ownerMatch`
+ * belong to the requested `collectionId` and are empty/null without one.
+ * There is no `omittedByRules` here: that count is the schema reply's (§10.6).
+ */
+export interface DataIdentityCandidatesResponse {
+    collections: DataIdentityCollection[];
+    candidates: {
+        id: string;
+        label: string;
+    }[];
+    /** The record whose `email` is the owner's verified Percher email AND whose `verified` is true. */
+    ownerMatch: string | null;
+    rulesLockAll: boolean;
+}
+/**
+ * Refusals the two access setters may name to the dashboard (§3, §10.2,
+ * §10.2a); any other refusal is reported by status. A failed identity lookup
+ * is not named: §10.2 gives it no code.
+ */
+export declare const DATA_ACCESS_SETTER_ERROR_STATUS: {
+    readonly DATA_TOOLS_NOT_ENABLED: 403;
+    /** A changed identity on an app that is not running. */
+    readonly PB_NOT_RUNNING: 503;
+};
+export type DataAccessSetterErrorCode = keyof typeof DATA_ACCESS_SETTER_ERROR_STATUS;
+//# sourceMappingURL=data-records.d.ts.map

package/dist/data-records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-records.d.ts","sourceRoot":"","sources":["../src/data-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,QAAiC,CAAC;AAEjE,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,QAA0B,CAAC;AAEzD,qEAAqE;AACrE,eAAO,MAAM,WAAW;IACtB,6CAA6C;aAC7C,SAAS,EAAE,MAAO;IAClB,6EAA6E;aAC7E,aAAa,EAAE,OAAS;aACxB,OAAO,EAAE,IAAI;aACb,UAAU,EAAE,GAAG;IACf,6CAA6C;aAC7C,eAAe,EAAE,IAAI;aACrB,cAAc,EAAE,EAAE;aAClB,oBAAoB,EAAE,EAAE;IACxB,6CAA6C;aAC7C,aAAa,EAAE,EAAE;IACjB,0DAA0D;aAC1D,aAAa,EAAE,GAAG;aAClB,cAAc,EAAE,EAAE;IAClB,mFAAmF;aACnF,YAAY,EAAE,CAAC;IACf,4DAA4D;aAC5D,iBAAiB,EAAE,GAAG;IACtB,kEAAkE;aAClE,oBAAoB,EAAE,GAAG;IACzB,kCAAkC;aAClC,yBAAyB,EAAE,EAAE;CACrB,CAAC;AAEX,eAAO,MAAM,iBAAiB,YAAI,MAAM,EAAE,WAAW,CAAU,CAAC;AAChE,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB,YAAI,MAAM,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,YAAY;AACtB,kEAAkE;AAChE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,uDAAuD;GACrD;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE;AACrB,yDAAyD;GACvD;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE1B,qGAAqG;AACrG,eAAO,MAAM,cAAc,oDAA6C,CAAC;AACzE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,eAAO,MAAM,kBAAkB,YAAI,UAAU,EAAE,KAAK,CAAU,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,MAAM,UAAU;AACpB,qBAAqB;AACnB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,EAAE,CAAA;CAAE;AAC9F,kFAAkF;GAChF;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC;AAEjG,iGAAiG;AACjG,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,EAAE,CAAA;CAAE,GAC3F;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC;AAEjG,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;CAC9B;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAA;KAAE,EAAE,CAAC;CACxE,GAAG,CAAC;IAAE,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAAC;AAErE,oFAAoF;AACpF,MAAM,WAAW,4BAA4B;IAC3C,CAAC,EAAE,CAAC,CAAC;IACL,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,eAAO,MAAM,wBAAwB,YACnC,UAAU,EACV,WAAW,EACX,SAAS,EACT,cAAc,CACN,CAAC;AACX,8CAA8C;AAC9C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,sEAAsE;AACtE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,uCAAuC;IACvC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5E;AAED,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AACrF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,YAAI,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAErE,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,qIAAqI;IACrI,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,QAAQ,EAAE,YAAY,CAAC;IACvB,+GAA+G;IAC/G,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,sEAAsE;IACtE,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2FAA2F;AAC3F,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAErF,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,yIAAyI;AACzI,eAAO,MAAM,wBAAwB,YAAI,gBAAgB,EAAE,SAAS,CAAU,CAAC;AAC/E,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,UAAU,CAAC;IACf,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,eAAO,MAAM,+BAA+B,YAC1C,kBAAkB,EAClB,WAAW,EACX,gBAAgB,CACR,CAAC;AACX,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1F,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,0BAA0B,CAAC;CACpC;AAED,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,YAAI,SAAS,EAAE,KAAK,CAAU,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB;aACnC,sBAAsB,EAAE,GAAG;aAC3B,mBAAmB,EAAE,GAAG;aACxB,aAAa,EAAE,GAAG;aAClB,WAAW,EAAE,GAAG;aAChB,uBAAuB,EAAE,GAAG;aAC5B,yBAAyB,EAAE,GAAG;aAC9B,sBAAsB,EAAE,GAAG;aAC3B,iBAAiB,EAAE,GAAG;aACtB,uBAAuB,EAAE,GAAG;aAC5B,0BAA0B,EAAE,GAAG;aAC/B,sBAAsB,EAAE,GAAG;aAC3B,cAAc,EAAE,GAAG;aACnB,cAAc,EAAE,GAAG;aACnB,qBAAqB,EAAE,GAAG;aAC1B,cAAc,EAAE,GAAG;IACnB,mGAAmG;aACnG,kBAAkB,EAAE,GAAG;IACvB,6CAA6C;aAC7C,qBAAqB,EAAE,GAAG;IAC1B,2CAA2C;aAC3C,kBAAkB,EAAE,GAAG;IACvB,0FAA0F;aAC1F,0BAA0B,EAAE,GAAG;IAC/B,gFAAgF;aAChF,cAAc,EAAE,GAAG;IACnB,4EAA4E;aAC5E,oBAAoB,EAAE,GAAG;IACzB,0GAA0G;aAC1G,uBAAuB,EAAE,GAAG;CACpB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,wBAAwB,CAAC;AAExE,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAKvE,CAAC;AAOF,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,4FAA4F;AAC5F,eAAO,MAAM,+BAA+B,YAAI,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AACrF,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1F,6EAA6E;AAC7E,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,0BAA0B,CAAA;KAAE,EAAE,CAAC;CAC9D;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACtC,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,mGAAmG;IACnG,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;aAC1C,sBAAsB,EAAE,GAAG;IAC3B,wDAAwD;aACxD,cAAc,EAAE,GAAG;CACX,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,MAAM,OAAO,+BAA+B,CAAC"}

package/dist/data-records.js

@@ -0,0 +1,124 @@
+/**
+ * The data-tools contract: the record shapes, limits, path patterns and
+ * error codes shared by the API records routes, the MCP data tools, the
+ * client and the Connections editor (spec:
+ * docs/plans/IMPLEMENTING_data-tools-connector.md, §3–§5, §8, §10 and §11).
+ *
+ * Record operations run as an identity of the app (§10): a chosen app user,
+ * a visitor, or full access (the PocketBase superuser) as an explicit per-app
+ * opt-in. A grant covers all apps or selected apps (§11).
+ *
+ * Everything a record route returns came from the app's own users. Record
+ * contents, validation maps and `currentUpdated` are untrusted diagnostics:
+ * they never reach a recovery prompt or any other instruction field.
+ */
+/** A collection name in a data-route path (spec §4.1, `COLLECTION_RE`). */
+export const DATA_COLLECTION_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+/** A record id in a data-route path (spec §4.1, `RECORD_ID_RE`). */
+export const DATA_RECORD_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+/** Request, response and expression bounds (spec §3, §4.1, §4.2). */
+export const DATA_LIMITS = {
+    /** Request body, read as a capped stream. */
+    bodyBytes: 262_144,
+    /** Outward JSON, and every upstream body on decoded bytes before parsing. */
+    responseBytes: 1_048_576,
+    maxPage: 1000,
+    maxPerPage: 100,
+    /** Each of `filter`, `sort` and `fields`. */
+    expressionChars: 1024,
+    filterMaxDepth: 16,
+    filterMaxComparisons: 64,
+    /** Apps one grant's data access may list. */
+    accessMaxApps: 50,
+    /** `GET /api/collections` paging for the schema route. */
+    schemaPerPage: 200,
+    schemaMaxPages: 10,
+    /** PocketBase's `DefaultSortExprLimit` (v0.40.5 `tools/search/provider.go:25`). */
+    sortMaxItems: 8,
+    /** `duration` sent to PocketBase's impersonate endpoint. */
+    actAsTokenSeconds: 900,
+    /** Upper bound on an impersonate token's in-memory cache life. */
+    actAsCacheMaxSeconds: 600,
+    /** Picker candidates per page. */
+    identityCandidatesPerPage: 20,
+};
+export const DATA_ACCESS_MODES = ["read", "readwrite"];
+export const DATA_IDENTITY_KINDS = ["user", "visitor", "superuser"];
+/** An identity kind, or `unset` where no identity is stored (reads as a visitor, refuses writes). */
+export const DATA_ACTING_AS = [...DATA_IDENTITY_KINDS, "unset"];
+export const DATA_ACCESS_SCOPES = ["selected", "all"];
+export const DATA_NOT_RUNNING_REASONS = [
+    "sleeping",
+    "suspended",
+    "stopped",
+    "not_deployed",
+];
+/** The five PocketBase collection rules, and `extra.op` on `PB_RULE_DENIED`. */
+export const DATA_RULE_OPS = ["list", "view", "create", "update", "delete"];
+/**
+ * A rule's class (§10.6): null → `superuser_only`, non-empty → `rule` (the
+ * result depends on the rule, not that it is allowed), empty → `public`.
+ * The rule text itself is never returned.
+ */
+export const DATA_RULE_CLASSES = ["superuser_only", "rule", "public"];
+/** `superuser_only`: a null rule. `refused`: PocketBase refused a create without detail, never a claim that a rule caused it (§10.4). */
+export const DATA_RULE_DENIED_REASONS = ["superuser_only", "refused"];
+export const DATA_ACT_AS_UNAVAILABLE_REASONS = [
+    "identity_missing",
+    "auth_rule",
+    "token_rejected",
+];
+/** Whose limiter refused: Percher's own, or the app's PocketBase rate limits (§10.4). */
+export const DATA_RATE_LIMIT_SOURCES = ["percher", "app"];
+/** Every error code a data-records route returns, with its HTTP status (spec §4.5, §10.5). */
+export const DATA_RECORD_ERROR_STATUS = {
+    PB_VERSION_UNSUPPORTED: 503,
+    PB_RECORD_NOT_FOUND: 404,
+    PB_VALIDATION: 400,
+    PB_CONFLICT: 409,
+    PB_CONFLICT_UNSUPPORTED: 400,
+    DATA_COLLECTION_FORBIDDEN: 403,
+    DATA_FIELD_UNSUPPORTED: 400,
+    DATA_RATE_LIMITED: 429,
+    DATA_RESPONSE_TOO_LARGE: 413,
+    OAUTH_DATA_ACCESS_REQUIRED: 403,
+    DATA_TOOLS_NOT_ENABLED: 403,
+    PB_AUTH_FAILED: 503,
+    PB_NOT_RUNNING: 503,
+    PB_BRIDGE_UNAVAILABLE: 502,
+    NOT_POCKETBASE: 400,
+    /** A filter, sort or fields rejection; `extra` is a `DataQueryInvalidExtra` (diagnostics only). */
+    DATA_QUERY_INVALID: 400,
+    /** The schema route hit its page ceiling. */
+    DATA_SCHEMA_TOO_LARGE: 413,
+    /** A read or query passed its deadline. */
+    DATA_QUERY_TIMEOUT: 504,
+    /** A write timed out or its reply was oversize: it may have completed. Never replayed. */
+    DATA_WRITE_OUTCOME_UNKNOWN: 502,
+    /** The app's rules refused the identity; `extra` is a `DataRuleDeniedExtra`. */
+    PB_RULE_DENIED: 403,
+    /** A write under an unset identity, refused before PocketBase is called. */
+    DATA_ACT_AS_REQUIRED: 403,
+    /** The chosen app user cannot be acted as; `extra` is a `DataActAsUnavailableExtra`. Never falls back. */
+    DATA_ACT_AS_UNAVAILABLE: 403,
+};
+/** The card, editor and email text for each state (§10.7). */
+export const DATA_IDENTITY_LABELS = {
+    user: "Acts as the app user you chose. The app's own access rules apply.",
+    visitor: "Acts as a visitor who is not signed in. The app's own access rules apply.",
+    superuser: "Full access. Bypasses the app's own access rules.",
+    unset: "Reads as a visitor. Choose an app user to allow changes.",
+};
+/** Field types a picker label may come from (§10.9); never email, password or token key. */
+export const DATA_IDENTITY_LABEL_FIELD_TYPES = ["text", "number", "select"];
+/**
+ * Refusals the two access setters may name to the dashboard (§3, §10.2,
+ * §10.2a); any other refusal is reported by status. A failed identity lookup
+ * is not named: §10.2 gives it no code.
+ */
+export const DATA_ACCESS_SETTER_ERROR_STATUS = {
+    DATA_TOOLS_NOT_ENABLED: 403,
+    /** A changed identity on an app that is not running. */
+    PB_NOT_RUNNING: 503,
+};
+//# sourceMappingURL=data-records.js.map

package/dist/data-records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-records.js","sourceRoot":"","sources":["../src/data-records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAEjE,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAEzD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,6CAA6C;IAC7C,SAAS,EAAE,OAAO;IAClB,6EAA6E;IAC7E,aAAa,EAAE,SAAS;IACxB,OAAO,EAAE,IAAI;IACb,UAAU,EAAE,GAAG;IACf,6CAA6C;IAC7C,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,EAAE;IAClB,oBAAoB,EAAE,EAAE;IACxB,6CAA6C;IAC7C,aAAa,EAAE,EAAE;IACjB,0DAA0D;IAC1D,aAAa,EAAE,GAAG;IAClB,cAAc,EAAE,EAAE;IAClB,mFAAmF;IACnF,YAAY,EAAE,CAAC;IACf,4DAA4D;IAC5D,iBAAiB,EAAE,GAAG;IACtB,kEAAkE;IAClE,oBAAoB,EAAE,GAAG;IACzB,kCAAkC;IAClC,yBAAyB,EAAE,EAAE;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,WAAW,CAAU,CAAC;AAIhE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAU,CAAC;AAc7E,qGAAqG;AACrG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,mBAAmB,EAAE,OAAO,CAAU,CAAC;AAGzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAC;AAuD/D,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,UAAU;IACV,WAAW;IACX,SAAS;IACT,cAAc;CACN,CAAC;AAcX,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGrF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAmE/E,yIAAyI;AACzI,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAU,CAAC;AAS/E,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,kBAAkB;IAClB,WAAW;IACX,gBAAgB;CACR,CAAC;AAQX,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;AAcnE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sBAAsB,EAAE,GAAG;IAC3B,mBAAmB,EAAE,GAAG;IACxB,aAAa,EAAE,GAAG;IAClB,WAAW,EAAE,GAAG;IAChB,uBAAuB,EAAE,GAAG;IAC5B,yBAAyB,EAAE,GAAG;IAC9B,sBAAsB,EAAE,GAAG;IAC3B,iBAAiB,EAAE,GAAG;IACtB,uBAAuB,EAAE,GAAG;IAC5B,0BAA0B,EAAE,GAAG;IAC/B,sBAAsB,EAAE,GAAG;IAC3B,cAAc,EAAE,GAAG;IACnB,cAAc,EAAE,GAAG;IACnB,qBAAqB,EAAE,GAAG;IAC1B,cAAc,EAAE,GAAG;IACnB,mGAAmG;IACnG,kBAAkB,EAAE,GAAG;IACvB,6CAA6C;IAC7C,qBAAqB,EAAE,GAAG;IAC1B,2CAA2C;IAC3C,kBAAkB,EAAE,GAAG;IACvB,0FAA0F;IAC1F,0BAA0B,EAAE,GAAG;IAC/B,gFAAgF;IAChF,cAAc,EAAE,GAAG;IACnB,4EAA4E;IAC5E,oBAAoB,EAAE,GAAG;IACzB,0GAA0G;IAC1G,uBAAuB,EAAE,GAAG;CACpB,CAAC;AAGX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAA2C;IAC1E,IAAI,EAAE,mEAAmE;IACzE,OAAO,EAAE,2EAA2E;IACpF,SAAS,EAAE,mDAAmD;IAC9D,KAAK,EAAE,0DAA0D;CAClE,CAAC;AAuBF,4FAA4F;AAC5F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAgCrF;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,sBAAsB,EAAE,GAAG;IAC3B,wDAAwD;IACxD,cAAc,EAAE,GAAG;CACX,CAAC"}

package/dist/deployment-security.d.ts

@@ -0,0 +1,32 @@
+/** Durable publication decision. Scanner strings are diagnostic data, never instructions. */
+export type SecurityScanFailureCode = "SCANNER_UNAVAILABLE" | "SCANNER_ENGINE_DEGRADED" | "SCANNER_DATABASE_ERROR" | "KEV_CATALOG_STALE" | "IMMUTABLE_SOURCE_UNAVAILABLE" | "IMMUTABLE_SOURCE_CHANGED" | "SCAN_EVIDENCE_UNAVAILABLE" | "SCANNER_EXECUTION_ERROR";
+export type DeploymentSecurityAction = "retry_scan" | "update_dependency" | "wait_for_platform_fix";
+export interface DeploymentSecurityFinding {
+    cve: string;
+    component: string;
+    version: string | null;
+    fixedIn: string | null;
+    severity: "Critical" | "High" | "Medium" | "Low";
+    exploitedKev: boolean;
+    responsibility: "user" | "percher";
+}
+export interface DeploymentSecurityBlock {
+    version: 1;
+    context?: "automatic_rollback";
+    reason: "vulnerability" | "scan_unavailable";
+    imageId: string | null;
+    actions: DeploymentSecurityAction[];
+    findings: DeploymentSecurityFinding[];
+    totalFindings: number;
+    truncated: boolean;
+    scanFailureCode?: SecurityScanFailureCode;
+}
+export declare function deploymentSecurityActionText(action: DeploymentSecurityAction, context?: "automatic_rollback"): string;
+/** Fixed authored text only; never interpolate scanner-supplied values here. */
+export declare function deploymentSecuritySummary(block: DeploymentSecurityBlock): string;
+/** Fixed recovery instructions; scanner diagnostics never enter this channel. */
+export declare function deploymentSecurityRecoveryPrompt(block: Pick<DeploymentSecurityBlock, "reason" | "context">): string;
+/** Validate persisted/wire data without turning it into a recovery instruction. */
+export declare function parseDeploymentSecurityBlock(value: unknown): DeploymentSecurityBlock | null;
+export declare function decodeDeploymentSecurityBlock(json: string | null | undefined): DeploymentSecurityBlock | null;
+//# sourceMappingURL=deployment-security.d.ts.map

package/dist/deployment-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-security.d.ts","sourceRoot":"","sources":["../src/deployment-security.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,MAAM,MAAM,uBAAuB,GAC/B,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,mBAAmB,GACnB,8BAA8B,GAC9B,0BAA0B,GAC1B,2BAA2B,GAC3B,yBAAyB,CAAC;AAE9B,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AAEpG,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,eAAe,GAAG,kBAAkB,CAAC;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,CAAC,EAAE,uBAAuB,CAAC;CAC3C;AAaD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,wBAAwB,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAWR;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAUhF;AAED,iFAAiF;AACjF,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,SAAS,CAAC,GACzD,MAAM,CASR;AAYD,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAiG3F;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,uBAAuB,GAAG,IAAI,CAOhC"}