@sanoma-ai/workflows 0.2.0 → 0.4.1

package/dist/cedar.d.ts

@@ -0,0 +1,87 @@
+import type { ResolvedConfig } from "./config.ts";
+import { type Policy } from "./policy.ts";
+import { type PeopleResource } from "./shared.ts";
+/** Where a company's policies are, under its root. */
+export declare const POLICIES_DIR = "policies";
+/** One policy, as loaded: its id, its text and where it is written, and the annotations Sanoma reads. */
+export interface CedarPolicySource {
+    /** Its `@id`, else `<file>#<n>`, counting from 1 in the order written. */
+    id: string;
+    text: string;
+    /** Relative to the root, such as `policies/money.cedar`. */
+    file: string;
+    /** The line and column its text starts at in `file`, from 1. */
+    line: number;
+    column: number;
+    effect: "permit" | "forbid";
+    /** `@hold(...)`: a declared group, a declared person's id, or `on-behalf-of`. */
+    hold?: string;
+    /** `@title(...)`: the Inbox title of its hold. */
+    title?: string;
+    /** `@reason(...)`: the message of its deny. */
+    reason?: string;
+}
+/** What is wrong in the policies, at a file, line and column when Cedar says where. */
+export interface PolicyProblem {
+    file?: string;
+    line?: number;
+    column?: number;
+    /** The policy's id, when the problem is in one. */
+    policy?: string;
+    message: string;
+}
+/** `<root>/policies/**\/*.cedar`, sorted by path, each relative to the root with `/` between its parts. */
+export declare function readPolicyFiles(root: string): {
+    file: string;
+    text: string;
+}[];
+/**
+ * Each file's policies, in the order written (`policySetTextToParts`, which sorts them, then
+ * their places in the text), each with its id and annotations (`policyToJson`): built once, the
+ * map from a policy's id to what decides its answer. A file that does not parse, a template and
+ * two policies with one id are problems.
+ */
+export declare function loadPolicies(files: readonly {
+    file: string;
+    text: string;
+}[]): {
+    policies: CedarPolicySource[];
+    problems: PolicyProblem[];
+};
+/**
+ * The policies checked against the schema of the resolved config (`validate`, strict), and what
+ * Cedar cannot check: a `permit` (the runtime's is the only one), and a `@hold` naming neither a
+ * declared group, nor a declared person, nor `on-behalf-of`. In the order written, each at its
+ * file, line and column, once per place: a policy scoped to every action fails the same way for each.
+ */
+export declare function validatePolicies(resolved: Pick<ResolvedConfig, "ops" | "workflows" | "collections">, policies: readonly CedarPolicySource[], people: readonly PeopleResource[]): PolicyProblem[];
+/**
+ * The policy a repo's Cedar files make, the runtime's `permit` added; its `version` a hash of the
+ * policies' ids and text. It decides each call with `statefulIsAuthorized`
+ * over the policy set and the schema of `resolved` (`schemaOf`), each parsed once:
+ *
+ * - allow: `allow`, with the policies that allowed as `reasons`;
+ * - deny, a determining `forbid` without `@hold`: `deny` with its `@reason`, or "Refused by <id>";
+ * - deny by `@hold` forbids only: each lifted once an approval addressed to its approver and
+ *   covering the operation is approved (`approvedFor`); allowed when all are, else `approve` for
+ *   the first, in the order written, with its `@title` and its id as `reasons`.
+ *
+ * An approver is a declared group (`{ group }`), a declared person's id, or the principal's
+ * `onBehalfOf`; a principal acting for no one makes `on-behalf-of` a deny, "cannot resolve
+ * approver". A policy that fails to evaluate is a deny naming it (Cedar would skip it), as is one
+ * reading a field a `before` lacks: a record saved under fields since changed is asked about
+ * without the schema, so it can still be fixed or deleted.
+ * `preview` asks the same ahead of a call, its context unknown; `start`, about a run's start.
+ */
+export declare function cedarPolicy(resolved: Pick<ResolvedConfig, "ops" | "workflows" | "collections">, policies: readonly CedarPolicySource[], people: readonly PeopleResource[]): Policy;
+/**
+ * The policy of the repo at `root`: its `policies/**\/*.cedar` over `resolved` and the people its
+ * data files declare (`readPeople`, `cedarPolicy`), or `allowAll` when it has none. With problems
+ * (`loadPolicies`, `validatePolicies`), each a printable line (`file:line:col: <policy id>:
+ * <message>`), a policy that refuses every call, start and preview naming the first: a repo never
+ * runs on part of its rules.
+ */
+export declare function policyAt(root: string | undefined, resolved: Pick<ResolvedConfig, "ops" | "workflows" | "collections">): {
+    policy: Policy;
+    problems: string[];
+};

package/dist/cedar.js

@@ -0,0 +1,365 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { locator } from "./ast.js";
+import { filesUnder } from "./paths.js";
+import { allow, allowAll, approve, approvedFor, deny, denyAll, } from "./policy.js";
+import { readPeople } from "./resources.js";
+import { cedarValue, cedarWasm, contextTypeOf, messageOf, NAMESPACE, schemaOf } from "./schema.js";
+import { approverLabel, approverOf, DATA_VENDOR, groupNamesOf, principalIdsOf, principalOf, problemLine, WORKFLOW_ACTION, } from "./shared.js";
+// A company's policies in Cedar (`policies/**/*.cedar`), decided with `@cedar-policy/cedar-wasm`
+// against the schema of its resolved config (`schemaOf`). Allow is the default: the runtime adds
+// the one `permit`, so a company's policies are `forbid`s, each a hold when it carries
+// `@hold(...)` and a deny otherwise.
+/** Where a company's policies are, under its root. */
+export const POLICIES_DIR = "policies";
+/** The runtime's own policy: allow whatever no `forbid` refuses. */
+const ALLOW_ID = "allow-by-default";
+const ALLOW = "permit (principal, action, resource);";
+/** The `@hold` that addresses the principal's `onBehalfOf`. */
+const ON_BEHALF_OF = "on-behalf-of";
+/** `<root>/policies/**\/*.cedar`, sorted by path, each relative to the root with `/` between its parts. */
+export function readPolicyFiles(root) {
+    return filesUnder(join(root, POLICIES_DIR), (name) => name.endsWith(".cedar")).map((path) => ({
+        file: relative(root, path).split(sep).join("/"),
+        text: readFileSync(path, "utf8"),
+    }));
+}
+/**
+ * Each file's policies, in the order written (`policySetTextToParts`, which sorts them, then
+ * their places in the text), each with its id and annotations (`policyToJson`): built once, the
+ * map from a policy's id to what decides its answer. A file that does not parse, a template and
+ * two policies with one id are problems.
+ */
+export function loadPolicies(files) {
+    const cedar = cedarWasm();
+    const policies = [];
+    const problems = [];
+    const ids = new Set([ALLOW_ID]);
+    for (const { file, text } of files) {
+        const locate = locator(text);
+        const parts = cedar.policySetTextToParts(text);
+        if (parts.type === "failure") {
+            problems.push(...parts.errors.map((e) => problemOf(e, file, text)));
+            continue;
+        }
+        for (const template of parts.policy_templates) {
+            problems.push({
+                file,
+                ...locate(text.indexOf(template)),
+                message: "a template (`?principal`, `?resource`) is not a policy: name the principal or resource",
+            });
+        }
+        const placed = new Set();
+        const inOrder = parts.policies
+            .map((part) => {
+            let offset = text.indexOf(part);
+            while (offset >= 0 && placed.has(offset))
+                offset = text.indexOf(part, offset + 1);
+            placed.add(offset);
+            // A part that is not a slice of the text (none is, as Cedar 4.14 cuts them) keeps Cedar's order, last.
+            return { part, offset: offset < 0 ? Infinity : offset };
+        })
+            .toSorted((a, b) => a.offset - b.offset);
+        inOrder.forEach(({ part, offset }, n) => {
+            const start = locate(Number.isFinite(offset) ? offset : 0);
+            const answer = cedar.policyToJson(part);
+            if (answer.type === "failure") {
+                problems.push(...answer.errors.map((e) => problemOf(e, file, part, start)));
+                return;
+            }
+            const { effect, annotations = {} } = answer.json;
+            const id = annotations.id ?? `${file}#${n + 1}`;
+            if (ids.has(id)) {
+                const whose = id === ALLOW_ID ? "the runtime's own policy's" : "another policy's";
+                problems.push({ file, line: start.line, message: `the id "${id}" is ${whose}: give this one another @id` });
+                return;
+            }
+            ids.add(id);
+            policies.push({
+                id,
+                text: part,
+                file,
+                ...start,
+                effect,
+                ...(annotations.hold !== undefined && { hold: annotations.hold }),
+                ...(annotations.title !== undefined && { title: annotations.title }),
+                ...(annotations.reason !== undefined && { reason: annotations.reason }),
+            });
+        });
+    }
+    return { policies, problems };
+}
+/**
+ * The policies checked against the schema of the resolved config (`validate`, strict), and what
+ * Cedar cannot check: a `permit` (the runtime's is the only one), and a `@hold` naming neither a
+ * declared group, nor a declared person, nor `on-behalf-of`. In the order written, each at its
+ * file, line and column, once per place: a policy scoped to every action fails the same way for each.
+ */
+export function validatePolicies(resolved, policies, people) {
+    const answer = cedarWasm().validate({
+        schema: schemaOf(resolved, people),
+        policies: { staticPolicies: Object.fromEntries(policies.map((p) => [p.id, p.text])) },
+        validationSettings: { mode: "strict" },
+    });
+    if (answer.type === "failure")
+        return answer.errors.map((e) => ({ message: messageOf(e) }));
+    return policies.flatMap((p) => {
+        const place = { file: p.file, line: p.line, policy: p.id };
+        const places = new Set();
+        const cedar = answer.validationErrors
+            .filter(({ policyId }) => policyId === p.id)
+            .map(({ error }) => ({ ...problemOf(error, p.file, p.text, p), policy: p.id }))
+            .filter(({ line, column }) => {
+            // Cedar's errors without a place are each their own.
+            if (column === undefined)
+                return true;
+            const at = `${line}:${column}`;
+            return !places.has(at) && Boolean(places.add(at));
+        })
+            .toSorted((a, b) => a.line - b.line || (a.column ?? 0) - (b.column ?? 0));
+        const ours = [];
+        if (p.effect === "permit") {
+            ours.push({ ...place, message: "a permit changes nothing: every call no forbid refuses is allowed already" });
+        }
+        else if (p.hold !== undefined && p.hold !== ON_BEHALF_OF && approverOf(p.hold, people) === undefined) {
+            ours.push({ ...place, message: `@hold("${p.hold}") names no declared group or person, nor "${ON_BEHALF_OF}"` });
+        }
+        return [...cedar, ...ours];
+    });
+}
+/**
+ * The policy a repo's Cedar files make, the runtime's `permit` added; its `version` a hash of the
+ * policies' ids and text. It decides each call with `statefulIsAuthorized`
+ * over the policy set and the schema of `resolved` (`schemaOf`), each parsed once:
+ *
+ * - allow: `allow`, with the policies that allowed as `reasons`;
+ * - deny, a determining `forbid` without `@hold`: `deny` with its `@reason`, or "Refused by <id>";
+ * - deny by `@hold` forbids only: each lifted once an approval addressed to its approver and
+ *   covering the operation is approved (`approvedFor`); allowed when all are, else `approve` for
+ *   the first, in the order written, with its `@title` and its id as `reasons`.
+ *
+ * An approver is a declared group (`{ group }`), a declared person's id, or the principal's
+ * `onBehalfOf`; a principal acting for no one makes `on-behalf-of` a deny, "cannot resolve
+ * approver". A policy that fails to evaluate is a deny naming it (Cedar would skip it), as is one
+ * reading a field a `before` lacks: a record saved under fields since changed is asked about
+ * without the schema, so it can still be fixed or deleted.
+ * `preview` asks the same ahead of a call, its context unknown; `start`, about a run's start.
+ */
+export function cedarPolicy(resolved, policies, people) {
+    const cedar = cedarWasm();
+    const schema = schemaOf(resolved, people);
+    const staticPolicies = { ...Object.fromEntries(policies.map((p) => [p.id, p.text])), [ALLOW_ID]: ALLOW };
+    const version = hash(staticPolicies);
+    // Cedar caches both per thread, by name: one for these policies over this schema.
+    const set = `sanoma-${hash({ staticPolicies, schema })}`;
+    for (const answer of [cedar.preparsePolicySet(set, { staticPolicies }), cedar.preparseSchema(set, schema)]) {
+        if (answer.type === "failure") {
+            throw new Error(`The Cedar policies do not parse: ${answer.errors.map(messageOf).join("; ")}`);
+        }
+    }
+    const directory = directoryOf(people);
+    /**
+     * The determining `forbid`s, in the order written, each with whom it holds for: the first that
+     * refuses (no `@hold`, else a hold for no one), or the holds.
+     */
+    const forbidsOf = (ids, principal) => {
+        const holds = policies
+            .filter((p) => p.effect === "forbid" && ids.includes(p.id))
+            .map((p) => ({ p, approver: p.hold === undefined ? undefined : holdOf(p.hold, principal, people) }));
+        const refusing = holds.find(({ p }) => p.hold === undefined) ?? holds.find(({ approver }) => !approver);
+        return { refusing: refusing?.p, holds };
+    };
+    /** What `request` is about: a workflow start on its `Workflow`, an operation on its target, in its collection for `data`. */
+    const requestOf = (principal, action, target, context) => {
+        const entities = directory.entities(principal);
+        let resource;
+        if (action.startsWith(WORKFLOW_ACTION)) {
+            resource = uid("Workflow", action.slice(WORKFLOW_ACTION.length));
+        }
+        else {
+            resource = uid("Target", target ?? action);
+            const op = resolved.ops.get(action);
+            const parents = op?.vendor === DATA_VENDOR ? [uid("Collection", op.resource)] : [];
+            entities.push({ uid: resource, attrs: {}, parents });
+        }
+        const type = contextTypeOf(schema, action);
+        return {
+            principal: uid("Principal", principal.id),
+            action: uid("Action", action),
+            resource,
+            context: (type ? cedarValue(context(Object.keys(type.attributes)), type) : {}),
+            entities,
+        };
+    };
+    /** May `actor` take `action` on `target` with `context`, given the run's `approvals` so far. */
+    const authorize = (actor, action, target, context, approvals) => {
+        const principal = directory.principal(actor);
+        const check = (asked) => cedar.statefulIsAuthorized({
+            ...requestOf(principal, action, target, () => asked),
+            preparsedSchemaName: set,
+            validateRequest: true,
+            preparsedPolicySetId: set,
+        });
+        let answer = check(context);
+        // A record saved under fields since changed does not fit the schema as `before`. When the rest
+        // of the call does, it is asked again without the schema (the context is plain values), the
+        // action's groups given as entities: a policy reading a field the record lacks fails, so denies.
+        const { before, ...rest } = context;
+        if (answer.type === "failure" && before !== undefined && check(rest).type === "success") {
+            const request = requestOf(principal, action, target, () => context);
+            const groups = schema[NAMESPACE]?.actions[action]?.memberOf ?? [];
+            request.entities.push({ uid: request.action, attrs: {}, parents: groups.map((g) => uid("Action", g.id)) });
+            answer = cedar.statefulIsAuthorized({ ...request, preparsedPolicySetId: set });
+        }
+        // A request the schema refuses (an input Cedar cannot hold) is denied, not an error of the call.
+        if (answer.type === "failure")
+            return deny(`The call does not fit the Cedar schema: ${answer.errors.map(messageOf).join("; ")}`);
+        const { decision, diagnostics } = answer.response;
+        const failed = diagnostics.errors[0];
+        if (failed)
+            return deny(`${failed.policyId} failed: ${messageOf(failed.error)}`, [failed.policyId]);
+        const reasons = diagnostics.reason;
+        if (decision === "allow")
+            return allow(reasons);
+        const { refusing, holds } = forbidsOf(reasons, principal);
+        if (refusing) {
+            return deny(refusing.hold === undefined ? (refusing.reason ?? `Refused by ${refusing.id}`) : "cannot resolve approver", reasons);
+        }
+        const waiting = holds.find(({ approver }) => !approvedFor(approvals, action, approver));
+        if (!waiting)
+            return allow(reasons);
+        const approver = waiting.approver;
+        const title = waiting.p.title ?? `${action} needs ${approverLabel(approver)}`;
+        return approve(approver, { title, reasons: [waiting.p.id] });
+    };
+    const decide = (call) => authorize(call.actor, call.op.id, call.target, { input: call.input, ...(call.before !== undefined && { before: call.before }) }, call.run.approvals);
+    const start = (actor, workflow, input, approvals = []) => authorize(actor, `${WORKFLOW_ACTION}${workflow}`, undefined, { input }, approvals);
+    const preview = (requests) => requests.map(({ principal: actor, action, resource }) => {
+        const principal = directory.principal(actor);
+        const answer = cedar.isAuthorizedPartial({
+            ...requestOf(principal, action.id, resource, unknown),
+            schema,
+            validateRequest: false,
+            policies: { staticPolicies },
+        });
+        if (answer.type === "failure")
+            throw new Error(answer.errors.map(messageOf).join("; "));
+        const { decision, mustBeDetermining, nontrivialResiduals, residuals } = answer.response;
+        if (decision === "allow")
+            return { answer: "allow" };
+        if (decision === "deny") {
+            const { refusing, holds } = forbidsOf(mustBeDetermining, principal);
+            const first = holds[0];
+            if (refusing || !first)
+                return { answer: "deny", ...(refusing && { rule: ruleOf(refusing) }) };
+            return { answer: "hold", rule: ruleOf(first.p), approver: first.approver };
+        }
+        // Undecided: a residual forbid whose conditions fold to false cannot apply.
+        const open = policies.find((p) => nontrivialResiduals.includes(p.id) && mayApply(residuals[p.id]));
+        return open ? { answer: "depends", rule: ruleOf(open) } : { answer: "allow" };
+    });
+    return Object.freeze(Object.assign(decide, { version, preview, start }));
+}
+/**
+ * The policy of the repo at `root`: its `policies/**\/*.cedar` over `resolved` and the people its
+ * data files declare (`readPeople`, `cedarPolicy`), or `allowAll` when it has none. With problems
+ * (`loadPolicies`, `validatePolicies`), each a printable line (`file:line:col: <policy id>:
+ * <message>`), a policy that refuses every call, start and preview naming the first: a repo never
+ * runs on part of its rules.
+ */
+export function policyAt(root, resolved) {
+    const files = root === undefined ? [] : readPolicyFiles(root);
+    if (!files.length)
+        return { policy: allowAll, problems: [] };
+    const { people } = readPeople(root);
+    const { policies, problems } = loadPolicies(files);
+    problems.push(...validatePolicies(resolved, policies, people));
+    if (!problems.length)
+        return { policy: cedarPolicy(resolved, policies, people), problems: [] };
+    const lines = problems.map(({ policy, ...p }) => problemLine({ ...p, message: policy ? `${policy}: ${p.message}` : p.message }));
+    return { policy: denyAll(`The policies do not hold: ${lines[0]}`), problems: lines };
+}
+/** A policy as a preview names it. */
+const ruleOf = (p) => ({
+    id: p.id,
+    file: p.file,
+    ...(p.title !== undefined && { title: p.title }),
+    ...(p.reason !== undefined && { reason: p.reason }),
+});
+/** The first 12 hex digits of a SHA-256 of `value` as JSON. */
+const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 12);
+const uid = (type, id) => ({ type: `${NAMESPACE}::${type}`, id });
+/** Every field of a context unknown: partial evaluation leaves what depends on it. */
+const unknown = (names) => Object.fromEntries(names.map((name) => [name, { __extn: { fn: "unknown", arg: name } }]));
+/** Whom `@hold(hold)` holds the call for, resolved for `principal`: undefined when it names no one. */
+const holdOf = (hold, principal, people) => hold === ON_BEHALF_OF ? principal.onBehalfOf : approverOf(hold, people);
+/** The people as Cedar entities, made once: each a `Principal` in its groups, with `onBehalfOf` when it acts for someone. */
+function directoryOf(people) {
+    const groups = new Set(groupNamesOf(people));
+    const principal = (actor) => {
+        // An admitted principal (`admit`) carries its groups as the files say now: those are taken as
+        // they are. One without groups is given those declared when the policy was made.
+        const declared = actor.groups === undefined ? principalOf(actor.id, people) : undefined;
+        const onBehalfOf = actor.onBehalfOf ?? declared?.onBehalfOf;
+        return {
+            ...actor,
+            groups: [...new Set([...(actor.groups ?? []), ...(declared?.groups ?? [])])],
+            ...(onBehalfOf !== undefined && { onBehalfOf }),
+        };
+    };
+    const entityOf = (p) => ({
+        uid: uid("Principal", p.id),
+        attrs: p.onBehalfOf === undefined ? {} : { onBehalfOf: { __entity: uid("Principal", p.onBehalfOf) } },
+        // Only the groups the schema enumerates: Cedar refuses any other.
+        parents: (p.groups ?? []).filter((g) => groups.has(g)).map((g) => uid("Group", g)),
+    });
+    const declared = new Map(principalIdsOf(people).map((id) => [id, entityOf(principal({ id }))]));
+    return {
+        principal,
+        entities: (actor) => {
+            const actingFor = actor.onBehalfOf === undefined || actor.onBehalfOf === actor.id ? undefined : declared.get(actor.onBehalfOf);
+            return [entityOf(actor), ...(actingFor ? [actingFor] : [])];
+        },
+    };
+}
+/** False when one of a residual policy's conditions is already decided against it. */
+const mayApply = ({ conditions }) => !conditions.some((c) => folded(c.body) === (c.kind === "unless"));
+/** A residual's value when its constants decide it, else undefined: partial evaluation leaves `unknown && false` as it is. */
+function folded(expr) {
+    const e = expr;
+    if ("Value" in e)
+        return typeof e.Value === "boolean" ? e.Value : undefined;
+    if (e["!"]) {
+        const arg = folded(e["!"].arg);
+        return arg === undefined ? undefined : !arg;
+    }
+    const pair = e["&&"] ?? e["||"];
+    if (pair) {
+        const and = e["&&"] !== undefined;
+        const [l, r] = [folded(pair.left), folded(pair.right)];
+        // `and`: false decides it, true twice makes it; `or`: the other way round.
+        if (l === !and || r === !and)
+            return !and;
+        return l === and && r === and ? and : undefined;
+    }
+    if (e["if-then-else"]) {
+        const { if: test, then, else: otherwise } = e["if-then-else"];
+        const t = folded(test);
+        return t === undefined ? undefined : folded(t ? then : otherwise);
+    }
+    return undefined;
+}
+/** A Cedar error in `text`, which starts at `start` in `file` (the file's start when it is the file), as a problem at its place. */
+function problemOf(error, file, text, start = { line: 1, column: 1 }) {
+    const byte = error.sourceLocations?.[0]?.start;
+    if (byte === undefined)
+        return { file, line: start.line, message: messageOf(error) };
+    // Cedar counts bytes; a line and column count characters.
+    const at = locator(text)(Buffer.from(text).subarray(0, byte).toString().length);
+    const place = at.line === 1
+        ? { line: start.line, column: start.column + at.column - 1 }
+        : { line: start.line + at.line - 1, column: at.column };
+    return { file, ...place, message: messageOf(error) };
+}
+//# sourceMappingURL=cedar.js.map

package/dist/cedar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cedar.js","sourceRoot":"","sources":["../src/cedar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGnC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EACJ,OAAO,GAKR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,YAAY,EAEZ,cAAc,EACd,WAAW,EACX,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,iGAAiG;AACjG,iGAAiG;AACjG,uFAAuF;AACvF,qCAAqC;AAErC,sDAAsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AA+BvC,oEAAoE;AACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,KAAK,GAAG,uCAAuC,CAAC;AAEtD,+DAA+D;AAC/D,MAAM,YAAY,GAAG,cAAc,CAAC;AAIpC,2GAA2G;AAC3G,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5F,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/C,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;KACjC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgD;IAI3E,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACjC,OAAO,EAAE,wFAAwF;aAClG,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,OAAO,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,uGAAuG;YACvG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC5E,OAAO;YACT,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YACjD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,kBAAkB,CAAC;gBAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,KAAK,6BAA6B,EAAE,CAAC,CAAC;gBAC5G,OAAO;YACT,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE;gBACF,IAAI,EAAE,IAAI;gBACV,IAAI;gBACJ,GAAG,KAAK;gBACR,MAAM;gBACN,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;gBACjE,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;gBACpE,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC;aACxE,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmE,EACnE,QAAsC,EACtC,MAAiC;IAEjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC;QAClC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAClC,QAAQ,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QACrF,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACvC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,gBAAgB;aAClC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;aAC3C,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;aAC9E,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;YAC3B,qDAAqD;YACrD,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC;aACD,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAK,GAAG,CAAC,CAAC,IAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,2EAA2E,EAAE,CAAC,CAAC;QAChH,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YACvG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,IAAI,8CAA8C,YAAY,GAAG,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CACzB,QAAmE,EACnE,QAAsC,EACtC,MAAiC;IAEjC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACrC,kFAAkF;IAClF,MAAM,GAAG,GAAG,UAAU,IAAI,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC3G,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEtC;;;OAGG;IACH,MAAM,SAAS,GAAG,CAAC,GAAsB,EAAE,SAAoB,EAAE,EAAE;QACjE,MAAM,KAAK,GAAG,QAAQ;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC,CAAC;IAEF,6HAA6H;IAC7H,MAAM,SAAS,GAAG,CAChB,SAAoB,EACpB,MAAc,EACd,MAA0B,EAC1B,OAAqD,EACrD,EAAE;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC;QACb,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,MAAM,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,EAAE,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC7B,QAAQ;YACR,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAmC;YAChH,QAAQ;SACT,CAAC;IACJ,CAAC,CAAC;IAEF,gGAAgG;IAChG,MAAM,SAAS,GAAG,CAChB,KAAgB,EAChB,MAAc,EACd,MAA0B,EAC1B,OAAgC,EAChC,SAAyC,EAC/B,EAAE;QACZ,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,CAAC,KAA8B,EAAE,EAAE,CAC/C,KAAK,CAAC,oBAAoB,CAAC;YACzB,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;YACpD,mBAAmB,EAAE,GAAG;YACxB,eAAe,EAAE,IAAI;YACrB,oBAAoB,EAAE,GAAG;SAC1B,CAAC,CAAC;QACL,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,+FAA+F;QAC/F,4FAA4F;QAC5F,iGAAiG;QACjG,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxF,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;YAClE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3G,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iGAAiG;QACjG,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAC3B,OAAO,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,YAAY,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;QACnC,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CACT,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,cAAc,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,yBAAyB,EAC1G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAS,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAS,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,UAAU,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAY,EAAE,CAC5C,SAAS,CACP,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,MAAM,EACX,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAChF,IAAI,CAAC,GAAG,CAAC,SAAS,CACnB,CAAC;IAEJ,MAAM,KAAK,GAAG,CAAC,KAAgB,EAAE,QAAgB,EAAE,KAAc,EAAE,SAAS,GAA6B,EAAE,EAAE,EAAE,CAC7G,SAAS,CAAC,KAAK,EAAE,GAAG,eAAe,GAAG,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,CAAC,QAAmC,EAAmB,EAAE,CACvE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC;YACvC,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC;YACrD,MAAM;YACN,eAAe,EAAE,KAAK;YACtB,QAAQ,EAAE,EAAE,cAAc,EAAE;SAC7B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxF,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACxF,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,QAAQ,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAS,EAAE,CAAC;QAC9E,CAAC;QACD,4EAA4E;QAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEL,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAwB,EACxB,QAAmE;IAEnE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAC9C,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAC/E,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,6BAA6B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvF,CAAC;AAED,sCAAsC;AACtC,MAAM,MAAM,GAAG,CAAC,CAAoB,EAAE,EAAE,CAAC,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACpD,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE/G,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,KAAK,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAClF,sFAAsF;AACtF,MAAM,OAAO,GAAG,CAAC,KAAe,EAAE,EAAE,CAClC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAE5F,uGAAuG;AACvG,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,SAAoB,EAAE,MAAiC,EAAwB,EAAE,CAC7G,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAS1E,6HAA6H;AAC7H,SAAS,WAAW,CAAC,MAAiC;IACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,KAAgB,EAAa,EAAE;QAChD,8FAA8F;QAC9F,iFAAiF;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,CAAC;QAC5D,OAAO;YACL,GAAG,KAAK;YACR,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,CAAY,EAAc,EAAE,CAAC,CAAC;QAC9C,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE;QACrG,kEAAkE;QAClE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,SAAS,GACb,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/G,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,QAAQ,GAAG,CAAC,EAAE,UAAU,EAAc,EAAW,EAAE,CACvD,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAIpE,8HAA8H;AAC9H,SAAS,MAAM,CAAC,IAAU;IACxB,MAAM,CAAC,GAAG,IAMT,CAAC;IACF,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;QAClC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,2EAA2E;QAC3E,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC;QAC1C,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oIAAoI;AACpI,SAAS,SAAS,CAChB,KAAoB,EACpB,IAAY,EACZ,IAAY,EACZ,KAAK,GAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;IAErC,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;IACrF,0DAA0D;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;IAChF,MAAM,KAAK,GACT,EAAE,CAAC,IAAI,KAAK,CAAC;QACX,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE;QAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/dist/client.d.ts

@@ -33,7 +33,7 @@ export interface RunSummary {
     runId: string;
     workflow: string;
     status: RunStatus;
-    /** Who started the run, as passed to `start`. */
+    /** Who started the run, as `start` admitted them. */
     startedBy?: Principal;
     createdAt: number;
     updatedAt?: number;
@@ -43,12 +43,17 @@ export interface RunSummary {
     sandbox?: string;
 }
 export interface StartOptions {
-    /** Recorded as the run's actor in the ledger and passed to the policy. */
-    startedBy: Principal;
+    /**
+     * Who starts it, by id (`"ada"`, or `{ id: "ada" }`): recorded as the run's actor in the ledger
+     * and passed to the policy. When the data files declare people, the run is started as the
+     * declared principal (`principalOf`: their groups, not any given here), and an id nobody
+     * declares is refused with `not_admitted`.
+     */
+    startedBy: Principal | string;
     /**
      * Use this run id instead of a new one, so a retried start makes one run. Starting an id
      * that exists returns it, without starting another, when the workflow, the input (compared
-     * as JSON), `startedBy` and `sandbox` are the same, and throws `invalid_input` naming what differs
+     * as JSON), `startedBy`'s id and `sandbox` are the same, and throws `invalid_input` naming what differs
      * when they are not. Of two starts racing with one new id, the first's run stands.
      */
     runId?: string;
@@ -59,6 +64,19 @@ export interface StartOptions {
      */
     sandbox?: string;
 }
+/** What `SanomaClient.call` takes besides the operation's id and its input. */
+export interface CallOptions {
+    /**
+     * Who calls, by id, admitted as `startedBy` is: the policy decides as them, a write's record
+     * names them, and a save's `updatedBy` is their id.
+     */
+    actor: Principal | string;
+    /**
+     * The call's id, so a retried write is made once: the same id with the same input returns what
+     * the first call returned, with another input is refused (`invalid_input`). A new one by default.
+     */
+    id?: string;
+}
 /** Talks to the runtime from another process (the app, a script), through the shared Postgres. */
 export declare class SanomaClient {
     private readonly dbos;
@@ -68,6 +86,8 @@ export declare class SanomaClient {
     private readonly audit;
     /** On the config's database, for the credentials table: opened on first use. */
     private readonly credentialsPool;
+    /** What a direct call's driver reads secrets from, as a worker's live driver does. */
+    private readonly storedSecrets;
     private constructor();
     /**
      * Connects to the runtime's Postgres for the config's app. Checks the config first and throws
@@ -82,6 +102,54 @@ export declare class SanomaClient {
      * `workflow` is a definition, or the name of one in the config's `workflows`.
      */
     start<S extends z.ZodType>(workflow: WorkflowDefinition<any, S> | string, input: z.input<S>, options: StartOptions): Promise<string>;
+    /**
+     * The policy's answer to starting a run of `workflow` as `startedBy` (`decideStart`), for a
+     * workflow of the config's own: a deny throws `policy_denied`; a hold is what the run waits on
+     * before its body. A run `runId` names already is returned as it is, whatever the policy says now.
+     */
+    private startHold;
+    /**
+     * Calls an operation directly, outside a run, as `actor`: one that may be (`isDirect`), a
+     * collection's or a vendor's read, never a vendor's write, the runtime's own or a resource
+     * type's (`invalid_input`, as is an unknown id or input its schema refuses). The policy decides
+     * it as the person, in a run `direct:<actor>:<id>` of the workflow `call` with no approvals. A
+     * deny throws `policy_denied` and writes nothing. An allowed call runs the driver once, without
+     * DBOS and without a retry (a driver's failure is `driver_failed`). A read returns its output
+     * and records nothing. A write is recorded as one `op.called` (seq 0) in that run, and with the
+     * default ledger in one transaction with the record it saves, so both are written or neither;
+     * a write with the same id and input returns the output recorded. When the policy asks for an
+     * approval, the call becomes run `call:<actor>:<id>` of the built-in `call` workflow, started
+     * as the person, which makes it once approved, and this throws `approval_pending` with its id.
+     */
+    call(opId: string, input: unknown, options: CallOptions): Promise<unknown>;
+    /**
+     * A direct write, made once and recorded once: with the default ledger, a collection's write
+     * and its record in one transaction on the database both are in, so both are kept or neither;
+     * otherwise the driver's call, then the record in the config's ledger. The first record of the
+     * call's id stands: a write that finds one already there (two calls with one id at once) is
+     * undone, and answers as `recordedCall` does.
+     */
+    private directWrite;
+    /**
+     * What the direct write recorded as `runId` returned, when one did: refused (`invalid_input`)
+     * when it was of another operation or input, and its failure again (`driver_failed`) when it failed.
+     */
+    private recordedCall;
+    /**
+     * What the held call's run `heldId` returned once it ended (its error, when it failed);
+     * `approval_pending` while it has not; undefined when there is no such run. Refused
+     * (`invalid_input`) when the run was started with another input or by someone else.
+     */
+    private heldCall;
+    /**
+     * The newest finished run of the workflow, with its output and when it finished; null when it
+     * has none. One query, whatever the app's runs.
+     */
+    latest(workflow: string): Promise<{
+        runId: string;
+        output: unknown;
+        at: number;
+    } | null>;
     /** The run's audit record, in order, from the ledger store. */
     ledger(runId: string): Promise<LedgerRecord[]>;
     /**
@@ -142,7 +210,8 @@ export declare class SanomaClient {
      * loads it into its environment, unless its environment sets the variable itself. Refuses
      * (`invalid_input`) a name no driver declares, and a value the variable's schema refuses, with
      * the schema's reason and never the value; an empty value too (`clearCredential` unsets one).
-     * Nothing records the value but its row, which records `by` and when.
+     * Nothing records the value but its row, which records `by` and when. `by` is admitted as
+     * `start`'s `startedBy` is (`not_admitted`).
      */
     setCredential(name: string, value: string, options: {
         by: string;
@@ -150,7 +219,7 @@ export declare class SanomaClient {
     /**
      * Deletes the stored value of a declared variable, and tells the workers, which unset it unless
      * their environment sets it. `by` is who asks; nothing records it once the row is gone.
-     * Refuses (`invalid_input`) a name no driver declares.
+     * Refuses (`invalid_input`) a name no driver declares, and `by` as `setCredential` does.
      */
     clearCredential(name: string, options: {
         by: string;
@@ -185,9 +254,18 @@ export declare class SanomaClient {
     private declared;
     /** The pool the credentials are read and written with, on the database once it is prepared. */
     private credentialsDb;
+    /**
+     * The principal as the data files declare it (`admit`): its id alone is taken, never the groups
+     * a caller gives, and an id nobody declares is `not_admitted`.
+     */
+    private admitted;
+    /** `options.by`, who sets or clears a credential, admitted (`admitted`): their id. */
+    private admittedBy;
     /** Refuses a run id whose run, as stored, was started with another input, by someone else, or in another sandbox. */
     private mustMatch;
-    /** The run's status row, read without its input (and its output, unless asked), or `run_not_found`. */
+    /** The run's status row, read without its input (and its output, unless asked), if there is one. */
+    private row;
+    /** The run's status row, as `row` reads it, or `run_not_found`. */
     private mustExist;
     /** The run's output once it ends, or its error, polled every 100 ms; `run_running` after `timeoutMs`. */
     private awaitResult;