ekwo-os 0.4.1

package/dist/doctor.js

@@ -0,0 +1,448 @@
+/**
+ * `ekwo doctor` — the checks worth running on a live installation.
+ *
+ * Each one is something that is true of a healthy database and that nothing
+ * in the schema can enforce on its own: a table someone added without row
+ * level security, a migration that never landed, a membership row pointing at
+ * a user who has since been deleted, a bank statement whose declared closing
+ * balance does not match its lines.
+ *
+ * The doctor reads and reports. It never repairs: the fix for a missing
+ * policy is a migration, and the fix for an orphaned membership is a decision
+ * about who should have access, not a delete the installer guesses at.
+ */
+import { compareSection, describeFinding } from './grants.js';
+import { compareCatalogue, describeDifferences, installedSections, readExpectedObjects, readGrants, } from './inventory.js';
+import { migrationGap } from './migrations.js';
+import { scalar } from './sql.js';
+export async function doctor(db, migrations, options = {}) {
+    const checks = [];
+    // Read once and handed to both: the inventory carries the objects a release
+    // defines and the privileges it grants on them, and reading the file twice
+    // would be two answers to one question.
+    const expected = options.expected ?? (await readExpectedObjects());
+    checks.push(await checkMigrations(db, migrations));
+    checks.push(await checkCatalogue(db, expected));
+    checks.push(await checkRowLevelSecurity(db));
+    checks.push(await checkPolicies(db));
+    checks.push(await checkGrants(db, expected));
+    checks.push(await checkOrphanMembers(db));
+    checks.push(await checkOrphanAdmins(db));
+    checks.push(await checkBankAccounts(db));
+    checks.push(await checkStatements(db));
+    checks.push(await checkPostedEntriesBalance(db));
+    checks.push(await checkAuditTrail(db));
+    return {
+        checks,
+        problems: checks.filter((c) => c.severity === 'problem').length,
+        warnings: checks.filter((c) => c.severity === 'warning').length,
+    };
+}
+async function checkMigrations(db, migrations) {
+    const gap = await migrationGap(db, migrations);
+    if (gap.unknown.length > 0) {
+        return {
+            name: 'migrations',
+            severity: 'warning',
+            summary: `the database is ahead of this CLI by ${gap.unknown.length} migration(s)`,
+            details: gap.unknown.map((v) => `${v} is applied but not shipped here — upgrade the CLI`),
+        };
+    }
+    if (gap.pending.length > 0) {
+        return {
+            name: 'migrations',
+            severity: 'problem',
+            summary: `${gap.pending.length} migration(s) pending`,
+            details: gap.pending.map((m) => m.file),
+        };
+    }
+    return {
+        name: 'migrations',
+        severity: 'ok',
+        summary: `${gap.applied.length} applied, none pending`,
+    };
+}
+/**
+ * Every object this release defines, against what the database holds.
+ *
+ * The list is generated from the migrations and ships with the CLI, so the
+ * check cannot drift: see `inventory.ts` for why missing, extra and a policy
+ * are three different severities.
+ *
+ * The two schema versions are reported and never gate the comparison. A
+ * database older than the CLI is precisely when an operator runs this, and
+ * refusing to look would be refusing the case: what it says then is which
+ * version the inventory describes, which one the database reports, and what
+ * differs between them.
+ */
+async function checkCatalogue(db, expected) {
+    if (expected === undefined) {
+        return {
+            name: 'catalogue',
+            severity: 'warning',
+            summary: 'this build ships no inventory, so there is nothing to compare against',
+            details: ['Run `npm run build` in a checkout, or reinstall the package.'],
+        };
+    }
+    const comparison = await compareCatalogue(db, expected);
+    const faults = [];
+    const information = [];
+    for (const section of comparison.sections) {
+        const lines = describeDifferences(section);
+        faults.push(...lines.faults);
+        information.push(...lines.information);
+    }
+    const versions = comparison.databaseVersion === comparison.expectedVersion
+        ? []
+        : [
+            `the inventory describes schema ${comparison.expectedVersion ?? 'unknown'}, ` +
+                `the database reports ${comparison.databaseVersion ?? 'none'} — compared anyway`,
+        ];
+    const skipped = comparison.sections
+        .filter((s) => !s.installed)
+        .map((s) => `${s.code} is not installed here, so none of its objects are required`);
+    const data = { ...comparison };
+    if (faults.length === 0) {
+        return {
+            name: 'catalogue',
+            severity: comparison.extra > 0 ? 'warning' : 'ok',
+            summary: comparison.extra > 0
+                ? `everything this release defines is there, and ${comparison.extra} object(s) it does not`
+                : 'every object this release defines is there, and nothing else',
+            details: [...versions, ...skipped, ...cap(information)],
+            data,
+        };
+    }
+    return {
+        name: 'catalogue',
+        severity: 'problem',
+        summary: `${comparison.missing} object(s) missing, ${comparison.changed} changed, ` +
+            `${comparison.extra} added`,
+        details: [...versions, ...skipped, ...cap(faults), ...cap(information)],
+        data,
+    };
+}
+/** Twenty lines of evidence, then a count. A doctor nobody reads is no doctor. */
+function cap(lines, limit = 20) {
+    if (lines.length <= limit)
+        return lines;
+    return [...lines.slice(0, limit), `… and ${lines.length - limit} more (see --json)`];
+}
+/**
+ * The privileges the schema declares against the ones it holds.
+ *
+ * Row level security decides which rows a role sees; a grant decides whether
+ * the statement is allowed to run at all. Both are needed and only one of them
+ * used to be written down — until `20260914151207` the grants came from a
+ * Supabase project's default privileges, which hand `anon` everything and
+ * disappear the day `public` is recreated. This asks a live database whether
+ * it still matches the `grants` section of the inventory.
+ *
+ * Its own check rather than a category of `catalogue`, because the rule is not
+ * the same. A missing grant is a problem: it is invisible to every other check
+ * and it reaches a user as "permission denied for table companies". An extra
+ * grant to `anon` is a problem too — the anonymous role reaches the policy
+ * helpers and nothing else, and one more is a surface nobody meant to open. An
+ * extra grant to `authenticated` or `service_role` is a warning: often a local
+ * customisation, never nothing. A default privilege still standing is a
+ * warning wherever it is, because a privilege that comes from there comes from
+ * something no migration wrote and a recreated schema takes away.
+ */
+async function checkGrants(db, expected) {
+    if (expected === undefined) {
+        return {
+            name: 'grants',
+            severity: 'warning',
+            summary: 'this CLI ships no inventory, so the privileges cannot be compared',
+            details: ['Reinstall the package, or run `npm run inventory` in a checkout.'],
+        };
+    }
+    const findings = [];
+    const defaults = [];
+    const schemas = [];
+    for (const section of await installedSections(db, expected)) {
+        // An inventory generated before the grants joined it has no declaration to
+        // compare against, and silence is not an assertion.
+        if (section.grants === undefined)
+            continue;
+        schemas.push(section.schema);
+        const actual = await readGrants(db, section.schema);
+        findings.push(...compareSection(section.grants, actual));
+        for (const entry of actual.defaultPrivileges) {
+            defaults.push(`${section.schema}: a default privilege still stands (${entry}) — grants should come from a migration`);
+        }
+    }
+    if (schemas.length === 0) {
+        return {
+            name: 'grants',
+            severity: 'warning',
+            summary: 'the inventory this CLI ships declares no privileges',
+            details: ['It was generated before the schema granted its own rights. Upgrade the CLI.'],
+        };
+    }
+    const problems = findings.filter((f) => f.difference === 'missing' || f.role === 'anon');
+    const warnings = findings.filter((f) => !problems.includes(f));
+    const data = { problems, warnings, defaultPrivileges: defaults };
+    if (problems.length > 0) {
+        return {
+            name: 'grants',
+            severity: 'problem',
+            summary: `${problems.length} privilege(s) do not match what this release declares`,
+            details: cap([
+                ...problems.map(describeFinding),
+                ...warnings.map((f) => `${describeFinding(f)} (warning)`),
+                ...defaults,
+                'A missing grant answers "permission denied" to the first client and to nothing else.',
+                'Run `ekwo migrate`; if that does not close it, the privileges were changed by hand.',
+            ]),
+            data,
+        };
+    }
+    if (warnings.length > 0 || defaults.length > 0) {
+        return {
+            name: 'grants',
+            severity: 'warning',
+            summary: `${warnings.length + defaults.length} privilege(s) wider than this release declares`,
+            details: cap([
+                ...warnings.map(describeFinding),
+                ...defaults,
+                'Row level security is then the only thing refusing a verb the schema meant to withhold.',
+            ]),
+            data,
+        };
+    }
+    return {
+        name: 'grants',
+        severity: 'ok',
+        summary: `every privilege in ${schemas.join(', ')} is the one the schema grants itself`,
+    };
+}
+async function checkRowLevelSecurity(db) {
+    const rows = await db.query(`select c.relname as tablename
+       from pg_class c
+       join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity
+      order by c.relname`);
+    if (rows.length === 0) {
+        return { name: 'row level security', severity: 'ok', summary: 'enabled on every table' };
+    }
+    return {
+        name: 'row level security',
+        severity: 'problem',
+        summary: `${rows.length} table(s) without row level security`,
+        details: rows.map((r) => r.tablename),
+    };
+}
+async function checkPolicies(db) {
+    const rows = await db.query(`select c.relname as tablename
+       from pg_class c
+       join pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = 'public' and c.relkind = 'r' and c.relrowsecurity
+        and not exists (select 1 from pg_policy p where p.polrelid = c.oid)
+      order by c.relname`);
+    if (rows.length === 0) {
+        return { name: 'policies', severity: 'ok', summary: 'every protected table has a policy' };
+    }
+    return {
+        name: 'policies',
+        severity: 'problem',
+        summary: `${rows.length} table(s) with row level security and no policy — nobody can read them`,
+        details: rows.map((r) => r.tablename),
+    };
+}
+/**
+ * `company_members` deliberately has no foreign key to `auth.users`: inviting
+ * someone into a company before they have an account is a normal thing to
+ * want. The price is that deleting a user leaves a row behind, and this is
+ * where that price is paid.
+ */
+async function checkOrphanMembers(db) {
+    const rows = await db.query(`select c.name as company, m.user_id
+       from company_members m
+       join companies c on c.id = m.company_id
+      where not exists (select 1 from auth.users u where u.id = m.user_id)
+      order by c.name`);
+    if (rows.length === 0) {
+        return {
+            name: 'company members',
+            severity: 'ok',
+            summary: 'every membership points at a real user',
+        };
+    }
+    return {
+        name: 'company members',
+        severity: 'warning',
+        summary: `${rows.length} membership row(s) whose user no longer exists in Supabase Auth`,
+        details: [
+            ...rows.map((r) => `${r.company}: ${r.user_id}`),
+            'These grant nothing — auth.uid() can never match them — but they misreport who has access.',
+            'Delete them, or re-invite the person, once you know which it should be.',
+        ],
+    };
+}
+async function checkOrphanAdmins(db) {
+    const rows = await db.query(`select a.user_id from instance_admins a
+      where not exists (select 1 from auth.users u where u.id = a.user_id)`);
+    if (rows.length === 0) {
+        const count = await scalar(db, 'select count(*)::text from instance_admins');
+        return {
+            name: 'instance administrators',
+            severity: count === '0' ? 'warning' : 'ok',
+            summary: count === '0'
+                ? 'no administrator: nobody can create a company here'
+                : `${count ?? '0'} administrator(s), all real users`,
+        };
+    }
+    return {
+        name: 'instance administrators',
+        severity: 'problem',
+        summary: `${rows.length} administrator(s) whose user no longer exists`,
+        details: [
+            ...rows.map((r) => r.user_id),
+            'The foreign key to auth.users should have cascaded these away. Check that it is still there.',
+        ],
+    };
+}
+/**
+ * A company with no bank account has nowhere for a payment to land.
+ *
+ * `post_payment` resolves the money side from the payment's bank account, or
+ * from the default account of its journal — and the country template wires
+ * that second one, so this is never an error. It is the configuration an
+ * operator meant to finish and did not: without a bank account there is no
+ * IBAN on an invoice, no statement to import and nothing to reconcile
+ * against. So: a warning, naming the companies and the command that fixes it.
+ */
+async function checkBankAccounts(db) {
+    const rows = await db.query(`select c.name
+       from companies c
+      where not exists (
+        select 1 from bank_accounts b where b.company_id = c.id and b.active
+      )
+      order by c.name`);
+    if (rows.length === 0) {
+        const count = await scalar(db, 'select count(*)::text from companies');
+        return {
+            name: 'bank accounts',
+            severity: 'ok',
+            summary: count === '0'
+                ? 'no company yet, so nothing to bank'
+                : 'every company has at least one bank account',
+        };
+    }
+    return {
+        name: 'bank accounts',
+        severity: 'warning',
+        summary: `${rows.length} company/companies with no bank account`,
+        details: [
+            ...rows.map((r) => r.name),
+            'Payments still book — the bank journal carries a default account — but there is no IBAN to',
+            'put on an invoice and no statement to reconcile against.',
+            'Add one with `ekwo init --iban …` on the same project, or the create_bank_account tool of the MCP server.',
+        ],
+    };
+}
+async function checkStatements(db) {
+    const rows = await db.query(`select c.name as company, s.statement_date::text,
+            s.balance_end_declared::text as declared,
+            s.balance_end_computed::text as computed
+       from bank_statements s
+       join companies c on c.id = s.company_id
+      where not s.is_consistent
+      order by s.statement_date`);
+    if (rows.length === 0) {
+        return {
+            name: 'bank statements',
+            severity: 'ok',
+            summary: 'every statement ties to its lines',
+        };
+    }
+    return {
+        name: 'bank statements',
+        severity: 'warning',
+        summary: `${rows.length} statement(s) whose closing balance does not match their lines`,
+        details: rows.map((r) => `${r.company} ${r.statement_date}: declared ${r.declared}, lines give ${r.computed}`),
+    };
+}
+async function checkPostedEntriesBalance(db) {
+    const rows = await db.query(`select e.number, e.entry_date::text
+       from entries e
+      where e.state = 'posted' and not e.is_balanced
+      order by e.entry_date`);
+    if (rows.length === 0) {
+        return { name: 'posted entries', severity: 'ok', summary: 'every posted entry balances' };
+    }
+    return {
+        name: 'posted entries',
+        severity: 'problem',
+        summary: `${rows.length} posted entry/entries do not balance`,
+        details: rows.map((r) => `${r.number ?? '(no number)'} on ${r.entry_date}`),
+    };
+}
+/**
+ * The audit trail still being what it claims to be.
+ *
+ * Everything here is read from the catalogue rather than from a list kept by
+ * hand: the trail is append-only, so the guard trigger has to be on the table
+ * and no policy may let a client write, update or delete a row. A migration
+ * added later that put an insert policy on `audit_log` "so the application can
+ * log too" would break the one property the table exists for, and nothing else
+ * would notice.
+ */
+async function checkAuditTrail(db) {
+    const installed = (await scalar(db, `select exists (
+         select 1 from information_schema.tables
+          where table_schema = 'public' and table_name = 'audit_log'
+       )`)) === true;
+    if (!installed) {
+        return {
+            name: 'audit trail',
+            severity: 'problem',
+            summary: 'audit_log is not there',
+            details: ['The migration that creates it has not been applied. Run `ekwo migrate`.'],
+        };
+    }
+    const faults = [];
+    const guarded = await db.query(`select t.tgname from pg_trigger t
+       join pg_class c on c.oid = t.tgrelid
+      where c.relname = 'audit_log' and not t.tgisinternal`);
+    if (guarded.length === 0) {
+        faults.push('no trigger on audit_log: nothing refuses an update or a delete on it any more');
+    }
+    const rls = (await scalar(db, `select relrowsecurity from pg_class where relname = 'audit_log' and relnamespace = 'public'::regnamespace`)) === true;
+    if (!rls)
+        faults.push('row level security is off on audit_log: every signed-in user reads every company');
+    const writable = await db.query(`select p.polname, case p.polcmd
+              when 'a' then 'insert' when 'w' then 'update'
+              when 'd' then 'delete' when '*' then 'all' else 'select' end as cmd
+       from pg_policy p
+       join pg_class c on c.oid = p.polrelid
+      where c.relname = 'audit_log' and p.polcmd <> 'r'`);
+    for (const policy of writable) {
+        faults.push(`policy ${policy.polname} allows ${policy.cmd} on audit_log, which is append-only`);
+    }
+    const purgers = await db.query(`select a.grantee from (
+       select (aclexplode(p.proacl)).grantee as grantee
+         from pg_proc p
+        where p.proname = 'purge_audit_log'
+     ) a
+     where a.grantee <> 0 and pg_get_userbyid(a.grantee) not in ('service_role', current_user)`);
+    for (const grant of purgers) {
+        faults.push(`purge_audit_log is executable by a role other than service_role (${grant.grantee})`);
+    }
+    if (faults.length === 0) {
+        const rows = await scalar(db, 'select count(*)::text from audit_log');
+        return {
+            name: 'audit trail',
+            severity: 'ok',
+            summary: `append-only, ${rows ?? '0'} row(s) recorded`,
+        };
+    }
+    return {
+        name: 'audit trail',
+        severity: 'problem',
+        summary: `${faults.length} thing(s) the audit trail no longer guarantees`,
+        details: faults,
+    };
+}
+//# sourceMappingURL=doctor.js.map

package/dist/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,GAGX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAiClC,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,EAAa,EACb,UAAuB,EACvB,UAAyB,EAAE;IAE3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC;IAEnE,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;KAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,UAAuB;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wCAAwC,GAAG,CAAC,OAAO,CAAC,MAAM,eAAe;YAClF,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oDAAoD,CAAC;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,uBAAuB;YACrD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,wBAAwB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAAa,EAAE,QAAqC;IAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,CAAC,8DAA8D,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GACZ,UAAU,CAAC,eAAe,KAAK,UAAU,CAAC,eAAe;QACvD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,kCAAkC,UAAU,CAAC,eAAe,IAAI,SAAS,IAAI;gBAC3E,wBAAwB,UAAU,CAAC,eAAe,IAAI,MAAM,oBAAoB;SACnF,CAAC;IAER,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,6DAA6D,CAAC,CAAC;IAEtF,MAAM,IAAI,GAA4B,EAAE,GAAG,UAAU,EAAwC,CAAC;IAE9F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACjD,OAAO,EACL,UAAU,CAAC,KAAK,GAAG,CAAC;gBAClB,CAAC,CAAC,iDAAiD,UAAU,CAAC,KAAK,wBAAwB;gBAC3F,CAAC,CAAC,8DAA8D;YACpE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,SAAS;QACnB,OAAO,EACL,GAAG,UAAU,CAAC,OAAO,uBAAuB,UAAU,CAAC,OAAO,YAAY;YAC1E,GAAG,UAAU,CAAC,KAAK,QAAQ;QAC7B,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,GAAG,CAAC,KAAe,EAAE,KAAK,GAAG,EAAE;IACtC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,GAAG,KAAK,oBAAoB,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,WAAW,CAAC,EAAa,EAAE,QAAqC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,mEAAmE;YAC5E,OAAO,EAAE,CAAC,kEAAkE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,MAAM,uCAAuC,KAAK,yCAAyC,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qDAAqD;YAC9D,OAAO,EAAE,CAAC,6EAA6E,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,uDAAuD;YAClF,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC;gBACzD,GAAG,QAAQ;gBACX,sFAAsF;gBACtF,qFAAqF;aACtF,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,gDAAgD;YAC7F,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ;gBACX,yFAAyF;aAC1F,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;KACxF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;yBAIqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAa;IACxC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;yBAKqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,wEAAwE;QAC/F,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAAa;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;sBAIkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,iEAAiE;QACxF,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,4FAA4F;YAC5F,yEAAyE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;2EACuE,CACxE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1C,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,mCAAmC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,+CAA+C;QACtE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7B,8FAA8F;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;sBAKkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC/E,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,yCAAyC;QAChE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1B,4FAA4F;YAC5F,0DAA0D;YAC1D,2GAA2G;SAC5G;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAMzB;;;;;;gCAM4B,CAC7B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,gEAAgE;QACvF,OAAO,EAAE,IAAI,CAAC,GAAG,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,cAAc,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAC5F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAa;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;4BAGwB,CACzB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,aAAa,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,SAAS,GACb,CAAC,MAAM,MAAM,CACX,EAAE,EACF;;;SAGG,CACJ,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,CAAC,yEAAyE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;2DAEuD,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,GAAG,GACP,CAAC,MAAM,MAAM,CACX,EAAE,EACF,2GAA2G,CAC5G,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAE1G,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B;;;;;wDAKoD,CACrD,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;;;;+FAK2F,CAC5F,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,oEAAoE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,gBAAgB,IAAI,IAAI,GAAG,kBAAkB;SACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,gDAAgD;QACzE,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC"}

package/dist/grants.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The privileges the schema declares, and how a live database is compared to
+ * them.
+ *
+ * Since `20260914151207` every table, view and function of Ekwo names the
+ * roles that may reach it, in the migration that creates it. Before that the
+ * privileges came from a Supabase project's default privileges on `public`,
+ * which gave `anon` — the role behind the publishable key — `all` on every
+ * table of the ledger, and which vanish the day somebody recreates the schema.
+ *
+ * The declaration travels in `packages/cli/assets/expected-objects.json`,
+ * under `grants` in each schema's section: the same inventory that carries the
+ * tables, the policies and the triggers a release defines, generated by
+ * `scripts/generate-expected-objects.mjs` from a freshly migrated database and
+ * committed. One file, because the privileges of an object and the object are
+ * the same release. This module reads the same catalogue out of a live
+ * installation and says where the two differ:
+ *
+ *   - a **missing** grant is a problem. It is the failure PostgREST reports as
+ *     "permission denied for table companies" to the first user, and it passes
+ *     every other check there is.
+ *   - an **extra** grant to `anon` is a problem. The anonymous role reaches
+ *     the policy helpers and nothing else; anything more is a surface somebody
+ *     opened by hand or a default privilege that was never taken away.
+ *   - an **extra** grant to `authenticated` or `service_role` is a warning. It
+ *     is usually a local customisation and it is never nothing: row level
+ *     security is then the only thing refusing a verb the schema meant to
+ *     withhold.
+ *
+ * The SQL that describes a schema lives here rather than in the generator, so
+ * that the file and the check can never read the catalogue two different ways.
+ * `inventory.ts` calls `describeGrants` to fill the section, and `doctor.ts`
+ * calls it again on the live database and hands both to `compareSection`.
+ */
+/** The three roles a Supabase project exposes to a client. */
+export declare const GRANT_ROLES: readonly ["anon", "authenticated", "service_role"];
+export type GrantRole = (typeof GRANT_ROLES)[number];
+/** Privileges held on one object, by role. Lower case, sorted. */
+export type HeldBy = Record<GrantRole, string[]>;
+export interface GrantedObject extends HeldBy {
+    name: string;
+    /** Functions only: the identity arguments that tell an overload apart. */
+    arguments?: string;
+    /** Functions only, and true when the function returns `trigger`. */
+    trigger?: boolean;
+}
+export interface GrantsSection extends Record<string, unknown> {
+    schema: string;
+    /** `usage` on the schema itself, which is what makes the rest reachable. */
+    usage: HeldBy;
+    tables: GrantedObject[];
+    views: GrantedObject[];
+    sequences: GrantedObject[];
+    functions: GrantedObject[];
+    /**
+     * Default privileges still standing on the schema, as
+     * `owner:objtype:role:privilege`. Empty is the point: a privilege that comes
+     * from here comes from something no migration wrote.
+     */
+    defaultPrivileges: string[];
+}
+/** Rows from one parameterised query. Both PGlite and the CLI client fit. */
+export type QueryRows = <T>(sql: string, params: unknown[]) => Promise<T[]>;
+/**
+ * Every privilege one schema hands to the three roles, object by object.
+ *
+ * `aclexplode` turns an `aclitem[]` into one row per grantee and privilege,
+ * which is the only shape worth comparing: the text form of an ACL depends on
+ * the owner's name and on the order the privileges happen to sit in. The
+ * owner's own grants are dropped — they are not a declaration, they are what
+ * owning a table means.
+ */
+export declare function describeGrants(rows: QueryRows, schema: string): Promise<GrantsSection>;
+export type Difference = 'missing' | 'extra';
+export interface GrantFinding {
+    schema: string;
+    /** `table entries`, `function post_entry(p_entry_id uuid)`. */
+    object: string;
+    role: GrantRole;
+    difference: Difference;
+    /** The privileges that are missing, or the ones that are too many. */
+    privileges: string[];
+}
+/** Every difference between what a schema declares and what it holds. */
+export declare function compareSection(expected: GrantsSection, actual: GrantsSection): GrantFinding[];
+/** A finding as one line of the doctor's output. */
+export declare function describeFinding(finding: GrantFinding): string;
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,8DAA8D;AAC9D,eAAO,MAAM,WAAW,oDAAqD,CAAC;AAC9E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,kEAAkE;AAClE,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAEjD,MAAM,WAAW,aAAc,SAAQ,MAAM;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAc,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;AAI5E;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAiG5F;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AA2BD,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,YAAY,EAAE,CAgC7F;AAED,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAG7D"}