ekwo-os 0.7.0 → 0.8.0

package/dist/assets/expected-objects.json

@@ -1,6 +1,6 @@
 {
-  "schemaVersion": "0.7.0",
-  "migration": "20260922124012",
+  "schemaVersion": "0.8.0",
+  "migration": "20260923093000",
   "socle": {
     "schema": "public",
     "tables": [
@@ -3743,6 +3743,10 @@
         "name": "amount_text_format",
         "arguments": "p_rounding money_rounding"
       },
+      {
+        "name": "api_key_company",
+        "arguments": ""
+      },
       {
         "name": "assert_may_close_year",
         "arguments": ""
@@ -3931,6 +3935,10 @@
         "name": "declaration_period_start",
         "arguments": "p_period declaration_period, p_day date"
       },
+      {
+        "name": "default_statement_code",
+        "arguments": "p_company_id uuid, p_kind text, p_at date"
+      },
       {
         "name": "disable_module",
         "arguments": "p_company_id uuid, p_code text"
@@ -3999,6 +4007,10 @@
         "name": "ec_sales_list",
         "arguments": "p_company_id uuid, p_from date, p_to date, p_report_code text"
       },
+      {
+        "name": "ekwo_pre_request",
+        "arguments": ""
+      },
       {
         "name": "ekwo_schema_version",
         "arguments": ""
@@ -4095,6 +4107,10 @@
         "name": "financial_statement",
         "arguments": "p_company_id uuid, p_statement_code text, p_from date, p_to date"
       },
+      {
+        "name": "financial_statement_of_kind",
+        "arguments": "p_company_id uuid, p_kind text, p_from date, p_to date"
+      },
       {
         "name": "fiscal_year_at",
         "arguments": "p_company_id uuid, p_date date"
@@ -4151,6 +4167,10 @@
         "name": "install_country_template",
         "arguments": "p_company_id uuid, p_country character, p_language character, p_chart_code text"
       },
+      {
+        "name": "installed_schema_version",
+        "arguments": ""
+      },
       {
         "name": "instance_has_no_admin",
         "arguments": ""
@@ -4183,6 +4203,10 @@
         "name": "is_instance_admin",
         "arguments": ""
       },
+      {
+        "name": "is_known_caller",
+        "arguments": ""
+      },
       {
         "name": "label_for",
         "arguments": "p_name text, p_i18n jsonb, p_languages text[]"
@@ -4315,6 +4339,10 @@
         "name": "prepare_filing",
         "arguments": "p_company_id uuid, p_from date, p_to date, p_report_code text"
       },
+      {
+        "name": "present_api_key",
+        "arguments": "p_secret text"
+      },
       {
         "name": "purge_audit_log",
         "arguments": "p_before date"
@@ -6817,6 +6845,19 @@
             "execute"
           ]
         },
+        {
+          "name": "api_key_company",
+          "arguments": "",
+          "anon": [
+            "execute"
+          ],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "assert_may_close_year",
           "arguments": "",
@@ -7281,6 +7322,17 @@
             "execute"
           ]
         },
+        {
+          "name": "default_statement_code",
+          "arguments": "p_company_id uuid, p_kind text, p_at date",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "disable_module",
           "arguments": "p_company_id uuid, p_code text",
@@ -7441,6 +7493,19 @@
             "execute"
           ]
         },
+        {
+          "name": "ekwo_pre_request",
+          "arguments": "",
+          "anon": [
+            "execute"
+          ],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "ekwo_schema_version",
           "arguments": "",
@@ -7684,6 +7749,17 @@
             "execute"
           ]
         },
+        {
+          "name": "financial_statement_of_kind",
+          "arguments": "p_company_id uuid, p_kind text, p_from date, p_to date",
+          "anon": [],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "fiscal_year_at",
           "arguments": "p_company_id uuid, p_date date",
@@ -7834,6 +7910,19 @@
             "execute"
           ]
         },
+        {
+          "name": "installed_schema_version",
+          "arguments": "",
+          "anon": [
+            "execute"
+          ],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "instance_has_no_admin",
           "arguments": "",
@@ -7932,6 +8021,19 @@
             "execute"
           ]
         },
+        {
+          "name": "is_known_caller",
+          "arguments": "",
+          "anon": [
+            "execute"
+          ],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "label_for",
           "arguments": "p_name text, p_i18n jsonb, p_languages text[]",
@@ -8294,6 +8396,19 @@
             "execute"
           ]
         },
+        {
+          "name": "present_api_key",
+          "arguments": "p_secret text",
+          "anon": [
+            "execute"
+          ],
+          "authenticated": [
+            "execute"
+          ],
+          "service_role": [
+            "execute"
+          ]
+        },
         {
           "name": "purge_audit_log",
           "arguments": "p_before date",

package/dist/assets/migrations/20260922143000_a_version_anybody_signed_in_may_read.sql

@@ -0,0 +1,52 @@
+-- Ekwo OS — the version of the schema, for somebody who is on no company yet.
+--
+-- A client of this schema has one question to ask before it draws anything:
+-- is this installation new enough for the code I ship? The answer is
+-- `instance.schema_version`, and the policy on that table admits members of
+-- at least one company and instance administrators — for the reason written
+-- in `20260911140000`: self sign-up is on by default on a Supabase project,
+-- so a signed-in stranger is ordinary and the organisation's name, its country
+-- and the day it was installed are not theirs to read.
+--
+-- A freshly created account is exactly that stranger. It signs in, reads no
+-- row, and the client cannot tell an instance behind its schema from one
+-- whose row it was never allowed to see. Both are silence, and the two call
+-- for opposite behaviour: print `ekwo migrate`, or say nothing and carry on.
+-- A web application meets this on its first screen, with an account whose
+-- invitation has not arrived yet.
+--
+-- So the version leaves the table and becomes a question of its own.
+-- `installed_schema_version()` is definer — it reads the singleton row past a
+-- policy that was written about the rest of it — and it returns two fields
+-- and no others: the version the migrations wrote, and the edition, which is
+-- `community` or `cloud` and gates nothing anywhere in this repository.
+-- Whoever the caller is, what they learn is what release this software is at.
+-- Nothing about the customer comes with it.
+--
+-- **`anon` does not get it**, and the exception is not worth making. Decision
+-- 0002 keeps the anonymous surface closed, and the list of what `anon` may
+-- execute is the policy helpers, which answer about `auth.uid()` and therefore
+-- say nothing, plus `shared_document()`, which somebody was handed a link to.
+-- The version is not in that shape: nobody asks it before signing in — the
+-- client asks it *after*, which is the moment the old answer went missing —
+-- and granting it would hand an unauthenticated scanner the exact release an
+-- installation runs, for a convenience nothing needs. A reader who needs it
+-- signs in first.
+
+create or replace function installed_schema_version()
+returns table (schema_version text, edition text)
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select i.schema_version, i.edition::text from instance i where i.id = 1;
+$$;
+
+comment on function installed_schema_version() is
+  'The schema version this installation runs, and its edition. Definer, so a signed-in account that is on no company yet can still tell an instance behind its schema from one it may not read the row of — which is the same silence otherwise. Nothing else of the instance row comes with it.';
+
+revoke execute on all functions in schema public from public;
+
+revoke execute on function installed_schema_version() from public, anon;
+grant execute on function installed_schema_version() to authenticated, service_role;

package/dist/assets/migrations/20260922144500_a_balance_sheet_without_knowing_the_pack.sql

@@ -0,0 +1,117 @@
+-- Ekwo OS — asking for a balance sheet without knowing which pack answers.
+--
+-- `financial_statement()` takes `p_statement_code`, and a code belongs to a
+-- country pack: `BE-BNB-ABBR-BS`, `FR-2050`, the generic `IFRS-SME-BS`. A
+-- client that knows which company it is looking at does not know that string,
+-- and it must not learn it — writing `FR-2050` into an application is writing
+-- a country into code, one screen at a time, which is the thing
+-- `docs/decisions/0025` exists to stop.
+--
+-- `available_statements(company, at)` has been the way out since the day the
+-- statements landed: it gives every scheme that company may ask for, with its
+-- kind and whether its chart declares it. What was missing is the step after
+-- it — going from *a balance sheet* to the one statement that answers, and
+-- doing it the same way twice. Every caller that wanted one wrote its own
+-- choice: take the first row, prefer `is_default`, prefer the country over the
+-- generic. Three readers, three orders, and the day a pack carries two balance
+-- sheets they disagree about which is the company's.
+--
+-- Two functions, and no new rule about accounting:
+--
+--   `default_statement_code(company, kind, at)` — the one scheme of that kind
+--       this company reports on. The order is the pack's own preferences,
+--       stated once: a statement the company's chart declares
+--       (`chart_templates.statements`, which is what `is_default` marks) comes
+--       first; then one of the company's country, because a national scheme is
+--       what an administration reads; then the generic framework, which fits
+--       any chart and is the fallback and never the first answer. `code`
+--       settles a tie, so the answer does not depend on the order rows were
+--       loaded in.
+--
+--   `financial_statement_of_kind(company, kind, from, to)` — the same table
+--       `financial_statement()` returns, resolved that way, with the code it
+--       chose in the first column. The code comes back because a reader has to
+--       be able to say which scheme it is printing, and because the next call
+--       — `unmapped_accounts()`, an XBRL export — takes the code.
+--
+-- The kind is the one the schema already has: `balance_sheet`,
+-- `income_statement`, `allocation`, `cash_flow` — the vocabulary of
+-- `statement_templates.kind`, not a new one. A company with no statement of
+-- the kind asked for is told so, and told what it does have; a company that
+-- installed no pack at all has the generic framework and so has both of the
+-- two that are produced.
+--
+-- The date the validity is read at is `p_to`: a statement is the one that was
+-- in force at the end of the period being reported, not the one in force
+-- today. A scheme replaced last month still prints last year.
+
+create or replace function default_statement_code(
+  p_company_id uuid,
+  p_kind       text,
+  p_at         date default null
+)
+returns text
+language sql
+stable
+as $$
+  select s.code
+    from available_statements(p_company_id, p_at) s
+   where s.kind = p_kind
+   order by s.is_default desc, (s.country is null), s.code
+   limit 1;
+$$;
+
+comment on function default_statement_code(uuid, text, date) is
+  'The statement of a kind this company reports on: one its chart declares, else one of its country, else the generic framework. Null when it has none of that kind. The one place that choice is made, so two readers cannot disagree about which balance sheet is the company''s.';
+
+create or replace function financial_statement_of_kind(
+  p_company_id uuid,
+  p_kind       text,
+  p_from       date,
+  p_to         date
+)
+returns table (
+  statement_code text,
+  line_code      text,
+  parent_code    text,
+  name           text,
+  sequence       integer,
+  is_total       boolean,
+  amount         numeric,
+  xbrl_element   text
+)
+language plpgsql
+stable
+as $$
+declare
+  v_code  text;
+  v_kinds text;
+begin
+  if not exists (select 1 from companies c where c.id = p_company_id) then
+    raise exception 'unknown_company: %', p_company_id;
+  end if;
+
+  v_code := default_statement_code(p_company_id, p_kind, p_to);
+  if v_code is null then
+    select string_agg(distinct s.kind, ', ' order by s.kind) into v_kinds
+      from available_statements(p_company_id, p_to) s;
+    raise exception 'unknown_statement: this company reports no % — it reports %. available_statements() names each one by code.',
+      p_kind, coalesce(v_kinds, 'nothing');
+  end if;
+
+  return query
+    select v_code, f.line_code, f.parent_code, f.name, f.sequence,
+           f.is_total, f.amount, f.xbrl_element
+      from financial_statement(p_company_id, v_code, p_from, p_to) f;
+end;
+$$;
+
+comment on function financial_statement_of_kind(uuid, text, date, date) is
+  'One financial statement of a company by kind — balance_sheet, income_statement, allocation, cash_flow — for a caller that does not know which scheme its country pack carries. Resolves through default_statement_code() at the end date of the period, then answers as financial_statement() does, with the code it chose in the first column.';
+
+revoke execute on all functions in schema public from public;
+
+revoke execute on function default_statement_code(uuid, text, date) from public, anon;
+grant execute on function default_statement_code(uuid, text, date) to authenticated, service_role;
+revoke execute on function financial_statement_of_kind(uuid, text, date, date) from public, anon;
+grant execute on function financial_statement_of_kind(uuid, text, date, date) to authenticated, service_role;

package/dist/assets/migrations/20260922160000_a_key_reaches_the_api.sql

@@ -0,0 +1,265 @@
+-- Ekwo OS — a machine key that reaches the API, and not only a connection.
+--
+-- Decision 0006 wrote the limit down rather than hiding it: "because PostgREST
+-- runs each request in its own transaction, a key is for a client holding a
+-- connection". `use_api_key()` puts the key's fingerprint in `ekwo.api_key`
+-- transaction-locally, and two REST calls are two transactions, so the key was
+-- never presented when the work ran. Anything operated for somebody else — a
+-- backup, a scheduled report, a script on a host with no psql — had to hold a
+-- password of theirs or their `service_role` key. Both are worse than the key
+-- the schema already mints.
+--
+-- The same decision left one question open, in as many words: "Deciding what
+-- of `companies` a key may read is an open question, recorded rather than
+-- patched per function." This answers it.
+--
+-- ---------------------------------------------------------------------------
+-- 1. The key travels in a header, and the transaction reads it
+-- ---------------------------------------------------------------------------
+--
+-- PostgREST calls one function of our choosing at the start of every request's
+-- transaction — `pgrst.db_pre_request` — which is exactly the place
+-- `use_api_key()` was missing. `ekwo_pre_request()` reads
+-- `X-Ekwo-Api-Key` off `request.headers` and presents the key. No header, no
+-- effect: a request that carries none is the request it was before this
+-- migration, down to the role it runs as.
+--
+-- The name of the header is ours and not `Authorization`: PostgREST reads the
+-- role out of that one, and a value it cannot parse as a JWT fails the request
+-- before any function of ours runs. Two doors, two names.
+--
+-- ---------------------------------------------------------------------------
+-- 2. The role, which is the part that is not obvious
+-- ---------------------------------------------------------------------------
+--
+-- A request carrying only the publishable key runs as `anon`, and `anon` holds
+-- no privilege on any table of this schema — decision 0003, and
+-- `tests/grants.test.ts` asserts it. Row level security never gets a chance to
+-- decide: the grant refuses first. So presenting a key has to move the request
+-- off `anon`, and `ekwo_pre_request()` does that, *after* the key has been
+-- checked and never before:
+--
+--     set_config('role', 'authenticated', true)
+--
+-- Three things make that sound rather than clever.
+--
+-- **It is not a definer function.** PostgreSQL refuses `set role` inside
+-- SECURITY DEFINER — "cannot set parameter role within security-definer
+-- function" — so `ekwo_pre_request()` runs as its caller, and the privilege
+-- check is the ordinary one: the session user is `authenticator`, which is a
+-- member of `authenticated`, and that is what makes the switch legal. A role
+-- that is a member of nothing is refused by the server, not by us.
+--
+-- **Nothing is reached before the key is proven.** `present_api_key()` raises
+-- on a key that is unknown, withdrawn or expired, and a raise inside the
+-- pre-request fails the whole request. The switch is on the line after it.
+--
+-- **`authenticated` is not a person.** `auth.uid()` stays null — a key is not
+-- a session, which is the sentence decision 0006 opens with — so every policy
+-- that asks for a signed-in user still answers no, and what the caller may do
+-- is decided by `has_capability()`, which has answered for a key since the
+-- keys landed. The role is the door; the capabilities are the rooms.
+--
+-- ---------------------------------------------------------------------------
+-- 3. What a key is on: its own company
+-- ---------------------------------------------------------------------------
+--
+-- Past the grants, five policies still refused, and they are the ones that ask
+-- `is_company_member()` rather than a capability: the company row itself, its
+-- members, which modules it has on, how often it files, its matching settings,
+-- its audit trail. They are structural — a caller that cannot read
+-- `companies` cannot export the company, cannot round at its currency and
+-- cannot find its financial year — and none of them has a capability of its
+-- own, by decision 0004: "no capability without something that can refuse on
+-- it".
+--
+-- So the answer is written once, where the question is asked:
+--
+--     a key of a company is on that company.
+--
+-- `is_company_member()` says true for the company the presented key belongs
+-- to, and every policy that asks it follows without being rewritten —
+-- including `module_enabled()`, which is the same question for a module's
+-- tables. A key is still narrower than the member who issued it: every
+-- capability on it was one the issuer held, and every table that has a
+-- capability keeps asking for it. What it gains is the handful of rows that
+-- describe the company it was minted for, which is the company it can already
+-- read the ledger of.
+--
+-- Widened deliberately and stated so a reviewer can object: whatever its
+-- capabilities, a key reads its company's row, its members, its modules, its
+-- filing periods, its matching settings and its audit trail — exactly what the
+-- narrowest member of that company reads. It reads nothing of any other
+-- company, because `api_keys.company_id` is one company and there is no second
+-- one to name.
+--
+-- The reference tables of the installation — currencies, charts, statement
+-- schemes, the capability list — ask a different question again,
+-- `auth.uid() is not null`, and they are the subject of the migration that
+-- follows this one: they are not a company's rows, and what they were reaching
+-- for was never a session but a caller this installation knows.
+
+-- ---------------------------------------------------------------------------
+-- The company of the key presented in this transaction
+-- ---------------------------------------------------------------------------
+
+create or replace function api_key_company()
+returns uuid
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select k.company_id
+    from api_keys k
+   where k.key_hash = nullif(current_setting('ekwo.api_key', true), '')
+     and k.revoked_at is null
+     and (k.expires_at is null or k.expires_at > now());
+$$;
+
+comment on function api_key_company() is
+  'The company of the machine key presented in this transaction, or nothing. What `is_company_member()` asks so that a key is on the company it was minted for, and the only thing of a key the policy helpers read.';
+
+-- ---------------------------------------------------------------------------
+-- A member, or a key of this company
+--
+-- The body is the only place the rule lives. `company_role()` still answers
+-- about `auth.uid()` alone, and stays the answer to "which preset is this
+-- person on" — a key is on no preset, holds a list, and must not be made to
+-- look like a role.
+-- ---------------------------------------------------------------------------
+
+create or replace function is_company_member(p_company_id uuid)
+returns boolean
+language sql
+stable
+as $$
+  -- `coalesce`, and decision 0005 is why: `p_company_id = api_key_company()`
+  -- is NULL when no key is presented, `false or NULL` is NULL, and a guard
+  -- written as `if not is_company_member(...)` would not fire for a stranger.
+  -- A helper a guard is written on answers true or false and never NULL.
+  select company_role(p_company_id) is not null
+      or coalesce(p_company_id = api_key_company(), false);
+$$;
+
+comment on function is_company_member(uuid) is
+  'Whether the caller is on a company: a member of it, or the holder of a machine key minted on it. False, never NULL, for a stranger.';
+
+create or replace function is_any_company_member()
+returns boolean
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select exists (select 1 from company_members m where m.user_id = auth.uid())
+      or api_key_company() is not null;
+$$;
+
+comment on function is_any_company_member() is
+  'Whether the caller belongs to at least one company of this installation, as a member or as the holder of a machine key.';
+
+-- ---------------------------------------------------------------------------
+-- Presenting a key without reading one
+--
+-- `use_api_key()` returns the row, which is what a client holding a connection
+-- wants and what a pre-request must not hand back: the pre-request is called
+-- by `anon`, so whatever it can call, an anonymous caller can call. This
+-- returns nothing at all, and the row — `key_hash` included — stays behind the
+-- grant it has always been behind.
+-- ---------------------------------------------------------------------------
+
+create or replace function present_api_key(p_secret text)
+returns void
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+begin
+  perform use_api_key(p_secret);
+end;
+$$;
+
+comment on function present_api_key(text) is
+  'Presents a machine key for the current transaction and answers nothing. What `ekwo_pre_request()` calls, and the only form of the question an anonymous caller may ask: the refusals of use_api_key() word for word, and no row.';
+
+-- ---------------------------------------------------------------------------
+-- The pre-request
+--
+-- Invoker, deliberately: PostgreSQL refuses `set role` inside a definer
+-- function, and the privilege that makes the switch legal is the session's —
+-- `authenticator` is a member of `authenticated` — not ours to lend.
+--
+-- `request.headers` is set by PostgREST and absent everywhere else, so the
+-- function is a no-op on a direct connection, which is what the command line
+-- and the MCP server use.
+-- ---------------------------------------------------------------------------
+
+create or replace function ekwo_pre_request()
+returns void
+language plpgsql
+set search_path = public, pg_temp
+as $$
+declare
+  v_headers json := nullif(current_setting('request.headers', true), '')::json;
+  v_secret  text := nullif(v_headers ->> 'x-ekwo-api-key', '');
+begin
+  if v_secret is null then
+    return;
+  end if;
+
+  -- Raises on a key that is unknown, withdrawn or expired, and the raise fails
+  -- the request. Nothing below this line runs for a key that is not one.
+  perform present_api_key(v_secret);
+
+  -- Off `anon`, which holds no privilege on any table, and onto the role whose
+  -- grants row level security is written against. `auth.uid()` stays null.
+  perform set_config('role', 'authenticated', true);
+end;
+$$;
+
+comment on function ekwo_pre_request() is
+  'Called by PostgREST at the start of every request (pgrst.db_pre_request). Presents the key in X-Ekwo-Api-Key when there is one, then moves the request off `anon` so that row level security decides instead of the grants. No header, no effect.';
+
+-- ---------------------------------------------------------------------------
+-- Telling PostgREST to call it
+--
+-- The setting lives on the `authenticator` role, which is the login PostgREST
+-- connects with. It is configuration of the API and not of the schema, so a
+-- database that has no such role — PGlite under the tests, a plain Postgres
+-- behind the command line — skips it and loses nothing.
+--
+-- Where the role exists and the migration is not allowed to write its
+-- settings, the schema is still correct and the header is simply not read yet.
+-- That is a state somebody has to be told about rather than left to discover,
+-- so it is a notice here and a check in `ekwo doctor`, which names the exact
+-- statement to run.
+-- ---------------------------------------------------------------------------
+
+do $$
+begin
+  if not exists (select 1 from pg_roles where rolname = 'authenticator') then
+    return;
+  end if;
+  begin
+    execute 'alter role authenticator set pgrst.db_pre_request = ''public.ekwo_pre_request''';
+    notify pgrst, 'reload config';
+  exception when insufficient_privilege then
+    raise notice 'ekwo: could not set pgrst.db_pre_request on the authenticator role. Machine keys will not be read from X-Ekwo-Api-Key until somebody with the privilege runs: alter role authenticator set pgrst.db_pre_request = ''public.ekwo_pre_request''; notify pgrst, ''reload config''; — `ekwo doctor` reports this.';
+  end;
+end
+$$;
+
+revoke execute on all functions in schema public from public;
+
+-- `anon` gains two functions, and the decision record says why. `api_key_company()`
+-- is read by `is_company_member()`, which `anon` already executes on behalf of
+-- a policy; `present_api_key()` and `ekwo_pre_request()` are the door itself,
+-- and both answer `void`.
+revoke execute on function api_key_company()    from public;
+revoke execute on function present_api_key(text) from public;
+revoke execute on function ekwo_pre_request()   from public;
+
+grant execute on function api_key_company()      to anon, authenticated, service_role;
+grant execute on function present_api_key(text)  to anon, authenticated, service_role;
+grant execute on function ekwo_pre_request()     to anon, authenticated, service_role;

package/dist/assets/migrations/20260922161500_the_version_answers_a_key_as_well.sql

@@ -0,0 +1,42 @@
+-- Ekwo OS — the version answers a key too, and a stranger not at all.
+--
+-- `installed_schema_version()` was granted to `authenticated` alone, because
+-- the client that asks it asks after signing in. A machine key now reaches the
+-- API (`20260922160000`), and it asks the same question first and for the same
+-- reason: a backup that does not know whether the instance is ahead of the
+-- code reading it writes an archive nobody can check.
+--
+-- Two ways to give it that answer. Granting `anon` the function as it stands
+-- would hand an unauthenticated scanner the exact release an installation
+-- runs, which is what the first migration declined to do. Granting it and
+-- letting the *body* decide gives nothing away: the function returns a row to
+-- a caller this installation knows — a signed-in user, or the holder of a live
+-- key — and no rows at all to anybody else. `anon` may call it; calling it
+-- anonymously is a way of learning nothing.
+--
+-- The grant is the one exception worth the sentence: a key presented through
+-- the pre-request arrives as `authenticated` and does not need it. It is the
+-- call made *before* the key is presented — the screen that checks a pasted
+-- key against an instance — that arrives as `anon`, and the shape of the
+-- answer is the same for both: zero rows unless somebody is there.
+
+create or replace function installed_schema_version()
+returns table (schema_version text, edition text)
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select i.schema_version, i.edition::text
+    from instance i
+   where i.id = 1
+     and (auth.uid() is not null or api_key_company() is not null);
+$$;
+
+comment on function installed_schema_version() is
+  'The schema version this installation runs, and its edition, for a caller it knows: a signed-in account that is on no company yet, or the holder of a machine key. No rows for anybody else, so an anonymous call learns nothing. Nothing else of the instance row comes with it.';
+
+revoke execute on all functions in schema public from public;
+
+revoke execute on function installed_schema_version() from public;
+grant execute on function installed_schema_version() to anon, authenticated, service_role;

package/dist/assets/migrations/20260922162500_reference_data_for_a_caller_this_installation_knows.sql

@@ -0,0 +1,127 @@
+-- Ekwo OS — reference data is for a caller this installation knows.
+--
+-- Eighteen tables of the socle carry the reference data every reading depends
+-- on: the currencies and their rates, the charts of accounts and their
+-- templates, the taxes and where they post, the boxes of the declaration
+-- forms, the financial statement schemes, the legal mentions, the territories,
+-- the modules, and the list of capabilities itself. None of them belongs to a
+-- company. Their policy has always been the same sentence — `auth.uid() is not
+-- null` — which reads "somebody signed in", and was the right sentence while
+-- the only caller this installation had was a person.
+--
+-- `20260922160000` gave it a second kind of caller. A machine key now reaches
+-- the API, arrives as `authenticated` and is on its own company, and every
+-- policy that asks a capability follows. These eighteen ask none: they ask for
+-- a session, and a key is not a session, so they answered no — and a caller
+-- that cannot read `modules` cannot even be told which tables an archive
+-- carries, which is how `export_company()` was still refusing a key that held
+-- `company.export`. The refusal was not about the company's data at all. It
+-- was about a list of module codes.
+--
+-- So the sentence is replaced by what it was always reaching for, in one
+-- helper that every one of them now calls:
+--
+--     is_known_caller() — a signed-in user, or the holder of a live key.
+--
+-- Nothing else changes. These tables hold no customer data: a chart of
+-- accounts and a currency are the same rows on every installation, which is
+-- why the seed writes them and nobody may. What widens is who may read what
+-- the installation already publishes to every person signed into it, and the
+-- set of callers grows by exactly one: somebody holding a key this
+-- installation minted, which is a stronger claim than having signed up.
+--
+-- `anon` is untouched and still reads none of them: `is_known_caller()`
+-- answers false without a session and without a key, which is the same word
+-- `auth.uid() is not null` gave it.
+--
+-- The two reference tables of the assets module are the same question in a
+-- module's schema, and are moved in the module's own migration, where they
+-- belong.
+
+create or replace function is_known_caller()
+returns boolean
+language sql
+stable
+as $$
+  select auth.uid() is not null or api_key_company() is not null;
+$$;
+
+comment on function is_known_caller() is
+  'Whether this installation knows who is asking: a signed-in user, or the holder of a live machine key. What the policies of the reference tables ask, in place of the `auth.uid() is not null` they asked while a person was the only caller.';
+
+drop policy account_templates_select on account_templates;
+create policy account_templates_select on account_templates
+  for select using (is_known_caller());
+
+drop policy capabilities_select on capabilities;
+create policy capabilities_select on capabilities
+  for select using (is_known_caller());
+
+drop policy chart_templates_select on chart_templates;
+create policy chart_templates_select on chart_templates
+  for select using (is_known_caller());
+
+drop policy country_defaults_select on country_defaults;
+create policy country_defaults_select on country_defaults
+  for select using (is_known_caller());
+
+drop policy currencies_select on currencies;
+create policy currencies_select on currencies
+  for select using (is_known_caller());
+
+drop policy currency_rates_select on currency_rates;
+create policy currency_rates_select on currency_rates
+  for select using (is_known_caller());
+
+drop policy journal_templates_select on journal_templates;
+create policy journal_templates_select on journal_templates
+  for select using (is_known_caller());
+
+drop policy legal_mention_templates_select on legal_mention_templates;
+create policy legal_mention_templates_select on legal_mention_templates
+  for select using (is_known_caller());
+
+drop policy modules_select on modules;
+create policy modules_select on modules
+  for select using (is_known_caller());
+
+drop policy role_capabilities_select on role_capabilities;
+create policy role_capabilities_select on role_capabilities
+  for select using (is_known_caller());
+
+drop policy statement_line_rules_select on statement_line_rules;
+create policy statement_line_rules_select on statement_line_rules
+  for select using (is_known_caller());
+
+drop policy statement_line_templates_select on statement_line_templates;
+create policy statement_line_templates_select on statement_line_templates
+  for select using (is_known_caller());
+
+drop policy statement_templates_select on statement_templates;
+create policy statement_templates_select on statement_templates
+  for select using (is_known_caller());
+
+drop policy tax_posting_templates_select on tax_posting_templates;
+create policy tax_posting_templates_select on tax_posting_templates
+  for select using (is_known_caller());
+
+drop policy tax_report_box_templates_select on tax_report_box_templates;
+create policy tax_report_box_templates_select on tax_report_box_templates
+  for select using (is_known_caller());
+
+drop policy tax_report_templates_select on tax_report_templates;
+create policy tax_report_templates_select on tax_report_templates
+  for select using (is_known_caller());
+
+drop policy tax_templates_select on tax_templates;
+create policy tax_templates_select on tax_templates
+  for select using (is_known_caller());
+
+drop policy territories_select on territories;
+create policy territories_select on territories
+  for select using (is_known_caller());
+
+revoke execute on all functions in schema public from public;
+
+revoke execute on function is_known_caller() from public;
+grant execute on function is_known_caller() to anon, authenticated, service_role;

package/dist/assets/migrations/20260922171000_a_key_is_presented_in_a_read_only_transaction.sql

@@ -0,0 +1,82 @@
+-- Ekwo OS — presenting a key must not need a transaction that can write.
+--
+-- Found against a real project, which is the only place it could be found:
+-- PostgREST runs a GET, and an RPC whose function is not volatile, inside a
+-- **read-only transaction**. `use_api_key()` ends by stamping
+-- `api_keys.last_used_at` through `touch_api_key()`, and an UPDATE there is
+-- refused:
+--
+--     cannot execute UPDATE in a read-only transaction   (SQLSTATE 25006)
+--
+-- The refusal happens inside `ekwo_pre_request()`, so it fails the whole
+-- request — with a 405 and a message about an UPDATE nobody asked for, on a
+-- plain `GET /rest/v1/companies`. Every read a machine key makes is that
+-- request, which is most of what a machine key is for: a backup, a report, a
+-- dashboard. PGlite never said so, because a test opens the transaction it
+-- wants and none of ours asked for a read-only one.
+--
+-- **The stamp is worth less than the request.** `last_used_at` answers "has
+-- this key been used lately", which is what an operator withdraws keys on. It
+-- is a convenience, and the work the key was presented for is not. So the use
+-- is recorded when the transaction can record it, and skipped when it cannot,
+-- rather than the other way round.
+--
+-- This is not an error being swallowed. Nothing is caught here and nothing
+-- raises: the function asks whether the transaction it is in may write, and
+-- the answer is a fact about the transaction, known before anything is
+-- attempted. A key presented on a connection — the command line, the MCP
+-- server, `ekwo` itself — opens a read-write transaction and is stamped
+-- exactly as before. A key presented on a read request is not, and
+-- `last_used_at` then means "last used in a way that could write it down",
+-- which the column comment now says.
+--
+-- The alternative was an autonomous transaction, which in PostgreSQL means an
+-- extension — dblink or pg_background — and this schema requires none and is
+-- not going to start over a timestamp.
+
+create or replace function use_api_key(p_secret text)
+returns api_keys
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_row api_keys%rowtype;
+begin
+  select * into v_row
+    from api_keys
+   where key_hash = encode(sha256(convert_to(coalesce(p_secret, ''), 'UTF8')), 'hex');
+
+  if v_row.id is null then
+    raise exception 'unknown_api_key: that is not a key of this installation'
+      using errcode = '42501';
+  end if;
+  if v_row.revoked_at is not null then
+    raise exception 'api_key_revoked: that key was withdrawn on %', v_row.revoked_at
+      using errcode = '42501';
+  end if;
+  if v_row.expires_at is not null and v_row.expires_at <= now() then
+    raise exception 'api_key_expired: that key expired on %', v_row.expires_at
+      using errcode = '42501';
+  end if;
+
+  -- Transaction-local: the key is presented for the work at hand and not for
+  -- the life of a connection somebody else may inherit from a pool.
+  perform set_config('ekwo.api_key', v_row.key_hash, true);
+
+  -- Recorded where it can be. A read request runs in a read-only transaction
+  -- and an UPDATE in one is refused, which would fail the request the key was
+  -- presented for.
+  if not current_setting('transaction_read_only')::boolean then
+    perform touch_api_key(v_row.id);
+  end if;
+
+  return v_row;
+end;
+$$;
+
+comment on function use_api_key(text) is
+  'Presents a machine key for the current transaction: has_capability() answers for it until the transaction ends. Refuses a key that is unknown, withdrawn or expired. Records the use when the transaction may write — a read request runs in a read-only transaction, where the stamp is worth less than the request.';
+
+comment on column api_keys.last_used_at is
+  'When this key was last presented in a transaction that could write it down. A read over the API runs read-only and is not stamped, so this is a floor and never a ceiling: a key with an old date may still be in daily use for reading.';

package/dist/assets/migrations/20260923093000_schema_version_0_8_0.sql

@@ -0,0 +1,42 @@
+-- Ekwo OS — the schema this release defines is 0.8.0.
+--
+-- `ekwo_schema_version()` is the one place the number lives, and a migration
+-- is the only thing that moves it. A database then answers for the files it
+-- has actually run rather than for what somebody believed it had run: the
+-- column default and `init_instance()` both call this function, so a fresh
+-- install records the new number without a second edit, and `ekwo migrate`
+-- reads it back onto `instance.schema_version` for a database that was
+-- installed at an older one.
+--
+-- Between 0.7.0 and here the schema gained the way a key reaches the API.
+-- `ekwo_pre_request()` is called by PostgREST at the start of every request,
+-- named in `pgrst.db_pre_request`, and presents the secret sent in
+-- `X-Ekwo-Api-Key` before the request leaves `anon`; `present_api_key()` does
+-- the presenting, `is_known_caller()` answers for a signed-in user or the
+-- holder of a live key, and `is_company_member()` says true for the company a
+-- key was minted on. It also gained `installed_schema_version()`, which
+-- answers a caller this installation knows and nobody else, and
+-- `default_statement_code()` with `financial_statement_of_kind()`, which give
+-- a balance sheet to a client that does not know the country pack. A 0.7.0
+-- database has none of them, and the packages of this release call them: the
+-- floor of `ekwo-os`, `@ekwo-ai/core` and `@ekwo-ai/mcp` rises to 0.8.0 and
+-- refuses an older database by name, as every release has, rather than
+-- answering for one they were never run against.
+
+create or replace function ekwo_schema_version()
+returns text
+language sql
+immutable
+as $$
+  select '0.8.0'::text;
+$$;
+
+comment on function ekwo_schema_version() is
+  'Schema version of the installed release. Bumped by a migration, never by hand.';
+
+-- `create or replace` keeps the privileges the function already had, and the
+-- revoke is what every migration of this directory ends with: a function that
+-- comes out with the built-in default is published by Supabase as an
+-- anonymous RPC endpoint.
+revoke execute on all functions in schema public from public;
+grant execute on function ekwo_schema_version() to authenticated, service_role;

package/dist/assets/modules/assets/supabase/migrations/20260922162600_assets_reference_for_a_known_caller.sql

@@ -0,0 +1,24 @@
+-- Ekwo module `assets` — its reference tables answer the same caller the
+-- socle's do.
+--
+-- `assets.country_rules` and `assets.category_templates` are reference data of
+-- the module: the depreciation rules a country allows, and the categories a
+-- register starts from. Their policy is the sentence the socle used everywhere
+-- before `20260922162500` — `auth.uid() is not null`, which reads "somebody
+-- signed in" — and the socle has since replaced it with what it was reaching
+-- for: `is_known_caller()`, a signed-in user or the holder of a live machine
+-- key.
+--
+-- A module does not get to answer that question differently. A key that may
+-- read the register and cannot read the rules the register is built on reads
+-- half a module, and the half it is missing is the half that explains the
+-- other. The company's own rows are untouched: they keep asking
+-- `has_capability()` and `module_enabled()`, as they did.
+
+drop policy assets_country_rules_select on assets.country_rules;
+create policy assets_country_rules_select on assets.country_rules
+  for select using (public.is_known_caller());
+
+drop policy assets_category_templates_select on assets.category_templates;
+create policy assets_category_templates_select on assets.category_templates
+  for select using (public.is_known_caller());

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,wBAAsB,MAAM,CAC1B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,SAAS,EAAE,EACvB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CA0BvB"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpD,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,wBAAsB,MAAM,CAC1B,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,SAAS,EAAE,EACvB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CA2BvB"}

package/dist/doctor.js

@@ -26,6 +26,7 @@ export async function doctor(db, migrations, options = {}) {
     checks.push(await checkRowLevelSecurity(db));
     checks.push(await checkPolicies(db));
     checks.push(await checkGrants(db, expected));
+    checks.push(await checkPreRequest(db));
     checks.push(await checkOrphanMembers(db));
     checks.push(await checkOrphanAdmins(db));
     checks.push(await checkBankAccounts(db));
@@ -342,6 +343,45 @@ async function checkBankAccounts(db) {
         ],
     };
 }
+/**
+ * Whether PostgREST has been told to call `ekwo_pre_request()`.
+ *
+ * A machine key travels in `X-Ekwo-Api-Key` and is read by that function at
+ * the start of a request's transaction — which only happens if
+ * `pgrst.db_pre_request` names it on the `authenticator` role. The migration
+ * sets it where it is allowed to, and a managed project may not allow it, so
+ * this is the check that says so out loud instead of leaving somebody to
+ * discover that their key does nothing.
+ *
+ * A database with no `authenticator` role has no PostgREST in front of it —
+ * the command line's own connection, a plain Postgres — and there is nothing
+ * to report.
+ */
+async function checkPreRequest(db) {
+    const name = 'api keys over the API';
+    const found = await db.query(`select (select s from unnest(coalesce(r.rolconfig, '{}')) as s
+              where s like 'pgrst.db_pre_request=%') as setting
+       from pg_roles r where r.rolname = 'authenticator'`);
+    if (found.length === 0) {
+        return { name, severity: 'ok', summary: 'no PostgREST in front of this database' };
+    }
+    const setting = found[0]?.setting ?? null;
+    if (setting !== null && setting.endsWith('ekwo_pre_request')) {
+        return { name, severity: 'ok', summary: 'PostgREST calls ekwo_pre_request()' };
+    }
+    return {
+        name,
+        severity: 'warning',
+        summary: setting === null
+            ? 'PostgREST calls no pre-request, so a machine key in X-Ekwo-Api-Key is ignored'
+            : `PostgREST calls another pre-request (${setting}), so a machine key in X-Ekwo-Api-Key is ignored`,
+        details: [
+            "alter role authenticator set pgrst.db_pre_request = 'public.ekwo_pre_request';",
+            "notify pgrst, 'reload config';",
+            'Run both as a role that may write the settings of `authenticator`. Nothing else is affected: keys presented on a direct connection with use_api_key() work either way.',
+        ],
+    };
+}
 async function checkStatements(db) {
     const rows = await db.query(`select c.name as company, s.statement_date::text,
             s.balance_end_declared::text as declared,

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,GAGX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAiClC,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,EAAa,EACb,UAAuB,EACvB,UAAyB,EAAE;IAE3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC;IAEnE,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7C,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;KAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,UAAuB;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wCAAwC,GAAG,CAAC,OAAO,CAAC,MAAM,eAAe;YAClF,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oDAAoD,CAAC;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,uBAAuB;YACrD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,wBAAwB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAAa,EAAE,QAAqC;IAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,CAAC,8DAA8D,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GACZ,UAAU,CAAC,eAAe,KAAK,UAAU,CAAC,eAAe;QACvD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,kCAAkC,UAAU,CAAC,eAAe,IAAI,SAAS,IAAI;gBAC3E,wBAAwB,UAAU,CAAC,eAAe,IAAI,MAAM,oBAAoB;SACnF,CAAC;IAER,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,6DAA6D,CAAC,CAAC;IAEtF,MAAM,IAAI,GAA4B,EAAE,GAAG,UAAU,EAAwC,CAAC;IAE9F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACjD,OAAO,EACL,UAAU,CAAC,KAAK,GAAG,CAAC;gBAClB,CAAC,CAAC,iDAAiD,UAAU,CAAC,KAAK,wBAAwB;gBAC3F,CAAC,CAAC,8DAA8D;YACpE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,SAAS;QACnB,OAAO,EACL,GAAG,UAAU,CAAC,OAAO,uBAAuB,UAAU,CAAC,OAAO,YAAY;YAC1E,GAAG,UAAU,CAAC,KAAK,QAAQ;QAC7B,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,GAAG,CAAC,KAAe,EAAE,KAAK,GAAG,EAAE;IACtC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,GAAG,KAAK,oBAAoB,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,WAAW,CAAC,EAAa,EAAE,QAAqC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,mEAAmE;YAC5E,OAAO,EAAE,CAAC,kEAAkE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,MAAM,uCAAuC,KAAK,yCAAyC,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qDAAqD;YAC9D,OAAO,EAAE,CAAC,6EAA6E,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,uDAAuD;YAClF,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC;gBACzD,GAAG,QAAQ;gBACX,sFAAsF;gBACtF,qFAAqF;aACtF,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,gDAAgD;YAC7F,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ;gBACX,yFAAyF;aAC1F,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;KACxF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;yBAIqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAa;IACxC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;yBAKqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,wEAAwE;QAC/F,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAAa;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;sBAIkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,iEAAiE;QACxF,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,4FAA4F;YAC5F,yEAAyE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;2EACuE,CACxE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1C,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,mCAAmC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,+CAA+C;QACtE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7B,8FAA8F;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;sBAKkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC/E,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,yCAAyC;QAChE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1B,4FAA4F;YAC5F,0DAA0D;YAC1D,2GAA2G;SAC5G;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAMzB;;;;;;gCAM4B,CAC7B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,gEAAgE;QACvF,OAAO,EAAE,IAAI,CAAC,GAAG,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,cAAc,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAC5F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAa;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;4BAGwB,CACzB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,aAAa,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,SAAS,GACb,CAAC,MAAM,MAAM,CACX,EAAE,EACF;;;SAGG,CACJ,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,CAAC,yEAAyE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;2DAEuD,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,GAAG,GACP,CAAC,MAAM,MAAM,CACX,EAAE,EACF,2GAA2G,CAC5G,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAE1G,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B;;;;;wDAKoD,CACrD,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;;;;+FAK2F,CAC5F,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,oEAAoE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,gBAAgB,IAAI,IAAI,GAAG,kBAAkB;SACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,gDAAgD;QACzE,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAqB,MAAM,aAAa,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,GAGX,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAiClC,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,EAAa,EACb,UAAuB,EACvB,UAAyB,EAAE;IAE3B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,4EAA4E;IAC5E,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,MAAM,mBAAmB,EAAE,CAAC,CAAC;IAEnE,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,IAAI,CAAC,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM;KAChE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,UAAuB;IACnE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wCAAwC,GAAG,CAAC,OAAO,CAAC,MAAM,eAAe;YAClF,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,oDAAoD,CAAC;SAC1F,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,uBAAuB;YACrD,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,wBAAwB;KACvD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,EAAa,EAAE,QAAqC;IAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,uEAAuE;YAChF,OAAO,EAAE,CAAC,8DAA8D,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GACZ,UAAU,CAAC,eAAe,KAAK,UAAU,CAAC,eAAe;QACvD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,kCAAkC,UAAU,CAAC,eAAe,IAAI,SAAS,IAAI;gBAC3E,wBAAwB,UAAU,CAAC,eAAe,IAAI,MAAM,oBAAoB;SACnF,CAAC;IAER,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,6DAA6D,CAAC,CAAC;IAEtF,MAAM,IAAI,GAA4B,EAAE,GAAG,UAAU,EAAwC,CAAC;IAE9F,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YACjD,OAAO,EACL,UAAU,CAAC,KAAK,GAAG,CAAC;gBAClB,CAAC,CAAC,iDAAiD,UAAU,CAAC,KAAK,wBAAwB;gBAC3F,CAAC,CAAC,8DAA8D;YACpE,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,SAAS;QACnB,OAAO,EACL,GAAG,UAAU,CAAC,OAAO,uBAAuB,UAAU,CAAC,OAAO,YAAY;YAC1E,GAAG,UAAU,CAAC,KAAK,QAAQ;QAC7B,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI;KACL,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,GAAG,CAAC,KAAe,EAAE,KAAK,GAAG,EAAE;IACtC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM,GAAG,KAAK,oBAAoB,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,WAAW,CAAC,EAAa,EAAE,QAAqC;IAC7E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,mEAAmE;YAC5E,OAAO,EAAE,CAAC,kEAAkE,CAAC;SAC9E,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,OAAO,IAAI,MAAM,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5D,2EAA2E;QAC3E,oDAAoD;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC3C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,MAAM,uCAAuC,KAAK,yCAAyC,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qDAAqD;YAC9D,OAAO,EAAE,CAAC,6EAA6E,CAAC;SACzF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,uDAAuD;YAClF,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC;gBACzD,GAAG,QAAQ;gBACX,sFAAsF;gBACtF,qFAAqF;aACtF,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,gDAAgD;YAC7F,OAAO,EAAE,GAAG,CAAC;gBACX,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,QAAQ;gBACX,yFAAyF;aAC1F,CAAC;YACF,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;KACxF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EAAa;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;yBAIqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,EAAa;IACxC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;yBAKqB,CACtB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,wEAAwE;QAC/F,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAAa;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;sBAIkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,wCAAwC;SAClD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,iEAAiE;QACxF,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChD,4FAA4F;YAC5F,yEAAyE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;2EACuE,CACxE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,4CAA4C,CAAC,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1C,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,mCAAmC;SACzD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,+CAA+C;QACtE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7B,8FAA8F;SAC/F;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAAa;IAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;;;sBAKkB,CACnB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC/E,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,IAAI;YACd,OAAO,EACL,KAAK,KAAK,GAAG;gBACX,CAAC,CAAC,oCAAoC;gBACtC,CAAC,CAAC,6CAA6C;SACpD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,yCAAyC;QAChE,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1B,4FAA4F;YAC5F,0DAA0D;YAC1D,2GAA2G;SAC5G;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,IAAI,GAAG,uBAAuB,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAC1B;;yDAEqD,CACtD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;IAC1C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,SAAS;QACnB,OAAO,EACL,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,+EAA+E;YACjF,CAAC,CAAC,wCAAwC,OAAO,kDAAkD;QACvG,OAAO,EAAE;YACP,gFAAgF;YAChF,gCAAgC;YAChC,wKAAwK;SACzK;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAMzB;;;;;;gCAM4B,CAC7B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,gEAAgE;QACvF,OAAO,EAAE,IAAI,CAAC,GAAG,CACf,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,cAAc,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAC5F;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,EAAa;IACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CACzB;;;4BAGwB,CACzB,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC5F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,sCAAsC;QAC7D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,aAAa,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,EAAa;IAC1C,MAAM,SAAS,GACb,CAAC,MAAM,MAAM,CACX,EAAE,EACF;;;SAGG,CACJ,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,wBAAwB;YACjC,OAAO,EAAE,CAAC,yEAAyE,CAAC;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;2DAEuD,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,GAAG,GACP,CAAC,MAAM,MAAM,CACX,EAAE,EACF,2GAA2G,CAC5G,CAAC,KAAK,IAAI,CAAC;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAE1G,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAC7B;;;;;wDAKoD,CACrD,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAC5B;;;;;+FAK2F,CAC5F,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,oEAAoE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAS,EAAE,EAAE,sCAAsC,CAAC,CAAC;QAC9E,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,gBAAgB,IAAI,IAAI,GAAG,kBAAkB;SACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,gDAAgD;QACzE,OAAO,EAAE,MAAM;KAChB,CAAC;AACJ,CAAC"}

package/dist/schema.d.ts

@@ -11,5 +11,5 @@
  * every package of this repository; `tests/cli/package.test.ts` keeps the two
  * equal.
  */
-export declare const SCHEMA_MIN = "0.7.0";
+export declare const SCHEMA_MIN = "0.8.0";
 //# sourceMappingURL=schema.d.ts.map

package/dist/schema.js

@@ -11,5 +11,5 @@
  * every package of this repository; `tests/cli/package.test.ts` keeps the two
  * equal.
  */
-export const SCHEMA_MIN = '0.7.0';
+export const SCHEMA_MIN = '0.8.0';
 //# sourceMappingURL=schema.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ekwo-os",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Install and operate Ekwo OS on your own Supabase project: npx ekwo-os init.",
   "keywords": ["accounting", "supabase", "postgres", "migrations", "cli", "bookkeeping", "ekwo"],
   "license": "AGPL-3.0-only",
@@ -10,7 +10,7 @@
   "bugs": { "url": "https://github.com/Ekwo-ai/ekwo-os/issues" },
   "type": "module",
   "engines": { "node": ">=20" },
-  "ekwo": { "schemaMin": "0.7.0" },
+  "ekwo": { "schemaMin": "0.8.0" },
   "files": ["dist", "schema", "README.md"],
   "bin": { "ekwo": "./dist/bin.js" },
   "main": "./dist/index.js",
@@ -23,7 +23,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@ekwo-ai/core": "^0.7.0",
+    "@ekwo-ai/core": "^0.8.0",
     "postgres": "^3.4.5"
   }
 }