plumb-fhir 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 0.9.0 (2026-10-05)
+
+Faster and more useful `validate`, and config and credentials that fit a
+monorepo. The checker changes, so the next `push` redeploys it.
+
+- **`validate` counts records on each type's line**, not profile checks: a
+  record stamped with a profile and its parent was counted twice, so a type
+  could read `334 of 334 read, all 340 passed`. It now reads `all 331
+  stamped passed`, and each profile's line still counts its checks (#121).
+- **`--env-file <path>`** on `validate` and `push` reads credentials and
+  secrets from a dotenv file, as Node's `--env-file` does: repeatable, later
+  files win, and a variable already set wins over every file. Node refuses
+  `--env-file` in `NODE_OPTIONS` and cannot run a package manager's shell
+  shim, so this was the only short way (#120).
+- **A config Node cannot load loads with the project's tsx** when it has one
+  installed, so in a workspace `plumb.config.ts` can import a sibling package
+  that exports TypeScript source, and use `tsconfig` path aliases and `enum`.
+  Node still loads every config it can, so tsx is never loaded for one that
+  worked before. Without tsx, importing TypeScript from `node_modules` is now
+  a named `unsupported-syntax` error suggesting tsx (#114).
+- **`validate` and `push`'s gate read only resources with a selected stamp**
+  (`_profile=<selected URLs>`), and count the rest by query, so one narrow
+  profile on a large type no longer reads the whole table: selecting one
+  Observation profile read every stored Observation, 100 per async job.
+  Resources stamped only with other profiles are counted together; `plumb
+  validate --full` reads everything to break them down into silent stamps
+  and profiles not selected, as every run did before. A type of more than one
+  page prints its progress (#127).
+- **`plumb validate --unstamped`** forecasts what would fail once unstamped
+  resources are stamped: the checker routes each one with the config's
+  routing rows, as the generated `route` does, and checks it against what
+  `createProfiled` would stamp. Resources routing to no profile, or to
+  several, are counted by reason. The forecast is reported beside the
+  results and never fails the run (#123).
+
+## 0.8.0 (2026-10-05)
+
+- **`plumb check`** reports every `MedplumClient` read or write of a type a
+  selected profile fully holds that goes around `readProfiled`,
+  `searchProfiled`, `createProfiled`, `updateProfiled` or `stampProfiled`,
+  by the types the compiler infers, so an inferred write is found as surely as
+  a literal one. A committed baseline lets a project adopt it with a backlog:
+  only new or grown findings fail. `// plumb-check: <reason>` marks a
+  deliberate exception. It needs the project's TypeScript 5 or 6 (design 07).
+- **`stampProfiled` returns its resource branded** (`T & Stamped`, an optional
+  unique-symbol property), which `check` reads to accept a stamped write
+  through a variable. Callers see no difference.
+- `check` in the config: `tsconfig`, `baseline` and `ignore`.
 ## 0.7.0 (2026-10-05)
 
 - **`stampProfiled(resource, options?)`** returns the copy `createProfiled`

package/README.md

@@ -58,8 +58,11 @@ export default defineConfig({
   did not write.
 
 The config is loaded by Node itself, which strips the types, so TypeScript-only
-syntax such as `enum`, relative imports without `.ts`, and `tsconfig` path
-aliases are not available in it.
+syntax such as `enum`, relative imports without `.ts`, `tsconfig` path aliases
+and packages that export TypeScript source are not available in it. When the
+project has `tsx` installed, Plumb loads with it whatever Node cannot, and
+all of these work: a workspace can import its access policies from the
+package that defines them.
 
 **3. Generate:**
 
@@ -379,6 +382,61 @@ read would refuse. History is not offered typed: an old version may predate
 its stamp, so read it with `medplum.readHistory` and `asProfiled` it if you
 must.
 
+## Find code that goes around Plumb
+
+The profiled reads and writes only help where they are called. `plumb check`
+reads your code the way the compiler does and reports every `MedplumClient`
+read or write of a profiled type that does not go through them, including a
+write whose type is only inferred:
+
+```ts
+export default defineConfig({
+  // …igs, profiles, out
+  check: {
+    tsconfig: ['apps/web/tsconfig.json'],
+    baseline: './plumb-check-baseline.json',
+    ignore: ['**/*.test.ts', '**/*.stories.tsx'],
+  },
+});
+```
+
+```bash
+npx plumb check
+```
+
+```text
+plumb check
+✖ check     2 new, 248 in the baseline, in 2767 files   6.2s
+    apps/web/src/lib/goals/goal.ts:41:10  readResource Goal  → readProfiled
+    apps/web/src/lib/coverage/save.ts:90:5  createResource Coverage  → createProfiled, updateProfiled or stampProfiled
+Failed in 6.2s
+```
+
+- **What it reports:** `readResource`, `searchResources`, `searchOne`,
+  `searchResourcePages`, `createResource`, `updateResource`, `upsertResource`
+  and `createResourceIfNoneExist` on a `MedplumClient` (or a class deriving
+  from it), for a type every resource of which a selected profile holds: one
+  with a profile that routes on no keys, or a `defaultProfile`. A type whose
+  profiles are keyed on content (one code of Observation) is not reported, and
+  neither is `string` or `ResourceType`.
+- **A stamped write passes,** through a variable too: `stampProfiled` returns
+  its resource branded, and `check` reads the brand from the type.
+- **A deliberate exception** takes a comment with a reason on the line before:
+  `// plumb-check: the backfill reads unstamped records to stamp them`.
+- **The baseline** is a committed count per file, method and type. `check`
+  fails only when a count grows or a new one appears, so new raw access is
+  refused at once while the backlog shrinks. `--update-baseline` records
+  fixes; it refuses growth unless `--allow-growth` is given.
+- **Paths** in the output, the baseline and `ignore` are relative to the
+  deepest folder holding the config and every tsconfig, so a monorepo's config
+  in one package checks code in another.
+- **TypeScript:** `check` compiles with your project's own `typescript`, which
+  needs its compiler API: TypeScript 5 or 6. TypeScript 7's native package has
+  none yet, and `check` exits 2 on it.
+
+Exit codes: 0 when nothing is new, 1 when something is (or the baseline would
+grow), 2 for usage, config and set-up errors.
+
 ## Check stored data, then load profiles
 
 Medplum validates a resource when it is written, and never again. Tightening a
@@ -408,6 +466,10 @@ export default defineConfig({
 });
 ```
 
+Set the variables in the shell, or keep them in a gitignored dotenv file and
+pass it with `--env-file .env` (repeatable; later files win, and a variable
+already set wins over every file).
+
 **2. Give Plumb a client.** Create a ClientApplication in the project for CI,
 and make its project membership an admin: `push` creates Plumb's checker bot
 through Medplum's admin endpoint, reads bot memberships, and writes Bot,
@@ -430,8 +492,8 @@ plumb validate --env prod
 ✔ checker   plumb-checker 0.6.0 installed   60ms
 ✔ profiles  1 selected, none shadowed   80ms
 ✖ validate  1 of 1 profiles would fail   38.4s
-    Patient: 12400 of 12400 read, 300 of 12360 fail; 40 unstamped; silent stamps: 3 url|version
-      us-core-patient   12360 checked, 300 failures
+    Patient: 12400 of 12400 read, 300 of 12357 stamped fail; 40 unstamped; 3 stamped only with profiles not selected (--full breaks them down)
+      us-core-patient   12357 checked, 300 failures
         Patient.identifier: Missing required property   (300)
 Failing ids: .plumb/validate-prod.json (gitignored)
 Failed in 40.8s
@@ -445,14 +507,30 @@ Failed in 40.8s
 - **Against the versions in `plumb.config.ts`,** not what the project has
   loaded: it answers "what would fail if we loaded these?"
 - **Each resource is checked against the selected profiles it is stamped
-  with** (`meta.profile`). Resources with no stamp are counted, not checked.
-  Silent stamps, which today validate against nothing, are counted too: a
-  profile URL the project does not hold, a `url|version` stamp (Medplum
-  matches bare URLs only) and an empty `meta.profile`.
+  with** (`meta.profile`). The bot reads only resources carrying a selected
+  stamp, so one narrow profile on a large type reads only what carries it.
+  The rest are counted by query: resources with no stamp, and those stamped
+  only with other profiles.
+- **`--full` reads every resource** of each type to break those other stamps
+  down: silent stamps, which today validate against nothing (a profile URL
+  the project does not hold, or a `url|version` stamp, since Medplum matches
+  bare URLs only), and stamps of profiles the project holds but the config
+  does not select. Run it when the report counts any.
+- **`--unstamped` forecasts what stamping would break.** Before moving
+  writes to `createProfiled` or backfilling stamps, `plumb validate --env prod
+  --unstamped` also reads each unstamped resource, routes it as the generated
+  `route` does, and checks it against what `createProfiled` would stamp. The
+  report adds `if stamped: 40 of 2,295 routed would fail; 12 route to no
+  profile` under each type, with the reasons. It is a forecast: the exit
+  code still reflects stamped data only. Defaults the config does not select
+  have no definition to check against, so only selected profiles are checked.
 - **Empty is never ambiguous.** Each type reports how many resources the bot
   read against how many exist, so "all passed", "none carries a selected
   profile", "none stored" and "0 of N readable" (an AccessPolicy that hides
   them) read differently.
+- **A type counts records; a profile counts checks.** A record stamped with a
+  profile and its parent is checked against each, so it appears once on the
+  type's line (`all 331 stamped passed`) and once under each profile.
 - **Shadowed profiles** fail the check: more than one StructureDefinition for
   a selected URL, of which Medplum enforces the one whose version sorts last
   as text, so `1.9.0` beats `1.10.0`.
@@ -460,7 +538,8 @@ Failed in 40.8s
   CI logs or `--json`. The `.plumb` folder ignores itself in git.
 - **Large projects:** the bot checks one page per run, as an async job, and
   the file saves each page; `--resume` continues an interrupted run from its
-  last page.
+  last page. A type of more than one page prints its progress
+  (`Observation: 4,300 of 45,213 read`).
 - **Exit codes:** 0 when nothing fails; 1 when something would fail, a type
   could not be read, or a profile is shadowed; 2 for usage, config and
   connection errors, and when the checker is missing or from another Plumb

package/dist/checker.cjs

@@ -1659,12 +1659,37 @@ var pd = vt();
 var ri = `${Mt}/fhir/StructureDefinition/patient-preferredPharmacy`;
 var Kd = { wk: 1440 * 7, d: 1440, h: 60, min: 1 };
 
+// src/emit/routes.ts
+function routeTo(rows, resource) {
+  const fields = resource;
+  const matched = rows.filter(
+    (row) => row.keys.every(([element, patterns]) => patterns.some((p2) => holds(fields[element], p2)))
+  );
+  const best = matched.filter((row) => !matched.some((o) => o.parents.includes(row.profile)));
+  if (best.length === 1 && best[0]) return { profile: best[0].profile };
+  return { refused: best.length === 0 ? "none" : "ambiguous" };
+}
+function holds(value, pattern) {
+  if (Array.isArray(value) && !Array.isArray(pattern)) return value.some((v2) => holds(v2, pattern));
+  if (Array.isArray(pattern)) {
+    return Array.isArray(value) && pattern.every((p2) => value.some((v2) => holds(v2, p2)));
+  }
+  if (pattern !== null && typeof pattern === "object") {
+    if (value === null || typeof value !== "object") return false;
+    const record = value;
+    return Object.entries(pattern).every(([key, p2]) => holds(record[key], p2));
+  }
+  return value === pattern;
+}
+
 // src/checker/handler.ts
 var PAGE_SIZE = "100";
 async function handler(medplum, event) {
-  const { resourceType, profiles, definitions, cursor } = event.input;
+  const { resourceType, profiles, definitions, cursor, full, forecast } = event.input;
   const selected = load(definitions, profiles);
+  const stamped = full ? {} : { _profile: profiles.join(",") };
   const bundle = await medplum.search(resourceType, {
+    ...forecast ? { "_profile:missing": "true" } : stamped,
     _count: PAGE_SIZE,
     _sort: "_lastUpdated",
     ...cursor ? { _cursor: cursor } : {}
@@ -1672,9 +1697,35 @@ async function handler(medplum, event) {
   const next = bundle.link?.find((l) => l.relation === "next")?.url;
   const resources = (bundle.entry ?? []).flatMap((e) => e.resource ? [e.resource] : []);
   await loadNestedTypes(medplum, resources);
-  const page = checkPage(resources, selected);
   const nextCursor = next ? new URL(next).searchParams.get("_cursor") : null;
-  return { ...page, ...nextCursor ? { next: nextCursor } : {} };
+  const after = nextCursor ? { next: nextCursor } : {};
+  if (forecast) return { ...forecastPage(resources, selected, forecast), ...after };
+  const page = checkPage(resources, selected);
+  const totals = full || cursor ? void 0 : await count(medplum, resourceType, stamped);
+  return { ...page, ...totals ? { totals } : {}, ...after };
+}
+function forecastPage(resources, selected, forecast) {
+  const unrouted = { none: 0, ambiguous: 0 };
+  const routed = [];
+  for (const resource of resources) {
+    const route = routeTo(forecast.routes, resource);
+    if ("refused" in route) unrouted[route.refused]++;
+    else {
+      const profile = (forecast.stamps[route.profile] ?? []).filter((url) => selected.has(url));
+      routed.push({ ...resource, meta: { ...resource.meta, profile } });
+    }
+  }
+  const page = checkPage(routed, selected);
+  return { ...page, read: resources.length, unrouted };
+}
+async function count(medplum, resourceType, stamped) {
+  const total = async (params) => (await medplum.search(resourceType, { ...params, _summary: "count" })).total ?? 0;
+  const [readable, unstamped, selected] = await Promise.all([
+    total({}),
+    total({ "_profile:missing": "true" }),
+    total(stamped)
+  ]);
+  return { readable, unstamped, stamped: selected };
 }
 function load(definitions, urls) {
   const { base, profiles } = JSON.parse(
@@ -1707,6 +1758,8 @@ function checkPage(resources, selected) {
   const result = {
     core: Dn,
     read: resources.length,
+    stamped: 0,
+    failing: 0,
     unstamped: 0,
     silent: { versioned: 0, empty: 0 },
     otherStamps: {},
@@ -1720,14 +1773,17 @@ function checkPage(resources, selected) {
     else {
       const tally = tallies.get(url) ?? new Tally();
       tallies.set(url, tally);
-      tally.add(resource, profile);
+      return { checked: true, passed: tally.add(resource, profile) };
     }
+    return { checked: false, passed: true };
   };
   for (const resource of resources) {
     const stamps = resource.meta?.profile;
     if (stamps === void 0) result.unstamped++;
     else if (stamps.length === 0) result.silent.empty++;
-    for (const url of stamps ?? []) stamp(url, resource);
+    const checks = (stamps ?? []).map((url) => stamp(url, resource));
+    if (checks.some((c2) => c2.checked)) result.stamped++;
+    if (checks.some((c2) => !c2.passed)) result.failing++;
   }
   for (const [url, tally] of tallies) result.profiles[url] = tally.result();
   return result;
@@ -1736,6 +1792,7 @@ var Tally = class {
   checked = 0;
   failing = [];
   reasons = /* @__PURE__ */ new Map();
+  /** Checks the resource, returning whether it passed. */
   add(resource, profile) {
     this.checked++;
     const failures = errors(resource, profile);
@@ -1750,6 +1807,7 @@ ${message}`;
       reason.count++;
       this.reasons.set(key, reason);
     }
+    return failures.length === 0;
   }
   result() {
     const reasons = [...this.reasons.values()].sort((a, b) => b.count - a.count);

package/dist/cjs/check.d.ts

@@ -0,0 +1,89 @@
+import type * as TS from 'typescript5';
+import type { PlumbConfig } from './config.js';
+import { type Route } from './emit/routes.js';
+/** A `MedplumClient` read or write of a profiled type that goes around Plumb. */
+export interface Finding {
+    /** Relative to the config's folder, with forward slashes. */
+    file: string;
+    line: number;
+    column: number;
+    method: string;
+    /** The profiled resource types the call can touch, sorted. */
+    resourceTypes: string[];
+    /** What to call instead, or why the finding stands. */
+    instead: string;
+}
+export interface FindOptions {
+    /** The project's TypeScript module, with its compiler API. */
+    ts: typeof TS;
+    /** The folder findings are relative to, and `ignore` is matched from. */
+    base: string;
+    tsconfig: string[];
+    /** Resource types a selected profile constrains. */
+    profiledTypes: ReadonlySet<string>;
+    /** The generated folder, never checked. */
+    out: string;
+    ignore?: string[];
+}
+/**
+ * Compiles each project and reports every raw `MedplumClient` read or write of
+ * a profiled type, with the type the checker infers, not the text written.
+ */
+export declare function findRawAccess(options: FindOptions): {
+    findings: Finding[];
+    files: number;
+};
+/** Accepted findings, counted per file, method and resource types. */
+export type Baseline = Record<string, number>;
+export declare function countFindings(findings: Finding[]): Baseline;
+export interface BaselineComparison {
+    /** Findings under a key that is new or grew: every one of them, since a line cannot be told apart. */
+    fresh: Finding[];
+    /** How many findings the baseline accepts that are now gone. */
+    fixed: number;
+    /** Findings the baseline accepts. */
+    accepted: number;
+}
+/** A finding fails only where its key's count exceeds the baseline's. */
+export declare function compareBaseline(findings: Finding[], baseline: Baseline): BaselineComparison;
+export interface CheckResult {
+    ok: boolean;
+    findings: Finding[];
+    comparison: BaselineComparison;
+    files: number;
+    /** Set when `updateBaseline` wrote the file. */
+    baselineWritten?: boolean;
+    errors: {
+        code: 'no-check-config' | 'no-compiler-api' | 'no-lock' | 'baseline-growth';
+        message: string;
+    }[];
+}
+export interface CheckOptions {
+    config: PlumbConfig;
+    configPath: string;
+    /** The project's TypeScript; resolved from the config's folder by default. */
+    ts?: typeof TS;
+    cacheDir?: string;
+    updateBaseline?: boolean;
+    allowGrowth?: boolean;
+}
+/**
+ * `plumb check`: loads the selected profiles for the types they constrain,
+ * compiles the configured projects, and compares what it finds with the
+ * baseline, or rewrites the baseline.
+ */
+export declare function checkProject(options: CheckOptions): Promise<CheckResult>;
+/**
+ * The folder findings and `ignore` globs are relative to: the deepest one
+ * holding the config and every tsconfig, so a monorepo's config in one package
+ * checks code in another, and baseline keys do not depend on where it runs.
+ */
+export declare function checkRoot(configPath: string, tsconfig: string[]): string;
+/**
+ * The types every resource of which a selected profile holds: one with a
+ * profile that routes on no keys, or a `defaultProfile`. A profile keyed on
+ * content (one code of Observation) holds only some, so raw access to the type
+ * is not wrong and is not reported.
+ */
+export declare function enforcedTypes(routes: Record<string, Route[]>, defaultProfile?: Record<string, string[]>): Set<string>;
+//# sourceMappingURL=check.d.ts.map

package/dist/cjs/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,kBAAkB,CAAC;AAI3D,iFAAiF;AACjF,MAAM,WAAW,OAAO;IACtB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;CACjB;AAiBD,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,EAAE,EAAE,OAAO,EAAE,CAAC;IACd,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAe1F;AAoHD,sEAAsE;AACtE,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAI9C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAI3D;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,kBAAkB,CAS3F;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE;QACN,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,SAAS,GAAG,iBAAiB,CAAC;QAC5E,OAAO,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA2D9E;AAeD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAC/B,cAAc,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAM,GAC5C,GAAG,CAAC,MAAM,CAAC,CAKb"}

package/dist/cjs/checker/handler.d.ts

@@ -1,5 +1,6 @@
 import { type BotEvent, type MedplumClient } from '@medplum/core';
 import type { ResourceType } from '@medplum/fhirtypes';
+import { type Route } from '../emit/routes.js';
 /** One page's request, from `plumb validate`. */
 export interface CheckerInput {
     resourceType: ResourceType;
@@ -13,6 +14,28 @@ export interface CheckerInput {
     definitions: string;
     /** The server's `_cursor` from the previous page; the first page has none. */
     cursor?: string;
+    /**
+     * Read every resource of the type, to break down the stamps that name no
+     * selected profile. Otherwise only resources with a selected stamp are
+     * read, and the rest are counted by query.
+     */
+    full?: boolean;
+    /**
+     * Read the unstamped resources instead, and check each against what
+     * `createProfiled` would stamp it with: its type's routing rows, and each
+     * routed profile's stamps.
+     */
+    forecast?: {
+        routes: Route[];
+        stamps: Record<string, string[]>;
+    };
+}
+/** A type's counts by query, under the checker's own AccessPolicy. */
+export interface Totals {
+    readable: number;
+    unstamped: number;
+    /** Resources with a selected stamp: what the run will page through. */
+    stamped: number;
 }
 /** Resources failing for one element path and message, indexes removed. */
 export interface Reason {
@@ -29,6 +52,10 @@ export interface PageResult {
     /** The `@medplum/core` version validating, bundled into the bot. */
     core: string;
     read: number;
+    /** Resources stamped with at least one selected profile, each counted once. */
+    stamped: number;
+    /** Of those, the ones failing any of their selected profiles. */
+    failing: number;
     /** Resources with no `meta.profile`: routing's job, not validated. */
     unstamped: number;
     /** Stamps that validate against nothing: `url|version`, and `meta.profile: []`. */
@@ -39,6 +66,13 @@ export interface PageResult {
     /** Stamps naming a profile not selected, by URL: the CLI tells loaded from unknown. */
     otherStamps: Record<string, number>;
     profiles: Record<string, ProfileResult>;
+    /** On the first page of a run that is not `full`. */
+    totals?: Totals;
+    /** With `forecast`: the unstamped resources no profile, or several, would route to. */
+    unrouted?: {
+        none: number;
+        ambiguous: number;
+    };
     /** The cursor for the next page, absent on the last. */
     next?: string;
 }

package/dist/cjs/checker/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/checker/handler.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,QAAQ,EAKb,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAY,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AAMtF,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,2EAA2E;AAC3E,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC5B,OAAO,CAAC,UAAU,CAAC,CAcrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/checker/handler.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,QAAQ,EAKb,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAY,YAAY,EAAuB,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,KAAK,KAAK,EAAW,MAAM,mBAAmB,CAAC;AAMxD,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;KAAE,CAAC;CAClE;AAED,sEAAsE;AACtE,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD,2EAA2E;AAC3E,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC5B,OAAO,CAAC,UAAU,CAAC,CAoBrB"}

package/dist/cjs/commands.d.ts

@@ -1,3 +1,4 @@
+import type * as TS from 'typescript5';
 import { type Checked } from './conformance.js';
 import { type Step } from './generate.js';
 export interface CliIo {
@@ -9,12 +10,14 @@ export interface CliIo {
     stderr: (text: string) => void;
     cacheDir?: string;
     fetch?: typeof globalThis.fetch;
+    /** The TypeScript `check` compiles with; the project's own by default. */
+    typescript?: typeof TS;
 }
 /** What a step did, as one line: its name, its counts and its time. */
 export declare function formatStep(step: Step, out: string): string;
 /** Runs a command line, printing its report, and returns the exit code. */
 export declare function run(argv: string[], io: CliIo): Promise<number>;
-type Found = Pick<Checked, 'types' | 'profiles'>;
+type Found = Pick<Checked, 'types' | 'profiles' | 'forecast'>;
 /** The validate report under its step: each type, then each of its profiles and their reasons. */
 export declare function formatValidation(result: Found): string[];
 export {};

package/dist/cjs/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/commands.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAGzE,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAyDD,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,2EAA2E;AAC3E,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBpE;AAqID,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC;AAIjD,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE,CAexD"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/commands.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAGvC,OAAO,EACL,KAAK,OAAO,EAIb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAGzE,MAAM,WAAW,KAAK;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,6DAA6D;IAC7D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;CACxB;AAqED,uEAAuE;AACvE,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAe1D;AAED,2EAA2E;AAC3E,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBpE;AA+MD,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC,CAAC;AAI9D,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,EAAE,CAcxD"}

package/dist/cjs/config.d.ts

@@ -36,6 +36,17 @@ export interface PlumbConfig {
     defaultProfile?: Record<string, string[]>;
     /** What `push` writes to each environment's project besides its profiles. */
     project?: ProjectConfig;
+    /** What `plumb check` reads. */
+    check?: CheckConfig;
+}
+/** What `plumb check` reads: the project's code, for raw access to profiled types. */
+export interface CheckConfig {
+    /** The TypeScript projects to check, each compiled once; a path or several. */
+    tsconfig: string | string[];
+    /** The committed file of accepted findings; without one, every finding fails. */
+    baseline?: string;
+    /** Globs, relative to the config, of files not to check (tests, stories). */
+    ignore?: string[];
 }
 /**
  * A project's configuration, as a project admin can write it. Policies and
@@ -94,7 +105,7 @@ export interface ResolvedEnvironment {
     clientId: string;
     clientSecret: string;
 }
-export type ConfigErrorCode = 'config-not-found' | 'unsupported-syntax' | 'unresolved-import' | 'no-default-export' | 'unknown-key' | 'missing-out' | 'invalid-type' | 'invalid-ig' | 'unlisted-ig' | 'invalid-profile' | 'invalid-max-codes' | 'invalid-base-url' | 'unknown-environment' | 'missing-variable' | 'invalid-route' | 'unselected-route' | 'invalid-route-element' | 'invalid-default-profile' | 'versioned-url' | 'fsh-and-local' | 'no-sushi-config' | 'invalid-setting' | 'super-admin-field' | 'unknown-access-policy' | 'duplicate-key';
+export type ConfigErrorCode = 'config-not-found' | 'unsupported-syntax' | 'unresolved-import' | 'no-default-export' | 'unknown-key' | 'missing-out' | 'invalid-type' | 'invalid-ig' | 'unlisted-ig' | 'invalid-profile' | 'invalid-max-codes' | 'invalid-base-url' | 'unknown-environment' | 'missing-variable' | 'invalid-route' | 'unselected-route' | 'invalid-route-element' | 'invalid-default-profile' | 'versioned-url' | 'fsh-and-local' | 'no-sushi-config' | 'invalid-setting' | 'super-admin-field' | 'unknown-access-policy' | 'duplicate-key' | 'invalid-check';
 export interface ConfigError {
     code: ConfigErrorCode;
     message: string;
@@ -115,7 +126,8 @@ export declare function defineConfig(config: PlumbConfig): PlumbConfig;
 declare const PROFILE_TYPES: readonly ['Patient', 'Practitioner', 'RelatedPerson', 'Admin'];
 /**
  * Loads `plumb.config.ts` from `cwd`, or `configPath` relative to it, with
- * Node's own type stripping. `local`, `fsh` and `out` come back as absolute
+ * Node's type stripping, or the project's own tsx for what Node cannot load.
+ * `local`, `fsh` and `out` come back as absolute
  * paths, resolved against the config file's folder; with `fsh`, `local` is its
  * SUSHI output.
  */

package/dist/cjs/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,YAAY,EAEZ,MAAM,EACN,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE;QACT,0FAA0F;QAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;IAC1C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjD,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpD,sEAAsE;IACtE,qBAAqB,CAAC,EAAE;QACtB,WAAW,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE7D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAoBD,QAAA,MAAM,aAAa,YAAI,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC;AAOrF;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+C5B;AA+aD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE/E;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,mBAAmB,GAAG,sBAAsB,GAAG,6BAA6B,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA+B5F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EACnC,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACnD,WAAW,EAAE,CAiBf;AAUD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAsCvF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,YAAY,EAEZ,MAAM,EACN,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE;QACT,0FAA0F;QAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC,CAAC;IAC1C;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,6EAA6E;IAC7E,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gCAAgC;IAChC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AASD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjD,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACpD,sEAAsE;IACtE,qBAAqB,CAAC,EAAE;QACtB,WAAW,EAAE,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5C,YAAY,EAAE,MAAM,CAAC;KACtB,EAAE,CAAC;IACJ,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,YAAY,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,aAAa,GACb,cAAc,GACd,YAAY,GACZ,aAAa,GACb,iBAAiB,GACjB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAClB,uBAAuB,GACvB,yBAAyB,GACzB,eAAe,GACf,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,uBAAuB,GACvB,eAAe,GACf,eAAe,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE7D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE7D;AAqBD,QAAA,MAAM,aAAa,YAAI,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC;AAOrF;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4D5B;AA0eD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAE/E;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,mBAAmB,GAAG,sBAAsB,GAAG,6BAA6B,CAAC;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE,CA+B5F;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EACnC,QAAQ,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,mBAAmB,CAAA;CAAE,EAAE,GACnD,WAAW,EAAE,CAiBf;AAUD,yEAAyE;AACzE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAsCvF"}