@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/{src → dist}/auth/constants.js

@@ -3,7 +3,7 @@ export const AUTH_SCOPE_TABLE = "auth_scopes";
 export const AUTH_GRANT_TABLE = "auth_user_scopes";
 export const DEFAULT_TENANT_ID = "easley-family";
 export const DEFAULT_TENANT_NAME = "Easley Family";
-
 export class SubscriptionError extends Error {
-  constructor(message) { super(message); this.name = "SubscriptionError"; }
+    constructor(message) { super(message); this.name = "SubscriptionError"; }
 }
+//# sourceMappingURL=constants.js.map

package/dist/auth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC;CAClF"}

package/dist/auth/domains.d.ts

@@ -0,0 +1,3 @@
+/** Platform-owned domains are installed in every Worker; application domains append to these. */
+export declare const AUTH_DOMAINS: readonly [import("./groups/domain.js").AuthGroupsDomain, import("./scopes/domain.js").AuthScopesDomain, import("./tenants/domain.js").AuthTenantsDomain, import("./users/domain.js").AuthUsersDomain, import("./impersonation/domain.js").AuthImpersonationDomain];
+//# sourceMappingURL=domains.d.ts.map

package/dist/auth/domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.d.ts","sourceRoot":"","sources":["../../src/auth/domains.ts"],"names":[],"mappings":"AAKA,iGAAiG;AACjG,eAAO,MAAM,YAAY,oQAA+E,CAAC"}

package/dist/auth/domains.js

@@ -0,0 +1,8 @@
+import { authGroups } from "./groups/domain.js";
+import { authScopes } from "./scopes/domain.js";
+import { authTenants } from "./tenants/domain.js";
+import { authUsers } from "./users/domain.js";
+import { authImpersonation } from "./impersonation/domain.js";
+/** Platform-owned domains are installed in every Worker; application domains append to these. */
+export const AUTH_DOMAINS = [authGroups, authScopes, authTenants, authUsers, authImpersonation];
+//# sourceMappingURL=domains.js.map

package/dist/auth/domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/auth/domains.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAU,CAAC"}

package/dist/auth/encoding.d.ts

@@ -0,0 +1,7 @@
+export declare function parseJsonValue(value: unknown): unknown;
+export declare function deepEqual(left: unknown, right: unknown): boolean;
+export declare function signValue(value: string, secret: string): Promise<string>;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function base64urlDecode(value: string): Uint8Array;
+export declare function constantTimeEqual(left: unknown, right: unknown): boolean;
+//# sourceMappingURL=encoding.d.ts.map

package/dist/auth/encoding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/auth/encoding.ts"],"names":[],"mappings":"AAAA,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOtD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9E;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAIzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CASxE"}

package/dist/auth/encoding.js

@@ -0,0 +1,41 @@
+export function parseJsonValue(value) {
+    if (typeof value !== "string")
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+export function deepEqual(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+export async function signValue(value, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(value));
+    return base64url(new Uint8Array(signature));
+}
+export function base64url(bytes) {
+    return btoa(String.fromCharCode(...bytes))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+export function base64urlDecode(value) {
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/")
+        + "=".repeat((4 - value.length % 4) % 4);
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+export function constantTimeEqual(left, right) {
+    const encoder = new TextEncoder();
+    const a = encoder.encode(String(left));
+    const b = encoder.encode(String(right));
+    let result = a.length ^ b.length;
+    for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+        result |= (a[index] ?? 0) ^ (b[index] ?? 0);
+    }
+    return result === 0;
+}
+//# sourceMappingURL=encoding.js.map

package/dist/auth/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/auth/encoding.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,KAAc;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAc;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACvC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;UAC1D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAc;IAC7D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/auth/groups/d1.d.ts

@@ -0,0 +1,16 @@
+import type { AuthGroup, GroupUser, NewAuthGroup } from "./model.js";
+export interface GroupDatabaseOptions {
+    who?: string;
+}
+type Row = Record<string, unknown>;
+export declare function listGroupRows(env: unknown, { who }?: GroupDatabaseOptions): Promise<AuthGroup[]>;
+export declare function getGroupRow(env: unknown, name: string, { who }?: GroupDatabaseOptions): Promise<AuthGroup | null>;
+export declare function insertGroupRow(env: unknown, input: NewAuthGroup, { who }?: GroupDatabaseOptions): Promise<AuthGroup | null>;
+export declare function updateGroupRow(env: unknown, name: string, input: Omit<NewAuthGroup, "name">, { who }?: GroupDatabaseOptions): Promise<AuthGroup | null>;
+export declare function deleteGroupRow(env: unknown, name: string, { who }?: GroupDatabaseOptions): Promise<boolean>;
+export declare function listGroupUsersRows(env: unknown, groupName: string, { who }?: GroupDatabaseOptions): Promise<GroupUser[]>;
+export declare function listUserGroupsRows(env: unknown, userId: string, { who }?: GroupDatabaseOptions): Promise<Row[]>;
+export declare function replaceUserGroupsRows(env: unknown, userId: string, groups: readonly string[], grantedBy: string | undefined, { who }?: GroupDatabaseOptions): Promise<Row[]>;
+export declare function replaceGroupScopesRows(env: unknown, groupName: string, scopes: readonly string[], grantedBy: string | undefined, { who }?: GroupDatabaseOptions): Promise<string[]>;
+export {};
+//# sourceMappingURL=d1.d.ts.map

package/dist/auth/groups/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/d1.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAErE,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAmB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAQ1H;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3I;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAqB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAGvJ;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,GAAqB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAGnL;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAqB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQvI;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAGlJ;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAmB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAGzI;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,GAAqB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAOxM;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,EAAE,GAAqB,EAAE,GAAE,oBAAyB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAa/M"}

package/dist/auth/groups/d1.js

@@ -0,0 +1,66 @@
+import { createD1 } from "../../core/database/index.js";
+export async function listGroupRows(env, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT name,display_name,description,active,created_at,updated_at FROM auth_groups ORDER BY display_name COLLATE NOCASE").all();
+    const groups = result.results ?? [];
+    if (!groups.length)
+        return groups;
+    const scopes = await createD1(env, { who }).prepare("SELECT group_name,scope_name FROM auth_group_scopes ORDER BY group_name,scope_name").all();
+    const byGroup = new Map();
+    for (const row of scopes.results ?? [])
+        byGroup.set(row.group_name, [...(byGroup.get(row.group_name) ?? []), row.scope_name]);
+    return groups.map((group) => ({ ...group, scopes: byGroup.get(group.name) ?? [] }));
+}
+export async function getGroupRow(env, name, { who = "system:read" } = {}) {
+    return await createD1(env, { who }).prepare("SELECT name,display_name,description,active,created_at,updated_at FROM auth_groups WHERE name=?").bind(name).first();
+}
+export async function insertGroupRow(env, input, { who = "system:update" } = {}) {
+    await createD1(env, { who }).prepare("INSERT INTO auth_groups (name,display_name,description) VALUES (?,?,?)").bind(input.name, input.display_name, input.description ?? "").run();
+    return getGroupRow(env, input.name, { who });
+}
+export async function updateGroupRow(env, name, input, { who = "system:update" } = {}) {
+    await createD1(env, { who }).prepare("UPDATE auth_groups SET display_name=?,description=?,updated_at=CURRENT_TIMESTAMP WHERE name=?").bind(input.display_name, input.description ?? "", name).run();
+    return getGroupRow(env, name, { who });
+}
+export async function deleteGroupRow(env, name, { who = "system:update" } = {}) {
+    const existing = await getGroupRow(env, name, { who });
+    if (!existing)
+        return false;
+    const db = createD1(env, { who });
+    const membership = await db.prepare("SELECT 1 FROM auth_user_groups WHERE group_name=? LIMIT 1").bind(name).first();
+    if (membership)
+        throw new TypeError("Group must have no members before it can be deleted.");
+    await db.prepare("DELETE FROM auth_groups WHERE name=?").bind(name).run();
+    return true;
+}
+export async function listGroupUsersRows(env, groupName, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT u.id,u.email,u.display_name,ug.granted_at FROM auth_user_groups ug JOIN auth_users u ON u.id=ug.user_id WHERE ug.group_name=? ORDER BY u.display_name COLLATE NOCASE,u.email").bind(groupName).all();
+    return result.results ?? [];
+}
+export async function listUserGroupsRows(env, userId, { who = "system:read" } = {}) {
+    const result = await createD1(env, { who }).prepare("SELECT group_name,granted_at FROM auth_user_groups WHERE user_id=? ORDER BY group_name").bind(userId).all();
+    return result.results ?? [];
+}
+export async function replaceUserGroupsRows(env, userId, groups, grantedBy, { who = "system:update" } = {}) {
+    const db = createD1(env, { who });
+    await db.batch([
+        db.prepare("DELETE FROM auth_user_groups WHERE user_id=?").bind(userId),
+        ...[...new Set(groups)].map((group) => db.prepare("INSERT INTO auth_user_groups (user_id,group_name,granted_by) VALUES (?,?,?)").bind(userId, group, grantedBy ?? null)),
+    ]);
+    return listUserGroupsRows(env, userId, { who });
+}
+export async function replaceGroupScopesRows(env, groupName, scopes, grantedBy, { who = "system:update" } = {}) {
+    const db = createD1(env, { who });
+    const unique = [...new Set(scopes)];
+    if (unique.length) {
+        const placeholders = unique.map(() => "?").join(",");
+        const result = await db.prepare(`SELECT name FROM auth_scopes WHERE name IN (${placeholders})`).bind(...unique).all();
+        if ((result.results ?? []).length !== unique.length)
+            throw new TypeError("One or more scopes do not exist.");
+    }
+    await db.batch([
+        db.prepare("DELETE FROM auth_group_scopes WHERE group_name=?").bind(groupName),
+        ...unique.map((scope) => db.prepare("INSERT INTO auth_group_scopes (group_name,scope_name,granted_by) VALUES (?,?,?)").bind(groupName, scope, grantedBy ?? null)),
+    ]);
+    return unique;
+}
+//# sourceMappingURL=d1.js.map

package/dist/auth/groups/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../../src/auth/groups/d1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AASxD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAY,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAAyB,EAAE;IAClG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,yHAAyH,CAAC,CAAC,GAAG,EAA+B,CAAC;IAClN,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,EAA8C,CAAC;IAC5L,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9H,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,IAAY,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAAyB,EAAE;IAC9G,OAAO,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,iGAAiG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAsB,CAAC;AACxL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,KAAmB,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAAyB,EAAE;IAC1H,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACnL,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAAY,EAAE,KAAiC,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAAyB,EAAE;IACtJ,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,+FAA+F,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACpM,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAAY,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAAyB,EAAE;IACnH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IACpH,IAAI,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,SAAiB,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAAyB,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,qLAAqL,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAA+B,CAAC;IAC9R,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,MAAc,EAAE,EAAE,GAAG,GAAG,aAAa,EAAE,GAAyB,EAAE;IACvH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,wFAAwF,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAyB,CAAC;IACxL,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAY,EAAE,MAAc,EAAE,MAAyB,EAAE,SAA6B,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAAyB,EAAE;IACtL,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACvE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;KACzK,CAAC,CAAC;IACH,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAY,EAAE,SAAiB,EAAE,MAAyB,EAAE,SAA6B,EAAE,EAAE,GAAG,GAAG,eAAe,EAAE,GAAyB,EAAE;IAC1L,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,+CAA+C,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,EAAoB,CAAC;QACxI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9E,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;KAClK,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/groups/domain.d.ts

@@ -0,0 +1,8 @@
+import { AppDomain } from "../../domain/index.js";
+import type { AuthGroup, GroupAuthorizationState } from "./model.js";
+/** The complete auth.groups capability, suitable for core or downstream app manifests. */
+export declare class AuthGroupsDomain extends AppDomain<AuthGroup, unknown, GroupAuthorizationState> {
+    constructor();
+}
+export declare const authGroups: AuthGroupsDomain;
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/groups/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAO7E,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAerE,0FAA0F;AAC1F,qBAAa,gBAAiB,SAAQ,SAAS,CAC7C,SAAS,EACT,OAAO,EACP,uBAAuB,CACxB;IACC,cAiCC;CACF;AA8DD,eAAO,MAAM,UAAU,kBAAyB,CAAC"}

package/dist/auth/groups/domain.js

@@ -0,0 +1,99 @@
+import { AppDomain } from "../../domain/index.js";
+import { badRequest, errorMessage, notFound, readJsonObject, } from "../../api/http.js";
+import { createGroup, deleteGroup, getGroup, listGroupUsers, listGroups, replaceGroupScopes, updateGroup, } from "./service.js";
+import { GroupListView } from "./views/list.js";
+import { AUTH_GROUP_REPOSITORY } from "../repositories.js";
+/** The complete auth.groups capability, suitable for core or downstream app manifests. */
+export class AuthGroupsDomain extends AppDomain {
+    constructor() {
+        super({
+            name: "auth.groups",
+            basePath: "/api/admin/groups",
+            auth: "user",
+            scopes: "groups:read",
+            repositories: [AUTH_GROUP_REPOSITORY],
+        });
+        this.view("list", GroupListView);
+        this.route({
+            method: "GET",
+            handler: ({ env, identity }) => listGroups(env, { who: identity.who }).then((groups) => Response.json({ groups })),
+        });
+        this.route({ method: "POST", csrf: true, scopes: "groups:manage", handler: create });
+        this.route({ method: "GET", path: "/:groupName", handler: get });
+        this.route({
+            method: ["PUT", "PATCH"],
+            path: "/:groupName",
+            csrf: true,
+            scopes: "groups:manage",
+            handler: update,
+        });
+        this.route({ method: "DELETE", path: "/:groupName", csrf: true, scopes: "groups:manage", handler: remove });
+        this.route({
+            method: "GET",
+            path: "/:groupName/users",
+            handler: ({ env, identity, params }) => listGroupUsers(env, params.groupName, { who: identity.who }).then((users) => Response.json({ users })),
+        });
+        this.route({ method: "PUT", path: "/:groupName/scopes", csrf: true, scopes: "groups:manage", handler: setScopes });
+    }
+}
+async function setScopes({ request, env, identity, state, params }) {
+    try {
+        const body = await readJsonObject(request);
+        if (!Array.isArray(body?.scopes) || !body.scopes.every((scope) => typeof scope === "string"))
+            return badRequest("scopes must be an array");
+        const scopes = await replaceGroupScopes(env, params.groupName, body.scopes, undefined, { who: identity.who });
+        return Response.json({ scopes });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function create({ request, env, identity }) {
+    try {
+        const group = await createGroup(env, await readJsonObject(request), { who: identity.who });
+        return Response.json({ group }, { status: 201 });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function get({ env, identity, params }) {
+    try {
+        const group = await getGroup(env, params.groupName, { who: identity.who });
+        return group ? Response.json({ group }) : notFound("Group not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function update({ request, env, identity, params }) {
+    try {
+        const body = await readJsonObject(request);
+        if (request.method === "PATCH") {
+            const current = await getGroup(env, params.groupName, { who: identity.who });
+            if (!current)
+                return notFound("Group not found.");
+            const group = await updateGroup(env, params.groupName, {
+                display_name: body?.display_name ?? current.display_name,
+                description: body?.description ?? current.description,
+            }, { who: identity.who });
+            return Response.json({ group });
+        }
+        const group = await updateGroup(env, params.groupName, body, { who: identity.who });
+        return group ? Response.json({ group }) : notFound("Group not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function remove({ env, identity, params }) {
+    try {
+        const deleted = await deleteGroup(env, params.groupName, { who: identity.who });
+        return deleted ? new Response(null, { status: 204 }) : notFound("Group not found.");
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+export const authGroups = new AuthGroupsDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/groups/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/groups/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,WAAW,EACX,QAAQ,EACR,cAAc,EACd,UAAU,EACV,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,0FAA0F;AAC1F,MAAM,OAAO,gBAAiB,SAAQ,SAIrC;IACC;QACE,KAAK,CAAC;YACJ,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,mBAAmB;YAC7B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,aAAa;YACrB,YAAY,EAAE,CAAC,qBAAqB,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAC7B,UAAU,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;YACxB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CACrC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CACzB;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACrH,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAW;IACzE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAAE,OAAO,UAAU,CAAC,yBAAyB,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAW;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IAC/D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,OAAO;gBAAE,OAAO,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE;gBACrD,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO,CAAC,YAAY;gBACxD,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,OAAO,CAAC,WAAW;aACtD,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAC7B,GAAG,EACH,MAAM,CAAC,SAAS,EAChB,IAAI,EACJ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CACtB,CAAC;QACF,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,gBAAgB,EAAE,CAAC"}

package/dist/auth/groups/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./policy.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/groups/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/groups/index.js

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./policy.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/groups/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/groups/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/groups/model.d.ts

@@ -0,0 +1,38 @@
+/** Domain shape for a named authorization group. */
+export interface AuthGroup {
+    name: string;
+    display_name: string;
+    description: string;
+    created_at?: string;
+    updated_at?: string;
+    active?: boolean | number;
+    scopes?: readonly string[];
+}
+/** A membership is deliberately separate from the group definition. */
+export interface GroupMembership {
+    user_id: string;
+    group_name: string;
+    granted_by?: string | null;
+    granted_at?: string;
+}
+export interface GroupUser {
+    id: string;
+    email?: string | null;
+    display_name?: string | null;
+    granted_at?: string;
+}
+export interface NewAuthGroup {
+    name: string;
+    display_name: string;
+    description?: string;
+}
+export type GroupId = string;
+export interface GroupAuthorizationState {
+    user?: {
+        auth_strategy?: string;
+    } | null;
+    authUser?: {
+        is_admin?: boolean;
+    } | null;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/groups/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/model.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C"}

package/dist/auth/groups/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/groups/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/groups/model.ts"],"names":[],"mappings":""}

package/dist/auth/groups/policy.d.ts

@@ -0,0 +1,5 @@
+import type { GroupAuthorizationState } from "./model.js";
+/** Group administration is an administrator capability, not a property of the route folder. */
+export declare function canManageGroups(state: GroupAuthorizationState): boolean;
+export declare function requireGroupAdministrator(state: GroupAuthorizationState): GroupAuthorizationState["authUser"];
+//# sourceMappingURL=policy.d.ts.map

package/dist/auth/groups/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAEvE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAE7G"}

package/dist/auth/groups/policy.js

@@ -0,0 +1,8 @@
+/** Group administration is an administrator capability, not a property of the route folder. */
+export function canManageGroups(state) {
+    return state.user?.auth_strategy === "http_basic" || Boolean(state.authUser?.is_admin);
+}
+export function requireGroupAdministrator(state) {
+    return canManageGroups(state) ? state.authUser ?? null : null;
+}
+//# sourceMappingURL=policy.js.map

package/dist/auth/groups/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/auth/groups/policy.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,OAAO,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC"}

package/dist/auth/groups/service.d.ts

@@ -0,0 +1,20 @@
+import type { GroupAuthorizationState, AuthGroup, GroupUser } from "./model.js";
+export interface GroupServiceOptions {
+    who?: string;
+}
+export declare function listGroups(env: unknown, options?: GroupServiceOptions): Promise<AuthGroup[]>;
+export declare function getGroup(env: unknown, name: unknown, options?: GroupServiceOptions): Promise<AuthGroup | null>;
+export declare function createGroup(env: unknown, input: unknown, options?: GroupServiceOptions): Promise<AuthGroup | null>;
+export declare function updateGroup(env: unknown, name: unknown, input: unknown, options?: GroupServiceOptions): Promise<AuthGroup | null>;
+export declare function deleteGroup(env: unknown, name: unknown, options?: GroupServiceOptions): Promise<boolean>;
+export declare function listGroupUsers(env: unknown, name: unknown, options?: GroupServiceOptions): Promise<GroupUser[]>;
+export declare function listUserGroups(env: unknown, userId: string, options?: GroupServiceOptions): Promise<{
+    [x: string]: unknown;
+}[]>;
+export declare function replaceUserGroups(env: unknown, userId: string, groups: readonly unknown[], grantedBy?: string, options?: GroupServiceOptions): Promise<{
+    [x: string]: unknown;
+}[]>;
+export declare function replaceGroupScopes(env: unknown, groupName: string, scopes: readonly unknown[], grantedBy?: string, options?: GroupServiceOptions): Promise<string[]>;
+export declare function assertGroupAdministrator(state: GroupAuthorizationState): void;
+export declare function groupActor(state: GroupAuthorizationState): string;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/groups/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEhF,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEtG;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAExH;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE5H;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAG3I;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAElH;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEzH;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;;KAEnG;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB;;KAEtJ;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,qBAEpJ;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,CAE7E;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAEjE"}

package/dist/auth/groups/service.js

@@ -0,0 +1,40 @@
+import { requestActor } from "../identity/index.js";
+import { canManageGroups } from "./policy.js";
+import { deleteGroupRow, getGroupRow, insertGroupRow, listGroupRows, listGroupUsersRows, listUserGroupsRows, replaceGroupScopesRows, replaceUserGroupsRows, updateGroupRow } from "./d1.js";
+import { validateGroupInput, validateGroupName, validateGroupNames } from "./validation.js";
+export async function listGroups(env, options = {}) {
+    return listGroupRows(env, options);
+}
+export async function getGroup(env, name, options = {}) {
+    return getGroupRow(env, validateGroupName(name), options);
+}
+export async function createGroup(env, input, options = {}) {
+    return insertGroupRow(env, validateGroupInput(input), options);
+}
+export async function updateGroup(env, name, input, options = {}) {
+    const validated = validateGroupInput({ ...input, name });
+    return updateGroupRow(env, validated.name, validated, options);
+}
+export async function deleteGroup(env, name, options = {}) {
+    return deleteGroupRow(env, validateGroupName(name), options);
+}
+export async function listGroupUsers(env, name, options = {}) {
+    return listGroupUsersRows(env, validateGroupName(name), options);
+}
+export async function listUserGroups(env, userId, options = {}) {
+    return listUserGroupsRows(env, userId, options);
+}
+export async function replaceUserGroups(env, userId, groups, grantedBy, options = {}) {
+    return replaceUserGroupsRows(env, userId, validateGroupNames(groups), grantedBy, options);
+}
+export function replaceGroupScopes(env, groupName, scopes, grantedBy, options = {}) {
+    return replaceGroupScopesRows(env, validateGroupName(groupName), scopes.map(String), grantedBy, options);
+}
+export function assertGroupAdministrator(state) {
+    if (!canManageGroups(state))
+        throw new Error("Administrator access is required.");
+}
+export function groupActor(state) {
+    return requestActor(state);
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/groups/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/groups/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5L,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAO5F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAY,EAAE,OAAO,GAAwB,EAAE;IAC9E,OAAO,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAa,EAAE,OAAO,GAAwB,EAAE;IAC3F,OAAO,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,KAAc,EAAE,OAAO,GAAwB,EAAE;IAC/F,OAAO,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,IAAa,EAAE,KAAc,EAAE,OAAO,GAAwB,EAAE;IAC9G,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,GAAI,KAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,OAAO,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,IAAa,EAAE,OAAO,GAAwB,EAAE;IAC9F,OAAO,cAAc,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,IAAa,EAAE,OAAO,GAAwB,EAAE;IACjG,OAAO,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,MAAc,EAAE,OAAO,GAAwB,EAAE;IAClG,OAAO,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,MAAc,EAAE,MAA0B,EAAE,SAAkB,EAAE,OAAO,GAAwB,EAAE;IACrJ,OAAO,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,SAAiB,EAAE,MAA0B,EAAE,SAAkB,EAAE,OAAO,GAAwB,EAAE;IACnJ,OAAO,sBAAsB,CAAC,GAAG,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAA8B;IACvD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/auth/groups/validation.d.ts

@@ -0,0 +1,5 @@
+import type { NewAuthGroup } from "./model.js";
+export declare function validateGroupName(value: unknown): string;
+export declare function validateGroupInput(value: unknown): NewAuthGroup;
+export declare function validateGroupNames(values: readonly unknown[]): string[];
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/groups/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/groups/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIxD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAQ/D;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,EAAE,CAEvE"}

package/dist/auth/groups/validation.js

@@ -0,0 +1,22 @@
+const GROUP_NAME = /^[a-z0-9][a-z0-9._:-]*$/;
+export function validateGroupName(value) {
+    const name = typeof value === "string" ? value.trim() : "";
+    if (!GROUP_NAME.test(name))
+        throw new TypeError("Group names must use lowercase capability-style characters.");
+    return name;
+}
+export function validateGroupInput(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("A group object is required.");
+    const input = value;
+    const name = validateGroupName(input.name);
+    const display_name = typeof input.display_name === "string" ? input.display_name.trim() : "";
+    if (!display_name)
+        throw new TypeError("display_name is required.");
+    const description = input.description === undefined ? "" : String(input.description).trim();
+    return { name, display_name, description };
+}
+export function validateGroupNames(values) {
+    return [...new Set(values.map(validateGroupName))];
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/groups/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/groups/validation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACpH,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/auth/groups/views/list.d.ts

@@ -0,0 +1,10 @@
+/** @jsxImportSource hono/jsx */
+import type { FC } from "hono/jsx";
+import type { AuthGroup } from "../model.js";
+export interface GroupListViewProps {
+    groups: readonly AuthGroup[];
+    title?: string;
+}
+/** Optional Hono JSX view for server-rendered admin shells. React UI remains separate. */
+export declare const GroupListView: FC<GroupListViewProps>;
+//# sourceMappingURL=list.d.ts.map

package/dist/auth/groups/views/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../src/auth/groups/views/list.tsx"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0FAA0F;AAC1F,eAAO,MAAM,aAAa,EAAE,EAAE,CAAC,kBAAkB,CAiBhD,CAAC"}

package/dist/auth/groups/views/list.js

@@ -0,0 +1,4 @@
+import { jsx as _jsx, jsxs as _jsxs } from "hono/jsx/jsx-runtime";
+/** Optional Hono JSX view for server-rendered admin shells. React UI remains separate. */
+export const GroupListView = ({ groups, title = "Groups" }) => (_jsxs("section", { children: [_jsx("h1", { children: title }), groups.length ? (_jsx("ul", { children: groups.map((group) => (_jsxs("li", { children: [_jsx("strong", { children: group.display_name }), _jsx("small", { children: group.name }), group.description ? _jsx("p", { children: group.description }) : null] }, group.name))) })) : (_jsx("p", { children: "No groups registered." }))] }));
+//# sourceMappingURL=list.js.map

package/dist/auth/groups/views/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/auth/groups/views/list.tsx"],"names":[],"mappings":";AAUA,0FAA0F;AAC1F,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,QAAQ,EAAE,EAAE,EAAE,CAAC,CACrF,8BACE,uBAAK,KAAK,GAAM,EACf,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CACf,uBACG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrB,yBACE,2BAAS,KAAK,CAAC,YAAY,GAAU,EACrC,0BAAQ,KAAK,CAAC,IAAI,GAAS,EAC1B,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,sBAAI,KAAK,CAAC,WAAW,GAAK,CAAC,CAAC,CAAC,IAAI,KAH/C,KAAK,CAAC,IAAI,CAId,CACN,CAAC,GACC,CACN,CAAC,CAAC,CAAC,CACF,gDAA4B,CAC7B,IACO,CACX,CAAC"}