@celsoft/platform 0.14.0 → 0.15.0

package/dist/runtime/access.d.ts

@@ -0,0 +1,76 @@
+import { type SQL } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { LINK_HEADER } from "./link-header.js";
+export { LINK_HEADER };
+export declare const LEVELS: readonly ["read", "create", "write", "delete", "manage"];
+export type Level = (typeof LEVELS)[number];
+export type Grantee = {
+    user: string;
+} | {
+    team: string;
+} | {
+    organization: string;
+} | {
+    email: string;
+};
+export interface Grant {
+    to: Grantee;
+    level: Level;
+    grantedBy: string | null;
+}
+export type ShareEmail = {
+    path?: string;
+    subject?: string;
+    text?: string;
+} | false;
+export interface ShareNotice {
+    to: string;
+    sharedBy: string | null;
+    level: Level;
+    path: string;
+    subject?: string;
+    text?: string;
+}
+export interface Link {
+    id: string;
+    level: Level;
+    expiresAt: Date | null;
+}
+export interface Access {
+    level(kind: string, id: string): Promise<Level | null>;
+    can(kind: string, id: string, level: Level): Promise<boolean>;
+    require(kind: string, id: string, level: Level): Promise<void>;
+    place(kind: string, id: string, parentKind: string, parentId: string): Promise<void>;
+    remove(kind: string, id: string): Promise<void>;
+    restrict(kind: string, id: string, restricted?: boolean): Promise<void>;
+    share(kind: string, id: string, to: Grantee, level: Level, options?: {
+        email?: ShareEmail;
+    }): Promise<void>;
+    revoke(kind: string, id: string, to: Grantee): Promise<void>;
+    grants(kind: string, id: string): Promise<Grant[]>;
+    sharedWithMe(kind: string): Promise<string[]>;
+    link(kind: string, id: string, level: Level, options?: {
+        expires?: Date;
+    }): Promise<{
+        id: string;
+        token: string;
+    }>;
+    links(kind: string, id: string): Promise<Link[]>;
+    revokeLink(kind: string, id: string, linkId: string): Promise<void>;
+    accessible(kind: string, level: Level, column: unknown): Promise<SQL>;
+    in(tx: unknown): Access;
+}
+export interface Caller {
+    userId: string | null;
+    link: string | null;
+}
+export declare const MAX_DEPTH = 64;
+type Db = Pick<NodePgDatabase<Record<string, unknown>>, "execute" | "transaction">;
+export declare function rank(level: Level): number;
+export declare function shareMessage(notice: ShareNotice, appName: string, origin: string): {
+    to: string;
+    subject: string;
+    text: string;
+};
+export declare function hashToken(token: string): Promise<string>;
+export declare function createAccess(db: Db, caller: () => Promise<Caller>, notify?: (notice: ShareNotice) => Promise<void>): Access;

package/dist/runtime/access.js

@@ -0,0 +1,307 @@
+import { sql } from "drizzle-orm";
+import { EndpointError } from "./endpoint-error.js";
+import { LINK_HEADER } from "./link-header.js";
+export { LINK_HEADER };
+// Who may do what to an app's items; see docs/design.md, App Code, Access, and the cases in
+// docs/access-rules.md. Every check is one query against the app's own Postgres, never cached.
+export const LEVELS = ["read", "create", "write", "delete", "manage"];
+// The longest chain from an item up to its user or organization, counting the item itself.
+export const MAX_DEPTH = 64;
+const ROOTS = ["user", "organization"];
+const KIND = /^[a-z][a-z0-9_-]{0,62}$/;
+const [READ, CREATE, WRITE, DELETE, MANAGE] = [1, 2, 3, 4, 5];
+export function rank(level) {
+    const n = LEVELS.indexOf(level);
+    if (n < 0)
+        throw new Error(`unknown access level ${JSON.stringify(level)}; use ${LEVELS.join(", ")}`);
+    return n + 1;
+}
+const named = (n) => (n >= READ ? LEVELS[n - 1] : null);
+function checkKind(kind) {
+    if (typeof kind !== "string" || !KIND.test(kind) || ROOTS.includes(kind)) {
+        throw new Error(`access kind ${JSON.stringify(kind)} must be lowercase letters, digits, - and _, and not "user" or "organization"`);
+    }
+}
+function checkId(id) {
+    if (typeof id !== "string" || id.length === 0 || id.length > 200)
+        throw new Error(`access id ${JSON.stringify(id)} must be 1 to 200 characters`);
+}
+const notFound = () => new EndpointError(404, "not found");
+export function shareMessage(notice, appName, origin) {
+    const who = notice.sharedBy || "Someone";
+    const url = new URL(notice.path, origin).toString();
+    return {
+        to: notice.to,
+        subject: notice.subject ?? `${who} shared something with you on ${appName}`,
+        text: `${notice.text ?? `${who} gave you ${notice.level} access on ${appName}.`}\n\n${url}\n`,
+    };
+}
+export async function hashToken(token) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+    return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function newToken() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+// The caller's level on one item, 0 for none, as a scalar subquery. It walks up the chain to the
+// user or organization at the top, stops counting grants and links above the first restricted
+// item, and gives nothing at all to a chain that never reaches a user or organization that exists.
+function levelSql(kind, id, who) {
+    return sql `(
+    with recursive chain as (
+      select i.kind, i.id, i.parent_kind, i.parent_id, i.restricted, 0 as depth
+      from access_item i where i.kind = ${kind} and i.id = ${id}
+      union all
+      select p.kind, p.id, p.parent_kind, p.parent_id, p.restricted, c.depth + 1
+      from chain c join access_item p on p.kind = c.parent_kind and p.id = c.parent_id
+      where c.depth < ${MAX_DEPTH - 1}
+    ),
+    root as (
+      select parent_kind as kind, parent_id as id from chain
+      where (parent_kind = 'user' and exists (select 1 from "user" u where u.id::text = parent_id))
+         or (parent_kind = 'organization' and exists (select 1 from organization o where o.id::text = parent_id))
+    ),
+    cut as (select min(depth) as depth from chain where restricted),
+    reach as (select chain.kind, chain.id from chain, cut where cut.depth is null or chain.depth <= cut.depth),
+    me as (select ${who.userId}::uuid as id),
+    levels as (
+      select ${MANAGE} as level from root, me where root.kind = 'user' and root.id = me.id::text
+      union all
+      select case btrim(roles.name)
+          when 'owner' then ${MANAGE}
+          when 'admin' then ${DELETE}
+          when 'member' then (select case when cut.depth is null then ${READ} else 0 end from cut)
+          else 0 end
+      from root
+      join member m on root.kind = 'organization' and m.organization_id::text = root.id
+      join me on m.user_id = me.id
+      cross join lateral unnest(string_to_array(m.role, ',')) as roles(name)
+      union all
+      select g.level from access_grant g join reach on g.item_kind = reach.kind and g.item_id = reach.id, me
+      where g.user_id = me.id
+        or g.team_id in (select tm.team_id from team_member tm where tm.user_id = me.id)
+        or g.organization_id in (select mm.organization_id from member mm where mm.user_id = me.id)
+        or g.email = (select lower(u.email) from "user" u where u.id = me.id and u.email_verified)
+      union all
+      select l.level from access_link l join reach on l.item_kind = reach.kind and l.item_id = reach.id
+      where l.token_hash = ${who.linkHash} and (l.expires_at is null or l.expires_at > now())
+    )
+    select case when exists (select 1 from root) then coalesce(max(level), 0) else 0 end from levels
+  )`;
+}
+const rows = async (db, query) => (await db.execute(query)).rows;
+function granteeColumns(to) {
+    const keys = Object.keys(to ?? {});
+    if (keys.length !== 1 || !["user", "team", "organization", "email"].includes(keys[0])) {
+        throw new Error("share with exactly one of { user }, { team }, { organization } or { email }");
+    }
+    const value = Object.values(to)[0];
+    if (typeof value !== "string" || value.trim() === "")
+        throw new Error("a grantee needs a non-empty id or email");
+    return {
+        user: "user" in to ? to.user : null,
+        team: "team" in to ? to.team : null,
+        organization: "organization" in to ? to.organization : null,
+        email: "email" in to ? to.email.trim().toLowerCase() : null,
+    };
+}
+function grantee(row) {
+    if (row.user_id)
+        return { user: row.user_id };
+    if (row.team_id)
+        return { team: row.team_id };
+    if (row.organization_id)
+        return { organization: row.organization_id };
+    return { email: row.email };
+}
+// Postgres refuses a grant to a user, team or organization that does not exist, or whose id is not
+// a UUID at all; both look like any other missing thing.
+async function missingAsNotFound(work) {
+    try {
+        return await work;
+    }
+    catch (error) {
+        const code = error.code ?? error.cause?.code;
+        if (code === "23503" || code === "22P02")
+            throw notFound();
+        throw error;
+    }
+}
+export function createAccess(db, caller, notify) {
+    let who;
+    const me = () => (who ??= caller().then(async ({ userId, link }) => ({ userId, linkHash: link ? await hashToken(link) : null })));
+    async function levelOf(on, kind, id) {
+        checkKind(kind);
+        checkId(id);
+        const [row] = await rows(on, sql `select ${levelSql(sql `${kind}`, sql `${id}`, await me())} as level`);
+        const level = Number(row?.level ?? 0);
+        if (level === 0)
+            await reportTooDeep(on, kind, id);
+        return level;
+    }
+    // A chain longer than place allows can only come from writing the tables directly; it is
+    // refused like any other, and logged, since it means a bug.
+    async function reportTooDeep(on, kind, id) {
+        const [up] = await rows(on, chainUp(kind, id, MAX_DEPTH + 1));
+        if (up && Number(up.depth) >= MAX_DEPTH)
+            console.error(`access: ${kind} ${id} sits more than ${MAX_DEPTH} items deep; refused`);
+    }
+    async function need(on, kind, id, level) {
+        if ((await levelOf(on, kind, id)) < level)
+            throw notFound();
+    }
+    // The level the top of the tree gives: a user over their own items, a role over an organization's.
+    async function topLevel(on, kind, id) {
+        const { userId } = await me();
+        if (!userId)
+            return 0;
+        if (kind === "user")
+            return id === userId ? MANAGE : 0;
+        const [row] = await rows(on, sql `select coalesce(max(case btrim(roles.name) when 'owner' then ${MANAGE} when 'admin' then ${DELETE} when 'member' then ${READ} else 0 end), 0) as level
+          from member m cross join lateral unnest(string_to_array(m.role, ',')) as roles(name)
+          where m.organization_id::text = ${id} and m.user_id = ${userId}::uuid`);
+        return Number(row?.level ?? 0);
+    }
+    async function place(on, kind, id, parentKind, parentId) {
+        checkKind(kind);
+        checkId(id);
+        checkId(parentId);
+        await on.transaction(async (raw) => {
+            const tx = raw;
+            // One move at a time per database, so two moves can never pass each other's loop check.
+            await tx.execute(sql `select pg_advisory_xact_lock(hashtext('@celsoft/platform access place'))`);
+            const [existing] = await rows(tx, sql `select 1 from access_item where kind = ${kind} and id = ${id}`);
+            if (existing)
+                await need(tx, kind, id, WRITE);
+            let above = 0;
+            if (ROOTS.includes(parentKind)) {
+                if ((await topLevel(tx, parentKind, parentId)) < CREATE)
+                    throw notFound();
+            }
+            else {
+                await need(tx, parentKind, parentId, CREATE);
+                const [up] = await rows(tx, sql `${chainUp(parentKind, parentId, MAX_DEPTH)}, (select exists (select 1 from up where kind = ${kind} and id = ${id})) as within`);
+                if (up?.within)
+                    throw new EndpointError(409, "an item cannot be placed inside itself");
+                above = Number(up?.depth ?? 0) + 1;
+            }
+            const [down] = await rows(tx, sql `with recursive down as (
+              select kind, id, 1 as depth from access_item where parent_kind = ${kind} and parent_id = ${id}
+              union all
+              select c.kind, c.id, d.depth + 1 from down d join access_item c on c.parent_kind = d.kind and c.parent_id = d.id
+              where d.depth < ${MAX_DEPTH}
+            )
+            select coalesce(max(depth), 0) as height from down`);
+            if (above + 1 + Number(down?.height ?? 0) > MAX_DEPTH)
+                throw new EndpointError(409, `items can sit at most ${MAX_DEPTH} deep`);
+            await tx.execute(sql `
+        insert into access_item (kind, id, parent_kind, parent_id) values (${kind}, ${id}, ${parentKind}, ${parentId})
+        on conflict (kind, id) do update set parent_kind = excluded.parent_kind, parent_id = excluded.parent_id, updated_at = now()`);
+        });
+    }
+    function bound(on) {
+        return {
+            level: async (kind, id) => named(await levelOf(on, kind, id)),
+            can: async (kind, id, level) => (await levelOf(on, kind, id)) >= rank(level),
+            require: async (kind, id, level) => need(on, kind, id, rank(level)),
+            place: (kind, id, parentKind, parentId) => place(on, kind, id, parentKind, parentId),
+            async remove(kind, id) {
+                await need(on, kind, id, DELETE);
+                const [child] = await rows(on, sql `select 1 from access_item where parent_kind = ${kind} and parent_id = ${id} limit 1`);
+                if (child)
+                    throw new EndpointError(409, "move or delete what is inside first");
+                await on.execute(sql `delete from access_item where kind = ${kind} and id = ${id}`);
+            },
+            async restrict(kind, id, restricted = true) {
+                await need(on, kind, id, MANAGE);
+                await on.execute(sql `update access_item set restricted = ${restricted}, updated_at = now() where kind = ${kind} and id = ${id}`);
+            },
+            async share(kind, id, to, level, options = {}) {
+                const n = rank(level);
+                const g = granteeColumns(to);
+                const email = options.email ?? {};
+                if (email && email.path !== undefined && !/^\/(?![/\\])/.test(email.path))
+                    throw new Error(`a sharing email's path must start with one /, such as /pages/7; got ${JSON.stringify(email.path)}`);
+                await need(on, kind, id, MANAGE);
+                const { userId } = await me();
+                // xmax is 0 only for a row this statement inserted, so a changed grant sends no second email.
+                const [row] = await missingAsNotFound(rows(on, sql `
+            insert into access_grant (item_kind, item_id, user_id, team_id, organization_id, email, level, granted_by)
+            values (${kind}, ${id}, ${g.user}::uuid, ${g.team}::uuid, ${g.organization}::uuid, ${g.email}, ${n}, ${userId}::uuid)
+            on conflict on constraint access_grant_once do update set level = excluded.level, granted_by = excluded.granted_by, updated_at = now()
+            returning xmax = 0 as inserted,
+              coalesce(email, (select u.email from "user" u where u.id = access_grant.user_id)) as recipient,
+              (select u.name from "user" u where u.id = ${userId}::uuid) as shared_by`));
+                if (!notify || email === false || !row?.inserted || !row.recipient)
+                    return;
+                await notify({ to: row.recipient, sharedBy: row.shared_by, level, path: email.path ?? "/", subject: email.subject, text: email.text });
+            },
+            async revoke(kind, id, to) {
+                const g = granteeColumns(to);
+                await need(on, kind, id, MANAGE);
+                await on.execute(sql `
+          delete from access_grant where item_kind = ${kind} and item_id = ${id}
+            and user_id is not distinct from ${g.user}::uuid and team_id is not distinct from ${g.team}::uuid
+            and organization_id is not distinct from ${g.organization}::uuid and email is not distinct from ${g.email}`);
+            },
+            async grants(kind, id) {
+                await need(on, kind, id, MANAGE);
+                const found = await rows(on, sql `select user_id, team_id, organization_id, email, level, granted_by from access_grant where item_kind = ${kind} and item_id = ${id} order by created_at, id`);
+                return found.map((row) => ({ to: grantee(row), level: named(Number(row.level)), grantedBy: row.granted_by }));
+            },
+            async sharedWithMe(kind) {
+                checkKind(kind);
+                const who = await me();
+                if (!who.userId)
+                    return [];
+                const found = await rows(on, sql `select distinct g.item_id from access_grant g
+              where g.item_kind = ${kind}
+                and (g.user_id = ${who.userId}::uuid
+                  or g.team_id in (select team_id from team_member where user_id = ${who.userId}::uuid)
+                  or g.organization_id in (select organization_id from member where user_id = ${who.userId}::uuid)
+                  or g.email = (select lower(email) from "user" where id = ${who.userId}::uuid and email_verified))
+                and ${levelSql(sql `g.item_kind`, sql `g.item_id`, who)} >= ${READ}
+              order by g.item_id`);
+                return found.map((row) => row.item_id);
+            },
+            async link(kind, id, level, options = {}) {
+                const n = rank(level);
+                if (n > WRITE)
+                    throw new Error(`a link can carry read, create or write, never ${level}`);
+                await need(on, kind, id, MANAGE);
+                const token = newToken();
+                const { userId } = await me();
+                const [row] = await rows(on, sql `insert into access_link (item_kind, item_id, token_hash, level, expires_at, created_by)
+              values (${kind}, ${id}, ${await hashToken(token)}, ${n}, ${options.expires ?? null}, ${userId}::uuid) returning id`);
+                return { id: row.id, token };
+            },
+            async links(kind, id) {
+                await need(on, kind, id, MANAGE);
+                const found = await rows(on, sql `select id, level, expires_at from access_link where item_kind = ${kind} and item_id = ${id} order by created_at, id`);
+                return found.map((row) => ({ id: row.id, level: named(Number(row.level)), expiresAt: row.expires_at ? new Date(row.expires_at) : null }));
+            },
+            async revokeLink(kind, id, linkId) {
+                await need(on, kind, id, MANAGE);
+                await on.execute(sql `delete from access_link where item_kind = ${kind} and item_id = ${id} and id::text = ${linkId}`);
+            },
+            async accessible(kind, level, column) {
+                checkKind(kind);
+                return sql `(${levelSql(sql `${kind}`, sql `(${column})::text`, await me())} >= ${rank(level)})`;
+            },
+            in: (tx) => bound(tx),
+        };
+    }
+    return bound(db);
+}
+// The chain above an item, the item included, as `up`, with `depth` the topmost step reached.
+function chainUp(kind, id, limit) {
+    return sql `with recursive up as (
+      select kind, id, parent_kind, parent_id, 0 as depth from access_item where kind = ${kind} and id = ${id}
+      union all
+      select p.kind, p.id, p.parent_kind, p.parent_id, u.depth + 1 from up u join access_item p on p.kind = u.parent_kind and p.id = u.parent_id
+      where u.depth < ${limit}
+    )
+    select (select max(depth) from up) as depth`;
+}
+//# sourceMappingURL=access.js.map

package/dist/runtime/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/runtime/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,CAAC;AAEvB,4FAA4F;AAC5F,+FAA+F;AAE/F,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AA4D/E,2FAA2F;AAC3F,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAE5B,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACvC,MAAM,IAAI,GAAG,yBAAyB,CAAC;AACvC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAI9D,MAAM,UAAU,IAAI,CAAC,KAAY;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE/E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACtI,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,EAAU;IACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;AACnJ,CAAC;AAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAE3D,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,OAAe,EAAE,MAAc;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACpD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,GAAG,GAAG,iCAAiC,OAAO,EAAE;QAC3E,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,GAAG,aAAa,MAAM,CAAC,KAAK,cAAc,OAAO,GAAG,OAAO,GAAG,IAAI;KAC9F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxG,CAAC;AAOD,iGAAiG;AACjG,8FAA8F;AAC9F,mGAAmG;AACnG,SAAS,QAAQ,CAAC,IAAS,EAAE,EAAO,EAAE,GAAQ;IAC5C,OAAO,GAAG,CAAA;;;0CAG8B,IAAI,eAAe,EAAE;;;;wBAIvC,SAAS,GAAG,CAAC;;;;;;;;;oBASjB,GAAG,CAAC,MAAM;;eAEf,MAAM;;;8BAGS,MAAM;8BACN,MAAM;wEACoC,IAAI;;;;;;;;;;;;;;6BAc/C,GAAG,CAAC,QAAQ;;;IAGrC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,GAAG,KAAK,EAAK,EAAM,EAAE,KAAU,EAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAW,CAAC;AAElG,SAAS,cAAc,CAAC,EAAW;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACjH,OAAO;QACL,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACnC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QACnC,YAAY,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QAC3D,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAC5D,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAA6G;IAC5H,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,GAAG,CAAC,eAAe;QAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;IACtE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAM,EAAE,CAAC;AAC/B,CAAC;AAED,mGAAmG;AACnG,yDAAyD;AACzD,KAAK,UAAU,iBAAiB,CAAI,IAAgB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAAsD,CAAC,IAAI,IAAK,KAAuC,CAAC,KAAK,EAAE,IAAI,CAAC;QAClI,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;YAAE,MAAM,QAAQ,EAAE,CAAC;QAC3D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAM,EAAE,MAA6B,EAAE,MAA+C;IACjH,IAAI,GAA6B,CAAC;IAClC,MAAM,EAAE,GAAG,GAAG,EAAE,CACd,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnH,KAAK,UAAU,OAAO,CAAC,EAAM,EAAE,IAAY,EAAE,EAAU;QACrD,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAoB,EAAE,EAAE,GAAG,CAAA,UAAU,QAAQ,CAAC,GAAG,CAAA,GAAG,IAAI,EAAE,EAAE,GAAG,CAAA,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;QACxH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,CAAC;YAAE,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,yFAAyF;IACzF,4DAA4D;IAC5D,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,IAAY,EAAE,EAAU;QAC3D,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAoB,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,mBAAmB,SAAS,sBAAsB,CAAC,CAAC;IAClI,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,EAAM,EAAE,IAAY,EAAE,EAAU,EAAE,KAAa;QACjE,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK;YAAE,MAAM,QAAQ,EAAE,CAAC;IAC9D,CAAC;IAED,mGAAmG;IACnG,KAAK,UAAU,QAAQ,CAAC,EAAM,EAAE,IAAY,EAAE,EAAU;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CACtB,EAAE,EACF,GAAG,CAAA,gEAAgE,MAAM,sBAAsB,MAAM,uBAAuB,IAAI;;4CAE1F,EAAE,oBAAoB,MAAM,QAAQ,CAC3E,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,UAAU,KAAK,CAAC,EAAM,EAAE,IAAY,EAAE,EAAU,EAAE,UAAkB,EAAE,QAAgB;QACzF,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjC,MAAM,EAAE,GAAG,GAAoB,CAAC;YAChC,wFAAwF;YACxF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,0EAA0E,CAAC,CAAC;YAChG,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAA,0CAA0C,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;YACtG,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAE9C,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,MAAM;oBAAE,MAAM,QAAQ,EAAE,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CACrB,EAAE,EACF,GAAG,CAAA,GAAG,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,mDAAmD,IAAI,aAAa,EAAE,cAAc,CACnI,CAAC;gBACF,IAAI,EAAE,EAAE,MAAM;oBAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;gBACvF,KAAK,GAAG,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CACvB,EAAE,EACF,GAAG,CAAA;iFACsE,IAAI,oBAAoB,EAAE;;;gCAG3E,SAAS;;+DAEsB,CACxD,CAAC;YACF,IAAI,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,SAAS;gBAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,yBAAyB,SAAS,OAAO,CAAC,CAAC;YAE/H,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;6EACmD,IAAI,KAAK,EAAE,KAAK,UAAU,KAAK,QAAQ;oIACgB,CAAC,CAAC;QAClI,CAAC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,KAAK,CAAC,EAAM;QACnB,OAAO;YACL,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC;YAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACnE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;YAEpF,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBACnB,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,GAAG,CAAA,iDAAiD,IAAI,oBAAoB,EAAE,UAAU,CAAC,CAAC;gBACzH,IAAI,KAAK;oBAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,wCAAwC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,GAAG,IAAI;gBACxC,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,uCAAuC,UAAU,qCAAqC,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE;gBAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChM,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;gBAC9B,8FAA8F;gBAC9F,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,CACnC,IAAI,CACF,EAAE,EACF,GAAG,CAAA;;sBAEO,IAAI,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM;;;;0DAI/D,MAAM,sBAAsB,CAC3E,CACF,CAAC;gBACF,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,SAAS;oBAAE,OAAO;gBAC3E,MAAM,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBACvB,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC7B,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;uDAC2B,IAAI,kBAAkB,EAAE;+CAChC,CAAC,CAAC,IAAI,2CAA2C,CAAC,CAAC,IAAI;uDAC/C,CAAC,CAAC,YAAY,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;gBACnB,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,EAAE,EACF,GAAG,CAAA,0GAA0G,IAAI,kBAAkB,EAAE,0BAA0B,CAChK,CAAC;gBACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjH,CAAC;YAED,KAAK,CAAC,YAAY,CAAC,IAAI;gBACrB,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,MAAM;oBAAE,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,EAAE,EACF,GAAG,CAAA;oCACuB,IAAI;mCACL,GAAG,CAAC,MAAM;qFACwC,GAAG,CAAC,MAAM;gGACC,GAAG,CAAC,MAAM;6EAC7B,GAAG,CAAC,MAAM;sBACjE,QAAQ,CAAC,GAAG,CAAA,aAAa,EAAE,GAAG,CAAA,WAAW,EAAE,GAAG,CAAC,OAAO,IAAI;iCAC/C,CACxB,CAAC;gBACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE;gBACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,CAAC,GAAG,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,EAAE,CAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;gBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CACtB,EAAE,EACF,GAAG,CAAA;wBACW,IAAI,KAAK,EAAE,KAAK,MAAM,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,OAAO,IAAI,IAAI,KAAK,MAAM,sBAAsB,CACxH,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,GAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;YAChC,CAAC;YAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE;gBAClB,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CACtB,EAAE,EACF,GAAG,CAAA,mEAAmE,IAAI,kBAAkB,EAAE,0BAA0B,CACzH,CAAC;gBACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7I,CAAC;YAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM;gBAC/B,MAAM,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,6CAA6C,IAAI,kBAAkB,EAAE,mBAAmB,MAAM,EAAE,CAAC,CAAC;YACxH,CAAC;YAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;gBAClC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAChB,OAAO,GAAG,CAAA,IAAI,QAAQ,CAAC,GAAG,CAAA,GAAG,IAAI,EAAE,EAAE,GAAG,CAAA,IAAI,MAAM,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAChG,CAAC;YAED,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAQ,CAAC;SAC5B,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,KAAa;IACtD,OAAO,GAAG,CAAA;0FAC8E,IAAI,aAAa,EAAE;;;wBAGrF,KAAK;;gDAEmB,CAAC;AACjD,CAAC"}

package/dist/runtime/client.d.ts

@@ -15,6 +15,8 @@ type OutputOf<E> = E extends {
     output: infer O extends z.ZodType;
 } ? Jsonified<z.output<O>> : never;
 export type Call<App> = <Name extends keyof EndpointsOf<App> & string>(name: Name, input: InputOf<EndpointsOf<App>[Name]>) => Promise<OutputOf<EndpointsOf<App>[Name]>>;
+export declare function linkFromPage(): string | null;
 export declare function createCall<App>(routes: Record<string, readonly [Method, string]>, options?: {
     url?: string;
+    link?: () => string | null;
 }): Call<App>;

package/dist/runtime/client.js

@@ -2,15 +2,30 @@ import { createORPCClient, ORPCError } from "@orpc/client";
 import { oc } from "@orpc/contract";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
 import { EndpointError } from "./endpoint-error.js";
+import { LINK_HEADER } from "./link-header.js";
 export { EndpointError };
+// The access link token in the page's address, written `#link=<token>`; a fragment never reaches
+// the server, so tokens stay out of its logs and Referer headers.
+export function linkFromPage() {
+    if (typeof location === "undefined")
+        return null;
+    return new URLSearchParams(location.hash.replace(/^#/, "")).get("link");
+}
 // Calls the app's endpoints by name over its REST API; the generated .platform/client.ts passes
-// each endpoint's method and path, and the app's own type for the inputs and outputs.
+// each endpoint's method and path, and the app's own type for the inputs and outputs. Every call
+// carries the page's access link token, or the one `link` returns.
 export function createCall(routes, options = {}) {
     const contract = Object.fromEntries(Object.entries(routes).map(([name, [method, path]]) => [name, oc.route({ method, path: path })]));
     const url = options.url ?? (typeof location === "undefined" ? undefined : location.origin);
     if (!url)
         throw new Error("createCall needs a url outside a browser");
-    const client = createORPCClient(new OpenAPILink(contract, { url }));
+    const client = createORPCClient(new OpenAPILink(contract, {
+        url,
+        headers: () => {
+            const token = (options.link ?? linkFromPage)();
+            return token ? { [LINK_HEADER]: token } : {};
+        },
+    }));
     return (async (name, input) => {
         const fn = routes[name] && client[name];
         if (!fn)

package/dist/runtime/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/runtime/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,CAAC;AAezB,gGAAgG;AAChG,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAM,MAAiD,EAAE,OAAO,GAAqB,EAAE;IAC/G,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAuD,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE1H,OAAO,CAAC,KAAK,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS;gBAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAc,CAAC;AAClB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/runtime/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,CAAC;AAezB,iGAAiG;AACjG,kEAAkE;AAClE,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,gGAAgG;AAChG,iGAAiG;AACjG,mEAAmE;AACnE,MAAM,UAAU,UAAU,CAAM,MAAiD,EAAE,OAAO,GAAiD,EAAE;IAC3I,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAoB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtJ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAuD,IAAI,WAAW,CAAC,QAAQ,EAAE;QAC5G,GAAG;QACH,OAAO,EAAE,GAA2B,EAAE;YACpC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC,CAAC;IAEN,OAAO,CAAC,KAAK,EAAE,IAAY,EAAE,KAAc,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS;gBAAE,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAc,CAAC;AAClB,CAAC"}

package/dist/runtime/endpoints.d.ts

@@ -1,4 +1,5 @@
 import type { z } from "zod";
+import type { Level } from "./access.js";
 import type { AppContext } from "./index.js";
 export type AnyApp = AppContext<any, any>;
 export type Method = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
@@ -10,11 +11,17 @@ export interface EndpointDefinition<Input extends z.ZodType, Output extends z.Zo
     description?: string;
     input: Input;
     output: Output;
+    access?: {
+        kind: string;
+        id: string;
+        level: Level;
+    };
 }
 export interface Endpoint<Input extends z.ZodType = z.ZodType, Output extends z.ZodType = z.ZodType, App = AnyApp> extends EndpointDefinition<Input, Output> {
     handler: (input: z.output<Input>, app: App) => z.input<Output> | Promise<z.input<Output>>;
 }
 export declare function endpoint<Input extends z.ZodType, Output extends z.ZodType, App = AnyApp>(definition: EndpointDefinition<Input, Output>, handler: (input: z.output<Input>, app: App) => z.input<Output> | Promise<z.input<Output>>): Endpoint<Input, Output, App>;
+export declare function runEndpoint<App>(e: Endpoint<z.ZodType, z.ZodType, App>, input: unknown, app: App): Promise<unknown>;
 export type Endpoints = Record<string, Endpoint<z.ZodType, z.ZodType, never>>;
 export interface Route {
     method: Method;

package/dist/runtime/endpoints.js

@@ -4,8 +4,21 @@ import { experimental_ZodSmartCoercionPlugin } from "@orpc/zod/zod4";
 import { EndpointError } from "./endpoint-error.js";
 // One typed function: its Zod schemas are its only types, wherever it is served.
 export function endpoint(definition, handler) {
+    if (definition.access) {
+        const shape = definition.input.shape;
+        if (!shape || !(definition.access.id in shape))
+            throw new Error(`an endpoint's access names input field ${definition.access.id}, which its input schema does not have`);
+    }
     return { ...definition, handler };
 }
+// Runs one endpoint's function for either door, after its access check.
+export async function runEndpoint(e, input, app) {
+    if (e.access) {
+        const { kind, id, level } = e.access;
+        await app.access.require(kind, String(input[id]), level);
+    }
+    return e.handler(input, app);
+}
 export const servesApi = (e) => (e.serve ?? ["api"]).includes("api");
 // The method and path of every endpoint served over the API, checked once: each must say both,
 // stay under /api/, and use only input fields as path parameters.
@@ -43,7 +56,7 @@ export function apiHandler(endpoints) {
             .output(e.output)
             .handler(async ({ input, context }) => {
             try {
-                return await e.handler(input, context.app);
+                return await runEndpoint(e, input, context.app);
             }
             catch (error) {
                 if (error instanceof EndpointError)

package/dist/runtime/endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/runtime/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mCAAmC,EAAE,MAAM,gBAAgB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyBpD,iFAAiF;AACjF,MAAM,UAAU,QAAQ,CACtB,UAA6C,EAC7C,OAAyF;IAEzF,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AASD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAElG,+FAA+F;AAC/F,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,SAAoD;IAC5E,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0DAA0D,CAAC,CAAC;QACtH,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,+DAA+D,CAAC,CAAC;QAClI,MAAM,KAAK,GAAI,CAAC,CAAC,KAA6C,CAAC,KAAK,CAAC;QACrE,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAM,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,KAAK,wCAAwC,CAAC,CAAC;QACnI,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD,kGAAkG;AAClG,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAM,SAA8D;IAC5F,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAgB,CAAC;IACzC,MAAM,MAAM,GAA8B,MAAM,CAAC,WAAW,CAC1D,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI;aACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAE,CAAC,IAAoB,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;aACvI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;aACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;aAChB,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,aAAa;oBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5H,0EAA0E;gBAC1E,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;oBAC9B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;oBACxF,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxG,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACL,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE;QACzC,OAAO,EAAE,CAAC,IAAI,mCAAmC,EAAE,CAAC;QACpD,kBAAkB,EAAE;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,EAAE,CAAC;gBACtB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;wBAAE,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBAC1K,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG;YACvB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC;YACjC,wEAAwE;YACxE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;YAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/runtime/endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,EAAE,EAAe,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mCAAmC,EAAE,MAAM,gBAAgB,CAAC;AAGrE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA4BpD,iFAAiF;AACjF,MAAM,UAAU,QAAQ,CACtB,UAA6C,EAC7C,OAAyF;IAEzF,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,KAAK,GAAI,UAAU,CAAC,KAA6C,CAAC,KAAK,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,CAAC,MAAM,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC1K,CAAC;IACD,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAM,CAAsC,EAAE,KAAc,EAAE,GAAQ;IACrG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QACrC,MAAO,GAA0B,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAE,KAAiC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAA4B,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AASD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAElG,+FAA+F;AAC/F,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,SAAoD;IAC5E,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,0DAA0D,CAAC,CAAC;QACtH,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,+DAA+D,CAAC,CAAC;QAClI,MAAM,KAAK,GAAI,CAAC,CAAC,KAA6C,CAAC,KAAK,CAAC;QACrE,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAM,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,KAAK,wCAAwC,CAAC,CAAC;QACnI,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,MAAM,CAAC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD,kGAAkG;AAClG,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAM,SAA8D;IAC5F,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAgB,CAAC;IACzC,MAAM,MAAM,GAA8B,MAAM,CAAC,WAAW,CAC1D,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI;aACnB,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAE,CAAC,IAAoB,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;aACvI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;aACd,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;aAChB,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACpC,IAAI,CAAC;gBACH,OAAO,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,aAAa;oBAAE,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC5H,0EAA0E;gBAC1E,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;oBAC9B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;oBACxF,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;gBACxG,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACL,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE;QACzC,OAAO,EAAE,CAAC,IAAI,mCAAmC,EAAE,CAAC;QACpD,kBAAkB,EAAE;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;gBACvB,IAAI,CAAC;oBACH,OAAO,MAAM,IAAI,EAAE,CAAC;gBACtB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;wBAAE,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBAC1K,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG;YACvB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC5C,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC;YACjC,wEAAwE;YACxE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC;YAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime/index.d.ts

@@ -1,5 +1,6 @@
 import { type NodePgDatabase } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
+import { type Access } from "./access.js";
 import { type Auth } from "./auth.js";
 import { type Email, type EmailBindings } from "./email.js";
 import { type Endpoint } from "./endpoints.js";
@@ -8,6 +9,7 @@ import { type RateLimiter } from "./guard.js";
 import type { z } from "zod";
 import { type Live, type LiveNamespace } from "./live.js";
 import type { LivePeer } from "./live-client.js";
+export { LEVELS, LINK_HEADER, MAX_DEPTH, type Access, type Grant, type Grantee, type Level, type Link, type ShareEmail } from "./access.js";
 export type { Auth } from "./auth.js";
 export { EndpointError } from "./endpoint-error.js";
 export { endpoint, type Door, type Endpoint, type EndpointDefinition, type Method } from "./endpoints.js";
@@ -27,6 +29,7 @@ export interface PlatformBindings extends EmailBindings, FilesBindings {
     LIVE?: LiveNamespace;
     LIVE_ROOMS?: string;
     MCP?: string;
+    ACCESS?: string;
 }
 export interface ExecutionContext {
     waitUntil(promise: Promise<unknown>): void;
@@ -40,6 +43,7 @@ export interface AppContext<Env, Schema extends Record<string, unknown>> {
     readonly files: Files;
     readonly auth: Auth;
     readonly live: Live;
+    readonly access: Access;
     session(): Promise<Session | null>;
     requireUser(): Promise<User>;
     waitUntil(promise: Promise<unknown>): void;

package/dist/runtime/index.js

@@ -1,5 +1,6 @@
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
+import { createAccess, LINK_HEADER, shareMessage } from "./access.js";
 import { AUTH_PATH, createAuth } from "./auth.js";
 import { createEmail } from "./email.js";
 import { apiHandler } from "./endpoints.js";
@@ -8,6 +9,7 @@ import { isCrossSiteForm, needsSession, rateLimited } from "./guard.js";
 import { anyMessage, CLIENT_PATH, clientScript, createLive, joinRoom, LIVE_PATH, liveRoom } from "./live.js";
 import { MCP_PATH, mcpChallenge, mcpUserId, serveMcp, WELL_KNOWN } from "./mcp.js";
 import { isScreen, renderScreen } from "./screens.js";
+export { LEVELS, LINK_HEADER, MAX_DEPTH } from "./access.js";
 export { EndpointError } from "./endpoint-error.js";
 export { endpoint } from "./endpoints.js";
 function messageCheck(schema) {
@@ -96,6 +98,7 @@ knownSession) {
     let files;
     let auth;
     let live;
+    let access;
     let session;
     const app = {
         env,
@@ -124,6 +127,14 @@ knownSession) {
         get live() {
             return (live ??= createLive(env.LIVE, env.LIVE_ROOMS === "on", messageCheck(options.live?.message)));
         },
+        get access() {
+            if (env.ACCESS !== "on")
+                throw new Error("this app has no access; set `access: true` in platform.jsonc");
+            const origin = env.APP_URL ?? new URL(request.url).origin;
+            return (access ??= createAccess(app.db, async () => ({ userId: (await app.session())?.user.id ?? null, link: request.headers.get(LINK_HEADER) }), 
+            // Sent after the answer, so a slow or failing email never fails the share itself.
+            async (notice) => app.waitUntil(app.email.send(shareMessage(notice, env.APP_NAME ?? new URL(origin).hostname, origin)).catch((error) => console.error("sharing email failed", error)))));
+        },
         session() {
             return (session ??= knownSession ? knownSession() : env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
         },