@celsoft/platform 0.16.0 → 0.17.0

package/dist/runtime/index.js

@@ -1,15 +1,17 @@
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
-import { createAccess, LINK_HEADER, shareMessage } from "./access.js";
+import { applyStaticPoints, createAccess, LINK_HEADER, shareMessage } from "./access.js";
 import { AUTH_PATH, createAuth } from "./auth.js";
 import { createEmail } from "./email.js";
-import { apiHandler } from "./endpoints.js";
+import { apiHandler, undeclaredAccess } from "./endpoints.js";
 import { createFiles } from "./files.js";
 import { isCrossSiteForm, needsSession, rateLimited } from "./guard.js";
 import { anyMessage, CLIENT_PATH, clientScript, createLive, joinRoom, LIVE_PATH, liveRoom } from "./live.js";
 import { MCP_PATH, mcpChallenge, mcpUserId, serveMcp, WELL_KNOWN } from "./mcp.js";
+import { createOrganizations, PLATFORM_API, serveOrganizations } from "./organizations.js";
+import { EndpointError } from "./endpoint-error.js";
 import { isScreen, renderScreen } from "./screens.js";
-export { LEVELS, LINK_HEADER, MAX_DEPTH } from "./access.js";
+export { LEVELS, LINK_HEADER, MAX_DEPTH, organizationPoint, teamPoint } from "./access.js";
 export { EndpointError } from "./endpoint-error.js";
 export { endpoint } from "./endpoints.js";
 function messageCheck(schema) {
@@ -32,12 +34,19 @@ export function defineApp(handler, options = {}) {
     const check = messageCheck(options.live?.message);
     const handle = handler ?? notFound;
     const api = apiHandler(options.endpoints ?? {});
+    const once = {};
+    const undeclared = undeclaredAccess(options.endpoints ?? {});
     return {
         // Read by the package to generate the browser client's routes; the app's own types come from here.
         endpoints: (options.endpoints ?? {}),
         async fetch(request, env, ctx) {
             const url = new URL(request.url);
-            const { app, close } = createContext(request, env, ctx, options);
+            // With access on, every endpoint says what it checks, so a forgotten check never ships open.
+            if (env.ACCESS === "on" && undeclared.length > 0) {
+                console.error(`endpoints ${undeclared.join(", ")} declare no access; add access: { point, level } or access: "none"`);
+                return json({ error: "this app is misconfigured; see its logs" }, 500);
+            }
+            const { app, close } = createContext(request, env, ctx, options, once);
             try {
                 if (isCrossSiteForm(request, url))
                     return json({ error: "cross-site form submissions are refused" }, 403);
@@ -45,7 +54,7 @@ export function defineApp(handler, options = {}) {
                 if (live)
                     return live;
                 if (env.MCP === "on" && env.BETTER_AUTH_SECRET) {
-                    const answered = await mcpRoute(request, url, env, ctx, app, options);
+                    const answered = await mcpRoute(request, url, env, ctx, app, options, once);
                     if (answered)
                         return answered;
                 }
@@ -62,6 +71,9 @@ export function defineApp(handler, options = {}) {
             catch (thrown) {
                 if (thrown instanceof Response)
                     return thrown;
+                // A refusal from app.access or app.organizations in a hand-written route answers like an endpoint's.
+                if (thrown instanceof EndpointError)
+                    return json({ error: thrown.message }, thrown.status);
                 throw thrown;
             }
             finally {
@@ -76,7 +88,7 @@ export function defineApp(handler, options = {}) {
             const env = rawEnv;
             return async (room, message, from) => {
                 const pending = [];
-                const { app, close } = createContext(new Request(env.APP_URL ?? "https://app.invalid/"), env, { waitUntil: (p) => void pending.push(p) }, options);
+                const { app, close } = createContext(new Request(env.APP_URL ?? "https://app.invalid/"), env, { waitUntil: (p) => void pending.push(p) }, options, once);
                 try {
                     await onMessage(room, message, from, app);
                     await Promise.allSettled(pending);
@@ -88,7 +100,7 @@ export function defineApp(handler, options = {}) {
         }, check),
     };
 }
-function createContext(request, env, ctx, options, 
+function createContext(request, env, ctx, options, once, 
 // Set when the caller is already known, as for an MCP client signed in with a token.
 knownSession) {
     const openPool = options.pool ?? defaultPool;
@@ -99,6 +111,7 @@ knownSession) {
     let auth;
     let live;
     let access;
+    let organizations;
     let session;
     const app = {
         env,
@@ -131,9 +144,29 @@ knownSession) {
             if (env.ACCESS !== "on")
                 throw new Error("this app has no access; set `access: true` in platform.jsonc");
             const origin = env.APP_URL ?? new URL(request.url).origin;
-            return (access ??= createAccess(app.db, async () => ({ userId: (await app.session())?.user.id ?? null, link: request.headers.get(LINK_HEADER) }), 
-            // Sent after the answer, so a slow or failing email never fails the share itself.
-            async (notice) => app.waitUntil(app.email.send(shareMessage(notice, env.APP_NAME ?? new URL(origin).hostname, origin)).catch((error) => console.error("sharing email failed", error)))));
+            const db = app.db;
+            return (access ??= createAccess(db, async () => ({ userId: (await app.session())?.user.id ?? null, link: request.headers.get(LINK_HEADER) }), {
+                // Sent after the answer, so a slow or failing email never fails the grant itself.
+                notify: async (notice) => app.waitUntil(app.email.send(shareMessage(notice, env.APP_NAME ?? new URL(origin).hostname, origin)).catch((error) => console.error("sharing email failed", error))),
+                // Once per Worker instance; a failure is retried by the next request.
+                ready: () => (once.staticPoints ??= applyStaticPoints(db, options.access?.points ?? {}).catch((error) => {
+                    once.staticPoints = undefined;
+                    throw error;
+                })),
+            }));
+        },
+        get organizations() {
+            if (!env.BETTER_AUTH_SECRET)
+                throw new Error("this app has no auth; set `auth: true` in platform.jsonc");
+            const origin = env.APP_URL ?? new URL(request.url).origin;
+            const appName = env.APP_NAME ?? new URL(origin).hostname;
+            return (organizations ??= createOrganizations(app.db, async () => ({ userId: (await app.session())?.user.id ?? null, link: null }), async (notice) => app.waitUntil(app.email
+                .send({
+                to: notice.to,
+                subject: `Join ${notice.organization} on ${appName}`,
+                text: `${notice.invitedBy ?? "Someone"} invited you to join ${notice.organization}:\n\n${new URL(`/login?invitation=${notice.invitationId}`, origin)}\n`,
+            })
+                .catch((error) => console.error("invitation email failed", error)))));
         },
         session() {
             return (session ??= knownSession ? knownSession() : env.BETTER_AUTH_SECRET ? app.auth.api.getSession({ headers: request.headers }) : Promise.resolve(null));
@@ -152,7 +185,7 @@ knownSession) {
 const MCP_AUTH_PATHS = ["/oauth2/", "/admin/oauth2/", "/jwks", "/.well-known/"];
 // MCP for AI clients: OAuth discovery under /.well-known/, and /mcp, where each call runs as the
 // user its token was issued to.
-async function mcpRoute(request, url, env, ctx, app, options) {
+async function mcpRoute(request, url, env, ctx, app, options, once) {
     if (url.pathname.startsWith(WELL_KNOWN))
         return app.auth.handler(request);
     if (url.pathname !== MCP_PATH)
@@ -165,7 +198,7 @@ async function mcpRoute(request, url, env, ctx, app, options) {
         const user = await (await app.auth.$context).internalAdapter.findUserById(userId);
         return user ? { user, session: { id: "mcp", userId, token: "", expiresAt: new Date(Date.now() + 60_000), createdAt: new Date(), updatedAt: new Date() } } : null;
     };
-    const { app: asUser, close } = createContext(request, env, ctx, options, known);
+    const { app: asUser, close } = createContext(request, env, ctx, options, once, known);
     try {
         if (!(await asUser.session()))
             return mcpChallenge(origin);
@@ -198,8 +231,12 @@ async function platformRoute(request, url, env, app, options) {
         return renderScreen(path, env.APP_NAME ?? url.hostname, options.screens?.stylesheet);
     if (await rateLimited(request, path, env.AUTH_LIMIT))
         return json({ error: "too many attempts; wait a minute" }, 429);
-    if (path.startsWith(`${AUTH_PATH}/organization/`) && env.AUTH_ORGANIZATIONS !== "on")
-        return json({ error: "not found" }, 404);
+    if (path.startsWith(PLATFORM_API)) {
+        if (env.AUTH_ORGANIZATIONS !== "on")
+            return json({ error: "not found" }, 404);
+        await app.requireUser();
+        return serveOrganizations(request, path, app.organizations);
+    }
     if (env.MCP !== "on" && MCP_AUTH_PATHS.some((p) => path.startsWith(`${AUTH_PATH}${p}`)))
         return json({ error: "not found" }, 404);
     if (path.startsWith(`${AUTH_PATH}/`))

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAoD,MAAM,WAAW,CAAC;AAE/J,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAiF,MAAM,aAAa,CAAC;AAE5I,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAkE,MAAM,gBAAgB,CAAC;AAmD1G,SAAS,YAAY,CAAC,MAA6B;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/K,CAAC,CAAC;AACJ,CAAC;AAWD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,MAAM,QAAQ,GAA8C,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAEpG,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAMvB,OAAgE,EAChE,OAAO,GAAwI,EAAE;IAGjJ,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,IAAK,QAAiC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAEhD,OAAO;QACL,mGAAmG;QACnG,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAM;QAEzC,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;YAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,+FAA+F;QAC/F,sFAAsF;QACtF,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACjC,MAAM,GAAG,GAAG,MAAa,CAAC;YAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAuB,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACnJ,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,EAAE,OAA4B,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC/D,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;wBAAS,CAAC;oBACT,KAAK,EAAE,CAAC;gBACV,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,EAAE,KAAK,CAAC;KACV,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,OAAgC;AAChC,qFAAqF;AACrF,YAA4C;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,IAAI,IAAsB,CAAC;IAC3B,IAAI,EAAsC,CAAC;IAC3C,IAAI,KAAwB,CAAC;IAC7B,IAAI,KAAwB,CAAC;IAC7B,IAAI,IAAsB,CAAC;IAC3B,IAAI,IAAsB,CAAC;IAC3B,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA4C,CAAC;IAEjD,MAAM,GAAG,GAA4B;QACnC,GAAG;QACH,IAAI,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI;YACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;gBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;gBACnD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;aAC/C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,IAAI;YACN,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM;YACR,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1D,OAAO,CAAC,MAAM,KAAK,YAAY,CAC7B,GAAG,CAAC,EAA6C,EACjD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxG,kFAAkF;YAClF,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC,CACvL,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9J,CAAC;QACD,KAAK,CAAC,WAAW;YACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC/C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AAEhF,iGAAiG;AACjG,gCAAgC;AAChC,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAAqB,EACrB,GAA4B,EAC5B,OAAgC;IAEhC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,IAA6B,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3L,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAClG,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,YAAY,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,gBAAgB,CAAC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAClI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAuB,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAiC,MAAM,aAAa,CAAC;AACxH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAa,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAiB,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAkC,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAoB,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAoD,MAAM,WAAW,CAAC;AAE/J,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAsB,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAsI,MAAM,aAAa,CAAC;AAG/N,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAkE,MAAM,gBAAgB,CAAC;AAoD1G,SAAS,YAAY,CAAC,MAA6B;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IAC/B,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/K,CAAC,CAAC;AACJ,CAAC;AAkBD,MAAM,WAAW,GAAG,CAAC,gBAAwB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAE9E,MAAM,QAAQ,GAA8C,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;AAEpG,0FAA0F;AAC1F,mGAAmG;AACnG,iGAAiG;AACjG,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAMvB,OAAgE,EAChE,OAAO,GAAwI,EAAE;IAGjJ,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,IAAK,QAAiC,CAAC;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAS,EAAE,CAAC;IACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE7D,OAAO;QACL,mGAAmG;QACnG,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAM;QAEzC,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAqB;YAC3D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,6FAA6F;YAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,KAAK,CAAC,aAAa,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;gBACtH,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1G,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC9D,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;gBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5E,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;oBACtE,IAAI,QAAQ;wBAAE,OAAO,QAAQ,CAAC;gBAChC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;gBAC9B,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,IAAI,MAAM,YAAY,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,qGAAqG;gBACrG,IAAI,MAAM,YAAY,aAAa;oBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3F,MAAM,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QAED,+FAA+F;QAC/F,sFAAsF;QACtF,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;YAC5B,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACjC,MAAM,GAAG,GAAG,MAAa,CAAC;YAC1B,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAuB,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACzJ,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,IAAI,EAAE,OAA4B,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC/D,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;wBAAS,CAAC;oBACT,KAAK,EAAE,CAAC;gBACV,CAAC;YACH,CAAC,CAAC;QACJ,CAAC,EAAE,KAAK,CAAC;KACV,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,GAAQ,EACR,GAAqB,EACrB,OAAgC,EAChC,IAAU;AACV,qFAAqF;AACrF,YAA4C;IAE5C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,IAAI,IAAsB,CAAC;IAC3B,IAAI,EAAsC,CAAC;IAC3C,IAAI,KAAwB,CAAC;IAC7B,IAAI,KAAwB,CAAC;IAC7B,IAAI,IAAsB,CAAC;IAC3B,IAAI,IAAsB,CAAC;IAC3B,IAAI,MAA0B,CAAC;IAC/B,IAAI,aAAwC,CAAC;IAC7C,IAAI,OAA4C,CAAC;IAEjD,MAAM,GAAG,GAA4B;QACnC,GAAG;QACH,IAAI,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC3F,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAK,EAAa,EAAE,CAAC,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,KAAK;YACP,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,IAAI;YACN,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;gBAC1B,EAAE,EAAE,GAAG,CAAC,EAA6C;gBACrD,MAAM,EAAE,GAAG,CAAC,kBAAkB;gBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM;gBACnD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,mBAAmB,EAAE,GAAG,CAAC,UAAU,KAAK,MAAM;aAC/C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,IAAI;YACN,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,KAAK,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM;YACR,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,EAAE,GAAG,GAAG,CAAC,EAA6C,CAAC;YAC7D,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE;gBAC5I,kFAAkF;gBAClF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC9L,sEAAsE;gBACtE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACtG,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;oBAC9B,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;aACJ,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,aAAa;YACf,IAAI,CAAC,GAAG,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YACzG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YACzD,OAAO,CAAC,aAAa,KAAK,mBAAmB,CAAC,GAAG,CAAC,EAA6C,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAC9L,GAAG,CAAC,SAAS,CACX,GAAG,CAAC,KAAK;iBACN,IAAI,CAAC;gBACJ,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,QAAQ,MAAM,CAAC,YAAY,OAAO,OAAO,EAAE;gBACpD,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,wBAAwB,MAAM,CAAC,YAAY,QAAQ,IAAI,GAAG,CAAC,qBAAqB,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,IAAI;aACzJ,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC,CACrE,CACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO;YACL,OAAO,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9J,CAAC;QACD,KAAK,CAAC,WAAW;YACf,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;KAC/C,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AAEhF,iGAAiG;AACjG,gCAAgC;AAChC,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAAqB,EACrB,GAA4B,EAC5B,OAAgC,EAChC,IAAU;IAEV,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,IAA6B,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3L,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CACtB,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAClG,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO,YAAY,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;QAC1E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,GAAQ,EACR,GAA4B,EAC5B,OAAgC;IAEhC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC1B,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrI,IAAI,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IAClI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvE,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/runtime/organizations.d.ts

@@ -0,0 +1,77 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { type Caller } from "./access.js";
+export declare const INVITATION_DAYS = 7;
+export declare const ADMINS = "Admins";
+export interface Organization {
+    id: string;
+    name: string;
+    slug: string;
+}
+export interface Member {
+    userId: string;
+    name: string;
+    email: string;
+    admin: boolean;
+}
+export interface Team {
+    id: string;
+    name: string;
+    admins: boolean;
+}
+export interface Invitation {
+    id: string;
+    email: string;
+    teamId: string | null;
+    expiresAt: Date;
+}
+export interface MyInvitation {
+    id: string;
+    organizationId: string;
+    organization: string;
+    teamId: string | null;
+    team: string | null;
+    invitedBy: string | null;
+    expiresAt: Date;
+}
+export interface InvitationNotice {
+    to: string;
+    organization: string;
+    invitedBy: string | null;
+    invitationId: string;
+}
+export interface Organizations {
+    create(input: {
+        name: string;
+        slug?: string;
+    }): Promise<Organization>;
+    list(): Promise<Organization[]>;
+    get(id: string): Promise<Organization>;
+    rename(id: string, name: string): Promise<void>;
+    remove(id: string): Promise<void>;
+    requireMember(id: string): Promise<void>;
+    members(id: string): Promise<Member[]>;
+    removeMember(id: string, userId: string): Promise<void>;
+    invite(id: string, email: string, options?: {
+        team?: string;
+    }): Promise<Invitation>;
+    invitations(id: string): Promise<Invitation[]>;
+    revokeInvitation(id: string, invitationId: string): Promise<void>;
+    accept(invitationId: string): Promise<string>;
+    myInvitations(): Promise<MyInvitation[]>;
+    decline(invitationId: string): Promise<void>;
+    teams(id: string): Promise<Team[]>;
+    team(teamId: string): Promise<Team & {
+        organizationId: string;
+    }>;
+    createTeam(id: string, name: string): Promise<Team>;
+    renameTeam(teamId: string, name: string): Promise<void>;
+    removeTeam(teamId: string): Promise<void>;
+    teamMembers(teamId: string): Promise<Member[]>;
+    addToTeam(teamId: string, userId: string): Promise<void>;
+    removeFromTeam(teamId: string, userId: string): Promise<void>;
+}
+type Db = Pick<NodePgDatabase<Record<string, unknown>>, "execute" | "transaction">;
+export declare function createOrganizations(db: Db, caller: () => Promise<Caller>, notify?: (notice: InvitationNotice) => Promise<void>): Organizations;
+export declare const PLATFORM_API = "/api/platform/";
+export declare function serveOrganizations(request: Request, path: string, orgs: Organizations): Promise<Response>;
+export {};

package/dist/runtime/organizations.js

@@ -0,0 +1,326 @@
+import { sql } from "drizzle-orm";
+import { createAccess, organizationPoint, teamPoint } from "./access.js";
+import { EndpointError } from "./endpoint-error.js";
+// The platform's own organizations, teams, members and invitations; see docs/design.md, Auth
+// behavior, Organizations. Members carry no roles: who may do what is decided by control points,
+// the organization's point for the organization and each team's point for the team, and the
+// built-in Admins team gets `manage` on everything under its organization.
+export const INVITATION_DAYS = 7;
+export const ADMINS = "Admins";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const notFound = () => new EndpointError(404, "not found");
+const conflict = (message) => new EndpointError(409, message);
+const invalid = (message) => new EndpointError(400, message);
+const rows = async (db, query) => (await db.execute(query)).rows;
+// Ids come from URLs and bodies; anything that is not a UUID names nothing.
+function uuid(value) {
+    if (typeof value !== "string" || !UUID.test(value))
+        throw notFound();
+    return value.toLowerCase();
+}
+function name(value) {
+    if (typeof value !== "string" || value.trim().length === 0 || value.trim().length > 100)
+        throw invalid("a name must be 1 to 100 characters");
+    return value.trim();
+}
+function slugOf(value, fallback) {
+    const slug = typeof value === "string" ? value : `${fallback.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 40) || "org"}-${crypto.randomUUID().slice(0, 8)}`;
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/.test(slug))
+        throw invalid("a slug is 1 to 64 lowercase letters, digits and dashes, not starting or ending with a dash");
+    return slug;
+}
+function email(value) {
+    if (typeof value !== "string" || value.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim()))
+        throw invalid("an email address is needed");
+    return value.trim().toLowerCase();
+}
+export function createOrganizations(db, caller, notify) {
+    const access = createAccess(db, caller);
+    async function me() {
+        const { userId } = await caller();
+        if (!userId || !UUID.test(userId))
+            throw new EndpointError(401, "sign in first");
+        return userId;
+    }
+    // The team's organization, when the caller can see the team at all.
+    async function teamOrganization(on, teamId) {
+        const [team] = await rows(on, sql `select organization_id, admins from team where id = ${teamId}::uuid`);
+        if (!team)
+            throw notFound();
+        return { organizationId: team.organization_id, admins: team.admins };
+    }
+    // Refuses a change that would leave an organization with no admin.
+    async function keepAnAdmin(on, organizationId, userId) {
+        const [row] = await rows(on, sql `select exists (select 1 from team_member tm join team t on t.id = tm.team_id where t.organization_id = ${organizationId}::uuid and t.admins and tm.user_id = ${userId}::uuid) as admin,
+                 (select count(*) from team_member tm join team t on t.id = tm.team_id join member m on m.user_id = tm.user_id and m.organization_id = t.organization_id
+                  where t.organization_id = ${organizationId}::uuid and t.admins)::int as admins`);
+        if (row?.admin && Number(row.admins) <= 1)
+            throw conflict("an organization needs at least one admin; add another first");
+    }
+    async function makeTeam(tx, organizationId, teamName, admins, creator) {
+        const [team] = await rows(tx, sql `insert into team (name, organization_id, admins) values (${teamName}, ${organizationId}::uuid, ${admins}) returning id`);
+        await tx.execute(sql `
+      insert into access_point (id, parent_id, organization_id, for_team, created_by)
+      values (${teamPoint(team.id)}, ${organizationPoint(organizationId)}, ${organizationId}::uuid, ${team.id}::uuid, ${creator}::uuid)`);
+        await tx.execute(sql `
+      insert into access_grant (point_id, team_id, user_id, level, granted_by)
+      values (${teamPoint(team.id)}, ${team.id}::uuid, null, 3, ${creator}::uuid), (${teamPoint(team.id)}, null, ${creator}::uuid, 5, ${creator}::uuid)`);
+        return { id: team.id, name: teamName, admins };
+    }
+    const listMembers = (on, where) => rows(on, sql `select u.id as user_id, u.name, u.email,
+            exists (select 1 from team_member tm join team t on t.id = tm.team_id where t.organization_id = m.organization_id and t.admins and tm.user_id = u.id) as admin
+          from member m join "user" u on u.id = m.user_id where ${where} order by u.name, u.id`).then((found) => found.map((r) => ({ userId: r.user_id, name: r.name, email: r.email, admin: Boolean(r.admin) })));
+    return {
+        async create(input) {
+            const creator = await me();
+            const orgName = name(input?.name);
+            const slug = slugOf(input?.slug, orgName);
+            return db.transaction(async (raw) => {
+                const tx = raw;
+                let org;
+                try {
+                    [org] = await rows(tx, sql `insert into organization (name, slug) values (${orgName}, ${slug}) returning id`);
+                }
+                catch (error) {
+                    if (error.code === "23505" || error.cause?.code === "23505")
+                        throw conflict("that slug is taken");
+                    throw error;
+                }
+                const id = org.id;
+                await tx.execute(sql `insert into member (organization_id, user_id) values (${id}::uuid, ${creator}::uuid)`);
+                await tx.execute(sql `
+          insert into access_point (id, organization_id, for_organization, created_by) values (${organizationPoint(id)}, ${id}::uuid, ${id}::uuid, ${creator}::uuid)`);
+                await tx.execute(sql `
+          insert into access_grant (point_id, organization_id, level, granted_by) values (${organizationPoint(id)}, ${id}::uuid, 1, ${creator}::uuid)`);
+                await tx.execute(sql `
+          insert into access_grant (point_id, user_id, level, granted_by) values (${organizationPoint(id)}, ${creator}::uuid, 5, ${creator}::uuid)`);
+                const admins = await makeTeam(tx, id, ADMINS, true, creator);
+                await tx.execute(sql `insert into team_member (team_id, user_id) values (${admins.id}::uuid, ${creator}::uuid)`);
+                return { id, name: orgName, slug };
+            });
+        },
+        async list() {
+            const userId = await me();
+            return rows(db, sql `select o.id, o.name, o.slug from organization o join member m on m.organization_id = o.id where m.user_id = ${userId}::uuid order by o.name, o.id`);
+        },
+        async get(id) {
+            await access.check(organizationPoint(uuid(id)));
+            const [org] = await rows(db, sql `select id, name, slug from organization where id = ${uuid(id)}::uuid`);
+            if (!org)
+                throw notFound();
+            return org;
+        },
+        async rename(id, newName) {
+            await access.require(organizationPoint(uuid(id)), "write");
+            await db.execute(sql `update organization set name = ${name(newName)}, updated_at = now() where id = ${uuid(id)}::uuid`);
+        },
+        async remove(id) {
+            await access.require(organizationPoint(uuid(id)), "delete");
+            await db.execute(sql `delete from organization where id = ${uuid(id)}::uuid`);
+        },
+        async requireMember(id) {
+            const userId = await me();
+            const [row] = await rows(db, sql `select 1 from member where organization_id = ${uuid(id)}::uuid and user_id = ${userId}::uuid`);
+            if (!row)
+                throw notFound();
+        },
+        async members(id) {
+            await access.check(organizationPoint(uuid(id)));
+            return listMembers(db, sql `m.organization_id = ${uuid(id)}::uuid`);
+        },
+        async removeMember(id, userId) {
+            const orgId = uuid(id);
+            const leaving = uuid(userId);
+            const self = (await me()) === leaving;
+            // Anyone may leave; removing someone else needs `manage` on the organization.
+            if (self)
+                await access.check(organizationPoint(orgId));
+            else
+                await access.require(organizationPoint(orgId), "manage");
+            await db.transaction(async (raw) => {
+                const tx = raw;
+                await tx.execute(sql `select pg_advisory_xact_lock(hashtext(${`@celsoft/platform admins ${orgId}`}))`);
+                const [row] = await rows(tx, sql `select 1 from member where organization_id = ${orgId}::uuid and user_id = ${leaving}::uuid`);
+                if (!row)
+                    throw notFound();
+                await keepAnAdmin(tx, orgId, leaving);
+                await tx.execute(sql `delete from team_member where user_id = ${leaving}::uuid and team_id in (select id from team where organization_id = ${orgId}::uuid)`);
+                await tx.execute(sql `delete from member where organization_id = ${orgId}::uuid and user_id = ${leaving}::uuid`);
+            });
+        },
+        async invite(id, address, options = {}) {
+            const orgId = uuid(id);
+            await access.require(organizationPoint(orgId), "manage");
+            const to = email(address);
+            const teamId = options.team === undefined || options.team === null ? null : uuid(options.team);
+            if (teamId && (await teamOrganization(db, teamId)).organizationId !== orgId)
+                throw notFound();
+            const inviter = await me();
+            const [row] = await rows(db, sql `insert into invitation (organization_id, email, team_id, expires_at, inviter_id)
+            values (${orgId}::uuid, ${to}, ${teamId}::uuid, now() + make_interval(days => ${INVITATION_DAYS}), ${inviter}::uuid)
+            on conflict on constraint invitation_once do update set team_id = excluded.team_id, expires_at = excluded.expires_at, inviter_id = excluded.inviter_id, updated_at = now()
+            returning id, expires_at, (select name from "user" where id = ${inviter}::uuid) as inviter, (select name from organization where id = ${orgId}::uuid) as org`);
+            await notify?.({ to, organization: row.org, invitedBy: row.inviter, invitationId: row.id });
+            return { id: row.id, email: to, teamId, expiresAt: new Date(row.expires_at) };
+        },
+        async invitations(id) {
+            await access.require(organizationPoint(uuid(id)), "manage");
+            const found = await rows(db, sql `select id, email, team_id, expires_at from invitation where organization_id = ${uuid(id)}::uuid and expires_at > now() order by created_at, id`);
+            return found.map((r) => ({ id: r.id, email: r.email, teamId: r.team_id, expiresAt: new Date(r.expires_at) }));
+        },
+        async revokeInvitation(id, invitationId) {
+            await access.require(organizationPoint(uuid(id)), "manage");
+            await db.execute(sql `delete from invitation where id = ${uuid(invitationId)}::uuid and organization_id = ${uuid(id)}::uuid`);
+        },
+        async accept(invitationId) {
+            const userId = await me();
+            const invitationKey = uuid(invitationId);
+            return db.transaction(async (raw) => {
+                const tx = raw;
+                const [inv] = await rows(tx, sql `select i.organization_id, i.team_id from invitation i join "user" u on u.id = ${userId}::uuid
+              where i.id = ${invitationKey}::uuid and i.expires_at > now() and u.email_verified and lower(u.email) = i.email
+              for update of i`);
+                if (!inv)
+                    throw notFound();
+                await tx.execute(sql `insert into member (organization_id, user_id) values (${inv.organization_id}::uuid, ${userId}::uuid) on conflict on constraint member_once do nothing`);
+                if (inv.team_id)
+                    await tx.execute(sql `insert into team_member (team_id, user_id) values (${inv.team_id}::uuid, ${userId}::uuid) on conflict on constraint team_member_once do nothing`);
+                await tx.execute(sql `delete from invitation where id = ${invitationKey}::uuid`);
+                return inv.organization_id;
+            });
+        },
+        async myInvitations() {
+            const userId = await me();
+            const found = await rows(db, sql `select i.id, i.organization_id, o.name as organization, i.team_id, t.name as team, inviter.name as invited_by, i.expires_at
+            from invitation i join "user" u on u.id = ${userId}::uuid and u.email_verified and lower(u.email) = i.email
+            join organization o on o.id = i.organization_id
+            left join team t on t.id = i.team_id
+            left join "user" inviter on inviter.id = i.inviter_id
+            where i.expires_at > now() order by i.created_at, i.id`);
+            return found.map((r) => ({ id: r.id, organizationId: r.organization_id, organization: r.organization, teamId: r.team_id, team: r.team, invitedBy: r.invited_by, expiresAt: new Date(r.expires_at) }));
+        },
+        async decline(invitationId) {
+            const userId = await me();
+            const [row] = await rows(db, sql `delete from invitation i using "user" u where i.id = ${uuid(invitationId)}::uuid and u.id = ${userId}::uuid and u.email_verified and lower(u.email) = i.email returning i.id`);
+            if (!row)
+                throw notFound();
+        },
+        async team(teamId) {
+            await access.check(teamPoint(uuid(teamId)));
+            const [found] = await rows(db, sql `select id, name, admins, organization_id from team where id = ${uuid(teamId)}::uuid`);
+            if (!found)
+                throw notFound();
+            return { id: found.id, name: found.name, admins: found.admins, organizationId: found.organization_id };
+        },
+        async teams(id) {
+            await access.check(organizationPoint(uuid(id)));
+            return rows(db, sql `select id, name, admins from team where organization_id = ${uuid(id)}::uuid order by admins desc, name, id`);
+        },
+        async createTeam(id, teamName) {
+            const orgId = uuid(id);
+            const n = name(teamName);
+            await access.require(organizationPoint(orgId), "create");
+            const creator = await me();
+            return db.transaction(async (raw) => makeTeam(raw, orgId, n, false, creator));
+        },
+        async renameTeam(teamId, newName) {
+            await access.require(teamPoint(uuid(teamId)), "write");
+            await db.execute(sql `update team set name = ${name(newName)}, updated_at = now() where id = ${uuid(teamId)}::uuid`);
+        },
+        async removeTeam(teamId) {
+            await access.require(teamPoint(uuid(teamId)), "delete");
+            if ((await teamOrganization(db, uuid(teamId))).admins)
+                throw conflict("the Admins team stays as long as its organization");
+            await db.execute(sql `delete from team where id = ${uuid(teamId)}::uuid`);
+        },
+        async teamMembers(teamId) {
+            await access.check(teamPoint(uuid(teamId)));
+            return listMembers(db, sql `exists (select 1 from team_member tm where tm.team_id = ${uuid(teamId)}::uuid and tm.user_id = m.user_id) and m.organization_id = (select organization_id from team where id = ${uuid(teamId)}::uuid)`);
+        },
+        async addToTeam(teamId, userId) {
+            const team = uuid(teamId);
+            const adding = uuid(userId);
+            await access.require(teamPoint(team), "manage");
+            const { organizationId } = await teamOrganization(db, team);
+            const [row] = await rows(db, sql `select 1 from member where organization_id = ${organizationId}::uuid and user_id = ${adding}::uuid`);
+            if (!row)
+                throw notFound();
+            await db.execute(sql `insert into team_member (team_id, user_id) values (${team}::uuid, ${adding}::uuid) on conflict on constraint team_member_once do nothing`);
+        },
+        async removeFromTeam(teamId, userId) {
+            const team = uuid(teamId);
+            const leaving = uuid(userId);
+            if ((await me()) === leaving)
+                await access.check(teamPoint(team));
+            else
+                await access.require(teamPoint(team), "manage");
+            const { organizationId, admins } = await teamOrganization(db, team);
+            await db.transaction(async (raw) => {
+                const tx = raw;
+                await tx.execute(sql `select pg_advisory_xact_lock(hashtext(${`@celsoft/platform admins ${organizationId}`}))`);
+                if (admins)
+                    await keepAnAdmin(tx, organizationId, leaving);
+                await tx.execute(sql `delete from team_member where team_id = ${team}::uuid and user_id = ${leaving}::uuid`);
+            });
+        },
+    };
+}
+export const PLATFORM_API = "/api/platform/";
+const ROUTES = [
+    ["GET", /^organizations$/, (o) => o.list()],
+    ["POST", /^organizations$/, (o, _, b) => o.create({ name: b.name, slug: b.slug })],
+    ["GET", /^organizations\/([^/]+)$/, (o, [id]) => o.get(id)],
+    ["PATCH", /^organizations\/([^/]+)$/, (o, [id], b) => o.rename(id, b.name)],
+    ["DELETE", /^organizations\/([^/]+)$/, (o, [id]) => o.remove(id)],
+    ["GET", /^organizations\/([^/]+)\/members$/, (o, [id]) => o.members(id)],
+    ["DELETE", /^organizations\/([^/]+)\/members\/([^/]+)$/, (o, [id, user]) => o.removeMember(id, user)],
+    ["GET", /^organizations\/([^/]+)\/invitations$/, (o, [id]) => o.invitations(id)],
+    ["POST", /^organizations\/([^/]+)\/invitations$/, (o, [id], b) => o.invite(id, b.email, { team: b.team })],
+    ["DELETE", /^organizations\/([^/]+)\/invitations\/([^/]+)$/, (o, [id, inv]) => o.revokeInvitation(id, inv)],
+    ["GET", /^invitations$/, (o) => o.myInvitations()],
+    ["POST", /^invitations\/([^/]+)\/accept$/, async (o, [inv]) => ({ organizationId: await o.accept(inv) })],
+    ["DELETE", /^invitations\/([^/]+)$/, (o, [inv]) => o.decline(inv)],
+    ["GET", /^organizations\/([^/]+)\/teams$/, (o, [id]) => o.teams(id)],
+    ["POST", /^organizations\/([^/]+)\/teams$/, (o, [id], b) => o.createTeam(id, b.name)],
+    ["GET", /^teams\/([^/]+)$/, (o, [team]) => o.team(team)],
+    ["PATCH", /^teams\/([^/]+)$/, (o, [team], b) => o.renameTeam(team, b.name)],
+    ["DELETE", /^teams\/([^/]+)$/, (o, [team]) => o.removeTeam(team)],
+    ["GET", /^teams\/([^/]+)\/members$/, (o, [team]) => o.teamMembers(team)],
+    ["POST", /^teams\/([^/]+)\/members$/, (o, [team], b) => o.addToTeam(team, b.user)],
+    ["DELETE", /^teams\/([^/]+)\/members\/([^/]+)$/, (o, [team, user]) => o.removeFromTeam(team, user)],
+];
+// The organization routes browsers call, under /api/platform/, answering JSON like every API
+// route; an unknown path or method under the prefix is a 404.
+export async function serveOrganizations(request, path, orgs) {
+    const rest = path.slice(PLATFORM_API.length);
+    for (const [method, pattern, run] of ROUTES) {
+        const match = pattern.exec(rest);
+        if (!match || request.method !== method)
+            continue;
+        let body = {};
+        if (method === "POST" || method === "PATCH") {
+            const parsed = await request.json().catch(() => undefined);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                return Response.json({ error: "send a JSON object" }, { status: 400 });
+            body = parsed;
+        }
+        try {
+            let params;
+            try {
+                params = match.slice(1).map(decodeURIComponent);
+            }
+            catch {
+                return Response.json({ error: "not found" }, { status: 404 });
+            }
+            const result = await run(orgs, params, body);
+            return Response.json(result ?? {}, { status: method === "POST" && !rest.endsWith("/accept") ? 201 : 200 });
+        }
+        catch (error) {
+            if (error instanceof EndpointError)
+                return Response.json({ error: error.message }, { status: error.status });
+            throw error;
+        }
+    }
+    return Response.json({ error: "not found" }, { status: 404 });
+}
+//# sourceMappingURL=organizations.js.map