@forge-cms/runtime 0.5.0 → 0.7.0

package/dist/auth-handlers.d.ts

@@ -8,12 +8,50 @@ import type { AnyForgeCmsRuntime } from './runtime.js';
  * instead of re-implementing (and risking drifting from) this switch.
  */
 export declare function authFailureResponse(reason: AuthFailureReason): Response;
+/** One login or signup attempt, as handed to the host's {@link AuthAttemptThrottle} (spec 069). */
+export interface AuthAttempt {
+    action: 'login' | 'signup';
+    /**
+     * The submitted email, trimmed and lower-cased — the same canonical form the users adapter looks up.
+     * It is what was *submitted*: it says nothing about whether such an account exists.
+     */
+    identifier: string;
+    /** The original request, for host policy (a client address, a tenant header, …). Its body is consumed. */
+    request: Request;
+}
+export type AuthAttemptDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    /** Seconds until a retry may succeed. Emitted as `Retry-After` when a finite number > 0. */
+    retryAfterSeconds?: number;
+};
+/**
+ * A host-provided limiter for login/signup (spec 069). Forge calls it exactly once per well-formed
+ * attempt — after the bounded body is parsed and before any credential lookup or password hashing —
+ * with the same arguments whether or not the account exists. Forge keeps no counters: the host decides
+ * the key(s) (identifier, client, tenant, a combination) and where the state lives (a Cloudflare Rate
+ * Limiting binding, a proxy, an external service). A rejection is `429 RATE_LIMITED`; a throw or any
+ * result other than `{ allowed: true | false }` fails closed as `500`.
+ */
+export type AuthAttemptThrottle = (attempt: AuthAttempt) => AuthAttemptDecision | Promise<AuthAttemptDecision>;
 export interface AuthHandlerOptions<TEnv = unknown> {
     runtime: AnyForgeCmsRuntime<TEnv>;
     /** Omit the cookie's `Secure` attribute — only for local `http://` development. Defaults to `true`. */
     cookie?: {
         secure?: boolean;
     };
+    /**
+     * Login/signup only: the host's attempt limiter. Omitted, nothing is throttled (unchanged behaviour).
+     * Ignored by `handleLogout`/`handleMe`.
+     */
+    throttle?: AuthAttemptThrottle;
+    /**
+     * Login/signup only: the largest accepted JSON body, in bytes. Defaults to
+     * `DEFAULT_AUTH_MAX_BODY_BYTES` (8 KiB); raise it only with `passwordPolicy.maxLength`. An integer
+     * from 1 to 1 MiB; anything else makes the handler throw (a configuration error, not a response).
+     */
+    maxBodyBytes?: number;
 }
 export interface SignupHandlerOptions<TEnv = unknown> extends AuthHandlerOptions<TEnv> {
     /** Public signup is opt-in — no implicit default-on. */
@@ -23,13 +61,17 @@ export interface SignupHandlerOptions<TEnv = unknown> extends AuthHandlerOptions
  * `POST` `{ email, password }` → `{ data: { user, token } }` (unchanged shape — Bearer-compatible)
  * plus a `Set-Cookie` that starts a browser session. `404` if the configured `AuthAdapter` doesn't
  * implement `login`.
+ *
+ * Order (spec 069): bounded body (`413`/`400`) → `options.throttle` (`429`) → `auth.login` → response.
  */
 export declare function handleLogin<TEnv = unknown>(context: ApiContext<TEnv>, options: AuthHandlerOptions<TEnv>): Promise<Response>;
 /**
  * `POST` `{ email, password, name? }` → `{ data: { user, token } }` + `Set-Cookie`. Any other body
  * field (e.g. a `role`) is never read — role escalation through this endpoint is structurally
  * impossible, not merely hidden. `404` when `options.enabled` is `false` or the adapter doesn't
- * implement `signup`.
+ * implement `signup` — decided before the body is read or the throttle is called.
+ *
+ * Order (spec 069): bounded body (`413`/`400`) → `options.throttle` (`429`) → `auth.signup` → response.
  */
 export declare function handleSignup<TEnv = unknown>(context: ApiContext<TEnv>, options: SignupHandlerOptions<TEnv>): Promise<Response>;
 /**

package/dist/auth-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handlers.d.ts","sourceRoot":"","sources":["../src/auth-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAwBvD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,QAAQ,CAWvE;AAUD,MAAM,WAAW,kBAAkB,CAAC,IAAI,GAAG,OAAO;IAChD,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,uGAAuG;IACvG,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB,CAAC,IAAI,GAAG,OAAO,CAAE,SAAQ,kBAAkB,CAAC,IAAI,CAAC;IACpF,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAG,OAAO,EAC9C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CA0BnB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAG,OAAO,EAC/C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CAmCnB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAG,OAAO,EAC/C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CAanB;AAED,8EAA8E;AAC9E,wBAAsB,QAAQ,CAAC,IAAI,GAAG,OAAO,EAC3C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CAUnB"}
+{"version":3,"file":"auth-handlers.d.ts","sourceRoot":"","sources":["../src/auth-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAuCvD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,QAAQ,CAavE;AAED,mGAAmG;AACnG,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC3B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IACE,OAAO,EAAE,KAAK,CAAC;IACf,4FAA4F;IAC5F,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEN;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,OAAO,EAAE,WAAW,KACjB,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB,CAAC,IAAI,GAAG,OAAO;IAChD,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,uGAAuG;IACvG,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA4BD,MAAM,WAAW,oBAAoB,CAAC,IAAI,GAAG,OAAO,CAAE,SAAQ,kBAAkB,CAAC,IAAI,CAAC;IACpF,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAG,OAAO,EAC9C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAG,OAAO,EAC/C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,QAAQ,CAAC,CA0CnB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAG,OAAO,EAC/C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CAanB;AAED,8EAA8E;AAC9E,wBAAsB,QAAQ,CAAC,IAAI,GAAG,OAAO,EAC3C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EACzB,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAChC,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/auth-handlers.js

@@ -1,7 +1,8 @@
 import { getLogger } from '@forge-cms/core';
 import { ForgeAuthError, buildLogoutCookie, buildSessionCookie } from '@forge-cms/auth';
 import { assertCsrfSafe } from './csrf.js';
-import { InvalidInputError, isForgeError, toApiErrorBody } from './errors.js';
+import { readBoundedJsonObject, resolveMaxBodyBytes } from './body.js';
+import { RateLimitedError, isForgeError, toApiErrorBody } from './errors.js';
 function jsonResponse(data, status = 200) {
     return new Response(JSON.stringify(data), {
         status,
@@ -11,12 +12,24 @@ function jsonResponse(data, status = 200) {
 function errorResponse(code, message, status) {
     return jsonResponse({ error: { code, message } }, status);
 }
-function toErrorResponse(err) {
+/**
+ * Expected failures (typed `ForgeError`s: bad JSON, 413, 429, CSRF, …) are responses, never log lines.
+ * An unexpected one is logged as metadata only — the operation and the error's class name — because an
+ * adapter's, driver's or host throttle's error message can quote whatever it was handed: a password,
+ * a token, a cookie, the request body (spec 069).
+ */
+function toErrorResponse(err, operation) {
     if (isForgeError(err)) {
-        const body = toApiErrorBody(err);
-        return jsonResponse(body, err.status);
+        const response = jsonResponse(toApiErrorBody(err), err.status);
+        if (err instanceof RateLimitedError && err.retryAfterSeconds !== undefined) {
+            response.headers.set('retry-after', String(err.retryAfterSeconds));
+        }
+        return response;
     }
-    getLogger().error('Unexpected error in auth handler', err);
+    getLogger().error('Unexpected error in auth handler', {
+        operation,
+        error: err instanceof Error ? err.name : typeof err
+    });
     return errorResponse('INTERNAL_ERROR', 'An unexpected error occurred', 500);
 }
 /**
@@ -35,33 +48,57 @@ export function authFailureResponse(reason) {
             return errorResponse('INVALID_INPUT', 'Password does not meet requirements', 400);
         case 'email-in-use':
             return errorResponse('UNIQUE_CONSTRAINT', 'Email is already in use', 409);
+        case 'invalid-name':
+            return errorResponse('INVALID_INPUT', 'Invalid name', 400);
     }
 }
-async function readJsonBody(request) {
-    try {
-        return (await request.json());
-    }
-    catch {
-        throw new InvalidInputError('Invalid JSON body');
+/** `Retry-After` must be a positive whole number of seconds; clamp absurd values to one day. */
+const MAX_RETRY_AFTER_SECONDS = 24 * 60 * 60;
+async function enforceThrottle(throttle, attempt) {
+    if (!throttle)
+        return;
+    const decision = (await throttle(attempt));
+    if (decision?.allowed === true)
+        return;
+    if (decision?.allowed !== false) {
+        throw new Error('The auth throttle returned neither { allowed: true } nor { allowed: false }');
     }
+    const retry = 'retryAfterSeconds' in decision ? decision.retryAfterSeconds : undefined;
+    const retryAfter = typeof retry === 'number' && Number.isFinite(retry) && retry > 0
+        ? Math.min(Math.ceil(retry), MAX_RETRY_AFTER_SECONDS)
+        : undefined;
+    throw new RateLimitedError(retryAfter);
+}
+/** The canonical identifier handed to the throttle — the users adapter's own email normalisation. */
+function canonicalIdentifier(email) {
+    return email.trim().toLowerCase();
 }
 /**
  * `POST` `{ email, password }` → `{ data: { user, token } }` (unchanged shape — Bearer-compatible)
  * plus a `Set-Cookie` that starts a browser session. `404` if the configured `AuthAdapter` doesn't
  * implement `login`.
+ *
+ * Order (spec 069): bounded body (`413`/`400`) → `options.throttle` (`429`) → `auth.login` → response.
  */
 export async function handleLogin(context, options) {
     const auth = options.runtime.adapters.auth;
     if (!auth.login) {
         return errorResponse('NOT_FOUND', 'Login is not supported by the configured auth adapter', 404);
     }
+    // A bad `maxBodyBytes` is a host configuration error: thrown as is, never mapped to a response.
+    const maxBytes = resolveMaxBodyBytes(options.maxBodyBytes);
     try {
-        const body = await readJsonBody(context.request);
+        const body = await readBoundedJsonObject(context.request, { maxBytes });
         const email = typeof body['email'] === 'string' ? body['email'] : undefined;
         const password = typeof body['password'] === 'string' ? body['password'] : undefined;
         if (!email || !password) {
             return errorResponse('INVALID_INPUT', 'Missing email or password', 400);
         }
+        await enforceThrottle(options.throttle, {
+            action: 'login',
+            identifier: canonicalIdentifier(email),
+            request: context.request
+        });
         const result = await auth.login(email, password);
         if (!result.ok)
             return authFailureResponse(result.reason);
@@ -70,14 +107,16 @@ export async function handleLogin(context, options) {
         return response;
     }
     catch (err) {
-        return toErrorResponse(err);
+        return toErrorResponse(err, 'login');
     }
 }
 /**
  * `POST` `{ email, password, name? }` → `{ data: { user, token } }` + `Set-Cookie`. Any other body
  * field (e.g. a `role`) is never read — role escalation through this endpoint is structurally
  * impossible, not merely hidden. `404` when `options.enabled` is `false` or the adapter doesn't
- * implement `signup`.
+ * implement `signup` — decided before the body is read or the throttle is called.
+ *
+ * Order (spec 069): bounded body (`413`/`400`) → `options.throttle` (`429`) → `auth.signup` → response.
  */
 export async function handleSignup(context, options) {
     if (!options.enabled) {
@@ -87,14 +126,21 @@ export async function handleSignup(context, options) {
     if (!auth.signup) {
         return errorResponse('NOT_FOUND', 'Signup is not supported by the configured auth adapter', 404);
     }
+    // A bad `maxBodyBytes` is a host configuration error: thrown as is, never mapped to a response.
+    const maxBytes = resolveMaxBodyBytes(options.maxBodyBytes);
     try {
-        const body = await readJsonBody(context.request);
+        const body = await readBoundedJsonObject(context.request, { maxBytes });
         const email = typeof body['email'] === 'string' ? body['email'] : undefined;
         const password = typeof body['password'] === 'string' ? body['password'] : undefined;
         const name = typeof body['name'] === 'string' ? body['name'] : undefined;
         if (!email || !password) {
             return errorResponse('INVALID_INPUT', 'Missing email or password', 400);
         }
+        await enforceThrottle(options.throttle, {
+            action: 'signup',
+            identifier: canonicalIdentifier(email),
+            request: context.request
+        });
         const result = await auth.signup({ email, password, ...(name !== undefined && { name }) });
         if (!result.ok)
             return authFailureResponse(result.reason);
@@ -103,7 +149,7 @@ export async function handleSignup(context, options) {
         return response;
     }
     catch (err) {
-        return toErrorResponse(err);
+        return toErrorResponse(err, 'signup');
     }
 }
 /**
@@ -116,7 +162,7 @@ export async function handleLogout(context, options) {
         assertCsrfSafe(context.request);
     }
     catch (err) {
-        return toErrorResponse(err);
+        return toErrorResponse(err, 'logout');
     }
     const response = new Response(null, { status: 204 });
     response.headers.append('set-cookie', buildLogoutCookie({ secure: options.cookie?.secure ?? true }));
@@ -132,7 +178,7 @@ export async function handleMe(context, options) {
         if (err instanceof ForgeAuthError) {
             return errorResponse('UNAUTHORIZED', 'Unauthorized', 401);
         }
-        return toErrorResponse(err);
+        return toErrorResponse(err, 'me');
     }
 }
 //# sourceMappingURL=auth-handlers.js.map

package/dist/auth-handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-handlers.js","sourceRoot":"","sources":["../src/auth-handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9E,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IAClE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,SAAS,EAAE,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,aAAa,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,aAAa,CAAC,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QACzE,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC,eAAe,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACtE,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC,eAAe,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAgB;IAC1C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,aAAa,CAAC,WAAW,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,eAAe,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC7E,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,aAAa,CAClB,WAAW,EACX,wDAAwD,EACxD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,eAAe,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC7E,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAAiC;IAEjC,IAAI,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAyB,EACzB,OAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-handlers.js","sourceRoot":"","sources":["../src/auth-handlers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExF,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7E,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IAClE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAID;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,SAAwB;IAC7D,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,GAAG,YAAY,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC3E,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,SAAS,EAAE,CAAC,KAAK,CAAC,kCAAkC,EAAE;QACpD,SAAS;QACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG;KACpD,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,gBAAgB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB;YACxB,OAAO,aAAa,CAAC,cAAc,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QACzE,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC,eAAe,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACtE,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC,eAAe,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACpF,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC5E,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,eAAe,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAmDD,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE7C,KAAK,UAAU,eAAe,CAC5B,QAAyC,EACzC,OAAoB;IAEpB,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAoD,CAAC;IAC9F,IAAI,QAAQ,EAAE,OAAO,KAAK,IAAI;QAAE,OAAO;IACvC,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,uBAAuB,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,qGAAqG;AACrG,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyB,EACzB,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,aAAa,CAAC,WAAW,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAC;IAClG,CAAC;IAED,gGAAgG;IAChG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,eAAe,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpF,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC7E,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAAmC;IAEnC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,aAAa,CAClB,WAAW,EACX,wDAAwD,EACxD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,eAAe,EAAE,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACzF,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC7E,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAyB,EACzB,OAAiC;IAEjC,IAAI,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,OAAO,CAAC,MAAM,CACrB,YAAY,EACZ,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAyB,EACzB,OAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC,cAAc,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}

package/dist/auth-managed.d.ts

@@ -0,0 +1,19 @@
+import type { OperationContext } from './context.js';
+/**
+ * Is `slug` a collection whose lifecycle the configured `AuthAdapter` owns (spec 061)? Asked of the
+ * adapter through its optional `managesCollection` — the runtime never inspects a concrete adapter or a
+ * slug convention, so an adapter that omits the method (or a composite of such adapters) restricts
+ * nothing.
+ */
+export declare function isAuthManagedCollection(ctx: OperationContext, slug: string): boolean;
+/**
+ * The generic-mutation boundary. Called first thing by `create`/`update`/`deleteDocumentInternal`/
+ * `restoreVersion` — before hooks, access checks and any read or write — so the answer is the same for
+ * every caller (`overrideAccess: true` bypasses *authorization*, never the auth subsystem's
+ * data-integrity invariants) and for a document that does not exist, and a refusal has no side effects.
+ * The message deliberately does not distinguish create/update/delete — the boundary is the same for all
+ * three, and the caller's fix (use the auth adapter's own operations) does not depend on which one this
+ * was.
+ */
+export declare function assertNotAuthManaged(ctx: OperationContext, slug: string): void;
+//# sourceMappingURL=auth-managed.d.ts.map

package/dist/auth-managed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-managed.d.ts","sourceRoot":"","sources":["../src/auth-managed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAE9E"}

package/dist/auth-managed.js

@@ -0,0 +1,24 @@
+import { AuthManagedCollectionError } from './errors.js';
+/**
+ * Is `slug` a collection whose lifecycle the configured `AuthAdapter` owns (spec 061)? Asked of the
+ * adapter through its optional `managesCollection` — the runtime never inspects a concrete adapter or a
+ * slug convention, so an adapter that omits the method (or a composite of such adapters) restricts
+ * nothing.
+ */
+export function isAuthManagedCollection(ctx, slug) {
+    return ctx.adapters.auth.managesCollection?.(slug) === true;
+}
+/**
+ * The generic-mutation boundary. Called first thing by `create`/`update`/`deleteDocumentInternal`/
+ * `restoreVersion` — before hooks, access checks and any read or write — so the answer is the same for
+ * every caller (`overrideAccess: true` bypasses *authorization*, never the auth subsystem's
+ * data-integrity invariants) and for a document that does not exist, and a refusal has no side effects.
+ * The message deliberately does not distinguish create/update/delete — the boundary is the same for all
+ * three, and the caller's fix (use the auth adapter's own operations) does not depend on which one this
+ * was.
+ */
+export function assertNotAuthManaged(ctx, slug) {
+    if (isAuthManagedCollection(ctx, slug))
+        throw new AuthManagedCollectionError(slug);
+}
+//# sourceMappingURL=auth-managed.js.map

package/dist/auth-managed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-managed.js","sourceRoot":"","sources":["../src/auth-managed.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAqB,EAAE,IAAY;IACzE,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAqB,EAAE,IAAY;IACtE,IAAI,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC"}

package/dist/body.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Default bound for an auth JSON body (spec 069): `{ email, password, name }` at their own bounds —
+ * a 1024-character password (≤ 3 KB of UTF-8), a 254-character email and a 256-character name — plus
+ * keys and whitespace, with room to spare. A request needs a fraction of it.
+ */
+export declare const DEFAULT_AUTH_MAX_BODY_BYTES: number;
+export interface ReadBoundedJsonOptions {
+    /** Defaults to {@link DEFAULT_AUTH_MAX_BODY_BYTES}. An integer between 1 and 1 MiB. */
+    maxBytes?: number;
+}
+/**
+ * Validates a configured bound. Called by the auth handlers before their error mapping, so a bad value
+ * is a thrown configuration error with its message intact, not a redacted `500` on every request.
+ */
+export declare function resolveMaxBodyBytes(maxBytes: number | undefined): number;
+/**
+ * Reads a JSON-object request body without ever holding more than `maxBytes` of it (spec 069).
+ *
+ * 1. A valid `Content-Length` over the bound is refused before any read.
+ * 2. The stream is read chunk by chunk and cancelled as soon as the running total passes the bound — a
+ *    missing or lying `Content-Length` cannot get past it.
+ * 3. The bytes must be valid UTF-8 and parse as JSON, and the value must be a plain object.
+ *
+ * Throws `PayloadTooLargeError` (`413`) or `InvalidInputError` (`400`); neither message contains any of
+ * the body. Web Streams only — runs unchanged on Workers, Node, Deno and Bun.
+ */
+export declare function readBoundedJsonObject(request: Request, options?: ReadBoundedJsonOptions): Promise<Record<string, unknown>>;
+//# sourceMappingURL=body.d.ts.map

package/dist/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../src/body.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAW,CAAC;AAKpD,MAAM,WAAW,sBAAsB;IACrC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQxE;AAQD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2ClC"}

package/dist/body.js

@@ -0,0 +1,81 @@
+import { InvalidInputError, PayloadTooLargeError } from './errors.js';
+/**
+ * Default bound for an auth JSON body (spec 069): `{ email, password, name }` at their own bounds —
+ * a 1024-character password (≤ 3 KB of UTF-8), a 254-character email and a 256-character name — plus
+ * keys and whitespace, with room to spare. A request needs a fraction of it.
+ */
+export const DEFAULT_AUTH_MAX_BODY_BYTES = 8 * 1024;
+/** No configuration may raise a bounded body above this. */
+const MAX_BODY_BYTES_CEILING = 1024 * 1024;
+/**
+ * Validates a configured bound. Called by the auth handlers before their error mapping, so a bad value
+ * is a thrown configuration error with its message intact, not a redacted `500` on every request.
+ */
+export function resolveMaxBodyBytes(maxBytes) {
+    const value = maxBytes ?? DEFAULT_AUTH_MAX_BODY_BYTES;
+    if (!Number.isInteger(value) || value < 1 || value > MAX_BODY_BYTES_CEILING) {
+        throw new Error(`maxBodyBytes must be an integer between 1 and ${MAX_BODY_BYTES_CEILING}; got ${String(value)}.`);
+    }
+    return value;
+}
+function cancelQuietly(body) {
+    if (!body)
+        return;
+    // Best effort: stop the upstream sender. A body that is already locked or closed has nothing to cancel.
+    body.cancel().catch(() => undefined);
+}
+/**
+ * Reads a JSON-object request body without ever holding more than `maxBytes` of it (spec 069).
+ *
+ * 1. A valid `Content-Length` over the bound is refused before any read.
+ * 2. The stream is read chunk by chunk and cancelled as soon as the running total passes the bound — a
+ *    missing or lying `Content-Length` cannot get past it.
+ * 3. The bytes must be valid UTF-8 and parse as JSON, and the value must be a plain object.
+ *
+ * Throws `PayloadTooLargeError` (`413`) or `InvalidInputError` (`400`); neither message contains any of
+ * the body. Web Streams only — runs unchanged on Workers, Node, Deno and Bun.
+ */
+export async function readBoundedJsonObject(request, options = {}) {
+    const maxBytes = resolveMaxBodyBytes(options.maxBytes);
+    const declared = request.headers.get('content-length');
+    if (declared !== null && /^\d+$/.test(declared.trim()) && Number(declared) > maxBytes) {
+        cancelQuietly(request.body);
+        throw new PayloadTooLargeError();
+    }
+    if (request.bodyUsed)
+        throw new InvalidInputError('Request body was already read');
+    const chunks = [];
+    let total = 0;
+    if (request.body) {
+        const reader = request.body.getReader();
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw new PayloadTooLargeError();
+            }
+            chunks.push(value);
+        }
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new InvalidInputError('Invalid JSON body');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new InvalidInputError('JSON body must be an object');
+    }
+    return parsed;
+}
+//# sourceMappingURL=body.js.map

package/dist/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../src/body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpD,4DAA4D;AAC5D,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAO3C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA4B;IAC9D,MAAM,KAAK,GAAG,QAAQ,IAAI,2BAA2B,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,sBAAsB,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,iDAAiD,sBAAsB,SAAS,MAAM,CAAC,KAAK,CAAC,GAAG,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAuC;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,wGAAwG;IACxG,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QACtF,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,CAAC,CAAC;IACnF,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC7C,MAAM,IAAI,oBAAoB,EAAE,CAAC;YACnC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/concurrency.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A compare-and-set on `updated_at` is only as fine as the millisecond the adapters stamp. Before a CAS
+ * write, wait until the clock has passed the stamp that was read, so this write's own stamp is strictly
+ * later: a concurrent CAS writer that read the same row then cannot match it (spec 066 review). Bounded:
+ * at most a few milliseconds. Clock skew *between* processes is outside what this can see.
+ */
+export declare function afterStamp(stamp: unknown): Promise<void>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../src/concurrency.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAM9D"}

package/dist/concurrency.js

@@ -0,0 +1,15 @@
+/**
+ * A compare-and-set on `updated_at` is only as fine as the millisecond the adapters stamp. Before a CAS
+ * write, wait until the clock has passed the stamp that was read, so this write's own stamp is strictly
+ * later: a concurrent CAS writer that read the same row then cannot match it (spec 066 review). Bounded:
+ * at most a few milliseconds. Clock skew *between* processes is outside what this can see.
+ */
+export async function afterStamp(stamp) {
+    const seen = typeof stamp === 'string' ? Date.parse(stamp) : NaN;
+    if (Number.isNaN(seen))
+        return;
+    for (let i = 0; i < 20 && Date.now() <= seen; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 1));
+    }
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../src/concurrency.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAc;IAC7C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/context.d.ts

@@ -12,5 +12,10 @@ export interface OperationContext {
     getCollection(slug: string): CollectionDefinition | undefined;
     getGlobal(slug: string): GlobalDefinition | undefined;
     getCollections(): readonly CollectionDefinition[];
+    /**
+     * Every registered global. Optional so a structural implementation written before spec 064 still
+     * type-checks; without it, relation integrity cannot see references held by globals.
+     */
+    getGlobals?(): readonly GlobalDefinition[];
 }
 //# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAC9D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtD,cAAc,IAAI,SAAS,oBAAoB,EAAE,CAAC;CACnD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAAC;IAC9D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtD,cAAc,IAAI,SAAS,oBAAoB,EAAE,CAAC;IAClD;;;OAGG;IACH,UAAU,CAAC,IAAI,SAAS,gBAAgB,EAAE,CAAC;CAC5C"}

package/dist/errors.d.ts

@@ -1,5 +1,5 @@
 import type { ValidationError } from '@forge-cms/core';
-export type ForgeErrorCode = 'NOT_FOUND' | 'INVALID_INPUT' | 'VALIDATION_ERROR' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'UNKNOWN_FIELD' | 'INVALID_QUERY' | 'UNIQUE_CONSTRAINT' | 'INTERNAL_ERROR';
+export type ForgeErrorCode = 'NOT_FOUND' | 'INVALID_INPUT' | 'VALIDATION_ERROR' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'UNKNOWN_FIELD' | 'INVALID_QUERY' | 'UNIQUE_CONSTRAINT' | 'AUTH_MANAGED_COLLECTION' | 'CONCURRENT_MODIFICATION' | 'PAYLOAD_TOO_LARGE' | 'RATE_LIMITED' | 'INTERNAL_ERROR';
 export declare class ForgeError extends Error {
     readonly status: number;
     readonly code: ForgeErrorCode;
@@ -47,6 +47,51 @@ export declare class UniqueConstraintError extends ForgeError {
     readonly fields: string[];
     constructor(collection: string, fields: string[]);
 }
+/**
+ * A generic `create`/`update`/`delete` targeted a collection whose lifecycle the configured
+ * `AuthAdapter` owns (`AuthAdapter.managesCollection`, spec 061). Those mutations would bypass the
+ * adapter's invariants — first-admin provisioning, last-admin protection, password hashing, email
+ * normalisation, session versioning — so they are refused for every caller, trusted (`overrideAccess:
+ * true`) or not. Deliberately says nothing about which adapter or how; the way out is the auth
+ * adapter's own user-management operations.
+ */
+export declare class AuthManagedCollectionError extends ForgeError {
+    readonly collection: string;
+    constructor(collection: string);
+}
+/**
+ * A versioned document mutation lost a race (spec 062): another write committed a new version of the
+ * same document after this one read it, so this one's document write and snapshot were rolled back
+ * together — nothing was written. Forge never retries it automatically (`before*` hooks may already
+ * have run); re-read the document and submit again. Deliberately names the public collection slug,
+ * never the internal `_versions_*` table whose unique index detected the conflict.
+ *
+ * Spec 064 reuses it for relation lifecycle conflicts — a referenced document deleted while a write was
+ * in progress, or a relation delete whose graph changed before it committed — with a `message` saying
+ * so. The meaning is the same: another request changed what this one depended on; nothing was written.
+ */
+export declare class ConcurrentModificationError extends ForgeError {
+    readonly collection: string;
+    readonly id: string;
+    constructor(collection: string, id: string, message?: string);
+}
+/**
+ * A request body over a Forge-owned size bound (spec 069; today: the auth JSON bodies read by
+ * `readBoundedJsonObject`). Says nothing about the body's contents.
+ */
+export declare class PayloadTooLargeError extends ForgeError {
+    constructor(message?: string);
+}
+/**
+ * The host's auth throttle refused a login/signup attempt (spec 069). The message is fixed and generic:
+ * it never says whether the account exists, which limit fired or how many attempts remain.
+ * `retryAfterSeconds` is already validated (a positive integer) when present; the auth handlers emit it
+ * as `Retry-After`.
+ */
+export declare class RateLimitedError extends ForgeError {
+    readonly retryAfterSeconds?: number;
+    constructor(retryAfterSeconds?: number);
+}
 export declare function isForgeError(err: unknown): err is ForgeError;
 export interface ForgeApiErrorBody {
     error: {

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,WAAW,GACX,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc;CAMlE;AAED,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBAExB,OAAO,EAAE,eAAe,EAAE;CAIvC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAiB;CAGrC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAc;CAGlC;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,UAAU;gBAC3B,OAAO,SAAgC;CAGpD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;CAWjD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,UAAU,CAE5D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,iBAAiB,CAyBjE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,WAAW,GACX,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,yBAAyB,GACzB,yBAAyB,GACzB,mBAAmB,GACnB,cAAc,GACd,gBAAgB,CAAC;AAErB,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc;CAMlE;AAED,qBAAa,aAAc,SAAQ,UAAU;gBAC/B,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,EAAE,MAAM;CAG5B;AAED,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC;gBAExB,OAAO,EAAE,eAAe,EAAE;CAIvC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAiB;CAGrC;AAED,qBAAa,iBAAkB,SAAQ,UAAU;gBACnC,OAAO,SAAc;CAGlC;AAED;;;;;GAKG;AACH,qBAAa,SAAU,SAAQ,UAAU;gBAC3B,OAAO,SAAgC;CAGpD;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAEd,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;CAWjD;AAED;;;;;;;GAOG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAEhB,UAAU,EAAE,MAAM;CAS/B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,UAAU;IACzD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;gBAER,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAW7D;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;gBACtC,OAAO,SAA8B;CAGlD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;gBAExB,iBAAiB,CAAC,EAAE,MAAM;CAIvC;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,UAAU,CAE5D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE;QACL,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,iBAAiB,CAyBjE"}