@haverstack/server 0.8.0 → 0.9.0

package/dist/routes/entity.js

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import { requireAuth, requireOwner } from '../middleware/auth.js';
+import { readJson } from '../lib/json.js';
+import { serializeRecord } from '@haverstack/wire-types';
+import { StackNotFoundError } from '@haverstack/core';
+export function entityRoutes(ctx) {
+    const app = new Hono();
+    const { stack } = ctx;
+    const ownerEntityId = stack.ownerEntityId;
+    app.get('/', requireAuth(), async (c) => {
+        const auth = c.get('auth');
+        const record = await stack.forSession(auth).getOwnerEntity();
+        if (!record)
+            throw new StackNotFoundError('Entity record not found');
+        return c.json(serializeRecord(record));
+    });
+    app.patch('/', requireOwner(ownerEntityId), async (c) => {
+        const auth = c.get('auth');
+        const record = await stack.forSession(auth).getOwnerEntity();
+        if (!record)
+            throw new StackNotFoundError('Entity record not found');
+        const body = await readJson(c);
+        const updated = await stack
+            .forSession(auth)
+            .patchContent(record.id, (body.content ?? {}));
+        return c.json(serializeRecord(updated));
+    });
+    return app;
+}
+//# sourceMappingURL=entity.js.map

package/dist/routes/entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity.js","sourceRoot":"","sources":["../../src/routes/entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,UAAU,YAAY,CAAC,GAAiB;IAC5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACtB,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,KAAK;aACxB,UAAU,CAAC,IAAI,CAAC;aAChB,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC,CAAC;QAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+export declare function healthRoutes(): Hono<AppEnv>;
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,wBAAgB,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,CAI3C"}

package/dist/routes/health.js

@@ -0,0 +1,7 @@
+import { Hono } from 'hono';
+export function healthRoutes() {
+    const app = new Hono();
+    app.get('/', (c) => c.json({ status: 'ok', timestamp: new Date().toISOString() }));
+    return app;
+}
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/records.d.ts

@@ -0,0 +1,5 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+import type { StackContext } from '../stack.js';
+export declare function recordRoutes(ctx: StackContext, queryTimeoutMs: number): Hono<AppEnv>;
+//# sourceMappingURL=records.d.ts.map

package/dist/routes/records.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../src/routes/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA4BhD,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAoOpF"}

package/dist/routes/records.js

@@ -0,0 +1,231 @@
+import { Hono } from 'hono';
+import { requireAuth, requireOwner } from '../middleware/auth.js';
+import { readJson } from '../lib/json.js';
+import { parseQueryBody, parseQueryParams, parsePositiveInt, parseIfMatch, createOptionsFromWireRecord, changesFromWireBody, } from '@haverstack/core/wire';
+import { clampLimit } from '../lib/queryLimit.js';
+import { serializeRecord, serializeVersion } from '@haverstack/wire-types';
+import { StackValidationError, StackQueryError, StackNotFoundError } from '@haverstack/core';
+// ---------------------------------------------------------------------------
+// Route factory
+// ---------------------------------------------------------------------------
+// Only the routes that can search a large index (POST /query, GET /) run
+// on the query worker pool with a deadline; everything else calls the main
+// thread's ScopedStack directly, being index-bound already. Virtualizing
+// the whole ScopedStack API across the worker boundary would buy no bound
+// the unbounded-cost case needs. See src/lib/queryWorker/pool.ts and
+// docs/spec/wire-format.md § Bounding query cost.
+export function recordRoutes(ctx, queryTimeoutMs) {
+    const app = new Hono();
+    const { stack, queryWorker } = ctx;
+    const ownerEntityId = stack.ownerEntityId;
+    /** Scope to a session if authenticated, else the anonymous view. */
+    function scopeFor(auth) {
+        return auth ? stack.forSession(auth) : stack.asEntity(null);
+    }
+    // POST /records/query — full query with content-field filters. Optional
+    // auth, like GET /records: a superset of the same query surface, so an
+    // anonymous caller gets the same public-record subset either way.
+    // Registered ahead of the /:id patterns, which would otherwise capture
+    // the literal "query" segment.
+    app.post('/query', async (c) => {
+        const auth = c.get('auth');
+        const query = clampLimit(parseQueryBody(await readJson(c)));
+        const result = await queryWorker.query(auth, query, queryTimeoutMs);
+        const body = {
+            records: result.records.map(serializeRecord),
+            cursor: result.cursor,
+        };
+        return c.json(body);
+    });
+    // GET /records — query by native fields via URL params
+    app.get('/', async (c) => {
+        const auth = c.get('auth');
+        const query = clampLimit(parseQueryParams(new URL(c.req.url)));
+        const result = await queryWorker.query(auth, query, queryTimeoutMs);
+        const body = {
+            records: result.records.map(serializeRecord),
+            cursor: result.cursor,
+        };
+        return c.json(body);
+    });
+    // POST /records — a full record body, but version, entityId and
+    // principalId are stamped here and never trusted from it. Everything else
+    // a wire record body can carry — which fields are forwarded as-is, which
+    // are owner-acting-alone-only, and which reduce to a boolean rather than
+    // their literal value — is `createOptionsFromWireRecord()`'s disposition
+    // to make, not this route's: see `@haverstack/core/wire` and
+    // docs/spec/wire-format.md § Records.
+    app.post('/', requireAuth(), async (c) => {
+        const auth = c.get('auth');
+        const body = await readJson(c);
+        const { typeId, content, options } = createOptionsFromWireRecord(body, auth, ownerEntityId);
+        const created = await stack.forSession(auth).create(typeId, content, options);
+        return c.json(serializeRecord(created), 200);
+    });
+    // GET /records/:id
+    app.get('/:id', async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const record = await scopeFor(auth).get(id);
+        if (!record)
+            throw new StackNotFoundError('Record not found');
+        return c.json(serializeRecord(record));
+    });
+    // PATCH /records/:id — the body is a change set: an envelope naming any
+    // combination of `contentPatch`, `parentId`, `permissions`, `associations`
+    // and `unlisted`, applied as one atomic write that produces exactly one
+    // version. A conforming client sends { "contentPatch": { "title": "New" } },
+    // never the bare patch — content is one aspect among five here, so the
+    // envelope is what tells a `parentId` naming a container from a content
+    // field of that name. One If-Match fences the whole multi-aspect edit.
+    //
+    // `changesFromWireBody()` owns the entire read of that envelope: which
+    // keys it may carry, the 400 an unrecognized or wholly absent key earns,
+    // and the 422 a malformed value earns. Content keys stay Stack's to judge,
+    // so nothing here inspects the patch. See docs/spec/wire-format.md § Records.
+    //
+    // No route-level guard belongs here: ScopedStack owns the _attachment@1
+    // immutable-field and _grant@1 owner-only rules (docs/spec/attachments.md,
+    // docs/spec/access-control.md) and resolves each change-set key against its
+    // own gate, so a denial round-trips as the core error it is rather than a
+    // guess made before the permission check ran.
+    app.patch('/:id', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const changes = changesFromWireBody(await readJson(c));
+        const updated = await stack
+            .forSession(auth)
+            .mutate(id, changes, { ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        return c.json(serializeRecord(updated));
+    });
+    // DELETE /records/:id  (?hard=true for permanent). A soft delete bumps
+    // the version like any other mutation, so it answers with the record it
+    // produced (carrying deletedAt); a hard delete leaves nothing to answer
+    // with, so that one stays 204.
+    app.delete('/:id', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const hard = new URL(c.req.url).searchParams.get('hard') === 'true';
+        const session = stack.forSession(auth);
+        await session.delete(id, { hard, ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        if (hard)
+            return c.body(null, 204);
+        return c.json(serializeRecord((await session.get(id))));
+    });
+    // POST /records/:id/undelete — reverses a soft delete; idempotent
+    app.post('/:id/undelete', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const restored = await stack
+            .forSession(auth)
+            .undelete(id, { ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        return c.json(serializeRecord(restored));
+    });
+    // ------------------------------------------------------------------
+    // Permissions
+    // ------------------------------------------------------------------
+    app.get('/:id/permissions', async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const record = await scopeFor(auth).get(id);
+        if (!record)
+            throw new StackNotFoundError('Record not found');
+        return c.json({ permissions: record.permissions ?? [] });
+    });
+    // ------------------------------------------------------------------
+    // Associations
+    // ------------------------------------------------------------------
+    app.get('/:id/associations', async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const record = await scopeFor(auth).get(id);
+        if (!record)
+            throw new StackNotFoundError('Record not found');
+        let assocs = record.associations ?? [];
+        const kind = c.req.query('kind');
+        if (kind)
+            assocs = assocs.filter((a) => a.kind === kind);
+        const label = c.req.query('label');
+        if (label)
+            assocs = assocs.filter((a) => a.label === label);
+        return c.json({ associations: assocs });
+    });
+    app.post('/:id/associations', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const body = await readJson(c);
+        if (!body.kind || !body.label)
+            throw new StackQueryError('kind and label are required');
+        const updated = await stack
+            .forSession(auth)
+            .associate(id, body, { ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        return c.json(serializeRecord(updated));
+    });
+    // POST, not DELETE — a DELETE request body has no defined semantics
+    // (RFC 9110 §9.3.5) and is a portability landmine for proxies/gateways
+    // that drop or reject it.
+    app.post('/:id/associations/delete', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const body = await readJson(c);
+        const updated = await stack
+            .forSession(auth)
+            .dissociate(id, body, { ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        return c.json(serializeRecord(updated));
+    });
+    // ------------------------------------------------------------------
+    // Versions
+    // ------------------------------------------------------------------
+    app.get('/:id/versions', async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const versions = await scopeFor(auth).getVersions(id);
+        return c.json(versions.map(serializeVersion));
+    });
+    app.get('/:id/versions/:version', async (c) => {
+        const id = c.req.param('id');
+        const vNum = parsePositiveInt(c.req.param('version'), 'version number');
+        const auth = c.get('auth');
+        const version = await scopeFor(auth).getVersion(id, vNum);
+        if (!version)
+            throw new StackNotFoundError('Version not found');
+        return c.json(serializeVersion(version));
+    });
+    // POST /records/:id/restore/:version — creates new version, does not rewrite history
+    app.post('/:id/restore/:version', requireAuth(), async (c) => {
+        const id = c.req.param('id');
+        const vNum = parsePositiveInt(c.req.param('version'), 'version number');
+        const auth = c.get('auth');
+        const restored = await stack
+            .forSession(auth)
+            .restoreVersion(id, vNum, { ifVersion: parseIfMatch(c.req.header('If-Match')) });
+        return c.json(serializeRecord(restored));
+    });
+    // POST /records/:id/migrate — the only way typeId changes after creation.
+    // The body carries the full post-migration content, computed client-side
+    // by the type's owning app and validated against toTypeId's schema by
+    // ScopedStack.commitMigration(). Owner acting alone only: replacing
+    // content and typeId wholesale would have to re-derive every gate
+    // create() and update() apply at both ends.
+    app.post('/:id/migrate', requireOwner(ownerEntityId), async (c) => {
+        const id = c.req.param('id');
+        const auth = c.get('auth');
+        const body = await readJson(c);
+        if (!body.toTypeId || typeof body.toTypeId !== 'string')
+            throw new StackQueryError('toTypeId is required');
+        if (!body.content || typeof body.content !== 'object')
+            throw new StackQueryError('content is required');
+        if (!(await stack.getType(body.toTypeId)))
+            throw new StackValidationError([
+                { path: 'toTypeId', message: `Unknown type: "${body.toTypeId}"` },
+            ]);
+        const migrated = await stack
+            .forSession(auth)
+            .commitMigration(id, body.toTypeId, body.content, {
+            ifVersion: parseIfMatch(c.req.header('If-Match')),
+        });
+        return c.json(serializeRecord(migrated));
+    });
+    return app;
+}
+//# sourceMappingURL=records.js.map

package/dist/routes/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/routes/records.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG7F,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,cAAsB;IACpE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACnC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,oEAAoE;IACpE,SAAS,QAAQ,CAAC,IAAyB;QACzC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,+BAA+B;IAC/B,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,6DAA6D;IAC7D,sCAAsC;IACtC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,2BAA2B,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,EAAE;IACF,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,EAAE;IACF,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,8CAA8C;IAC9C,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,KAAK;aACxB,UAAU,CAAC,IAAI,CAAC;aAChB,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,+BAA+B;IAC/B,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC;QACpE,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK;aACzB,UAAU,CAAC,IAAI,CAAC;aAChB,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,cAAc;IACd,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,eAAe;IACf,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IAAI,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI;YAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,KAAK;aACxB,UAAU,CAAC,IAAI,CAAC;aAChB,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,uEAAuE;IACvE,0BAA0B;IAC1B,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAc,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,KAAK;aACxB,UAAU,CAAC,IAAI,CAAC;aAChB,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,WAAW;IACX,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,qFAAqF;IACrF,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK;aACzB,UAAU,CAAC,IAAI,CAAC;aAChB,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,4CAA4C;IAC5C,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACrD,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YACnD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAkB,CAAC,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,QAAQ,GAAG,EAAE;aAClE,CAAC,CAAC;QAEL,MAAM,QAAQ,GAAG,MAAM,KAAK;aACzB,UAAU,CAAC,IAAI,CAAC;aAChB,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,QAAkB,EAAE,IAAI,CAAC,OAAkC,EAAE;YACrF,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;SAClD,CAAC,CAAC;QACL,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/tokens.d.ts

@@ -0,0 +1,5 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+import type { StackContext } from '../stack.js';
+export declare function tokenRoutes(ctx: StackContext): Hono<AppEnv>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/routes/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQhD,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CA+D3D"}

package/dist/routes/tokens.js

@@ -0,0 +1,65 @@
+import { Hono } from 'hono';
+import { requireOwner } from '../middleware/auth.js';
+import { readJson } from '../lib/json.js';
+import { parseDate } from '@haverstack/wire-types';
+import { StackValidationError } from '@haverstack/core';
+import { isValidDid } from '@haverstack/core/did';
+export function tokenRoutes(ctx) {
+    const app = new Hono();
+    const { tokens, stack } = ctx;
+    const ownerEntityId = stack.ownerEntityId;
+    // POST /tokens — issue a new token (owner only). `onBehalfOf` asserts a
+    // delegation out of band: the owner names the subject the issued
+    // principal acts for, per docs/spec/wire-format.md § The session a
+    // token names.
+    app.post('/', requireOwner(ownerEntityId), async (c) => {
+        const body = await readJson(c);
+        if (body.entityId !== undefined && !isValidDid(body.entityId))
+            throw new StackValidationError([{ path: 'entityId', message: 'Must be a DID' }]);
+        if (body.onBehalfOf !== undefined && !isValidDid(body.onBehalfOf))
+            throw new StackValidationError([{ path: 'onBehalfOf', message: 'Must be a DID' }]);
+        const principalId = body.entityId ?? ownerEntityId;
+        const expiresAt = body.expiresAt ? parseDate(body.expiresAt) : undefined;
+        if (body.expiresAt && !expiresAt)
+            throw new StackValidationError([{ path: 'expiresAt', message: 'Invalid date' }]);
+        const { id, token } = await tokens.createToken(principalId, {
+            onBehalfOf: body.onBehalfOf,
+            label: body.label,
+            expiresAt,
+        });
+        // Read the row back rather than fabricating createdAt here — the store
+        // is the source of truth, and GET /tokens must report the same value.
+        const stored = (await tokens.listTokens()).find((t) => t.id === id);
+        return c.json({
+            id,
+            token,
+            principalId,
+            subjectId: body.onBehalfOf ?? principalId,
+            label: stored.label ?? null,
+            createdAt: stored.createdAt.toISOString(),
+            expiresAt: stored.expiresAt?.toISOString() ?? null,
+        }, 201);
+    });
+    // GET /tokens — list all DB-managed tokens; never returns token values
+    app.get('/', requireOwner(ownerEntityId), async (c) => {
+        const list = await tokens.listTokens();
+        return c.json({ tokens: list.map(serializeToken) });
+    });
+    // DELETE /tokens/:id — revoke a token by its ID
+    app.delete('/:id', requireOwner(ownerEntityId), async (c) => {
+        await tokens.revokeToken(c.req.param('id'));
+        return c.body(null, 204);
+    });
+    return app;
+}
+function serializeToken(t) {
+    return {
+        id: t.id,
+        principalId: t.principalId,
+        subjectId: t.subjectId,
+        label: t.label ?? null,
+        createdAt: t.createdAt.toISOString(),
+        expiresAt: t.expiresAt?.toISOString() ?? null,
+    };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/routes/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,MAAM,UAAU,WAAW,CAAC,GAAiB;IAC3C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAC9B,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAE1C,wEAAwE;IACxE,iEAAiE;IACjE,mEAAmE;IACnE,eAAe;IACf,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAKxB,CAAC,CAAC,CAAC;QACN,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3D,MAAM,IAAI,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC/D,MAAM,IAAI,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAErF,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;YAC9B,MAAM,IAAI,oBAAoB,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAEnF,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE;YAC1D,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS;SACV,CAAC,CAAC;QAEH,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;QAErE,OAAO,CAAC,CAAC,IAAI,CACX;YACE,EAAE;YACF,KAAK;YACL,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,WAAW;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;SACnD,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAY;IAClC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;KAC9C,CAAC;AACJ,CAAC"}

package/dist/routes/types.d.ts

@@ -0,0 +1,5 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+import type { StackContext } from '../stack.js';
+export declare function typeRoutes(ctx: StackContext): Hono<AppEnv>;
+//# sourceMappingURL=types.d.ts.map

package/dist/routes/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/routes/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYhD,wBAAgB,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CA0C1D"}

package/dist/routes/types.js

@@ -0,0 +1,46 @@
+import { Hono } from 'hono';
+import { requireOwner } from '../middleware/auth.js';
+import { readJson } from '../lib/json.js';
+import { serializeType } from '@haverstack/wire-types';
+import { hashSchema, StackQueryError, StackNotFoundError, StackValidationError, } from '@haverstack/core';
+export function typeRoutes(ctx) {
+    const app = new Hono();
+    const { adapter, stack } = ctx;
+    app.get('/', async (c) => {
+        const types = await adapter.listTypes();
+        return c.json(types.map(serializeType));
+    });
+    app.get('/:id', async (c) => {
+        const id = decodeURIComponent(c.req.param('id'));
+        const type = await adapter.getType(id);
+        if (!type)
+            throw new StackNotFoundError('Type not found');
+        return c.json(serializeType(type));
+    });
+    app.post('/', requireOwner(stack.ownerEntityId), async (c) => {
+        const body = await readJson(c);
+        if (!body.id || typeof body.id !== 'string')
+            throw new StackQueryError('id is required');
+        if (!body.name || typeof body.name !== 'string')
+            throw new StackQueryError('name is required');
+        if (!body.schema || typeof body.schema !== 'object')
+            throw new StackQueryError('schema is required');
+        if (!body.schemaHash || typeof body.schemaHash !== 'string')
+            throw new StackQueryError('schemaHash is required');
+        const computedHash = await hashSchema(body.schema);
+        if (body.schemaHash !== computedHash)
+            throw new StackValidationError([
+                { path: 'schemaHash', message: 'schemaHash does not match schema' },
+            ]);
+        // stack.defineType() (not adapter.saveType() directly) is what runs the
+        // schema-drift check: redefining an existing typeId with anything
+        // beyond additive evolution throws StackSchemaDriftError, which
+        // adapter.saveType() alone has no way to enforce — it's a raw write.
+        const type = await stack.defineType(body.id, body.name, body.schema, {
+            ...(body.migratesFrom ? { migratesFrom: body.migratesFrom } : {}),
+        });
+        return c.json(serializeType(type), 201);
+    });
+    return app;
+}
+//# sourceMappingURL=types.js.map

package/dist/routes/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/routes/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACL,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAC/B,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,EAAE,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAA0B,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAC/F,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YACjD,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACzD,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QAEtD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAoB,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,UAAU,KAAK,YAAY;YAClC,MAAM,IAAI,oBAAoB,CAAC;gBAC7B,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,kCAAkC,EAAE;aACpE,CAAC,CAAC;QAEL,wEAAwE;QACxE,kEAAkE;QAClE,gEAAgE;QAChE,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAoB,EAAE;YACjF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/wellknown.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../types.js';
+import type { StackContext } from '../stack.js';
+import type { Config } from '../config.js';
+export declare function wellknownRoutes(ctx: StackContext, config: Config): Hono<AppEnv>;
+//# sourceMappingURL=wellknown.d.ts.map

package/dist/routes/wellknown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.d.ts","sourceRoot":"","sources":["../../src/routes/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CA2C/E"}

package/dist/routes/wellknown.js

@@ -0,0 +1,45 @@
+import { Hono } from 'hono';
+import { WIRE_PROTOCOL_VERSION, AUTH_METHOD_DID_CHALLENGE, CHANGE_TRANSPORT_SSE, } from '@haverstack/wire-types';
+export function wellknownRoutes(ctx, config) {
+    const app = new Hono();
+    app.get('/stack', (c) => {
+        const body = {
+            version: WIRE_PROTOCOL_VERSION,
+            entityId: ctx.stack.ownerEntityId,
+            timezone: ctx.stack.timezone,
+            // The server's own request-size ceilings are authoritative here,
+            // overriding the adapter's `null` — nothing at the storage layer
+            // imposes a limit, but this server enforces both. See
+            // docs/spec/wire-format.md § Discovery.
+            capabilities: {
+                ...ctx.stack.features,
+                limits: {
+                    attachmentBytes: config.maxAttachmentBytes,
+                    contentBytes: config.maxContentBytes,
+                },
+            },
+            // The DID challenge-response handshake is always implemented by this
+            // server, so it's always advertised — a client holding a DID
+            // credential learns at open() that there's a handshake to perform,
+            // rather than discovering it as a 404 partway through one.
+            auth: { methods: [AUTH_METHOD_DID_CHALLENGE] },
+            // Top-level rather than inside `capabilities`, which carries only
+            // what the `...ctx.stack.features` spread brings. An object rather
+            // than a boolean for the same reason `auth` is: the surface grows
+            // entries — another transport, batched frames — not more booleans.
+            //
+            // Both flags are literals with no override: GET /changes does resume
+            // and does honor `?include=record`, and a client acts on this answer
+            // without asking again. An override could only ever make discovery
+            // lie about the route beside it.
+            changes: {
+                transports: [CHANGE_TRANSPORT_SSE],
+                resume: true,
+                records: true,
+            },
+        };
+        return c.json(body);
+    });
+    return app;
+}
+//# sourceMappingURL=wellknown.js.map

package/dist/routes/wellknown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wellknown.js","sourceRoot":"","sources":["../../src/routes/wellknown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAMhC,MAAM,UAAU,eAAe,CAAC,GAAiB,EAAE,MAAc;IAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAsB;YAC9B,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa;YACjC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ;YAC5B,iEAAiE;YACjE,iEAAiE;YACjE,sDAAsD;YACtD,wCAAwC;YACxC,YAAY,EAAE;gBACZ,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ;gBACrB,MAAM,EAAE;oBACN,eAAe,EAAE,MAAM,CAAC,kBAAkB;oBAC1C,YAAY,EAAE,MAAM,CAAC,eAAe;iBACrC;aACF;YACD,qEAAqE;YACrE,6DAA6D;YAC7D,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE;YAC9C,kEAAkE;YAClE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,EAAE;YACF,qEAAqE;YACrE,qEAAqE;YACrE,mEAAmE;YACnE,iCAAiC;YACjC,OAAO,EAAE;gBACP,UAAU,EAAE,CAAC,oBAAoB,CAAC;gBAClC,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/shutdown.d.ts

@@ -0,0 +1,23 @@
+import type { Logger } from 'pino';
+import type { StackContext } from './stack.js';
+/**
+ * The subset of node-server's return value shutdown() needs. `close()`
+ * mirrors Node's http.Server: it stops accepting new connections and waits
+ * for open ones to end before invoking the callback. `closeAllConnections()`
+ * (Node >=18.2) destroys every open connection immediately, which is what
+ * makes a pending close() callback fire once the grace period expires.
+ * Optional because node-server's `ServerType` also covers Http2Server, whose
+ * @types/node surface omits it even though the app only ever serves HTTP/1.
+ */
+export type ShutdownServer = {
+    close(callback: () => void): void;
+    closeAllConnections?(): void;
+};
+/**
+ * Builds the shutdown sequence: stop the server (bounded by `timeoutMs` so a
+ * client holding a keep-alive connection open can't block it indefinitely),
+ * then release the stack's resources. Does not call process.exit — callers
+ * decide the exit code so this stays unit-testable.
+ */
+export declare function createShutdownHandler(server: ShutdownServer, ctx: StackContext, logger: Logger, timeoutMs: number): (signal: string) => Promise<void>;
+//# sourceMappingURL=shutdown.d.ts.map

package/dist/shutdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.d.ts","sourceRoot":"","sources":["../src/shutdown.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAClC,mBAAmB,CAAC,IAAI,IAAI,CAAC;CAC9B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CA2BnC"}

package/dist/shutdown.js

@@ -0,0 +1,32 @@
+/**
+ * Builds the shutdown sequence: stop the server (bounded by `timeoutMs` so a
+ * client holding a keep-alive connection open can't block it indefinitely),
+ * then release the stack's resources. Does not call process.exit — callers
+ * decide the exit code so this stays unit-testable.
+ */
+export function createShutdownHandler(server, ctx, logger, timeoutMs) {
+    return async (signal) => {
+        logger.info({ signal }, 'Shutting down');
+        // A change-feed stream never drains on its own, so server.close() below
+        // would wait out the full grace period every time. See
+        // src/lib/changeStreams.ts.
+        ctx.changeStreams.closeAll();
+        await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                logger.warn({ timeoutMs }, 'Shutdown grace period exceeded; forcing connections closed');
+                server.closeAllConnections?.();
+            }, timeoutMs);
+            server.close(() => {
+                clearTimeout(timer);
+                resolve();
+            });
+        });
+        await ctx.queryWorker.close();
+        await ctx.stack.flush();
+        await ctx.stack.close();
+        await ctx.tokens.close();
+        ctx.nonces.close();
+        logger.info('Clean shutdown complete');
+    };
+}
+//# sourceMappingURL=shutdown.js.map

package/dist/shutdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shutdown.js","sourceRoot":"","sources":["../src/shutdown.ts"],"names":[],"mappings":"AAiBA;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAsB,EACtB,GAAiB,EACjB,MAAc,EACd,SAAiB;IAEjB,OAAO,KAAK,EAAE,MAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAEzC,wEAAwE;QACxE,uDAAuD;QACvD,4BAA4B;QAC5B,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAE7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,4DAA4D,CAAC,CAAC;gBACzF,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACjC,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC"}

package/dist/stack.d.ts

@@ -0,0 +1,20 @@
+import { LocalAdapter } from '@haverstack/adapter-local';
+import { Stack } from '@haverstack/core';
+import type { StackTokenStore } from '@haverstack/core/wire';
+import type { Logger } from 'pino';
+import type { Config } from './config.js';
+import { AuthNonceStore } from './lib/nonceStore.js';
+import { QueryWorkerPool } from './lib/queryWorker/pool.js';
+import { ChangeStreamRegistry } from './lib/changeStreams.js';
+export type StackContext = {
+    adapter: LocalAdapter;
+    stack: Stack;
+    tokens: StackTokenStore & {
+        close(): Promise<void>;
+    };
+    nonces: AuthNonceStore;
+    queryWorker: QueryWorkerPool;
+    changeStreams: ChangeStreamRegistry;
+};
+export declare function initStack(config: Config, logger: Logger): Promise<StackContext>;
+//# sourceMappingURL=stack.d.ts.map

package/dist/stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../src/stack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA2C,MAAM,2BAA2B,CAAC;AAYlG,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAyB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IAIb,MAAM,EAAE,eAAe,GAAG;QAAE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAGrD,MAAM,EAAE,cAAc,CAAC;IAIvB,WAAW,EAAE,eAAe,CAAC;IAG7B,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAEF,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAwDrF"}