@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/tenant.js

@@ -0,0 +1,352 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref, tuplesForCreate } from '@kindgi/authz';
+import { makeEnvName } from '@kindgi/types';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Upper bound on binding `list` calls per `GET /config` request, so a
+ * binding that keeps returning empty pages with a `nextCursor` can't
+ * hold the request open; the response then carries the cursor on.
+ */
+const MAX_CONFIG_LIST_CALLS = 10;
+/** Opaque url-safe base64 of the JSON position (as in `./pagination.ts`). */
+function encodeConfigCursor(position) {
+    return Buffer.from(JSON.stringify(position), 'utf8').toString('base64url');
+}
+/** Returns `null` on any decode failure — caller responds with 400 bad-input. */
+function decodeConfigCursor(raw) {
+    try {
+        const parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+        if (parsed === null || typeof parsed !== 'object')
+            return null;
+        const { source, cursor } = parsed;
+        if (source !== 'env' && source !== 'secret')
+            return null;
+        if (cursor !== undefined && (typeof cursor !== 'string' || cursor.length === 0))
+            return null;
+        return cursor === undefined ? { source } : { source, cursor };
+    }
+    catch {
+        return null;
+    }
+}
+const DEFAULT_ENV_NAME = (() => {
+    const raw = 'default';
+    const validated = makeEnvName(raw);
+    // Defensive: the constant grammar accepts 'default'; the null branch
+    // is unreachable, but the cast is unavoidable without factory
+    // widening.
+    return validated ?? raw;
+})();
+function resolveTenantConfigEnvName() {
+    const raw = process.env.KINDGI_ENV_NAME;
+    if (raw === undefined || raw.length === 0)
+        return DEFAULT_ENV_NAME;
+    const validated = makeEnvName(raw);
+    return validated ?? DEFAULT_ENV_NAME;
+}
+export function tenantRouter(options) {
+    const { tenantHierarchyBinding, envBinding, secretsBinding, authorizer } = options;
+    const r = new Hono();
+    // Authorization — gate every /v1/tenant route with `read` on the
+    // caller's tenant. Anyone with tenant admin/member cascades through
+    // via can_read. Non-members (rare — usually implies a mis-issued
+    // token) get 403 rather than the tenant metadata.
+    if (authorizer !== undefined) {
+        r.use('*', authorizer.authorize('read', (c) => ref('tenant', c.get('tenantId'))));
+    }
+    // ---------- GET / ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const row = await tenantHierarchyBinding.getTenant(tenantId);
+        if (row === null) {
+            c.status(statusFor('tenant-not-found'));
+            return c.json(toWireError({
+                code: 'tenant-not-found',
+                message: `No tenant with id "${tenantId}"`,
+                tenantId: tenantId,
+            }, requestId));
+        }
+        return c.json({
+            id: row.id,
+            name: row.name,
+            slug: row.slug,
+            createdAt: row.createdAt,
+            updatedAt: row.updatedAt,
+        });
+    });
+    if (envBinding === undefined && secretsBinding === undefined) {
+        return r;
+    }
+    // ---------- GET /config ----------
+    r.get('/config', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const kindRaw = c.req.query('kind');
+        let kindFilter;
+        if (kindRaw !== undefined && kindRaw.length > 0) {
+            if (!isCompatConfigKind(kindRaw)) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`kind` must be one of: env, config, secret' }, requestId));
+            }
+            kindFilter = kindRaw;
+        }
+        const keyPrefix = c.req.query('keyPrefix');
+        const cursorRaw = c.req.query('cursor');
+        const envName = resolveTenantConfigEnvName();
+        const scope = { kind: 'tenant', tenantId };
+        // Paging across two bindings with opaque cursors: the list is the
+        // env entries (in the env binding's order) followed by the secret
+        // entries (in the secrets binding's order). `env` and `config` both
+        // draw from `envBinding`; `secret` from `secretsBinding`. The wire
+        // cursor records which binding the next page starts in and that
+        // binding's own cursor. Each binding page is requested with the
+        // slots still free and taken whole, so a page never exceeds `limit`
+        // and the binding's `nextCursor` is always an exact resume point.
+        const wantsEnv = kindFilter === undefined || kindFilter === 'env' || kindFilter === 'config';
+        const wantsSecret = kindFilter === undefined || kindFilter === 'secret';
+        const sources = [
+            ...(wantsEnv && envBinding !== undefined ? ['env'] : []),
+            ...(wantsSecret && secretsBinding !== undefined ? ['secret'] : []),
+        ];
+        let position = sources[0] !== undefined ? { source: sources[0] } : null;
+        if (cursorRaw !== undefined && cursorRaw.length > 0) {
+            const decoded = decodeConfigCursor(cursorRaw);
+            if (decoded === null || !sources.includes(decoded.source)) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`cursor` is malformed' }, requestId));
+            }
+            position = decoded;
+        }
+        const listFrom = async (at, pageLimit) => {
+            const input = {
+                scope,
+                envName,
+                limit: pageLimit,
+                ...(keyPrefix !== undefined && keyPrefix.length > 0 && { namePrefix: keyPrefix }),
+                ...(at.cursor !== undefined && { cursor: at.cursor }),
+            };
+            if (at.source === 'env') {
+                const page = await envBinding.list(input);
+                return {
+                    entries: page.data.map((rec) => envRecordToCompat(rec, tenantId)),
+                    ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+                };
+            }
+            const page = await secretsBinding.list(input);
+            return {
+                entries: page.data.map((rec) => secretRecordToCompat(rec, tenantId)),
+                ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+            };
+        };
+        const nextSource = (source) => {
+            const following = sources[sources.indexOf(source) + 1];
+            return following !== undefined ? { source: following } : null;
+        };
+        const entries = [];
+        let calls = 0;
+        while (position !== null && entries.length < limit && calls < MAX_CONFIG_LIST_CALLS) {
+            calls += 1;
+            const page = await listFrom(position, limit - entries.length);
+            entries.push(...page.entries);
+            position =
+                page.nextCursor !== undefined
+                    ? { source: position.source, cursor: page.nextCursor }
+                    : nextSource(position.source);
+        }
+        // The page filled up exactly where a binding not yet read begins:
+        // look ahead one entry so `hasMore` doesn't promise an empty page.
+        while (position !== null && position.cursor === undefined && calls < MAX_CONFIG_LIST_CALLS) {
+            calls += 1;
+            const probe = await listFrom(position, 1);
+            if (probe.entries.length > 0 || probe.nextCursor !== undefined)
+                break;
+            position = nextSource(position.source);
+        }
+        return c.json({
+            data: entries,
+            hasMore: position !== null,
+            ...(position !== null && { nextCursor: encodeConfigCursor(position) }),
+        });
+    });
+    // ---------- PATCH /config ----------
+    r.patch('/config', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        if (!isCompatConfigKind(b.kind)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`kind` must be one of: env, config, secret' }, requestId));
+        }
+        if (typeof b.key !== 'string' || b.key.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`key` is required and must be a non-empty string' }, requestId));
+        }
+        if (typeof b.value !== 'string') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`value` is required and must be a string' }, requestId));
+        }
+        if (b.sensitive !== undefined && typeof b.sensitive !== 'boolean') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`sensitive` must be a boolean when present' }, requestId));
+        }
+        if (b.ifRevision !== undefined && typeof b.ifRevision !== 'number') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`ifRevision` must be a number when present' }, requestId));
+        }
+        const key = b.key;
+        const value = b.value;
+        const kind = b.kind;
+        const explicitSensitive = b.sensitive;
+        const ifRevision = b.ifRevision;
+        const envName = resolveTenantConfigEnvName();
+        const scope = { kind: 'tenant', tenantId };
+        // `kind` collapse: `env` and `config` both name the env binding; a
+        // caller flag of `sensitive: true` promotes the write to the
+        // secrets binding regardless of `kind`. `kind: 'secret'` always
+        // routes to secrets.
+        const wantsSecrets = kind === 'secret' || explicitSensitive === true;
+        if (wantsSecrets) {
+            if (secretsBinding === undefined) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({
+                    code: 'bad-input',
+                    message: 'A secret write was attempted but no `secretsBinding` is wired on this deployment.',
+                }, requestId));
+            }
+            const currentRecord = await secretsBinding.get({ scope, envName, name: key });
+            const writeMode = currentRecord === null ? 'create-new' : 'add-version';
+            const outcome = await secretsBinding.set({
+                scope,
+                envName,
+                name: key,
+                value,
+                writeMode,
+                ...(ifRevision !== undefined && { ifVersion: ifRevision }),
+                enqueueTuples: (secretRowId) => tuplesForCreate({ kind: 'secret', id: secretRowId, tenantId, scope }),
+            });
+            if (outcome.kind === 'ok') {
+                return c.json({
+                    entry: {
+                        tenantId: tenantId,
+                        kind: 'secret',
+                        key,
+                        value: '[redacted]',
+                        sensitive: true,
+                        revision: outcome.versionId,
+                        updatedAt: outcome.record.updatedAt,
+                    },
+                });
+            }
+            if (outcome.kind === 'version-conflict') {
+                c.status(statusFor('tenant-config-revision-conflict'));
+                return c.json(toWireError({
+                    code: 'tenant-config-revision-conflict',
+                    message: `Stored revision is ${outcome.currentVersion}; retry with the current value.`,
+                    currentRevision: outcome.currentVersion,
+                }, requestId));
+            }
+            if (outcome.kind === 'already-exists') {
+                return c.json({
+                    entry: {
+                        tenantId: tenantId,
+                        kind: 'secret',
+                        key,
+                        value: '[redacted]',
+                        sensitive: true,
+                        revision: outcome.record.currentVersion,
+                        updatedAt: outcome.record.updatedAt,
+                    },
+                });
+            }
+            c.status(500);
+            return c.json(toWireError({ code: outcome.code, message: outcome.message }, requestId));
+        }
+        if (envBinding === undefined) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: 'An env write was attempted but no `envBinding` is wired on this deployment.',
+            }, requestId));
+        }
+        const outcome = await envBinding.set({
+            scope,
+            envName,
+            name: key,
+            value,
+            ...(ifRevision !== undefined && { ifRevision }),
+            enqueueTuples: (envRowId) => tuplesForCreate({ kind: 'env', id: envRowId, tenantId, scope }),
+        });
+        if (outcome.kind === 'ok') {
+            // At this point `kind` is `env` or `config` (secrets branch
+            // early-returned above); PATCH echoes the input verbatim so
+            // callers see the same slot they wrote.
+            return c.json({
+                entry: {
+                    tenantId: tenantId,
+                    kind,
+                    key,
+                    value: outcome.record.value,
+                    sensitive: false,
+                    revision: outcome.record.revision,
+                    updatedAt: outcome.record.updatedAt,
+                },
+            });
+        }
+        if (outcome.kind === 'revision-conflict') {
+            c.status(statusFor('tenant-config-revision-conflict'));
+            return c.json(toWireError({
+                code: 'tenant-config-revision-conflict',
+                message: `Stored revision is ${outcome.currentRevision}; retry with the current value.`,
+                currentRevision: outcome.currentRevision,
+            }, requestId));
+        }
+        c.status(500);
+        return c.json(toWireError({ code: outcome.code, message: outcome.message }, requestId));
+    });
+    return r;
+}
+function isCompatConfigKind(x) {
+    return x === 'env' || x === 'config' || x === 'secret';
+}
+function envRecordToCompat(rec, tenantId) {
+    return {
+        tenantId,
+        kind: 'env',
+        key: rec.name,
+        value: rec.value,
+        sensitive: false,
+        revision: rec.revision,
+        updatedAt: rec.updatedAt,
+    };
+}
+function secretRecordToCompat(rec, tenantId) {
+    return {
+        tenantId,
+        kind: 'secret',
+        key: rec.name,
+        // Admin surface never reveals the value. It is only accessible via
+        // `SecretBinding.resolve` (dispatch path, capability-gated).
+        value: '[redacted]',
+        sensitive: true,
+        revision: rec.currentVersion,
+        updatedAt: rec.updatedAt,
+    };
+}
+//# sourceMappingURL=tenant.js.map

package/dist/routes/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgF7C;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,QAAsB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAgD,CAAC;QAC5E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAY,CAAC,GAAY,EAAE;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC;IACtB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,qEAAqE;IACrE,8DAA8D;IAC9D,YAAY;IACZ,OAAO,SAAS,IAAK,GAAe,CAAC;AACvC,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,IAAI,gBAAgB,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACnF,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,iEAAiE;IACjE,oEAAoE;IACpE,iEAAiE;IACjE,kDAAkD;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CACH,GAAG,EACH,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sBAAsB,QAA6B,GAAG;gBAC/D,QAAQ,EAAE,QAA6B;aACxC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,oCAAoC;IACpC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,UAAwC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,OAAO,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,QAAQ,CAAC;QAC7F,MAAM,WAAW,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,CAAC;QACxE,MAAM,OAAO,GAA4B;YACvC,GAAG,CAAC,QAAQ,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,cAAc,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QAEF,IAAI,QAAQ,GAAwB,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,EACpB,EAAgB,EAChB,SAAiB,EAIhB,EAAE;YACH,MAAM,KAAK,GAAG;gBACZ,KAAK;gBACL,OAAO;gBACP,KAAK,EAAE,SAAS;gBAChB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBACjF,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAgB,EAAE,CAAC;aAChE,CAAC;YACF,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAO,UAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACjE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;iBACtE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAO,cAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAuB,EAAE;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC;QAEF,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACpF,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,QAAQ;gBACN,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;oBACtD,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAC3F,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM;YACtE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ,KAAK,IAAI;YAC1B,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAClF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAC1E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAgC,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAgC,CAAC;QACtD,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,mEAAmE;QACnE,6DAA6D;QAC7D,gEAAgE;QAChE,qBAAqB;QACrB,MAAM,YAAY,GAAG,IAAI,KAAK,QAAQ,IAAI,iBAAiB,KAAK,IAAI,CAAC;QAErE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EACL,mFAAmF;iBACtF,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC;gBACvC,KAAK;gBACL,OAAO;gBACP,IAAI,EAAE,GAAG;gBACT,KAAK;gBACL,SAAS;gBACT,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;gBAC1D,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,SAAS;wBAC3B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,iCAAiC;oBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,cAAc,iCAAiC;oBACtF,eAAe,EAAE,OAAO,CAAC,cAAc;iBACxC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;wBACvC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,6EAA6E;aACvF,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC;YACnC,KAAK;YACL,OAAO;YACP,IAAI,EAAE,GAAG;YACT,KAAK;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,4DAA4D;YAC5D,4DAA4D;YAC5D,wCAAwC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE;oBACL,QAAQ,EAAE,QAA6B;oBACvC,IAAI;oBACJ,GAAG;oBACH,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;oBAC3B,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;oBACjC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,eAAe,iCAAiC;gBACvF,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAc,EAAE,QAAkB;IAC3D,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAiB,EAAE,QAAkB;IACjE,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,mEAAmE;QACnE,6DAA6D;QAC7D,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,GAAG,CAAC,cAAc;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}

package/dist/routes/tokens.d.ts

@@ -0,0 +1,14 @@
+import { Hono } from 'hono';
+import type { Authorizer } from '../middleware/authorize.js';
+import { type TokenAdmin } from '../token-admin.js';
+import type { AppEnv } from '../types.js';
+/**
+ * API keys: mint, list, read, revoke. Every route is tenant-admin only:
+ * `admin` on the tenant when authorization is on, otherwise the
+ * `tenant-admin` scope on the caller's token.
+ *
+ * A caller can only give a new key what it holds itself: every
+ * capability it grants must be one of its own.
+ */
+export declare function tokensRouter(admin: TokenAdmin, authorizer?: Authorizer): Hono<AppEnv>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/routes/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA8FrF"}

package/dist/routes/tokens.js

@@ -0,0 +1,231 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { API_TOKEN_ROLES, } from '../token-admin.js';
+import { clampLimit, decodeCursor, encodeCursor } from './pagination.js';
+/**
+ * API keys: mint, list, read, revoke. Every route is tenant-admin only:
+ * `admin` on the tenant when authorization is on, otherwise the
+ * `tenant-admin` scope on the caller's token.
+ *
+ * A caller can only give a new key what it holds itself: every
+ * capability it grants must be one of its own.
+ */
+export function tokensRouter(admin, authorizer) {
+    const r = new Hono();
+    r.use('/*', requireTenantAdmin(authorizer));
+    // ---------- POST / (mint) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const body = await readJsonBody(c);
+        if (body.kind === 'err')
+            return fail(c, body.error, requestId);
+        const parsed = parseMintBody(body.value);
+        if (parsed.kind === 'err')
+            return fail(c, parsed.error, requestId);
+        const held = new Set(c.get('capabilities') ?? []);
+        const notHeld = parsed.value.capabilities.filter((cap) => !held.has(cap));
+        if (notHeld.length > 0) {
+            return fail(c, {
+                code: 'permission-denied',
+                message: `A key can only be given capabilities its minter holds; you don't hold: ${notHeld.join(', ')}`,
+            }, requestId);
+        }
+        const createdBy = callerRef(c);
+        const minted = await admin.mint({
+            tenantId,
+            role: parsed.value.role,
+            capabilities: parsed.value.capabilities,
+            ...(parsed.value.label !== undefined && { label: parsed.value.label }),
+            ...(parsed.value.expiresAt !== undefined && { expiresAt: parsed.value.expiresAt }),
+            ...(parsed.value.projectId !== undefined && { projectId: parsed.value.projectId }),
+            ...(createdBy !== undefined && { createdBy }),
+        });
+        c.status(201);
+        return c.json({ ...toWire(minted.record), token: minted.token });
+    });
+    // ---------- GET / (list, newest first; never secrets) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const rawCursor = c.req.query('cursor');
+        let after;
+        if (rawCursor !== undefined) {
+            const decoded = decodeCursor(rawCursor);
+            if (decoded === null || Number.isNaN(Date.parse(decoded.createdAt))) {
+                return fail(c, { code: 'bad-input', message: '`cursor` is not a valid cursor' }, requestId);
+            }
+            after = { createdAt: new Date(decoded.createdAt), tokenId: decoded.id };
+        }
+        const records = await admin.list({ tenantId, limit: limit + 1, ...(after && { after }) });
+        const hasMore = records.length > limit;
+        const page = hasMore ? records.slice(0, limit) : records;
+        const last = page[page.length - 1];
+        return c.json({
+            data: page.map(toWire),
+            hasMore,
+            ...(hasMore &&
+                last !== undefined && {
+                nextCursor: encodeCursor({
+                    createdAt: last.createdAt.toISOString(),
+                    id: last.tokenId,
+                }),
+            }),
+        });
+    });
+    // ---------- GET /:tokenId ----------
+    r.get('/:tokenId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const tokenId = c.req.param('tokenId');
+        const record = await admin.get({ tenantId, tokenId });
+        if (record === undefined)
+            return notFound(c, tokenId, requestId);
+        return c.json(toWire(record));
+    });
+    // ---------- POST /:tokenId/revoke ----------
+    r.post('/:tokenId/revoke', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const tokenId = c.req.param('tokenId');
+        const outcome = await admin.revoke({ tenantId, tokenId });
+        if (outcome.kind === 'not-found')
+            return notFound(c, tokenId, requestId);
+        return c.json({ tokenId: tokenId, revoked: true });
+    });
+    return r;
+}
+function requireTenantAdmin(authorizer) {
+    if (authorizer !== undefined) {
+        return async (c, next) => {
+            const tenantId = c.get('tenantId');
+            const mw = authorizer.authorize('admin', async () => ref('tenant', tenantId));
+            return mw(c, next);
+        };
+    }
+    return async (c, next) => {
+        if (!(c.get('scopes') ?? []).includes('tenant-admin')) {
+            return fail(c, { code: 'permission-denied', message: 'Managing API keys needs a tenant admin' }, c.get('requestId'));
+        }
+        await next();
+        return;
+    };
+}
+/** The caller as a principal reference: `user:<id>` or `service_account:<tokenId>`. */
+function callerRef(c) {
+    const userId = c.get('userId');
+    if (userId !== undefined)
+        return `user:${userId}`;
+    const tokenId = c.get('tokenId');
+    if (tokenId !== undefined)
+        return `service_account:${tokenId}`;
+    return undefined;
+}
+function toWire(record) {
+    return {
+        tokenId: record.tokenId,
+        role: record.role,
+        capabilities: record.capabilities,
+        ...(record.label !== undefined && { label: record.label }),
+        ...(record.projectId !== undefined && { projectId: record.projectId }),
+        ...(record.createdBy !== undefined && { createdBy: record.createdBy }),
+        createdAt: record.createdAt.toISOString(),
+        ...(record.expiresAt !== undefined && { expiresAt: record.expiresAt.toISOString() }),
+        ...(record.revokedAt !== undefined && { revokedAt: record.revokedAt.toISOString() }),
+        ...(record.lastUsedAt !== undefined && { lastUsedAt: record.lastUsedAt.toISOString() }),
+    };
+}
+function fail(c, error, requestId) {
+    c.status(statusFor(error.code));
+    return c.json(toWireError(error, requestId));
+}
+function notFound(c, tokenId, requestId) {
+    return fail(c, { code: 'not-found', message: `No token with id ${tokenId}` }, requestId);
+}
+/**
+ * An empty body is allowed on mint. Parse when the caller declared a JSON
+ * body or sent any content, so a plain `POST` with no body still works.
+ */
+async function readJsonBody(c) {
+    const hasBody = (c.req.header('content-type') ?? '').includes('json') ||
+        (c.req.header('content-length') !== undefined && c.req.header('content-length') !== '0');
+    if (!hasBody)
+        return { kind: 'ok', value: {} };
+    try {
+        const text = await c.req.text();
+        return { kind: 'ok', value: text.length > 0 ? JSON.parse(text) : {} };
+    }
+    catch {
+        return {
+            kind: 'err',
+            error: { code: 'bad-input', message: 'Request body must be valid JSON' },
+        };
+    }
+}
+const MAX_CAPABILITY_LENGTH = 100;
+function badInput(message) {
+    return { kind: 'err', error: { code: 'bad-input', message } };
+}
+function parseMintBody(body) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        return badInput('Request body must be an object');
+    }
+    const b = body;
+    const role = parseRole(b.role);
+    if (role.kind === 'err')
+        return role;
+    const capabilities = parseCapabilities(b.capabilities);
+    if (capabilities.kind === 'err')
+        return capabilities;
+    const out = { role: role.value, capabilities: capabilities.value };
+    if (b.label !== undefined) {
+        if (typeof b.label !== 'string')
+            return badInput('`label` must be a string');
+        out.label = b.label;
+    }
+    if (b.expiresAt !== undefined) {
+        if (typeof b.expiresAt !== 'string')
+            return badInput('`expiresAt` must be an ISO date string');
+        const parsed = new Date(b.expiresAt);
+        if (Number.isNaN(parsed.getTime()))
+            return badInput('`expiresAt` is not a valid ISO date');
+        out.expiresAt = parsed;
+    }
+    if (b.projectId !== undefined) {
+        if (typeof b.projectId !== 'string') {
+            return badInput('`projectId` must be a string when supplied');
+        }
+        out.projectId = b.projectId;
+    }
+    return { kind: 'ok', value: out };
+}
+/** `role`: `admin` | `member`; `member` when absent (least privilege). */
+function parseRole(raw) {
+    if (raw === undefined)
+        return { kind: 'ok', value: 'member' };
+    if (typeof raw !== 'string' || !API_TOKEN_ROLES.includes(raw)) {
+        return badInput(`\`role\` must be one of: ${API_TOKEN_ROLES.join(', ')}`);
+    }
+    return { kind: 'ok', value: raw };
+}
+/** `capabilities`: distinct non-empty strings; none when absent. */
+function parseCapabilities(raw) {
+    if (raw === undefined)
+        return { kind: 'ok', value: [] };
+    if (!Array.isArray(raw))
+        return badInput('`capabilities` must be an array of strings');
+    const out = [];
+    for (const cap of raw) {
+        if (typeof cap !== 'string' || cap.length === 0 || cap.length > MAX_CAPABILITY_LENGTH) {
+            return badInput(`\`capabilities\` must hold non-empty strings of at most ${MAX_CAPABILITY_LENGTH} characters`);
+        }
+        if (!out.includes(cap))
+            out.push(cap);
+    }
+    return { kind: 'ok', value: out };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/routes/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAGjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EACL,eAAe,GAIhB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB,EAAE,UAAuB;IACrE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;IAE5C,sCAAsC;IACtC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CACT,CAAC,EACD;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,0EAA0E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxG,EACD,SAAS,CACV,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;YACvB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YACvC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAClF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAClF,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAA2D,CAAC;QAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9F,CAAC;YACD,KAAK,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAgB,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YACtB,OAAO;YACP,GAAG,CAAC,OAAO;gBACT,IAAI,KAAK,SAAS,IAAI;gBACpB,UAAU,EAAE,YAAY,CAAC;oBACvB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;oBACvC,EAAE,EAAE,IAAI,CAAC,OAA4B;iBACtC,CAAC;aACH,CAAC;SACL,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAe,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAe,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkC;IAC5D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAClD,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAC7C,CAAC;YACF,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,CACT,CAAC,EACD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAChF,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAS,SAAS,CAAC,CAAkB;IACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,MAA2B,EAAE,CAAC;IACvE,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,mBAAmB,OAA4B,EAAE,CAAC;IACpF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,MAAM,CAAC,MAAsB;IACpC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAA4B;QAC5C,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAA8B,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACtE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;QACzC,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACpF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAID,SAAS,IAAI,CAAC,CAAkB,EAAE,KAAgB,EAAE,SAAiB;IACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAkB,EAAE,OAAmB,EAAE,SAAiB;IAC1E,OAAO,IAAI,CACT,CAAC,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,OAA4B,EAAE,EAAE,EAClF,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,CAAkB;IAElB,MAAM,OAAO,GACX,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrD,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE;SACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAE1C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IACrD,MAAM,GAAG,GAML,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC;IAE3D,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC7E,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,wCAAwC,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAAE,OAAO,QAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC3F,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAsB,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC9D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAmB,CAAC,EAAE,CAAC;QAC9E,OAAO,QAAQ,CAAC,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAmB,EAAE,CAAC;AACpD,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,4CAA4C,CAAC,CAAC;IACvF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YACtF,OAAO,QAAQ,CACb,2DAA2D,qBAAqB,aAAa,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC"}