@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/routes/orgs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/routes/orgs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,sBAAsB,EACvC,UAAU,CAAC,EAAE,UAAU,GACtB,IAAI,CAAC,MAAM,CAAC,CAgOd"}

package/dist/routes/orgs.js

@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Orgs resource routes — part of the multi-tenant hierarchy.
+ *
+ * Five endpoints on `/v1/orgs`:
+ *   - `GET    /`                — cursor-paginated list; optional
+ *                                 `?limit=` / `?cursor=` / `?nameContains=`.
+ *   - `POST   /`                — create; body `{ name, slug }`; 201 `{ id }`.
+ *   - `GET    /:orgId`          — 200 `Org`; 404 `org-not-found`.
+ *   - `PATCH  /:orgId`          — partial update via `OrgPatch`; 204 on
+ *                                 success; 404 `org-not-found`.
+ *   - `DELETE /:orgId`          — 204 idempotent (unknown is 204 per the
+ *                                 binding's delete-is-a-no-op contract).
+ *
+ * Registry storage is caller-plugged via `OrgBinding` from
+ * `@kindgi/platform`. Tenant isolation is a binding guardrail — the
+ * route never sees a cross-tenant row because the binding filters at the
+ * query layer.
+ */
+export function orgsRouter(binding, tenantHierarchy, authorizer) {
+    const r = new Hono();
+    // ---------- Authorization middleware ----------
+    // Full PEP surface:
+    //   POST /            → admin on tenant
+    //   PATCH /:orgId     → admin on the org
+    //   DELETE /:orgId    → admin on the org
+    //   GET /:orgId       → read on the org (per-resource check)
+    //   GET /             → tenant-scoped fetch + filterByCan('read') strip
+    if (authorizer !== undefined) {
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'POST')
+                return next();
+            const mw = authorizer.authorize('admin', (ctx) => ref('tenant', ctx.get('tenantId')));
+            return mw(c, next);
+        });
+        r.use('/:orgId', async (c, next) => {
+            const method = c.req.method;
+            if (method !== 'PATCH' && method !== 'DELETE' && method !== 'GET')
+                return next();
+            const orgId = c.req.param('orgId');
+            const action = method === 'GET' ? 'read' : method === 'DELETE' ? 'admin' : 'admin';
+            const mw = authorizer.authorize(action, () => ref('org', orgId));
+            return mw(c, next);
+        });
+    }
+    // ---------- GET / (list, cursor-paginated + filtered) ----------
+    r.get('/', async (c) => {
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const nameContainsRaw = c.req.query('nameContains');
+        const page = await binding.list(tenantId, {
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(nameContainsRaw !== undefined &&
+                nameContainsRaw.length > 0 && { nameContains: nameContainsRaw }),
+        });
+        // Authorization list-filter — strip orgs the caller can't read.
+        const visible = authorizer !== undefined
+            ? await authorizer.filterByCan(c, 'read', page.items, (o) => ref('org', o.id))
+            : [...page.items];
+        return c.json({
+            data: visible.map(serializeOrg),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- POST / (create) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        if (typeof b.name !== 'string' || b.name.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`name` is required and must be a non-empty string' }, requestId));
+        }
+        if (typeof b.slug !== 'string' || b.slug.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`slug` is required and must be a non-empty string' }, requestId));
+        }
+        const spec = { name: b.name, slug: b.slug };
+        // Create through the tenant-hierarchy binding only when authz is
+        // configured — it enqueues FGA tuples that only matter when a PDP is
+        // enforcing. Wiring without an authorizer (e.g. tests) falls back to
+        // `binding.create`, so test doubles don't need a real database.
+        if (authorizer !== undefined) {
+            const principal = c.get('principal');
+            const creatorUserId = principal?.actor.kind === 'user'
+                ? principal.actor.id
+                : '00000000-0000-0000-0000-000000000000';
+            const result = await tenantHierarchy.createOrg({ tenantId, creatorUserId, spec });
+            if (result.kind === 'err') {
+                const code = result.error.code === 'slug-conflict' ? 'slug-conflict' : 'internal-server-error';
+                c.status(statusFor(code));
+                return c.json(toWireError({ code, message: result.error.message }, requestId));
+            }
+            c.status(201);
+            return c.json({ id: result.value.orgId });
+        }
+        const id = await binding.create(tenantId, spec);
+        c.status(201);
+        return c.json({ id: id });
+    });
+    // ---------- GET /:orgId ----------
+    r.get('/:orgId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const orgId = c.req.param('orgId');
+        const org = await binding.get(tenantId, orgId);
+        if (org === undefined) {
+            c.status(statusFor('org-not-found'));
+            return c.json(toWireError({
+                code: 'org-not-found',
+                message: `No org with id "${orgId}"`,
+                orgId: orgId,
+            }, requestId));
+        }
+        return c.json(serializeOrg(org));
+    });
+    // ---------- PATCH /:orgId ----------
+    r.patch('/:orgId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const orgId = c.req.param('orgId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        const shaped = {};
+        if (b.name !== undefined) {
+            if (typeof b.name !== 'string') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`name` must be a string when present' }, requestId));
+            }
+            shaped.name = b.name;
+        }
+        if (b.slug !== undefined) {
+            if (typeof b.slug !== 'string') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`slug` must be a string when present' }, requestId));
+            }
+            shaped.slug = b.slug;
+        }
+        try {
+            await binding.update(tenantId, orgId, shaped);
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            if (message.startsWith('org-not-found')) {
+                c.status(statusFor('org-not-found'));
+                return c.json(toWireError({
+                    code: 'org-not-found',
+                    message: `No org with id "${orgId}"`,
+                    orgId: orgId,
+                }, requestId));
+            }
+            throw cause;
+        }
+        c.status(204);
+        return c.body(null);
+    });
+    // ---------- DELETE /:orgId ----------
+    r.delete('/:orgId', async (c) => {
+        const tenantId = c.get('tenantId');
+        const orgId = c.req.param('orgId');
+        await binding.delete(tenantId, orgId);
+        c.status(204);
+        return c.body(null);
+    });
+    return r;
+}
+function serializeOrg(o) {
+    return {
+        id: o.id,
+        tenantId: o.tenantId,
+        name: o.name,
+        slug: o.slug,
+        createdAt: o.createdAt,
+        updatedAt: o.updatedAt,
+    };
+}
+//# sourceMappingURL=orgs.js.map

package/dist/routes/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/routes/orgs.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CACxB,OAAmB,EACnB,eAAuC,EACvC,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,iDAAiD;IACjD,oBAAoB;IACpB,wCAAwC;IACxC,yCAAyC;IACzC,yCAAyC;IACzC,6DAA6D;IAC7D,wEAAwE;IACxE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CACxD,CAAC;YACF,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YACnF,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACjE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxC,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,gEAAgE;QAChE,MAAM,OAAO,GACX,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACxD,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAuB,CAAC,CACtC;YACH,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,EACnF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,EACnF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,iEAAiE;QACjE,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM;gBAC9B,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa;gBAChC,CAAC,CAAE,sCAAiD,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,KAA0B,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAuB,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,oCAAoC;IACpC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAU,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,mBAAmB,KAA0B,GAAG;gBACzD,KAAK,EAAE,KAA0B;aAClC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAU,CAAC;QAE5C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,MAAM,GAAqD,EAAE,CAAC;QACpE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;gBAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,mBAAmB,KAA0B,GAAG;oBACzD,KAAK,EAAE,KAA0B;iBAClC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAU,CAAC;QAC5C,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,CAAM;IAC1B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAA6B;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,SAAS,EAAE,CAAC,CAAC,SAA8B;KAC5C,CAAC;AACJ,CAAC"}

package/dist/routes/pagination.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Cursor + limit helpers per `docs/API-ROUTE-CONVENTIONS.md` §5.
+ *
+ * Cursors are opaque url-safe base64 of `{ createdAt: ISO, id: uuid }`.
+ * The client MUST NOT parse the string; the server rebuilds it on each
+ * page. Sort order is fixed per endpoint (documented per route); the
+ * only tie-breaker is `id` so pagination is stable under equal
+ * `createdAt`.
+ */
+export interface DecodedCursor {
+    readonly createdAt: string;
+    readonly id: string;
+}
+export declare function encodeCursor(cursor: DecodedCursor): string;
+/** Returns `null` on any decode failure — caller responds with 400 bad-input. */
+export declare function decodeCursor(raw: string): DecodedCursor | null;
+export declare function clampLimit(raw: string | undefined, def?: number, cap?: number): number;
+//# sourceMappingURL=pagination.d.ts.map

package/dist/routes/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/routes/pagination.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAG1D;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAmB9D;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,SAAK,EAAE,GAAG,SAAM,GAAG,MAAM,CAK/E"}

package/dist/routes/pagination.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export function encodeCursor(cursor) {
+    const json = JSON.stringify(cursor);
+    return Buffer.from(json, 'utf8').toString('base64url');
+}
+/** Returns `null` on any decode failure — caller responds with 400 bad-input. */
+export function decodeCursor(raw) {
+    try {
+        const json = Buffer.from(raw, 'base64url').toString('utf8');
+        const parsed = JSON.parse(json);
+        if (parsed === null ||
+            typeof parsed !== 'object' ||
+            typeof parsed.createdAt !== 'string' ||
+            typeof parsed.id !== 'string') {
+            return null;
+        }
+        return {
+            createdAt: parsed.createdAt,
+            id: parsed.id,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function clampLimit(raw, def = 25, cap = 100) {
+    if (raw === undefined)
+        return def;
+    const n = Number.parseInt(raw, 10);
+    if (!Number.isFinite(n) || n < 1)
+        return def;
+    return Math.min(n, cap);
+}
+//# sourceMappingURL=pagination.js.map

package/dist/routes/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../../src/routes/pagination.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAiBjC,MAAM,UAAU,YAAY,CAAC,MAAqB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,OAAQ,MAAkC,CAAC,SAAS,KAAK,QAAQ;YACjE,OAAQ,MAA2B,CAAC,EAAE,KAAK,QAAQ,EACnD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAG,MAAwB,CAAC,SAAS;YAC9C,EAAE,EAAG,MAAwB,CAAC,EAAE;SACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAuB,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,GAAG;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC"}

package/dist/routes/policies.d.ts

@@ -0,0 +1,23 @@
+import { Hono } from 'hono';
+import { type PolicyRegistryBinding } from '@kindgi/policy-contract';
+import type { AppEnv } from '../types.js';
+/**
+ * Policies resource routes — part of the admin control plane. Full
+ * versioned CRUD, mirroring `flows` 1:1.
+ *
+ * The registry is intentionally kind-neutral: the wire body carries a
+ * `kind` discriminator and a `spec` object whose shape is dictated by
+ * that kind. The route validates the top-level shape (id, tenantId,
+ * semver version, kind ∈ closed enum, spec is an object), and `spec`
+ * against its kind's contract where `@kindgi/policy-contract` has one
+ * (`tool-errors`, `hitl`) — a policy that couldn't be applied is refused
+ * here, not found out on a turn. Other kinds' specs are their runtime
+ * consumer's to validate.
+ *
+ * Enforcement is out of scope. This is the *registry* surface only.
+ * Runtime consumers (e.g. `@kindgi/capabilities` `route` for
+ * `model-routing`, adapter-allowlist checks, retention sweeps) read
+ * policies from this store and apply them at their own boundary.
+ */
+export declare function policiesRouter(binding: PolicyRegistryBinding): Hono<AppEnv>;
+//# sourceMappingURL=policies.d.ts.map

package/dist/routes/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../src/routes/policies.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAIL,KAAK,qBAAqB,EAE3B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CAoQ3E"}

package/dist/routes/policies.js

@@ -0,0 +1,314 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { POLICY_KINDS, validatePolicySpec, } from '@kindgi/policy-contract';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Policies resource routes — part of the admin control plane. Full
+ * versioned CRUD, mirroring `flows` 1:1.
+ *
+ * The registry is intentionally kind-neutral: the wire body carries a
+ * `kind` discriminator and a `spec` object whose shape is dictated by
+ * that kind. The route validates the top-level shape (id, tenantId,
+ * semver version, kind ∈ closed enum, spec is an object), and `spec`
+ * against its kind's contract where `@kindgi/policy-contract` has one
+ * (`tool-errors`, `hitl`) — a policy that couldn't be applied is refused
+ * here, not found out on a turn. Other kinds' specs are their runtime
+ * consumer's to validate.
+ *
+ * Enforcement is out of scope. This is the *registry* surface only.
+ * Runtime consumers (e.g. `@kindgi/capabilities` `route` for
+ * `model-routing`, adapter-allowlist checks, retention sweeps) read
+ * policies from this store and apply them at their own boundary.
+ */
+export function policiesRouter(binding) {
+    const r = new Hono();
+    // ---------- GET / (list, cursor-paginated) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const kindRaw = c.req.query('kind');
+        const nameRaw = c.req.query('name');
+        if (kindRaw !== undefined && kindRaw.length > 0 && !isPolicyKind(kindRaw)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: `Unknown policy kind "${kindRaw}". Expected one of: ${POLICY_KINDS.join(', ')}.`,
+            }, requestId));
+        }
+        const page = await binding.list({
+            tenantId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(kindRaw !== undefined && kindRaw.length > 0 && { policyKind: kindRaw }),
+            ...(nameRaw !== undefined && nameRaw.length > 0 && { nameFilter: nameRaw }),
+        });
+        return c.json({
+            data: page.data.map(serializePolicy),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:policyId (latest version) ----------
+    r.get('/:policyId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const policyId = c.req.param('policyId');
+        const policy = await binding.get({ tenantId, policyId });
+        if (policy === null) {
+            // 410 gone (head exists, no active version) vs 404 not-found.
+            const exists = await binding.headExists({ tenantId, policyId });
+            if (exists) {
+                c.status(statusFor('policy-gone'));
+                return c.json(toWireError({
+                    code: 'policy-gone',
+                    message: `Policy "${policyId}" has no active versions; reinstate a tombstoned version or publish a new one`,
+                    policyId,
+                }, requestId));
+            }
+            c.status(statusFor('policy-not-found'));
+            return c.json(toWireError({
+                code: 'policy-not-found',
+                message: `No policy registered with id "${policyId}"`,
+                policyId,
+            }, requestId));
+        }
+        return c.json(serializePolicy(policy));
+    });
+    // ---------- GET /:policyId/versions (list versions) ----------
+    r.get('/:policyId/versions', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const policyId = c.req.param('policyId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        // `?includeTombstoned=true` surfaces soft-tombstoned rows alongside
+        // active ones. Rows carry `unregisteredAt` (ISO string) iff
+        // tombstoned. Absent / anything else → active-only (the default).
+        const includeTombstoned = c.req.query('includeTombstoned') === 'true';
+        // Confirm the id exists at all — an empty versions list from the
+        // binding is ambiguous (no versions vs. unknown id). `headExists`
+        // returns true for the derived-retired state (all versions
+        // tombstoned) too, so the includeTombstoned=true caller sees the
+        // history even when every version has been unregistered.
+        const exists = await binding.headExists({ tenantId, policyId });
+        if (!exists) {
+            c.status(statusFor('policy-not-found'));
+            return c.json(toWireError({
+                code: 'policy-not-found',
+                message: `No policy registered with id "${policyId}"`,
+                policyId,
+            }, requestId));
+        }
+        const page = await binding.listVersions({
+            tenantId,
+            policyId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(includeTombstoned && { includeTombstoned: true }),
+        });
+        return c.json({
+            data: page.data.map(serializePolicyVersionRow),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:policyId/versions/:version ----------
+    r.get('/:policyId/versions/:version', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const policyId = c.req.param('policyId');
+        const version = c.req.param('version');
+        const policy = await binding.getVersion({ tenantId, policyId, version });
+        if (policy === null) {
+            c.status(statusFor('policy-not-found'));
+            return c.json(toWireError({
+                code: 'policy-not-found',
+                message: `No policy "${policyId}" at version "${version}"`,
+                policyId,
+                version,
+            }, requestId));
+        }
+        return c.json(serializePolicy(policy));
+    });
+    // ---------- POST / (publish) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        // Validate the wire shape, and `spec` for the kinds whose contract
+        // lives in `@kindgi/policy-contract`.
+        const validation = validatePolicy(body, tenantId);
+        if (validation.kind === 'err') {
+            c.status(statusFor('validation-failed'));
+            return c.json(toWireError({
+                code: 'validation-failed',
+                message: validation.error.message,
+                issues: validation.error.issues,
+            }, requestId));
+        }
+        const outcome = await binding.publish({ tenantId, policy: validation.value });
+        if (outcome.kind === 'already-registered') {
+            c.status(statusFor('policy-already-registered'));
+            return c.json(toWireError({
+                code: 'policy-already-registered',
+                message: `Policy "${outcome.policyId}" version "${outcome.version}" is already registered`,
+                policyId: outcome.policyId,
+                version: outcome.version,
+            }, requestId));
+        }
+        c.status(201);
+        return c.json({ policyId: outcome.policyId, version: outcome.version });
+    });
+    // ---------- POST /:policyId/versions/:version/unregister ----------
+    r.post('/:policyId/versions/:version/unregister', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const policyId = c.req.param('policyId');
+        const version = c.req.param('version');
+        const outcome = await binding.unregister({ tenantId, policyId, version });
+        if (!outcome.unregistered) {
+            c.status(statusFor('policy-not-found'));
+            return c.json(toWireError({
+                code: 'policy-not-found',
+                message: `No policy "${policyId}" at version "${version}" to unregister`,
+                policyId,
+                version,
+            }, requestId));
+        }
+        return c.json({ policyId, version, unregistered: true });
+    });
+    // ---------- POST /:policyId/versions/:version/reinstate ----------
+    r.post('/:policyId/versions/:version/reinstate', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const policyId = c.req.param('policyId');
+        const version = c.req.param('version');
+        const outcome = await binding.reinstateVersion({ tenantId, policyId, version });
+        if (outcome.kind === 'not-found') {
+            c.status(statusFor('policy-not-found'));
+            return c.json(toWireError({
+                code: 'policy-not-found',
+                message: `No policy "${policyId}" at version "${version}" to reinstate`,
+                policyId,
+                version,
+            }, requestId));
+        }
+        return c.json({
+            policyId: outcome.policyId,
+            version: outcome.version,
+            wasTombstoned: outcome.wasTombstoned,
+        });
+    });
+    return r;
+}
+function serializePolicy(p) {
+    return {
+        id: p.id,
+        tenantId: p.tenantId,
+        version: p.version,
+        kind: p.kind,
+        ...(p.description !== undefined && { description: p.description }),
+        spec: p.spec,
+    };
+}
+/**
+ * Version-list serializer — same shape as `serializePolicy` plus the
+ * optional `unregisteredAt` timestamp when the row is tombstoned. Kept
+ * separate so `get` / `getVersion` responses don't leak the field.
+ */
+function serializePolicyVersionRow(p) {
+    return {
+        ...serializePolicy(p),
+        ...(p.unregisteredAt !== undefined && { unregisteredAt: p.unregisteredAt }),
+    };
+}
+function isPolicyKind(value) {
+    return POLICY_KINDS.includes(value);
+}
+const SEMVER_RE = /^\d+\.\d+\.\d+$/;
+/**
+ * Wire-shape validator for `Policy`. Confirms the top-level fields the
+ * registry needs (id, tenantId, semver version, kind ∈ closed enum,
+ * spec is an object), then `spec` against its kind's contract
+ * (`validatePolicySpec`); its issues are pathed under `spec`, e.g.
+ * `spec/tools/acme.pay/mode`.
+ */
+function validatePolicy(body, tenantId) {
+    const b = body;
+    const issues = [];
+    if (typeof b.id !== 'string' || b.id.length === 0) {
+        issues.push({ path: 'id', message: 'policy.id must be a non-empty string' });
+    }
+    if (typeof b.version !== 'string' || !SEMVER_RE.test(b.version)) {
+        issues.push({
+            path: 'version',
+            message: 'policy.version must be a semver string (e.g. "1.0.0")',
+        });
+    }
+    if (typeof b.kind !== 'string' || !isPolicyKind(b.kind)) {
+        issues.push({
+            path: 'kind',
+            message: `policy.kind must be one of: ${POLICY_KINDS.join(', ')}`,
+        });
+    }
+    // tenantId is optional on the wire — when present, it must match the
+    // caller's tenant (server-derived from the token). Cross-tenant
+    // publish is not allowed.
+    if (b.tenantId !== undefined) {
+        if (typeof b.tenantId !== 'string' ||
+            b.tenantId !== tenantId) {
+            issues.push({
+                path: 'tenantId',
+                message: 'policy.tenantId must match the caller tenant',
+            });
+        }
+    }
+    if (b.spec === undefined ||
+        b.spec === null ||
+        typeof b.spec !== 'object' ||
+        Array.isArray(b.spec)) {
+        issues.push({ path: 'spec', message: 'policy.spec must be an object' });
+    }
+    else if (typeof b.kind === 'string' && isPolicyKind(b.kind)) {
+        for (const issue of validatePolicySpec(b.kind, b.spec)) {
+            issues.push({
+                path: `spec${issue.path}`,
+                message: `policy.spec${issue.path} ${issue.message}`,
+            });
+        }
+    }
+    if (b.description !== undefined && typeof b.description !== 'string') {
+        issues.push({ path: 'description', message: 'policy.description must be a string' });
+    }
+    if (issues.length > 0) {
+        return {
+            kind: 'err',
+            error: { message: issues[0]?.message ?? 'policy validation failed', issues },
+        };
+    }
+    const value = {
+        id: b.id,
+        tenantId,
+        version: b.version,
+        kind: b.kind,
+        ...(typeof b.description === 'string' && { description: b.description }),
+        spec: b.spec,
+    };
+    return { kind: 'ok', value };
+}
+//# sourceMappingURL=policies.js.map

package/dist/routes/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/routes/policies.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EACL,YAAY,EAIZ,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,wBAAwB,OAAO,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1F,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAqB,EAAE,CAAC;YACzF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;SAC5E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YACpC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,8DAA8D;YAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,IAAI,MAAM,EAAE,CAAC;gBACX,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAU,CAAC,CAAC;gBAC5C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,WAAW,QAAQ,+EAA+E;oBAC3G,QAAQ;iBACT,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,iCAAiC,QAAQ,GAAG;gBACrD,QAAQ;aACT,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,oEAAoE;QACpE,4DAA4D;QAC5D,kEAAkE;QAClE,MAAM,iBAAiB,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,MAAM,CAAC;QAEtE,iEAAiE;QACjE,kEAAkE;QAClE,2DAA2D;QAC3D,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,iCAAiC,QAAQ,GAAG;gBACrD,QAAQ;aACT,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;YACtC,QAAQ;YACR,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,iBAAiB,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;YAC9C,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yDAAyD;IACzD,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,cAAc,QAAQ,iBAAiB,OAAO,GAAG;gBAC1D,QAAQ;gBACR,OAAO;aACR,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,sCAAsC;QACtC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBACjC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,MAA8C;aACxE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,CAAU,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,WAAW,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,OAAO,yBAAyB;gBAC1F,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,CAAC,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,cAAc,QAAQ,iBAAiB,OAAO,iBAAiB;gBACxE,QAAQ;gBACR,OAAO;aACR,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,CAAC,CAAC,IAAI,CAAC,wCAAwC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,cAAc,QAAQ,iBAAiB,OAAO,gBAAgB;gBACvE,QAAQ;gBACR,OAAO;aACR,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAA6B;QACzC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,CAAgD;IAEhD,OAAO;QACL,GAAG,eAAe,CAAC,CAAC,CAAC;QACrB,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAQ,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;GAMG;AACH,SAAS,cAAc,CACrB,IAAa,EACb,QAAkB;IAOlB,MAAM,CAAC,GAAG,IAAiD,CAAC;IAC5D,MAAM,MAAM,GAAwC,EAAE,CAAC;IAEvD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IACD,qEAAqE;IACrE,gEAAgE;IAChE,0BAA0B;IAC1B,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,IACE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,QAA8B,KAAM,QAA8B,EACrE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,8CAA8C;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IACE,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,IAAI,KAAK,IAAI;QACf,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EACrB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,EAAE;gBACzB,OAAO,EAAE,cAAc,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,EAAE;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAW;QACpB,EAAE,EAAE,CAAC,CAAC,EAAY;QAClB,QAAQ;QACR,OAAO,EAAE,CAAC,CAAC,OAAiB;QAC5B,IAAI,EAAE,CAAC,CAAC,IAAkB;QAC1B,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,EAAE,CAAC,CAAC,IAAyC;KAClD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}