@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/routes/teams.js

@@ -0,0 +1,443 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Teams resource routes — part of the multi-tenant hierarchy.
+ *
+ * Nine endpoints on `/v1/teams`:
+ *   - `GET    /`                        — cursor-paginated list;
+ *                                         `?limit=` / `?cursor=` / `?orgId=` /
+ *                                         `?nameContains=`.
+ *   - `POST   /`                        — create; body `{ name, slug,
+ *                                         description?, orgId? }`; 201 `{ id }`.
+ *   - `GET    /:teamId`                 — get; 200 or 404 `team-not-found`.
+ *   - `PATCH  /:teamId`                 — partial update; 204 or 404.
+ *   - `DELETE /:teamId`                 — 204 idempotent.
+ *   - `GET    /:teamId/memberships`     — list; cursor-paginated.
+ *   - `POST   /:teamId/memberships`     — add member; body `{ userId, role }`;
+ *                                         201. Idempotent — adding an existing
+ *                                         member with a differing role is a
+ *                                         no-op per the binding contract.
+ *   - `DELETE /:teamId/memberships/:userId`
+ *                                       — 204 idempotent.
+ *   - `PATCH  /:teamId/memberships/:userId`
+ *                                       — updateRole via `{ role }`; 204 or
+ *                                         404 `team-membership-not-found`.
+ */
+export function teamsRouter(binding, membershipBinding, tenantHierarchy, authorizer) {
+    const r = new Hono();
+    // ---------- Authorization middleware ----------
+    // Full PEP surface:
+    //   POST /                                    → admin on tenant
+    //   GET  /:teamId                              → read on team
+    //   PATCH /:teamId, DELETE /:teamId           → admin on team
+    //   *    /:teamId/memberships                  → GET: read; else admin
+    //   *    /:teamId/memberships/:userId          → same
+    //   GET  /                                     → list-filter by can_read
+    //
+    // Note: POST / checks `admin on tenant` even when the body carries an
+    // orgId — a strictly stronger gate than `admin on org:$spec.orgId`
+    // (tenant admins can do anything an org admin can).
+    if (authorizer !== undefined) {
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'POST')
+                return next();
+            const mw = authorizer.authorize('admin', (ctx) => ref('tenant', ctx.get('tenantId')));
+            return mw(c, next);
+        });
+        r.use('/:teamId', async (c, next) => {
+            const method = c.req.method;
+            if (method !== 'GET' && method !== 'PATCH' && method !== 'DELETE')
+                return next();
+            const teamId = c.req.param('teamId');
+            const action = method === 'GET' ? 'read' : 'admin';
+            const mw = authorizer.authorize(action, () => ref('team', teamId));
+            return mw(c, next);
+        });
+        r.use('/:teamId/memberships', async (c, next) => {
+            const teamId = c.req.param('teamId');
+            const action = c.req.method === 'GET' ? 'read' : 'admin';
+            const mw = authorizer.authorize(action, () => ref('team', teamId));
+            return mw(c, next);
+        });
+        r.use('/:teamId/memberships/:userId', async (c, next) => {
+            const teamId = c.req.param('teamId');
+            const action = c.req.method === 'GET' ? 'read' : 'admin';
+            const mw = authorizer.authorize(action, () => ref('team', teamId));
+            return mw(c, next);
+        });
+    }
+    // ---------- GET / ----------
+    r.get('/', async (c) => {
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const orgIdRaw = c.req.query('orgId');
+        const nameContainsRaw = c.req.query('nameContains');
+        const page = await binding.list(tenantId, {
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(orgIdRaw !== undefined && orgIdRaw.length > 0 && { orgId: orgIdRaw }),
+            ...(nameContainsRaw !== undefined &&
+                nameContainsRaw.length > 0 && { nameContains: nameContainsRaw }),
+        });
+        // Authorization list-filter — strip teams the caller can't read.
+        const visible = authorizer !== undefined
+            ? await authorizer.filterByCan(c, 'read', page.items, (t) => ref('team', t.id))
+            : [...page.items];
+        return c.json({
+            data: visible.map(serializeTeam),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- POST / ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        if (typeof b.name !== 'string' || b.name.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`name` is required and must be a non-empty string' }, requestId));
+        }
+        if (typeof b.slug !== 'string' || b.slug.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`slug` is required and must be a non-empty string' }, requestId));
+        }
+        if (b.description !== undefined && typeof b.description !== 'string') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`description` must be a string when present' }, requestId));
+        }
+        if (b.orgId !== undefined && typeof b.orgId !== 'string') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`orgId` must be a string when present' }, requestId));
+        }
+        const spec = {
+            name: b.name,
+            slug: b.slug,
+            ...(b.description !== undefined && { description: b.description }),
+            ...(b.orgId !== undefined && { orgId: b.orgId }),
+        };
+        if (authorizer !== undefined) {
+            const principal = c.get('principal');
+            const creatorUserId = principal?.actor.kind === 'user'
+                ? principal.actor.id
+                : '00000000-0000-0000-0000-000000000000';
+            const result = await tenantHierarchy.createTeam({ tenantId, creatorUserId, spec });
+            if (result.kind === 'err') {
+                const code = result.error.code === 'slug-conflict' ? 'slug-conflict' : 'internal-server-error';
+                c.status(statusFor(code));
+                return c.json(toWireError({ code, message: result.error.message }, requestId));
+            }
+            c.status(201);
+            return c.json({ id: result.value.teamId });
+        }
+        const id = await binding.create(tenantId, spec);
+        c.status(201);
+        return c.json({ id: id });
+    });
+    // ---------- GET /:teamId/memberships ----------
+    // Mount BEFORE /:teamId so the `memberships` segment is not consumed by
+    // the `:teamId` param on the parent route table.
+    r.get('/:teamId/memberships', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        // Preliminary get flips unknown teamId to a 404 so an empty list from
+        // the membership binding is unambiguous.
+        const team = await binding.get(tenantId, teamId);
+        if (team === undefined) {
+            c.status(statusFor('team-not-found'));
+            return c.json(toWireError({
+                code: 'team-not-found',
+                message: `No team with id "${teamId}"`,
+                teamId: teamId,
+            }, requestId));
+        }
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const page = await membershipBinding.list(tenantId, teamId, {
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+        });
+        return c.json({
+            data: page.items.map(serializeTeamMembership),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- POST /:teamId/memberships ----------
+    r.post('/:teamId/memberships', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        const team = await binding.get(tenantId, teamId);
+        if (team === undefined) {
+            c.status(statusFor('team-not-found'));
+            return c.json(toWireError({
+                code: 'team-not-found',
+                message: `No team with id "${teamId}"`,
+                teamId: teamId,
+            }, requestId));
+        }
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        if (typeof b.userId !== 'string' || b.userId.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`userId` is required and must be a non-empty string' }, requestId));
+        }
+        if (!isTeamRole(b.role)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: '`role` must be one of: member, admin',
+            }, requestId));
+        }
+        try {
+            if (authorizer !== undefined) {
+                const res = await tenantHierarchy.addTeamMember({
+                    tenantId,
+                    teamId,
+                    userId: b.userId,
+                    role: b.role,
+                });
+                if (res.kind === 'err')
+                    throw new Error(res.error.message);
+            }
+            else {
+                await membershipBinding.add(tenantId, {
+                    teamId,
+                    userId: b.userId,
+                    role: b.role,
+                });
+            }
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            if (message.startsWith('team-not-found')) {
+                // Racy — team was deleted between the preliminary get and the add.
+                c.status(statusFor('team-not-found'));
+                return c.json(toWireError({
+                    code: 'team-not-found',
+                    message: `No team with id "${teamId}"`,
+                    teamId: teamId,
+                }, requestId));
+            }
+            throw cause;
+        }
+        c.status(201);
+        return c.json({
+            teamId: teamId,
+            userId: b.userId,
+            role: b.role,
+        });
+    });
+    // ---------- DELETE /:teamId/memberships/:userId ----------
+    r.delete('/:teamId/memberships/:userId', async (c) => {
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        const userId = c.req.param('userId');
+        await membershipBinding.remove(tenantId, teamId, userId);
+        c.status(204);
+        return c.body(null);
+    });
+    // ---------- PATCH /:teamId/memberships/:userId ----------
+    r.patch('/:teamId/memberships/:userId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        const userId = c.req.param('userId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        if (!isTeamRole(b.role)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: '`role` must be one of: member, admin',
+            }, requestId));
+        }
+        try {
+            await membershipBinding.updateRole(tenantId, teamId, userId, b.role);
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            if (message.startsWith('team-membership-not-found')) {
+                c.status(statusFor('team-membership-not-found'));
+                return c.json(toWireError({
+                    code: 'team-membership-not-found',
+                    message: `No membership for team "${teamId}" + user "${userId}"`,
+                    teamId: teamId,
+                    userId: userId,
+                }, requestId));
+            }
+            if (message.startsWith('team-not-found')) {
+                c.status(statusFor('team-not-found'));
+                return c.json(toWireError({
+                    code: 'team-not-found',
+                    message: `No team with id "${teamId}"`,
+                    teamId: teamId,
+                }, requestId));
+            }
+            throw cause;
+        }
+        c.status(204);
+        return c.body(null);
+    });
+    // ---------- GET /:teamId ----------
+    r.get('/:teamId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        const team = await binding.get(tenantId, teamId);
+        if (team === undefined) {
+            c.status(statusFor('team-not-found'));
+            return c.json(toWireError({
+                code: 'team-not-found',
+                message: `No team with id "${teamId}"`,
+                teamId: teamId,
+            }, requestId));
+        }
+        return c.json(serializeTeam(team));
+    });
+    // ---------- PATCH /:teamId ----------
+    r.patch('/:teamId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const b = body;
+        const shaped = {};
+        if (b.name !== undefined) {
+            if (typeof b.name !== 'string') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`name` must be a string when present' }, requestId));
+            }
+            shaped.name = b.name;
+        }
+        if (b.slug !== undefined) {
+            if (typeof b.slug !== 'string') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`slug` must be a string when present' }, requestId));
+            }
+            shaped.slug = b.slug;
+        }
+        if (b.description !== undefined) {
+            if (typeof b.description !== 'string') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`description` must be a string when present' }, requestId));
+            }
+            shaped.description = b.description;
+        }
+        if ('orgId' in b) {
+            const raw = b.orgId;
+            if (raw === null) {
+                shaped.orgId = null;
+            }
+            else if (typeof raw === 'string') {
+                shaped.orgId = raw;
+            }
+            else {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`orgId` must be a string or null when present' }, requestId));
+            }
+        }
+        try {
+            await binding.update(tenantId, teamId, shaped);
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            if (message.startsWith('team-not-found')) {
+                c.status(statusFor('team-not-found'));
+                return c.json(toWireError({
+                    code: 'team-not-found',
+                    message: `No team with id "${teamId}"`,
+                    teamId: teamId,
+                }, requestId));
+            }
+            throw cause;
+        }
+        c.status(204);
+        return c.body(null);
+    });
+    // ---------- DELETE /:teamId ----------
+    r.delete('/:teamId', async (c) => {
+        const tenantId = c.get('tenantId');
+        const teamId = c.req.param('teamId');
+        await binding.delete(tenantId, teamId);
+        c.status(204);
+        return c.body(null);
+    });
+    return r;
+}
+function isTeamRole(x) {
+    return x === 'member' || x === 'admin';
+}
+function serializeTeam(t) {
+    return {
+        id: t.id,
+        tenantId: t.tenantId,
+        ...(t.orgId !== undefined && { orgId: t.orgId }),
+        name: t.name,
+        slug: t.slug,
+        ...(t.description !== undefined && { description: t.description }),
+        createdAt: t.createdAt,
+        updatedAt: t.updatedAt,
+    };
+}
+function serializeTeamMembership(m) {
+    return {
+        teamId: m.teamId,
+        userId: m.userId,
+        role: m.role,
+        joinedAt: m.joinedAt,
+    };
+}
+//# sourceMappingURL=teams.js.map

package/dist/routes/teams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"teams.js","sourceRoot":"","sources":["../../src/routes/teams.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,MAAM,eAAe,CAAC;AAapD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,iBAAwC,EACxC,eAAuC,EACvC,UAAuB;IAEvB,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,iDAAiD;IACjD,oBAAoB;IACpB,gEAAgE;IAChE,8DAA8D;IAC9D,8DAA8D;IAC9D,uEAAuE;IACvE,sDAAsD;IACtD,yEAAyE;IACzE,EAAE;IACF,sEAAsE;IACtE,mEAAmE;IACnE,oDAAoD;IACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CACxD,CAAC;YACF,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,EAAE,CAAC;YACjF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACtD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8BAA8B;IAC9B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxC,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAiB,EAAE,CAAC;YAClF,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,iEAAiE;QACjE,MAAM,OAAO,GACX,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CACxD,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAuB,CAAC,CACvC;YACH,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+BAA+B;IAC/B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,EACnF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,mDAAmD,EAAE,EACnF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAC7E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE,EACvE,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAa;YACrB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAqB,EAAE,CAAC;YAC5E,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAyB,EAAE,CAAC;SACrE,CAAC;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM;gBAC9B,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa;gBAChC,CAAC,CAAE,sCAAiD,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC1B,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACpF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAA2B,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAuB,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,wEAAwE;IACxE,iDAAiD;IACjD,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,sEAAsE;QACtE,yCAAyC;QACzC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;gBAC3D,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE;YAC1D,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;SACxF,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;gBAC3D,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qDAAqD,EAAE,EACrF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,sCAAsC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,aAAa,CAAC;oBAC9C,QAAQ;oBACR,MAAM;oBACN,MAAM,EAAE,CAAC,CAAC,MAA2B;oBACrC,IAAI,EAAE,CAAC,CAAC,IAAgB;iBACzB,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,MAAM,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE;oBACpC,MAAM;oBACN,MAAM,EAAE,CAAC,CAAC,MAA2B;oBACrC,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzC,mEAAmE;gBACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;oBAC3D,MAAM,EAAE,MAA2B;iBACpC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAA2B;YACnC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,CAAC,CAAC,MAAM,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,sCAAsC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,CAAU,CAAC,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,2BAA2B,MAA2B,aAAa,MAA2B,GAAG;oBAC1G,MAAM,EAAE,MAA2B;oBACnC,MAAM,EAAE,MAA2B;iBACpC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;oBAC3D,MAAM,EAAE,MAA2B;iBACpC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;gBAC3D,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,MAAM,GAAuD,EAAE,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,EACtE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACtC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAC7E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC;YACpB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACtB,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,CAAC,KAAK,GAAG,GAAuB,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,+CAA+C,EAAE,EAC/E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAU,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,oBAAoB,MAA2B,GAAG;oBAC3D,MAAM,EAAE,MAA2B;iBACpC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAC/C,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,CAAO;IAC5B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAA6B;QACzC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAA0B,EAAE,CAAC;QACrE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,SAAS,EAAE,CAAC,CAAC,SAA8B;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAiB;IAChD,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAA6B;KAC1C,CAAC;AACJ,CAAC"}

package/dist/routes/tenant.d.ts

@@ -0,0 +1,57 @@
+import { Hono } from 'hono';
+import type { TenantHierarchyBinding } from '@kindgi/platform';
+import type { EnvBinding } from '../env-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { SecretBinding } from '../secrets-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Tenant resource routes — part of the multi-tenant hierarchy. Config
+ * reads and writes route through the two symmetric bindings
+ * `EnvBinding` + `SecretBinding` at tenant scope.
+ *
+ * Three endpoints on `/v1/tenant` — the caller's tenant is always
+ * implicit from the bearer token; there is no `/v1/tenants` collection
+ * (tenants are the sovereignty boundary, not a listable resource under
+ * a tenant).
+ *
+ *   - `GET   /`         — returns `{ id, name, slug, createdAt,
+ *                         updatedAt }` for the caller's tenant.
+ *                         Reads the tenant via the tenant-hierarchy
+ *                         binding.
+ *   - `GET   /config`   — cursor-paginated list of the tenant's config
+ *                         entries: the env entries, then the secret
+ *                         entries. Merged view over `EnvBinding.list` +
+ *                         `SecretBinding.list` at `scope: tenant` with
+ *                         `inherit: false` (tenant is the top of the
+ *                         resolution walk — no upward inheritance is
+ *                         possible). Optional `?kind=` filters to one
+ *                         binding; `env` and `config` both surface the
+ *                         env binding. Secret
+ *                         `value` is ALWAYS redacted here (the admin
+ *                         surface never returns raw plaintext).
+ *   - `PATCH /config`   — upsert one config entry. Body: `{ kind, key,
+ *                         value, sensitive?, ifRevision? }`. Routes to
+ *                         `SecretBinding.set` when `kind === 'secret'`
+ *                         OR `sensitive === true`; else to
+ *                         `EnvBinding.set`. Returns 200 with `{ entry }`
+ *                         on ok, 409 `tenant-config-revision-conflict`
+ *                         when `ifRevision` mismatches.
+ *
+ * Env dimension. The wire shape doesn't carry `envName`, but both
+ * bindings require it. The router
+ * derives it from `KINDGI_ENV_NAME` at request time, falling back to
+ * `'default'` if unset. Deployments that want per-env writes should use
+ * the dedicated `/v1/env/*` + `/v1/secrets/*` routes.
+ *
+ * Mount policy. `/config` mounts when either `envBinding` OR
+ * `secretsBinding` is present. If only one is wired, the other class of
+ * writes returns 400 with a clear message.
+ */
+export interface TenantRouterOptions {
+    readonly tenantHierarchyBinding: TenantHierarchyBinding;
+    readonly envBinding?: EnvBinding;
+    readonly secretsBinding?: SecretBinding;
+    readonly authorizer?: Authorizer;
+}
+export declare function tenantRouter(options: TenantRouterOptions): Hono<AppEnv>;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/routes/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAS,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAItE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAwED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC,CA0WvE"}