@kindgi/api 0.1.4 → 0.1.5-rc.0

package/dist/middleware/authorize.js

@@ -1,8 +1,23 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
-import { denyPayload, } from '@kindgi/authz';
+import { OBJECT_ACTIONS, denyPayload, } from '@kindgi/authz';
 import { toWireError } from '../errors.js';
 export function createAuthorizer(binding) {
+    /**
+     * Whether a resource is inside the project the caller's API key is
+     * limited to (always, for a caller with no such key). The tenant, orgs,
+     * teams and projects are held by `keyCeilingDeny`; anything else must
+     * belong to the key's project, as the store says (`inProject`). Without
+     * that answer, the key reaches no other resource.
+     */
+    async function inKeyProject(c, principal, resource) {
+        const keyProject = c.get('tokenProjectId');
+        if (keyProject === undefined || STRUCTURAL.has(resource.type))
+            return true;
+        if (binding.inProject === undefined)
+            return false;
+        return binding.inProject(principal, resource, keyProject);
+    }
     async function checkInternal(c, action, resource) {
         const principal = c.get('principal');
         if (principal === undefined) {
@@ -18,6 +33,15 @@ export function createAuthorizer(binding) {
                 },
             };
         }
+        const undefinedPair = undefinedRelation(action, resource);
+        if (undefinedPair !== undefined)
+            return undefinedPair;
+        const ceiling = keyCeilingDeny(c, action, resource);
+        if (ceiling !== undefined)
+            return ceiling;
+        if (!(await inKeyProject(c, principal, resource))) {
+            return keyDecision(action, resource, `the API key is limited to project ${c.get('tokenProjectId')}`);
+        }
         const requestId = c.get('requestId');
         const ctx = typeof requestId === 'string' && requestId.length > 0
             ? { correlationId: requestId }
@@ -58,19 +82,104 @@ export function createAuthorizer(binding) {
             const principal = c.get('principal');
             if (principal === undefined)
                 return [];
-            const refs = items.map(refFn);
+            // What the model can't answer, or the key itself rules out, never
+            // reaches the store.
+            const allowedByKey = await Promise.all(items.map(async (item) => undefinedRelation(action, refFn(item)) === undefined &&
+                keyCeilingDeny(c, action, refFn(item)) === undefined &&
+                (await inKeyProject(c, principal, refFn(item)))));
+            const open = items.filter((_, i) => allowedByKey[i]);
+            if (open.length === 0)
+                return [];
+            const refs = open.map(refFn);
             const requestId = c.get('requestId');
             const ctx = typeof requestId === 'string' && requestId.length > 0
                 ? { correlationId: requestId }
                 : undefined;
             const decisions = await binding.checkBatch(principal, action, refs, ctx);
             const out = [];
-            for (let i = 0; i < items.length; i++) {
+            for (let i = 0; i < open.length; i++) {
                 if (decisions[i]?.allowed)
-                    out.push(items[i]);
+                    out.push(open[i]);
             }
             return out;
         },
+        async listObjects(c, action, type) {
+            if (binding.listObjects === undefined)
+                return undefined;
+            const principal = c.get('principal');
+            if (principal === undefined)
+                return [];
+            const requestId = c.get('requestId');
+            const ctx = typeof requestId === 'string' && requestId.length > 0
+                ? { correlationId: requestId }
+                : undefined;
+            return binding.listObjects(principal, action, type, ctx);
+        },
     };
 }
+/**
+ * A check must name a relation the authorization model defines for the
+ * resource's type (`OBJECT_ACTIONS`, kept equal to the runtime's model by
+ * its tests). Any other pair is a bug in the route: the PDP rejects it
+ * for everyone, the seed admin included, and only with authorization on,
+ * so it's refused here, naming the pair, and logged.
+ */
+function undefinedRelation(action, resource) {
+    const defined = OBJECT_ACTIONS[resource.type];
+    if (defined?.includes(action) === true)
+        return undefined;
+    const reason = `the authorization model has no \`${action}\` on \`${resource.type}\` (a check that can never pass: a bug in the route)`;
+    console.error(`[authz] ${reason}`);
+    return {
+        allowed: false,
+        failing: 'invalid-action',
+        reason,
+        evidence: {
+            action,
+            relation: '',
+            resource: `${resource.type}:${resource.id}`,
+            actorSubject: '',
+        },
+    };
+}
+/** Types a key's project limit is checked on directly, not through `inProject`. */
+const STRUCTURAL = new Set(['tenant', 'org', 'team', 'project']);
+function keyDecision(action, resource, reason) {
+    return {
+        allowed: false,
+        failing: 'scope',
+        reason,
+        evidence: {
+            action,
+            relation: '',
+            resource: `${resource.type}:${resource.id}`,
+            actorSubject: '',
+        },
+    };
+}
+/**
+ * What an API key itself rules out, before the principal's grants are
+ * asked: a key can do less than its principal, never more.
+ *
+ * - A `member` key takes no `admin` action on the tenant, even for a
+ *   principal who is a tenant admin: a day-to-day key can't change keys,
+ *   grants or policies. Below the tenant, its principal's roles hold: a
+ *   project admin's member key administers that project.
+ * - A key limited to a project acts on no other project, and takes no
+ *   `admin` action on the tenant, an org or a team. Other resources must
+ *   be in its project (`inKeyProject`).
+ */
+function keyCeilingDeny(c, action, resource) {
+    if (action === 'admin' && resource.type === 'tenant' && c.get('tokenRole') === 'member') {
+        return keyDecision(action, resource, 'a member API key takes no admin action on the tenant');
+    }
+    const keyProject = c.get('tokenProjectId');
+    if (keyProject === undefined)
+        return undefined;
+    const otherProject = resource.type === 'project' && resource.id !== keyProject;
+    const aboveIt = resource.type !== 'project' && STRUCTURAL.has(resource.type) && action === 'admin';
+    return otherProject || aboveIt
+        ? keyDecision(action, resource, `the API key is limited to project ${keyProject}`)
+        : undefined;
+}
 //# sourceMappingURL=authorize.js.map

package/dist/middleware/authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,OAAO,EAML,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA+B3C,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,MAAc,EACd,QAAqB;QAErB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,mEAAmE;gBAC3E,QAAQ,EAAE;oBACR,MAAM;oBACN,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE;oBAC3C,YAAY,EAAE,EAAE;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ;YAC3B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,WAAW;YAC3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,mEAAmE;oBACnE,8DAA8D;oBAC9D,oCAAoC;oBACpC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;wBACE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,EACD,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC/C,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;gBAC9B,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,MAAM,GAAG,GAA6B,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO;oBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA2B,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../src/middleware/authorize.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,OAAO,EAIL,cAAc,EAId,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAyC3C,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD;;;;;;OAMG;IACH,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,SAAoB,EACpB,QAAqB;QAErB,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,MAAc,EACd,QAAqB;QAErB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,mEAAmE;gBAC3E,QAAQ,EAAE;oBACR,MAAM;oBACN,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE;oBAC3C,YAAY,EAAE,EAAE;iBACjB;aACF,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;QACtD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,WAAW,CAChB,MAAM,EACN,QAAQ,EACR,qCAAqC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,aAAa;QACpB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ;YAC3B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,WAAW;YAC3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;gBACvB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;gBACtC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACtB,mEAAmE;oBACnE,8DAA8D;oBAC9D,oCAAoC;oBACpC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACd,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;wBACE,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,OAAO,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;qBACpB,EACD,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAC/C,CACF,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACvC,kEAAkE;YAClE,qBAAqB;YACrB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACpC,KAAK,CAAC,GAAG,CACP,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;gBACpD,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS;gBACpD,CAAC,MAAM,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAClD,CACF,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;gBAC9B,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACzE,MAAM,GAAG,GAA6B,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAA2B,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI;YAC/B,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;YAC9D,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE;gBAC9B,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,MAAc,EAAE,QAAqB;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAkB,CAAkC,CAAC;IAC7F,IAAI,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,oCAAoC,MAAM,WAAW,QAAQ,CAAC,IAAI,sDAAsD,CAAC;IACxI,OAAO,CAAC,KAAK,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACnC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,gBAAgB;QACzB,MAAM;QACN,QAAQ,EAAE;YACR,MAAM;YACN,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE;YAC3C,YAAY,EAAE,EAAE;SACjB;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtF,SAAS,WAAW,CAAC,MAAc,EAAE,QAAqB,EAAE,MAAc;IACxE,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,OAAO;QAChB,MAAM;QACN,QAAQ,EAAE;YACR,MAAM;YACN,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE;YAC3C,YAAY,EAAE,EAAE;SACjB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,CAAkB,EAClB,MAAc,EACd,QAAqB;IAErB,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;QACxF,OAAO,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,sDAAsD,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC;IAC/E,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,OAAO,CAAC;IACrF,OAAO,YAAY,IAAI,OAAO;QAC5B,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,qCAAqC,UAAU,EAAE,CAAC;QAClF,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/middleware/error-mapper.d.ts

@@ -15,6 +15,11 @@ import type { Context } from 'hono';
  *
  * The requestId embedded in the response body matches
  * `middleware/request-id.ts`, so a caller can correlate.
+ *
+ * A failed database query's message carries its SQL and its parameters
+ * (Drizzle's `Failed query: … params: …`), which can be a person's email or
+ * address: the body says only that a query failed, and the log keeps the
+ * whole error.
  */
 export declare function mapThrownError(cause: Error, c: Context): Response;
 //# sourceMappingURL=error-mapper.d.ts.map

package/dist/middleware/error-mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.d.ts","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAiBjE"}
+{"version":3,"file":"error-mapper.d.ts","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAqBjE"}

package/dist/middleware/error-mapper.js

@@ -17,6 +17,11 @@ import { statusFor, toWireError } from '../errors.js';
  *
  * The requestId embedded in the response body matches
  * `middleware/request-id.ts`, so a caller can correlate.
+ *
+ * A failed database query's message carries its SQL and its parameters
+ * (Drizzle's `Failed query: … params: …`), which can be a person's email or
+ * address: the body says only that a query failed, and the log keeps the
+ * whole error.
  */
 export function mapThrownError(cause, c) {
     if ('getResponse' in cause && typeof cause.getResponse === 'function') {
@@ -28,9 +33,17 @@ export function mapThrownError(cause, c) {
     c.get('log')?.error('unhandled error', { err: cause });
     const body = toWireError({
         code: 'internal-server-error',
-        message: cause.message.length > 0 ? cause.message : 'Unhandled server error',
+        message: isQueryError(cause)
+            ? 'A database query failed.'
+            : cause.message.length > 0
+                ? cause.message
+                : 'Unhandled server error',
     }, requestId);
     c.status(statusFor('internal-server-error'));
     return c.json(body);
 }
+/** Drizzle's wrapper around a failed query, whose message is the SQL and its values. */
+function isQueryError(cause) {
+    return cause.name === 'DrizzleQueryError' || cause.message.startsWith('Failed query: ');
+}
 //# sourceMappingURL=error-mapper.js.map

package/dist/middleware/error-mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-mapper.js","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAKjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY,EAAE,CAAU;IACrD,IAAI,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtE,MAAM,GAAG,GAAI,KAAqC,CAAC,WAAW,EAAE,CAAC;QACjE,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAwB,IAAI,aAAa,CAAC;IAC9E,yEAAyE;IACxE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAwB,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,WAAW,CACtB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;KAC7E,EACD,SAAS,CACV,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"error-mapper.js","sourceRoot":"","sources":["../../src/middleware/error-mapper.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAKjC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,cAAc,CAAC,KAAY,EAAE,CAAU;IACrD,IAAI,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtE,MAAM,GAAG,GAAI,KAAqC,CAAC,WAAW,EAAE,CAAC;QACjE,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAwB,IAAI,aAAa,CAAC;IAC9E,yEAAyE;IACxE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAwB,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,WAAW,CACtB;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,wBAAwB;KAC/B,EACD,SAAS,CACV,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,KAAY;IAChC,OAAO,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAC1F,CAAC"}

package/dist/middleware/idempotency.d.ts

@@ -1,6 +1,7 @@
-import type { MiddlewareHandler } from 'hono';
+import type { Context, MiddlewareHandler } from 'hono';
+import type { AppEnv } from '../types.js';
 /**
- * Idempotency-key store: `(tenantId, route, key) → cached response`,
+ * Idempotency-key store: `(tenantId, caller, route, key) → cached response`,
  * cached for `ttlMs` (default 24h per API-ROUTE-CONVENTIONS.md §3.1).
  *
  * Injected into the middleware so deployments can plug in a durable
@@ -10,15 +11,65 @@ import type { MiddlewareHandler } from 'hono';
  */
 export interface IdempotencyStore {
     get(key: string): Promise<StoredIdempotencyEntry | null>;
+    /** Store an answer. It replaces a hold on the key, never a stored answer: the first stays. */
     set(key: string, entry: StoredIdempotencyEntry): Promise<void>;
+    /**
+     * Hold a key while its request runs (T349), so a repeat sent meanwhile
+     * is answered 409 `idempotency-key-in-flight` instead of running the
+     * operation again. Optional: a store without holds holds nothing, and
+     * such a repeat runs again (the behaviour before 0.1.5).
+     */
+    readonly holds?: IdempotencyHolds;
 }
+/** A store's holds: all three or none. */
+export interface IdempotencyHolds {
+    /** Take the key for `hold.holder`, unless an unexpired hold or a stored answer has it. */
+    hold(key: string, hold: IdempotencyHold): Promise<IdempotencyHoldOutcome>;
+    /** Extend the holder's hold: its request still runs. */
+    renew(key: string, holder: string, expiresAt: number): Promise<void>;
+    /** Drop the holder's hold: its request ended with nothing to replay. */
+    release(key: string, holder: string): Promise<void>;
+}
+export interface IdempotencyHold {
+    /** Who holds it: one id per request. */
+    readonly holder: string;
+    readonly bodyHash: string;
+    readonly expiresAt: number;
+}
+export type IdempotencyHoldOutcome = {
+    readonly kind: 'held';
+} | {
+    readonly kind: 'in-flight';
+    readonly bodyHash: string;
+} | {
+    readonly kind: 'stored';
+    readonly entry: StoredIdempotencyEntry;
+};
 export interface StoredIdempotencyEntry {
     readonly bodyHash: string;
     readonly status: number;
     readonly contentType: string;
+    /** The answer's body; empty when it's `withheld`. */
     readonly bodyText: string;
     readonly expiresAt: number;
+    /**
+     * The answer carried a secret (`withholdFromReplay`), so only that the
+     * request succeeded is kept: a repeat is answered 409
+     * `idempotency-key-replay-withheld`, never the secret. Optional: a store
+     * that doesn't keep it stores the empty body, and a repeat replays that.
+     */
+    readonly withheld?: boolean;
+    /** When the answer was stored (ms since the epoch), for the withheld 409. */
+    readonly storedAt?: number;
 }
+/**
+ * For a route whose answer carries a secret (an API key, a session token,
+ * a signing secret): the Idempotency-Key middleware keeps that the request
+ * succeeded and when, never the answer. A repeat with the same key gets 409
+ * `idempotency-key-replay-withheld` instead of the secret, and instead of
+ * running again (which would make a second one). Call it before answering.
+ */
+export declare function withholdFromReplay(c: Context<AppEnv>): void;
 /** Simple in-memory store with lazy expiry — swap for a DB store in prod. */
 export declare function createInMemoryIdempotencyStore(): IdempotencyStore;
 /**
@@ -36,12 +87,26 @@ export declare function createInMemoryIdempotencyStore(): IdempotencyStore;
  *   nothing, and a failure (5xx) may be transient: neither is stored, so
  *   a retry with the same key after fixing the cause runs again instead
  *   of replaying the old error.
+ * - With a store that holds keys (`store.holds`, T349): the key is held
+ *   while the handler runs (for `holdMs`, renewed every third of it), so
+ *   a repeat sent meanwhile gets 409 `idempotency-key-in-flight` with
+ *   `Retry-After`, or `idempotency-key-body-mismatch` for another body,
+ *   instead of running the operation again. The hold becomes the stored
+ *   answer, or is released when nothing is stored. A crashed request's
+ *   hold lapses within `holdMs`.
+ *
+ * The middleware sits AFTER auth so `tenantId` is available. The cache
+ * key is the tenant, the caller (`user:…`, `service_account:…`, else the
+ * key or session it came with), the route and the key: someone else in
+ * the tenant who sends the same key and body runs the request themselves,
+ * and never gets another caller's answer (T392).
  *
- * The middleware sits AFTER auth so `tenantId` is available; the
- * cache key is namespaced by tenant so callers can't collide across
- * tenants.
+ * A route whose answer carries a secret calls `withholdFromReplay`: its
+ * answer isn't kept, only that it succeeded (status, when). A repeat with
+ * the same key and body gets 409 `idempotency-key-replay-withheld`.
  */
 export declare function idempotencyMiddleware(store: IdempotencyStore, opts?: {
     ttlMs?: number;
+    holdMs?: number;
 }): MiddlewareHandler;
 //# sourceMappingURL=idempotency.d.ts.map

package/dist/middleware/idempotency.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAM9C;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,IAAI,gBAAgB,CAgBjE;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5B,iBAAiB,CA+DnB"}
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAMvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzD,8FAA8F;IAC9F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;CACnC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC1E,wDAAwD;IACxD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,wEAAwE;IACxE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,eAAe;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAE3D;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,IAAI,gBAAgB,CAwCjE;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7C,iBAAiB,CA8FnB"}

package/dist/middleware/idempotency.js

@@ -1,28 +1,71 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { callerRef } from '../caller.js';
 import { statusFor, toWireError } from '../errors.js';
+/**
+ * For a route whose answer carries a secret (an API key, a session token,
+ * a signing secret): the Idempotency-Key middleware keeps that the request
+ * succeeded and when, never the answer. A repeat with the same key gets 409
+ * `idempotency-key-replay-withheld` instead of the secret, and instead of
+ * running again (which would make a second one). Call it before answering.
+ */
+export function withholdFromReplay(c) {
+    c.set('idempotencyWithhold', true);
+}
 /** Simple in-memory store with lazy expiry — swap for a DB store in prod. */
 export function createInMemoryIdempotencyStore() {
     const table = new Map();
+    const held = new Map();
+    const stored = (key) => {
+        const hit = table.get(key);
+        if (hit === undefined)
+            return null;
+        if (hit.expiresAt <= Date.now()) {
+            table.delete(key);
+            return null;
+        }
+        return hit;
+    };
     return {
         async get(key) {
-            const hit = table.get(key);
-            if (hit === undefined)
-                return null;
-            if (hit.expiresAt <= Date.now()) {
-                table.delete(key);
-                return null;
-            }
-            return hit;
+            return stored(key);
         },
         async set(key, entry) {
-            table.set(key, entry);
+            held.delete(key);
+            if (stored(key) === null)
+                table.set(key, entry);
+        },
+        holds: {
+            async hold(key, hold) {
+                const entry = stored(key);
+                if (entry !== null)
+                    return { kind: 'stored', entry };
+                const current = held.get(key);
+                if (current !== undefined && current.expiresAt > Date.now()) {
+                    return { kind: 'in-flight', bodyHash: current.bodyHash };
+                }
+                held.set(key, hold);
+                return { kind: 'held' };
+            },
+            async renew(key, holder, expiresAt) {
+                const current = held.get(key);
+                if (current?.holder === holder)
+                    held.set(key, { ...current, expiresAt });
+            },
+            async release(key, holder) {
+                if (held.get(key)?.holder === holder)
+                    held.delete(key);
+            },
         },
     };
 }
 const MUTATING_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
 const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+/** How long a hold lasts unless renewed; renewed every third of it while the request runs. */
+const DEFAULT_HOLD_MS = 30 * 1000;
+/** What a repeat in flight is told to wait, in seconds. */
+const IN_FLIGHT_RETRY_AFTER_S = 5;
 /**
  * Idempotency-Key middleware per API-ROUTE-CONVENTIONS.md §3.1.
  *
@@ -38,13 +81,27 @@ const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
  *   nothing, and a failure (5xx) may be transient: neither is stored, so
  *   a retry with the same key after fixing the cause runs again instead
  *   of replaying the old error.
+ * - With a store that holds keys (`store.holds`, T349): the key is held
+ *   while the handler runs (for `holdMs`, renewed every third of it), so
+ *   a repeat sent meanwhile gets 409 `idempotency-key-in-flight` with
+ *   `Retry-After`, or `idempotency-key-body-mismatch` for another body,
+ *   instead of running the operation again. The hold becomes the stored
+ *   answer, or is released when nothing is stored. A crashed request's
+ *   hold lapses within `holdMs`.
+ *
+ * The middleware sits AFTER auth so `tenantId` is available. The cache
+ * key is the tenant, the caller (`user:…`, `service_account:…`, else the
+ * key or session it came with), the route and the key: someone else in
+ * the tenant who sends the same key and body runs the request themselves,
+ * and never gets another caller's answer (T392).
  *
- * The middleware sits AFTER auth so `tenantId` is available; the
- * cache key is namespaced by tenant so callers can't collide across
- * tenants.
+ * A route whose answer carries a secret calls `withholdFromReplay`: its
+ * answer isn't kept, only that it succeeded (status, when). A repeat with
+ * the same key and body gets 409 `idempotency-key-replay-withheld`.
  */
 export function idempotencyMiddleware(store, opts = {}) {
     const ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+    const holdMs = opts.holdMs ?? DEFAULT_HOLD_MS;
     return async (c, next) => {
         if (!MUTATING_METHODS.has(c.req.method.toUpperCase())) {
             return next();
@@ -62,43 +119,119 @@ export function idempotencyMiddleware(store, opts = {}) {
             return next();
         }
         const bodyText = await readRawBody(c.req.raw);
-        const bodyHash = hashBody(bodyText);
-        const cacheKey = `${tenantId}|${c.req.method.toUpperCase()}:${c.req.path}|${rawKey}`;
+        const bodyHash = sha256Hex(bodyText);
+        const cacheKey = `${tenantId}|${callerKey(c)}|${c.req.method.toUpperCase()}:${c.req.path}|${rawKey}`;
         const hit = await store.get(cacheKey);
-        if (hit !== null) {
-            if (hit.bodyHash !== bodyHash) {
-                c.status(statusFor('idempotency-key-body-mismatch'));
+        if (hit !== null)
+            return replay(c, hit, bodyHash, requestId, ttlMs);
+        const { holds } = store;
+        const holder = randomUUID();
+        if (holds !== undefined) {
+            const held = await holds.hold(cacheKey, {
+                holder,
+                bodyHash,
+                expiresAt: Date.now() + holdMs,
+            });
+            if (held.kind === 'stored')
+                return replay(c, held.entry, bodyHash, requestId, ttlMs);
+            if (held.kind === 'in-flight') {
+                if (held.bodyHash !== bodyHash)
+                    return bodyMismatch(c, requestId);
+                c.header('Retry-After', String(IN_FLIGHT_RETRY_AFTER_S));
+                c.status(statusFor('idempotency-key-in-flight'));
                 return c.json(toWireError({
-                    code: 'idempotency-key-body-mismatch',
-                    message: 'Idempotency-Key was reused with a different request body. Use a fresh key or the original body.',
+                    code: 'idempotency-key-in-flight',
+                    message: "A request with this Idempotency-Key is still running. Retry after it answers (Retry-After), and you'll get its answer.",
                 }, requestId));
             }
-            return c.body(hit.bodyText, hit.status, {
-                'Content-Type': hit.contentType,
-                'X-Idempotent-Replay': 'true',
-            });
         }
         // Re-attach the buffered body so downstream handlers reading
         // `c.req.json()` see the same bytes.
         if (bodyText.length > 0)
             rebindBody(c, bodyText);
-        await next();
-        const res = c.res;
-        // Only what took effect is replayed; see the doc above.
-        if (res.status >= 400)
-            return;
-        const savedBody = await res.clone().text();
-        const contentType = res.headers.get('Content-Type') ?? 'application/octet-stream';
-        await store.set(cacheKey, {
-            bodyHash,
-            status: res.status,
-            contentType,
-            bodyText: savedBody,
-            expiresAt: Date.now() + ttlMs,
-        });
-        return;
+        const renewal = holds === undefined
+            ? undefined
+            : setInterval(() => {
+                holds.renew(cacheKey, holder, Date.now() + holdMs).catch(() => undefined);
+            }, Math.max(1, Math.floor(holdMs / 3)));
+        renewal?.unref?.();
+        let answered = false;
+        try {
+            await next();
+            const res = c.res;
+            // Only what took effect is replayed; see the doc above.
+            if (res.status >= 400)
+                return;
+            const withheld = c.get('idempotencyWithhold') === true;
+            const savedBody = withheld ? '' : await res.clone().text();
+            const contentType = res.headers.get('Content-Type') ?? 'application/octet-stream';
+            const now = Date.now();
+            await store.set(cacheKey, {
+                bodyHash,
+                status: res.status,
+                contentType,
+                bodyText: savedBody,
+                expiresAt: now + ttlMs,
+                ...(withheld && { withheld: true }),
+                storedAt: now,
+            });
+            answered = true;
+        }
+        finally {
+            if (renewal !== undefined)
+                clearInterval(renewal);
+            // Nothing stored (a refusal, a failure, a throw): let a retry run.
+            if (!answered && holds !== undefined) {
+                await holds.release(cacheKey, holder).catch(() => undefined);
+            }
+        }
     };
 }
+/**
+ * Who the request comes from, for the cache key: the caller's principal
+ * (`user:…`, `service_account:…`; an API key with neither is its own
+ * service account), else the session it came with, else the credential
+ * itself (`token:` and the first 16 hex of its sha256: one bucket per
+ * credential, never a shared one, and nothing a reader could use).
+ */
+function callerKey(c) {
+    const ref = callerRef(c);
+    if (ref !== undefined)
+        return ref;
+    const sessionId = c.get('sessionId');
+    if (sessionId !== undefined)
+        return `session:${sessionId}`;
+    return `token:${sha256Hex(c.req.header('authorization') ?? '').slice(0, 16)}`;
+}
+/**
+ * A stored answer, replayed; or the refusal for the same key with another
+ * body; or, for an answer that carried a secret, what succeeded and when.
+ */
+function replay(c, hit, bodyHash, requestId, ttlMs) {
+    if (hit.bodyHash !== bodyHash)
+        return bodyMismatch(c, requestId);
+    if (hit.withheld === true) {
+        const at = new Date(hit.storedAt ?? hit.expiresAt - ttlMs).toISOString();
+        c.status(statusFor('idempotency-key-replay-withheld'));
+        return c.json(toWireError({
+            code: 'idempotency-key-replay-withheld',
+            message: `The request with this Idempotency-Key succeeded (${hit.status}, at ${at}). Its answer carried a secret, which isn't kept, so it can't be sent again: read what it made (for an API key, \`GET /v1/tokens\`), or make a new one with a fresh key.`,
+            status: hit.status,
+            at,
+        }, requestId));
+    }
+    return c.body(hit.bodyText, hit.status, {
+        'Content-Type': hit.contentType,
+        'X-Idempotent-Replay': 'true',
+    });
+}
+function bodyMismatch(c, requestId) {
+    c.status(statusFor('idempotency-key-body-mismatch'));
+    return c.json(toWireError({
+        code: 'idempotency-key-body-mismatch',
+        message: 'Idempotency-Key was reused with a different request body. Use a fresh key or the original body.',
+    }, requestId));
+}
 async function readRawBody(req) {
     const method = req.method.toUpperCase();
     if (method === 'GET' || method === 'HEAD')
@@ -110,8 +243,8 @@ async function readRawBody(req) {
         return '';
     }
 }
-function hashBody(body) {
-    return createHash('sha256').update(body).digest('hex');
+function sha256Hex(text) {
+    return createHash('sha256').update(text).digest('hex');
 }
 function rebindBody(c, body) {
     const original = c.req.raw;

package/dist/middleware/idempotency.js.map

@@ -1 +1 @@
-{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAwBtD,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAA2B,EAAE;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAyB,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,2DAA2D;YAC3D,wDAAwD;YACxD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,+BAA+B,CAAU,CAAC,CAAC;gBAC9D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,+BAA+B;oBACrC,OAAO,EACL,iGAAiG;iBACpG,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAe,EAAE;gBAC/C,cAAc,EAAE,GAAG,CAAC,WAAW;gBAC/B,qBAAqB,EAAE,MAAM;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,qCAAqC;QACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,wDAAwD;QACxD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAC9B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;QAClF,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YACxB,QAAQ;YACR,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW;YACX,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC9B,CAAC,CAAC;QACH,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,CAA4B,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/middleware/idempotency.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMrD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAiEtD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAkB;IACnD,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAiC,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjB,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,EAAE;YACL,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI;gBAClB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,IAAI;oBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;gBACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC5D,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBACpB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,OAAO,EAAE,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM;gBACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,8FAA8F;AAC9F,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,OAA4C,EAAE;IAE9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9C,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACtD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAyB,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,2DAA2D;YAC3D,wDAAwD;YACxD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,SAAS,CAAC,CAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;QACxH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAEpE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACxB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACtC,MAAM;gBACN,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;aAC/B,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACrF,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAClE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,2BAA2B,CAAU,CAAC,CAAC;gBAC1D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EACL,wHAAwH;iBAC3H,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,qCAAqC;QACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,OAAO,GACX,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CACT,GAAG,EAAE;gBACH,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CACpC,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YAEb,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YAClB,wDAAwD;YACxD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;YAC9B,MAAM,QAAQ,GAAI,CAAqB,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC;YAC5E,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;YAC3D,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;YAClF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACxB,QAAQ;gBACR,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW;gBACX,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE,GAAG,GAAG,KAAK;gBACtB,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACnC,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,mEAAmE;YACnE,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,CAAkB;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,WAAW,SAA8B,EAAE,CAAC;IAChF,OAAO,SAAS,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CACb,CAAU,EACV,GAA2B,EAC3B,QAAgB,EAChB,SAAiB,EACjB,KAAa;IAEb,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;YACE,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,oDAAoD,GAAG,CAAC,MAAM,QAAQ,EAAE,0KAA0K;YAC3P,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,EAAE;SACH,EACD,SAAS,CACV,CACF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAe,EAAE;QAC/C,cAAc,EAAE,GAAG,CAAC,WAAW;QAC/B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,CAAU,EAAE,SAAiB;IACjD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,+BAA+B,CAAU,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EACL,iGAAiG;KACpG,EACD,SAAS,CACV,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,CAA4B,EAAE,IAAY;IAC5D,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QACxC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC"}