@kindgi/api 0.1.4 → 0.1.5

package/dist/routes/tenant-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-access.d.ts","sourceRoot":"","sources":["../../src/routes/tenant-access.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,UAAU,GAAG,SAAS,GACjC,iBAAiB,CAAC,MAAM,CAAC,CAQ3B;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAO/F"}

package/dist/routes/tenant-access.js

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { ref } from '@kindgi/authz';
+/**
+ * Access to a tenant-wide resource (providers, policies, adapters, …):
+ * reading it needs `read` on the tenant, anything else `admin`. The
+ * authorization model gives a tenant no `write`, so a tenant-wide change
+ * is an admin's. Without an authorizer, nothing is checked (as before).
+ */
+export function tenantResourceAccess(authorizer) {
+    return async (c, next) => {
+        if (authorizer === undefined)
+            return next();
+        const reading = c.req.method === 'GET' || c.req.method === 'HEAD';
+        return authorizer.authorize(reading ? 'read' : 'admin', (ctx) => ref('tenant', ctx.get('tenantId')))(c, next);
+    };
+}
+/** Access to a tenant setting every call of which is an admin's (webhook endpoints, compliance). */
+export function tenantAdminAccess(authorizer) {
+    return async (c, next) => {
+        if (authorizer === undefined)
+            return next();
+        return authorizer.authorize('admin', (ctx) => ref('tenant', ctx.get('tenantId')))(c, next);
+    };
+}
+//# sourceMappingURL=tenant-access.js.map

package/dist/routes/tenant-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-access.js","sourceRoot":"","sources":["../../src/routes/tenant-access.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAIjC,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAKpC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkC;IAElC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;QAClE,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC9D,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CACxD,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,UAAkC;IAClE,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC3C,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CACxD,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACb,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAS,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAItE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAwED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC,CA0WvE"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAS,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAItE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAwED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC,CAgXvE"}

package/dist/routes/tenant.js

@@ -56,6 +56,10 @@ export function tenantRouter(options) {
     // token) get 403 rather than the tenant metadata.
     if (authorizer !== undefined) {
         r.use('*', authorizer.authorize('read', (c) => ref('tenant', c.get('tenantId'))));
+        // Changing the config writes the tenant's secrets and env: `admin`
+        // on the tenant (T243 A), as every tenant-wide write.
+        const admin = authorizer.authorize('admin', (c) => ref('tenant', c.get('tenantId')));
+        r.use('/config', async (c, next) => (c.req.method === 'PATCH' ? admin(c, next) : next()));
     }
     // ---------- GET / ----------
     r.get('/', async (c) => {

package/dist/routes/tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgF7C;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,QAAsB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAgD,CAAC;QAC5E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAY,CAAC,GAAY,EAAE;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC;IACtB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,qEAAqE;IACrE,8DAA8D;IAC9D,YAAY;IACZ,OAAO,SAAS,IAAK,GAAe,CAAC;AACvC,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,IAAI,gBAAgB,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACnF,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,iEAAiE;IACjE,oEAAoE;IACpE,iEAAiE;IACjE,kDAAkD;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CACH,GAAG,EACH,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sBAAsB,QAA6B,GAAG;gBAC/D,QAAQ,EAAE,QAA6B;aACxC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,oCAAoC;IACpC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,UAAwC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,OAAO,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,QAAQ,CAAC;QAC7F,MAAM,WAAW,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,CAAC;QACxE,MAAM,OAAO,GAA4B;YACvC,GAAG,CAAC,QAAQ,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,cAAc,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QAEF,IAAI,QAAQ,GAAwB,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,EACpB,EAAgB,EAChB,SAAiB,EAIhB,EAAE;YACH,MAAM,KAAK,GAAG;gBACZ,KAAK;gBACL,OAAO;gBACP,KAAK,EAAE,SAAS;gBAChB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBACjF,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAgB,EAAE,CAAC;aAChE,CAAC;YACF,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAO,UAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACjE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;iBACtE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAO,cAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAuB,EAAE;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC;QAEF,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACpF,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,QAAQ;gBACN,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;oBACtD,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAC3F,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM;YACtE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ,KAAK,IAAI;YAC1B,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAClF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAC1E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAgC,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAgC,CAAC;QACtD,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,mEAAmE;QACnE,6DAA6D;QAC7D,gEAAgE;QAChE,qBAAqB;QACrB,MAAM,YAAY,GAAG,IAAI,KAAK,QAAQ,IAAI,iBAAiB,KAAK,IAAI,CAAC;QAErE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EACL,mFAAmF;iBACtF,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC;gBACvC,KAAK;gBACL,OAAO;gBACP,IAAI,EAAE,GAAG;gBACT,KAAK;gBACL,SAAS;gBACT,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;gBAC1D,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,SAAS;wBAC3B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,iCAAiC;oBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,cAAc,iCAAiC;oBACtF,eAAe,EAAE,OAAO,CAAC,cAAc;iBACxC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;wBACvC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,6EAA6E;aACvF,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC;YACnC,KAAK;YACL,OAAO;YACP,IAAI,EAAE,GAAG;YACT,KAAK;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,4DAA4D;YAC5D,4DAA4D;YAC5D,wCAAwC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE;oBACL,QAAQ,EAAE,QAA6B;oBACvC,IAAI;oBACJ,GAAG;oBACH,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;oBAC3B,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;oBACjC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,eAAe,iCAAiC;gBACvF,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAc,EAAE,QAAkB;IAC3D,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAiB,EAAE,QAAkB;IACjE,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,mEAAmE;QACnE,6DAA6D;QAC7D,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,GAAG,CAAC,cAAc;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/routes/tenant.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAgF7C;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,QAAsB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QACrF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAgD,CAAC;QAC5E,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAY,CAAC,GAAY,EAAE;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC;IACtB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,qEAAqE;IACrE,8DAA8D;IAC9D,YAAY;IACZ,OAAO,SAAS,IAAK,GAAe,CAAC;AACvC,CAAC,CAAC,EAAE,CAAC;AAEL,SAAS,0BAA0B;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,SAAS,IAAI,gBAAgB,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,EAAE,sBAAsB,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACnF,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,iEAAiE;IACjE,oEAAoE;IACpE,iEAAiE;IACjE,kDAAkD;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CACH,GAAG,EACH,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CAAC,CAC3F,CAAC;QACF,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC,CACtD,CAAC;QACF,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,8BAA8B;IAC9B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,sBAAsB,QAA6B,GAAG;gBAC/D,QAAQ,EAAE,QAA6B;aACxC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,oCAAoC;IACpC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,UAAwC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,OAAO,CAAC;QACvB,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,gEAAgE;QAChE,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,QAAQ,CAAC;QAC7F,MAAM,WAAW,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,CAAC;QACxE,MAAM,OAAO,GAA4B;YACvC,GAAG,CAAC,QAAQ,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,KAAK,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,IAAI,cAAc,KAAK,SAAS,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QAEF,IAAI,QAAQ,GAAwB,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,OAAO,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,EACpB,EAAgB,EAChB,SAAiB,EAIhB,EAAE;YACH,MAAM,KAAK,GAAG;gBACZ,KAAK;gBACL,OAAO;gBACP,KAAK,EAAE,SAAS;gBAChB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBACjF,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAgB,EAAE,CAAC;aAChE,CAAC;YACF,IAAI,EAAE,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAO,UAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACjE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;iBACtE,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAO,cAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAuB,EAAE;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC;QAEF,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YACpF,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,QAAQ;gBACN,IAAI,CAAC,UAAU,KAAK,SAAS;oBAC3B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE;oBACtD,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,kEAAkE;QAClE,mEAAmE;QACnE,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAC3F,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM;YACtE,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ,KAAK,IAAI;YAC1B,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kDAAkD,EAAE,EAClF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAC1E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4CAA4C,EAAE,EAC5E,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,iBAAiB,GAAG,CAAC,CAAC,SAAgC,CAAC;QAC7D,MAAM,UAAU,GAAG,CAAC,CAAC,UAAgC,CAAC;QACtD,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAElD,mEAAmE;QACnE,6DAA6D;QAC7D,gEAAgE;QAChE,qBAAqB;QACrB,MAAM,YAAY,GAAG,IAAI,KAAK,QAAQ,IAAI,iBAAiB,KAAK,IAAI,CAAC;QAErE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EACL,mFAAmF;iBACtF,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC;gBACvC,KAAK;gBACL,OAAO;gBACP,IAAI,EAAE,GAAG;gBACT,KAAK;gBACL,SAAS;gBACT,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;gBAC1D,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,SAAS;wBAC3B,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;gBAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,iCAAiC;oBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,cAAc,iCAAiC;oBACtF,eAAe,EAAE,OAAO,CAAC,cAAc;iBACxC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE;wBACL,QAAQ,EAAE,QAA6B;wBACvC,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,KAAK,EAAE,YAAY;wBACnB,SAAS,EAAE,IAAI;wBACf,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc;wBACvC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,6EAA6E;aACvF,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC;YACnC,KAAK;YACL,OAAO;YACP,IAAI,EAAE,GAAG;YACT,KAAK;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,4DAA4D;YAC5D,4DAA4D;YAC5D,wCAAwC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE;oBACL,QAAQ,EAAE,QAA6B;oBACvC,IAAI;oBACJ,GAAG;oBACH,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;oBAC3B,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;oBACjC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;iBACpC;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,iCAAiC,CAAU,CAAC,CAAC;YAChE,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,sBAAsB,OAAO,CAAC,eAAe,iCAAiC;gBACvF,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU;IACpC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAc,EAAE,QAAkB;IAC3D,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAiB,EAAE,QAAkB;IACjE,OAAO;QACL,QAAQ;QACR,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,GAAG,CAAC,IAAI;QACb,mEAAmE;QACnE,6DAA6D;QAC7D,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,GAAG,CAAC,cAAc;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC"}

package/dist/routes/token-sign-in.d.ts

@@ -0,0 +1,36 @@
+import { Hono } from 'hono';
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { SessionStoreBinding } from '../session-store-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * `POST /v1/auth/token-sign-in`: a person signs in to the console with an
+ * API token. The token comes once, in `Authorization`, and is exchanged for
+ * a browser session in the session cookie (HttpOnly, the same as a sign-in
+ * with an identity provider), so the browser never keeps it.
+ *
+ * Only a person's **full** key opens a session. A service account's key is
+ * for machines, and a narrowed key (a `member` role, or one project) would
+ * be widened to the person's full grants by a session: both are refused,
+ * 403 `token-sign-in-not-allowed`. The session acts as the key did: it
+ * carries the key's scopes (a deployment without an authorizer reads tenant
+ * admin from them; a key's scopes never change after it's minted). It never
+ * outlives the key: it ends when the key expires, and, with a store that has
+ * `revokeByProvider`, when the key is revoked (its `providerId` is
+ * `api-token:<tokenId>`).
+ * Refusals are audited (`sign-in-refused`), as is each sign-in.
+ */
+export type TokenSignInRouteOptions = 
+/** The deployment doesn't allow it, or has no browser sessions: 403 `token-sign-in-off`. */
+{
+    readonly enabled: false;
+} | {
+    readonly enabled: true;
+    readonly sessionStore: SessionStoreBinding;
+    /** The session's lifetime, in milliseconds. */
+    readonly ttlMs: number;
+    readonly cookieName: string;
+    /** `signed-in` events, best effort. */
+    readonly auditEvents?: AuditEventBinding;
+};
+export declare function tokenSignInRouter(options: TokenSignInRouteOptions): Hono<AppEnv>;
+//# sourceMappingURL=token-sign-in.d.ts.map

package/dist/routes/token-sign-in.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-sign-in.d.ts","sourceRoot":"","sources":["../../src/routes/token-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAM1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,uBAAuB;AACjC,4FAA4F;AAC1F;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;CAC1C,CAAC;AAEN,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,CAiHhF"}

package/dist/routes/token-sign-in.js

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { randomUUID } from 'node:crypto';
+import { Hono } from 'hono';
+import { setCookie } from 'hono/cookie';
+import { statusFor, toWireError } from '../errors.js';
+import { encodeSessionToken } from '../middleware/auth.js';
+import { withholdFromReplay } from '../middleware/idempotency.js';
+export function tokenSignInRouter(options) {
+    const r = new Hono();
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        /** An audit event, best effort: a failure is logged, never the answer. */
+        const auditEvents = options.enabled ? options.auditEvents : undefined;
+        const audit = async (event) => {
+            if (auditEvents === undefined)
+                return;
+            try {
+                const appended = await auditEvents.append([
+                    { ...event, id: randomUUID(), timestamp: new Date().toISOString() },
+                ]);
+                if (appended.kind === 'err') {
+                    c.get('log').warn(`${event.kind} audit event failed: ${appended.error.message}`);
+                }
+            }
+            catch (cause) {
+                c.get('log').warn(`${event.kind} audit event failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+            }
+        };
+        const refuse = async (code, message) => {
+            const userId = c.get('userId');
+            const serviceAccountId = c.get('serviceAccountId');
+            await audit({
+                tenantId: c.get('tenantId'),
+                kind: 'sign-in-refused',
+                actor: serviceAccountId !== undefined
+                    ? `service_account:${serviceAccountId}`
+                    : userId !== undefined
+                        ? `user:${userId}`
+                        : 'system',
+                outcome: 'denied',
+                payload: { v: 1, doc: { method: 'api-token', reason: code } },
+            });
+            c.status(statusFor(code));
+            return c.json(toWireError({ code, message }, requestId));
+        };
+        if (!options.enabled) {
+            return refuse('token-sign-in-off', "This deployment doesn't allow signing in to the console with an API token. Sign in with your organization's identity provider, or ask whoever runs Kindgi to allow it.");
+        }
+        if (c.get('sessionId') !== undefined) {
+            return refuse('token-sign-in-needs-an-api-token', 'You are already signed in with a session: token sign-in takes an API token in the Authorization header.');
+        }
+        const tenantId = c.get('tenantId');
+        const userId = c.get('userId');
+        if (c.get('serviceAccountId') !== undefined || userId === undefined) {
+            return refuse('token-sign-in-not-allowed', "Only a person's API key can open a console session; a service account's key is for machines.");
+        }
+        if (c.get('tokenRole') === 'member' || c.get('tokenProjectId') !== undefined) {
+            return refuse('token-sign-in-not-allowed', "A narrowed key (a member role, or one project) can't open a console session: the session would carry all of your permissions. Use a full key, or sign in with your identity provider.");
+        }
+        const keyExpiresAt = c.get('tokenExpiresAt');
+        const expires = Math.min(Date.now() + options.ttlMs, keyExpiresAt === undefined ? Number.POSITIVE_INFINITY : keyExpiresAt.getTime());
+        const tokenId = c.get('tokenId');
+        const created = await options.sessionStore.create({
+            tenantId,
+            userId,
+            providerId: tokenId === undefined ? 'api-token' : `api-token:${tokenId}`,
+            expiresAt: new Date(expires).toISOString(),
+            // What the key may do, so the session acts as it did: with authz off,
+            // an admin key's `tenant-admin` is how the server and console know.
+            scopes: [...(c.get('scopes') ?? [])],
+        });
+        setCookie(c, options.cookieName, created.token ?? encodeSessionToken(created.sessionId), {
+            httpOnly: true,
+            secure: true,
+            sameSite: 'Lax',
+            path: '/',
+            maxAge: Math.max(0, Math.floor((expires - Date.now()) / 1000)),
+        });
+        await audit({
+            tenantId,
+            kind: 'signed-in',
+            actor: `user:${userId}`,
+            outcome: 'succeeded',
+            payload: {
+                v: 1,
+                doc: {
+                    method: 'api-token',
+                    sessionId: created.sessionId,
+                    ...(tokenId !== undefined && { tokenId }),
+                },
+            },
+        });
+        // The session is in the cookie, which a stored answer doesn't keep: a
+        // repeat with the same Idempotency-Key is refused, not "signed in".
+        withholdFromReplay(c);
+        return c.json({ userId, expiresAt: new Date(expires).toISOString() });
+    });
+    return r;
+}
+//# sourceMappingURL=token-sign-in.js.map

package/dist/routes/token-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-sign-in.js","sourceRoot":"","sources":["../../src/routes/token-sign-in.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAKxC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAkClE,MAAM,UAAU,iBAAiB,CAAC,OAAgC;IAChE,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,0EAA0E;QAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,KAAK,GAAG,KAAK,EAAE,KAA2C,EAAE,EAAE;YAClE,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;oBACxC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe,EAAE;iBACjF,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC5B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,wBAAwB,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CACf,GAAG,KAAK,CAAC,IAAI,wBAAwB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE;YACrD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC;gBACV,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;gBAC3B,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EACH,gBAAgB,KAAK,SAAS;oBAC5B,CAAC,CAAC,mBAAmB,gBAAgB,EAAE;oBACvC,CAAC,CAAC,MAAM,KAAK,SAAS;wBACpB,CAAC,CAAC,QAAQ,MAAM,EAAE;wBAClB,CAAC,CAAC,QAAQ;gBAChB,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;aAC9D,CAAC,CAAC;YACH,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAU,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,MAAM,CACX,mBAAmB,EACnB,wKAAwK,CACzK,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,MAAM,CACX,kCAAkC,EAClC,yGAAyG,CAC1G,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO,MAAM,CACX,2BAA2B,EAC3B,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7E,OAAO,MAAM,CACX,2BAA2B,EAC3B,uLAAuL,CACxL,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAC1B,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAC/E,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC;YAChD,QAAQ;YACR,MAAM;YACN,UAAU,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE;YACxE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAe;YACvD,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;SACrC,CAAC,CAAC;QACH,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;YACvF,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;SAC/D,CAAC,CAAC;QAEH,MAAM,KAAK,CAAC;YACV,QAAQ;YACR,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,QAAQ,MAAM,EAAE;YACvB,OAAO,EAAE,WAAW;YACpB,OAAO,EAAE;gBACP,CAAC,EAAE,CAAC;gBACJ,GAAG,EAAE;oBACH,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;iBAC1C;aACF;SACF,CAAC,CAAC;QAEH,sEAAsE;QACtE,oEAAoE;QACpE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/routes/tokens.d.ts

@@ -3,12 +3,22 @@ import type { Authorizer } from '../middleware/authorize.js';
 import { type TokenAdmin } from '../token-admin.js';
 import type { AppEnv } from '../types.js';
 /**
- * API keys: mint, list, read, revoke. Every route is tenant-admin only:
- * `admin` on the tenant when authorization is on, otherwise the
- * `tenant-admin` scope on the caller's token.
+ * API keys: mint, list, read, revoke. A key acts for one principal (a
+ * person or a service account) with that principal's grants; its role is
+ * a ceiling under them and its project a narrowing.
  *
- * A caller can only give a new key what it holds itself: every
- * capability it grants must be one of its own.
+ * - **Your own keys:** a person, or a service account's key, may mint,
+ *   list, read and revoke the keys that act for them.
+ * - **Someone else's:** only a tenant admin (`admin` on the tenant when
+ *   authorization is on, otherwise the `tenant-admin` scope) mints keys
+ *   for another principal, and sees and revokes every key. A tenant admin
+ *   whose token names no principal mints, as before principals, keys
+ *   that are their own service account.
+ * - **What a new key may hold:** an `admin` key needs a tenant admin
+ *   minting it (and, for someone else, a principal that is one: the store
+ *   refuses `role-exceeds-principal`). Every capability granted must be
+ *   one the minter holds. A minter narrowed to a project mints only keys
+ *   narrowed to the same project.
  */
 export declare function tokensRouter(admin: TokenAdmin, authorizer?: Authorizer): Hono<AppEnv>;
 //# sourceMappingURL=tokens.d.ts.map

package/dist/routes/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA8FrF"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/routes/tokens.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAIL,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA4GrF"}

package/dist/routes/tokens.js

@@ -1,21 +1,32 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright (C) 2026 Kindgi Inc.
 import { Hono } from 'hono';
-import { ref } from '@kindgi/authz';
+import { callerPrincipal, callerRef, isTenantAdmin, principalToWire } from '../caller.js';
 import { statusFor, toWireError } from '../errors.js';
+import { withholdFromReplay } from '../middleware/idempotency.js';
 import { API_TOKEN_ROLES, } from '../token-admin.js';
 import { clampLimit, decodeCursor, encodeCursor } from './pagination.js';
 /**
- * API keys: mint, list, read, revoke. Every route is tenant-admin only:
- * `admin` on the tenant when authorization is on, otherwise the
- * `tenant-admin` scope on the caller's token.
+ * API keys: mint, list, read, revoke. A key acts for one principal (a
+ * person or a service account) with that principal's grants; its role is
+ * a ceiling under them and its project a narrowing.
  *
- * A caller can only give a new key what it holds itself: every
- * capability it grants must be one of its own.
+ * - **Your own keys:** a person, or a service account's key, may mint,
+ *   list, read and revoke the keys that act for them.
+ * - **Someone else's:** only a tenant admin (`admin` on the tenant when
+ *   authorization is on, otherwise the `tenant-admin` scope) mints keys
+ *   for another principal, and sees and revokes every key. A tenant admin
+ *   whose token names no principal mints, as before principals, keys
+ *   that are their own service account.
+ * - **What a new key may hold:** an `admin` key needs a tenant admin
+ *   minting it (and, for someone else, a principal that is one: the store
+ *   refuses `role-exceeds-principal`). Every capability granted must be
+ *   one the minter holds. A minter narrowed to a project mints only keys
+ *   narrowed to the same project.
  */
 export function tokensRouter(admin, authorizer) {
     const r = new Hono();
-    r.use('/*', requireTenantAdmin(authorizer));
+    r.use('/*', requireOwnerOrAdmin(authorizer));
     // ---------- POST / (mint) ----------
     r.post('/', async (c) => {
         const requestId = c.get('requestId');
@@ -26,17 +37,15 @@ export function tokensRouter(admin, authorizer) {
         const parsed = parseMintBody(body.value);
         if (parsed.kind === 'err')
             return fail(c, parsed.error, requestId);
-        const held = new Set(c.get('capabilities') ?? []);
-        const notHeld = parsed.value.capabilities.filter((cap) => !held.has(cap));
-        if (notHeld.length > 0) {
-            return fail(c, {
-                code: 'permission-denied',
-                message: `A key can only be given capabilities its minter holds; you don't hold: ${notHeld.join(', ')}`,
-            }, requestId);
-        }
+        const owner = keyOwner(c);
+        const principal = parsed.value.for ?? owner;
+        const refused = await mintRefusal(c, authorizer, owner, principal, parsed.value);
+        if (refused !== undefined)
+            return fail(c, refused, requestId);
         const createdBy = callerRef(c);
         const minted = await admin.mint({
             tenantId,
+            ...(principal !== undefined && { principal }),
             role: parsed.value.role,
             capabilities: parsed.value.capabilities,
             ...(parsed.value.label !== undefined && { label: parsed.value.label }),
@@ -44,6 +53,11 @@ export function tokensRouter(admin, authorizer) {
             ...(parsed.value.projectId !== undefined && { projectId: parsed.value.projectId }),
             ...(createdBy !== undefined && { createdBy }),
         });
+        if (!('token' in minted)) {
+            return fail(c, { code: minted.kind, message: minted.message }, requestId);
+        }
+        // The key's secret is shown once: an Idempotency-Key repeat doesn't get it.
+        withholdFromReplay(c);
         c.status(201);
         return c.json({ ...toWire(minted.record), token: minted.token });
     });
@@ -61,7 +75,17 @@ export function tokensRouter(admin, authorizer) {
             }
             after = { createdAt: new Date(decoded.createdAt), tokenId: decoded.id };
         }
-        const records = await admin.list({ tenantId, limit: limit + 1, ...(after && { after }) });
+        const filter = parsePrincipalQuery(c.req.query('principal'));
+        if (filter.kind === 'err')
+            return fail(c, filter.error, requestId);
+        // An admin sees every key (or one principal's); anyone else, their own.
+        const principal = (await isTenantAdmin(c, authorizer)) ? filter.value : keyOwner(c);
+        const records = await admin.list({
+            tenantId,
+            limit: limit + 1,
+            ...(principal !== undefined && { principal }),
+            ...(after && { after }),
+        });
         const hasMore = records.length > limit;
         const page = hasMore ? records.slice(0, limit) : records;
         const last = page[page.length - 1];
@@ -80,9 +104,8 @@ export function tokensRouter(admin, authorizer) {
     // ---------- GET /:tokenId ----------
     r.get('/:tokenId', async (c) => {
         const requestId = c.get('requestId');
-        const tenantId = c.get('tenantId');
         const tokenId = c.req.param('tokenId');
-        const record = await admin.get({ tenantId, tokenId });
+        const record = await visibleKey(c, admin, authorizer, tokenId);
         if (record === undefined)
             return notFound(c, tokenId, requestId);
         return c.json(toWire(record));
@@ -92,42 +115,95 @@ export function tokensRouter(admin, authorizer) {
         const requestId = c.get('requestId');
         const tenantId = c.get('tenantId');
         const tokenId = c.req.param('tokenId');
-        const outcome = await admin.revoke({ tenantId, tokenId });
+        // Someone else's key reads as missing, as it does for `get`.
+        if ((await visibleKey(c, admin, authorizer, tokenId)) === undefined) {
+            return notFound(c, tokenId, requestId);
+        }
+        const revokedBy = callerRef(c);
+        const outcome = await admin.revoke({
+            tenantId,
+            tokenId,
+            ...(revokedBy !== undefined && { revokedBy }),
+        });
         if (outcome.kind === 'not-found')
             return notFound(c, tokenId, requestId);
         return c.json({ tokenId: tokenId, revoked: true });
     });
     return r;
 }
-function requireTenantAdmin(authorizer) {
-    if (authorizer !== undefined) {
-        return async (c, next) => {
-            const tenantId = c.get('tenantId');
-            const mw = authorizer.authorize('admin', async () => ref('tenant', tenantId));
-            return mw(c, next);
-        };
-    }
+/** A caller with keys of their own, or a tenant admin. */
+function requireOwnerOrAdmin(authorizer) {
     return async (c, next) => {
-        if (!(c.get('scopes') ?? []).includes('tenant-admin')) {
+        if (keyOwner(c) === undefined && !(await isTenantAdmin(c, authorizer))) {
             return fail(c, { code: 'permission-denied', message: 'Managing API keys needs a tenant admin' }, c.get('requestId'));
         }
         await next();
         return;
     };
 }
-/** The caller as a principal reference: `user:<id>` or `service_account:<tokenId>`. */
-function callerRef(c) {
-    const userId = c.get('userId');
-    if (userId !== undefined)
-        return `user:${userId}`;
-    const tokenId = c.get('tokenId');
-    if (tokenId !== undefined)
-        return `service_account:${tokenId}`;
+/**
+ * Whom the caller's own keys act for: the person, or the service account
+ * the caller's key acts for. A token naming neither (a key from before
+ * principals, a static token) has no keys of its own.
+ */
+function keyOwner(c) {
+    const caller = callerPrincipal(c);
+    if (caller?.kind === 'service-account' && c.get('serviceAccountId') === undefined) {
+        return undefined;
+    }
+    return caller;
+}
+function samePrincipal(a, b) {
+    if (b === undefined)
+        return false;
+    if (a.kind === 'user')
+        return b.kind === 'user' && b.userId === a.userId;
+    return b.kind === 'service-account' && b.serviceAccountId === a.serviceAccountId;
+}
+/** Why the route refuses this mint before the store sees it, if it does. */
+async function mintRefusal(c, authorizer, owner, principal, body) {
+    const forSomeoneElse = principal !== undefined && !samePrincipal(principal, owner);
+    if ((forSomeoneElse || body.role === 'admin') && !(await isTenantAdmin(c, authorizer))) {
+        return {
+            code: 'permission-denied',
+            message: forSomeoneElse
+                ? 'Only a tenant admin mints keys for someone else'
+                : 'Only a tenant admin mints an admin key',
+        };
+    }
+    const held = new Set(c.get('capabilities') ?? []);
+    const notHeld = body.capabilities.filter((cap) => !held.has(cap));
+    if (notHeld.length > 0) {
+        return {
+            code: 'permission-denied',
+            message: `A key can only be given capabilities its minter holds; you don't hold: ${notHeld.join(', ')}`,
+        };
+    }
+    const narrowedTo = c.get('tokenProjectId');
+    if (narrowedTo !== undefined && body.projectId !== narrowedTo) {
+        return {
+            code: 'key-project-mismatch',
+            message: `Your key is limited to project ${narrowedTo}: a key it mints must be limited to it too`,
+        };
+    }
     return undefined;
 }
+/** A key the caller may see: any, for a tenant admin; otherwise only their own. */
+async function visibleKey(c, admin, authorizer, tokenId) {
+    const tenantId = c.get('tenantId');
+    const record = await admin.get({ tenantId, tokenId });
+    if (record === undefined)
+        return undefined;
+    if (await isTenantAdmin(c, authorizer))
+        return record;
+    return record.principal !== undefined && samePrincipal(record.principal, keyOwner(c))
+        ? record
+        : undefined;
+}
 function toWire(record) {
     return {
         tokenId: record.tokenId,
+        ...(record.principal !== undefined && { principal: principalToWire(record.principal) }),
         role: record.role,
         capabilities: record.capabilities,
         ...(record.label !== undefined && { label: record.label }),
@@ -181,19 +257,24 @@ function parseMintBody(body) {
     const capabilities = parseCapabilities(b.capabilities);
     if (capabilities.kind === 'err')
         return capabilities;
-    const out = { role: role.value, capabilities: capabilities.value };
+    const principal = parseFor(b.for);
+    if (principal.kind === 'err')
+        return principal;
+    const out = {
+        ...(principal.value !== undefined && { for: principal.value }),
+        role: role.value,
+        capabilities: capabilities.value,
+    };
     if (b.label !== undefined) {
         if (typeof b.label !== 'string')
             return badInput('`label` must be a string');
         out.label = b.label;
     }
     if (b.expiresAt !== undefined) {
-        if (typeof b.expiresAt !== 'string')
-            return badInput('`expiresAt` must be an ISO date string');
-        const parsed = new Date(b.expiresAt);
-        if (Number.isNaN(parsed.getTime()))
-            return badInput('`expiresAt` is not a valid ISO date');
-        out.expiresAt = parsed;
+        const expiresAt = parseExpiresAt(b.expiresAt);
+        if (expiresAt.kind === 'err')
+            return expiresAt;
+        out.expiresAt = expiresAt.value;
     }
     if (b.projectId !== undefined) {
         if (typeof b.projectId !== 'string') {
@@ -203,6 +284,15 @@ function parseMintBody(body) {
     }
     return { kind: 'ok', value: out };
 }
+/** `expiresAt`: an ISO date string. */
+function parseExpiresAt(raw) {
+    if (typeof raw !== 'string')
+        return badInput('`expiresAt` must be an ISO date string');
+    const parsed = new Date(raw);
+    if (Number.isNaN(parsed.getTime()))
+        return badInput('`expiresAt` is not a valid ISO date');
+    return { kind: 'ok', value: parsed };
+}
 /** `role`: `admin` | `member`; `member` when absent (least privilege). */
 function parseRole(raw) {
     if (raw === undefined)
@@ -228,4 +318,33 @@ function parseCapabilities(raw) {
     }
     return { kind: 'ok', value: out };
 }
+/** `for`, when present: whom the key acts for. */
+function parseFor(raw) {
+    return raw === undefined ? { kind: 'ok', value: undefined } : parsePrincipalBody(raw);
+}
+/** `for`: `{kind: 'user' | 'service-account', id}`. */
+function parsePrincipalBody(raw) {
+    const b = (raw ?? {});
+    if (typeof b.id !== 'string' || b.id.length === 0) {
+        return badInput('`for.id` must be the id of a person or a service account');
+    }
+    if (b.kind === 'user')
+        return { kind: 'ok', value: { kind: 'user', userId: b.id } };
+    if (b.kind === 'service-account') {
+        return { kind: 'ok', value: { kind: 'service-account', serviceAccountId: b.id } };
+    }
+    return badInput("`for.kind` must be 'user' or 'service-account'");
+}
+/** `?principal=user:<id>` or `?principal=service-account:<id>`: one principal's keys (admins). */
+function parsePrincipalQuery(raw) {
+    if (raw === undefined || raw === '')
+        return { kind: 'ok', value: undefined };
+    const colon = raw.indexOf(':');
+    const kind = raw.slice(0, colon);
+    const id = raw.slice(colon + 1);
+    if (colon <= 0 || id === '') {
+        return badInput('`principal` is `user:<id>` or `service-account:<id>`');
+    }
+    return parsePrincipalBody({ kind, id });
+}
 //# sourceMappingURL=tokens.js.map