@lovrozagar/oat 0.4.0 → 0.6.0

package/dist/runtime/auth.js

@@ -8,6 +8,16 @@
  */
 import { requestContent } from "../spec/collection.js";
 import { encodeRequest } from "./body.js";
+export const DEFAULT_REFRESH_BUFFER_MS = 30_000;
+/** Signup acquire without `auth.refresh` — re-running `steps` would register again. */
+export class AuthRefreshRequiredError extends Error {
+    code = "AUTH_REFRESH_REQUIRED";
+    constructor(principalId) {
+        super(`oat: principal "${principalId}" cannot refresh — its acquire steps register a new account, ` +
+            "and re-running them is not a refresh. Declare auth.refresh with the refresh-token operation.");
+        this.name = "AuthRefreshRequiredError";
+    }
+}
 export function readPath(body, path) {
     let node = body;
     for (const segment of path
@@ -60,11 +70,11 @@ export function jwtExpiryMs(credential) {
     const claims = jwtClaims(credential);
     return typeof claims?.exp === "number" ? claims.exp * 1000 : null;
 }
-/** Runs the chain once, returning the credential and everything bound along the way. */
-export async function runAcquireChain(spec, context) {
-    const scope = {};
+/** Runs an auth step list against an existing scope, returning the credential and bindings. */
+export async function runAuthSteps(steps, spec, context, initialScope = {}) {
+    const scope = { ...initialScope };
     let last;
-    for (const [index, step] of spec.steps.entries()) {
+    for (const [index, step] of steps.entries()) {
         const stepBind = "bind" in step ? step.bind : undefined;
         for (const [name, literal] of Object.entries(stepBind ?? {})) {
             scope[name] = String(interpolate(literal, scope));
@@ -81,6 +91,8 @@ export async function runAcquireChain(spec, context) {
             ...(request.contentType === undefined ? {} : { contentType: request.contentType }),
             ...(request.headers === undefined ? {} : { headers: request.headers }),
             ...(request.query === undefined ? {} : { query: request.query }),
+            /* Auth hops must not trigger refresh / 401-retry — that is how a refresh deadlocks. */
+            skipAuthRefresh: true,
         });
         const acceptable = ("expect" in step ? step.expect : undefined) ?? [];
         const ok = acceptable.length > 0 ? acceptable.includes(last.status) : last.status < 300;
@@ -124,6 +136,39 @@ export async function runAcquireChain(spec, context) {
     }
     return { credential, expiresAt: computeExpiry(spec, last, credential), scope };
 }
+/** Runs the acquire chain once, returning the credential and everything bound along the way. */
+export async function runAcquireChain(spec, context) {
+    return runAuthSteps(spec.steps, spec, context);
+}
+const REGISTER_LIKE = /register|sign[-_]?up/i;
+function stepLooksLikeRegister(step, model) {
+    if ("outOfBand" in step)
+        return false;
+    if (isOperationStep(step)) {
+        if (REGISTER_LIKE.test(step.operationId))
+            return true;
+        const op = model.byOperationId.get(step.operationId);
+        if (op === undefined)
+            return false;
+        return op.freshPrincipal || REGISTER_LIKE.test(op.path);
+    }
+    if (isRequestStep(step))
+        return REGISTER_LIKE.test(step.path);
+    return false;
+}
+/** First HTTP hop looks like signup — re-running `steps` would 409, not refresh. */
+export function acquireLooksLikeRegister(spec, model) {
+    const firstHttp = spec.steps.find((step) => !("outOfBand" in step));
+    return firstHttp !== undefined && stepLooksLikeRegister(firstHttp, model);
+}
+function headerOf(headers, name) {
+    const want = name.toLowerCase();
+    for (const [key, value] of Object.entries(headers)) {
+        if (key.toLowerCase() === want)
+            return value;
+    }
+    return undefined;
+}
 function computeExpiry(spec, last, credential) {
     /* Prefer what the API states, then what the credential itself carries, then the configured
      * fallback. Guessing an expiry that is too long means requests start failing mid-run for
@@ -223,37 +268,76 @@ async function resolveOutOfBand(context, address, kind) {
 /** Wraps a chain in a credential that refreshes itself before it expires. */
 export async function createPrincipal(id, spec, context) {
     let credential = "";
-    let expiresAt = null;
     let scope = {};
-    const acquire = async () => {
-        const result = await runAcquireChain(spec, { ...context, principalId: id });
-        credential = result.credential;
-        expiresAt = result.expiresAt;
-        scope = result.scope;
-    };
-    await acquire();
+    const issued = new Set();
     const header = spec.header ?? "authorization";
     const template = spec.template ?? "Bearer {credential}";
+    const bufferMs = spec.refreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS;
+    const ctx = { ...context, principalId: id };
+    const authValue = (token) => template.replace("{credential}", token);
     const runtime = {
-        /* Whatever the flow bound as an address is what teardown will cascade on. */
-        address: scope.address ?? scope.email ?? null,
-        expiresAt,
-        headers: () => ({ [header]: template.replace("{credential}", credential) }),
+        address: null,
+        expiresAt: null,
+        headers: () => ({ [header]: authValue(credential) }),
         id,
-        reacquire: acquire,
-        /* Refresh at three quarters of the lifetime, before dispatch rather than mid-flight, so a
-         * run stays reproducible and no request is ever retried for timing reasons alone. */
-        refreshIfStale: async () => {
-            if (expiresAt === null)
-                return;
-            const issuedWindow = expiresAt - Date.now();
-            if (issuedWindow > 0 && issuedWindow < 0.25 * (spec.assumeTtlMs ?? 300_000))
-                await acquire();
-            else if (issuedWindow <= 0)
-                await acquire();
+        matches: (headers) => {
+            const sent = headerOf(headers, header);
+            return sent !== undefined && issued.has(sent);
         },
+        reacquire: async () => undefined,
+        refreshIfStale: async () => undefined,
         scope,
     };
+    const apply = (result) => {
+        credential = result.credential;
+        scope = result.scope;
+        runtime.expiresAt = result.expiresAt;
+        runtime.scope = result.scope;
+        runtime.address = result.scope.address ?? result.scope.email ?? runtime.address;
+        issued.add(authValue(credential));
+    };
+    apply(await runAuthSteps(spec.steps, spec, ctx));
+    let inflight = null;
+    let refreshing = false;
+    const doRefresh = async () => {
+        refreshing = true;
+        try {
+            if (spec.refresh !== undefined) {
+                apply(await runAuthSteps(spec.refresh.steps, spec, ctx, scope));
+                return;
+            }
+            if (acquireLooksLikeRegister(spec, ctx.model)) {
+                throw new AuthRefreshRequiredError(id);
+            }
+            apply(await runAuthSteps(spec.steps, spec, ctx));
+        }
+        finally {
+            refreshing = false;
+        }
+    };
+    runtime.refreshIfStale = async (force = false) => {
+        /* Re-entrant from an in-flight refresh hop: do not start a second refresh. */
+        if (refreshing)
+            return;
+        if (!force) {
+            /* Static-header / unknown expiry: never proactive. 401 still passes force=true. */
+            if (runtime.expiresAt === null)
+                return;
+            if (runtime.expiresAt - Date.now() > bufferMs)
+                return;
+        }
+        if (inflight !== null)
+            return inflight;
+        const pending = doRefresh().finally(() => {
+            if (inflight === pending)
+                inflight = null;
+        });
+        inflight = pending;
+        return pending;
+    };
+    runtime.reacquire = async () => {
+        apply(await runAuthSteps(spec.steps, spec, ctx));
+    };
     return runtime;
 }
 //# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAoBzC,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAY;IACnD,IAAI,IAAI,GAAY,IAAI,CAAA;IACxB,KAAK,MAAM,OAAO,IAAI,IAAI;SACxB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC1C,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACd,CAAC,CAAE,IAAgC,CAAC,OAAO,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,KAAc,EAAE,KAA6B;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC7D,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IAClG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAClE,CAAC;AASD,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAiB,EACjB,OAAuB;IAEvB,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,IAAI,IAA0B,CAAA;IAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,KAAK,CAAA;YAChC,SAAQ;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QACjE,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE;YACjE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACrE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;QACvF,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,yBAAyB,KAAK,GAAG,CAAC,GAAG;gBAC1E,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,cAAc;gBAChD,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK;gBAChF,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACrD,CAAA;QACF,CAAC;QAED,MAAM,cAAc,GAAG,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;QACjF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,SAAS,OAAO,CAAC,WAAW,sBAAsB;oBAC5E,GAAG,cAAc,CAAC,KAAK,qCAAqC,CAC7D,CAAA;YACF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,UAAU,IAAI,cAAc,SAAS,qBAAqB;wBACpF,qCAAqC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;gBACF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;YAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,SAAS,OAAO,CAAC,WAAW,qBAAqB,IAAI,KAAK;oBACpF,IAAI,IAAI,yCAAyC,CAClD,CAAA;YACF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAA;IACtG,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,6BAA6B,IAAI,CAAC,cAAc,GAAG;YACxF,4BAA4B,CAC7B,CAAA;IACF,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAA;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,IAAiB,EAAE,IAA0B,EAAE,UAAkB;IACvF;;iDAE6C;IAC7C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAA;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACpC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;IACxE,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACtC,OAAO,aAAa,IAAI,IAAI,CAAA;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACpC,OAAO,QAAQ,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,IAAc,EACd,OAAuB,EACvB,KAA6B,EAC7B,KAAa;IASb;yEACqE;IACrE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,qBAAqB,IAAI,CAAC,WAAW,yBAAyB,GAAG,UAAU,CACtG,CAAA;QACF,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACxF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QACzE,OAAO;YACN,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,GAAG,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAA2B,EAAE,CAAC;YAC9G,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAA2B,EAAE,CAAC;SACxG,CAAA;IACF,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,GAAG,CAAC,wDAAwD,CAAC,CAAA;IACrG,CAAC;IACD,OAAO;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAA2B,EAAE,CAAC;QAC9G,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAA2B,EAAE,CAAC;KACxG,CAAA;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,WAAmB,EACnB,GAAkD,EAClD,IAAa;IAEb,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,CAAA;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,IAA+B;QACvC,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QACpB,OAAO,EAAE,UAAU;QACnB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACzE,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,WAAW,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,OAAe,EAAE,IAAY;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAA;IAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,cAAc,IAAI,kCAAkC;YACzF,uFAAuF;YACvF,wDAAwD,CACzD,CAAA;IACF,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,CAAA;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACpD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,IAAI,KAAK,CACd,YAAY,IAAI,uBAAuB,OAAO,+CAA+C;QAC5F,6DAA6D,CAC9D,CAAA;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAU,EACV,IAAiB,EACjB,OAAuB;IAEvB,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,SAAS,GAAkB,IAAI,CAAA;IACnC,IAAI,KAAK,GAA2B,EAAE,CAAA;IAEtC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3E,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC5B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IACrB,CAAC,CAAA;IAED,MAAM,OAAO,EAAE,CAAA;IAEf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAA;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAA;IAEvD,MAAM,OAAO,GAAqB;QACjC,6EAA6E;QAC7E,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;QAC7C,SAAS;QACT,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;QAC3E,EAAE;QACF,SAAS,EAAE,OAAO;QAClB;6FACqF;QACrF,cAAc,EAAE,KAAK,IAAI,EAAE;YAC1B,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAM;YAC9B,MAAM,YAAY,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC3C,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAA;iBACvF,IAAI,YAAY,IAAI,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAA;QAC5C,CAAC;QACD,KAAK;KACL,CAAA;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/runtime/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAOzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAA;AAE/C,uFAAuF;AACvF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,IAAI,GAAG,uBAAgC,CAAA;IAEhD,YAAY,WAAmB;QAC9B,KAAK,CACJ,mBAAmB,WAAW,+DAA+D;YAC5F,8FAA8F,CAC/F,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACvC,CAAC;CACD;AAqBD,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAY;IACnD,IAAI,IAAI,GAAY,IAAI,CAAA;IACxB,KAAK,MAAM,OAAO,IAAI,IAAI;SACxB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC1C,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACd,CAAC,CAAE,IAAgC,CAAC,OAAO,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,iEAAiE;AACjE,SAAS,WAAW,CAAC,KAAc,EAAE,KAA6B;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAA4B,EAAE,CAAA;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC7D,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IAClG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AAClE,CAAC;AASD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,KAA0B,EAC1B,IAAiB,EACjB,OAAuB,EACvB,eAAuC,EAAE;IAEzC,MAAM,KAAK,GAA2B,EAAE,GAAG,YAAY,EAAE,CAAA;IACzD,IAAI,IAA0B,CAAA;IAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;QAClD,CAAC;QAED,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAC3E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,KAAK,CAAA;YAChC,SAAQ;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QACjE,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE;YACjE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,uFAAuF;YACvF,eAAe,EAAE,IAAI;SACrB,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACrE,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;QACvF,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,yBAAyB,KAAK,GAAG,CAAC,GAAG;gBAC1E,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,cAAc;gBAChD,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK;gBAChF,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACrD,CAAA;QACF,CAAC;QAED,MAAM,cAAc,GAAG,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;QACjF,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,SAAS,OAAO,CAAC,WAAW,sBAAsB;oBAC5E,GAAG,cAAc,CAAC,KAAK,qCAAqC,CAC7D,CAAA;YACF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;gBACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,UAAU,IAAI,cAAc,SAAS,qBAAqB;wBACpF,qCAAqC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtE,CAAA;gBACF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YAC5B,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;QACzD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAA;YAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,SAAS,OAAO,CAAC,WAAW,qBAAqB,IAAI,KAAK;oBACpF,IAAI,IAAI,yCAAyC,CAClD,CAAA;YACF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAA;IACtG,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,6BAA6B,IAAI,CAAC,cAAc,GAAG;YACxF,4BAA4B,CAC7B,CAAA;IACF,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,CAAA;AAC/E,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,IAAiB,EACjB,OAAuB;IAEvB,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,aAAa,GAAG,uBAAuB,CAAA;AAE7C,SAAS,qBAAqB,CAAC,IAAc,EAAE,KAAgB;IAC9D,IAAI,WAAW,IAAI,IAAI;QAAE,OAAO,KAAK,CAAA;IACrC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAClC,OAAO,EAAE,CAAC,cAAc,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,KAAK,CAAA;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,KAAgB;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAA;IACnE,OAAO,SAAS,KAAK,SAAS,IAAI,qBAAqB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,OAA+B,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;IAC7C,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,IAAiB,EAAE,IAA0B,EAAE,UAAkB;IACvF;;iDAE6C;IAC7C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAA;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACvC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACpC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAA;IACxE,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACtC,OAAO,aAAa,IAAI,IAAI,CAAA;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACpC,OAAO,QAAQ,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,IAAc,EACd,OAAuB,EACvB,KAA6B,EAC7B,KAAa;IASb;yEACqE;IACrE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC5D,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACd,kBAAkB,KAAK,GAAG,CAAC,qBAAqB,IAAI,CAAC,WAAW,yBAAyB,GAAG,UAAU,CACtG,CAAA;QACF,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACxF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QACzE,OAAO;YACN,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,GAAG,OAAO;YACV,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAA2B,EAAE,CAAC;YAC9G,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAA2B,EAAE,CAAC;SACxG,CAAA;IACF,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,GAAG,CAAC,wDAAwD,CAAC,CAAA;IACrG,CAAC;IACD,OAAO;QACN,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAA2B,EAAE,CAAC;QAC9G,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAA2B,EAAE,CAAC;KACxG,CAAA;AACF,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,WAAmB,EACnB,GAAkD,EAClD,IAAa;IAEb,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,IAAI,EAAE,CAAA;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,EAAE,IAA+B;QACvC,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;QACpB,OAAO,EAAE,UAAU;QACnB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;KACzE,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,WAAW,KAAK,SAAS;QACvC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE,OAAe,EAAE,IAAY;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAA;IAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACd,mBAAmB,OAAO,CAAC,WAAW,cAAc,IAAI,kCAAkC;YACzF,uFAAuF;YACvF,wDAAwD,CACzD,CAAA;IACF,CAAC;IACD,IAAI,KAAK,GAAG,GAAG,CAAA;IACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QAChD,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACpD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,IAAI,KAAK,CACd,YAAY,IAAI,uBAAuB,OAAO,+CAA+C;QAC5F,6DAA6D,CAC9D,CAAA;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAU,EACV,IAAiB,EACjB,OAAuB;IAEvB,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,IAAI,KAAK,GAA2B,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAA;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAA;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAClE,MAAM,GAAG,GAAmB,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAA;IAE3D,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAEpF,MAAM,OAAO,GAAqB;QACjC,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,EAAE;QACF,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACtC,OAAO,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC9C,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QAChC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;QACrC,KAAK;KACL,CAAA;IAED,MAAM,KAAK,GAAG,CAAC,MAAuF,EAAQ,EAAE;QAC/G,UAAU,GAAG,MAAM,CAAC,UAAU,CAAA;QAC9B,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QACpB,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QACpC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAC5B,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAA;QAC/E,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IAClC,CAAC,CAAA;IAED,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IAEhD,IAAI,QAAQ,GAAyB,IAAI,CAAA;IACzC,IAAI,UAAU,GAAG,KAAK,CAAA;IAEtB,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC3C,UAAU,GAAG,IAAI,CAAA;QACjB,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;gBAC/D,OAAM;YACP,CAAC;YACD,IAAI,wBAAwB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAA;YACvC,CAAC;YACD,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACjD,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,KAAK,CAAA;QACnB,CAAC;IACF,CAAC,CAAA;IAED,OAAO,CAAC,cAAc,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,EAAiB,EAAE;QAC/D,8EAA8E;QAC9E,IAAI,UAAU;YAAE,OAAM;QACtB,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,mFAAmF;YACnF,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAM;YACtC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,OAAM;QACtD,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAA;QACtC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACxC,IAAI,QAAQ,KAAK,OAAO;gBAAE,QAAQ,GAAG,IAAI,CAAA;QAC1C,CAAC,CAAC,CAAA;QACF,QAAQ,GAAG,OAAO,CAAA;QAClB,OAAO,OAAO,CAAA;IACf,CAAC,CAAA;IAED,OAAO,CAAC,SAAS,GAAG,KAAK,IAAI,EAAE;QAC9B,KAAK,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IACjD,CAAC,CAAA;IAED,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/runtime/checks.d.ts

@@ -44,6 +44,8 @@ export interface CheckContext {
     softDelete: string | null;
     invite: InviteSpec | null;
     auth: () => Record<string, string>;
+    /** Countdown / 401 refresh for the writer principal. Bound onto the client as well. */
+    refreshIfStale?: (force?: boolean) => Promise<void>;
     /**
      * Every configured principal, primary first. Isolation checks still use `altAuth` (the first
      * actor whose scope is a different tenant). Lattice checks walk this list by `rank`.

package/dist/runtime/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/runtime/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjE,OAAO,KAAK,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAA;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,KAAK,OAAO,EAAY,MAAM,YAAY,CAAA;AAEnD,kGAAkG;AAClG,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,SAAS,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;IAClC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,OAAO,EAAE,CAAA;IAClB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC;;;OAGG;IACH,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,6FAA6F;IAC7F,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,OAAO,EAAE,aAAa,CAAA;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,0DAA0D;IAC1D,SAAS,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,8EAA8E;IAC9E,UAAU,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAA;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAwqID,eAAO,MAAM,MAAM,EAAE,SAAS,KAAK,EA0ElC,CAAA"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/runtime/checks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAIjE,OAAO,KAAK,EAAE,MAAM,EAA4B,MAAM,aAAa,CAAA;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,KAAK,OAAO,EAAY,MAAM,YAAY,CAAA;AAEnD,kGAAkG;AAClG,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,iEAAiE;IACjE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,SAAS,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE,cAAc,GAAG,SAAS,CAAA;IAClC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAA;IACpC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,OAAO,EAAE,CAAA;IAClB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,uFAAuF;IACvF,cAAc,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD;;;OAGG;IACH,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,6FAA6F;IAC7F,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IACnD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;IAC5C,SAAS,EAAE,eAAe,GAAG,SAAS,CAAA;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,OAAO,EAAE,aAAa,CAAA;IACtB,8DAA8D;IAC9D,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,0DAA0D;IAC1D,SAAS,EAAE,cAAc,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,8EAA8E;IAC9E,UAAU,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAA;IAC1C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,GAAG,EAAE,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAk/ID,eAAO,MAAM,MAAM,EAAE,SAAS,KAAK,EA8ElC,CAAA"}

package/dist/runtime/checks.js

@@ -7,7 +7,9 @@
  */
 import { filterTerm, selectTerm, sortTerm } from "../spec/conventions.js";
 import { requestContent } from "../spec/collection.js";
+import { pathTemplateMatches } from "../spec/load.js";
 import { encodeForOperation } from "./body.js";
+import { STRING_PAYLOADS, payloadFits } from "./payloads.js";
 import { describeFeatureGate, isDocumentedFeatureGateDenial, reportFeatureGateSchemaDrift } from "./feature-gate.js";
 import { driveAsync } from "./async.js";
 import { buildCohort } from "./fixture.js";
@@ -3372,7 +3374,7 @@ const asyncReachesTerminalState = {
                 ctx.findings.gap(this.id, ctx.entityName, `${op.operationId} could not be started`, `returned ${start.status}; the async lifecycle after it is untested`);
                 continue;
             }
-            const outcome = await driveAsync(ctx.client, spec, start.responseBody, ctx.scope, ctx.auth());
+            const outcome = await driveAsync(ctx.client, spec, start.responseBody, ctx.scope, ctx.auth, ctx.refreshIfStale);
             if (outcome.timedOut) {
                 ctx.findings.backend(this.id, ctx.entityName, `${op.operationId} never reached a terminal state`, `polled ${spec.poll} ${outcome.polls} time(s) over ${Math.round(outcome.elapsedMs)}ms ` +
                     `without satisfying "${spec.until ?? "any terminal state"}". A job that neither ` +
@@ -3432,6 +3434,284 @@ const asyncReceiptIsResolvable = {
         }
     },
 };
+const ASCII_PAYLOAD_PROBE = "oat-payload-probe";
+function pickPayloadField(ctx, op) {
+    const schema = requestSchemaOf(ctx, op);
+    const properties = (schema?.properties ?? {});
+    const immutable = new Set([
+        ...(ctx.updateOp?.immutable ?? []),
+        ...(ctx.updateOp?.generated ?? []),
+        ...(ctx.createOp?.generated ?? []),
+        ctx.identity,
+    ]);
+    let best = null;
+    for (const [name, declared] of Object.entries(properties)) {
+        if (immutable.has(name) || /_at$|_id$/.test(name))
+            continue;
+        if (declared === null || typeof declared !== "object")
+            continue;
+        if (declared.readOnly === true)
+            continue;
+        const union = declared.oneOf ?? declared.anyOf;
+        const branch = Array.isArray(union)
+            ? union.find((candidate) => candidate !== null && typeof candidate === "object" && candidate.type === "string")
+            : undefined;
+        const stringSchema = branch ?? declared;
+        const type = stringSchema.type;
+        const isString = type === "string" || (Array.isArray(type) && type.includes("string"));
+        if (!isString && type !== undefined)
+            continue;
+        if (Array.isArray(stringSchema.enum))
+            continue;
+        if (typeof stringSchema.pattern === "string")
+            continue;
+        if (typeof stringSchema.format === "string")
+            continue;
+        const maxLength = typeof stringSchema.maxLength === "number" ? stringSchema.maxLength : undefined;
+        const minLength = typeof stringSchema.minLength === "number" ? stringSchema.minLength : undefined;
+        if (maxLength !== undefined && maxLength < 8)
+            continue;
+        const nullable = declared.nullable === true ||
+            (Array.isArray(declared.type) && declared.type.includes("null")) ||
+            (Array.isArray(union) &&
+                union.some((candidate) => candidate !== null && typeof candidate === "object" && candidate.type === "null"));
+        const score = (nullable ? 1000 : 0) + (maxLength ?? 1024);
+        if (best === null || score > best.score)
+            best = { maxLength, minLength, name, score };
+    }
+    return best;
+}
+const stringPayloadSurvives = {
+    applicable: (ctx) => ctx.readOp !== undefined &&
+        ctx.records.length > 0 &&
+        (ctx.updateOp !== undefined || (ctx.createOp !== undefined && ctx.deleteOp !== undefined)),
+    dependsOn: ["list.read-after-write"],
+    id: "payload.string-survives",
+    mutates: true,
+    needs: "an update or create+delete, an item route, and a writable unconstrained string",
+    async run(ctx) {
+        const writeOp = ctx.updateOp ?? ctx.createOp;
+        const readOp = ctx.readOp;
+        if (writeOp === undefined || readOp === undefined)
+            return;
+        const field = pickPayloadField(ctx, writeOp);
+        if (field === null) {
+            return ctx.findings.unresolved(this.id, ctx.entityName, "no writable unconstrained string field is available to probe payloads against");
+        }
+        const viaPatch = ctx.updateOp !== undefined;
+        const target = ctx.records.at(-1) ?? ctx.records[0];
+        if (target === undefined)
+            return;
+        const id = String(target[ctx.identity]);
+        const params = { ...ctx.scope, ...itemParamFor(ctx, id) };
+        const original = target[field.name];
+        const writeField = async (value, recordId) => {
+            if (viaPatch && ctx.updateOp !== undefined) {
+                return ctx.client.request("PATCH", fillPath(ctx.updateOp.path, { ...ctx.scope, ...itemParamFor(ctx, recordId) }), {
+                    body: { [field.name]: value },
+                    headers: ctx.auth(),
+                });
+            }
+            const createOp = ctx.createOp;
+            if (createOp === undefined)
+                throw new Error("payload probe has no write operation");
+            const body = { ...validBody(ctx, requestSchemaOf(ctx, createOp) ?? {}), [field.name]: value };
+            return ctx.client.request("POST", fillPath(createOp.path, ctx.scope), { body, headers: ctx.auth() });
+        };
+        const readField = async (recordId) => {
+            const exchange = await ctx.client.get(fillPath(readOp.path, { ...ctx.scope, ...itemParamFor(ctx, recordId) }), {
+                headers: ctx.auth(),
+            });
+            const body = (exchange.responseBody ?? {});
+            return { exchange, value: body[field.name] };
+        };
+        const remove = async (recordId) => {
+            if (viaPatch || ctx.deleteOp === undefined)
+                return;
+            await ctx.client.request("DELETE", fillPath(ctx.deleteOp.path, { ...ctx.scope, ...itemParamFor(ctx, recordId) }), {
+                headers: ctx.auth(),
+            });
+        };
+        const identityOf = (exchange) => {
+            const body = exchange.responseBody;
+            if (body === null || typeof body !== "object")
+                return undefined;
+            const value = body[ctx.identity];
+            return value === undefined || value === null ? undefined : String(value);
+        };
+        try {
+            const control = await writeField(ASCII_PAYLOAD_PROBE, id);
+            if (standDownForFeatureGate(ctx, writeOp, control, this.id))
+                return;
+            if (control.status === 401 || control.status === 403) {
+                return ctx.findings.unresolved(this.id, ctx.entityName, `the ASCII control write returned ${control.status}, so later refusals cannot be attributed to the payload`);
+            }
+            if (control.status >= 400 && control.status < 500) {
+                return ctx.findings.unresolved(this.id, ctx.entityName, `the ASCII control write was rejected with ${control.status}, so the field refuses ordinary strings`);
+            }
+            if (control.status >= 500) {
+                ctx.findings.backend(this.id, ctx.entityName, "an ordinary ASCII write returned 5xx", `PATCH/POST of "${ASCII_PAYLOAD_PROBE}" on "${field.name}" returned ${control.status}.`, [control]);
+                return;
+            }
+            const controlId = viaPatch ? id : identityOf(control);
+            if (controlId === undefined) {
+                return ctx.findings.unresolved(this.id, ctx.entityName, "the ASCII control write did not return an identity, so the value could not be read back");
+            }
+            const controlRead = await readField(controlId);
+            if (!viaPatch)
+                await remove(controlId);
+            if (controlRead.value !== ASCII_PAYLOAD_PROBE) {
+                ctx.findings.backend(this.id, ctx.entityName, "an ordinary ASCII write did not persist exactly", `"${field.name}" was sent ${JSON.stringify(ASCII_PAYLOAD_PROBE)} and read back ` +
+                    `${JSON.stringify(controlRead.value)}.`, [control, controlRead.exchange]);
+                return;
+            }
+            const failed = [];
+            const evidence = [];
+            let lostAuth = false;
+            for (const payload of STRING_PAYLOADS) {
+                if (!payloadFits(payload.value, field.maxLength, field.minLength))
+                    continue;
+                const written = await writeField(payload.value, id);
+                if (standDownForFeatureGate(ctx, writeOp, written, this.id))
+                    return;
+                if (written.status === 401) {
+                    const retry = await writeField(ASCII_PAYLOAD_PROBE, id);
+                    if (retry.status >= 400) {
+                        lostAuth = true;
+                        break;
+                    }
+                    failed.push(`${payload.id} (${payload.why}): sent ${JSON.stringify(payload.value)}, got HTTP 401`);
+                    if (evidence.length < 4)
+                        evidence.push(written);
+                    continue;
+                }
+                if (written.status === 404 || written.status === 409 || written.status === 415 || written.status === 429) {
+                    continue;
+                }
+                if (written.status >= 400 && written.status < 500) {
+                    failed.push(`${payload.id} (${payload.why}): sent ${JSON.stringify(payload.value)}, got HTTP ${written.status}`);
+                    if (evidence.length < 4)
+                        evidence.push(written);
+                    if (!viaPatch) {
+                        const extra = identityOf(written);
+                        if (extra !== undefined)
+                            await remove(extra);
+                    }
+                    continue;
+                }
+                if (written.status >= 500) {
+                    failed.push(`${payload.id} (${payload.why}): sent ${JSON.stringify(payload.value)}, got HTTP ${written.status}`);
+                    if (evidence.length < 4)
+                        evidence.push(written);
+                    continue;
+                }
+                const writtenId = viaPatch ? id : identityOf(written);
+                if (writtenId === undefined) {
+                    failed.push(`${payload.id} (${payload.why}): write succeeded but returned no identity`);
+                    continue;
+                }
+                const got = await readField(writtenId);
+                if (!viaPatch)
+                    await remove(writtenId);
+                if (got.value !== payload.value) {
+                    failed.push(`${payload.id} (${payload.why}): sent ${JSON.stringify(payload.value)}, got ${JSON.stringify(got.value)}`);
+                    if (evidence.length < 4)
+                        evidence.push(written, got.exchange);
+                }
+            }
+            if (lostAuth && failed.length === 0) {
+                return ctx.findings.unresolved(this.id, ctx.entityName, "authentication failed in the middle of the payload catalog, so remaining cases were not run");
+            }
+            if (failed.length === 0)
+                return;
+            ctx.findings.backend(this.id, ctx.entityName, "a documented-valid string did not survive a write", `"${field.name}" failed ${failed.length} payload case(s): ${failed.slice(0, 6).join("; ")}` +
+                (failed.length > 6 ? `; and ${failed.length - 6} more` : "") +
+                ". The document accepts these as strings; refusing or mutating them is silent corruption " +
+                "or an undocumented constraint.", evidence);
+        }
+        finally {
+            if (viaPatch && ctx.updateOp !== undefined) {
+                await ctx.client.request("PATCH", fillPath(ctx.updateOp.path, params), {
+                    body: { [field.name]: original ?? null },
+                    headers: ctx.auth(),
+                });
+            }
+        }
+    },
+};
+function resolveEntityOperation(ctx, method, pathname) {
+    let best = null;
+    for (const op of ctx.model.operations) {
+        if (op.method !== method)
+            continue;
+        if (op.entity !== ctx.entityName)
+            continue;
+        if (!pathTemplateMatches(op.path, pathname))
+            continue;
+        if (best === null || op.path.length > best.path.length)
+            best = op;
+    }
+    return best;
+}
+function statusIsDeclared(raw, status) {
+    const keys = Object.keys(raw?.responses ?? {});
+    if (keys.includes(String(status)))
+        return true;
+    return keys.includes(`${Math.floor(status / 100)}XX`);
+}
+function declaresConcreteStatuses(raw) {
+    return Object.keys(raw?.responses ?? {}).some((key) => /^\d{3}$/.test(key) || /^[1-5]XX$/i.test(key));
+}
+const documentedStatusHonoured = {
+    applicable: (ctx) => ctx.model.operations.some((op) => op.entity === ctx.entityName && op.action !== "create"),
+    id: "response.status-is-documented",
+    needs: "a modeled non-create operation on this entity",
+    async run(ctx) {
+        const createId = ctx.createOp?.operationId;
+        const byOp = new Map();
+        for (const exchange of ctx.client.transcript) {
+            let pathname;
+            try {
+                pathname = new URL(exchange.url).pathname;
+            }
+            catch {
+                continue;
+            }
+            const op = resolveEntityOperation(ctx, exchange.method, pathname);
+            if (op === null)
+                continue;
+            if (op.operationId === createId || op.action === "create")
+                continue;
+            if (isDocumentedFeatureGateDenial(op, exchange.status, exchange.responseBody))
+                continue;
+            const raw = ctx.model.rawOperations.get(op.operationId);
+            if (!declaresConcreteStatuses(raw))
+                continue;
+            if (statusIsDeclared(raw, exchange.status))
+                continue;
+            const seen = byOp.get(op.operationId) ?? [];
+            seen.push(exchange);
+            byOp.set(op.operationId, seen);
+        }
+        if (byOp.size === 0)
+            return;
+        const lines = [];
+        const evidence = [];
+        for (const [operationId, exchanges] of byOp) {
+            const raw = ctx.model.rawOperations.get(operationId);
+            const declared = Object.keys(raw?.responses ?? {})
+                .filter((key) => key !== "default")
+                .sort()
+                .join(", ");
+            const seen = [...new Set(exchanges.map((item) => item.status))].sort((a, b) => a - b);
+            lines.push(`${operationId} returned ${seen.join(", ")}; the document declares ${declared || "no concrete status"}`);
+            const first = exchanges[0];
+            if (first !== undefined && evidence.length < 6)
+                evidence.push(first);
+        }
+        ctx.findings.spec(this.id, ctx.entityName, "an operation returned a status the document does not declare", `${lines.join(". ")}. Clients generated from this document will not recognise the response.`, evidence);
+    },
+};
 export const CHECKS = [
     /* foundations — did the write land, is it visible, and do the paging primitives work at all.
      * Everything below assumes these hold, so they must be evaluated first for cascade
@@ -3469,6 +3749,7 @@ export const CHECKS = [
     /* write semantics */
     patchMinimality,
     immutableRejected,
+    stringPayloadSurvives,
     idempotentReplay,
     declaredInvalidationHappens,
     projectionsAgree,
@@ -3501,5 +3782,8 @@ export const CHECKS = [
     declaredEffectsOccur,
     asyncReachesTerminalState,
     asyncReceiptIsResolvable,
+    /* After every other check has written to the transcript — create is owned by
+     * create.status-matches-document. */
+    documentedStatusHonoured,
 ];
 //# sourceMappingURL=checks.js.map