@milaboratories/pl-client 3.14.6 → 3.15.0

package/dist/core/types.d.ts

@@ -1,34 +1,33 @@
 import { Branded } from "@milaboratories/pl-model-common";
-
 //#region src/core/types.d.ts
 /** Null resource id */
-type NullResourceId = Branded<bigint, "null", "__resource_id__">;
+export type NullResourceId = Branded<bigint, "null", "__resource_id__">;
 /** Global resource id */
-type GlobalResourceId = Branded<bigint, "global", "__resource_id__">;
+export type GlobalResourceId = Branded<bigint, "global", "__resource_id__">;
 /** Local resource id */
-type LocalResourceId = Branded<bigint, "local", "__resource_id__">;
+export type LocalResourceId = Branded<bigint, "local", "__resource_id__">;
 /** Any non-null resource id */
-type AnyResourceId = GlobalResourceId | LocalResourceId;
+export type AnyResourceId = GlobalResourceId | LocalResourceId;
 /** All possible resource flavours */
-type OptionalAnyResourceId = NullResourceId | GlobalResourceId | LocalResourceId;
-declare const NullResourceId: NullResourceId;
-declare function isAnyResourceId(resourceId: bigint): resourceId is AnyResourceId;
-type ResourceKind = "Structural" | "Value";
-type FieldType = "Input" | "Output" | "Service" | "OTW" | "Dynamic" | "MTW";
-type FutureFieldType = "Output" | "Input" | "Service";
-type FieldStatus = "Empty" | "Assigned" | "Resolved";
-interface ResourceType {
+export type OptionalAnyResourceId = NullResourceId | GlobalResourceId | LocalResourceId;
+export declare const NullResourceId: NullResourceId;
+export declare function isAnyResourceId(resourceId: bigint): resourceId is AnyResourceId;
+export type ResourceKind = "Structural" | "Value";
+export type FieldType = "Input" | "Output" | "Service" | "OTW" | "Dynamic" | "MTW";
+export type FutureFieldType = "Output" | "Input" | "Service";
+export type FieldStatus = "Empty" | "Assigned" | "Resolved";
+export interface ResourceType {
   readonly name: string;
   readonly version: string;
 }
-declare function resourceType(name: string, version: string): ResourceType;
-declare function resourceTypeToString(rt: ResourceType): string;
-declare function parseResourceType(str: string): ResourceType;
-declare function resourceTypesEqual(type1: ResourceType, type2: ResourceType): boolean;
+export declare function resourceType(name: string, version: string): ResourceType;
+export declare function resourceTypeToString(rt: ResourceType): string;
+export declare function parseResourceType(str: string): ResourceType;
+export declare function resourceTypesEqual(type1: ResourceType, type2: ResourceType): boolean;
 /** Color proof used for resource creation requests (alias for ResourceSignature). */
-type ColorProof = ResourceSignature;
+export type ColorProof = ResourceSignature;
 /** Readonly fields here marks properties of resource that can't change according to pl's state machine. */
-type BasicResourceData = {
+export type BasicResourceData = {
   readonly id: SignedResourceId;
   readonly originalResourceId: OptionalSignedResourceId;
   readonly kind: ResourceKind;
@@ -42,66 +41,66 @@ type BasicResourceData = {
    * a robust criteria to determine resource is in final state. */
   readonly final: boolean;
 };
-declare function extractBasicResourceData(rd: ResourceData): BasicResourceData;
-declare const jsonToData: (data: unknown) => Buffer<ArrayBuffer>;
-declare const resDataToJson: (res: ResourceData) => unknown;
-type ResourceData = BasicResourceData & {
+export declare function extractBasicResourceData(rd: ResourceData): BasicResourceData;
+export declare const jsonToData: (data: unknown) => Buffer<ArrayBuffer>;
+export declare const resDataToJson: (res: ResourceData) => unknown;
+export type ResourceData = BasicResourceData & {
   readonly fields: FieldData[];
 };
-declare function getField(r: ResourceData, name: string): FieldData;
-type FieldData = {
+export declare function getField(r: ResourceData, name: string): FieldData;
+export type FieldData = {
   readonly name: string;
   readonly type: FieldType;
   readonly status: FieldStatus;
   readonly value: OptionalSignedResourceId;
-  readonly error: OptionalSignedResourceId; /** True if value the fields points to is in final state. */
+  readonly error: OptionalSignedResourceId;
+  /** True if value the fields points to is in final state. */
   readonly valueIsFinal: boolean;
 };
-declare const MaxLocalId = 16777215;
-declare const MaxTxId = 4294967295;
-declare function isRootResourceId(id: bigint): boolean;
-declare function isLocalResourceId(id: bigint | string): id is LocalResourceId;
-declare function createLocalResourceId(isRoot: boolean, localCounterValue: number, localTxId: number): LocalResourceId;
-declare function createGlobalResourceId(isRoot: boolean, unmaskedId: bigint): GlobalResourceId;
-declare function extractTxId(localResourceId: LocalResourceId): number;
-declare function checkLocalityOfResourceId(resourceId: AnyResourceId, expectedTxId: number): void;
-declare function resourceIdToString(resourceId: OptionalAnyResourceId | OptionalSignedResourceId): string;
-declare function resourceIdFromString(str: string): OptionalAnyResourceId | undefined;
-declare function anyResourceIdToBigint(resourceId: bigint | SignedResourceId): bigint;
-declare function stringifyWithResourceId(object: unknown): string;
+export declare const MaxLocalId = 16777215;
+export declare const MaxTxId = 4294967295;
+export declare function isRootResourceId(id: bigint): boolean;
+export declare function isLocalResourceId(id: bigint | string): id is LocalResourceId;
+export declare function createLocalResourceId(isRoot: boolean, localCounterValue: number, localTxId: number): LocalResourceId;
+export declare function createGlobalResourceId(isRoot: boolean, unmaskedId: bigint): GlobalResourceId;
+export declare function extractTxId(localResourceId: LocalResourceId): number;
+export declare function checkLocalityOfResourceId(resourceId: AnyResourceId, expectedTxId: number): void;
+export declare function resourceIdToString(resourceId: OptionalAnyResourceId | OptionalSignedResourceId): string;
+export declare function resourceIdFromString(str: string): OptionalAnyResourceId | undefined;
+export declare function anyResourceIdToBigint(resourceId: bigint | SignedResourceId): bigint;
+export declare function stringifyWithResourceId(object: unknown): string;
 /** Opaque authorization signature attached to a resource. */
-type ResourceSignature = Branded<Uint8Array, "ResourceSignature">;
+export type ResourceSignature = Branded<Uint8Array, "ResourceSignature">;
 /**
  * Signed resource id is "<global ID>|<resource signature hex>", encoded as string
  * (e.g. "NG:0x123EC|1234567890abcdef")
  */
-type SignedResourceId = Branded<string, "signed", "__signed_resource_id__">;
-type NullSignedResourceId = Branded<string, "null", "__signed_resource_id__">;
-declare const NullSignedResourceId: NullSignedResourceId;
+export type SignedResourceId = Branded<string, "signed", "__signed_resource_id__">;
+export type NullSignedResourceId = Branded<string, "null", "__signed_resource_id__">;
+export declare const NullSignedResourceId: NullSignedResourceId;
 /** Nullable signed resource ID */
-type OptionalSignedResourceId = NullSignedResourceId | SignedResourceId;
-declare function isNullSignedResourceId(resourceId: bigint | string): resourceId is NullSignedResourceId;
-declare function isNotNullSignedResourceId(resourceId: OptionalSignedResourceId): resourceId is SignedResourceId;
-declare function ensureSignedResourceIdNotNull(resourceId: OptionalSignedResourceId): SignedResourceId;
-declare function isSignedResourceId(resourceId: bigint | string): resourceId is SignedResourceId;
-declare function setResourceSignaturesRequired(required: boolean): void;
+export type OptionalSignedResourceId = NullSignedResourceId | SignedResourceId;
+export declare function isNullSignedResourceId(resourceId: bigint | string): resourceId is NullSignedResourceId;
+export declare function isNotNullSignedResourceId(resourceId: OptionalSignedResourceId): resourceId is SignedResourceId;
+export declare function ensureSignedResourceIdNotNull(resourceId: OptionalSignedResourceId): SignedResourceId;
+export declare function isSignedResourceId(resourceId: bigint | string): resourceId is SignedResourceId;
+export declare function setResourceSignaturesRequired(required: boolean): void;
 /** Validate a string as a SignedResourceId and return it with the branded type.
  *  Requires the format "<globalId>|<signatureHex>". A non-empty signature is
  *  required only when {@link areResourceSignaturesRequired} is true. */
-declare function asSignedResourceId(str: string): SignedResourceId;
+export declare function asSignedResourceId(str: string): SignedResourceId;
 /** Encode resource signature to base64url for embedding in URL-based handles. */
-declare function signatureToBase64Url(sig?: ResourceSignature): string;
+export declare function signatureToBase64Url(sig?: ResourceSignature): string;
 /** Cast raw bytes to a branded ResourceSignature, returning undefined for empty/missing input. */
-declare function toResourceSignature(raw?: Uint8Array): ResourceSignature;
+export declare function toResourceSignature(raw?: Uint8Array): ResourceSignature;
 /** Decode base64url-encoded string back to a branded ResourceSignature. */
-declare function base64UrlToSignature(str: string): ResourceSignature;
+export declare function base64UrlToSignature(str: string): ResourceSignature;
 /** Converts bigint global resource id and signature to a SignedResourceId string.
  *  Format: "<globalIdString>|<signatureHex>" */
-declare function createSignedResourceId(globalId: bigint, signature?: ResourceSignature): SignedResourceId;
-declare function parseSignedResourceId(resourceId: SignedResourceId): {
+export declare function createSignedResourceId(globalId: bigint, signature?: ResourceSignature): SignedResourceId;
+export declare function parseSignedResourceId(resourceId: SignedResourceId): {
   globalId: GlobalResourceId;
   signature: ResourceSignature;
 };
 //#endregion
-export { AnyResourceId, BasicResourceData, ColorProof, FieldData, FieldStatus, FieldType, FutureFieldType, GlobalResourceId, LocalResourceId, MaxLocalId, MaxTxId, NullResourceId, NullSignedResourceId, OptionalAnyResourceId, OptionalSignedResourceId, ResourceData, ResourceKind, ResourceSignature, ResourceType, SignedResourceId, anyResourceIdToBigint, asSignedResourceId, base64UrlToSignature, checkLocalityOfResourceId, createGlobalResourceId, createLocalResourceId, createSignedResourceId, ensureSignedResourceIdNotNull, extractBasicResourceData, extractTxId, getField, isAnyResourceId, isLocalResourceId, isNotNullSignedResourceId, isNullSignedResourceId, isRootResourceId, isSignedResourceId, jsonToData, parseResourceType, parseSignedResourceId, resDataToJson, resourceIdFromString, resourceIdToString, resourceType, resourceTypeToString, resourceTypesEqual, setResourceSignaturesRequired, signatureToBase64Url, stringifyWithResourceId, toResourceSignature };
 //# sourceMappingURL=types.d.ts.map

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/core/types.ts"],"mappings":";;;;KAMY,cAAA,GAAiB,OAAO;AAApC;AAAA,KAGY,gBAAA,GAAmB,OAAO;;KAG1B,eAAA,GAAkB,OAAO;AAND;AAAA,KASxB,aAAA,GAAgB,gBAAA,GAAmB,eAAe;;KAGlD,qBAAA,GAAwB,cAAA,GAAiB,gBAAA,GAAmB,eAAA;AAAA,cAE3D,cAAA,EAAuB,cAAc;AAAA,iBAMlC,eAAA,CAAgB,UAAA,WAAqB,UAAA,IAAc,aAAa;AAAA,KAMpE,YAAA;AAAA,KAEA,SAAA;AAAA,KAEA,eAAA;AAAA,KAEA,WAAA;AAAA,UAEK,YAAA;EAAA,SACN,IAAA;EAAA,SACA,OAAO;AAAA;AAAA,iBAGF,YAAA,CAAa,IAAA,UAAc,OAAA,WAAkB,YAAY;AAAA,iBAIzD,oBAAA,CAAqB,EAAgB,EAAZ,YAAY;AAAA,iBAIrC,iBAAA,CAAkB,GAAA,WAAc,YAAY;AAAA,iBAK5C,kBAAA,CAAmB,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,YAAY;;KAK/D,UAAA,GAAa,iBAAiB;;KAG9B,iBAAA;EAAA,SACD,EAAA,EAAI,gBAAA;EAAA,SACJ,kBAAA,EAAoB,wBAAA;EAAA,SAEpB,IAAA,EAAM,YAAA;EAAA,SACN,IAAA,EAAM,YAAA;EAAA,SAEN,IAAA,GAAO,UAAA;EAAA,SAEP,KAAA,EAAO,wBAAA;EAAA,SAEP,YAAA;EAAA,SACA,aAAA;EAAA,SACA,aAAA;;;WAIA,KAAA;AAAA;AAAA,iBAGK,wBAAA,CAAyB,EAAA,EAAI,YAAA,GAAe,iBAAiB;AAAA,cA2BhE,UAAA,GAAc,IAAA,cAAa,MAAA,CAAA,WAAA;AAAA,cAE3B,aAAA,GAAiB,GAAiB,EAAZ,YAAY;AAAA,KAEnC,YAAA,GAAe,iBAAA;EAAA,SAChB,MAAA,EAAQ,SAAS;AAAA;AAAA,iBAGZ,QAAA,CAAS,CAAA,EAAG,YAAA,EAAc,IAAA,WAAe,SAAS;AAAA,KAItD,SAAA;EAAA,SACD,IAAA;EAAA,SACA,IAAA,EAAM,SAAA;EAAA,SACN,MAAA,EAAQ,WAAA;EAAA,SACR,KAAA,EAAO,wBAAA;EAAA,SACP,KAAA,EAAO,wBAAA,EAhGN;EAAA,SAmGD,YAAA;AAAA;AAAA,cAeE,UAAA;AAAA,cACA,OAAA;AAAA,iBAQG,gBAAA,CAAiB,EAAU;AAAA,iBAI3B,iBAAA,CAAkB,EAAA,oBAAsB,EAAA,IAAM,eAAe;AAAA,iBAQ7D,qBAAA,CACd,MAAA,WACA,iBAAA,UACA,SAAA,WACC,eAAe;AAAA,iBAcF,sBAAA,CAAuB,MAAA,WAAiB,UAAA,WAAqB,gBAAgB;AAAA,iBAI7E,WAAA,CAAY,eAAgC,EAAf,eAAe;AAAA,iBAI5C,yBAAA,CAA0B,UAAA,EAAY,aAAa,EAAE,YAAA;AAAA,iBAQrD,kBAAA,CACd,UAAA,EAAY,qBAAA,GAAwB,wBAAwB;AAAA,iBA8B9C,oBAAA,CAAqB,GAAA,WAAc,qBAAqB;AAAA,iBAUxD,qBAAA,CAAsB,UAAqC,WAAhB,gBAAgB;AAAA,iBAS3D,uBAAA,CAAwB,MAAe;AArNvD;AAAA,KA8NY,iBAAA,GAAoB,OAAO,CAAC,UAAA;;;AA5NtB;AAGlB;KA+NY,gBAAA,GAAmB,OAAO;AAAA,KAE1B,oBAAA,GAAuB,OAAO;AAAA,cAE7B,oBAAA,EAA6B,oBAAoB;;KAGlD,wBAAA,GAA2B,oBAAA,GAAuB,gBAAgB;AAAA,iBAE9D,sBAAA,CACd,UAAA,oBACC,UAAA,IAAc,oBAAoB;AAAA,iBAIrB,yBAAA,CACd,UAAA,EAAY,wBAAA,GACX,UAAA,IAAc,gBAAgB;AAAA,iBAIjB,6BAAA,CACd,UAAA,EAAY,wBAAA,GACX,gBAAgB;AAAA,iBAKH,kBAAA,CAAmB,UAAA,oBAA8B,UAAA,IAAc,gBAAgB;AAAA,iBAW/E,6BAAA,CAA8B,QAAiB;;;AAlQV;iBAyQrC,kBAAA,CAAmB,GAAA,WAAc,gBAAgB;;iBAUjD,oBAAA,CAAqB,GAAuB,GAAjB,iBAAiB;;iBAK5C,mBAAA,CAAoB,GAAA,GAAM,UAAA,GAAa,iBAAiB;AA/QxE;AAAA,iBAsRgB,oBAAA,CAAqB,GAAA,WAAc,iBAAiB;;;iBAMpD,sBAAA,CACd,QAAA,UACA,SAAA,GAAY,iBAAA,GACX,gBAAgB;AAAA,iBASH,qBAAA,CAAsB,UAAA,EAAY,gBAAA;EAChD,QAAA,EAAU,gBAAA;EACV,SAAA,EAAW,iBAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../src/core/types.ts"],"mappings":";;;YAMY,iBAAiB;;YAGjB,mBAAmB;;YAGnB,kBAAkB;;YAGlB,gBAAgB,mBAAmB;;YAGnC,wBAAwB,iBAAiB,mBAAmB;qBAE3D,gBAAuB;wBAMpB,gBAAgB,qBAAqB,cAAc;YAMvD;YAEA;YAEA;YAEA;iBAEK;WACN;WACA;;wBAGK,aAAa,cAAc,kBAAkB;wBAI7C,qBAAqB,IAAI;wBAIzB,kBAAkB,cAAc;wBAKhC,mBAAmB,OAAO,cAAc,OAAO;;YAKnD,aAAa;;YAGb;WACD,IAAI;WACJ,oBAAoB;WAEpB,MAAM;WACN,MAAM;WAEN,OAAO;WAEP,OAAO;WAEP;WACA;WACA;;;WAIA;;wBAGK,yBAAyB,IAAI,eAAe;qBA2B/C,aAAU,kBAAiB,OAAA;qBAE3B,gBAAa,KAAS;YAEvB,eAAe;WAChB,QAAQ;;wBAGH,SAAS,GAAG,cAAc,eAAe;YAI7C;WACD;WACA,MAAM;WACN,QAAQ;WACR,OAAO;WACP,OAAO;;WAGP;;qBAeE;qBACA;wBAQG,iBAAiB;wBAIjB,kBAAkB,sBAAsB,MAAM;wBAQ9C,sBACd,iBACA,2BACA,oBACC;wBAca,uBAAuB,iBAAiB,qBAAqB;wBAI7D,YAAY,iBAAiB;wBAI7B,0BAA0B,YAAY,eAAe;wBAQrD,mBACd,YAAY,wBAAwB;wBA8BtB,qBAAqB,cAAc;wBAUnC,sBAAsB,qBAAqB;wBAS3C,wBAAwB;;YAS5B,oBAAoB,QAAQ;;;;;YAM5B,mBAAmB;YAEnB,uBAAuB;qBAEtB,sBAA6B;;YAG9B,2BAA2B,uBAAuB;wBAE9C,uBACd,8BACC,cAAc;wBAID,0BACd,YAAY,2BACX,cAAc;wBAID,8BACd,YAAY,2BACX;wBAKa,mBAAmB,8BAA8B,cAAc;wBAW/D,8BAA8B;;;;wBAO9B,mBAAmB,cAAc;;wBAUjC,qBAAqB,MAAM;;wBAK3B,oBAAoB,MAAM,aAAa;;wBAOvC,qBAAqB,cAAc;;;wBAMnC,uBACd,kBACA,YAAY,oBACX;wBASa,sBAAsB,YAAY;EAChD,UAAU;EACV,WAAW"}

package/dist/core/unauth_client.d.ts

@@ -3,15 +3,14 @@ import { AuthInformation, PlClientConfig } from "./config.js";
 import { BackendCapability } from "./capabilities.js";
 import { LLPlClient } from "./ll_client.js";
 import { MiLogger } from "@milaboratories/ts-helpers";
-
 //#region src/core/unauth_client.d.ts
 /** Login-flow shape advertised by the backend for a given SSO method. Extension
  * point: future flow variants (e.g. backend-driven) sit alongside `public_pkce`. */
-type SSOFlowType = "public_pkce";
+export type SSOFlowType = "public_pkce";
 /** Typed projection of `AuthAPI.ListMethods.SSOAuthMethod` for desktop consumption.
  * Carries everything needed to drive the PKCE flow + diagnostics fields the renderer
  * may surface (`userIdClaim`, `groupsClaim`). */
-type SSOAuthMethod = {
+export type SSOAuthMethod = {
   id: string;
   description: string;
   issuer: string;
@@ -31,7 +30,7 @@ type SSOAuthMethod = {
 };
 /** Server-issued material returned by {@link UnauthenticatedPlClient.beginSSOLogin}.
  * Discriminated on `flow`; future flow variants extend the union. */
-type SSOLoginAttempt = {
+export type SSOLoginAttempt = {
   flow: "public_pkce";
   nonce: string;
   expiresAt: Date;
@@ -42,7 +41,7 @@ type SSOLoginAttempt = {
   clientSecret?: string;
 };
 /** Primarily used for initial authentication (login) */
-declare class UnauthenticatedPlClient {
+export declare class UnauthenticatedPlClient {
   readonly ll: LLPlClient;
   private constructor();
   static build(configOrAddress: PlClientConfig | string, ops?: {
@@ -82,5 +81,4 @@ declare class UnauthenticatedPlClient {
   }): Promise<AuthInformation>;
 }
 //#endregion
-export { SSOAuthMethod, SSOFlowType, SSOLoginAttempt, UnauthenticatedPlClient };
 //# sourceMappingURL=unauth_client.d.ts.map

package/dist/core/unauth_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;;KAaY,WAAA;;;;KAKA,aAAA;EACV,EAAA;EACA,WAAA;EACA,MAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;EACA,MAAA;EACA,aAAA;EACA,kBAAA;EACA,WAAA;EACA,WAAA;EACA,QAAA,EAAU,WAAW;EAHrB;;;EAOA,UAAA;AAAA;;;KAKU,eAAA;EACV,IAAA;EACA,KAAA;EACA,SAAA,EAAW,IAAI;EAAA;;;;EAKf,YAAA;AAAA;;cAIW,uBAAA;EAAA,SACK,EAAA,EAAI,UAAA;EAAA,QAEb,WAAA;EAAA,OAIa,KAAA,CAClB,eAAA,EAAiB,cAAA,WACjB,GAAA;IAAQ,MAAA,GAAS,QAAA;EAAA,IAChB,OAAA,CAAQ,uBAAA;EAKE,IAAA,IAAQ,OAAA,CAAQ,4BAAA;EAIhB,WAAA,IAAe,OAAA,CAAQ,4BAAA;EAIvB,WAAA,IAAe,OAAA;EAIrB,aAAA,CAAc,UAAA,EAAY,iBAAA;EAZZ;;;EAAA,IAmBV,oBAAA;IAA0B,KAAA;IAAgB,KAAA;EAAA;EA+CD;;EApC7C,SAAA,IAAa,aAAA;EA2E4B;;;;;;;;;;EAvCnC,KAAA,CAAM,IAAA,UAAc,QAAA,WAAmB,OAAA,CAAQ,eAAA;EAxElD;;EAoGG,aAAA,IAAiB,OAAA,CAAQ,eAAA;EAnGnC;EA8GU,QAAA,CAAS,OAAA;IAAW,aAAA,EAAe,UAAA;EAAA,IAAe,OAAA,CAAQ,eAAA;AAAA"}
+{"version":3,"file":"unauth_client.d.ts","names":[],"sources":["../../src/core/unauth_client.ts"],"mappings":";;;;;;;;YAaY;;;;YAKA;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,UAAU;;;;EAIV;;;;YAKU;EACV;EACA;EACA,WAAW;;;;;EAKX;;;qBAIW;WACK,IAAI;UAEb;SAIa,MAClB,iBAAiB,yBACjB;IAAQ,SAAS;MAChB,QAAQ;EAKE,QAAQ,QAAQ;EAIhB,eAAe,QAAQ;EAIvB,eAAe;EAIrB,cAAc,YAAY;;;;MAOtB;IAA0B;IAAgB;;;;EAW9C,aAAa;;;;;;;;;;;EAoCP,MAAM,cAAc,mBAAmB,QAAQ;;;EA4B/C,iBAAiB,QAAQ;;EAWzB,SAAS;IAAW,eAAe;MAAe,QAAQ"}

package/dist/core/user_resources.cjs

@@ -126,6 +126,29 @@ var UserResources = class {
 	async listUsers() {
 		return (await this.ll.listUsers()).map((user) => ({ login: user.login }));
 	}
+	/**
+	* Deletes a user account: the record, every identity-index entry that resolves to it (its login,
+	* its email, and any alternative of either), every grant it holds, and its root resource — and
+	* with the root, everything still attached under it.
+	*
+	* Exists for the duplicate account one person can end up with — an identity that could not be
+	* matched across a provider cutover, or one minted before the backend started refusing two
+	* records for one identity. The spare record shows up wherever users are listed and its projects
+	* keep taking part in deduplication.
+	*
+	* Destructive and irreversible. Re-attach anything worth keeping to another user's root before
+	* calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller
+	* credentials; gRPC-only, like {@link listUsers}.
+	*/
+	async deleteUser(login) {
+		const resp = await this.ll.deleteUser(login);
+		return {
+			userRootId: resp.userRootId === 0n ? void 0 : resp.userRootId,
+			userRootDeleted: resp.userRootDeleted,
+			revokedGrants: resp.revokedGrants,
+			removedIdentityIndexEntries: resp.removedIdentityIndexEntries
+		};
+	}
 	async getUserRootViaRpc(opts = {}) {
 		const resp = await this.ll.getUserRoot({
 			login: opts.login,

package/dist/core/user_resources.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"user_resources.cjs","names":["isUnimplementedError","createSignedResourceId","toResourceSignature","ClientRoot","toGlobalResourceId","isNotNullSignedResourceId"],"sources":["../../src/core/user_resources.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { LLPlClient } from \"./ll_client\";\nimport type { PlTransaction } from \"./transaction\";\nimport { toGlobalResourceId } from \"./transaction\";\nimport type { OptionalSignedResourceId, SignedResourceId, ResourceType } from \"./types\";\nimport {\n  createSignedResourceId,\n  isNotNullSignedResourceId,\n  NullSignedResourceId,\n  toResourceSignature,\n} from \"./types\";\nimport { isUnimplementedError } from \"./errors\";\nimport { ClientRoot } from \"../helpers/pl\";\n\nconst AnonymousClientRoot = \"AnonymousRoot\";\nconst LsStorageTypePrefix = \"LS/\"; // implements ls API in particular storage\nconst LsProviderFieldPrefix = \"storage/\"; // provides access to storages list\n\n/** One recipient of a resource, as returned by {@link UserResources.listGrants}. */\nexport interface GrantEntry {\n  /** Login the grant targets. An everyone-grant surfaces here as the backend's\n   *  everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\"); callers\n   *  map it to \"*\". */\n  readonly user: string;\n  /** True for a writable grant (copy / collaboration), false for read-only. */\n  readonly writable: boolean;\n  /** Login of the user who created the grant. */\n  readonly grantedBy: string;\n  /** When the grant was created (ms epoch). */\n  readonly grantedAt: number;\n}\n\n/** One user known to the server, as returned by {@link UserResources.listUsers}. */\nexport interface UserEntry {\n  /** Stable identifier of the user; the grant target and `GetUserRoot` key. */\n  readonly login: string;\n}\n\n/** Information about a single data library (LS storage). */\nexport interface StorageInfo {\n  /** Machine-stable identifier, e.g. \"library\". Used for filtering and map keys. */\n  readonly storageId: string;\n  /** Human-readable display name. For V1/legacy equals storageId; for V2 from resource JSON data. */\n  readonly storageName: string;\n  /** Signed resource ID for this storage resource. */\n  readonly resourceId: SignedResourceId;\n  /** Full resource type including correct version (\"1\" or \"2\"). */\n  readonly resourceType: ResourceType;\n}\n\n/** V2 LsStorage resource JSON data shape (contract with backend). */\ninterface LsStorageV2Data {\n  storageName: string;\n  storageID: string;\n}\n\n/**\n * Callback type for running transactions. Matches PlClient._withTx signature\n * so the index can run transactions before PlClient is fully initialized.\n */\nexport type TxRunner = <T>(\n  name: string,\n  writable: boolean,\n  clientRoot: OptionalSignedResourceId,\n  body: (tx: PlTransaction) => Promise<T>,\n) => Promise<T>;\n\ntype BackendCapability = \"getUserRoot\" | \"listUserResources\" | \"legacy\";\n\n/**\n * Abstracts user resource discovery with backward compatibility.\n *\n * Detects backend capability on the first getUserRoot() call and remembers\n * the result. Three-tier fallback:\n * 1. getUserRoot RPC (newest, supports createIfNotExists)\n * 2. listUserResources RPC (streams all resources, picks userRoot)\n * 3. Named resource lookup/creation via transaction (legacy)\n */\nexport class UserResources {\n  private backendCapability: BackendCapability | undefined;\n\n  constructor(\n    private readonly ll: LLPlClient,\n    private readonly runTx: TxRunner,\n    public readonly authUser: string | null,\n  ) {}\n\n  /**\n   * Returns the user's root resource ID.\n   *\n   * On first call, detects backend capability by trying methods in order:\n   * 1. getUserRoot RPC (newest)\n   * 2. listUserResources RPC\n   * 3. Named resource lookup/creation via transaction (legacy)\n   */\n  async getUserRoot(opts: { login?: string; createIfNotExists: true }): Promise<SignedResourceId>;\n  async getUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    if (this.backendCapability === undefined) {\n      return await this.detectAndGetUserRoot(opts);\n    }\n    return await this.getUserRootWith(this.backendCapability, opts);\n  }\n\n  private async detectAndGetUserRoot(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async detectAndGetUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async detectAndGetUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    // 1. Try getUserRoot RPC\n    try {\n      const root = await this.getUserRootViaRpc(opts);\n      this.backendCapability = \"getUserRoot\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 2. Try listUserResources\n    try {\n      const root = await this.getUserRootViaList(opts);\n      this.backendCapability = \"listUserResources\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 3. Legacy fallback\n    this.backendCapability = \"legacy\";\n    return await this.getUserRootViaLegacy(opts);\n  }\n\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists: true },\n  ): Promise<SignedResourceId>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts?: { login?: string; createIfNotExists?: boolean },\n  ): Promise<SignedResourceId | undefined>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    switch (capability) {\n      case \"getUserRoot\":\n        return await this.getUserRootViaRpc(opts);\n      case \"listUserResources\":\n        return await this.getUserRootViaList(opts);\n      case \"legacy\":\n        return await this.getUserRootViaLegacy(opts);\n    }\n  }\n\n  /**\n   * Returns all data libraries the user has access to.\n   * Always fetches fresh from the server (no caching).\n   */\n  async getDataLibraries(\n    opts: { login?: string; createUserRootIfNotExists?: boolean } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    if (this.backendCapability === undefined) {\n      // First call — detect backend capability\n      try {\n        const libs = await this.getDataLibrariesViaList(opts);\n        // getUserRoot RPC doesn't return libraries, but listUserResources does;\n        // record at least \"listUserResources\" so future getUserRoot calls don't re-detect.\n        this.backendCapability = \"listUserResources\";\n        return libs;\n      } catch (err) {\n        if (!isUnimplementedError(err)) throw err;\n        this.backendCapability = \"legacy\";\n        return await this.getDataLibrariesViaLegacy();\n      }\n    }\n\n    // A server that supports getUserRoot definitely supports listUserResources.\n    if (this.backendCapability !== \"legacy\") {\n      return await this.getDataLibrariesViaList(opts);\n    }\n    return await this.getDataLibrariesViaLegacy();\n  }\n\n  /**\n   * Discovers shared resources of a given type granted to the user, as signed resource ids.\n   *\n   * The public, type-filtered form of {@link getDataLibrariesViaList}: it polls the\n   * `ListUserResources` gRPC stream and returns every `sharedResource` entry whose\n   * `resourceType.name` matches `resourceTypeName`. Matching is by name only — the\n   * version is ignored (permissive, survives schema bumps).\n   *\n   * gRPC-only: `ListUserResources` throws on a REST-connected client\n   * ({@link LLPlClient.listUserResources}), so callers on REST get a thrown error.\n   */\n  async listSharedResourcesByType(\n    resourceTypeName: string,\n    opts: { login?: string } = {},\n  ): Promise<SignedResourceId[]> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    const result: SignedResourceId[] = [];\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n      if (!sr.resourceType) continue;\n      if (sr.resourceType.name !== resourceTypeName) continue;\n      result.push(createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature)));\n    }\n    return result;\n  }\n\n  /**\n   * Enumerates the recipients of a single resource — the donor-side \"who did I\n   * share with\" view.\n   *\n   * Takes a signed, writable resource handle: the backend gates grant listing on a\n   * signed resource id with writable permission, so only the resource's owner can\n   * call it. An everyone-grant surfaces with `user` matching the backend's\n   * everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\");\n   * the caller maps that to \"*\".\n   *\n   * Runs over a read transaction ({@link PlTransaction.listGrants}), so it works on\n   * every wire protocol — including REST, where the standalone server-streaming\n   * `ListGrants` RPC has no binding.\n   */\n  async listGrants(resourceId: SignedResourceId): Promise<GrantEntry[]> {\n    const grants = await this.runTx(\"ListGrants\", false, NullSignedResourceId, (tx) =>\n      tx.listGrants(resourceId),\n    );\n    return grants.map((grant) => ({\n      user: grant.user,\n      writable: grant.permissions?.writable ?? false,\n      grantedBy: grant.grantedBy,\n      grantedAt: Number(grant.grantedAt),\n    }));\n  }\n\n  /**\n   * Lists the logins of users known to the server, for the recipient picker. A user becomes\n   * known on first login; provisioned users who have never logged in do not appear. gRPC-only\n   * (the underlying {@link LLPlClient.listUsers} has no REST binding) — throws on a\n   * REST-connected client, so callers gate on the `userListing:v1` capability.\n   */\n  async listUsers(): Promise<UserEntry[]> {\n    const users = await this.ll.listUsers();\n    return users.map((user) => ({ login: user.login }));\n  }\n\n  private async getUserRootViaRpc(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaRpc(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaRpc(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const resp = await this.ll.getUserRoot({\n      login: opts.login,\n      createIfNotExists: opts.createIfNotExists,\n    });\n    if (resp.userRoot === undefined) {\n      if (!opts.createIfNotExists) return undefined;\n      throw new Error(\"getUserRoot returned no userRoot entry\");\n    }\n    return createSignedResourceId(\n      resp.userRoot.resourceId,\n      toResourceSignature(resp.userRoot.resourceSignature),\n    );\n  }\n\n  private async getUserRootViaList(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaList(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaList(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const responses = await this.ll.listUserResources({ login: opts.login, limit: 1 });\n    for (const msg of responses) {\n      if (msg.entry.oneofKind === \"userRoot\") {\n        return createSignedResourceId(\n          msg.entry.userRoot.resourceId,\n          toResourceSignature(msg.entry.userRoot.resourceSignature),\n        );\n      }\n    }\n\n    if (opts.createIfNotExists) {\n      throw new Error(\"listUserResources returned no userRoot entry\");\n    }\n\n    return undefined;\n  }\n\n  private async getDataLibrariesViaList(\n    opts: { login?: string } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    // Collect all LS/* shared resources, separating V1 and V2\n    const v1Entries: StorageInfo[] = [];\n    const v2ResourceIds: { resourceId: SignedResourceId; resourceType: ResourceType }[] = [];\n\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n\n      if (!sr.resourceType) continue;\n      const typeName = sr.resourceType.name;\n      const typeVersion = sr.resourceType.version;\n      if (!typeName.startsWith(LsStorageTypePrefix)) continue;\n\n      const rId = createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature));\n      const rType: ResourceType = { name: typeName, version: typeVersion };\n\n      if (typeVersion === \"2\") {\n        v2ResourceIds.push({ resourceId: rId, resourceType: rType });\n      } else {\n        // V1 or unknown version: derive storageId from type name\n        const storageId = typeName.substring(LsStorageTypePrefix.length);\n        v1Entries.push({\n          storageId,\n          storageName: storageId,\n          resourceId: rId,\n          resourceType: rType,\n        });\n      }\n    }\n\n    // Read V2 resource data in a single transaction\n    let v2Entries: StorageInfo[] = [];\n    if (v2ResourceIds.length > 0) {\n      v2Entries = await this.runTx(\n        \"ReadLsStorageV2Data\",\n        false,\n        NullSignedResourceId,\n        async (tx) => {\n          const entries: StorageInfo[] = [];\n          for (const { resourceId, resourceType } of v2ResourceIds) {\n            const rd = await tx.getResourceData(resourceId, false);\n            if (rd.data) {\n              const v2Data = JSON.parse(Buffer.from(rd.data).toString(\"utf-8\")) as LsStorageV2Data;\n              entries.push({\n                storageId: v2Data.storageID,\n                storageName: v2Data.storageName,\n                resourceId,\n                resourceType,\n              });\n            }\n          }\n          return entries;\n        },\n      );\n    }\n\n    const result = new Map<string, StorageInfo>();\n    for (const entry of [...v1Entries, ...v2Entries]) {\n      result.set(entry.storageId, entry);\n    }\n    return result;\n  }\n\n  private async getUserRootViaLegacy(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaLegacy(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaLegacy(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const login = opts.login ?? this.authUser;\n    const mainRootName =\n      login === null ? AnonymousClientRoot : createHash(\"sha256\").update(login).digest(\"hex\");\n\n    return await this.runTx(\"initialization\", true, NullSignedResourceId, async (tx) => {\n      if (await tx.checkResourceNameExists(mainRootName)) {\n        return await tx.getResourceByName(mainRootName);\n      }\n\n      if (!opts.createIfNotExists) {\n        return undefined;\n      }\n\n      const mainRoot = tx.createRoot(ClientRoot);\n      tx.setResourceName(mainRootName, mainRoot);\n      await tx.commit();\n      return await toGlobalResourceId(mainRoot);\n    });\n  }\n\n  private async getDataLibrariesViaLegacy(): Promise<ReadonlyMap<string, StorageInfo>> {\n    return await this.runTx(\"GetAvailableStorageIds\", false, NullSignedResourceId, async (tx) => {\n      const lsProviderId = await tx.getResourceByName(\"LSProvider\");\n      const provider = await tx.getResourceData(lsProviderId, true);\n\n      const result = new Map<string, StorageInfo>();\n      for (const field of provider.fields) {\n        if (field.type !== \"Dynamic\" || !isNotNullSignedResourceId(field.value)) continue;\n        if (!field.name.startsWith(LsProviderFieldPrefix)) continue;\n\n        const storageId = field.name.substring(LsProviderFieldPrefix.length);\n        result.set(storageId, {\n          storageId,\n          storageName: storageId,\n          resourceId: field.value,\n          resourceType: { name: `${LsStorageTypePrefix}${storageId}`, version: \"1\" },\n        });\n      }\n      return result;\n    });\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;;;;;;;;;;AA8D9B,IAAa,gBAAb,MAA2B;CAIN;CACA;CACD;CALlB;CAEA,YACE,IACA,OACA,UACA;EAHiB,KAAA,KAAA;EACA,KAAA,QAAA;EACD,KAAA,WAAA;CACf;CAeH,MAAM,YACJ,OAAwD,CAAC,GAClB;EACvC,IAAI,KAAK,sBAAsB,KAAA,GAC7B,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAE7C,OAAO,MAAM,KAAK,gBAAgB,KAAK,mBAAmB,IAAI;CAChE;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EAEvC,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC9C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC/C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,KAAK,oBAAoB;EACzB,OAAO,MAAM,KAAK,qBAAqB,IAAI;CAC7C;CAUA,MAAc,gBACZ,YACA,OAAwD,CAAC,GAClB;EACvC,QAAQ,YAAR;GACE,KAAK,eACH,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC1C,KAAK,qBACH,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC3C,KAAK,UACH,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAC/C;CACF;;;;;CAMA,MAAM,iBACJ,OAAgE,CAAC,GACtB;EAC3C,IAAI,KAAK,sBAAsB,KAAA,GAE7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,wBAAwB,IAAI;GAGpD,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;GACtC,KAAK,oBAAoB;GACzB,OAAO,MAAM,KAAK,0BAA0B;EAC9C;EAIF,IAAI,KAAK,sBAAsB,UAC7B,OAAO,MAAM,KAAK,wBAAwB,IAAI;EAEhD,OAAO,MAAM,KAAK,0BAA0B;CAC9C;;;;;;;;;;;;CAaA,MAAM,0BACJ,kBACA,OAA2B,CAAC,GACC;EAC7B,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAEvE,MAAM,SAA6B,CAAC;EACpC,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GACrB,IAAI,CAAC,GAAG,cAAc;GACtB,IAAI,GAAG,aAAa,SAAS,kBAAkB;GAC/C,OAAO,KAAKC,cAAAA,uBAAuB,GAAG,YAAYC,cAAAA,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;EAC9F;EACA,OAAO;CACT;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,YAAqD;EAIpE,QAAO,MAHc,KAAK,MAAM,cAAc,OAAA,KAA8B,OAC1E,GAAG,WAAW,UAAU,CAC1B,EAAA,CACc,KAAK,WAAW;GAC5B,MAAM,MAAM;GACZ,UAAU,MAAM,aAAa,YAAY;GACzC,WAAW,MAAM;GACjB,WAAW,OAAO,MAAM,SAAS;EACnC,EAAE;CACJ;;;;;;;CAQA,MAAM,YAAkC;EAEtC,QAAO,MADa,KAAK,GAAG,UAAU,EAAA,CACzB,KAAK,UAAU,EAAE,OAAO,KAAK,MAAM,EAAE;CACpD;CAUA,MAAc,kBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,OAAO,MAAM,KAAK,GAAG,YAAY;GACrC,OAAO,KAAK;GACZ,mBAAmB,KAAK;EAC1B,CAAC;EACD,IAAI,KAAK,aAAa,KAAA,GAAW;GAC/B,IAAI,CAAC,KAAK,mBAAmB,OAAO,KAAA;GACpC,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,OAAOD,cAAAA,uBACL,KAAK,SAAS,YACdC,cAAAA,oBAAoB,KAAK,SAAS,iBAAiB,CACrD;CACF;CAUA,MAAc,mBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB;GAAE,OAAO,KAAK;GAAO,OAAO;EAAE,CAAC;EACjF,KAAK,MAAM,OAAO,WAChB,IAAI,IAAI,MAAM,cAAc,YAC1B,OAAOD,cAAAA,uBACL,IAAI,MAAM,SAAS,YACnBC,cAAAA,oBAAoB,IAAI,MAAM,SAAS,iBAAiB,CAC1D;EAIJ,IAAI,KAAK,mBACP,MAAM,IAAI,MAAM,8CAA8C;CAIlE;CAEA,MAAc,wBACZ,OAA2B,CAAC,GACe;EAC3C,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAGvE,MAAM,YAA2B,CAAC;EAClC,MAAM,gBAAgF,CAAC;EAEvF,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GAErB,IAAI,CAAC,GAAG,cAAc;GACtB,MAAM,WAAW,GAAG,aAAa;GACjC,MAAM,cAAc,GAAG,aAAa;GACpC,IAAI,CAAC,SAAS,WAAW,mBAAmB,GAAG;GAE/C,MAAM,MAAMD,cAAAA,uBAAuB,GAAG,YAAYC,cAAAA,oBAAoB,GAAG,iBAAiB,CAAC;GAC3F,MAAM,QAAsB;IAAE,MAAM;IAAU,SAAS;GAAY;GAEnE,IAAI,gBAAgB,KAClB,cAAc,KAAK;IAAE,YAAY;IAAK,cAAc;GAAM,CAAC;QACtD;IAEL,MAAM,YAAY,SAAS,UAAU,CAA0B;IAC/D,UAAU,KAAK;KACb;KACA,aAAa;KACb,YAAY;KACZ,cAAc;IAChB,CAAC;GACH;EACF;EAGA,IAAI,YAA2B,CAAC;EAChC,IAAI,cAAc,SAAS,GACzB,YAAY,MAAM,KAAK,MACrB,uBACA,OAAA,IAEA,OAAO,OAAO;GACZ,MAAM,UAAyB,CAAC;GAChC,KAAK,MAAM,EAAE,YAAY,kBAAkB,eAAe;IACxD,MAAM,KAAK,MAAM,GAAG,gBAAgB,YAAY,KAAK;IACrD,IAAI,GAAG,MAAM;KACX,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;KAChE,QAAQ,KAAK;MACX,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB;MACA;KACF,CAAC;IACH;GACF;GACA,OAAO;EACT,CACF;EAGF,MAAM,yBAAS,IAAI,IAAyB;EAC5C,KAAK,MAAM,SAAS,CAAC,GAAG,WAAW,GAAG,SAAS,GAC7C,OAAO,IAAI,MAAM,WAAW,KAAK;EAEnC,OAAO;CACT;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,QAAQ,KAAK,SAAS,KAAK;EACjC,MAAM,eACJ,UAAU,OAAO,uBAAA,GAAA,YAAA,WAAA,CAAiC,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAExF,OAAO,MAAM,KAAK,MAAM,kBAAkB,MAAA,IAA4B,OAAO,OAAO;GAClF,IAAI,MAAM,GAAG,wBAAwB,YAAY,GAC/C,OAAO,MAAM,GAAG,kBAAkB,YAAY;GAGhD,IAAI,CAAC,KAAK,mBACR;GAGF,MAAM,WAAW,GAAG,WAAWC,WAAAA,UAAU;GACzC,GAAG,gBAAgB,cAAc,QAAQ;GACzC,MAAM,GAAG,OAAO;GAChB,OAAO,MAAMC,oBAAAA,mBAAmB,QAAQ;EAC1C,CAAC;CACH;CAEA,MAAc,4BAAuE;EACnF,OAAO,MAAM,KAAK,MAAM,0BAA0B,OAAA,IAA6B,OAAO,OAAO;GAC3F,MAAM,eAAe,MAAM,GAAG,kBAAkB,YAAY;GAC5D,MAAM,WAAW,MAAM,GAAG,gBAAgB,cAAc,IAAI;GAE5D,MAAM,yBAAS,IAAI,IAAyB;GAC5C,KAAK,MAAM,SAAS,SAAS,QAAQ;IACnC,IAAI,MAAM,SAAS,aAAa,CAACC,cAAAA,0BAA0B,MAAM,KAAK,GAAG;IACzE,IAAI,CAAC,MAAM,KAAK,WAAW,qBAAqB,GAAG;IAEnD,MAAM,YAAY,MAAM,KAAK,UAAU,CAA4B;IACnE,OAAO,IAAI,WAAW;KACpB;KACA,aAAa;KACb,YAAY,MAAM;KAClB,cAAc;MAAE,MAAM,GAAG,sBAAsB;MAAa,SAAS;KAAI;IAC3E,CAAC;GACH;GACA,OAAO;EACT,CAAC;CACH;AACF"}
+{"version":3,"file":"user_resources.cjs","names":["isUnimplementedError","createSignedResourceId","toResourceSignature","ClientRoot","toGlobalResourceId","isNotNullSignedResourceId"],"sources":["../../src/core/user_resources.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { LLPlClient } from \"./ll_client\";\nimport type { PlTransaction } from \"./transaction\";\nimport { toGlobalResourceId } from \"./transaction\";\nimport type { OptionalSignedResourceId, SignedResourceId, ResourceType } from \"./types\";\nimport {\n  createSignedResourceId,\n  isNotNullSignedResourceId,\n  NullSignedResourceId,\n  toResourceSignature,\n} from \"./types\";\nimport { isUnimplementedError } from \"./errors\";\nimport { ClientRoot } from \"../helpers/pl\";\n\nconst AnonymousClientRoot = \"AnonymousRoot\";\nconst LsStorageTypePrefix = \"LS/\"; // implements ls API in particular storage\nconst LsProviderFieldPrefix = \"storage/\"; // provides access to storages list\n\n/** One recipient of a resource, as returned by {@link UserResources.listGrants}. */\nexport interface GrantEntry {\n  /** Login the grant targets. An everyone-grant surfaces here as the backend's\n   *  everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\"); callers\n   *  map it to \"*\". */\n  readonly user: string;\n  /** True for a writable grant (copy / collaboration), false for read-only. */\n  readonly writable: boolean;\n  /** Login of the user who created the grant. */\n  readonly grantedBy: string;\n  /** When the grant was created (ms epoch). */\n  readonly grantedAt: number;\n}\n\n/** One user known to the server, as returned by {@link UserResources.listUsers}. */\nexport interface UserEntry {\n  /** Stable identifier of the user; the grant target and `GetUserRoot` key. */\n  readonly login: string;\n}\n\n/** What {@link UserResources.deleteUser} removed, so a caller can report it. */\nexport interface UserDeletionReport {\n  /** Raw id of the root resource the user owned, or undefined when they had none. Unsigned —\n   *  the resource is gone, so this is for the audit line, not for further calls. */\n  readonly userRootId: bigint | undefined;\n  /** Whether that root resource was deleted. */\n  readonly userRootDeleted: boolean;\n  /** Grants revoked, the user-root self-grant included. */\n  readonly revokedGrants: number;\n  /** Identity-index entries removed — one per value that resolved to the account: its login,\n   *  its email, and any alternative of either. */\n  readonly removedIdentityIndexEntries: number;\n}\n\n/** Information about a single data library (LS storage). */\nexport interface StorageInfo {\n  /** Machine-stable identifier, e.g. \"library\". Used for filtering and map keys. */\n  readonly storageId: string;\n  /** Human-readable display name. For V1/legacy equals storageId; for V2 from resource JSON data. */\n  readonly storageName: string;\n  /** Signed resource ID for this storage resource. */\n  readonly resourceId: SignedResourceId;\n  /** Full resource type including correct version (\"1\" or \"2\"). */\n  readonly resourceType: ResourceType;\n}\n\n/** V2 LsStorage resource JSON data shape (contract with backend). */\ninterface LsStorageV2Data {\n  storageName: string;\n  storageID: string;\n}\n\n/**\n * Callback type for running transactions. Matches PlClient._withTx signature\n * so the index can run transactions before PlClient is fully initialized.\n */\nexport type TxRunner = <T>(\n  name: string,\n  writable: boolean,\n  clientRoot: OptionalSignedResourceId,\n  body: (tx: PlTransaction) => Promise<T>,\n) => Promise<T>;\n\ntype BackendCapability = \"getUserRoot\" | \"listUserResources\" | \"legacy\";\n\n/**\n * Abstracts user resource discovery with backward compatibility.\n *\n * Detects backend capability on the first getUserRoot() call and remembers\n * the result. Three-tier fallback:\n * 1. getUserRoot RPC (newest, supports createIfNotExists)\n * 2. listUserResources RPC (streams all resources, picks userRoot)\n * 3. Named resource lookup/creation via transaction (legacy)\n */\nexport class UserResources {\n  private backendCapability: BackendCapability | undefined;\n\n  constructor(\n    private readonly ll: LLPlClient,\n    private readonly runTx: TxRunner,\n    public readonly authUser: string | null,\n  ) {}\n\n  /**\n   * Returns the user's root resource ID.\n   *\n   * On first call, detects backend capability by trying methods in order:\n   * 1. getUserRoot RPC (newest)\n   * 2. listUserResources RPC\n   * 3. Named resource lookup/creation via transaction (legacy)\n   */\n  async getUserRoot(opts: { login?: string; createIfNotExists: true }): Promise<SignedResourceId>;\n  async getUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    if (this.backendCapability === undefined) {\n      return await this.detectAndGetUserRoot(opts);\n    }\n    return await this.getUserRootWith(this.backendCapability, opts);\n  }\n\n  private async detectAndGetUserRoot(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async detectAndGetUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async detectAndGetUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    // 1. Try getUserRoot RPC\n    try {\n      const root = await this.getUserRootViaRpc(opts);\n      this.backendCapability = \"getUserRoot\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 2. Try listUserResources\n    try {\n      const root = await this.getUserRootViaList(opts);\n      this.backendCapability = \"listUserResources\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 3. Legacy fallback\n    this.backendCapability = \"legacy\";\n    return await this.getUserRootViaLegacy(opts);\n  }\n\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists: true },\n  ): Promise<SignedResourceId>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts?: { login?: string; createIfNotExists?: boolean },\n  ): Promise<SignedResourceId | undefined>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    switch (capability) {\n      case \"getUserRoot\":\n        return await this.getUserRootViaRpc(opts);\n      case \"listUserResources\":\n        return await this.getUserRootViaList(opts);\n      case \"legacy\":\n        return await this.getUserRootViaLegacy(opts);\n    }\n  }\n\n  /**\n   * Returns all data libraries the user has access to.\n   * Always fetches fresh from the server (no caching).\n   */\n  async getDataLibraries(\n    opts: { login?: string; createUserRootIfNotExists?: boolean } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    if (this.backendCapability === undefined) {\n      // First call — detect backend capability\n      try {\n        const libs = await this.getDataLibrariesViaList(opts);\n        // getUserRoot RPC doesn't return libraries, but listUserResources does;\n        // record at least \"listUserResources\" so future getUserRoot calls don't re-detect.\n        this.backendCapability = \"listUserResources\";\n        return libs;\n      } catch (err) {\n        if (!isUnimplementedError(err)) throw err;\n        this.backendCapability = \"legacy\";\n        return await this.getDataLibrariesViaLegacy();\n      }\n    }\n\n    // A server that supports getUserRoot definitely supports listUserResources.\n    if (this.backendCapability !== \"legacy\") {\n      return await this.getDataLibrariesViaList(opts);\n    }\n    return await this.getDataLibrariesViaLegacy();\n  }\n\n  /**\n   * Discovers shared resources of a given type granted to the user, as signed resource ids.\n   *\n   * The public, type-filtered form of {@link getDataLibrariesViaList}: it polls the\n   * `ListUserResources` gRPC stream and returns every `sharedResource` entry whose\n   * `resourceType.name` matches `resourceTypeName`. Matching is by name only — the\n   * version is ignored (permissive, survives schema bumps).\n   *\n   * gRPC-only: `ListUserResources` throws on a REST-connected client\n   * ({@link LLPlClient.listUserResources}), so callers on REST get a thrown error.\n   */\n  async listSharedResourcesByType(\n    resourceTypeName: string,\n    opts: { login?: string } = {},\n  ): Promise<SignedResourceId[]> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    const result: SignedResourceId[] = [];\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n      if (!sr.resourceType) continue;\n      if (sr.resourceType.name !== resourceTypeName) continue;\n      result.push(createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature)));\n    }\n    return result;\n  }\n\n  /**\n   * Enumerates the recipients of a single resource — the donor-side \"who did I\n   * share with\" view.\n   *\n   * Takes a signed, writable resource handle: the backend gates grant listing on a\n   * signed resource id with writable permission, so only the resource's owner can\n   * call it. An everyone-grant surfaces with `user` matching the backend's\n   * everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\");\n   * the caller maps that to \"*\".\n   *\n   * Runs over a read transaction ({@link PlTransaction.listGrants}), so it works on\n   * every wire protocol — including REST, where the standalone server-streaming\n   * `ListGrants` RPC has no binding.\n   */\n  async listGrants(resourceId: SignedResourceId): Promise<GrantEntry[]> {\n    const grants = await this.runTx(\"ListGrants\", false, NullSignedResourceId, (tx) =>\n      tx.listGrants(resourceId),\n    );\n    return grants.map((grant) => ({\n      user: grant.user,\n      writable: grant.permissions?.writable ?? false,\n      grantedBy: grant.grantedBy,\n      grantedAt: Number(grant.grantedAt),\n    }));\n  }\n\n  /**\n   * Lists the logins of users known to the server, for the recipient picker. A user becomes\n   * known on first login; provisioned users who have never logged in do not appear. gRPC-only\n   * (the underlying {@link LLPlClient.listUsers} has no REST binding) — throws on a\n   * REST-connected client, so callers gate on the `userListing:v1` capability.\n   */\n  async listUsers(): Promise<UserEntry[]> {\n    const users = await this.ll.listUsers();\n    return users.map((user) => ({ login: user.login }));\n  }\n\n  /**\n   * Deletes a user account: the record, every identity-index entry that resolves to it (its login,\n   * its email, and any alternative of either), every grant it holds, and its root resource — and\n   * with the root, everything still attached under it.\n   *\n   * Exists for the duplicate account one person can end up with — an identity that could not be\n   * matched across a provider cutover, or one minted before the backend started refusing two\n   * records for one identity. The spare record shows up wherever users are listed and its projects\n   * keep taking part in deduplication.\n   *\n   * Destructive and irreversible. Re-attach anything worth keeping to another user's root before\n   * calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller\n   * credentials; gRPC-only, like {@link listUsers}.\n   */\n  async deleteUser(login: string): Promise<UserDeletionReport> {\n    const resp = await this.ll.deleteUser(login);\n\n    return {\n      userRootId: resp.userRootId === 0n ? undefined : resp.userRootId,\n      userRootDeleted: resp.userRootDeleted,\n      revokedGrants: resp.revokedGrants,\n      removedIdentityIndexEntries: resp.removedIdentityIndexEntries,\n    };\n  }\n\n  private async getUserRootViaRpc(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaRpc(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaRpc(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const resp = await this.ll.getUserRoot({\n      login: opts.login,\n      createIfNotExists: opts.createIfNotExists,\n    });\n    if (resp.userRoot === undefined) {\n      if (!opts.createIfNotExists) return undefined;\n      throw new Error(\"getUserRoot returned no userRoot entry\");\n    }\n    return createSignedResourceId(\n      resp.userRoot.resourceId,\n      toResourceSignature(resp.userRoot.resourceSignature),\n    );\n  }\n\n  private async getUserRootViaList(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaList(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaList(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const responses = await this.ll.listUserResources({ login: opts.login, limit: 1 });\n    for (const msg of responses) {\n      if (msg.entry.oneofKind === \"userRoot\") {\n        return createSignedResourceId(\n          msg.entry.userRoot.resourceId,\n          toResourceSignature(msg.entry.userRoot.resourceSignature),\n        );\n      }\n    }\n\n    if (opts.createIfNotExists) {\n      throw new Error(\"listUserResources returned no userRoot entry\");\n    }\n\n    return undefined;\n  }\n\n  private async getDataLibrariesViaList(\n    opts: { login?: string } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    // Collect all LS/* shared resources, separating V1 and V2\n    const v1Entries: StorageInfo[] = [];\n    const v2ResourceIds: { resourceId: SignedResourceId; resourceType: ResourceType }[] = [];\n\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n\n      if (!sr.resourceType) continue;\n      const typeName = sr.resourceType.name;\n      const typeVersion = sr.resourceType.version;\n      if (!typeName.startsWith(LsStorageTypePrefix)) continue;\n\n      const rId = createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature));\n      const rType: ResourceType = { name: typeName, version: typeVersion };\n\n      if (typeVersion === \"2\") {\n        v2ResourceIds.push({ resourceId: rId, resourceType: rType });\n      } else {\n        // V1 or unknown version: derive storageId from type name\n        const storageId = typeName.substring(LsStorageTypePrefix.length);\n        v1Entries.push({\n          storageId,\n          storageName: storageId,\n          resourceId: rId,\n          resourceType: rType,\n        });\n      }\n    }\n\n    // Read V2 resource data in a single transaction\n    let v2Entries: StorageInfo[] = [];\n    if (v2ResourceIds.length > 0) {\n      v2Entries = await this.runTx(\n        \"ReadLsStorageV2Data\",\n        false,\n        NullSignedResourceId,\n        async (tx) => {\n          const entries: StorageInfo[] = [];\n          for (const { resourceId, resourceType } of v2ResourceIds) {\n            const rd = await tx.getResourceData(resourceId, false);\n            if (rd.data) {\n              const v2Data = JSON.parse(Buffer.from(rd.data).toString(\"utf-8\")) as LsStorageV2Data;\n              entries.push({\n                storageId: v2Data.storageID,\n                storageName: v2Data.storageName,\n                resourceId,\n                resourceType,\n              });\n            }\n          }\n          return entries;\n        },\n      );\n    }\n\n    const result = new Map<string, StorageInfo>();\n    for (const entry of [...v1Entries, ...v2Entries]) {\n      result.set(entry.storageId, entry);\n    }\n    return result;\n  }\n\n  private async getUserRootViaLegacy(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaLegacy(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaLegacy(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const login = opts.login ?? this.authUser;\n    const mainRootName =\n      login === null ? AnonymousClientRoot : createHash(\"sha256\").update(login).digest(\"hex\");\n\n    return await this.runTx(\"initialization\", true, NullSignedResourceId, async (tx) => {\n      if (await tx.checkResourceNameExists(mainRootName)) {\n        return await tx.getResourceByName(mainRootName);\n      }\n\n      if (!opts.createIfNotExists) {\n        return undefined;\n      }\n\n      const mainRoot = tx.createRoot(ClientRoot);\n      tx.setResourceName(mainRootName, mainRoot);\n      await tx.commit();\n      return await toGlobalResourceId(mainRoot);\n    });\n  }\n\n  private async getDataLibrariesViaLegacy(): Promise<ReadonlyMap<string, StorageInfo>> {\n    return await this.runTx(\"GetAvailableStorageIds\", false, NullSignedResourceId, async (tx) => {\n      const lsProviderId = await tx.getResourceByName(\"LSProvider\");\n      const provider = await tx.getResourceData(lsProviderId, true);\n\n      const result = new Map<string, StorageInfo>();\n      for (const field of provider.fields) {\n        if (field.type !== \"Dynamic\" || !isNotNullSignedResourceId(field.value)) continue;\n        if (!field.name.startsWith(LsProviderFieldPrefix)) continue;\n\n        const storageId = field.name.substring(LsProviderFieldPrefix.length);\n        result.set(storageId, {\n          storageId,\n          storageName: storageId,\n          resourceId: field.value,\n          resourceType: { name: `${LsStorageTypePrefix}${storageId}`, version: \"1\" },\n        });\n      }\n      return result;\n    });\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;;;;;;;;;;AA4E9B,IAAa,gBAAb,MAA2B;CAIN;CACA;CACD;CALlB;CAEA,YACE,IACA,OACA,UACA;EAHiB,KAAA,KAAA;EACA,KAAA,QAAA;EACD,KAAA,WAAA;CACf;CAeH,MAAM,YACJ,OAAwD,CAAC,GAClB;EACvC,IAAI,KAAK,sBAAsB,KAAA,GAC7B,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAE7C,OAAO,MAAM,KAAK,gBAAgB,KAAK,mBAAmB,IAAI;CAChE;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EAEvC,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC9C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC/C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,KAAK,oBAAoB;EACzB,OAAO,MAAM,KAAK,qBAAqB,IAAI;CAC7C;CAUA,MAAc,gBACZ,YACA,OAAwD,CAAC,GAClB;EACvC,QAAQ,YAAR;GACE,KAAK,eACH,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC1C,KAAK,qBACH,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC3C,KAAK,UACH,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAC/C;CACF;;;;;CAMA,MAAM,iBACJ,OAAgE,CAAC,GACtB;EAC3C,IAAI,KAAK,sBAAsB,KAAA,GAE7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,wBAAwB,IAAI;GAGpD,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAACA,eAAAA,qBAAqB,GAAG,GAAG,MAAM;GACtC,KAAK,oBAAoB;GACzB,OAAO,MAAM,KAAK,0BAA0B;EAC9C;EAIF,IAAI,KAAK,sBAAsB,UAC7B,OAAO,MAAM,KAAK,wBAAwB,IAAI;EAEhD,OAAO,MAAM,KAAK,0BAA0B;CAC9C;;;;;;;;;;;;CAaA,MAAM,0BACJ,kBACA,OAA2B,CAAC,GACC;EAC7B,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAEvE,MAAM,SAA6B,CAAC;EACpC,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GACrB,IAAI,CAAC,GAAG,cAAc;GACtB,IAAI,GAAG,aAAa,SAAS,kBAAkB;GAC/C,OAAO,KAAKC,cAAAA,uBAAuB,GAAG,YAAYC,cAAAA,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;EAC9F;EACA,OAAO;CACT;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,YAAqD;EAIpE,QAAO,MAHc,KAAK,MAAM,cAAc,OAAA,KAA8B,OAC1E,GAAG,WAAW,UAAU,CAC1B,EAAA,CACc,KAAK,WAAW;GAC5B,MAAM,MAAM;GACZ,UAAU,MAAM,aAAa,YAAY;GACzC,WAAW,MAAM;GACjB,WAAW,OAAO,MAAM,SAAS;EACnC,EAAE;CACJ;;;;;;;CAQA,MAAM,YAAkC;EAEtC,QAAO,MADa,KAAK,GAAG,UAAU,EAAA,CACzB,KAAK,UAAU,EAAE,OAAO,KAAK,MAAM,EAAE;CACpD;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,OAA4C;EAC3D,MAAM,OAAO,MAAM,KAAK,GAAG,WAAW,KAAK;EAE3C,OAAO;GACL,YAAY,KAAK,eAAe,KAAK,KAAA,IAAY,KAAK;GACtD,iBAAiB,KAAK;GACtB,eAAe,KAAK;GACpB,6BAA6B,KAAK;EACpC;CACF;CAUA,MAAc,kBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,OAAO,MAAM,KAAK,GAAG,YAAY;GACrC,OAAO,KAAK;GACZ,mBAAmB,KAAK;EAC1B,CAAC;EACD,IAAI,KAAK,aAAa,KAAA,GAAW;GAC/B,IAAI,CAAC,KAAK,mBAAmB,OAAO,KAAA;GACpC,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,OAAOD,cAAAA,uBACL,KAAK,SAAS,YACdC,cAAAA,oBAAoB,KAAK,SAAS,iBAAiB,CACrD;CACF;CAUA,MAAc,mBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB;GAAE,OAAO,KAAK;GAAO,OAAO;EAAE,CAAC;EACjF,KAAK,MAAM,OAAO,WAChB,IAAI,IAAI,MAAM,cAAc,YAC1B,OAAOD,cAAAA,uBACL,IAAI,MAAM,SAAS,YACnBC,cAAAA,oBAAoB,IAAI,MAAM,SAAS,iBAAiB,CAC1D;EAIJ,IAAI,KAAK,mBACP,MAAM,IAAI,MAAM,8CAA8C;CAIlE;CAEA,MAAc,wBACZ,OAA2B,CAAC,GACe;EAC3C,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAGvE,MAAM,YAA2B,CAAC;EAClC,MAAM,gBAAgF,CAAC;EAEvF,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GAErB,IAAI,CAAC,GAAG,cAAc;GACtB,MAAM,WAAW,GAAG,aAAa;GACjC,MAAM,cAAc,GAAG,aAAa;GACpC,IAAI,CAAC,SAAS,WAAW,mBAAmB,GAAG;GAE/C,MAAM,MAAMD,cAAAA,uBAAuB,GAAG,YAAYC,cAAAA,oBAAoB,GAAG,iBAAiB,CAAC;GAC3F,MAAM,QAAsB;IAAE,MAAM;IAAU,SAAS;GAAY;GAEnE,IAAI,gBAAgB,KAClB,cAAc,KAAK;IAAE,YAAY;IAAK,cAAc;GAAM,CAAC;QACtD;IAEL,MAAM,YAAY,SAAS,UAAU,CAA0B;IAC/D,UAAU,KAAK;KACb;KACA,aAAa;KACb,YAAY;KACZ,cAAc;IAChB,CAAC;GACH;EACF;EAGA,IAAI,YAA2B,CAAC;EAChC,IAAI,cAAc,SAAS,GACzB,YAAY,MAAM,KAAK,MACrB,uBACA,OAAA,IAEA,OAAO,OAAO;GACZ,MAAM,UAAyB,CAAC;GAChC,KAAK,MAAM,EAAE,YAAY,kBAAkB,eAAe;IACxD,MAAM,KAAK,MAAM,GAAG,gBAAgB,YAAY,KAAK;IACrD,IAAI,GAAG,MAAM;KACX,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;KAChE,QAAQ,KAAK;MACX,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB;MACA;KACF,CAAC;IACH;GACF;GACA,OAAO;EACT,CACF;EAGF,MAAM,yBAAS,IAAI,IAAyB;EAC5C,KAAK,MAAM,SAAS,CAAC,GAAG,WAAW,GAAG,SAAS,GAC7C,OAAO,IAAI,MAAM,WAAW,KAAK;EAEnC,OAAO;CACT;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,QAAQ,KAAK,SAAS,KAAK;EACjC,MAAM,eACJ,UAAU,OAAO,uBAAA,GAAA,YAAA,WAAA,CAAiC,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAExF,OAAO,MAAM,KAAK,MAAM,kBAAkB,MAAA,IAA4B,OAAO,OAAO;GAClF,IAAI,MAAM,GAAG,wBAAwB,YAAY,GAC/C,OAAO,MAAM,GAAG,kBAAkB,YAAY;GAGhD,IAAI,CAAC,KAAK,mBACR;GAGF,MAAM,WAAW,GAAG,WAAWC,WAAAA,UAAU;GACzC,GAAG,gBAAgB,cAAc,QAAQ;GACzC,MAAM,GAAG,OAAO;GAChB,OAAO,MAAMC,oBAAAA,mBAAmB,QAAQ;EAC1C,CAAC;CACH;CAEA,MAAc,4BAAuE;EACnF,OAAO,MAAM,KAAK,MAAM,0BAA0B,OAAA,IAA6B,OAAO,OAAO;GAC3F,MAAM,eAAe,MAAM,GAAG,kBAAkB,YAAY;GAC5D,MAAM,WAAW,MAAM,GAAG,gBAAgB,cAAc,IAAI;GAE5D,MAAM,yBAAS,IAAI,IAAyB;GAC5C,KAAK,MAAM,SAAS,SAAS,QAAQ;IACnC,IAAI,MAAM,SAAS,aAAa,CAACC,cAAAA,0BAA0B,MAAM,KAAK,GAAG;IACzE,IAAI,CAAC,MAAM,KAAK,WAAW,qBAAqB,GAAG;IAEnD,MAAM,YAAY,MAAM,KAAK,UAAU,CAA4B;IACnE,OAAO,IAAI,WAAW;KACpB;KACA,aAAa;KACb,YAAY,MAAM;KAClB,cAAc;MAAE,MAAM,GAAG,sBAAsB;MAAa,SAAS;KAAI;IAC3E,CAAC;GACH;GACA,OAAO;EACT,CAAC;CACH;AACF"}

package/dist/core/user_resources.d.ts

@@ -1,10 +1,9 @@
 import { OptionalSignedResourceId, ResourceType, SignedResourceId } from "./types.js";
 import { PlTransaction } from "./transaction.js";
 import { LLPlClient } from "./ll_client.js";
-
 //#region src/core/user_resources.d.ts
 /** One recipient of a resource, as returned by {@link UserResources.listGrants}. */
-interface GrantEntry {
+export interface GrantEntry {
   /** Login the grant targets. An everyone-grant surfaces here as the backend's
    *  everyone-sentinel — test with {@link isEveryoneUserLogin} (from "./transaction"); callers
    *  map it to "*". */
@@ -17,12 +16,25 @@ interface GrantEntry {
   readonly grantedAt: number;
 }
 /** One user known to the server, as returned by {@link UserResources.listUsers}. */
-interface UserEntry {
+export interface UserEntry {
   /** Stable identifier of the user; the grant target and `GetUserRoot` key. */
   readonly login: string;
 }
+/** What {@link UserResources.deleteUser} removed, so a caller can report it. */
+export interface UserDeletionReport {
+  /** Raw id of the root resource the user owned, or undefined when they had none. Unsigned —
+   *  the resource is gone, so this is for the audit line, not for further calls. */
+  readonly userRootId: bigint | undefined;
+  /** Whether that root resource was deleted. */
+  readonly userRootDeleted: boolean;
+  /** Grants revoked, the user-root self-grant included. */
+  readonly revokedGrants: number;
+  /** Identity-index entries removed — one per value that resolved to the account: its login,
+   *  its email, and any alternative of either. */
+  readonly removedIdentityIndexEntries: number;
+}
 /** Information about a single data library (LS storage). */
-interface StorageInfo {
+export interface StorageInfo {
   /** Machine-stable identifier, e.g. "library". Used for filtering and map keys. */
   readonly storageId: string;
   /** Human-readable display name. For V1/legacy equals storageId; for V2 from resource JSON data. */
@@ -36,7 +48,7 @@ interface StorageInfo {
  * Callback type for running transactions. Matches PlClient._withTx signature
  * so the index can run transactions before PlClient is fully initialized.
  */
-type TxRunner = <T>(name: string, writable: boolean, clientRoot: OptionalSignedResourceId, body: (tx: PlTransaction) => Promise<T>) => Promise<T>;
+export type TxRunner = <T>(name: string, writable: boolean, clientRoot: OptionalSignedResourceId, body: (tx: PlTransaction) => Promise<T>) => Promise<T>;
 /**
  * Abstracts user resource discovery with backward compatibility.
  *
@@ -46,7 +58,7 @@ type TxRunner = <T>(name: string, writable: boolean, clientRoot: OptionalSignedR
  * 2. listUserResources RPC (streams all resources, picks userRoot)
  * 3. Named resource lookup/creation via transaction (legacy)
  */
-declare class UserResources {
+export declare class UserResources {
   private readonly ll;
   private readonly runTx;
   readonly authUser: string | null;
@@ -114,6 +126,21 @@ declare class UserResources {
    * REST-connected client, so callers gate on the `userListing:v1` capability.
    */
   listUsers(): Promise<UserEntry[]>;
+  /**
+   * Deletes a user account: the record, every identity-index entry that resolves to it (its login,
+   * its email, and any alternative of either), every grant it holds, and its root resource — and
+   * with the root, everything still attached under it.
+   *
+   * Exists for the duplicate account one person can end up with — an identity that could not be
+   * matched across a provider cutover, or one minted before the backend started refusing two
+   * records for one identity. The spare record shows up wherever users are listed and its projects
+   * keep taking part in deduplication.
+   *
+   * Destructive and irreversible. Re-attach anything worth keeping to another user's root before
+   * calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller
+   * credentials; gRPC-only, like {@link listUsers}.
+   */
+  deleteUser(login: string): Promise<UserDeletionReport>;
   private getUserRootViaRpc;
   private getUserRootViaList;
   private getDataLibrariesViaList;
@@ -121,5 +148,4 @@ declare class UserResources {
   private getDataLibrariesViaLegacy;
 }
 //#endregion
-export { GrantEntry, StorageInfo, TxRunner, UserEntry, UserResources };
 //# sourceMappingURL=user_resources.d.ts.map

package/dist/core/user_resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user_resources.d.ts","names":[],"sources":["../../src/core/user_resources.ts"],"mappings":";;;;;;UAmBiB,UAAA;EAAA;;;EAAA,SAIN,IAAA;EAAA;EAAA,SAEA,QAAA;EAEA;EAAA,SAAA,SAAA;EAES;EAAA,SAAT,SAAA;AAAA;;UAIM,SAAA;EAED;EAAA,SAAL,KAAK;AAAA;;UAIC,WAAA;EAQoB;EAAA,SAN1B,SAAA;EAEA;EAAA,SAAA,WAAA;EAEY;EAAA,SAAZ,UAAA,EAAY,gBAAA;EAEE;EAAA,SAAd,YAAA,EAAc,YAAY;AAAA;AAarC;;;;AAAA,KAAY,QAAA,OACV,IAAA,UACA,QAAA,WACA,UAAA,EAAY,wBAAA,EACZ,IAAA,GAAO,EAAA,EAAI,aAAA,KAAkB,OAAA,CAAQ,CAAA,MAClC,OAAA,CAAQ,CAAA;;;;;;;;;;cAaA,aAAA;EAAA,iBAIQ,EAAA;EAAA,iBACA,KAAA;EAAA,SACD,QAAA;EAAA,QALV,iBAAA;cAGW,EAAA,EAAI,UAAA,EACJ,KAAA,EAAO,QAAA,EACR,QAAA;EApBlB;;;;AACY;AAad;;;EAiBQ,WAAA,CAAY,IAAA;IAAQ,KAAA;IAAgB,iBAAA;EAAA,IAA4B,OAAA,CAAQ,gBAAA;EACxE,WAAA,CAAY,IAAA;IAChB,KAAA;IACA,iBAAA;EAAA,IACE,OAAA,CAAQ,gBAAA;EAAA,QAUE,oBAAA;EAAA,QAkCA,eAAA;EAiEX;;;;EAvCG,gBAAA,CACJ,IAAA;IAAQ,KAAA;IAAgB,yBAAA;EAAA,IACvB,OAAA,CAAQ,WAAA,SAAoB,WAAA;EAzFZ;;;;;;;;;;;EA2Hb,yBAAA,CACJ,gBAAA,UACA,IAAA;IAAQ,KAAA;EAAA,IACP,OAAA,CAAQ,gBAAA;EAjH2D;;;;;;;;;;;;;;EA6IhE,UAAA,CAAW,UAAA,EAAY,gBAAA,GAAmB,OAAA,CAAQ,UAAA;EAjE7C;;;;;;EAmFL,SAAA,IAAa,OAAA,CAAQ,SAAA;EAAA,QAKb,iBAAA;EAAA,QAyBA,kBAAA;EAAA,QA4BA,uBAAA;EAAA,QAoEA,oBAAA;EAAA,QA+BA,yBAAA;AAAA"}
+{"version":3,"file":"user_resources.d.ts","names":[],"sources":["../../src/core/user_resources.ts"],"mappings":";;;;;iBAmBiB;;;;WAIN;;WAEA;;WAEA;;WAEA;;;iBAIM;;WAEN;;;iBAIM;;;WAGN;;WAEA;;WAEA;;;WAGA;;;iBAIM;;WAEN;;WAEA;;WAEA,YAAY;;WAEZ,cAAc;;;;;;YAab,YAAY,GACtB,cACA,mBACA,YAAY,0BACZ,OAAO,IAAI,kBAAkB,QAAQ,OAClC,QAAQ;;;;;;;;;;qBAaA;mBAIQ;mBACA;WACD;UALV;EAER,YACmB,IAAI,YACJ,OAAO,UACR;;;;;;;;;EAWZ,YAAY;IAAQ;IAAgB;MAA4B,QAAQ;EACxE,YAAY;IAChB;IACA;MACE,QAAQ;UAUE;UAkCA;;;;;EA0BR,iBACJ;IAAQ;IAAgB;MACvB,QAAQ,oBAAoB;;;;;;;;;;;;EAkCzB,0BACJ,0BACA;IAAQ;MACP,QAAQ;;;;;;;;;;;;;;;EA4BL,WAAW,YAAY,mBAAmB,QAAQ;;;;;;;EAkBlD,aAAa,QAAQ;;;;;;;;;;;;;;;EAmBrB,WAAW,gBAAgB,QAAQ;UAW3B;UAyBA;UA4BA;UAoEA;UA+BA"}

package/dist/core/user_resources.js

@@ -126,6 +126,29 @@ var UserResources = class {
 	async listUsers() {
 		return (await this.ll.listUsers()).map((user) => ({ login: user.login }));
 	}
+	/**
+	* Deletes a user account: the record, every identity-index entry that resolves to it (its login,
+	* its email, and any alternative of either), every grant it holds, and its root resource — and
+	* with the root, everything still attached under it.
+	*
+	* Exists for the duplicate account one person can end up with — an identity that could not be
+	* matched across a provider cutover, or one minted before the backend started refusing two
+	* records for one identity. The spare record shows up wherever users are listed and its projects
+	* keep taking part in deduplication.
+	*
+	* Destructive and irreversible. Re-attach anything worth keeping to another user's root before
+	* calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller
+	* credentials; gRPC-only, like {@link listUsers}.
+	*/
+	async deleteUser(login) {
+		const resp = await this.ll.deleteUser(login);
+		return {
+			userRootId: resp.userRootId === 0n ? void 0 : resp.userRootId,
+			userRootDeleted: resp.userRootDeleted,
+			revokedGrants: resp.revokedGrants,
+			removedIdentityIndexEntries: resp.removedIdentityIndexEntries
+		};
+	}
 	async getUserRootViaRpc(opts = {}) {
 		const resp = await this.ll.getUserRoot({
 			login: opts.login,

package/dist/core/user_resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"user_resources.js","names":[],"sources":["../../src/core/user_resources.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { LLPlClient } from \"./ll_client\";\nimport type { PlTransaction } from \"./transaction\";\nimport { toGlobalResourceId } from \"./transaction\";\nimport type { OptionalSignedResourceId, SignedResourceId, ResourceType } from \"./types\";\nimport {\n  createSignedResourceId,\n  isNotNullSignedResourceId,\n  NullSignedResourceId,\n  toResourceSignature,\n} from \"./types\";\nimport { isUnimplementedError } from \"./errors\";\nimport { ClientRoot } from \"../helpers/pl\";\n\nconst AnonymousClientRoot = \"AnonymousRoot\";\nconst LsStorageTypePrefix = \"LS/\"; // implements ls API in particular storage\nconst LsProviderFieldPrefix = \"storage/\"; // provides access to storages list\n\n/** One recipient of a resource, as returned by {@link UserResources.listGrants}. */\nexport interface GrantEntry {\n  /** Login the grant targets. An everyone-grant surfaces here as the backend's\n   *  everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\"); callers\n   *  map it to \"*\". */\n  readonly user: string;\n  /** True for a writable grant (copy / collaboration), false for read-only. */\n  readonly writable: boolean;\n  /** Login of the user who created the grant. */\n  readonly grantedBy: string;\n  /** When the grant was created (ms epoch). */\n  readonly grantedAt: number;\n}\n\n/** One user known to the server, as returned by {@link UserResources.listUsers}. */\nexport interface UserEntry {\n  /** Stable identifier of the user; the grant target and `GetUserRoot` key. */\n  readonly login: string;\n}\n\n/** Information about a single data library (LS storage). */\nexport interface StorageInfo {\n  /** Machine-stable identifier, e.g. \"library\". Used for filtering and map keys. */\n  readonly storageId: string;\n  /** Human-readable display name. For V1/legacy equals storageId; for V2 from resource JSON data. */\n  readonly storageName: string;\n  /** Signed resource ID for this storage resource. */\n  readonly resourceId: SignedResourceId;\n  /** Full resource type including correct version (\"1\" or \"2\"). */\n  readonly resourceType: ResourceType;\n}\n\n/** V2 LsStorage resource JSON data shape (contract with backend). */\ninterface LsStorageV2Data {\n  storageName: string;\n  storageID: string;\n}\n\n/**\n * Callback type for running transactions. Matches PlClient._withTx signature\n * so the index can run transactions before PlClient is fully initialized.\n */\nexport type TxRunner = <T>(\n  name: string,\n  writable: boolean,\n  clientRoot: OptionalSignedResourceId,\n  body: (tx: PlTransaction) => Promise<T>,\n) => Promise<T>;\n\ntype BackendCapability = \"getUserRoot\" | \"listUserResources\" | \"legacy\";\n\n/**\n * Abstracts user resource discovery with backward compatibility.\n *\n * Detects backend capability on the first getUserRoot() call and remembers\n * the result. Three-tier fallback:\n * 1. getUserRoot RPC (newest, supports createIfNotExists)\n * 2. listUserResources RPC (streams all resources, picks userRoot)\n * 3. Named resource lookup/creation via transaction (legacy)\n */\nexport class UserResources {\n  private backendCapability: BackendCapability | undefined;\n\n  constructor(\n    private readonly ll: LLPlClient,\n    private readonly runTx: TxRunner,\n    public readonly authUser: string | null,\n  ) {}\n\n  /**\n   * Returns the user's root resource ID.\n   *\n   * On first call, detects backend capability by trying methods in order:\n   * 1. getUserRoot RPC (newest)\n   * 2. listUserResources RPC\n   * 3. Named resource lookup/creation via transaction (legacy)\n   */\n  async getUserRoot(opts: { login?: string; createIfNotExists: true }): Promise<SignedResourceId>;\n  async getUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    if (this.backendCapability === undefined) {\n      return await this.detectAndGetUserRoot(opts);\n    }\n    return await this.getUserRootWith(this.backendCapability, opts);\n  }\n\n  private async detectAndGetUserRoot(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async detectAndGetUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async detectAndGetUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    // 1. Try getUserRoot RPC\n    try {\n      const root = await this.getUserRootViaRpc(opts);\n      this.backendCapability = \"getUserRoot\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 2. Try listUserResources\n    try {\n      const root = await this.getUserRootViaList(opts);\n      this.backendCapability = \"listUserResources\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 3. Legacy fallback\n    this.backendCapability = \"legacy\";\n    return await this.getUserRootViaLegacy(opts);\n  }\n\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists: true },\n  ): Promise<SignedResourceId>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts?: { login?: string; createIfNotExists?: boolean },\n  ): Promise<SignedResourceId | undefined>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    switch (capability) {\n      case \"getUserRoot\":\n        return await this.getUserRootViaRpc(opts);\n      case \"listUserResources\":\n        return await this.getUserRootViaList(opts);\n      case \"legacy\":\n        return await this.getUserRootViaLegacy(opts);\n    }\n  }\n\n  /**\n   * Returns all data libraries the user has access to.\n   * Always fetches fresh from the server (no caching).\n   */\n  async getDataLibraries(\n    opts: { login?: string; createUserRootIfNotExists?: boolean } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    if (this.backendCapability === undefined) {\n      // First call — detect backend capability\n      try {\n        const libs = await this.getDataLibrariesViaList(opts);\n        // getUserRoot RPC doesn't return libraries, but listUserResources does;\n        // record at least \"listUserResources\" so future getUserRoot calls don't re-detect.\n        this.backendCapability = \"listUserResources\";\n        return libs;\n      } catch (err) {\n        if (!isUnimplementedError(err)) throw err;\n        this.backendCapability = \"legacy\";\n        return await this.getDataLibrariesViaLegacy();\n      }\n    }\n\n    // A server that supports getUserRoot definitely supports listUserResources.\n    if (this.backendCapability !== \"legacy\") {\n      return await this.getDataLibrariesViaList(opts);\n    }\n    return await this.getDataLibrariesViaLegacy();\n  }\n\n  /**\n   * Discovers shared resources of a given type granted to the user, as signed resource ids.\n   *\n   * The public, type-filtered form of {@link getDataLibrariesViaList}: it polls the\n   * `ListUserResources` gRPC stream and returns every `sharedResource` entry whose\n   * `resourceType.name` matches `resourceTypeName`. Matching is by name only — the\n   * version is ignored (permissive, survives schema bumps).\n   *\n   * gRPC-only: `ListUserResources` throws on a REST-connected client\n   * ({@link LLPlClient.listUserResources}), so callers on REST get a thrown error.\n   */\n  async listSharedResourcesByType(\n    resourceTypeName: string,\n    opts: { login?: string } = {},\n  ): Promise<SignedResourceId[]> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    const result: SignedResourceId[] = [];\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n      if (!sr.resourceType) continue;\n      if (sr.resourceType.name !== resourceTypeName) continue;\n      result.push(createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature)));\n    }\n    return result;\n  }\n\n  /**\n   * Enumerates the recipients of a single resource — the donor-side \"who did I\n   * share with\" view.\n   *\n   * Takes a signed, writable resource handle: the backend gates grant listing on a\n   * signed resource id with writable permission, so only the resource's owner can\n   * call it. An everyone-grant surfaces with `user` matching the backend's\n   * everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\");\n   * the caller maps that to \"*\".\n   *\n   * Runs over a read transaction ({@link PlTransaction.listGrants}), so it works on\n   * every wire protocol — including REST, where the standalone server-streaming\n   * `ListGrants` RPC has no binding.\n   */\n  async listGrants(resourceId: SignedResourceId): Promise<GrantEntry[]> {\n    const grants = await this.runTx(\"ListGrants\", false, NullSignedResourceId, (tx) =>\n      tx.listGrants(resourceId),\n    );\n    return grants.map((grant) => ({\n      user: grant.user,\n      writable: grant.permissions?.writable ?? false,\n      grantedBy: grant.grantedBy,\n      grantedAt: Number(grant.grantedAt),\n    }));\n  }\n\n  /**\n   * Lists the logins of users known to the server, for the recipient picker. A user becomes\n   * known on first login; provisioned users who have never logged in do not appear. gRPC-only\n   * (the underlying {@link LLPlClient.listUsers} has no REST binding) — throws on a\n   * REST-connected client, so callers gate on the `userListing:v1` capability.\n   */\n  async listUsers(): Promise<UserEntry[]> {\n    const users = await this.ll.listUsers();\n    return users.map((user) => ({ login: user.login }));\n  }\n\n  private async getUserRootViaRpc(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaRpc(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaRpc(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const resp = await this.ll.getUserRoot({\n      login: opts.login,\n      createIfNotExists: opts.createIfNotExists,\n    });\n    if (resp.userRoot === undefined) {\n      if (!opts.createIfNotExists) return undefined;\n      throw new Error(\"getUserRoot returned no userRoot entry\");\n    }\n    return createSignedResourceId(\n      resp.userRoot.resourceId,\n      toResourceSignature(resp.userRoot.resourceSignature),\n    );\n  }\n\n  private async getUserRootViaList(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaList(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaList(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const responses = await this.ll.listUserResources({ login: opts.login, limit: 1 });\n    for (const msg of responses) {\n      if (msg.entry.oneofKind === \"userRoot\") {\n        return createSignedResourceId(\n          msg.entry.userRoot.resourceId,\n          toResourceSignature(msg.entry.userRoot.resourceSignature),\n        );\n      }\n    }\n\n    if (opts.createIfNotExists) {\n      throw new Error(\"listUserResources returned no userRoot entry\");\n    }\n\n    return undefined;\n  }\n\n  private async getDataLibrariesViaList(\n    opts: { login?: string } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    // Collect all LS/* shared resources, separating V1 and V2\n    const v1Entries: StorageInfo[] = [];\n    const v2ResourceIds: { resourceId: SignedResourceId; resourceType: ResourceType }[] = [];\n\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n\n      if (!sr.resourceType) continue;\n      const typeName = sr.resourceType.name;\n      const typeVersion = sr.resourceType.version;\n      if (!typeName.startsWith(LsStorageTypePrefix)) continue;\n\n      const rId = createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature));\n      const rType: ResourceType = { name: typeName, version: typeVersion };\n\n      if (typeVersion === \"2\") {\n        v2ResourceIds.push({ resourceId: rId, resourceType: rType });\n      } else {\n        // V1 or unknown version: derive storageId from type name\n        const storageId = typeName.substring(LsStorageTypePrefix.length);\n        v1Entries.push({\n          storageId,\n          storageName: storageId,\n          resourceId: rId,\n          resourceType: rType,\n        });\n      }\n    }\n\n    // Read V2 resource data in a single transaction\n    let v2Entries: StorageInfo[] = [];\n    if (v2ResourceIds.length > 0) {\n      v2Entries = await this.runTx(\n        \"ReadLsStorageV2Data\",\n        false,\n        NullSignedResourceId,\n        async (tx) => {\n          const entries: StorageInfo[] = [];\n          for (const { resourceId, resourceType } of v2ResourceIds) {\n            const rd = await tx.getResourceData(resourceId, false);\n            if (rd.data) {\n              const v2Data = JSON.parse(Buffer.from(rd.data).toString(\"utf-8\")) as LsStorageV2Data;\n              entries.push({\n                storageId: v2Data.storageID,\n                storageName: v2Data.storageName,\n                resourceId,\n                resourceType,\n              });\n            }\n          }\n          return entries;\n        },\n      );\n    }\n\n    const result = new Map<string, StorageInfo>();\n    for (const entry of [...v1Entries, ...v2Entries]) {\n      result.set(entry.storageId, entry);\n    }\n    return result;\n  }\n\n  private async getUserRootViaLegacy(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaLegacy(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaLegacy(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const login = opts.login ?? this.authUser;\n    const mainRootName =\n      login === null ? AnonymousClientRoot : createHash(\"sha256\").update(login).digest(\"hex\");\n\n    return await this.runTx(\"initialization\", true, NullSignedResourceId, async (tx) => {\n      if (await tx.checkResourceNameExists(mainRootName)) {\n        return await tx.getResourceByName(mainRootName);\n      }\n\n      if (!opts.createIfNotExists) {\n        return undefined;\n      }\n\n      const mainRoot = tx.createRoot(ClientRoot);\n      tx.setResourceName(mainRootName, mainRoot);\n      await tx.commit();\n      return await toGlobalResourceId(mainRoot);\n    });\n  }\n\n  private async getDataLibrariesViaLegacy(): Promise<ReadonlyMap<string, StorageInfo>> {\n    return await this.runTx(\"GetAvailableStorageIds\", false, NullSignedResourceId, async (tx) => {\n      const lsProviderId = await tx.getResourceByName(\"LSProvider\");\n      const provider = await tx.getResourceData(lsProviderId, true);\n\n      const result = new Map<string, StorageInfo>();\n      for (const field of provider.fields) {\n        if (field.type !== \"Dynamic\" || !isNotNullSignedResourceId(field.value)) continue;\n        if (!field.name.startsWith(LsProviderFieldPrefix)) continue;\n\n        const storageId = field.name.substring(LsProviderFieldPrefix.length);\n        result.set(storageId, {\n          storageId,\n          storageName: storageId,\n          resourceId: field.value,\n          resourceType: { name: `${LsStorageTypePrefix}${storageId}`, version: \"1\" },\n        });\n      }\n      return result;\n    });\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;;;;;;;;;;AA8D9B,IAAa,gBAAb,MAA2B;CAIN;CACA;CACD;CALlB;CAEA,YACE,IACA,OACA,UACA;EAHiB,KAAA,KAAA;EACA,KAAA,QAAA;EACD,KAAA,WAAA;CACf;CAeH,MAAM,YACJ,OAAwD,CAAC,GAClB;EACvC,IAAI,KAAK,sBAAsB,KAAA,GAC7B,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAE7C,OAAO,MAAM,KAAK,gBAAgB,KAAK,mBAAmB,IAAI;CAChE;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EAEvC,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC9C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC/C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,KAAK,oBAAoB;EACzB,OAAO,MAAM,KAAK,qBAAqB,IAAI;CAC7C;CAUA,MAAc,gBACZ,YACA,OAAwD,CAAC,GAClB;EACvC,QAAQ,YAAR;GACE,KAAK,eACH,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC1C,KAAK,qBACH,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC3C,KAAK,UACH,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAC/C;CACF;;;;;CAMA,MAAM,iBACJ,OAAgE,CAAC,GACtB;EAC3C,IAAI,KAAK,sBAAsB,KAAA,GAE7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,wBAAwB,IAAI;GAGpD,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;GACtC,KAAK,oBAAoB;GACzB,OAAO,MAAM,KAAK,0BAA0B;EAC9C;EAIF,IAAI,KAAK,sBAAsB,UAC7B,OAAO,MAAM,KAAK,wBAAwB,IAAI;EAEhD,OAAO,MAAM,KAAK,0BAA0B;CAC9C;;;;;;;;;;;;CAaA,MAAM,0BACJ,kBACA,OAA2B,CAAC,GACC;EAC7B,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAEvE,MAAM,SAA6B,CAAC;EACpC,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GACrB,IAAI,CAAC,GAAG,cAAc;GACtB,IAAI,GAAG,aAAa,SAAS,kBAAkB;GAC/C,OAAO,KAAK,uBAAuB,GAAG,YAAY,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;EAC9F;EACA,OAAO;CACT;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,YAAqD;EAIpE,QAAO,MAHc,KAAK,MAAM,cAAc,OAAA,KAA8B,OAC1E,GAAG,WAAW,UAAU,CAC1B,EAAA,CACc,KAAK,WAAW;GAC5B,MAAM,MAAM;GACZ,UAAU,MAAM,aAAa,YAAY;GACzC,WAAW,MAAM;GACjB,WAAW,OAAO,MAAM,SAAS;EACnC,EAAE;CACJ;;;;;;;CAQA,MAAM,YAAkC;EAEtC,QAAO,MADa,KAAK,GAAG,UAAU,EAAA,CACzB,KAAK,UAAU,EAAE,OAAO,KAAK,MAAM,EAAE;CACpD;CAUA,MAAc,kBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,OAAO,MAAM,KAAK,GAAG,YAAY;GACrC,OAAO,KAAK;GACZ,mBAAmB,KAAK;EAC1B,CAAC;EACD,IAAI,KAAK,aAAa,KAAA,GAAW;GAC/B,IAAI,CAAC,KAAK,mBAAmB,OAAO,KAAA;GACpC,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,OAAO,uBACL,KAAK,SAAS,YACd,oBAAoB,KAAK,SAAS,iBAAiB,CACrD;CACF;CAUA,MAAc,mBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB;GAAE,OAAO,KAAK;GAAO,OAAO;EAAE,CAAC;EACjF,KAAK,MAAM,OAAO,WAChB,IAAI,IAAI,MAAM,cAAc,YAC1B,OAAO,uBACL,IAAI,MAAM,SAAS,YACnB,oBAAoB,IAAI,MAAM,SAAS,iBAAiB,CAC1D;EAIJ,IAAI,KAAK,mBACP,MAAM,IAAI,MAAM,8CAA8C;CAIlE;CAEA,MAAc,wBACZ,OAA2B,CAAC,GACe;EAC3C,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAGvE,MAAM,YAA2B,CAAC;EAClC,MAAM,gBAAgF,CAAC;EAEvF,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GAErB,IAAI,CAAC,GAAG,cAAc;GACtB,MAAM,WAAW,GAAG,aAAa;GACjC,MAAM,cAAc,GAAG,aAAa;GACpC,IAAI,CAAC,SAAS,WAAW,mBAAmB,GAAG;GAE/C,MAAM,MAAM,uBAAuB,GAAG,YAAY,oBAAoB,GAAG,iBAAiB,CAAC;GAC3F,MAAM,QAAsB;IAAE,MAAM;IAAU,SAAS;GAAY;GAEnE,IAAI,gBAAgB,KAClB,cAAc,KAAK;IAAE,YAAY;IAAK,cAAc;GAAM,CAAC;QACtD;IAEL,MAAM,YAAY,SAAS,UAAU,CAA0B;IAC/D,UAAU,KAAK;KACb;KACA,aAAa;KACb,YAAY;KACZ,cAAc;IAChB,CAAC;GACH;EACF;EAGA,IAAI,YAA2B,CAAC;EAChC,IAAI,cAAc,SAAS,GACzB,YAAY,MAAM,KAAK,MACrB,uBACA,OAAA,IAEA,OAAO,OAAO;GACZ,MAAM,UAAyB,CAAC;GAChC,KAAK,MAAM,EAAE,YAAY,kBAAkB,eAAe;IACxD,MAAM,KAAK,MAAM,GAAG,gBAAgB,YAAY,KAAK;IACrD,IAAI,GAAG,MAAM;KACX,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;KAChE,QAAQ,KAAK;MACX,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB;MACA;KACF,CAAC;IACH;GACF;GACA,OAAO;EACT,CACF;EAGF,MAAM,yBAAS,IAAI,IAAyB;EAC5C,KAAK,MAAM,SAAS,CAAC,GAAG,WAAW,GAAG,SAAS,GAC7C,OAAO,IAAI,MAAM,WAAW,KAAK;EAEnC,OAAO;CACT;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,QAAQ,KAAK,SAAS,KAAK;EACjC,MAAM,eACJ,UAAU,OAAO,sBAAsB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAExF,OAAO,MAAM,KAAK,MAAM,kBAAkB,MAAA,IAA4B,OAAO,OAAO;GAClF,IAAI,MAAM,GAAG,wBAAwB,YAAY,GAC/C,OAAO,MAAM,GAAG,kBAAkB,YAAY;GAGhD,IAAI,CAAC,KAAK,mBACR;GAGF,MAAM,WAAW,GAAG,WAAW,UAAU;GACzC,GAAG,gBAAgB,cAAc,QAAQ;GACzC,MAAM,GAAG,OAAO;GAChB,OAAO,MAAM,mBAAmB,QAAQ;EAC1C,CAAC;CACH;CAEA,MAAc,4BAAuE;EACnF,OAAO,MAAM,KAAK,MAAM,0BAA0B,OAAA,IAA6B,OAAO,OAAO;GAC3F,MAAM,eAAe,MAAM,GAAG,kBAAkB,YAAY;GAC5D,MAAM,WAAW,MAAM,GAAG,gBAAgB,cAAc,IAAI;GAE5D,MAAM,yBAAS,IAAI,IAAyB;GAC5C,KAAK,MAAM,SAAS,SAAS,QAAQ;IACnC,IAAI,MAAM,SAAS,aAAa,CAAC,0BAA0B,MAAM,KAAK,GAAG;IACzE,IAAI,CAAC,MAAM,KAAK,WAAW,qBAAqB,GAAG;IAEnD,MAAM,YAAY,MAAM,KAAK,UAAU,CAA4B;IACnE,OAAO,IAAI,WAAW;KACpB;KACA,aAAa;KACb,YAAY,MAAM;KAClB,cAAc;MAAE,MAAM,GAAG,sBAAsB;MAAa,SAAS;KAAI;IAC3E,CAAC;GACH;GACA,OAAO;EACT,CAAC;CACH;AACF"}
+{"version":3,"file":"user_resources.js","names":[],"sources":["../../src/core/user_resources.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { LLPlClient } from \"./ll_client\";\nimport type { PlTransaction } from \"./transaction\";\nimport { toGlobalResourceId } from \"./transaction\";\nimport type { OptionalSignedResourceId, SignedResourceId, ResourceType } from \"./types\";\nimport {\n  createSignedResourceId,\n  isNotNullSignedResourceId,\n  NullSignedResourceId,\n  toResourceSignature,\n} from \"./types\";\nimport { isUnimplementedError } from \"./errors\";\nimport { ClientRoot } from \"../helpers/pl\";\n\nconst AnonymousClientRoot = \"AnonymousRoot\";\nconst LsStorageTypePrefix = \"LS/\"; // implements ls API in particular storage\nconst LsProviderFieldPrefix = \"storage/\"; // provides access to storages list\n\n/** One recipient of a resource, as returned by {@link UserResources.listGrants}. */\nexport interface GrantEntry {\n  /** Login the grant targets. An everyone-grant surfaces here as the backend's\n   *  everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\"); callers\n   *  map it to \"*\". */\n  readonly user: string;\n  /** True for a writable grant (copy / collaboration), false for read-only. */\n  readonly writable: boolean;\n  /** Login of the user who created the grant. */\n  readonly grantedBy: string;\n  /** When the grant was created (ms epoch). */\n  readonly grantedAt: number;\n}\n\n/** One user known to the server, as returned by {@link UserResources.listUsers}. */\nexport interface UserEntry {\n  /** Stable identifier of the user; the grant target and `GetUserRoot` key. */\n  readonly login: string;\n}\n\n/** What {@link UserResources.deleteUser} removed, so a caller can report it. */\nexport interface UserDeletionReport {\n  /** Raw id of the root resource the user owned, or undefined when they had none. Unsigned —\n   *  the resource is gone, so this is for the audit line, not for further calls. */\n  readonly userRootId: bigint | undefined;\n  /** Whether that root resource was deleted. */\n  readonly userRootDeleted: boolean;\n  /** Grants revoked, the user-root self-grant included. */\n  readonly revokedGrants: number;\n  /** Identity-index entries removed — one per value that resolved to the account: its login,\n   *  its email, and any alternative of either. */\n  readonly removedIdentityIndexEntries: number;\n}\n\n/** Information about a single data library (LS storage). */\nexport interface StorageInfo {\n  /** Machine-stable identifier, e.g. \"library\". Used for filtering and map keys. */\n  readonly storageId: string;\n  /** Human-readable display name. For V1/legacy equals storageId; for V2 from resource JSON data. */\n  readonly storageName: string;\n  /** Signed resource ID for this storage resource. */\n  readonly resourceId: SignedResourceId;\n  /** Full resource type including correct version (\"1\" or \"2\"). */\n  readonly resourceType: ResourceType;\n}\n\n/** V2 LsStorage resource JSON data shape (contract with backend). */\ninterface LsStorageV2Data {\n  storageName: string;\n  storageID: string;\n}\n\n/**\n * Callback type for running transactions. Matches PlClient._withTx signature\n * so the index can run transactions before PlClient is fully initialized.\n */\nexport type TxRunner = <T>(\n  name: string,\n  writable: boolean,\n  clientRoot: OptionalSignedResourceId,\n  body: (tx: PlTransaction) => Promise<T>,\n) => Promise<T>;\n\ntype BackendCapability = \"getUserRoot\" | \"listUserResources\" | \"legacy\";\n\n/**\n * Abstracts user resource discovery with backward compatibility.\n *\n * Detects backend capability on the first getUserRoot() call and remembers\n * the result. Three-tier fallback:\n * 1. getUserRoot RPC (newest, supports createIfNotExists)\n * 2. listUserResources RPC (streams all resources, picks userRoot)\n * 3. Named resource lookup/creation via transaction (legacy)\n */\nexport class UserResources {\n  private backendCapability: BackendCapability | undefined;\n\n  constructor(\n    private readonly ll: LLPlClient,\n    private readonly runTx: TxRunner,\n    public readonly authUser: string | null,\n  ) {}\n\n  /**\n   * Returns the user's root resource ID.\n   *\n   * On first call, detects backend capability by trying methods in order:\n   * 1. getUserRoot RPC (newest)\n   * 2. listUserResources RPC\n   * 3. Named resource lookup/creation via transaction (legacy)\n   */\n  async getUserRoot(opts: { login?: string; createIfNotExists: true }): Promise<SignedResourceId>;\n  async getUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  async getUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    if (this.backendCapability === undefined) {\n      return await this.detectAndGetUserRoot(opts);\n    }\n    return await this.getUserRootWith(this.backendCapability, opts);\n  }\n\n  private async detectAndGetUserRoot(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async detectAndGetUserRoot(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async detectAndGetUserRoot(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    // 1. Try getUserRoot RPC\n    try {\n      const root = await this.getUserRootViaRpc(opts);\n      this.backendCapability = \"getUserRoot\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 2. Try listUserResources\n    try {\n      const root = await this.getUserRootViaList(opts);\n      this.backendCapability = \"listUserResources\";\n      return root;\n    } catch (err) {\n      if (!isUnimplementedError(err)) throw err;\n    }\n\n    // 3. Legacy fallback\n    this.backendCapability = \"legacy\";\n    return await this.getUserRootViaLegacy(opts);\n  }\n\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists: true },\n  ): Promise<SignedResourceId>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts?: { login?: string; createIfNotExists?: boolean },\n  ): Promise<SignedResourceId | undefined>;\n  private async getUserRootWith(\n    capability: BackendCapability,\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    switch (capability) {\n      case \"getUserRoot\":\n        return await this.getUserRootViaRpc(opts);\n      case \"listUserResources\":\n        return await this.getUserRootViaList(opts);\n      case \"legacy\":\n        return await this.getUserRootViaLegacy(opts);\n    }\n  }\n\n  /**\n   * Returns all data libraries the user has access to.\n   * Always fetches fresh from the server (no caching).\n   */\n  async getDataLibraries(\n    opts: { login?: string; createUserRootIfNotExists?: boolean } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    if (this.backendCapability === undefined) {\n      // First call — detect backend capability\n      try {\n        const libs = await this.getDataLibrariesViaList(opts);\n        // getUserRoot RPC doesn't return libraries, but listUserResources does;\n        // record at least \"listUserResources\" so future getUserRoot calls don't re-detect.\n        this.backendCapability = \"listUserResources\";\n        return libs;\n      } catch (err) {\n        if (!isUnimplementedError(err)) throw err;\n        this.backendCapability = \"legacy\";\n        return await this.getDataLibrariesViaLegacy();\n      }\n    }\n\n    // A server that supports getUserRoot definitely supports listUserResources.\n    if (this.backendCapability !== \"legacy\") {\n      return await this.getDataLibrariesViaList(opts);\n    }\n    return await this.getDataLibrariesViaLegacy();\n  }\n\n  /**\n   * Discovers shared resources of a given type granted to the user, as signed resource ids.\n   *\n   * The public, type-filtered form of {@link getDataLibrariesViaList}: it polls the\n   * `ListUserResources` gRPC stream and returns every `sharedResource` entry whose\n   * `resourceType.name` matches `resourceTypeName`. Matching is by name only — the\n   * version is ignored (permissive, survives schema bumps).\n   *\n   * gRPC-only: `ListUserResources` throws on a REST-connected client\n   * ({@link LLPlClient.listUserResources}), so callers on REST get a thrown error.\n   */\n  async listSharedResourcesByType(\n    resourceTypeName: string,\n    opts: { login?: string } = {},\n  ): Promise<SignedResourceId[]> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    const result: SignedResourceId[] = [];\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n      if (!sr.resourceType) continue;\n      if (sr.resourceType.name !== resourceTypeName) continue;\n      result.push(createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature)));\n    }\n    return result;\n  }\n\n  /**\n   * Enumerates the recipients of a single resource — the donor-side \"who did I\n   * share with\" view.\n   *\n   * Takes a signed, writable resource handle: the backend gates grant listing on a\n   * signed resource id with writable permission, so only the resource's owner can\n   * call it. An everyone-grant surfaces with `user` matching the backend's\n   * everyone-sentinel — test with {@link isEveryoneUserLogin} (from \"./transaction\");\n   * the caller maps that to \"*\".\n   *\n   * Runs over a read transaction ({@link PlTransaction.listGrants}), so it works on\n   * every wire protocol — including REST, where the standalone server-streaming\n   * `ListGrants` RPC has no binding.\n   */\n  async listGrants(resourceId: SignedResourceId): Promise<GrantEntry[]> {\n    const grants = await this.runTx(\"ListGrants\", false, NullSignedResourceId, (tx) =>\n      tx.listGrants(resourceId),\n    );\n    return grants.map((grant) => ({\n      user: grant.user,\n      writable: grant.permissions?.writable ?? false,\n      grantedBy: grant.grantedBy,\n      grantedAt: Number(grant.grantedAt),\n    }));\n  }\n\n  /**\n   * Lists the logins of users known to the server, for the recipient picker. A user becomes\n   * known on first login; provisioned users who have never logged in do not appear. gRPC-only\n   * (the underlying {@link LLPlClient.listUsers} has no REST binding) — throws on a\n   * REST-connected client, so callers gate on the `userListing:v1` capability.\n   */\n  async listUsers(): Promise<UserEntry[]> {\n    const users = await this.ll.listUsers();\n    return users.map((user) => ({ login: user.login }));\n  }\n\n  /**\n   * Deletes a user account: the record, every identity-index entry that resolves to it (its login,\n   * its email, and any alternative of either), every grant it holds, and its root resource — and\n   * with the root, everything still attached under it.\n   *\n   * Exists for the duplicate account one person can end up with — an identity that could not be\n   * matched across a provider cutover, or one minted before the backend started refusing two\n   * records for one identity. The spare record shows up wherever users are listed and its projects\n   * keep taking part in deduplication.\n   *\n   * Destructive and irreversible. Re-attach anything worth keeping to another user's root before\n   * calling — `pl-cli admin delete-user` does both steps in order. Requires admin/controller\n   * credentials; gRPC-only, like {@link listUsers}.\n   */\n  async deleteUser(login: string): Promise<UserDeletionReport> {\n    const resp = await this.ll.deleteUser(login);\n\n    return {\n      userRootId: resp.userRootId === 0n ? undefined : resp.userRootId,\n      userRootDeleted: resp.userRootDeleted,\n      revokedGrants: resp.revokedGrants,\n      removedIdentityIndexEntries: resp.removedIdentityIndexEntries,\n    };\n  }\n\n  private async getUserRootViaRpc(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaRpc(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaRpc(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const resp = await this.ll.getUserRoot({\n      login: opts.login,\n      createIfNotExists: opts.createIfNotExists,\n    });\n    if (resp.userRoot === undefined) {\n      if (!opts.createIfNotExists) return undefined;\n      throw new Error(\"getUserRoot returned no userRoot entry\");\n    }\n    return createSignedResourceId(\n      resp.userRoot.resourceId,\n      toResourceSignature(resp.userRoot.resourceSignature),\n    );\n  }\n\n  private async getUserRootViaList(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaList(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaList(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const responses = await this.ll.listUserResources({ login: opts.login, limit: 1 });\n    for (const msg of responses) {\n      if (msg.entry.oneofKind === \"userRoot\") {\n        return createSignedResourceId(\n          msg.entry.userRoot.resourceId,\n          toResourceSignature(msg.entry.userRoot.resourceSignature),\n        );\n      }\n    }\n\n    if (opts.createIfNotExists) {\n      throw new Error(\"listUserResources returned no userRoot entry\");\n    }\n\n    return undefined;\n  }\n\n  private async getDataLibrariesViaList(\n    opts: { login?: string } = {},\n  ): Promise<ReadonlyMap<string, StorageInfo>> {\n    const responses = await this.ll.listUserResources({ login: opts.login });\n\n    // Collect all LS/* shared resources, separating V1 and V2\n    const v1Entries: StorageInfo[] = [];\n    const v2ResourceIds: { resourceId: SignedResourceId; resourceType: ResourceType }[] = [];\n\n    for (const msg of responses) {\n      if (msg.entry.oneofKind !== \"sharedResource\") continue;\n      const sr = msg.entry.sharedResource;\n\n      if (!sr.resourceType) continue;\n      const typeName = sr.resourceType.name;\n      const typeVersion = sr.resourceType.version;\n      if (!typeName.startsWith(LsStorageTypePrefix)) continue;\n\n      const rId = createSignedResourceId(sr.resourceId, toResourceSignature(sr.resourceSignature));\n      const rType: ResourceType = { name: typeName, version: typeVersion };\n\n      if (typeVersion === \"2\") {\n        v2ResourceIds.push({ resourceId: rId, resourceType: rType });\n      } else {\n        // V1 or unknown version: derive storageId from type name\n        const storageId = typeName.substring(LsStorageTypePrefix.length);\n        v1Entries.push({\n          storageId,\n          storageName: storageId,\n          resourceId: rId,\n          resourceType: rType,\n        });\n      }\n    }\n\n    // Read V2 resource data in a single transaction\n    let v2Entries: StorageInfo[] = [];\n    if (v2ResourceIds.length > 0) {\n      v2Entries = await this.runTx(\n        \"ReadLsStorageV2Data\",\n        false,\n        NullSignedResourceId,\n        async (tx) => {\n          const entries: StorageInfo[] = [];\n          for (const { resourceId, resourceType } of v2ResourceIds) {\n            const rd = await tx.getResourceData(resourceId, false);\n            if (rd.data) {\n              const v2Data = JSON.parse(Buffer.from(rd.data).toString(\"utf-8\")) as LsStorageV2Data;\n              entries.push({\n                storageId: v2Data.storageID,\n                storageName: v2Data.storageName,\n                resourceId,\n                resourceType,\n              });\n            }\n          }\n          return entries;\n        },\n      );\n    }\n\n    const result = new Map<string, StorageInfo>();\n    for (const entry of [...v1Entries, ...v2Entries]) {\n      result.set(entry.storageId, entry);\n    }\n    return result;\n  }\n\n  private async getUserRootViaLegacy(opts: {\n    login?: string;\n    createIfNotExists: true;\n  }): Promise<SignedResourceId>;\n  private async getUserRootViaLegacy(opts?: {\n    login?: string;\n    createIfNotExists?: boolean;\n  }): Promise<SignedResourceId | undefined>;\n  private async getUserRootViaLegacy(\n    opts: { login?: string; createIfNotExists?: boolean } = {},\n  ): Promise<SignedResourceId | undefined> {\n    const login = opts.login ?? this.authUser;\n    const mainRootName =\n      login === null ? AnonymousClientRoot : createHash(\"sha256\").update(login).digest(\"hex\");\n\n    return await this.runTx(\"initialization\", true, NullSignedResourceId, async (tx) => {\n      if (await tx.checkResourceNameExists(mainRootName)) {\n        return await tx.getResourceByName(mainRootName);\n      }\n\n      if (!opts.createIfNotExists) {\n        return undefined;\n      }\n\n      const mainRoot = tx.createRoot(ClientRoot);\n      tx.setResourceName(mainRootName, mainRoot);\n      await tx.commit();\n      return await toGlobalResourceId(mainRoot);\n    });\n  }\n\n  private async getDataLibrariesViaLegacy(): Promise<ReadonlyMap<string, StorageInfo>> {\n    return await this.runTx(\"GetAvailableStorageIds\", false, NullSignedResourceId, async (tx) => {\n      const lsProviderId = await tx.getResourceByName(\"LSProvider\");\n      const provider = await tx.getResourceData(lsProviderId, true);\n\n      const result = new Map<string, StorageInfo>();\n      for (const field of provider.fields) {\n        if (field.type !== \"Dynamic\" || !isNotNullSignedResourceId(field.value)) continue;\n        if (!field.name.startsWith(LsProviderFieldPrefix)) continue;\n\n        const storageId = field.name.substring(LsProviderFieldPrefix.length);\n        result.set(storageId, {\n          storageId,\n          storageName: storageId,\n          resourceId: field.value,\n          resourceType: { name: `${LsStorageTypePrefix}${storageId}`, version: \"1\" },\n        });\n      }\n      return result;\n    });\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;;;;;;;;;;AA4E9B,IAAa,gBAAb,MAA2B;CAIN;CACA;CACD;CALlB;CAEA,YACE,IACA,OACA,UACA;EAHiB,KAAA,KAAA;EACA,KAAA,QAAA;EACD,KAAA,WAAA;CACf;CAeH,MAAM,YACJ,OAAwD,CAAC,GAClB;EACvC,IAAI,KAAK,sBAAsB,KAAA,GAC7B,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAE7C,OAAO,MAAM,KAAK,gBAAgB,KAAK,mBAAmB,IAAI;CAChE;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EAEvC,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC9C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC/C,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;EACxC;EAGA,KAAK,oBAAoB;EACzB,OAAO,MAAM,KAAK,qBAAqB,IAAI;CAC7C;CAUA,MAAc,gBACZ,YACA,OAAwD,CAAC,GAClB;EACvC,QAAQ,YAAR;GACE,KAAK,eACH,OAAO,MAAM,KAAK,kBAAkB,IAAI;GAC1C,KAAK,qBACH,OAAO,MAAM,KAAK,mBAAmB,IAAI;GAC3C,KAAK,UACH,OAAO,MAAM,KAAK,qBAAqB,IAAI;EAC/C;CACF;;;;;CAMA,MAAM,iBACJ,OAAgE,CAAC,GACtB;EAC3C,IAAI,KAAK,sBAAsB,KAAA,GAE7B,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,wBAAwB,IAAI;GAGpD,KAAK,oBAAoB;GACzB,OAAO;EACT,SAAS,KAAK;GACZ,IAAI,CAAC,qBAAqB,GAAG,GAAG,MAAM;GACtC,KAAK,oBAAoB;GACzB,OAAO,MAAM,KAAK,0BAA0B;EAC9C;EAIF,IAAI,KAAK,sBAAsB,UAC7B,OAAO,MAAM,KAAK,wBAAwB,IAAI;EAEhD,OAAO,MAAM,KAAK,0BAA0B;CAC9C;;;;;;;;;;;;CAaA,MAAM,0BACJ,kBACA,OAA2B,CAAC,GACC;EAC7B,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAEvE,MAAM,SAA6B,CAAC;EACpC,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GACrB,IAAI,CAAC,GAAG,cAAc;GACtB,IAAI,GAAG,aAAa,SAAS,kBAAkB;GAC/C,OAAO,KAAK,uBAAuB,GAAG,YAAY,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;EAC9F;EACA,OAAO;CACT;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,YAAqD;EAIpE,QAAO,MAHc,KAAK,MAAM,cAAc,OAAA,KAA8B,OAC1E,GAAG,WAAW,UAAU,CAC1B,EAAA,CACc,KAAK,WAAW;GAC5B,MAAM,MAAM;GACZ,UAAU,MAAM,aAAa,YAAY;GACzC,WAAW,MAAM;GACjB,WAAW,OAAO,MAAM,SAAS;EACnC,EAAE;CACJ;;;;;;;CAQA,MAAM,YAAkC;EAEtC,QAAO,MADa,KAAK,GAAG,UAAU,EAAA,CACzB,KAAK,UAAU,EAAE,OAAO,KAAK,MAAM,EAAE;CACpD;;;;;;;;;;;;;;;CAgBA,MAAM,WAAW,OAA4C;EAC3D,MAAM,OAAO,MAAM,KAAK,GAAG,WAAW,KAAK;EAE3C,OAAO;GACL,YAAY,KAAK,eAAe,KAAK,KAAA,IAAY,KAAK;GACtD,iBAAiB,KAAK;GACtB,eAAe,KAAK;GACpB,6BAA6B,KAAK;EACpC;CACF;CAUA,MAAc,kBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,OAAO,MAAM,KAAK,GAAG,YAAY;GACrC,OAAO,KAAK;GACZ,mBAAmB,KAAK;EAC1B,CAAC;EACD,IAAI,KAAK,aAAa,KAAA,GAAW;GAC/B,IAAI,CAAC,KAAK,mBAAmB,OAAO,KAAA;GACpC,MAAM,IAAI,MAAM,wCAAwC;EAC1D;EACA,OAAO,uBACL,KAAK,SAAS,YACd,oBAAoB,KAAK,SAAS,iBAAiB,CACrD;CACF;CAUA,MAAc,mBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB;GAAE,OAAO,KAAK;GAAO,OAAO;EAAE,CAAC;EACjF,KAAK,MAAM,OAAO,WAChB,IAAI,IAAI,MAAM,cAAc,YAC1B,OAAO,uBACL,IAAI,MAAM,SAAS,YACnB,oBAAoB,IAAI,MAAM,SAAS,iBAAiB,CAC1D;EAIJ,IAAI,KAAK,mBACP,MAAM,IAAI,MAAM,8CAA8C;CAIlE;CAEA,MAAc,wBACZ,OAA2B,CAAC,GACe;EAC3C,MAAM,YAAY,MAAM,KAAK,GAAG,kBAAkB,EAAE,OAAO,KAAK,MAAM,CAAC;EAGvE,MAAM,YAA2B,CAAC;EAClC,MAAM,gBAAgF,CAAC;EAEvF,KAAK,MAAM,OAAO,WAAW;GAC3B,IAAI,IAAI,MAAM,cAAc,kBAAkB;GAC9C,MAAM,KAAK,IAAI,MAAM;GAErB,IAAI,CAAC,GAAG,cAAc;GACtB,MAAM,WAAW,GAAG,aAAa;GACjC,MAAM,cAAc,GAAG,aAAa;GACpC,IAAI,CAAC,SAAS,WAAW,mBAAmB,GAAG;GAE/C,MAAM,MAAM,uBAAuB,GAAG,YAAY,oBAAoB,GAAG,iBAAiB,CAAC;GAC3F,MAAM,QAAsB;IAAE,MAAM;IAAU,SAAS;GAAY;GAEnE,IAAI,gBAAgB,KAClB,cAAc,KAAK;IAAE,YAAY;IAAK,cAAc;GAAM,CAAC;QACtD;IAEL,MAAM,YAAY,SAAS,UAAU,CAA0B;IAC/D,UAAU,KAAK;KACb;KACA,aAAa;KACb,YAAY;KACZ,cAAc;IAChB,CAAC;GACH;EACF;EAGA,IAAI,YAA2B,CAAC;EAChC,IAAI,cAAc,SAAS,GACzB,YAAY,MAAM,KAAK,MACrB,uBACA,OAAA,IAEA,OAAO,OAAO;GACZ,MAAM,UAAyB,CAAC;GAChC,KAAK,MAAM,EAAE,YAAY,kBAAkB,eAAe;IACxD,MAAM,KAAK,MAAM,GAAG,gBAAgB,YAAY,KAAK;IACrD,IAAI,GAAG,MAAM;KACX,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC,SAAS,OAAO,CAAC;KAChE,QAAQ,KAAK;MACX,WAAW,OAAO;MAClB,aAAa,OAAO;MACpB;MACA;KACF,CAAC;IACH;GACF;GACA,OAAO;EACT,CACF;EAGF,MAAM,yBAAS,IAAI,IAAyB;EAC5C,KAAK,MAAM,SAAS,CAAC,GAAG,WAAW,GAAG,SAAS,GAC7C,OAAO,IAAI,MAAM,WAAW,KAAK;EAEnC,OAAO;CACT;CAUA,MAAc,qBACZ,OAAwD,CAAC,GAClB;EACvC,MAAM,QAAQ,KAAK,SAAS,KAAK;EACjC,MAAM,eACJ,UAAU,OAAO,sBAAsB,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;EAExF,OAAO,MAAM,KAAK,MAAM,kBAAkB,MAAA,IAA4B,OAAO,OAAO;GAClF,IAAI,MAAM,GAAG,wBAAwB,YAAY,GAC/C,OAAO,MAAM,GAAG,kBAAkB,YAAY;GAGhD,IAAI,CAAC,KAAK,mBACR;GAGF,MAAM,WAAW,GAAG,WAAW,UAAU;GACzC,GAAG,gBAAgB,cAAc,QAAQ;GACzC,MAAM,GAAG,OAAO;GAChB,OAAO,MAAM,mBAAmB,QAAQ;EAC1C,CAAC;CACH;CAEA,MAAc,4BAAuE;EACnF,OAAO,MAAM,KAAK,MAAM,0BAA0B,OAAA,IAA6B,OAAO,OAAO;GAC3F,MAAM,eAAe,MAAM,GAAG,kBAAkB,YAAY;GAC5D,MAAM,WAAW,MAAM,GAAG,gBAAgB,cAAc,IAAI;GAE5D,MAAM,yBAAS,IAAI,IAAyB;GAC5C,KAAK,MAAM,SAAS,SAAS,QAAQ;IACnC,IAAI,MAAM,SAAS,aAAa,CAAC,0BAA0B,MAAM,KAAK,GAAG;IACzE,IAAI,CAAC,MAAM,KAAK,WAAW,qBAAqB,GAAG;IAEnD,MAAM,YAAY,MAAM,KAAK,UAAU,CAA4B;IACnE,OAAO,IAAI,WAAW;KACpB;KACA,aAAa;KACb,YAAY,MAAM;KAClB,cAAc;MAAE,MAAM,GAAG,sBAAsB;MAAa,SAAS;KAAI;IAC3E,CAAC;GACH;GACA,OAAO;EACT,CAAC;CACH;AACF"}