@nacre.work/api 0.0.0

package/dist/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,WAAW,EACX,UAAU,EACV,OAAO,GAER,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAsCxC,MAAM,OAAO,iBAAiB;IACC;IAA6B;IAA1D,YAA6B,IAAU,EAAmB,IAAa;QAA1C,SAAI,GAAJ,IAAI,CAAM;QAAmB,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IAE3E;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,UAAkB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,oEAAoE;QACpE,mEAAmE;QACnE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAA;QAE1D,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,gEAAgE;YAChE,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAA;YAE1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CASjC;;;uEAG6D,EAC7D,CAAC,KAAK,EAAE,UAAU,CAAC,CACpB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,wEAAwE;YACxE,+DAA+D;YAC/D,oEAAoE;YACpE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,OAAO,SAAS,CAAA;gBAC1D,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC3E,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAA;YAClC,CAAC;YAED,OAAO;gBACL,WAAW,EAAE,GAAG,CAAC,EAAE;gBACnB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;gBACpC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;aACzC,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAYD,MAAM,OAAO,kBAAkB;IACA;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,KAAa,EAAE,IAAY;QACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,gEAAgE;YAChE,8CAA8C;YAC9C,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,IAAI,CAAC,KAAK,EACV,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAA;YACD,OAAO,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;QAC1F,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAC7D,CAAA;QAED,mEAAmE;QACnE,0EAA0E;QAC1E,0EAA0E;QAC1E,eAAe;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAA;QAEnC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAE1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YAClE,0EAA0E;YAC1E,cAAc;YACd,IAAI;SACL,CAAC,CAAA;QAEF,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAEnC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,IAAoB;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAEpE,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAOjC,kEAAkE;YAClE,+DAA+D;YAC/D,iEAAiE;YACjE,qEAAqE;YACrE,qBAAqB;YACrB;;;;;;;uCAO6B,EAC7B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC,EACD,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAC7D,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAEtD,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YAC5D,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,OAAO;gBACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAA;QACH,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IACnD,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,SAAS,CAAC,KAAa,EAAE,IAAuC;QACrE,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACjC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACK;IAA6B;IAA1D,YAA6B,IAAU,EAAmB,IAAa;QAA1C,SAAI,GAAJ,IAAI,CAAM;QAAmB,SAAI,GAAJ,IAAI,CAAS;IAAG,CAAC;IAE3E,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACnD,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,EACT,KAAK,CAAC,KAAK,EACX,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB;;8DAEoD,EACpD;gBACE,KAAK,CAAC,KAAK;gBACX,SAAS,IAAI,SAAS;gBACtB,kBAAkB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;gBACvD,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,MAAM;gBACZ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC5B,KAAK,CAAC,SAAS;aAChB,CACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,QAAgB,EAChB,KAAa,EACb,UAAkB;QAFlB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAQ;QACb,eAAU,GAAV,UAAU,CAAQ;IAClC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAEjC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SAC1D,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAA;QAC5E,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpC,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ;YACR,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,CAAC,MAAM,gBAAgB,KAAK,CAAC,MAAM,SAAS,CAAC,CAAA;QACzG,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAChG,MAAM,IAAI,KAAK,CACb,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,6BAA6B;oBAChE,0EAA0E,CAC7E,CAAA;YACH,CAAC;YACD,OAAO,CAAa,CAAA;QACtB,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAED,OAAO,EAAE,OAAO,EAAE,CAAA;AA4BlB,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,IAAgB;QAAhB,SAAI,GAAJ,IAAI,CAAY;IAAG,CAAC;IAEjD,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACrE,CAAC;IAED,oDAAoD;IAC5C,KAAK,CAAC,aAAa,CACzB,MAA+B,EAC/B,IAAiB,EACjB,SAAiB;QAEjB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,IAAI,CAAC,KAAK,EACV,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAA;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;QAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAA;QAE1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CACxB,CAAA;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QACtB,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEtC,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,CAAA;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,OAAsB;QACnD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACrE,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,OAAO,CAAC,GAAc,CAAA;YACxF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;YACnE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAEtE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;;;;;;;;;;;8CAeoC,EACpC;gBACE,IAAI,CAAC,KAAK;gBACV,OAAO;gBACP,OAAO,CAAC,UAAU;gBAClB,UAAU;gBACV,MAAM;gBACN,OAAO,CAAC,KAAK,IAAI,IAAI;gBACrB,UAAU,IAAI,EAAE;aACjB,CACF,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;YAE7E,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS;aACpC,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,UAAkB;QAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAA;QAEtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChD,0EAA0E;QAC1E,4EAA4E;QAC5E,kEAAkE;QAClE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAEpC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;YAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;YAC/D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;YAClE,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAA;YAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAA;YAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;iEACuD,EACvD,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CACzB,CAAA;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAA;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACvC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,qEAAqE;gBACrE,mEAAmE;gBACnE,kEAAkE;gBAClE,sEAAsE;gBACtE,oEAAoE;gBACpE,qEAAqE;gBACrE,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,OAAO,KAAK,CAAA;gBACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,OAAO,KAAK,CAAA;YAC1F,CAAC;YAED,uEAAuE;YACvE,sBAAsB;YACtB,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,4CAA4C;YAC5C,EAAE;YACF,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,kEAAkE;YAClE,kEAAkE;YAClE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YAErD,uEAAuE;YACvE,mEAAmE;YACnE,yBAAyB;YACzB,MAAM,MAAM,CAAC,KAAK,CAChB;0CACgC,EAChC,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CACzB,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,YAAY;IAEJ;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QAErD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,iEAAiE;YACjE,sEAAsE;YACtE,qEAAqE;YACrE,0BAA0B;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,SAAS,CAAA;YAE1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAOjC;iEACuD,EACvD,CAAC,KAAK,EAAE,KAAK,CAAC,CACf,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAA;gBACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAA;YAC9F,CAAC;YAED,MAAM,MAAM,GAAG,CACb,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1E,CAAC,CAAC,GAAG,CAAC,MAAM;gBACZ,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;oBACxB,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ,CACE,CAAA;YAElB,uEAAuE;YACvE,wEAAwE;YACxE,gCAAgC;YAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAEzE,OAAO;gBACL,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,MAAM;gBACN,QAAQ;gBACR,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;aACpD,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED,mFAAmF;AACnF,KAAK,UAAU,UAAU,CACvB,MAA+B,EAC/B,IAAiB;IAQjB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC/D,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,MAAM,EACN,IAAI,CAAC,KAAK,EACV,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CACzE,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACzE,CAAC;AAWD,MAAM,OAAO,cAAc;IAEN;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,CAAA;YAEnC,mEAAmE;YACnE,gEAAgE;YAChE,oEAAoE;YACpE,mEAAmE;YACnE,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,wEAAwE;YACxE,yBAAyB;YACzB,MAAM,UAAU,GAAG;;oFAEyD,CAAA;YAE5E,MAAM,EAAE,IAAI,EAAE,GACZ,IAAI,CAAC,IAAI,KAAK,KAAK;gBACjB,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB,UAAU,UAAU;+EAC2C,EAC/D,CAAC,IAAI,CAAC,KAAK,CAAC,CACb;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB,UAAU,UAAU;;kCAEF,EAClB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAC/B,CAAA;YAEP,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,YAAY;gBAC3B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;gBAChC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;aACxC,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,KAA0D;QAE1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QAE1E,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAE9C,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,iCAAiC;YACjC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAC3B,CAAC;YAED,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC7C,gFAAgF,EAChF,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAChC,CAAA;YACD,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YAE1D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAK5C;mFACyE,EACzE,CAAC,IAAI,CAAC,KAAK,CAAC,CACb,CAAA;YACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;YAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;YAC/F,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,oEAAoE;YACpE,+DAA+D;YAC/D,wDAAwD;YACxD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;YAE9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAOjC;;;+DAGqD,EACrD,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAC7E,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,qEAAqE;YACrE,sEAAsE;YACtE,4BAA4B;YAC5B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;YAElD,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,WAAW,EAAE,GAAG,CAAC,YAAY;oBAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;oBAClC,uDAAuD;oBACvD,aAAa,EAAE,CAAC;iBACjB;aACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAEN;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,CAAA;YAEnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;+DACqD,EACrD,CAAC,IAAI,CAAC,KAAK,CAAC,CACb,CAAA;YAED,OAAO,IAAI;iBACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACZ,eAAe,CACb,OAAO,EACP,EAAE,IAAI,EAAE,CAAC,CAAC,UAAgD,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAC5E,OAAO,CACR,CACF;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,aAAa,EAAE,CAAC,CAAC,cAA8C;gBAC/D,WAAW,EAAE,CAAC,CAAC,YAAY;gBAC3B,SAAS,EAAE,CAAC,CAAC,UAAsC;gBACnD,OAAO,EAAE,CAAC,CAAC,QAAQ;gBACnB,UAAU,EAAE,CAAC,CAAC,UAAuC;gBACrD,MAAM,EAAE,CAAC,CAAC,MAA+B;gBACzC,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC,CAAA;QACP,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,KAAiB;QAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3F,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAE9C,oEAAoE;YACpE,oEAAoE;YACpE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrF,OAAO,SAAS,CAAA;YAClB,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;;wCAK8B,EAC9B;gBACE,IAAI,CAAC,KAAK;gBACV,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,OAAO;gBACb,KAAK,CAAC,UAAU;aACjB,CACF,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,GAAG,CAAC,MAA+B;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,OAAe;QAC7C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAEnD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,uEAAuE,EACvE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CACtB,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,kEAAkE;YAClE,uEAAuE;YACvE,wDAAwD;YACxD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YAEnC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC9C,MAAM,KAAK,GAAG;gBACZ,IAAI,EAAE,GAAG,CAAC,UAAgD;gBAC1D,EAAE,EAAE,GAAG,CAAC,QAAQ;aACjB,CAAA;YACD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;YAE3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBACpF,IAAI,CAAC,KAAK;gBACV,OAAO;aACR,CAAC,CAAA;YAEF,wEAAwE;YACxE,wEAAwE;YACxE,kEAAkE;YAClE,oEAAoE;YACpE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACnC,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF"}

package/dist/auth.d.ts

@@ -0,0 +1,42 @@
+import type { OrgRole, Principal } from '@nacre.work/core';
+import { type KeyObject } from 'jose';
+import { type Problem } from './errors.js';
+export interface AuthContext {
+    /** From the token. Never from anywhere else. */
+    readonly orgId: string;
+    readonly principal: Principal;
+    readonly role: OrgRole;
+}
+export interface VerifyOptions {
+    readonly key: KeyObject | Uint8Array;
+    readonly issuer: string;
+    readonly audience: string;
+    /**
+     * Resolves a service account key, when one is presented.
+     *
+     * Injected rather than imported so this module keeps no database of its own:
+     * the JWT path is pure and stays that way, and a surface with no service
+     * accounts simply does not pass this.
+     */
+    readonly serviceKeys?: {
+        resolve(key: string): Promise<AuthContext | undefined>;
+    };
+}
+export declare function findTenantOverride(value: unknown, path?: string[]): string | undefined;
+/**
+ * T2. A body, path, or header naming an organization is refused with 403.
+ *
+ * 403 rather than 404 is deliberate and is the one place the wording matters in
+ * the other direction: the caller is authenticated, the refusal is about the
+ * *operation*, and no object's existence is revealed by saying so.
+ */
+export declare function rejectTenantOverride(body: unknown, query: URLSearchParams, headers: Record<string, string | string[] | undefined>, instance: string, requestId: string): Problem | undefined;
+/**
+ * Verify a bearer token into an AuthContext.
+ *
+ * Every failure path returns 401 with the same shape. Distinguishing "expired"
+ * from "wrong audience" from "unknown issuer" in the response tells an attacker
+ * which of their guesses was closest.
+ */
+export declare function authenticate(authorization: string | undefined, options: VerifyOptions, instance: string, requestId: string): Promise<AuthContext | Problem>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAA8B,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjE,OAAO,EAA2B,KAAK,OAAO,EAAE,MAAM,aAAa,CAAA;AAEnE,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,GAAG,UAAU,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;KACvD,CAAA;CACF;AAcD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,MAAM,GAAG,SAAS,CAW1F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,GAAG,SAAS,CAgBrB;AAWD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,CAoDhC"}

package/dist/auth.js

@@ -0,0 +1,106 @@
+import { jwtVerify } from 'jose';
+import { forbidden, unauthorized } from './errors.js';
+/**
+ * Fields a request body, path, or query string may never carry.
+ *
+ * Rule 1 is a precondition, not a validation step: the organization comes from
+ * the token, so a request that names one is not a request with a bad field —
+ * it is an attempt to act as another tenant, and it is journaled as one.
+ *
+ * `organization` and `tenant` are here because the next person to add a field
+ * will not call it `org_id`.
+ */
+const FORBIDDEN_KEYS = ['org_id', 'orgId', 'organization', 'organization_id', 'tenant', 'tenant_id'];
+export function findTenantOverride(value, path = []) {
+    if (value === null || typeof value !== 'object')
+        return undefined;
+    for (const [key, nested] of Object.entries(value)) {
+        if (FORBIDDEN_KEYS.includes(key))
+            return [...path, key].join('.');
+        // Nested, because a body that cannot say org_id at the top level will say
+        // it one level down.
+        const deeper = findTenantOverride(nested, [...path, key]);
+        if (deeper !== undefined)
+            return deeper;
+    }
+    return undefined;
+}
+/**
+ * T2. A body, path, or header naming an organization is refused with 403.
+ *
+ * 403 rather than 404 is deliberate and is the one place the wording matters in
+ * the other direction: the caller is authenticated, the refusal is about the
+ * *operation*, and no object's existence is revealed by saying so.
+ */
+export function rejectTenantOverride(body, query, headers, instance, requestId) {
+    const inBody = findTenantOverride(body);
+    if (inBody !== undefined) {
+        return forbidden(instance, requestId, `The organization comes from the token. Remove '${inBody}'.`);
+    }
+    for (const key of FORBIDDEN_KEYS) {
+        if (query.has(key)) {
+            return forbidden(instance, requestId, `The organization comes from the token. Remove '${key}'.`);
+        }
+        if (headers[`x-${key.replace(/_/g, '-')}`] !== undefined) {
+            return forbidden(instance, requestId, 'The organization comes from the token.');
+        }
+    }
+    return undefined;
+}
+const ROLES = ['platform_admin', 'org_admin', 'member'];
+const PRINCIPAL_TYPES = ['user', 'group', 'service_account'];
+/**
+ * Verify a bearer token into an AuthContext.
+ *
+ * Every failure path returns 401 with the same shape. Distinguishing "expired"
+ * from "wrong audience" from "unknown issuer" in the response tells an attacker
+ * which of their guesses was closest.
+ */
+export async function authenticate(authorization, options, instance, requestId) {
+    const bearer = authorization?.startsWith('Bearer ') ? authorization.slice(7) : undefined;
+    if (bearer === undefined) {
+        return unauthorized(instance, requestId, 'A bearer token is required.');
+    }
+    // A service account key is opaque and has nothing to verify locally, so it
+    // takes a different route — but only the route differs. It fails into the
+    // same 401 with the same wording as every JWT failure below, because
+    // "revoked key" and "wrong audience" and "expired" must be one answer.
+    if (bearer.startsWith('nacre_sk_')) {
+        if (options.serviceKeys === undefined) {
+            return unauthorized(instance, requestId, 'The token is not valid.');
+        }
+        const resolved = await options.serviceKeys.resolve(bearer);
+        return resolved ?? unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    let claims;
+    try {
+        const verified = await jwtVerify(bearer, options.key, {
+            issuer: options.issuer,
+            audience: options.audience,
+        });
+        claims = verified.payload;
+    }
+    catch {
+        return unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    const org = claims.org;
+    const sub = claims.sub;
+    const type = claims.principal_type;
+    const role = claims.role ?? 'member';
+    if (typeof org !== 'string' ||
+        typeof sub !== 'string' ||
+        typeof type !== 'string' ||
+        !PRINCIPAL_TYPES.includes(type) ||
+        typeof role !== 'string' ||
+        !ROLES.includes(role)) {
+        // A token that verifies but does not say who it is cannot be evaluated, and
+        // rule I3 makes that a denial rather than a default.
+        return unauthorized(instance, requestId, 'The token is not valid.');
+    }
+    return {
+        orgId: org,
+        principal: { type: type, id: sub },
+        role: role,
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAA;AAEjE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAgB,MAAM,aAAa,CAAA;AAyBnE;;;;;;;;;GASG;AACH,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;AAEpG,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,OAAiB,EAAE;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEjE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;IACzC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,KAAsB,EACtB,OAAsD,EACtD,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,MAAM,IAAI,CAAC,CAAA;IACrG,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,GAAG,IAAI,CAAC,CAAA;QAClG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,wCAAwC,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC;AAQD,MAAM,KAAK,GAAuB,CAAC,gBAAgB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAA;AAC3E,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAU,CAAA;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAiC,EACjC,OAAsB,EACtB,QAAgB,EAChB,SAAiB;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,6BAA6B,CAAC,CAAA;IACzE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1D,OAAO,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAmB,CAAA;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAc,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE;YACjE,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAA;QACF,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAA;IAEpC,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5C,CAAC;QACD,4EAA4E;QAC5E,qDAAqD;QACrD,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAA;IACrE,CAAC;IAED,OAAO;QACL,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,EAAE,IAAI,EAAE,IAAyB,EAAE,EAAE,EAAE,GAAG,EAAE;QACvD,IAAI,EAAE,IAAe;KACtB,CAAA;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,43 @@
+/**
+ * RFC 9457 problem details, and the status-code discipline that goes with them.
+ *
+ * The whole file exists for one distinction. `403` says "this exists and you
+ * may not touch it". `404` says nothing at all. Using the first where the
+ * caller cannot already see the object turns identifier enumeration into a
+ * directory of what exists, which is invariant I6.
+ */
+export interface ProblemInit {
+    readonly type: string;
+    readonly title: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly instance: string;
+    readonly requestId: string;
+}
+export declare class Problem extends Error {
+    readonly type: string;
+    readonly title: string;
+    readonly status: number;
+    readonly detail: string;
+    readonly instance: string;
+    readonly requestId: string;
+    constructor(init: ProblemInit);
+    toJSON(): Record<string, unknown>;
+}
+/**
+ * The response for anything the caller may not see.
+ *
+ * One function, one wording, for both "absent" and "invisible". Two call sites
+ * with two different messages is how the distinction leaks back in — the
+ * status matching while the body differs is still an oracle.
+ */
+export declare function notFound(instance: string, requestId: string): Problem;
+export declare function unauthorized(instance: string, requestId: string, detail: string): Problem;
+/**
+ * Only for an operation refused on an object the caller can already see — and
+ * for a request that tries to name its own organization, which is T2.
+ */
+export declare function forbidden(instance: string, requestId: string, detail: string): Problem;
+export declare function badRequest(instance: string, requestId: string, detail: string): Problem;
+export declare function internal(instance: string, requestId: string): Problem;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,qBAAa,OAAQ,SAAQ,KAAK;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,IAAI,EAAE,WAAW;IAW7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC;AAID;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASrE;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASzF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAStF;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CASvF;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAWrE"}

package/dist/errors.js

@@ -0,0 +1,101 @@
+/**
+ * RFC 9457 problem details, and the status-code discipline that goes with them.
+ *
+ * The whole file exists for one distinction. `403` says "this exists and you
+ * may not touch it". `404` says nothing at all. Using the first where the
+ * caller cannot already see the object turns identifier enumeration into a
+ * directory of what exists, which is invariant I6.
+ */
+export class Problem extends Error {
+    type;
+    title;
+    status;
+    detail;
+    instance;
+    requestId;
+    constructor(init) {
+        super(`${init.status} ${init.title}`);
+        this.name = 'Problem';
+        this.type = init.type;
+        this.title = init.title;
+        this.status = init.status;
+        this.detail = init.detail;
+        this.instance = init.instance;
+        this.requestId = init.requestId;
+    }
+    toJSON() {
+        return {
+            type: this.type,
+            title: this.title,
+            status: this.status,
+            detail: this.detail,
+            instance: this.instance,
+            request_id: this.requestId,
+        };
+    }
+}
+const uri = (slug) => `https://nacre.work/errors/${slug}`;
+/**
+ * The response for anything the caller may not see.
+ *
+ * One function, one wording, for both "absent" and "invisible". Two call sites
+ * with two different messages is how the distinction leaks back in — the
+ * status matching while the body differs is still an oracle.
+ */
+export function notFound(instance, requestId) {
+    return new Problem({
+        type: uri('not-found'),
+        title: 'Not found',
+        status: 404,
+        detail: 'The requested resource does not exist or is not accessible.',
+        instance,
+        requestId,
+    });
+}
+export function unauthorized(instance, requestId, detail) {
+    return new Problem({
+        type: uri('unauthorized'),
+        title: 'Unauthorized',
+        status: 401,
+        detail,
+        instance,
+        requestId,
+    });
+}
+/**
+ * Only for an operation refused on an object the caller can already see — and
+ * for a request that tries to name its own organization, which is T2.
+ */
+export function forbidden(instance, requestId, detail) {
+    return new Problem({
+        type: uri('forbidden'),
+        title: 'Forbidden',
+        status: 403,
+        detail,
+        instance,
+        requestId,
+    });
+}
+export function badRequest(instance, requestId, detail) {
+    return new Problem({
+        type: uri('bad-request'),
+        title: 'Bad request',
+        status: 400,
+        detail,
+        instance,
+        requestId,
+    });
+}
+export function internal(instance, requestId) {
+    return new Problem({
+        type: uri('internal'),
+        title: 'Internal error',
+        status: 500,
+        // No cause, no stack, no internal service name. Whatever went wrong is in
+        // the journal under this request_id.
+        detail: 'The request could not be completed.',
+        instance,
+        requestId,
+    });
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,MAAM,OAAO,OAAQ,SAAQ,KAAK;IACvB,IAAI,CAAQ;IACZ,KAAK,CAAQ;IACb,MAAM,CAAQ;IACd,MAAM,CAAQ;IACd,QAAQ,CAAQ;IAChB,SAAS,CAAQ;IAE1B,YAAY,IAAiB;QAC3B,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IACjC,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAA;IACH,CAAC;CACF;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,6BAA6B,IAAI,EAAE,CAAA;AAEjE;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,6DAA6D;QACrE,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC9E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC;QACzB,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC3E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAc;IAC5E,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC;QACxB,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAiB;IAC1D,OAAO,IAAI,OAAO,CAAC;QACjB,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC;QACrB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,GAAG;QACX,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,EAAE,qCAAqC;QAC7C,QAAQ;QACR,SAAS;KACV,CAAC,CAAA;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { createApi } from './server.js';
+export type { ApiOptions, AuditEvent, AuditSink, DocumentView, Documents, GrantInput, GrantRecord, Grants, Ingest, IngestOutcome, IngestRequest, Job, Jobs, Layer, LayerOutcome, Layers, SearchHit, SearchService, ServiceAccountPort, ServiceAccountView, } from './server.js';
+export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
+export type { AuthContext, VerifyOptions } from './auth.js';
+export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, } from './adapters.js';
+export type { DocumentTombstone, Embedder, IngestDeps, SearchDeps } from './adapters.js';
+export { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from './service-keys.js';
+export type { ServiceAccount, ServiceAccounts, ServiceKeyResolver } from './service-keys.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,MAAM,EACN,MAAM,EACN,aAAa,EACb,aAAa,EACb,GAAG,EACH,IAAI,EACJ,KAAK,EACL,YAAY,EACZ,MAAM,EACN,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAClF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AACxF,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { createApi } from './server.js';
+export { authenticate, findTenantOverride, rejectTenantOverride } from './auth.js';
+export { Problem, badRequest, forbidden, internal, notFound, unauthorized } from './errors.js';
+export { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, } from './adapters.js';
+export { generateKey, hashOf, KEY_PREFIX, looksLikeServiceKey, PostgresServiceAccounts, PostgresServiceKeys, prefixOf, } from './service-keys.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAuBvC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAElF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC9F,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAA;AAEtB,OAAO,EACL,WAAW,EACX,MAAM,EACN,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACT,MAAM,mBAAmB,CAAA"}

package/dist/init.d.ts

@@ -0,0 +1,49 @@
+import type { Pool } from 'pg';
+/**
+ * Create the first organization.
+ *
+ * Everything else in this repository assumes an organization, a user, an
+ * embedding provider, a workspace and a Qdrant collection already exist.
+ * Nothing created them. A new installation could start every process, get
+ * `{"status":"ok"}` from health, and have no way to reach a single endpoint
+ * that does anything — the quickstart began one step after where a real
+ * installation begins.
+ *
+ * A one-shot command rather than an endpoint, because an HTTP route that
+ * creates the first organization has to be reachable before any organization
+ * exists, which means unauthenticated, which means it has to be disabled again
+ * afterwards. Every version of that is a race between the first deploy and the
+ * internet. A command runs where the operator already has credentials.
+ *
+ * Idempotent: run it twice and the second run reports what already existed and
+ * changes nothing. Half-finished state is the normal outcome of a first
+ * install — the collection created, the process killed before the workspace —
+ * and refusing to continue from it would leave no way forward but manual SQL.
+ */
+export interface Options {
+    readonly slug: string;
+    readonly name: string;
+    readonly email: string;
+    readonly workspace: string;
+}
+export declare function parseArgs(argv: readonly string[]): Options | string;
+export interface InitResult {
+    readonly orgId: string;
+    readonly userId: string;
+    readonly workspaceId: string;
+    /** False when the organization was already there — the run changed nothing. */
+    readonly created: boolean;
+}
+/**
+ * The database half, in one transaction.
+ *
+ * Separate from `main` so it can be tested: idempotency is the property that
+ * matters here and the one that regresses silently, because the second run of
+ * something non-idempotent usually still exits zero.
+ */
+export declare function initialize(pool: Pool, options: Options, provider: {
+    endpoint: string;
+    model: string;
+    dimensions: number;
+}, collection: string, log?: (msg: string, extra?: Record<string, unknown>) => void): Promise<InitResult>;
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAG9B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,GAAG,MAAM,CA6BnE;AAMD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EACjE,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAsB,GAC5E,OAAO,CAAC,UAAU,CAAC,CAsFrB"}

package/dist/init.js

@@ -0,0 +1,201 @@
+import { collectionName, ConfigError, createPool, loadConfig, vectorName, VectorStore, } from '@nacre.work/core';
+import { SignJWT } from 'jose';
+import { pathToFileURL } from 'node:url';
+export function parseArgs(argv) {
+    const values = new Map();
+    for (let i = 0; i < argv.length; i += 2) {
+        const key = argv[i];
+        const value = argv[i + 1];
+        if (key === undefined || !key.startsWith('--') || value === undefined) {
+            return 'usage: nacre-init --org <slug> --email <address> [--name <display name>] [--workspace <slug>]';
+        }
+        values.set(key.slice(2), value);
+    }
+    const slug = values.get('org');
+    const email = values.get('email');
+    if (slug === undefined || email === undefined) {
+        return 'usage: nacre-init --org <slug> --email <address> [--name <display name>] [--workspace <slug>]';
+    }
+    // The slug becomes the Qdrant collection name, so the characters it may
+    // contain are not a matter of taste.
+    if (!/^[a-z0-9][a-z0-9-]{0,38}[a-z0-9]$/.test(slug)) {
+        return `--org must be 2-40 characters of lowercase letters, digits and hyphens, not starting or ending with one: ${slug}`;
+    }
+    if (!email.includes('@'))
+        return `--email does not look like an address: ${email}`;
+    return {
+        slug,
+        email,
+        name: values.get('name') ?? slug,
+        workspace: values.get('workspace') ?? 'default',
+    };
+}
+const say = (msg, extra = {}) => {
+    console.log(JSON.stringify({ msg, ...extra }));
+};
+/**
+ * The database half, in one transaction.
+ *
+ * Separate from `main` so it can be tested: idempotency is the property that
+ * matters here and the one that regresses silently, because the second run of
+ * something non-idempotent usually still exits zero.
+ */
+export async function initialize(pool, options, provider, collection, log = () => undefined) {
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        const { rows: orgs } = await client.query(`WITH ins AS (
+         INSERT INTO organizations (slug, name, vector_collection)
+         VALUES ($1,$2,$3) ON CONFLICT (slug) DO NOTHING
+         RETURNING id
+       )
+       SELECT id, false AS existed FROM ins
+       UNION ALL
+       SELECT id, true AS existed FROM organizations WHERE slug = $1
+       LIMIT 1`, [options.slug, options.name, collection]);
+        const org = orgs[0];
+        if (org === undefined)
+            throw new Error('the organization insert returned no row');
+        log(org.existed ? 'organization already existed' : 'organization created', {
+            org_id: org.id,
+            slug: options.slug,
+        });
+        // RLS is forced on every tenant table, so everything below this line needs
+        // the organization in the transaction-local setting. The organizations row
+        // itself is not covered — it is the tenant registry, not tenant data.
+        await client.query('SELECT set_config($1, $2, true)', ['app.current_org', org.id]);
+        const { rows: users } = await client.query(`INSERT INTO users (org_id, email, role) VALUES ($1,$2,'org_admin')
+       ON CONFLICT (org_id, email) DO UPDATE SET email = EXCLUDED.email
+       RETURNING id`, [org.id, options.email]);
+        const userId = users[0]?.id;
+        if (userId === undefined)
+            throw new Error('the user insert returned no row');
+        log('admin user ready', { user_id: userId, email: options.email });
+        // Shared across organizations by default: one endpoint serves every tenant
+        // in a self-hosted install, and a per-organization provider is the
+        // exception rather than the shape to create on day one.
+        const { rows: providers } = await client.query(`WITH ins AS (
+         INSERT INTO embedding_providers (org_id, name, endpoint, model, dimensions)
+         SELECT NULL,'default',$1,$2,$3
+         WHERE NOT EXISTS (SELECT 1 FROM embedding_providers WHERE org_id IS NULL)
+         RETURNING id
+       )
+       SELECT id FROM ins
+       UNION ALL
+       SELECT id FROM embedding_providers WHERE org_id IS NULL
+       LIMIT 1`, [provider.endpoint, provider.model, provider.dimensions]);
+        const providerId = providers[0]?.id;
+        if (providerId === undefined)
+            throw new Error('the embedding provider insert returned no row');
+        log('embedding provider ready', { provider_id: providerId, model: provider.model });
+        const { rows: workspaces } = await client.query(`WITH ins AS (
+         -- slug and name take separate parameters despite the same value: slug
+         -- is citext, name is text, and Postgres refuses to deduce one type for
+         -- a parameter feeding both.
+         INSERT INTO workspaces (org_id, slug, name) VALUES ($1,$2,$3)
+         ON CONFLICT (org_id, slug) DO NOTHING
+         RETURNING id
+       )
+       SELECT id FROM ins
+       UNION ALL
+       SELECT id FROM workspaces WHERE org_id = $1 AND slug = $2
+       LIMIT 1`, [org.id, options.workspace, options.workspace]);
+        const workspaceId = workspaces[0]?.id;
+        if (workspaceId === undefined)
+            throw new Error('the workspace insert returned no row');
+        log('workspace ready', { workspace_id: workspaceId, slug: options.workspace });
+        await client.query('COMMIT');
+        return { orgId: org.id, userId, workspaceId, created: !org.existed };
+    }
+    catch (error) {
+        await client.query('ROLLBACK').catch(() => { });
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+async function main() {
+    const parsed = parseArgs(process.argv.slice(2));
+    if (typeof parsed === 'string')
+        throw new ConfigError([parsed]);
+    const config = loadConfig();
+    const secret = process.env.NACRE_JWT_SECRET;
+    if (secret === undefined || secret.length < 32) {
+        throw new ConfigError([
+            'NACRE_JWT_SECRET is not set, or is shorter than 32 bytes. It is needed to ' +
+                'issue the first token, and the API will refuse to start without it either.',
+        ]);
+    }
+    const pool = createPool({ connectionString: config.pgUrl, max: 2 });
+    const vector = vectorName(config.embeddingModel, config.embeddingDim);
+    const collection = collectionName(parsed.slug);
+    try {
+        const ids = await initialize(pool, parsed, {
+            endpoint: config.embeddingEndpoint,
+            model: config.embeddingModel,
+            dimensions: config.embeddingDim,
+        }, collection, say);
+        // Qdrant after Postgres commits. The reverse order can leave a collection
+        // belonging to an organization that was rolled back, and the next run with
+        // the same slug would then adopt it.
+        //
+        // `ensureCollection` is already idempotent and already creates the payload
+        // indexes, which is the part worth not reimplementing: a filter that falls
+        // back to a scan is a latency problem that only appears at volume.
+        const vectors = new VectorStore(config.qdrantApiKey === undefined
+            ? { url: config.qdrantUrl }
+            : { url: config.qdrantUrl, apiKey: config.qdrantApiKey });
+        await vectors.ensureCollection(parsed.slug, vector, config.embeddingDim);
+        say('collection ready', { collection, vector, dimensions: config.embeddingDim });
+        // A short life on purpose. This is a symmetric secret signed by the same
+        // value the API verifies with, printed to a terminal and probably into a
+        // shell history; it exists to get through the quickstart, not to be the
+        // credential an installation runs on.
+        const token = await new SignJWT({
+            org: ids.orgId,
+            principal_type: 'user',
+            role: 'org_admin',
+        })
+            .setProtectedHeader({ alg: 'HS256' })
+            .setSubject(ids.userId)
+            .setIssuer(config.jwtIssuer)
+            .setAudience(config.jwtAudience)
+            .setExpirationTime('1h')
+            .sign(new TextEncoder().encode(secret));
+        console.log('');
+        console.log(`Organization ${parsed.slug} is ready.`);
+        console.log('');
+        console.log(`  Workspace id  ${ids.workspaceId}`);
+        console.log(`  Admin user    ${parsed.email}`);
+        console.log('');
+        console.log('An administrator token, valid for one hour:');
+        console.log('');
+        console.log(`  export NACRE_TOKEN=${token}`);
+        console.log('');
+        console.log('Create a layer with it, then follow docs/quickstart.md:');
+        console.log('');
+        console.log(`  curl -X POST ${config.canonicalUrl}/v1/layers \\`);
+        console.log(`    -H "Authorization: Bearer $NACRE_TOKEN" -H 'Content-Type: application/json' \\`);
+        console.log(`    -d '{"workspace_id":"${ids.workspaceId}","slug":"handbook","name":"Handbook"}'`);
+        console.log('');
+    }
+    finally {
+        await pool.end();
+    }
+}
+// Only when run as a command. This module is also imported — `initialize` is
+// the part with a test on it — and an unguarded call here runs the whole
+// command on import, which under a test runner means `process.exit(2)` in the
+// middle of somebody else's suite.
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    main().catch((error) => {
+        if (error instanceof ConfigError) {
+            console.error(error.message);
+            process.exit(2);
+        }
+        console.error(JSON.stringify({ msg: 'init failed', error: String(error) }));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=init.js.map