@nacre.work/api 0.28.0 → 0.29.0

package/dist/skills.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Skills: storage, who sees which, who writes which. docs/skills.md is the
+ * specification and every rule below is quoted from it rather than restated.
+ *
+ * One port for every surface. The REST handlers, the MCP tools and the
+ * `instructions` an agent reads on connecting all ask this, so "who may see a
+ * layer's skill" has one answer and it is the resolver's — the same
+ * `contextFor` the document paths use, which is the whole argument for this
+ * file reaching into `adapters.ts` for it rather than holding a second copy.
+ */
+import { type SkillFiles } from '@nacre.work/core';
+import type { Pool } from 'pg';
+import { type PrincipalsCache } from './adapters.js';
+import { type AuthContext } from './auth.js';
+import { type Page, type PageResult } from './pagination.js';
+/** Which skill. The installation's belongs to no organization. */
+export type SkillLevel = {
+    readonly kind: 'installation';
+} | {
+    readonly kind: 'organization';
+} | {
+    readonly kind: 'layer';
+    readonly layerId: string;
+};
+/** Through which door a write came — recorded on the version, see docs/skills.md. */
+export type SkillSurface = 'rest' | 'mcp' | 'mcp-admin';
+export interface SkillVersionMeta {
+    readonly version: number;
+    readonly name: string | null;
+    readonly description: string | null;
+    readonly hasScripts: boolean;
+    readonly fileCount: number;
+    /** `{type}:{id}`, as the access log writes it. */
+    readonly principal: string;
+    readonly surface: SkillSurface;
+    readonly connectionId: string | null;
+    /**
+     * Written by an agent rather than by a person at a screen: through MCP,
+     * through a delegation, or by a service account. What the console and the
+     * panel mark, because a skill is instructions every later agent follows.
+     */
+    readonly byAgent: boolean;
+    readonly restoredFrom: number | null;
+    readonly createdAt: string;
+}
+export interface SkillVersion extends SkillVersionMeta {
+    readonly files: SkillFiles;
+}
+/** One entry of what a caller sees — the base skill, or a layer's. */
+export interface SkillEntry {
+    readonly level: 'default' | 'installation' | 'organization' | 'layer';
+    readonly layerId: string | null;
+    readonly layerSlug: string | null;
+    readonly name: string;
+    readonly description: string;
+    readonly version: number | null;
+    readonly hasScripts: boolean;
+    readonly paths: readonly string[];
+}
+export interface EffectiveBase extends SkillEntry {
+    readonly files: SkillFiles;
+}
+export type SkillWrite = {
+    readonly kind: 'written';
+    readonly version: SkillVersionMeta;
+    readonly cleared: boolean;
+}
+/** No such level, or one the caller may not see — one answer, invariant 4. */
+ | {
+    readonly kind: 'not_found';
+}
+/** Visible, and the caller may not write it. */
+ | {
+    readonly kind: 'forbidden';
+}
+/** `based_on` is not the current version; nothing was written. */
+ | {
+    readonly kind: 'conflict';
+    readonly current: number;
+} | {
+    readonly kind: 'refused';
+    readonly reason: string;
+};
+export interface Skills {
+    /** The base skill for this caller: organization ?? installation ?? default. */
+    base(auth: AuthContext): Promise<EffectiveBase>;
+    /**
+     * The base skill and a page of the layer skills the caller may see, in the
+     * order layers were created. Paged, because a listing that answers the first
+     * fifty of a million layers and says nothing reads as the whole set.
+     */
+    list(auth: AuthContext, page: Page): Promise<{
+        readonly base: SkillEntry;
+        readonly layers: PageResult<SkillEntry>;
+    }>;
+    /** A layer id for a slug the caller may see a skill on, or `undefined`. */
+    layerBySlug(auth: AuthContext, slug: string): Promise<string | undefined>;
+    /** The current version, or `undefined` when there is none or the caller may not see it. */
+    current(auth: AuthContext, level: SkillLevel): Promise<SkillVersion | undefined>;
+    /** History, newest first. `undefined` unless the caller may write the level. */
+    versions(auth: AuthContext, level: SkillLevel, page: Page): Promise<PageResult<SkillVersionMeta> | undefined>;
+    version(auth: AuthContext, level: SkillLevel, n: number): Promise<SkillVersion | undefined>;
+    write(auth: AuthContext, level: SkillLevel, files: unknown, basedOn: number, surface: SkillSurface): Promise<SkillWrite>;
+    restore(auth: AuthContext, level: SkillLevel, n: number, basedOn: number, surface: SkillSurface): Promise<SkillWrite>;
+}
+/** Bytes above which `instructions` carry a pointer rather than the body. */
+export declare const INSTRUCTIONS_SKILL_LIMIT: number;
+export declare class PostgresSkills implements Skills {
+    private readonly pool;
+    private readonly role?;
+    private readonly principalsCache?;
+    constructor(pool: Pool, role?: string | undefined, principalsCache?: PrincipalsCache | undefined);
+    private get scope();
+    /**
+     * The layers whose skill this caller sees: any permission on the layer,
+     * `write` included, within the delegation's narrowing for that permission.
+     *
+     * `admin` implies both, so asking `read` and `write` covers it. A grant on a
+     * single document is not a permission on its layer and does not count — the
+     * skill describes the layer, and a document grant says nothing about it.
+     */
+    private visibleLayers;
+    /**
+     * `may_write_layer_skill` in docs/skills.md: `admin` resolved on the layer,
+     * and for a delegation the layer inside its narrowing for `admin`.
+     *
+     * The consent screen's per-layer `skill` box is the second clause of the
+     * specification's disjunction and arrives with it; until then a delegation
+     * writes a layer's skill only where its ceiling holds `admin` there, which
+     * the ordinary consent screen never sets.
+     */
+    private mayWriteLayer;
+    private mayReadLevel;
+    private mayWriteLevel;
+    private latest;
+    private live;
+    base(auth: AuthContext): Promise<EffectiveBase>;
+    private entry;
+    list(auth: AuthContext, page: Page): Promise<{
+        base: SkillEntry;
+        layers: PageResult<SkillEntry>;
+    }>;
+    layerBySlug(auth: AuthContext, slug: string): Promise<string | undefined>;
+    current(auth: AuthContext, level: SkillLevel): Promise<SkillVersion | undefined>;
+    versions(auth: AuthContext, level: SkillLevel, page: Page): Promise<PageResult<SkillVersionMeta> | undefined>;
+    version(auth: AuthContext, level: SkillLevel, n: number): Promise<SkillVersion | undefined>;
+    private at;
+    write(auth: AuthContext, level: SkillLevel, files: unknown, basedOn: number, surface: SkillSurface): Promise<SkillWrite>;
+    restore(auth: AuthContext, level: SkillLevel, n: number, basedOn: number, surface: SkillSurface): Promise<SkillWrite>;
+    /** Visibility and permission, in that order, so an invisible level is `not_found`. */
+    private gate;
+    private insert;
+    private insertIn;
+}
+//# sourceMappingURL=skills.d.ts.map

package/dist/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAML,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,IAAI,EAAc,MAAM,IAAI,CAAA;AAE1C,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAChE,OAAO,EAAsE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAA;AAChH,OAAO,EAAgB,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAE1E,kEAAkE;AAClE,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,CAAA;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,YAAa,SAAQ,gBAAgB;IACpD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,cAAc,GAAG,cAAc,GAAG,OAAO,CAAA;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAC3B;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AAC7F,8EAA8E;GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAChC,gDAAgD;GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAChC,kEAAkE;GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,MAAM,WAAW,MAAM;IACrB,+EAA+E;IAC/E,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC/C;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;KAAE,CAAC,CAAA;IACpH,2EAA2E;IAC3E,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACzE,2FAA2F;IAC3F,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAChF,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC,CAAA;IAC7G,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC3F,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,UAAU,CAAC,CAAA;IACtB,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACtH;AAED,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,QAAY,CAAA;AAuEjD,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAFhB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA,EACb,eAAe,CAAC,EAAE,eAAe,YAAA;IAGpD,OAAO,KAAK,KAAK,GAEhB;IAID;;;;;;;OAOG;YACW,aAAa;IA6B3B;;;;;;;;OAQG;YACW,aAAa;IAQ3B,OAAO,CAAC,YAAY,CAWnB;IAED,OAAO,CAAC,aAAa,CASpB;YAIa,MAAM;IAgBpB,OAAO,CAAC,IAAI,CAA6F;IAEnG,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAerD,OAAO,CAAC,KAAK;IAcP,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,CAAA;KAAE,CAAC;IA4ClG,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAkBzE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAahF,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;IAoC7G,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;YAanF,EAAE;IAcV,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAOxH,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAwB3H,sFAAsF;YACxE,IAAI;YAiBJ,MAAM;YAoBN,QAAQ;CAsDvB"}

package/dist/skills.js

@@ -0,0 +1,371 @@
+/**
+ * Skills: storage, who sees which, who writes which. docs/skills.md is the
+ * specification and every rule below is quoted from it rather than restated.
+ *
+ * One port for every surface. The REST handlers, the MCP tools and the
+ * `instructions` an agent reads on connecting all ask this, so "who may see a
+ * layer's skill" has one answer and it is the resolver's — the same
+ * `contextFor` the document paths use, which is the whole argument for this
+ * file reaching into `adapters.ts` for it rather than holding a second copy.
+ */
+import { activeResolver, checkSkill, DEFAULT_SKILL, withOrg, } from '@nacre.work/core';
+import { contextFor } from './adapters.js';
+import { administers, administersTenants, delegatedLayers, withinDelegation } from './auth.js';
+import { encodeCursor } from './pagination.js';
+/** Bytes above which `instructions` carry a pointer rather than the body. */
+export const INSTRUCTIONS_SKILL_LIMIT = 16 * 1024;
+const projection = (alias = '') => ['version', 'files', 'name', 'description', 'has_scripts', 'principal', 'surface', 'connection_id', 'restored_from']
+    .map((column) => `${alias}${column}`)
+    .concat(`${alias}created_at::text AS created_at_text`)
+    .join(', ');
+/** `installation_skill_versions` has no `connection_id`; it reads as NULL. */
+const PROJECTION = projection();
+const INSTALLATION_PROJECTION = PROJECTION.replace('connection_id', 'NULL::uuid AS connection_id');
+const byAgent = (row) => row.surface !== 'rest' || row.connection_id !== null || row.principal.startsWith('service_account:');
+const meta = (row) => ({
+    version: row.version,
+    name: row.name,
+    description: row.description,
+    hasScripts: row.has_scripts,
+    fileCount: Object.keys(row.files).length,
+    principal: row.principal,
+    surface: row.surface,
+    connectionId: row.connection_id,
+    byAgent: byAgent(row),
+    restoredFrom: row.restored_from,
+    createdAt: row.created_at_text,
+});
+const full = (row) => ({ ...meta(row), files: row.files });
+const actor = (auth) => `${auth.principal.type}:${auth.principal.id}`;
+/** A catalog entry, which names a skill's files and does not carry them. */
+function withoutFiles(skill) {
+    const { files, ...entry } = skill;
+    void files;
+    return entry;
+}
+/** The default skill as an entry, for an installation nobody has configured. */
+function defaultEntry() {
+    const check = checkSkill({ ...DEFAULT_SKILL });
+    // `skill.test.ts` holds this; a default the format refuses is a release bug.
+    if (check.kind !== 'skill')
+        throw new Error('the default skill does not pass checkSkill');
+    return {
+        level: 'default',
+        layerId: null,
+        layerSlug: null,
+        name: check.skill.name,
+        description: check.skill.description,
+        version: null,
+        hasScripts: check.skill.hasScripts,
+        paths: Object.keys(DEFAULT_SKILL),
+        files: DEFAULT_SKILL,
+    };
+}
+export class PostgresSkills {
+    pool;
+    role;
+    principalsCache;
+    constructor(pool, role, principalsCache) {
+        this.pool = pool;
+        this.role = role;
+        this.principalsCache = principalsCache;
+    }
+    get scope() {
+        return this.role === undefined ? {} : { role: this.role };
+    }
+    // ── who sees and who writes ────────────────────────────────────────────────
+    /**
+     * The layers whose skill this caller sees: any permission on the layer,
+     * `write` included, within the delegation's narrowing for that permission.
+     *
+     * `admin` implies both, so asking `read` and `write` covers it. A grant on a
+     * single document is not a permission on its layer and does not count — the
+     * skill describes the layer, and a document grant says nothing about it.
+     */
+    async visibleLayers(client, auth) {
+        // Rule 2: administering tenants is not access to one tenant's anything.
+        if (administersTenants(auth))
+            return new Set();
+        const ctx = await contextFor(client, auth, this.principalsCache);
+        const live = async () => {
+            const { rows } = await client.query('SELECT id FROM layers WHERE org_id = $1 AND deleted_at IS NULL', [auth.orgId]);
+            return rows.map((r) => r.id);
+        };
+        let all;
+        const seen = new Set();
+        for (const permission of ['read', 'write']) {
+            const plan = activeResolver().resolve(ctx, permission);
+            if (plan.kind === 'none')
+                continue;
+            const reached = plan.kind === 'all' ? (all ??= await live()) : plan.layers;
+            const narrowing = delegatedLayers(auth, permission);
+            for (const id of reached)
+                if (narrowing === undefined || narrowing.includes(id))
+                    seen.add(id);
+        }
+        if (seen.size === 0)
+            return seen;
+        // Deleted layers are not there, whatever a grant still names.
+        const { rows } = await client.query('SELECT id FROM layers WHERE org_id = $1 AND deleted_at IS NULL AND id = ANY($2::uuid[])', [auth.orgId, [...seen]]);
+        return new Set(rows.map((r) => r.id));
+    }
+    /**
+     * `may_write_layer_skill` in docs/skills.md: `admin` resolved on the layer,
+     * and for a delegation the layer inside its narrowing for `admin`.
+     *
+     * The consent screen's per-layer `skill` box is the second clause of the
+     * specification's disjunction and arrives with it; until then a delegation
+     * writes a layer's skill only where its ceiling holds `admin` there, which
+     * the ordinary consent screen never sets.
+     */
+    async mayWriteLayer(client, auth, layerId) {
+        if (administersTenants(auth))
+            return false;
+        const plan = activeResolver().resolve(await contextFor(client, auth, this.principalsCache), 'admin');
+        if (plan.kind === 'none')
+            return false;
+        if (plan.kind === 'scoped' && !plan.layers.includes(layerId))
+            return false;
+        return withinDelegation(auth, layerId, 'admin');
+    }
+    mayReadLevel = async (client, auth, level) => {
+        switch (level.kind) {
+            case 'installation':
+                // Read by everybody it applies to, which is everybody: it is the base
+                // skill of every organization that has not set its own.
+                return true;
+            case 'organization':
+                return !administersTenants(auth);
+            case 'layer':
+                return (await this.visibleLayers(client, auth)).has(level.layerId);
+        }
+    };
+    mayWriteLevel = async (client, auth, level) => {
+        switch (level.kind) {
+            case 'installation':
+                return administersTenants(auth);
+            case 'organization':
+                return administers(auth);
+            case 'layer':
+                return this.mayWriteLayer(client, auth, level.layerId);
+        }
+    };
+    // ── reading ────────────────────────────────────────────────────────────────
+    async latest(client, auth, level) {
+        if (level.kind === 'installation') {
+            const { rows } = await client.query(`SELECT ${INSTALLATION_PROJECTION} FROM installation_skill_versions ORDER BY version DESC LIMIT 1`);
+            return rows[0];
+        }
+        const { rows } = await client.query(`SELECT ${PROJECTION} FROM skill_versions
+        WHERE org_id = $1 AND layer_id IS NOT DISTINCT FROM $2
+        ORDER BY version DESC LIMIT 1`, [auth.orgId, level.kind === 'layer' ? level.layerId : null]);
+        return rows[0];
+    }
+    live = (row) => row !== undefined && row.name !== null;
+    async base(auth) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const own = administersTenants(auth) ? undefined : await this.latest(client, auth, { kind: 'organization' });
+            if (this.live(own))
+                return this.entry(own, 'organization', null, null);
+            const installation = await this.latest(client, auth, { kind: 'installation' });
+            if (this.live(installation))
+                return this.entry(installation, 'installation', null, null);
+            return defaultEntry();
+        }, this.scope);
+    }
+    entry(row, level, layerId, layerSlug) {
+        return {
+            level,
+            layerId,
+            layerSlug,
+            name: row.name ?? '',
+            description: row.description ?? '',
+            version: row.version,
+            hasScripts: row.has_scripts,
+            paths: Object.keys(row.files),
+            files: row.files,
+        };
+    }
+    async list(auth, page) {
+        const base = withoutFiles(await this.base(auth));
+        const layers = await withOrg(this.pool, auth.orgId, async (client) => {
+            const visible = await this.visibleLayers(client, auth);
+            if (visible.size === 0)
+                return { items: [], nextCursor: null };
+            // The newest version per layer, and only layers whose newest is live:
+            // a cleared layer skill is no layer skill. Seeking on the layer's own
+            // `(created_at, id)`, so a page boundary does not move when a skill is
+            // written in the middle of a walk.
+            const { rows } = await client.query(`SELECT * FROM (
+             SELECT DISTINCT ON (v.layer_id) v.layer_id, l.slug, l.created_at::text AS layer_created,
+                    ${projection('v.')}
+               FROM skill_versions v
+               JOIN layers l ON l.id = v.layer_id AND l.org_id = v.org_id AND l.deleted_at IS NULL
+              WHERE v.org_id = $1 AND v.layer_id = ANY($2::uuid[])
+              ORDER BY v.layer_id, v.version DESC
+           ) newest
+           WHERE name IS NOT NULL
+             AND ($3::timestamptz IS NULL OR (layer_created::timestamptz, layer_id) > ($3::timestamptz, $4::uuid))
+           ORDER BY layer_created::timestamptz, layer_id
+           LIMIT ${String(page.limit)}`, [auth.orgId, [...visible], page.after?.createdAt ?? null, page.after?.id ?? null]);
+            const items = rows.map((r) => withoutFiles(this.entry(r, 'layer', r.layer_id, r.slug)));
+            const last = rows[rows.length - 1];
+            return {
+                items,
+                nextCursor: rows.length < page.limit || last === undefined
+                    ? null
+                    : encodeCursor({ createdAt: last.layer_created, id: last.layer_id }),
+            };
+        }, this.scope);
+        return { base, layers };
+    }
+    async layerBySlug(auth, slug) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows } = await client.query('SELECT id FROM layers WHERE org_id = $1 AND slug = $2 AND deleted_at IS NULL', [auth.orgId, slug]);
+            const id = rows[0]?.id;
+            if (id === undefined)
+                return undefined;
+            // A slug the caller cannot see is a slug that is not there.
+            return (await this.visibleLayers(client, auth)).has(id) ? id : undefined;
+        }, this.scope);
+    }
+    async current(auth, level) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            if (!(await this.mayReadLevel(client, auth, level)))
+                return undefined;
+            const row = await this.latest(client, auth, level);
+            return this.live(row) ? full(row) : undefined;
+        }, this.scope);
+    }
+    async versions(auth, level, page) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // History says who wrote what and through which connection; it is
+            // shown to whoever may write the level, not to everybody who reads it.
+            if (!(await this.mayWriteLevel(client, auth, level)))
+                return undefined;
+            const before = page.after === undefined ? null : Number(page.after.id);
+            const { rows } = level.kind === 'installation'
+                ? await client.query(`SELECT ${INSTALLATION_PROJECTION} FROM installation_skill_versions
+                  WHERE ($1::int IS NULL OR version < $1) ORDER BY version DESC LIMIT ${String(page.limit)}`, [before])
+                : await client.query(`SELECT ${PROJECTION} FROM skill_versions
+                  WHERE org_id = $1 AND layer_id IS NOT DISTINCT FROM $2 AND ($3::int IS NULL OR version < $3)
+                  ORDER BY version DESC LIMIT ${String(page.limit)}`, [auth.orgId, level.kind === 'layer' ? level.layerId : null, before]);
+            const items = rows.map(meta);
+            const last = rows[rows.length - 1];
+            return {
+                items,
+                nextCursor: rows.length < page.limit || last === undefined
+                    ? null
+                    : encodeCursor({ createdAt: last.created_at_text, id: String(last.version) }),
+            };
+        }, this.scope);
+    }
+    async version(auth, level, n) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            if (!(await this.mayWriteLevel(client, auth, level)))
+                return undefined;
+            const row = await this.at(client, auth, level, n);
+            return row === undefined ? undefined : full(row);
+        }, this.scope);
+    }
+    async at(client, auth, level, n) {
+        const { rows } = level.kind === 'installation'
+            ? await client.query(`SELECT ${INSTALLATION_PROJECTION} FROM installation_skill_versions WHERE version = $1`, [n])
+            : await client.query(`SELECT ${PROJECTION} FROM skill_versions
+              WHERE org_id = $1 AND layer_id IS NOT DISTINCT FROM $2 AND version = $3`, [auth.orgId, level.kind === 'layer' ? level.layerId : null, n]);
+        return rows[0];
+    }
+    // ── writing ────────────────────────────────────────────────────────────────
+    async write(auth, level, files, basedOn, surface) {
+        const check = checkSkill(files);
+        if (check.kind === 'refused')
+            return { kind: 'refused', reason: check.reason };
+        const stored = check.kind === 'skill' ? check.skill : undefined;
+        return this.insert(auth, level, basedOn, surface, stored, null);
+    }
+    async restore(auth, level, n, basedOn, surface) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const gate = await this.gate(client, auth, level, surface);
+            if (gate !== undefined)
+                return gate;
+            const row = await this.at(client, auth, level, n);
+            if (row === undefined)
+                return { kind: 'not_found' };
+            const check = checkSkill(row.files);
+            // A stored version passed the format when it was written; a version the
+            // format now refuses is restored as written rather than silently dropped.
+            const skill = check.kind === 'skill'
+                ? check.skill
+                : check.kind === 'cleared' || row.name === null
+                    ? undefined
+                    : { name: row.name, description: row.description ?? '', hasScripts: row.has_scripts, files: row.files };
+            return this.insertIn(client, auth, level, basedOn, surface, skill, n);
+        }, this.scope);
+    }
+    /** Visibility and permission, in that order, so an invisible level is `not_found`. */
+    async gate(client, auth, level, surface) {
+        if (level.kind === 'installation') {
+            // Rights spanning tenants stay in the API and the console, by decision.
+            if (surface !== 'rest')
+                return { kind: 'not_found' };
+            return administersTenants(auth) ? undefined : { kind: 'not_found' };
+        }
+        if (!(await this.mayReadLevel(client, auth, level)))
+            return { kind: 'not_found' };
+        if (level.kind === 'layer') {
+            const { rows } = await client.query('SELECT id FROM layers WHERE org_id = $1 AND id = $2 AND deleted_at IS NULL', [auth.orgId, level.layerId]);
+            if (rows.length === 0)
+                return { kind: 'not_found' };
+        }
+        return (await this.mayWriteLevel(client, auth, level)) ? undefined : { kind: 'forbidden' };
+    }
+    async insert(auth, level, basedOn, surface, skill, restoredFrom) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const gate = await this.gate(client, auth, level, surface);
+            if (gate !== undefined)
+                return gate;
+            return this.insertIn(client, auth, level, basedOn, surface, skill, restoredFrom);
+        }, this.scope);
+    }
+    async insertIn(client, auth, level, basedOn, surface, skill, restoredFrom) {
+        const current = (await this.latest(client, auth, level))?.version ?? 0;
+        // A write names the version it was based on, and any other is a conflict —
+        // checked here, and again by the unique key, which is what holds when two
+        // writers both read the same `current` and race to insert after it.
+        if (basedOn !== current)
+            return { kind: 'conflict', current };
+        const values = [
+            basedOn + 1,
+            JSON.stringify(skill?.files ?? {}),
+            skill?.name ?? null,
+            skill?.description ?? null,
+            skill?.hasScripts ?? false,
+            actor(auth),
+            surface,
+            restoredFrom,
+        ];
+        try {
+            await client.query('SAVEPOINT skill_write');
+            const { rows } = level.kind === 'installation'
+                ? await client.query(`INSERT INTO installation_skill_versions
+                 (version, files, name, description, has_scripts, principal, surface, restored_from)
+               VALUES ($1, $2::jsonb, $3, $4, $5, $6, $7, $8) RETURNING ${INSTALLATION_PROJECTION}`, values)
+                : await client.query(`INSERT INTO skill_versions
+                 (version, files, name, description, has_scripts, principal, surface, restored_from,
+                  org_id, layer_id, connection_id)
+               VALUES ($1, $2::jsonb, $3, $4, $5, $6, $7, $8, $9, $10, $11) RETURNING ${PROJECTION}`, [...values, auth.orgId, level.kind === 'layer' ? level.layerId : null, auth.delegation?.id ?? null]);
+            await client.query('RELEASE SAVEPOINT skill_write');
+            const row = rows[0];
+            return { kind: 'written', version: meta(row), cleared: skill === undefined };
+        }
+        catch (error) {
+            if (error.code === '23505') {
+                await client.query('ROLLBACK TO SAVEPOINT skill_write');
+                const now = (await this.latest(client, auth, level))?.version ?? 0;
+                return { kind: 'conflict', current: now };
+            }
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=skills.js.map

package/dist/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,cAAc,EACd,UAAU,EACV,aAAa,EACb,OAAO,GAGR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,UAAU,EAAwB,MAAM,eAAe,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAoB,MAAM,WAAW,CAAA;AAChH,OAAO,EAAE,YAAY,EAA8B,MAAM,iBAAiB,CAAA;AAuF1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAA;AAejD,MAAM,UAAU,GAAG,CAAC,KAAK,GAAG,EAAE,EAAU,EAAE,CACxC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,CAAC;KACjH,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;KACpC,MAAM,CAAC,GAAG,KAAK,qCAAqC,CAAC;KACrD,IAAI,CAAC,IAAI,CAAC,CAAA;AAEf,8EAA8E;AAC9E,MAAM,UAAU,GAAG,UAAU,EAAE,CAAA;AAC/B,MAAM,uBAAuB,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAA;AAElG,MAAM,OAAO,GAAG,CAAC,GAAe,EAAW,EAAE,CAC3C,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAA;AAEtG,MAAM,IAAI,GAAG,CAAC,GAAe,EAAoB,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,UAAU,EAAE,GAAG,CAAC,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM;IACxC,SAAS,EAAE,GAAG,CAAC,SAAS;IACxB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,YAAY,EAAE,GAAG,CAAC,aAAa;IAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;IACrB,YAAY,EAAE,GAAG,CAAC,aAAa;IAC/B,SAAS,EAAE,GAAG,CAAC,eAAe;CAC/B,CAAC,CAAA;AAEF,MAAM,IAAI,GAAG,CAAC,GAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;AAEpF,MAAM,KAAK,GAAG,CAAC,IAAiB,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAA;AAE1F,4EAA4E;AAC5E,SAAS,YAAY,CAAC,KAAoB;IACxC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAA;IACjC,KAAK,KAAK,CAAA;IACV,OAAO,KAAK,CAAA;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;IAC9C,6EAA6E;IAC7E,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IACzF,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;QACtB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW;QACpC,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;QAClC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;QACjC,KAAK,EAAE,aAAa;KACrB,CAAA;AACH,CAAC;AAED,MAAM,OAAO,cAAc;IAEN;IACA;IACA;IAHnB,YACmB,IAAU,EACV,IAAa,EACb,eAAiC;QAFjC,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;QACb,oBAAe,GAAf,eAAe,CAAkB;IACjD,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED,8EAA8E;IAE9E;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,IAAiB;QAC/D,wEAAwE;QACxE,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;QAChE,MAAM,IAAI,GAAG,KAAK,IAAuB,EAAE;YACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,gEAAgE,EAChE,CAAC,IAAI,CAAC,KAAK,CAAC,CACb,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC9B,CAAC,CAAA;QACD,IAAI,GAAyB,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,UAAU,IAAI,CAAC,MAAM,EAAE,OAAO,CAA0C,EAAE,CAAC;YACpF,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YACtD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAQ;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;YAC1E,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YACnD,KAAK,MAAM,EAAE,IAAI,OAAO;gBAAE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAChC,8DAA8D;QAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,yFAAyF,EACzF,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CACxB,CAAA;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACvC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CAAC,MAAkB,EAAE,IAAiB,EAAE,OAAe;QAChF,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1C,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,CAAA;QACpG,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,KAAK,CAAA;QACtC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC1E,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAEO,YAAY,GAAG,KAAK,EAAE,MAAkB,EAAE,IAAiB,EAAE,KAAiB,EAAoB,EAAE;QAC1G,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,cAAc;gBACjB,sEAAsE;gBACtE,wDAAwD;gBACxD,OAAO,IAAI,CAAA;YACb,KAAK,cAAc;gBACjB,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAClC,KAAK,OAAO;gBACV,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACtE,CAAC;IACH,CAAC,CAAA;IAEO,aAAa,GAAG,KAAK,EAAE,MAAkB,EAAE,IAAiB,EAAE,KAAiB,EAAoB,EAAE;QAC3G,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,cAAc;gBACjB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAA;YACjC,KAAK,cAAc;gBACjB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAA;YAC1B,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAEtE,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,IAAiB,EAAE,KAAiB;QAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,UAAU,uBAAuB,iEAAiE,CACnG,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,UAAU,UAAU;;sCAEY,EAChC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAC5D,CAAA;QACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IAEO,IAAI,GAAG,CAAC,GAA2B,EAAqB,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAA;IAEzG,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;YAC5G,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACtE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;YAC9E,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACxF,OAAO,YAAY,EAAE,CAAA;QACvB,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,GAAe,EAAE,KAA0B,EAAE,OAAsB,EAAE,SAAwB;QACzG,OAAO;YACL,KAAK;YACL,OAAO;YACP,SAAS;YACT,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,IAAU;QACtC,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAmC,EAAE;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACtD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YAC9D,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,mCAAmC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAGjC;;sBAEY,UAAU,CAAC,IAAI,CAAC;;;;;;;;;mBASnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC7B,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,CAClF,CAAA;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACvF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAClC,OAAO;gBACL,KAAK;gBACL,UAAU,EACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,SAAS;oBAC5C,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;aACzE,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAiB,EAAE,IAAY;QAC/C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CACnB,CAAA;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;YACtB,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACtC,4DAA4D;YAC5D,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAiB,EAAE,KAAiB;QAChD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/C,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAiB,EAAE,KAAiB,EAAE,IAAU;QAC7D,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,kEAAkE;YAClE,uEAAuE;YACvE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACtE,MAAM,EAAE,IAAI,EAAE,GACZ,KAAK,CAAC,IAAI,KAAK,cAAc;gBAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB,UAAU,uBAAuB;wFACuC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAC5F,CAAC,MAAM,CAAC,CACT;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB,UAAU,UAAU;;gDAEY,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EACpD,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CACpE,CAAA;YACP,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAClC,OAAO;gBACL,KAAK;gBACL,UAAU,EACR,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,SAAS;oBAC5C,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;aAClF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAiB,EAAE,KAAiB,EAAE,CAAS;QAC3D,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YACjD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,EAAE,CAAC,MAAkB,EAAE,IAAiB,EAAE,KAAiB,EAAE,CAAS;QAClF,MAAM,EAAE,IAAI,EAAE,GACZ,KAAK,CAAC,IAAI,KAAK,cAAc;YAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAa,UAAU,uBAAuB,sDAAsD,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9H,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB,UAAU,UAAU;sFACsD,EAC1E,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC/D,CAAA;QACP,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;IAChB,CAAC;IAED,8EAA8E;IAE9E,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,KAAiB,EAAE,KAAc,EAAE,OAAe,EAAE,OAAqB;QACtG,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;QAC9E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAiB,EAAE,KAAiB,EAAE,CAAS,EAAE,OAAe,EAAE,OAAqB;QACnG,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAuB,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YACjD,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACnC,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,KAAK,OAAO;gBACpB,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBAC7C,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;YAC7G,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACvE,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,IAAiB,EAAE,KAAiB,EAAE,OAAqB;QAChG,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,wEAAwE;YACxE,IAAI,OAAO,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YACpD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACrE,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACjF,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,4EAA4E,EAC5E,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAC5B,CAAA;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACrD,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;IAC5F,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAiB,EACjB,KAAiB,EACjB,OAAe,EACf,OAAqB,EACrB,KAAgG,EAChG,YAA2B;QAE3B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAuB,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;YAC1D,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAA;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;QAClF,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,MAAkB,EAClB,IAAiB,EACjB,KAAiB,EACjB,OAAe,EACf,OAAqB,EACrB,KAAgG,EAChG,YAA2B;QAE3B,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAA;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;QAE7D,MAAM,MAAM,GAAG;YACb,OAAO,GAAG,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;YAClC,KAAK,EAAE,IAAI,IAAI,IAAI;YACnB,KAAK,EAAE,WAAW,IAAI,IAAI;YAC1B,KAAK,EAAE,UAAU,IAAI,KAAK;YAC1B,KAAK,CAAC,IAAI,CAAC;YACX,OAAO;YACP,YAAY;SACb,CAAA;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;YAC3C,MAAM,EAAE,IAAI,EAAE,GACZ,KAAK,CAAC,IAAI,KAAK,cAAc;gBAC3B,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;0EAE4D,uBAAuB,EAAE,EACrF,MAAM,CACP;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;wFAG0E,UAAU,EAAE,EACtF,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC,CACpG,CAAA;YACP,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAe,CAAA;YACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAA;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA2B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;gBACvD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAA;gBAClE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;YAC3C,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nacre.work/api",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Nacre REST API and authorization service",
   "repository": {
     "type": "git",
@@ -29,7 +29,7 @@
   "dependencies": {
     "jose": "^6.2.12",
     "pg": "^8.23.0",
-    "@nacre.work/core": "0.28.0"
+    "@nacre.work/core": "0.29.0"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",