@nacre.work/api 0.31.1 → 0.32.0

package/dist/main.js

@@ -1,6 +1,5 @@
 import { configureLogging, collectDatabaseGauges, createMetrics, createPool, loadConfig, loadedExtensions, loadModules, logger, loadJwtKeys, createMailer, loadMailConfig, loadSecondFactorKey, keyFingerprint, protectedResourceMetadata, Redis, RedisCache, Registry, S3, VectorStore, vectorStoreOptions, pendingMigrations, withOrg, ConfigError, installGuards, onListenError, } from '@nacre.work/core';
 import { HttpEmbedder, NacreIngest, NacreSearchService, PostgresAudit, PostgresAuditReader, PostgresDocuments, PostgresGrants, PostgresJobs, PostgresLayers, PostgresReferenceQueries, PostgresReindex, PostgresEmbeddingProviders, PostgresWorkspaces, } from './adapters.js';
-import { SignJWT } from 'jose';
 import { Idempotency } from './idempotency.js';
 import { Login } from './login.js';
 import { PasswordRecovery } from './recovery.js';
@@ -14,6 +13,7 @@ import { PostgresSkills } from './skills.js';
 import { PostgresServiceAccounts } from './service-keys.js';
 import { postgresVerification } from './verification.js';
 import { createApi } from './server.js';
+import { oauthMinter } from './oauth-mint.js';
 /**
  * The REST API process.
  *
@@ -379,48 +379,17 @@ async function main() {
             // inventing a second pair of knobs would be two answers to one question.
             refreshTtlSeconds: config.refreshTokenTtl,
             accessTtlSeconds: config.accessTokenTtl,
-            /**
-             * A token for whatever the connection acts as.
-             *
-             * For an **agent**: `principal_type: 'service_account'` and `sub` is the
-             * account — the same claims a service account key resolves to, so
-             * everything downstream treats this exactly as it treats one and there is
-             * no second notion of what an agent is. `role` is `member` because a
-             * service account has no organization-wide role: everything it reaches,
-             * it reaches by grant.
-             *
-             * For a **delegation**: `principal_type: 'user'` and `sub` is the person,
-             * plus `del` naming the connection. The permitted set is deliberately not
-             * in here — a token carrying one would keep answering with the access its
-             * holder had at consent, and every revocation would wait for it to
-             * expire. `role` is carried for shape and is **not** what the request
-             * runs as: `authenticate` takes the role from the connection's row, so a
-             * demotion applies without waiting for the token to expire.
-             */
-            mint: async (approved) => {
-                const ttl = config.accessTokenTtl;
-                const now = Math.floor(Date.now() / 1000);
-                const delegated = approved.subject.actsAs === 'user';
-                const accessToken = await new SignJWT({
-                    org: approved.orgId,
-                    principal_type: delegated ? 'user' : 'service_account',
-                    role: 'member',
-                    ...(delegated ? { del: approved.consentId } : {}),
-                })
-                    .setProtectedHeader({
-                    alg: jwt.algorithm,
-                    ...(jwt.keyId === undefined ? {} : { kid: jwt.keyId }),
-                })
-                    .setSubject(approved.subject.actsAs === 'user'
-                    ? approved.subject.userId
-                    : approved.subject.serviceAccountId)
-                    .setIssuer(config.jwtIssuer)
-                    .setAudience(config.jwtAudience)
-                    .setIssuedAt(now)
-                    .setExpirationTime(now + ttl)
-                    .sign(jwt.signing);
-                return { accessToken, expiresIn: ttl };
-            },
+            // `oauth-mint.ts`, so the audience rule — the administrative MCP's own,
+            // or the installation's — is one function this process and the suite
+            // that tests it both call.
+            mint: oauthMinter({
+                issuer: config.jwtIssuer,
+                audience: config.jwtAudience,
+                ttlSeconds: config.accessTokenTtl,
+                signing: jwt.signing,
+                algorithm: jwt.algorithm,
+                ...(jwt.keyId === undefined ? {} : { keyId: jwt.keyId }),
+            }),
         },
     });
     const port = Number(process.env.PORT ?? 8080);

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,WAAW,EACX,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,yBAAyB,EACzB,KAAK,EACL,UAAU,EACV,QAAQ,EACR,EAAE,EACF,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAE9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAE3B,+EAA+E;IAC/E,+EAA+E;IAC/E,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtE,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAEhE,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEjD,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,iBAAiB;IACjB,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IAGxF,MAAM,aAAa,GAAkC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,GAAG,EAAE;QAC9D,uEAAuE;QACvE,wEAAwE;QACxE,4DAA4D;QAC5D,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE,aAAa,EAAE,GAAG,EAAE;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,KAAK;QACL,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,yEAAyE;YACzE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC;YACxC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,QAAQ;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;KACF,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,KAAK;QACL,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;KACF,CAAC,CAAA;IAEF;;;;;;;;;;;;;;;OAeG;IACH,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,IAAI;QACJ,GAAG,EAAE,eAAe;QACpB,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,6DAA6D;QAC7D,EAAE;QACF,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,EAAE,SAAS,CAAC,QAAQ;QAC1B,YAAY,EAAE;YACZ,yEAAyE;YACzE,uEAAuE;YACvE,aAAa;YACb,EAAE,EAAE,SAAS,CAAC,QAAQ;YACtB,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB;;;;;;;;;eASG;YACH,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC;SACzD;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,CAAA;IAC7C,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,IAAI;YACJ,MAAM;YACN,qEAAqE;YACrE,mEAAmE;YACnE,sBAAsB;YACtB,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAA;IAER,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO;QACP,GAAG,EAAE,GAAG,CAAC,OAAO;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;KAC1D,CAAC,CAAA;IAEF,oDAAoD;IACpD,EAAE;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,aAAa;IACb,MAAM,KAAK,GAAG,KAAK,IAAsC,EAAE;QACzD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,OAAO,CAAC,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzB,OAAO,IAAI,CAAA;YACb,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACzC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAC/B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvF,6DAA6D;YAC7D,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,sDAAsD;YACtD,EAAE;YACF,kEAAkE;YAClE,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,kEAAkE;YAClE,uEAAuE;YACvE,iCAAiC;YACjC,iBAAiB,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACzC,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;iBACjB,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,mEAAmE;gBACnE,qEAAqE;gBACrE,uCAAuC;gBACvC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5E,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;SACL,CAAC,CAAA;QACF,OAAO;YACL,QAAQ;YACR,MAAM;YACN,KAAK,EAAE,OAAO;YACd,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SAC5C,CAAA;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,yEAAyE;YACzE,kEAAkE;YAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACtE,UAAU,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,sEAAsE;YACtE,wEAAwE;YACxE,8BAA8B;YAC9B,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;SACxC;QACD,OAAO,EAAE,QAAQ;QACjB,gBAAgB,EAAE,yBAAyB,CAAC;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,6DAA6D;YAC7D,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,mBAAmB,EACjB,MAAM,CAAC,wBAAwB,KAAK,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,wBAAwB;SACtC,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,UAAU;QACV,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,0EAA0E;QAC1E,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,qEAAqE;QACrE,mEAAmE;QACnE,aAAa,EAAE,OAAO,KAAK,SAAS;QACpC,MAAM;QACN,aAAa;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,cAAc,EAAE,MAAM,CAAC,iBAAiB;QACxC,WAAW;QACX,KAAK;QACL,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACrE,OAAO,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACtE,gBAAgB,EAAE,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC/E,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,SAAS,EAAE,IAAI,iBAAiB,CAC9B,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,eAAe,EACf,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtE;QACD,MAAM,EAAE,IAAI,kBAAkB,CAAC;YAC7B,eAAe;YACf,IAAI;YACJ,OAAO;YACP,uEAAuE;YACvE,2CAA2C;YAC3C,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;YACtF,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtG,CAAC;SACF,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC;QACtC,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,MAAM,EAAE,IAAI,WAAW,CAAC;YACtB,IAAI;YACJ,eAAe;YACf,SAAS,EAAE,OAAO;YAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACvD,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACpE,UAAU,EAAE,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACnE,kBAAkB,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,oBAAoB,CAAC;QACzH,mBAAmB,EAAE,MAAM,CAAC,oBAAoB;QAChD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,eAAe,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5D,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAE1C;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,+BAA+B;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACjD,cAAc,EAAE,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/D,QAAQ,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACnD,aAAa,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7D,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC;;;;;;;;;;;;;;;;;eAiBG;YACH,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACvB,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,CAAA;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;gBACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAA;gBACpD,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;oBACpC,GAAG,EAAE,QAAQ,CAAC,KAAK;oBACnB,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;oBACtD,IAAI,EAAE,QAAQ;oBACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC;qBACC,kBAAkB,CAAC;oBAClB,GAAG,EAAE,GAAG,CAAC,SAAS;oBAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;iBACvD,CAAC;qBACD,UAAU,CACT,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;oBAChC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBACzB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CACtC;qBACA,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;qBAC3B,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC;qBAC/B,WAAW,CAAC,GAAG,CAAC;qBAChB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;qBAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;YACxC,CAAC;SACF;KACF,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YACzC,uEAAuE;YACvE,kEAAkE;YAClE,mCAAmC;YACnC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,0CAA0C;YAC1C,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAElC,aAAa,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,MAAM,EACN,WAAW,EACX,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,yBAAyB,EACzB,KAAK,EACL,UAAU,EACV,QAAQ,EACR,EAAE,EACF,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,OAAO,EACP,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,wBAAwB,EACxB,eAAe,EACf,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,eAAe,CAAA;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE7C;;;;;;GAMG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAE5B,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAE3B,+EAA+E;IAC/E,+EAA+E;IAC/E,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAEtE,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAEjC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IAEzB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAEvE,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACvC,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;IAEhE,2EAA2E;IAC3E,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEjD,wEAAwE;IACxE,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,iBAAiB;IACjB,EAAE;IACF,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,eAAe,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,CAAA;IAGxF,MAAM,aAAa,GAAkC;QACnD,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7D,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,IAAI,EAAE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,aAAa,EAAE,GAAG,EAAE;QAC9D,uEAAuE;QACvE,wEAAwE;QACxE,4DAA4D;QAC5D,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE,aAAa,EAAE,GAAG,EAAE;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC7B,KAAK;QACL,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,yEAAyE;YACzE,kEAAkE;YAClE,mEAAmE;YACnE,wCAAwC;YACxC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC9C,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,QAAQ;gBACnE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3C,CAAC;KACF,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAEpC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,KAAK;QACL,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;QAClH,CAAC;KACF,CAAC,CAAA;IAEF;;;;;;;;;;;;;;;OAeG;IACH,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC9C,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,IAAI;QACJ,GAAG,EAAE,eAAe;QACpB,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,6DAA6D;QAC7D,EAAE;QACF,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,EAAE,SAAS,CAAC,QAAQ;QAC1B,YAAY,EAAE;YACZ,yEAAyE;YACzE,uEAAuE;YACvE,aAAa;YACb,EAAE,EAAE,SAAS,CAAC,QAAQ;YACtB,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB;;;;;;;;;eASG;YACH,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC;SACzD;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAA;IAEF;;;;;;OAMG;IACH,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,CAAA;IAC7C,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACnB,IAAI;YACJ,MAAM;YACN,qEAAqE;YACrE,mEAAmE;YACnE,sBAAsB;YACtB,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,IAAI,EAAE,QAAQ;SACf,CAAC,CAAA;IAER,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO;QACP,GAAG,EAAE,GAAG,CAAC,OAAO;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;QAC5B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;KAC1D,CAAC,CAAA;IAEF,oDAAoD;IACpD,EAAE;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,+EAA+E;IAC/E,6EAA6E;IAC7E,gEAAgE;IAChE,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,aAAa;IACb,MAAM,KAAK,GAAG,KAAK,IAAsC,EAAE;QACzD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClE,OAAO,CAAC,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAChE,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACzB,OAAO,IAAI,CAAA;YACb,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACzC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAClC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAC/B,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YACvF,6DAA6D;YAC7D,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,mEAAmE;YACnE,sDAAsD;YACtD,EAAE;YACF,kEAAkE;YAClE,8DAA8D;YAC9D,EAAE;YACF,qEAAqE;YACrE,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,EAAE;YACF,kEAAkE;YAClE,uEAAuE;YACvE,iCAAiC;YACjC,iBAAiB,CAAC,IAAI,CAAC;iBACpB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAChB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBACrC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACzC,OAAO,EAAE,OAAO,CAAC,MAAM;oBACvB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;iBACjB,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,mEAAmE;gBACnE,qEAAqE;gBACrE,uCAAuC;gBACvC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBAC5E,OAAO,KAAK,CAAA;YACd,CAAC,CAAC;SACL,CAAC,CAAA;QACF,OAAO;YACL,QAAQ;YACR,MAAM;YACN,KAAK,EAAE,OAAO;YACd,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SAC5C,CAAA;IACH,CAAC,CAAA;IAED,MAAM,MAAM,GAAG,SAAS,CAAC;QACvB,MAAM,EAAE;YACN,GAAG,EAAE,GAAG,CAAC,YAAY;YACrB,yEAAyE;YACzE,kEAAkE;YAClE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACtE,UAAU,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;YAC3B,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;YAC5B,sEAAsE;YACtE,wEAAwE;YACxE,8BAA8B;YAC9B,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;SACxC;QACD,OAAO,EAAE,QAAQ;QACjB,gBAAgB,EAAE,yBAAyB,CAAC;YAC1C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,6DAA6D;YAC7D,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,iDAAiD;YACjD,mBAAmB,EACjB,MAAM,CAAC,wBAAwB,KAAK,EAAE;gBACpC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,wBAAwB;SACtC,CAAC;QACF,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,UAAU;QACV,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACrD,0EAA0E;QAC1E,uEAAuE;QACvE,iCAAiC;QACjC,OAAO,EAAE,OAAO;QAChB,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,qEAAqE;QACrE,mEAAmE;QACnE,aAAa,EAAE,OAAO,KAAK,SAAS;QACpC,MAAM;QACN,aAAa;QACb,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;QACnF,cAAc,EAAE,MAAM,CAAC,iBAAiB;QACxC,WAAW;QACX,KAAK;QACL,WAAW,EAAE,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACrE,OAAO,EAAE,IAAI,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACtE,gBAAgB,EAAE,IAAI,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC/E,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,SAAS,EAAE,IAAI,iBAAiB,CAC9B,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,eAAe,EACf,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CACtE;QACD,MAAM,EAAE,IAAI,kBAAkB,CAAC;YAC7B,eAAe;YACf,IAAI;YACJ,OAAO;YACP,uEAAuE;YACvE,2CAA2C;YAC3C,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,iBAAiB,CAAC;YACtF,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,cAAc,EAAE,CAAC,KAAK,EAAE,EAAE;gBACxB,qEAAqE;gBACrE,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtG,CAAC;SACF,CAAC;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC;QACtC,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,MAAM,EAAE,IAAI,WAAW,CAAC;YACtB,IAAI;YACJ,eAAe;YACf,SAAS,EAAE,OAAO;YAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,IAAI,EAAE,IAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACvD,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC;QACpE,UAAU,EAAE,IAAI,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QACnE,kBAAkB,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,oBAAoB,CAAC;QACzH,mBAAmB,EAAE,MAAM,CAAC,oBAAoB;QAChD,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3C,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC3D,eAAe,EAAE,IAAI,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5D,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxC,MAAM,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC;QAE1C;;;;;;;;;WASG;QACH,KAAK,EAAE;YACL,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/C,iEAAiE;YACjE,wEAAwE;YACxE,yEAAyE;YACzE,+BAA+B;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,IAAI,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACjD,cAAc,EAAE,IAAI,2BAA2B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC/D,QAAQ,EAAE,IAAI,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACnD,aAAa,EAAE,IAAI,0BAA0B,CAAC,IAAI,EAAE,QAAQ,CAAC;YAC7D,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC,wEAAwE;YACxE,qEAAqE;YACrE,2BAA2B;YAC3B,IAAI,EAAE,WAAW,CAAC;gBAChB,MAAM,EAAE,MAAM,CAAC,SAAS;gBACxB,QAAQ,EAAE,MAAM,CAAC,WAAW;gBAC5B,UAAU,EAAE,MAAM,CAAC,cAAc;gBACjC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;aACzD,CAAC;SACH;KACF,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;IAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI;YAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,SAAS;YACtB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC;YACzC,uEAAuE;YACvE,kEAAkE;YAClE,mCAAmC;YACnC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7D,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,0CAA0C;YAC1C,UAAU,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAElC,aAAa,CAAC;QACZ,OAAO,EAAE,KAAK;QACd,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YACnE,KAAK,CAAC,KAAK,EAAE,CAAA;YACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAA;QAClB,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC,CAAC,CAAA"}

package/dist/oauth-mint.d.ts

@@ -0,0 +1,42 @@
+import { type KeyObject } from 'jose';
+import type { MintRequest } from './oauth-store.js';
+/**
+ * The access token the consent flow issues, for whatever the connection acts as.
+ *
+ * For an **agent**: `principal_type: 'service_account'` and `sub` is the
+ * account — the same claims a service account key resolves to, so everything
+ * downstream treats this exactly as it treats one and there is no second notion
+ * of what an agent is. `role` is `member` because a service account has no
+ * organization-wide role: everything it reaches, it reaches by grant.
+ *
+ * For a **delegation**: `principal_type: 'user'` and `sub` is the person, plus
+ * `del` naming the connection. The permitted set is deliberately not in here —
+ * a token carrying one would keep answering with the access its holder had at
+ * consent, and every revocation would wait for it to expire. `role` is carried
+ * for shape and is **not** what the request runs as: `authenticate` takes the
+ * role from the connection's row, so a demotion applies without waiting for the
+ * token to expire.
+ *
+ * **The audience is the connection's.** A connection approved on the
+ * administrative MCP's screen mints `adminAudience(audience)`, which the API
+ * and `/mcp` refuse because they compare audiences exactly, and which
+ * `/mcp/admin` accepts and nothing else. Read from the connection on the first
+ * exchange and on every renewal, so a renewal cannot turn one kind of token
+ * into the other. docs/mcp-admin.md.
+ *
+ * Its own module so that the process issuing tokens and the suite holding the
+ * rule call the same function: a copy of this in a test would be a test of the
+ * copy.
+ */
+export declare function oauthMinter(input: {
+    readonly issuer: string;
+    readonly audience: string;
+    readonly ttlSeconds: number;
+    readonly signing: KeyObject | Uint8Array;
+    readonly algorithm: string;
+    readonly keyId?: string;
+}): (approved: MintRequest) => Promise<{
+    accessToken: string;
+    expiresIn: number;
+}>;
+//# sourceMappingURL=oauth-mint.d.ts.map

package/dist/oauth-mint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-mint.d.ts","sourceRoot":"","sources":["../src/oauth-mint.ts"],"names":[],"mappings":"AACA,OAAO,EAAW,KAAK,SAAS,EAAE,MAAM,MAAM,CAAA;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjF"}

package/dist/oauth-mint.js

@@ -0,0 +1,52 @@
+import { adminAudience } from '@nacre.work/core';
+import { SignJWT } from 'jose';
+/**
+ * The access token the consent flow issues, for whatever the connection acts as.
+ *
+ * For an **agent**: `principal_type: 'service_account'` and `sub` is the
+ * account — the same claims a service account key resolves to, so everything
+ * downstream treats this exactly as it treats one and there is no second notion
+ * of what an agent is. `role` is `member` because a service account has no
+ * organization-wide role: everything it reaches, it reaches by grant.
+ *
+ * For a **delegation**: `principal_type: 'user'` and `sub` is the person, plus
+ * `del` naming the connection. The permitted set is deliberately not in here —
+ * a token carrying one would keep answering with the access its holder had at
+ * consent, and every revocation would wait for it to expire. `role` is carried
+ * for shape and is **not** what the request runs as: `authenticate` takes the
+ * role from the connection's row, so a demotion applies without waiting for the
+ * token to expire.
+ *
+ * **The audience is the connection's.** A connection approved on the
+ * administrative MCP's screen mints `adminAudience(audience)`, which the API
+ * and `/mcp` refuse because they compare audiences exactly, and which
+ * `/mcp/admin` accepts and nothing else. Read from the connection on the first
+ * exchange and on every renewal, so a renewal cannot turn one kind of token
+ * into the other. docs/mcp-admin.md.
+ *
+ * Its own module so that the process issuing tokens and the suite holding the
+ * rule call the same function: a copy of this in a test would be a test of the
+ * copy.
+ */
+export function oauthMinter(input) {
+    return async (approved) => {
+        const now = Math.floor(Date.now() / 1000);
+        const delegated = approved.subject.actsAs === 'user';
+        const administrative = 'surface' in approved && approved.surface === 'admin';
+        const accessToken = await new SignJWT({
+            org: approved.orgId,
+            principal_type: delegated ? 'user' : 'service_account',
+            role: 'member',
+            ...(delegated ? { del: approved.consentId } : {}),
+        })
+            .setProtectedHeader({ alg: input.algorithm, ...(input.keyId === undefined ? {} : { kid: input.keyId }) })
+            .setSubject(approved.subject.actsAs === 'user' ? approved.subject.userId : approved.subject.serviceAccountId)
+            .setIssuer(input.issuer)
+            .setAudience(administrative ? adminAudience(input.audience) : input.audience)
+            .setIssuedAt(now)
+            .setExpirationTime(now + input.ttlSeconds)
+            .sign(input.signing);
+        return { accessToken, expiresIn: input.ttlSeconds };
+    };
+}
+//# sourceMappingURL=oauth-mint.js.map

package/dist/oauth-mint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-mint.js","sourceRoot":"","sources":["../src/oauth-mint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAkB,MAAM,MAAM,CAAA;AAI9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,WAAW,CAAC,KAO3B;IACC,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAA;QACpD,MAAM,cAAc,GAAG,SAAS,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAA;QAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,OAAO,CAAC;YACpC,GAAG,EAAE,QAAQ,CAAC,KAAK;YACnB,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;YACtD,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;aACxG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC5G,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;aACvB,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;aAC5E,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;aACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;IACrD,CAAC,CAAA;AACH,CAAC"}

package/dist/oauth-store.d.ts

@@ -74,6 +74,8 @@ export interface Consent {
      * looks live and answers nothing has exactly one explanation and this is it.
      */
     readonly approverDisabled: boolean;
+    /** Which resource it is for — the administrative MCP, or the API and `/mcp`. */
+    readonly surface: ConsentSurface;
     /**
      * The layers a delegation was narrowed to at consent, if any.
      *
@@ -117,9 +119,37 @@ export type MintRequest = {
         readonly userId: string;
     };
     readonly consentId: string;
+    /**
+     * Which resource the connection is for, read from its row — on the first
+     * exchange and on every renewal, because a renewal has no authorization
+     * request to read it from. `admin` mints a token for `/mcp/admin`'s
+     * audience and nothing else; see docs/mcp-admin.md.
+     */
+    readonly surface: ConsentSurface;
+};
+/**
+ * Which resource a connection is for. `default` reaches the API and `/mcp`, as
+ * every connection always has; `admin` reaches `/mcp/admin` and nothing else.
+ * A delegation only — migration 0038 refuses an administrative agent.
+ */
+export type ConsentSurface = 'default' | 'admin';
+/** `T` without its `surface`, distributed over the union so each arm keeps its shape. */
+type WithoutSurface<T> = T extends unknown ? Omit<T, 'surface'> : never;
+/**
+ * A consent that has been given and not yet exchanged.
+ *
+ * No `surface`: the code points at its connection, and the connection is where
+ * the surface is recorded. A second copy on the code would be a second answer
+ * about which audience a token gets, read on a different path.
+ */
+export type PendingAuthorization = WithoutSurface<MintRequest> & {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly codeChallenge: string;
+    readonly resource?: string;
 };
-/** A consent that has been given and not yet exchanged. */
-export type PendingAuthorization = MintRequest & {
+/** A code exchanged: what was pending, and the connection's surface read back from its row. */
+export type RedeemedAuthorization = MintRequest & {
     readonly clientId: string;
     readonly redirectUri: string;
     readonly codeChallenge: string;
@@ -151,7 +181,13 @@ export interface OAuthConsents {
      * deliberately not storable: a delegation that can do nothing is not a
      * restriction anybody meant to write, and the database refuses one.
      */
-    permissions?: readonly CeilingValue[]): Promise<string>;
+    permissions?: readonly CeilingValue[], 
+    /**
+     * Which resource the connection is for. Absent is `default`. Part of the
+     * connection's identity: the same application connected to both is two
+     * connections, and approving one never overwrites the other.
+     */
+    surface?: ConsentSurface): Promise<string>;
     /**
      * Every connection this caller may see.
      *
@@ -201,7 +237,7 @@ export interface OAuthAuthorizations {
      * — is a window in which the same code is exchanged twice, and an
      * authorization code redeemed twice is the definition of a replay.
      */
-    redeem(code: string): Promise<PendingAuthorization | undefined>;
+    redeem(code: string): Promise<RedeemedAuthorization | undefined>;
 }
 export declare class PostgresOAuthClients implements OAuthClients {
     private readonly pool;
@@ -218,13 +254,13 @@ export declare class PostgresOAuthAuthorizations implements OAuthAuthorizations
         code: string;
         expiresAt: Date;
     }): Promise<void>;
-    redeem(code: string): Promise<PendingAuthorization | undefined>;
+    redeem(code: string): Promise<RedeemedAuthorization | undefined>;
 }
 export declare class PostgresOAuthConsents implements OAuthConsents {
     private readonly pool;
     private readonly role?;
     constructor(pool: Pool, role?: string | undefined);
-    record(auth: AuthContext, clientId: string, subject: ConsentSubject, layers?: readonly LayerNarrowing[], permissions?: readonly CeilingValue[]): Promise<string>;
+    record(auth: AuthContext, clientId: string, subject: ConsentSubject, layers?: readonly LayerNarrowing[], permissions?: readonly CeilingValue[], surface?: ConsentSurface): Promise<string>;
     list(auth: AuthContext): Promise<readonly Consent[]>;
     revoke(auth: AuthContext, id: string): Promise<boolean>;
 }
@@ -256,7 +292,9 @@ export declare class PostgresDelegations implements Delegations {
     resolve(orgId: string, id: string): Promise<{
         userId: string;
         role: OrgRole;
+        surface: ConsentSurface;
         layers?: readonly LayerNarrowing[];
     } | undefined>;
 }
+export {};
 //# sourceMappingURL=oauth-store.d.ts.map

package/dist/oauth-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA0C,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACvF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAC3E,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAC/C;AAkBD,oFAAoF;AACpF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,YAAY,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAEL,2DAA2D;AAC3D,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACpG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE;IAClC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GACpC,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IACpD;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;CAC9G;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1G;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;CAChE;AAED,qBAAa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC;IActB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAWpE;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IA6BV,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;CAgFtE;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,EAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GACpC,OAAO,CAAC,MAAM,CAAC;IAmFZ,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAyEpD,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA8B9D;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IAEjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,KAAK,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;CAwG9G;AAED;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;KAAE,GAAG,SAAS,CAAC;CA6D9F"}
+{"version":3,"file":"oauth-store.d.ts","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA0C,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACvF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAG9B,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAC3E,gFAAgF;GAC9E;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,CAAA;CAC/C;AAkBD,oFAAoF;AACpF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,uDAAuD;IACvD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAA;IAClC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,YAAY,EAAE,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAA;IAC3F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CACjC,CAAA;AAEL;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,CAAA;AAEhD,yFAAyF;AACzF,KAAK,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACpG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE;IAClC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,MAAM,CAAC,CAAA;IAClB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAA;IACpD;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpH;;;;;;;;;;;;OAYG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC,CAAA;CAC9G;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1G;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,qBAAa,oBAAqB,YAAW,YAAY;IAErD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,CAAC;IActB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;CAWpE;AAED,qBAAa,2BAA4B,YAAW,mBAAmB;IAEnE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,oBAAoB,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IA6BV,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;CA4FvE;AAED,qBAAa,qBAAsB,YAAW,aAAa;IAEvD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,EAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,EACrC,OAAO,GAAE,cAA0B,GAClC,OAAO,CAAC,MAAM,CAAC;IAmFZ,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IA2EpD,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CA8B9D;AAED,qBAAa,0BAA2B,YAAW,kBAAkB;IAEjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,KAAK,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,MAAM,CAAC;IAiBZ,MAAM,CACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,WAAW,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;CA+G9G;AAED;;;;;;;;;;GAUG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IAEnD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAG1B,OAAO,CACX,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;KAAE,GAC9F,SAAS,CACZ;CAmEF"}

package/dist/oauth-store.js

@@ -99,13 +99,20 @@ export class PostgresOAuthAuthorizations {
         // one row and exactly one of them gets it back. The SELECT above decides
         // nothing — it only says which tenant to ask.
         return withOrg(this.pool, found, async (client) => {
-            const { rows } = await client.query(`UPDATE oauth_authorizations
+            const { rows } = await client.query(
+            // The connection's surface comes with the code, from the row the code
+            // points at — never from the authorization request's `resource`,
+            // which is the client's to send. What a person approved is what the
+            // consent handler wrote into that row.
+            `UPDATE oauth_authorizations a
               SET consumed_at = now()
-            WHERE code_hash = $1
-              AND consumed_at IS NULL
-              AND expires_at > now()
-          RETURNING org_id, acts_as, service_account_id, approved_by, client_id,
-                    redirect_uri, code_challenge, resource, consent_id`, [hashCode(code)]);
+            WHERE a.code_hash = $1
+              AND a.consumed_at IS NULL
+              AND a.expires_at > now()
+          RETURNING a.org_id, a.acts_as, a.service_account_id, a.approved_by, a.client_id,
+                    a.redirect_uri, a.code_challenge, a.resource, a.consent_id,
+                    (SELECT c.surface FROM oauth_consents c
+                      WHERE c.id = a.consent_id AND c.org_id = a.org_id) AS surface`, [hashCode(code)]);
             const row = rows[0];
             if (row === undefined)
                 return undefined;
@@ -123,7 +130,12 @@ export class PostgresOAuthAuthorizations {
                 // `consent_id IS NOT NULL` is in 0025's CHECK for the delegated
                 // shape, which is what lets this be a cast rather than a branch that
                 // has to decide what a delegation with no connection means.
-                return { ...common, subject: { actsAs: 'user', userId: row.approved_by }, consentId: row.consent_id };
+                return {
+                    ...common,
+                    subject: { actsAs: 'user', userId: row.approved_by },
+                    consentId: row.consent_id,
+                    surface: row.surface ?? 'default',
+                };
             }
             return {
                 ...common,
@@ -140,7 +152,7 @@ export class PostgresOAuthConsents {
         this.pool = pool;
         this.role = role;
     }
-    async record(auth, clientId, subject, layers, permissions) {
+    async record(auth, clientId, subject, layers, permissions, surface = 'default') {
         return withOrg(this.pool, auth.orgId, async (client) => {
             // Approving again reuses the row and clears a previous revocation: the
             // person is deliberately reconnecting an application they had ended,
@@ -159,16 +171,16 @@ export class PostgresOAuthConsents {
                  DO UPDATE SET revoked_at = NULL, approved_by = EXCLUDED.approved_by
                  RETURNING id`, [auth.orgId, clientId, subject.serviceAccountId, auth.principal.id])
                 : await client.query(`INSERT INTO oauth_consents
-                   (org_id, client_id, service_account_id, approved_by, acts_as, permissions)
-                 VALUES ($1,$2,NULL,$3,'user',$4)
-                 ON CONFLICT (org_id, client_id, approved_by) WHERE acts_as = 'user'
+                   (org_id, client_id, service_account_id, approved_by, acts_as, permissions, surface)
+                 VALUES ($1,$2,NULL,$3,'user',$4,$5)
+                 ON CONFLICT (org_id, client_id, approved_by, surface) WHERE acts_as = 'user'
                  DO UPDATE SET revoked_at = NULL, permissions = EXCLUDED.permissions
                  RETURNING id`, 
                 // Replaced on re-approval, never merged. Merging would make a
                 // ceiling that can only ever rise, which is the one direction
                 // a restriction must not move in.
                 [auth.orgId, clientId, subject.userId,
-                    permissions === undefined || permissions.length === 0 ? null : [...permissions]]);
+                    permissions === undefined || permissions.length === 0 ? null : [...permissions], surface]);
             const id = rows[0].id;
             if (subject.actsAs === 'user') {
                 // Replaced wholesale, in the same transaction as the row it belongs
@@ -221,7 +233,7 @@ export class PostgresOAuthConsents {
             // administrator who set it up — and a delegation's approver may be a
             // row that no longer exists. Neither is a reason to drop the line.
             `SELECT c.id, c.client_id, oc.client_name, c.acts_as, c.service_account_id,
-                  sa.name AS service_account_name, c.approved_by, c.permissions,
+                  sa.name AS service_account_name, c.approved_by, c.permissions, c.surface,
                   u.email AS approved_by_email,
                   u.disabled_at IS NOT NULL AS approver_disabled,
                   JSON_AGG(JSON_BUILD_OBJECT('id', cl.layer_id, 'permissions', cl.permissions))
@@ -246,6 +258,7 @@ export class PostgresOAuthConsents {
                 approvedBy: r.approved_by,
                 approvedByEmail: r.approved_by_email,
                 approverDisabled: r.approver_disabled,
+                surface: r.surface,
                 layers: narrowingOf(r.layers),
                 permissions: r.permissions ?? [],
                 createdAt: r.created_at,
@@ -316,9 +329,15 @@ export class PostgresOAuthRefreshTokens {
             `SELECT t.id, t.consent_id, t.family_id, t.used_at,
                   t.expires_at <= now() AS expired,
                   c.revoked_at IS NOT NULL AS revoked,
-                  c.acts_as, c.service_account_id, c.approved_by,
+                  c.acts_as, c.service_account_id, c.approved_by, c.surface,
+                  -- An administrative connection is suspended, not ended, when
+                  -- its person stops being an organization administrator: the
+                  -- same reversible state a disabled person's connections are
+                  -- in, so promoting them again restores it rather than asking
+                  -- for a reconnection. docs/mcp-admin.md.
                   (c.acts_as = 'user'
-                     AND (u.id IS NULL OR u.disabled_at IS NOT NULL OR u.role = 'platform_admin')) AS suspended
+                     AND (u.id IS NULL OR u.disabled_at IS NOT NULL OR u.role = 'platform_admin'
+                          OR (c.surface = 'admin' AND u.role <> 'org_admin'))) AS suspended
              FROM oauth_refresh_tokens t
              JOIN oauth_consents c ON c.id = t.consent_id
              LEFT JOIN users u ON u.id = c.approved_by AND u.org_id = c.org_id
@@ -365,7 +384,7 @@ export class PostgresOAuthRefreshTokens {
             ]);
             const base = { orgId: found, consentId: row.consent_id, family: row.family_id };
             return row.acts_as === 'user'
-                ? { ...base, subject: { actsAs: 'user', userId: row.approved_by } }
+                ? { ...base, subject: { actsAs: 'user', userId: row.approved_by }, surface: row.surface }
                 : { ...base, subject: { actsAs: 'service_account', serviceAccountId: row.service_account_id } };
         }, this.role === undefined ? {} : { role: this.role });
     }
@@ -402,6 +421,7 @@ export class PostgresDelegations {
             const { rows } = await client.query(`SELECT c.approved_by AS user_id,
                   u.role,
                   c.permissions,
+                  c.surface,
                   JSON_AGG(JSON_BUILD_OBJECT('id', l.layer_id, 'permissions', l.permissions))
                     FILTER (WHERE l.layer_id IS NOT NULL) AS layers
              FROM oauth_consents c
@@ -415,7 +435,7 @@ export class PostgresDelegations {
               AND c.revoked_at IS NULL
               AND u.disabled_at IS NULL
               AND u.role <> 'platform_admin'
-            GROUP BY c.approved_by, u.role, c.permissions`, [orgId, id]);
+            GROUP BY c.approved_by, u.role, c.permissions, c.surface`, [orgId, id]);
             const row = rows[0];
             if (row === undefined)
                 return undefined;
@@ -428,6 +448,10 @@ export class PostgresDelegations {
             return {
                 userId: row.user_id,
                 role: row.role,
+                // Which resource the connection is for. Authentication compares it
+                // with the resource being verified for, because the audience alone is
+                // one check and a connection that says otherwise is a second.
+                surface: row.surface,
                 ...(row.layers === null ? {} : { layers: narrowingOf(row.layers) }),
                 // NULL is no ceiling, which is a different state from an empty set —
                 // the CHECK on the column refuses the second, so this cannot arrive

package/dist/oauth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAgB,MAAM,kBAAkB,CAAA;AAGvF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAmC3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAClB,IAA0E,EAC/C,EAAE,CAC7B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AAmK5G,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,YAA+B,EAC/B,QAAgB;QAEhB,0DAA0D;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,sDAAsD;QACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,MAAM,CAAC,KAAK,CAChB,uFAAuF,EACvF,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CACpC,CAAA;YACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QACrD,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,sFAAsF,EACtF,CAAC,QAAQ,CAAC,CACX,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAA;QAClG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,IAAiB,EACjB,KAA+D;QAE/D,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB;;;uDAG6C,EAC7C;gBACE,IAAI,CAAC,KAAK;gBACV,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;gBAClF,IAAI,CAAC,SAAS,CAAC,EAAE;gBACjB,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpB,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,OAAO,CAAC,MAAM;aACrB,CACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,kEAAkE;QAClE,wDAAwD;QACxD,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,kBAAkB;QAClB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,IAAI,CAAC,IAAI,EACT,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;gFACsE,EACtE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAA;QACxB,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEzC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAWjC;;;;;;uEAM6D,EAC7D,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,iEAAiE;YACjE,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,MAAM,GAAG;gBACb,KAAK,EAAE,GAAG,CAAC,MAAM;gBACjB,QAAQ,EAAE,GAAG,CAAC,SAAS;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC7D,CAAA;YACD,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,qEAAqE;gBACrE,4DAA4D;gBAC5D,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAoB,EAAE,CAAA;YACjH,CAAC;YACD,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAA4B,EAAE;gBAC1F,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;aAClE,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,QAAgB,EAChB,OAAuB,EACvB,MAAkC,EAClC,WAAqC;QAErC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,kCAAkC;YAClC,EAAE;YACF,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,EAAE,IAAI,EAAE,GACZ,OAAO,CAAC,MAAM,KAAK,iBAAiB;gBAClC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;8BAIc,EACd,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CACpE;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;8BAKc;gBACd,8DAA8D;gBAC9D,8DAA8D;gBAC9D,kCAAkC;gBAClC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM;oBACpC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAClF,CAAA;YACP,MAAM,EAAE,GAAI,IAAI,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAA;YAEzC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,6CAA6C;gBAC7C,MAAM,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;oBAC3F,IAAI,CAAC,KAAK;oBACV,EAAE;iBACH,CAAC,CAAA;gBACF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9C,4DAA4D;oBAC5D,iEAAiE;oBACjE,6DAA6D;oBAC7D,iEAAiE;oBACjE,kEAAkE;oBAClE,8DAA8D;oBAC9D,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;2DAK6C,EAC7C;wBACE,IAAI,CAAC,KAAK;wBACV,EAAE;wBACF,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACjB,EAAE,EAAE,CAAC,CAAC,EAAE;4BACR,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;yBACvE,CAAC,CAAC,CACJ;qBACF,CACF,CAAA;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAA;YAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAgBjC,iEAAiE;YACjE,sEAAsE;YACtE,8BAA8B;YAC9B,EAAE;YACF,sEAAsE;YACtE,8DAA8D;YAC9D,qEAAqE;YACrE,mEAAmE;YACnE;;;;;;;;;;;;iCAYuB,IAAI;;6CAEQ,EACnC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAC7D,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,SAAS;gBACrB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,OAAO,EACL,CAAC,CAAC,OAAO,KAAK,MAAM;oBAClB,CAAC,CAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAY;oBACtD,CAAC,CAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,kBAA4B,EAAY;gBAChG,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;gBAC1C,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,eAAe,EAAE,CAAC,CAAC,iBAAiB;gBACpC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;gBACrC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;gBAChC,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,eAAe,EAAE,CAAC,CAAC,iBAAiB;gBACpC,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU;QACxC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAA;YACzF,MAAM,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;kEACwD,IAAI;yBAC7C,EACf,MAAM,CACP,CAAA;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAEnC,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,EAAE;YACF,oEAAoE;YACpE,wEAAwE;YACxE,uBAAuB;YACvB,MAAM,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YAC9G,OAAO,IAAI,CAAA;QACb,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,KAAa,EACb,SAAiB,EACjB,KAAa,EACb,MAA0B,EAC1B,SAAe;QAEf,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;+BAEqB,EACrB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CAC/D,CAAA;YACD,OAAQ,IAAI,CAAC,CAAC,CAA2B,CAAC,SAAS,CAAA;QACrD,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa;QAEb,wEAAwE;QACxE,4EAA4E;QAC5E,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,IAAI,CAAC,IAAI,EACT,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,+DAA+D,EAC/D,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAA;QACxB,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEzC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAYjC,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,iDAAiD;YACjD;;;;;;;;;;4BAUkB,EAClB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,mEAAmE;gBACnE,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,MAAM,CAAC,KAAK,CAAC,uEAAuE,EAAE;oBAC1F,KAAK;oBACL,GAAG,CAAC,SAAS;iBACd,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAEhD,sEAAsE;YACtE,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,eAAe;YACf,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,WAAoB,CAAA;YAE9C,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC,gGAAgG,EAChG,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,MAAM,CAAC,KAAK,CAAC,mFAAmF,EAAE;gBACtG,KAAK;gBACL,GAAG,CAAC,UAAU;aACf,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;YAC/E,OAAO,GAAG,CAAC,OAAO,KAAK,MAAM;gBAC3B,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE;gBACnE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAA4B,EAAE,EAAE,CAAA;QAC7G,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,KAAa,EACb,EAAU;QAEV,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,0BAA0B;YAC1B,EAAE;YACF,uEAAuE;YACvE,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAMjC;;;;;;;;;;;;;;;;0DAgBgD,EAChD,CAAC,KAAK,EAAE,EAAE,CAAC,CACZ,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,uEAAuE;YACvE,uEAAuE;YACvE,+DAA+D;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,wCAAwC;YACxC,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,uCAAuC;gBACvC,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;aACtE,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"oauth-store.js","sourceRoot":"","sources":["../src/oauth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAgB,MAAM,kBAAkB,CAAA;AAGvF,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAmC3D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,CAClB,IAA0E,EAC/C,EAAE,CAC7B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AA0M5G,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,YAA+B,EAC/B,QAAgB;QAEhB,0DAA0D;QAC1D,2EAA2E;QAC3E,2EAA2E;QAC3E,sDAAsD;QACtD,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,MAAM,CAAC,KAAK,CAChB,uFAAuF,EACvF,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CACpC,CAAA;YACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QACrD,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,sFAAsF,EACtF,CAAC,QAAQ,CAAC,CACX,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,aAAa,EAAE,CAAA;QAClG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACxD,CAAC;CACF;AAED,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,IAAiB,EACjB,KAA+D;QAE/D,MAAM,OAAO,CACX,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,MAAM,CAAC,KAAK,CAChB;;;uDAG6C,EAC7C;gBACE,IAAI,CAAC,KAAK;gBACV,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;gBAClF,IAAI,CAAC,SAAS,CAAC,EAAE;gBACjB,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpB,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,WAAW;gBACjB,KAAK,CAAC,QAAQ,IAAI,IAAI;gBACtB,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,SAAS,IAAI,IAAI;gBACvB,KAAK,CAAC,OAAO,CAAC,MAAM;aACrB,CACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,uEAAuE;QACvE,EAAE;QACF,2EAA2E;QAC3E,kEAAkE;QAClE,wDAAwD;QACxD,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,kBAAkB;QAClB,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,IAAI,CAAC,IAAI,EACT,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;gFACsE,EACtE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAA;QACxB,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEzC,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,8CAA8C;QAC9C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAYjC,sEAAsE;YACtE,iEAAiE;YACjE,oEAAoE;YACpE,uCAAuC;YACvC;;;;;;;;oFAQ0E,EAC1E,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACjB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,iEAAiE;YACjE,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,MAAM,GAAG;gBACb,KAAK,EAAE,GAAG,CAAC,MAAM;gBACjB,QAAQ,EAAE,GAAG,CAAC,SAAS;gBACvB,WAAW,EAAE,GAAG,CAAC,YAAY;gBAC7B,aAAa,EAAE,GAAG,CAAC,cAAc;gBACjC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAC7D,CAAA;YACD,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,qEAAqE;gBACrE,4DAA4D;gBAC5D,OAAO;oBACL,GAAG,MAAM;oBACT,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;oBACpD,SAAS,EAAE,GAAG,CAAC,UAAoB;oBACnC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS;iBAClC,CAAA;YACH,CAAC;YACD,OAAO;gBACL,GAAG,MAAM;gBACT,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAA4B,EAAE;gBAC1F,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;aAClE,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,QAAgB,EAChB,OAAuB,EACvB,MAAkC,EAClC,WAAqC,EACrC,UAA0B,SAAS;QAEnC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,kCAAkC;YAClC,EAAE;YACF,qEAAqE;YACrE,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,EAAE,IAAI,EAAE,GACZ,OAAO,CAAC,MAAM,KAAK,iBAAiB;gBAClC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;8BAIc,EACd,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CACpE;gBACH,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;8BAKc;gBACd,8DAA8D;gBAC9D,8DAA8D;gBAC9D,kCAAkC;gBAClC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM;oBACpC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,CAAC,CAC3F,CAAA;YACP,MAAM,EAAE,GAAI,IAAI,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAA;YAEzC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,6CAA6C;gBAC7C,MAAM,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE;oBAC3F,IAAI,CAAC,KAAK;oBACV,EAAE;iBACH,CAAC,CAAA;gBACF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9C,4DAA4D;oBAC5D,iEAAiE;oBACjE,6DAA6D;oBAC7D,iEAAiE;oBACjE,kEAAkE;oBAClE,8DAA8D;oBAC9D,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;2DAK6C,EAC7C;wBACE,IAAI,CAAC,KAAK;wBACV,EAAE;wBACF,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACjB,EAAE,EAAE,CAAC,CAAC,EAAE;4BACR,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;yBACvE,CAAC,CAAC,CACJ;qBACF,CACF,CAAA;gBACH,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAA;QACX,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAyB,CAAA;YAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAiBjC,iEAAiE;YACjE,sEAAsE;YACtE,8BAA8B;YAC9B,EAAE;YACF,sEAAsE;YACtE,8DAA8D;YAC9D,qEAAqE;YACrE,mEAAmE;YACnE;;;;;;;;;;;;iCAYuB,IAAI;;6CAEQ,EACnC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAC7D,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,SAAS;gBACrB,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,OAAO,EACL,CAAC,CAAC,OAAO,KAAK,MAAM;oBAClB,CAAC,CAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAY;oBACtD,CAAC,CAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,kBAA4B,EAAY;gBAChG,kBAAkB,EAAE,CAAC,CAAC,oBAAoB;gBAC1C,UAAU,EAAE,CAAC,CAAC,WAAW;gBACzB,eAAe,EAAE,CAAC,CAAC,iBAAiB;gBACpC,gBAAgB,EAAE,CAAC,CAAC,iBAAiB;gBACrC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE;gBAChC,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,eAAe,EAAE,CAAC,CAAC,iBAAiB;gBACpC,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU;QACxC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAA;YACzF,MAAM,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;kEACwD,IAAI;yBAC7C,EACf,MAAM,CACP,CAAA;YACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAA;YAEnC,uEAAuE;YACvE,sEAAsE;YACtE,qEAAqE;YACrE,kDAAkD;YAClD,EAAE;YACF,oEAAoE;YACpE,wEAAwE;YACxE,uBAAuB;YACvB,MAAM,MAAM,CAAC,KAAK,CAAC,wEAAwE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;YAC9G,OAAO,IAAI,CAAA;QACb,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,KAAa,EACb,SAAiB,EACjB,KAAa,EACb,MAA0B,EAC1B,SAAe;QAEf,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;+BAEqB,EACrB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,CAAC,CAC/D,CAAA;YACD,OAAQ,IAAI,CAAC,CAAC,CAA2B,CAAC,SAAS,CAAA;QACrD,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAAa;QAEb,wEAAwE;QACxE,4EAA4E;QAC5E,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,IAAI,CAAC,IAAI,EACT,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,+DAA+D,EAC/D,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClB,CAAA;YACD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAA;QACxB,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;QACD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAEzC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK;YAajC,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,sEAAsE;YACtE,iDAAiD;YACjD;;;;;;;;;;;;;;;;4BAgBkB,EAClB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClB,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACzB,qEAAqE;gBACrE,mEAAmE;gBACnE,+DAA+D;gBAC/D,kEAAkE;gBAClE,MAAM,MAAM,CAAC,KAAK,CAAC,uEAAuE,EAAE;oBAC1F,KAAK;oBACL,GAAG,CAAC,SAAS;iBACd,CAAC,CAAA;gBACF,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YAEhD,sEAAsE;YACtE,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,eAAe;YACf,EAAE;YACF,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,uDAAuD;YACvD,IAAI,GAAG,CAAC,SAAS;gBAAE,OAAO,WAAoB,CAAA;YAE9C,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC,gGAAgG,EAChG,CAAC,GAAG,CAAC,EAAE,CAAC,CACT,CAAA;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAExC,MAAM,MAAM,CAAC,KAAK,CAAC,mFAAmF,EAAE;gBACtG,KAAK;gBACL,GAAG,CAAC,UAAU;aACf,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;YAC/E,OAAO,GAAG,CAAC,OAAO,KAAK,MAAM;gBAC3B,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBACzF,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAA4B,EAAE,EAAE,CAAA;QAC7G,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,KAAa,EACb,EAAU;QAKV,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,KAAK,EACL,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,0BAA0B;YAC1B,EAAE;YACF,uEAAuE;YACvE,gEAAgE;YAChE,6DAA6D;YAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAOjC;;;;;;;;;;;;;;;;;qEAiB2D,EAC3D,CAAC,KAAK,EAAE,EAAE,CAAC,CACZ,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YACvC,uEAAuE;YACvE,uEAAuE;YACvE,+DAA+D;YAC/D,uEAAuE;YACvE,qEAAqE;YACrE,wCAAwC;YACxC,OAAO;gBACL,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,mEAAmE;gBACnE,sEAAsE;gBACtE,8DAA8D;gBAC9D,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,uCAAuC;gBACvC,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;aACtE,CAAA;QACH,CAAC,EACD,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CACnD,CAAA;IACH,CAAC;CACF"}

package/dist/server.d.ts

@@ -568,9 +568,21 @@ export interface GrantRecord extends GrantInput {
     readonly effect: 'allow' | 'deny';
     readonly source: string;
 }
+/**
+ * Narrowing a grant listing to one principal or one scope. Applied in SQL, so
+ * "who holds anything on `contracts`" is one indexed read rather than a walk
+ * through every grant in the organization. A narrowing only ever removes: the
+ * visibility rule below it is unchanged.
+ */
+export interface GrantFilter {
+    readonly principalType?: GrantRecord['principalType'];
+    readonly principalId?: string;
+    readonly scopeType?: GrantRecord['scopeType'];
+    readonly scopeId?: string;
+}
 export interface Grants {
     /** Grants in the caller's organization. Admin only; the caller is checked above. */
-    list(auth: AuthContext, page?: Page): Promise<PageResult<GrantRecord>>;
+    list(auth: AuthContext, page?: Page, filter?: GrantFilter): Promise<PageResult<GrantRecord>>;
     /** `undefined` when the caller may not administer the scope, or it does not exist. */
     issue(auth: AuthContext, input: GrantInput): Promise<GrantRecord | undefined>;
     /**
@@ -691,6 +703,20 @@ export interface AuditQuery {
     readonly actorId?: string;
     readonly action?: string;
     readonly result?: 'allow' | 'deny' | 'error';
+    /**
+     * A layer, by id **and** slug, because the log records both: an
+     * administrative write names `layer_id` and an ingest names the `layer` it
+     * was asked for by slug. A filter on one would miss half the layer's rows,
+     * and an empty page under a filter reads as "nothing happened".
+     */
+    readonly layer?: {
+        readonly id: string;
+        readonly slug: string;
+    };
+    readonly documentId?: string;
+    /** The connection a call came through, as `connection:<id>`. */
+    readonly client?: string;
+    readonly surface?: 'api' | 'mcp' | 'mcp-admin' | 'admin' | 'system';
     /**
      * Restrict to administrative actions — everything that is not a substantive
      * access to a document's contents.