@nacre.work/api 0.33.0 → 0.35.0

package/dist/proposals.js

@@ -0,0 +1,289 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { mcpTools, McpToolRefusal, withOrg, } from '@nacre.work/core';
+import { isUuid } from './admin-names.js';
+/**
+ * Proposals: a change on the administrative MCP, waiting for a person.
+ * docs/mcp-admin.md, "A change is proposed, and a person applies it".
+ *
+ * A write tool on `/mcp/admin` stores what it would do here and answers with
+ * that. It happens when the person who approved the connection presses Apply —
+ * in the panel the host renders beside the tool's result, or on the console's
+ * Proposals screen under their own session — and at no other time and by no
+ * other hand. Never the model's, in any client: the panel's Apply is a tool the
+ * host leaves out of what the model is offered, and the console is a screen the
+ * model cannot reach at all. That second door is why a client that renders no
+ * panel still works, and why there is no "apply directly" setting for one.
+ *
+ * Three properties are this table's rather than the code's: single use (the
+ * UPDATE that claims a row is the only way to apply it), expiry (the database's
+ * clock, ten minutes), and a record of what nobody applied.
+ */
+export const PROPOSAL_TTL_MS = 10 * 60_000;
+/** The panel key as stored: its SHA-256, so a database read hands over nothing that applies. */
+const keyHash = (key) => createHash('sha256').update(key, 'utf8').digest();
+/** Literal, so `lint:audit-actions` can see each is recorded. */
+/** What revoking a connection records for each proposal it ends. oauth-store.ts. */
+export const CANCELLED_BY_REVOCATION = { action: 'proposal.cancelled' };
+const RECORDED = {
+    created: { action: 'proposal.created' },
+    applied: { action: 'proposal.applied' },
+    cancelled: { action: 'proposal.cancelled' },
+};
+export class PostgresProposals {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    inOrg(auth, run) {
+        return withOrg(this.pool, auth.orgId, run, { role: this.role });
+    }
+    /**
+     * Store one. The connection and the person come from the token — the
+     * administrative connection this call arrived on — and never from anything
+     * the tool or the model said.
+     */
+    async create(auth, entry) {
+        const consentId = auth.delegation?.id;
+        if (consentId === undefined || auth.delegation?.surface !== 'admin' || auth.principal.type !== 'user') {
+            throw new Error('a proposal is made on an administrative connection, by a person');
+        }
+        // Handed to the panel once, in `_meta`, and kept here only as a hash.
+        const panelKey = randomBytes(32).toString('base64url');
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`INSERT INTO admin_proposals (org_id, consent_id, proposed_by, tool, module, summary, details, input, expires_at, panel_key_hash)
+         VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8::jsonb, now() + make_interval(secs => $9), $10)
+         RETURNING id, to_char(expires_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS expires_at`, [
+                auth.orgId,
+                consentId,
+                auth.principal.id,
+                entry.tool,
+                entry.module,
+                entry.proposal.summary.slice(0, 1000),
+                JSON.stringify(entry.proposal.details),
+                JSON.stringify(entry.proposal.input),
+                PROPOSAL_TTL_MS / 1000,
+                keyHash(panelKey),
+            ]);
+            const row = rows[0];
+            return { id: row.id, expiresAt: row.expires_at, panelKey };
+        });
+    }
+    /**
+     * Take one for applying, or `undefined`. One answer for absent, another
+     * organization's, another connection's or person's, already decided, expired,
+     * and proposed through a connection revoked since — the caller learns
+     * nothing about a proposal that is not theirs to apply.
+     *
+     * The UPDATE is the single use: two presses, two tabs, or the panel and the
+     * console at once each run it, and exactly one gets a row.
+     */
+    async claim(auth, id, by) {
+        if (!isUuid(id) || (by.through === 'panel' && by.key === ''))
+            return undefined;
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`UPDATE admin_proposals p
+            SET status = 'applying', decided_at = now(), decided_through = $3
+          WHERE p.org_id = $1 AND p.id = $2::uuid
+            AND p.status = 'open' AND p.expires_at > now()
+            AND ${by.through === 'panel' ? 'p.consent_id = $4::uuid AND p.panel_key_hash = $5' : 'p.proposed_by = $4::uuid'}
+            AND EXISTS (SELECT 1 FROM oauth_consents c
+                         WHERE c.org_id = p.org_id AND c.id = p.consent_id AND c.revoked_at IS NULL)
+        RETURNING p.tool, p.module, p.input, p.consent_id`, by.through === 'panel'
+                ? [auth.orgId, id, by.through, by.consentId, keyHash(by.key)]
+                : [auth.orgId, id, by.through, by.personId]);
+            const row = rows[0];
+            return row === undefined ? undefined : { tool: row.tool, module: row.module, input: row.input, consentId: row.consent_id };
+        });
+    }
+    /** Record how applying went. */
+    async settle(auth, id, outcome) {
+        await this.inOrg(auth, async (client) => {
+            await client.query(`UPDATE admin_proposals SET status = $3, error = $4
+          WHERE org_id = $1 AND id = $2::uuid AND status = 'applying'`, [auth.orgId, id, outcome.ok ? 'applied' : 'failed', outcome.ok ? null : outcome.error.slice(0, 1000)]);
+        });
+    }
+    /** Decline one. The same single answer as `claim` for anything not the caller's. */
+    async cancel(auth, id, by) {
+        if (!isUuid(id) || (by.through === 'panel' && by.key === ''))
+            return undefined;
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`UPDATE admin_proposals
+            SET status = 'cancelled', decided_at = now(), decided_through = $3
+          WHERE org_id = $1 AND id = $2::uuid AND status = 'open' AND expires_at > now()
+            AND ${by.through === 'panel' ? 'consent_id = $4::uuid AND panel_key_hash = $5' : 'proposed_by = $4::uuid'}
+        RETURNING tool, module, consent_id`, by.through === 'panel'
+                ? [auth.orgId, id, by.through, by.consentId, keyHash(by.key)]
+                : [auth.orgId, id, by.through, by.personId]);
+            const row = rows[0];
+            return row === undefined ? undefined : { tool: row.tool, module: row.module, consentId: row.consent_id };
+        });
+    }
+    /** What is waiting for this person, newest first. Their own and nobody else's. */
+    async pending(auth) {
+        return this.inOrg(auth, async (client) => {
+            const { rows } = await client.query(`SELECT p.id, p.tool, p.module, p.summary, p.details,
+                to_char(p.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS created_at,
+                to_char(p.expires_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS expires_at,
+                p.consent_id, oc.client_name AS application
+           FROM admin_proposals p
+           JOIN oauth_consents c ON c.org_id = p.org_id AND c.id = p.consent_id AND c.revoked_at IS NULL
+           LEFT JOIN oauth_clients oc ON oc.client_id = c.client_id
+          WHERE p.org_id = $1 AND p.proposed_by = $2 AND p.status = 'open' AND p.expires_at > now()
+          ORDER BY p.created_at DESC
+          LIMIT 100`, [auth.orgId, auth.principal.id]);
+            return rows.map((r) => ({
+                id: r.id,
+                tool: r.tool,
+                module: r.module,
+                summary: r.summary,
+                details: r.details,
+                createdAt: r.created_at,
+                expiresAt: r.expires_at,
+                connection: { id: r.consent_id, application: r.application },
+            }));
+        });
+    }
+}
+/**
+ * The core's own writes and every module's, by the name and module a proposal
+ * stored. A module's tool is found only under the module that registered it,
+ * so a proposal cannot be applied by a different module's tool of the same
+ * name — and a module unloaded since leaves nothing that can apply it.
+ */
+export function writeLookup(core) {
+    return (tool, module) => {
+        if (module === null)
+            return core.find((t) => t.name === tool);
+        const found = mcpTools('admin').find((t) => t.module === module && t.tool.name === tool)?.tool;
+        return found?.kind === 'write' ? found : undefined;
+    };
+}
+const surfaceOf = (by) => (by.through === 'panel' ? 'mcp-admin' : 'api');
+/**
+ * A press on something that was not there to press: decided already, expired,
+ * another connection's, or — from the panel — without the key the panel was
+ * handed. Recorded as a `deny`, since a model applying an id it read out of the
+ * access log arrives exactly here.
+ */
+async function recordGone(deps, auth, action, id, by, requestId) {
+    await deps.audit.write({
+        orgId: auth.orgId,
+        actor: `${auth.principal.type}:${auth.principal.id}`,
+        ...action,
+        result: 'deny',
+        surface: surfaceOf(by),
+        target: { proposal: isUuid(id) ? id : 'not a proposal id' },
+        detail: { through: by.through, reason: 'not open, or not this caller\'s to decide' },
+        requestId,
+    });
+}
+/**
+ * Apply one, as the person deciding. The panel and the console both come
+ * here, so there is one answer to what applying means.
+ *
+ * `apply` runs under the decider's own authority — the administrative
+ * connection, or the person's session — and re-checks whatever it needs to: a
+ * role lost or a grant revoked in the minutes since the proposal is what
+ * decides. A refusal from it is the person's to read and is recorded; anything
+ * else is the generic failure and is logged by the caller.
+ */
+export async function applyProposal(deps, auth, id, by, requestId) {
+    const claimed = await deps.proposals.claim(auth, id, by);
+    if (claimed === undefined) {
+        await recordGone(deps, auth, RECORDED.applied, id, by, requestId);
+        return { kind: 'gone' };
+    }
+    const record = (result, detail) => deps.audit.write({
+        orgId: auth.orgId,
+        actor: `${auth.principal.type}:${auth.principal.id}`,
+        ...RECORDED.applied,
+        result,
+        surface: surfaceOf(by),
+        client: `connection:${claimed.consentId}`,
+        target: { proposal: id, tool: claimed.tool, ...(claimed.module === null ? {} : { module: claimed.module }) },
+        detail: { through: by.through, ...detail },
+        requestId,
+    });
+    const tool = deps.writes(claimed.tool, claimed.module);
+    if (tool === undefined) {
+        const reason = `${claimed.tool} is no longer offered here, so this proposal cannot be applied.`;
+        await deps.proposals.settle(auth, id, { ok: false, error: reason });
+        await record('deny', { reason });
+        return { kind: 'refused', reason };
+    }
+    try {
+        const result = await tool.apply({ auth, requestId, proposal: { id, through: by.through } }, claimed.input);
+        await deps.proposals.settle(auth, id, { ok: true });
+        await record('allow', {});
+        return { kind: 'applied', result };
+    }
+    catch (error) {
+        if (error instanceof McpToolRefusal) {
+            await deps.proposals.settle(auth, id, { ok: false, error: error.message });
+            await record('deny', { reason: error.message });
+            return { kind: 'refused', reason: error.message };
+        }
+        await deps.proposals.settle(auth, id, { ok: false, error: 'internal' });
+        await record('error', {});
+        throw error;
+    }
+}
+/** Decline one. Recorded, because a proposal nobody wanted is part of the story. */
+export async function cancelProposal(deps, auth, id, by, requestId) {
+    const cancelled = await deps.proposals.cancel(auth, id, by);
+    if (cancelled === undefined) {
+        await recordGone(deps, auth, RECORDED.cancelled, id, by, requestId);
+        return { kind: 'gone' };
+    }
+    await deps.audit.write({
+        orgId: auth.orgId,
+        actor: `${auth.principal.type}:${auth.principal.id}`,
+        ...RECORDED.cancelled,
+        result: 'allow',
+        surface: surfaceOf(by),
+        client: `connection:${cancelled.consentId}`,
+        target: { proposal: id, tool: cancelled.tool, ...(cancelled.module === null ? {} : { module: cancelled.module }) },
+        detail: { through: by.through },
+        requestId,
+    });
+    return { kind: 'cancelled' };
+}
+/** Store one and record that an agent asked for it. */
+/**
+ * A write that could not be proposed — a name that matched nothing, a value the
+ * tool will not take, or a failure. Recorded as `proposal.created` with `deny`
+ * or `error`, because the stream of what an agent *tried* is the part of the
+ * log an injection shows up in, and a model probing names leaves nothing
+ * otherwise.
+ */
+export async function recordRefusedProposal(deps, auth, entry, reason, requestId) {
+    await deps.audit.write({
+        orgId: auth.orgId,
+        actor: `${auth.principal.type}:${auth.principal.id}`,
+        ...RECORDED.created,
+        result: reason === undefined ? 'error' : 'deny',
+        surface: 'mcp-admin',
+        target: { tool: entry.tool, ...(entry.module === null ? {} : { module: entry.module }) },
+        detail: reason === undefined ? {} : { reason: reason.slice(0, 300) },
+        requestId,
+    });
+}
+export async function recordProposal(deps, auth, entry, requestId) {
+    const stored = await deps.proposals.create(auth, entry);
+    await deps.audit.write({
+        orgId: auth.orgId,
+        actor: `${auth.principal.type}:${auth.principal.id}`,
+        ...RECORDED.created,
+        result: 'allow',
+        surface: 'mcp-admin',
+        target: { proposal: stored.id, tool: entry.tool, ...(entry.module === null ? {} : { module: entry.module }) },
+        // The sentence and the facts, which are what a person reads — never the
+        // input, which may carry a skill's text.
+        detail: { summary: entry.proposal.summary, expires_at: stored.expiresAt },
+        requestId,
+    });
+    return stored;
+}
+//# sourceMappingURL=proposals.js.map

package/dist/proposals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposals.js","sourceRoot":"","sources":["../src/proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,OAAO,GAKR,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAGzC;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAA;AAS1C,gGAAgG;AAChG,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;AAoB1F,iEAAiE;AACjE,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAW,CAAA;AAEhF,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACvC,SAAS,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;CACnC,CAAA;AAEV,MAAM,OAAO,iBAAiB;IAET;IACA;IAFnB,YACmB,IAAU,EACV,IAAY;QADZ,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAQ;IAC5B,CAAC;IAEI,KAAK,CAAI,IAAiB,EAAE,GAAoD;QACtF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,KAAgG;QAEhG,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAA;QACrC,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,sEAAsE;QACtE,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;6GAEqG,EACrG;gBACE,IAAI,CAAC,KAAK;gBACV,SAAS;gBACT,IAAI,CAAC,SAAS,CAAC,EAAE;gBACjB,KAAK,CAAC,IAAI;gBACV,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;gBACrC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACtC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACpC,eAAe,GAAG,IAAI;gBACtB,OAAO,CAAC,QAAQ,CAAC;aAClB,CACF,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAuC,CAAA;YACzD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,IAAiB,EAAE,EAAU,EAAE,EAAmB;QAC5D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;kBAIU,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,0BAA0B;;;0DAGjE,EAClD,EAAE,CAAC,OAAO,KAAK,OAAO;gBACpB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC7D,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,CAC9C,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAA;QAC5H,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU,EAAE,OAA+E;QACzH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,CAAC,KAAK,CAChB;sEAC8D,EAC9D,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CACtG,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU,EAAE,EAAmB;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;kBAGU,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,wBAAwB;2CAC1E,EACnC,EAAE,CAAC,OAAO,KAAK,OAAO;gBACpB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAC7D,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,CAC9C,CAAA;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAA;QAC1G,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,OAAO,CAAC,IAAiB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAWjC;;;;;;;;;oBASY,EACZ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAChC,CAAA;YACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,SAAS,EAAE,CAAC,CAAC,UAAU;gBACvB,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;aAC7D,CAAC,CAAC,CAAA;QACL,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAKD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAA6B;IACvD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,IAAI,CAAA;QAC9F,OAAO,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACpD,CAAC,CAAA;AACH,CAAC;AAeD,MAAM,SAAS,GAAG,CAAC,EAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAE,WAAqB,CAAC,CAAC,CAAE,KAAe,CAAC,CAAA;AAE/G;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,IAA+B,EAC/B,IAAiB,EACjB,MAAmC,EACnC,EAAU,EACV,EAAmB,EACnB,SAAiB;IAEjB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;QACpD,GAAG,MAAM;QACT,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE;QAC3D,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,2CAA2C,EAAE;QACpF,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAgB,EAChB,IAAiB,EACjB,EAAU,EACV,EAAmB,EACnB,SAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QACjE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAkC,EAAE,MAA+B,EAAE,EAAE,CACrF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;QACpD,GAAG,QAAQ,CAAC,OAAO;QACnB,MAAM;QACN,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;QACzC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE;QAC5G,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,MAAM,EAAE;QAC1C,SAAS;KACV,CAAC,CAAA;IAEJ,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,iEAAiE,CAAA;QAC/F,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAChC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1G,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YAC1E,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;QACnD,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAA;QACvE,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACzB,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA6C,EAC7C,IAAiB,EACjB,EAAU,EACV,EAAmB,EACnB,SAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACzB,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;QACpD,GAAG,QAAQ,CAAC,SAAS;QACrB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,cAAc,SAAS,CAAC,SAAS,EAAE;QAC3C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;QAClH,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE;QAC/B,SAAS;KACV,CAAC,CAAA;IACF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;AAC9B,CAAC;AAED,uDAAuD;AACvD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA+B,EAC/B,IAAiB,EACjB,KAAgE,EAChE,MAA0B,EAC1B,SAAiB;IAEjB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;QACpD,GAAG,QAAQ,CAAC,OAAO;QACnB,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC/C,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QACxF,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QACpE,SAAS;KACV,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA6C,EAC7C,IAAiB,EACjB,KAAgG,EAChG,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;QACpD,GAAG,QAAQ,CAAC,OAAO;QACnB,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAC7G,wEAAwE;QACxE,yCAAyC;QACzC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE;QACzE,SAAS;KACV,CAAC,CAAA;IACF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/server.d.ts

@@ -12,6 +12,7 @@ import type { MintRequest, OAuthAuthorizations, OAuthClients, OAuthConsents, OAu
 import { type Groups, type Users } from './principals.js';
 import { type Page, type PageResult } from './pagination.js';
 import type { Skills } from './skills.js';
+import { type PostgresProposals, type WriteLookup } from './proposals.js';
 export type { Page, PageResult };
 /**
  * What the API needs from the rest of the system, as ports.
@@ -878,6 +879,21 @@ export interface OAuthServer {
         expiresIn: number;
     }>;
 }
+/**
+ * Where this installation is reached — what `GET /v1/endpoints` answers with.
+ * docs/openapi.yaml, `Endpoints`.
+ */
+export interface ServedEndpoints {
+    /** The REST API's base, ending in `/v1`. */
+    readonly api: string;
+    /** The MCP endpoint, Streamable HTTP. */
+    readonly mcp: string;
+    /** The administrative MCP endpoint, beside it. */
+    readonly mcpAdmin: string;
+    /** The OpenAPI document describing this release. */
+    readonly contract: string;
+    readonly version: string;
+}
 export interface ApiOptions {
     readonly verify: VerifyOptions;
     /** Rendered at /metrics. Absent means the endpoint answers 404. */
@@ -943,6 +959,16 @@ export interface ApiOptions {
      * neither agreed on.
      */
     readonly resourceMetadata?: ProtectedResourceMetadata;
+    /**
+     * Where a client reaches this installation, served at `/v1/endpoints`.
+     *
+     * Built once from `NACRE_CANONICAL_URL` and `NACRE_MCP_CANONICAL_URL` — the
+     * values every token's issuer and every discovery document are already made
+     * of — so the console says the address an operator configured rather than
+     * guessing one from the page it happens to be served on. Absent, the route
+     * answers `404`, which is what a server built without it should say.
+     */
+    readonly endpoints?: ServedEndpoints;
     /**
      * The public keys served at `/.well-known/jwks.json`.
      *
@@ -1016,6 +1042,21 @@ export interface ApiOptions {
     readonly jobs?: Jobs;
     readonly layers?: Layers;
     readonly grants?: Grants;
+    /**
+     * Changes proposed on the administrative MCP, decided on the console's
+     * Proposals screen. Absent means `/v1/proposals` answers 404.
+     *
+     * The console is the second place a person presses Apply, beside the panel a
+     * host renders — and the one that works in a client that renders none. Only
+     * the person's own session reaches it: a connected application's token,
+     * administrative or not, is answered as if the path did not exist, or a
+     * client could approve its own proposals and the person would never be in
+     * front of them.
+     */
+    readonly proposals?: {
+        readonly store: PostgresProposals;
+        readonly writes: WriteLookup;
+    };
     readonly serviceAccounts?: ServiceAccountPort;
     /** Absent means `/v1/users` answers 404, like any capability a surface lacks. */
     readonly users?: Users;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAuCL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC9B,KAAK,UAAU,EACf,KAAK,mBAAmB,EAKzB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAA;AAIlB,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAsD,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAA4D,MAAM,YAAY,CAAA;AACjG,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAGV,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAoC,KAAK,MAAM,EAAkB,KAAK,KAAK,EAAiB,MAAM,iBAAiB,CAAA;AAS1H,OAAO,EAA0B,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACpF,OAAO,KAAK,EAA0B,MAAM,EAAgC,MAAM,aAAa,CAAA;AAC/F,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG;;;;;;;OAOG;IACH,QAAQ,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CAC5C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAK7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAA;IAC9D;;;;;;;OAOG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAC3E,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACpC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACzE;AAED,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE3E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IAC5F,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAA;IACnE;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAC1C,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;;;;OASG;IACH,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AA0wDD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAyBrD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAuCL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC9B,KAAK,UAAU,EACf,KAAK,mBAAmB,EAKzB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAKL,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAA;AAIlB,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAsD,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAA4D,MAAM,YAAY,CAAA;AACjG,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAGV,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,kBAAkB,EACnB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAoC,KAAK,MAAM,EAAkB,KAAK,KAAK,EAAiB,MAAM,iBAAiB,CAAA;AAS1H,OAAO,EAA0B,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACpF,OAAO,KAAK,EAA0B,MAAM,EAAgC,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAiC,KAAK,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACxG,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5F;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAA;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG;;;;;;;OAOG;IACH,QAAQ,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7D,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CAC5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CAC5C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAK7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAA;IAC9D;;;;;;;OAOG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAC3E,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACpC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACzE;AAED,MAAM,MAAM,wBAAwB,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE3E,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAA;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IAC5F,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAA;IACnE;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAA;IAC5C,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAA;IAC1C,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;;;;OASG;IACH,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACjF;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,yCAAyC;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAA;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,CAAA;IACxF,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AA0wDD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAyBrD"}

package/dist/server.js

@@ -16,6 +16,7 @@ import { looksLikeEmail } from './principals.js';
 import { clientSource } from './source.js';
 import { auditFormat, auditJson, readAuditQuery, toCsv, toNdjson, } from './audit-export.js';
 import { decodeCursor, readPage } from './pagination.js';
+import { applyProposal, cancelProposal } from './proposals.js';
 /**
  * The default body cap, in bytes.
  *
@@ -3155,6 +3156,38 @@ async function handle(req, res, options) {
             }, requestId);
             return;
         }
+        /*
+         * Where a client connects: the REST base, the MCP endpoint, and — for an
+         * organization administrator — the administrative one.
+         *
+         * Asked of the server rather than worked out in a browser, because the
+         * page's own origin is the answer only when the console, the API and the
+         * MCP transport share one, and the operator already told the server which
+         * addresses are the public ones. Any credential may ask: a member connects
+         * their own client, and an agent reading this learns nothing its token did
+         * not already let it reach.
+         *
+         * `mcp_admin` is the administrative MCP, and only somebody who administers
+         * this organization is told it — its consent screen refuses everybody
+         * else, so offering it would be offering a connection that cannot be made.
+         * The same `administers` the gated handlers call.
+         */
+        if (instance === '/v1/endpoints') {
+            if (req.method !== 'GET' || options.endpoints === undefined) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const e = options.endpoints;
+            send(res, 200, {
+                api: e.api,
+                mcp: e.mcp,
+                ...(administers(auth) ? { mcp_admin: e.mcpAdmin } : {}),
+                contract: e.contract,
+                version: e.version,
+            }, requestId);
+            return;
+        }
         /*
          * The caller's own password.
          *
@@ -4123,6 +4156,76 @@ async function handle(req, res, options) {
          * is a denylist consulted on every request, which would make local
          * verification not local.
          */
+        // ── proposals ─────────────────────────────────────────────────────────
+        //
+        // docs/mcp-admin.md, "A change is proposed, and a person applies it". What
+        // the person's administrative connection proposed, waiting for them, and
+        // the two buttons. A person in their own session and nobody else: every
+        // other caller — a connected application's token included — gets the
+        // answer a path that does not exist gets.
+        const proposalMatch = pathMatch(/^\/v1\/proposals(?:\/([0-9a-f-]{36})\/(apply|cancel))?$/i, instance);
+        if (proposalMatch !== null && options.proposals !== undefined) {
+            const own = auth.principal.type === 'user' && auth.delegation === undefined && administers(auth);
+            const id = proposalMatch[1];
+            const verb = proposalMatch[2];
+            if (!own || (id === undefined ? req.method !== 'GET' : req.method !== 'POST')) {
+                const problem = notFound(instance, requestId);
+                send(res, problem.status, problem.toJSON(), requestId);
+                return;
+            }
+            const deps = { proposals: options.proposals.store, audit: options.audit, writes: options.proposals.writes };
+            const by = { through: 'console', personId: auth.principal.id };
+            if (id === undefined) {
+                const items = await options.proposals.store.pending(auth);
+                send(res, 200, {
+                    items: items.map((p) => ({
+                        id: p.id,
+                        tool: p.tool,
+                        module: p.module,
+                        summary: p.summary,
+                        details: p.details,
+                        created_at: p.createdAt,
+                        expires_at: p.expiresAt,
+                        connection: { id: p.connection.id, application: p.connection.application },
+                    })),
+                }, requestId);
+                return;
+            }
+            const outcome = verb === 'apply'
+                ? await applyProposal(deps, auth, id, by, requestId)
+                : await cancelProposal(deps, auth, id, by, requestId);
+            switch (outcome.kind) {
+                case 'applied':
+                    send(res, 200, { applied: true, result: outcome.result }, requestId);
+                    return;
+                case 'cancelled':
+                    send(res, 204, null, requestId);
+                    return;
+                case 'refused': {
+                    // The proposal was theirs and is now spent; the change itself was
+                    // refused, in the tool's own words — the role was lost, the name is
+                    // taken, the last administrator would go. Not 404: they are looking
+                    // straight at it.
+                    const problem = new Problem({
+                        type: 'https://nacre.work/errors/proposal-refused',
+                        title: 'The change was refused',
+                        status: 409,
+                        detail: outcome.reason,
+                        instance,
+                        requestId,
+                    });
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
+                default: {
+                    // Absent, somebody else's, decided, expired, or proposed through a
+                    // connection revoked since — one answer.
+                    const problem = notFound(instance, requestId);
+                    send(res, problem.status, problem.toJSON(), requestId);
+                    return;
+                }
+            }
+        }
         if (instance === '/v1/oauth/consents' && options.oauth !== undefined) {
             if (req.method !== 'GET') {
                 const problem = notFound(instance, requestId);
@@ -4467,6 +4570,10 @@ async function handle(req, res, options) {
                 detail: {
                     client_id: clientId,
                     client_name: client.clientName,
+                    // Which resource the connection is for. The `admin_connection` alert
+                    // rule reads this, and "when was an administrative connection
+                    // approved" is the question it answers for a person too.
+                    surface: administrative ? 'admin' : 'default',
                     acts_as: subject.actsAs,
                     ...(delegating
                         ? {