@nacre.work/api 0.4.0 → 0.5.0

package/dist/principals.d.ts

@@ -0,0 +1,167 @@
+import type { Pool } from 'pg';
+import type { AuthContext } from './auth.js';
+import { type Page, type PageResult } from './pagination.js';
+/**
+ * Users and groups — the principals a grant is issued to.
+ *
+ * `grants.principal_type` has admitted `user`, `group` and `service_account`
+ * since 0001, and only the third could be created through the API. So the
+ * documented way to onboard a colleague was to insert a row into `users` by
+ * hand, and the documented way to give a team access was to insert into
+ * `groups` and `group_members` by hand — which is the same shape of hole the
+ * workspace listing had: the model offers something the product gives no route
+ * to, and the route people find instead is `psql`.
+ *
+ * ## Why `org_admin` and not "admin on a scope"
+ *
+ * The same argument service accounts make. A user is a principal *in the
+ * organization* rather than an object inside a workspace, so there is no scope
+ * to check against — and someone holding `admin` on one layer must not be able
+ * to mint a principal, any more than they can mint a key. A caller without the
+ * role gets `404`, like everything else invariant 4 covers.
+ *
+ * ## Why a user is disabled and never deleted
+ *
+ * Two reasons and the second is structural. The audit log names a user id, and
+ * a row that disappears turns every past event into an unresolvable reference
+ * — which is the one thing an access log must not do. And `grants.created_by`
+ * references `users(id)` with no cascade, so deleting an administrator who has
+ * ever issued a grant raises a foreign key violation: the schema has always
+ * said this, and `disabled_at` is the column it said it with.
+ *
+ * A group *is* deleted, because nothing points at one that way and because
+ * "the team does not exist any more" is a different statement from "this person
+ * has left".
+ */
+export interface UserView {
+    readonly id: string;
+    readonly email: string;
+    readonly role: 'platform_admin' | 'org_admin' | 'member';
+    readonly createdAt: string;
+    readonly disabledAt: string | null;
+    /**
+     * Whether a password is set at all.
+     *
+     * Never the hash, and never anything derived from it. False is an SSO-only
+     * account — `users.password_hash` is nullable precisely so an IdP-backed user
+     * has no local credential to steal.
+     */
+    readonly hasPassword: boolean;
+}
+export interface Users {
+    list(auth: AuthContext, page?: Page): Promise<PageResult<UserView>>;
+    /**
+     * The password is in the result and nowhere else, ever again.
+     *
+     * `undefined` when the address is already in use in this organization —
+     * `UNIQUE (org_id, email)`, and a duplicate is something the caller typed
+     * rather than an internal error.
+     */
+    create(auth: AuthContext, email: string, role: 'org_admin' | 'member'): Promise<{
+        user: UserView;
+        password: string;
+    } | undefined>;
+    /**
+     * Change the role, the disabled state, or both.
+     *
+     * One call rather than a `disable` beside a `setRole`, because the guard
+     * below has to see both: demoting the last administrator and disabling them
+     * leave the organization in the same place, and two entry points with one
+     * check between them is how the guarded one gets routed around.
+     *
+     * `last-admin` refuses a change that would leave the organization with no
+     * active `org_admin`. Not paternalism — every endpoint that could appoint one
+     * is behind the role that was just given up, so the remedy would be SQL.
+     */
+    update(auth: AuthContext, id: string, change: {
+        role?: 'org_admin' | 'member';
+        disabled?: boolean;
+    }): Promise<'updated' | 'last-admin' | 'no-user'>;
+    /** The new password, shown once. `undefined` when there is no such user here. */
+    resetPassword(auth: AuthContext, id: string): Promise<string | undefined>;
+}
+export interface GroupView {
+    readonly id: string;
+    readonly name: string;
+    readonly createdAt: string;
+    /** Direct members only. A nested group counts as one, not as its members. */
+    readonly memberCount: number;
+}
+export type GroupMember = {
+    readonly type: 'user';
+    readonly id: string;
+    readonly label: string;
+} | {
+    readonly type: 'group';
+    readonly id: string;
+    readonly label: string;
+};
+export interface Groups {
+    list(auth: AuthContext, page?: Page): Promise<PageResult<GroupView>>;
+    /** `undefined` when the name is already in use in this organization. */
+    create(auth: AuthContext, name: string): Promise<GroupView | undefined>;
+    /** False when there is no such group here. */
+    remove(auth: AuthContext, id: string): Promise<boolean>;
+    /** `undefined` when there is no such group here — distinct from an empty one. */
+    members(auth: AuthContext, groupId: string, page?: Page): Promise<PageResult<GroupMember> | undefined>;
+    /**
+     * `no-group` and `no-member` are separate because the caller is an
+     * `org_admin` who can list both collections, so neither answer tells them
+     * anything they could not already read.
+     */
+    addMember(auth: AuthContext, groupId: string, member: {
+        type: 'user' | 'group';
+        id: string;
+    }): Promise<'added' | 'already' | 'no-group' | 'no-member'>;
+    /** False when that edge is not there. */
+    removeMember(auth: AuthContext, groupId: string, member: {
+        type: 'user' | 'group';
+        id: string;
+    }): Promise<boolean>;
+}
+export declare function generatePassword(): string;
+/**
+ * An email address, checked only enough to refuse what cannot be one.
+ *
+ * Deliberately not RFC 5322. A stricter test rejects addresses that work, and
+ * the column is `citext` with a uniqueness constraint — what matters here is
+ * that the value is a single token with an `@` and a dot after it, so a name or
+ * a uuid typed into the wrong field is refused where the operator can see it
+ * rather than becoming a user nobody can sign in as.
+ */
+export declare function looksLikeEmail(value: string): boolean;
+export declare class PostgresUsers implements Users {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    list(auth: AuthContext, page?: Page): Promise<PageResult<UserView>>;
+    create(auth: AuthContext, email: string, role: 'org_admin' | 'member'): Promise<{
+        user: UserView;
+        password: string;
+    } | undefined>;
+    update(auth: AuthContext, id: string, change: {
+        role?: 'org_admin' | 'member';
+        disabled?: boolean;
+    }): Promise<'updated' | 'last-admin' | 'no-user'>;
+    resetPassword(auth: AuthContext, id: string): Promise<string | undefined>;
+}
+export declare class PostgresGroups implements Groups {
+    private readonly pool;
+    private readonly role?;
+    constructor(pool: Pool, role?: string | undefined);
+    private get scope();
+    list(auth: AuthContext, page?: Page): Promise<PageResult<GroupView>>;
+    create(auth: AuthContext, name: string): Promise<GroupView | undefined>;
+    remove(auth: AuthContext, id: string): Promise<boolean>;
+    members(auth: AuthContext, groupId: string, page?: Page): Promise<PageResult<GroupMember> | undefined>;
+    addMember(auth: AuthContext, groupId: string, member: {
+        type: 'user' | 'group';
+        id: string;
+    }): Promise<'added' | 'already' | 'no-group' | 'no-member'>;
+    removeMember(auth: AuthContext, groupId: string, member: {
+        type: 'user' | 'group';
+        id: string;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=principals.d.ts.map

package/dist/principals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.d.ts","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAU,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,QAAQ,CAAA;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnE;;;;;;OAMG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IAC5D;;;;;;;;;;;OAWG;IACH,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC,CAAA;IAChD,iFAAiF;IACjF,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1E;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;IACvE,8CAA8C;IAC9C,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACvD,iFAAiF;IACjF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,CAAA;IAC/C;;;;OAIG;IACH,SAAS,CACP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,CAAA;IAC1D,yCAAyC;IACzC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAsBD,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,qBAAa,aAAc,YAAW,KAAK;IAEvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IA+CnE,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,GAAG,QAAQ,GAC3B,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IA2CtD,MAAM,CACV,IAAI,EAAE,WAAW,EACjB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5D,OAAO,CAAC,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;IAoD1C,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAsBhF;AAED,qBAAa,cAAe,YAAW,MAAM;IAEzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;gBADL,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE,MAAM,YAAA;IAGhC,OAAO,KAAK,KAAK,GAEhB;IAEK,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IA2CpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAqBvE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCvD,OAAO,CACX,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,IAAI,GACV,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IA6DzC,SAAS,CACb,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IAoDpD,YAAY,CAChB,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC;CAkBpB"}

package/dist/principals.js

@@ -0,0 +1,314 @@
+import { randomInt } from 'node:crypto';
+import { hashPassword, withOrg } from '@nacre.work/core';
+import { pageOf } from './pagination.js';
+const UUID = /^[0-9a-f-]{36}$/i;
+/**
+ * A generated password, in the same shape `init` prints.
+ *
+ * Generated and never taken from the request, for the reason `init` gives and
+ * one more. An administrator who chooses a colleague's password knows it, and
+ * "the person who onboarded you can sign in as you" is not a property worth
+ * having; a value the process invented and showed once is nobody's to keep.
+ *
+ * Six words rather than a random string because this gets typed into a sign-in
+ * form by a person at least once, and read aloud more often than anyone plans.
+ */
+const WORDS = [
+    'abalone', 'aragonite', 'bloom', 'brine', 'calcite', 'compass', 'coral',
+    'crest', 'current', 'drift', 'estuary', 'fathom', 'ferry', 'harbour',
+    'iridescent', 'keel', 'lagoon', 'ledger', 'lustre', 'mantle', 'nacre',
+    'pelagic', 'prism', 'reef', 'shoal', 'sound', 'stratum', 'tide',
+];
+export function generatePassword() {
+    // randomInt rather than Math.random or a modulo of randomBytes: one is not a
+    // CSPRNG and the other is biased unless the range divides evenly.
+    const chosen = Array.from({ length: 6 }, () => WORDS[randomInt(WORDS.length)]);
+    return `${chosen.join('-')}-${String(randomInt(10, 100))}`;
+}
+/**
+ * An email address, checked only enough to refuse what cannot be one.
+ *
+ * Deliberately not RFC 5322. A stricter test rejects addresses that work, and
+ * the column is `citext` with a uniqueness constraint — what matters here is
+ * that the value is a single token with an `@` and a dot after it, so a name or
+ * a uuid typed into the wrong field is refused where the operator can see it
+ * rather than becoming a user nobody can sign in as.
+ */
+export function looksLikeEmail(value) {
+    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+export class PostgresUsers {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    get scope() {
+        return this.role === undefined ? {} : { role: this.role };
+    }
+    async list(auth, page) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const after = page?.after;
+            const seek = after === undefined ? '' : ' AND (created_at, id) > ($2::timestamptz, $3::uuid)';
+            const cap = page === undefined ? '' : ` LIMIT ${page.limit}`;
+            const { rows } = await client.query(`SELECT id, email, role, created_at, created_at::text AS created_at_text,
+                  disabled_at, (password_hash IS NOT NULL) AS has_password
+             FROM users WHERE org_id = $1${seek} ORDER BY created_at, id${cap}`, after === undefined ? [auth.orgId] : [auth.orgId, after.createdAt, after.id]);
+            // Disabled ones are listed rather than hidden, on the same grounds as a
+            // revoked key: "this account was disabled on Tuesday" is the answer to
+            // the question being asked, and a row that vanishes looks like one that
+            // never existed.
+            const users = rows.map((r) => ({
+                id: r.id,
+                email: r.email,
+                role: r.role,
+                createdAt: r.created_at.toISOString(),
+                disabledAt: r.disabled_at?.toISOString() ?? null,
+                hasPassword: r.has_password,
+            }));
+            return pageOf(users, page, (u, i) => ({
+                createdAt: rows[i].created_at_text,
+                id: u.id,
+            }));
+        }, this.scope);
+    }
+    async create(auth, email, role) {
+        const password = generatePassword();
+        // Outside the transaction on purpose: scrypt at OWASP's minimum takes long
+        // enough that holding a database connection across it is a connection spent
+        // on arithmetic. `login.ts` makes the same call under a concurrency cap for
+        // the same reason.
+        const passwordHash = await hashPassword(password);
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // DO NOTHING rather than catching a unique violation: inside the
+            // transaction `withOrg` opens, a raised constraint error aborts
+            // everything after it, so recovering would need a savepoint. The empty
+            // result says the same thing without one.
+            const { rows } = await client.query(`INSERT INTO users (org_id, email, role, password_hash)
+           VALUES ($1,$2,$3,$4)
+           ON CONFLICT (org_id, email) DO NOTHING
+           RETURNING id, created_at`, [auth.orgId, email, role, passwordHash]);
+            const row = rows[0];
+            if (row === undefined)
+                return undefined;
+            return {
+                password,
+                user: {
+                    id: row.id,
+                    email,
+                    role,
+                    createdAt: row.created_at.toISOString(),
+                    disabledAt: null,
+                    hasPassword: true,
+                },
+            };
+        }, this.scope);
+    }
+    async update(auth, id, change) {
+        if (!UUID.test(id))
+            return 'no-user';
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows } = await client.query('SELECT role, disabled_at FROM users WHERE org_id = $1 AND id = $2 FOR UPDATE', [auth.orgId, id]);
+            const current = rows[0];
+            if (current === undefined)
+                return 'no-user';
+            const role = change.role ?? current.role;
+            const disabled = change.disabled ?? current.disabled_at !== null;
+            const wasActiveAdmin = current.role === 'org_admin' && current.disabled_at === null;
+            const staysActiveAdmin = role === 'org_admin' && !disabled;
+            // Counted in the same transaction, and only when this change would
+            // actually give one up. `FOR UPDATE` on the row above plus this count
+            // is what stops two administrators demoting each other concurrently and
+            // both reading a count of two.
+            if (wasActiveAdmin && !staysActiveAdmin) {
+                const { rows: others } = await client.query(`SELECT count(*) AS n FROM users
+              WHERE org_id = $1 AND id <> $2 AND role = 'org_admin' AND disabled_at IS NULL`, [auth.orgId, id]);
+                if (Number(others[0]?.n ?? '0') === 0)
+                    return 'last-admin';
+            }
+            // `disabled_at` keeps the instant it was set rather than being rewritten
+            // on every unrelated PATCH: "disabled since Tuesday" is the answer an
+            // operator is looking for, and re-stamping it on a role change would
+            // quietly move it.
+            const { rowCount } = await client.query(`UPDATE users
+              SET role = $3,
+                  disabled_at = CASE
+                    WHEN $4::boolean THEN COALESCE(disabled_at, now())
+                    ELSE NULL
+                  END
+            WHERE org_id = $1 AND id = $2`, [auth.orgId, id, role, disabled]);
+            return (rowCount ?? 0) > 0 ? 'updated' : 'no-user';
+        }, this.scope);
+    }
+    async resetPassword(auth, id) {
+        if (!UUID.test(id))
+            return undefined;
+        const password = generatePassword();
+        const passwordHash = await hashPassword(password);
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // A disabled account is deliberately still resettable: re-enabling and
+            // resetting are two decisions, and refusing here would make the second
+            // depend on the first in a way nothing asked for.
+            const { rowCount } = await client.query('UPDATE users SET password_hash = $3 WHERE org_id = $1 AND id = $2', [auth.orgId, id, passwordHash]);
+            return (rowCount ?? 0) > 0 ? password : undefined;
+        }, this.scope);
+    }
+}
+export class PostgresGroups {
+    pool;
+    role;
+    constructor(pool, role) {
+        this.pool = pool;
+        this.role = role;
+    }
+    get scope() {
+        return this.role === undefined ? {} : { role: this.role };
+    }
+    async list(auth, page) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const after = page?.after;
+            const seek = after === undefined ? '' : ' AND (g.created_at, g.id) > ($2::timestamptz, $3::uuid)';
+            const cap = page === undefined ? '' : ` LIMIT ${page.limit}`;
+            const { rows } = await client.query(`SELECT g.id, g.name, g.created_at, g.created_at::text AS created_at_text,
+                  (SELECT count(*) FROM group_members m
+                    WHERE m.org_id = g.org_id AND m.group_id = g.id) AS member_count
+             FROM groups g WHERE g.org_id = $1${seek} ORDER BY g.created_at, g.id${cap}`, after === undefined ? [auth.orgId] : [auth.orgId, after.createdAt, after.id]);
+            const groups = rows.map((r) => ({
+                id: r.id,
+                name: r.name,
+                createdAt: r.created_at.toISOString(),
+                // count() is bigint, which pg hands over as a string rather than
+                // silently losing precision. Parsed here rather than left to JSON,
+                // where it would have serialized as a quoted number.
+                memberCount: Number(r.member_count),
+            }));
+            return pageOf(groups, page, (g, i) => ({
+                createdAt: rows[i].created_at_text,
+                id: g.id,
+            }));
+        }, this.scope);
+    }
+    async create(auth, name) {
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows } = await client.query(`INSERT INTO groups (org_id, name) VALUES ($1,$2)
+           ON CONFLICT (org_id, name) DO NOTHING
+           RETURNING id, created_at`, [auth.orgId, name]);
+            const row = rows[0];
+            if (row === undefined)
+                return undefined;
+            return { id: row.id, name, createdAt: row.created_at.toISOString(), memberCount: 0 };
+        }, this.scope);
+    }
+    async remove(auth, id) {
+        if (!UUID.test(id))
+            return false;
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // Grants naming the group go first, and in the same transaction. There
+            // is no foreign key from `grants` to `groups` — `principal_id` is a
+            // bare uuid because it addresses three different tables — so nothing
+            // would clean them up, and a grant to a principal that no longer exists
+            // is a row `GET /v1/grants` lists and nobody can resolve.
+            //
+            // No permission answer changes either way: `effectivePrincipals` walks
+            // membership from the caller, and a deleted group has no members to
+            // walk from.
+            await client.query(`DELETE FROM grants WHERE org_id = $1 AND principal_type = 'group' AND principal_id = $2`, [auth.orgId, id]);
+            // `group_members` cascades on both endpoints, so the edges into and out
+            // of this group go with it. 0003's row trigger fires on those deletes
+            // and on this one, so `groups_version` moves and every cached principal
+            // set is composed from a different key on the next request.
+            const { rowCount } = await client.query('DELETE FROM groups WHERE org_id = $1 AND id = $2', [
+                auth.orgId,
+                id,
+            ]);
+            return (rowCount ?? 0) > 0;
+        }, this.scope);
+    }
+    async members(auth, groupId, page) {
+        if (!UUID.test(groupId))
+            return undefined;
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            // Asked first, so an empty group and a group that is not here are
+            // different answers. They are allowed to be: the caller is an
+            // `org_admin` who can list every group in the organization, so this
+            // tells them nothing `GET /v1/groups` would not.
+            const { rows: present } = await client.query('SELECT 1 FROM groups WHERE org_id = $1 AND id = $2', [auth.orgId, groupId]);
+            if (present.length === 0)
+                return undefined;
+            const after = page?.after;
+            // The tie-breaker is whichever member column is set: the CHECK from
+            // 0001 guarantees exactly one is, so the coalesce is total rather than
+            // a default.
+            const seek = after === undefined
+                ? ''
+                : ' AND (m.created_at, COALESCE(m.member_user, m.member_group)) > ($3::timestamptz, $4::uuid)';
+            const cap = page === undefined ? '' : ` LIMIT ${page.limit}`;
+            const { rows } = await client.query(`SELECT m.member_user, m.member_group,
+                  COALESCE(u.email, g.name) AS label,
+                  m.created_at::text AS created_at_text
+             FROM group_members m
+             LEFT JOIN users  u ON u.id = m.member_user  AND u.org_id = m.org_id
+             LEFT JOIN groups g ON g.id = m.member_group AND g.org_id = m.org_id
+            WHERE m.org_id = $1 AND m.group_id = $2${seek}
+            ORDER BY m.created_at, COALESCE(m.member_user, m.member_group)${cap}`, after === undefined
+                ? [auth.orgId, groupId]
+                : [auth.orgId, groupId, after.createdAt, after.id]);
+            const members = rows.map((r) => r.member_user !== null
+                ? { type: 'user', id: r.member_user, label: r.label }
+                : { type: 'group', id: r.member_group, label: r.label });
+            return pageOf(members, page, (m, i) => ({
+                createdAt: rows[i].created_at_text,
+                id: m.id,
+            }));
+        }, this.scope);
+    }
+    async addMember(auth, groupId, member) {
+        if (!UUID.test(groupId))
+            return 'no-group';
+        if (!UUID.test(member.id))
+            return 'no-member';
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rows: group } = await client.query('SELECT 1 FROM groups WHERE org_id = $1 AND id = $2', [auth.orgId, groupId]);
+            if (group.length === 0)
+                return 'no-group';
+            const { rows: exists } = await client.query(member.type === 'user'
+                ? 'SELECT 1 FROM users WHERE org_id = $1 AND id = $2'
+                : 'SELECT 1 FROM groups WHERE org_id = $1 AND id = $2', [auth.orgId, member.id]);
+            // Checked here as well as by the composite foreign key from 0002. The
+            // constraint is what makes a cross-tenant edge impossible; this is what
+            // makes a typo a `404` instead of a `500`, and the two are not
+            // substitutes — a raised constraint inside `withOrg`'s transaction
+            // aborts everything after it.
+            if (exists.length === 0)
+                return 'no-member';
+            // A cycle is not refused. `group_members`' own comment says cycles are
+            // the resolver's problem to terminate on rather than the schema's to
+            // prevent, and `effectivePrincipals` walks into a `Set` — so a group
+            // that contains itself resolves to the same principal set it already
+            // had. Refusing here would be a second, weaker implementation of a rule
+            // T14 already pins, and it would only catch the direct case anyway.
+            const { rowCount } = await client.query(member.type === 'user'
+                ? `INSERT INTO group_members (org_id, group_id, member_user) VALUES ($1,$2,$3)
+               ON CONFLICT DO NOTHING`
+                : `INSERT INTO group_members (org_id, group_id, member_group) VALUES ($1,$2,$3)
+               ON CONFLICT DO NOTHING`, [auth.orgId, groupId, member.id]);
+            // `already` rather than an error. 0018 is what makes this reachable at
+            // all — before it, `NULLS DISTINCT` meant the constraint matched
+            // nothing and `ON CONFLICT DO NOTHING` was a no-op that inserted a
+            // duplicate every time a directory sync ran.
+            return (rowCount ?? 0) > 0 ? 'added' : 'already';
+        }, this.scope);
+    }
+    async removeMember(auth, groupId, member) {
+        if (!UUID.test(groupId) || !UUID.test(member.id))
+            return false;
+        return withOrg(this.pool, auth.orgId, async (client) => {
+            const { rowCount } = await client.query(member.type === 'user'
+                ? 'DELETE FROM group_members WHERE org_id = $1 AND group_id = $2 AND member_user = $3'
+                : 'DELETE FROM group_members WHERE org_id = $1 AND group_id = $2 AND member_group = $3', [auth.orgId, groupId, member.id]);
+            return (rowCount ?? 0) > 0;
+        }, this.scope);
+    }
+}
+//# sourceMappingURL=principals.js.map

package/dist/principals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principals.js","sourceRoot":"","sources":["../src/principals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAIxD,OAAO,EAAE,MAAM,EAA8B,MAAM,iBAAiB,CAAA;AAgIpE,MAAM,IAAI,GAAG,kBAAkB,CAAA;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,KAAK,GAAG;IACZ,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO;IACvE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IACpE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO;IACrE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM;CACvD,CAAA;AAEV,MAAM,UAAU,gBAAgB;IAC9B,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,OAAO,aAAa;IAEL;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,IAAW;QACvC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;YACzB,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qDAAqD,CAAA;YAC7F,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;YAE5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAUjC;;2CAEiC,IAAI,2BAA2B,GAAG,EAAE,EACrE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAC7E,CAAA;YAED,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,iBAAiB;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;gBACrC,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;gBAChD,WAAW,EAAE,CAAC,CAAC,YAAY;aAC5B,CAAC,CAAC,CAAA;YAEH,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,SAAS,EAAG,IAAI,CAAC,CAAC,CAAiC,CAAC,eAAe;gBACnE,EAAE,EAAE,CAAC,CAAC,EAAE;aACT,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,KAAa,EACb,IAA4B;QAE5B,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;QACnC,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,mBAAmB;QACnB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAEjD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,iEAAiE;YACjE,gEAAgE;YAChE,uEAAuE;YACvE,0CAA0C;YAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;oCAG0B,EAC1B,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,CACxC,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,OAAO;gBACL,QAAQ;gBACR,IAAI,EAAE;oBACJ,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK;oBACL,IAAI;oBACJ,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;oBACvC,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;iBAClB;aACF,CAAA;QACH,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,IAAiB,EACjB,EAAU,EACV,MAA6D;QAE7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAEpC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC,8EAA8E,EAC9E,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACvB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAE3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAA;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,CAAA;YAChE,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,CAAA;YACnF,MAAM,gBAAgB,GAAG,IAAI,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAA;YAE1D,mEAAmE;YACnE,sEAAsE;YACtE,wEAAwE;YACxE,+BAA+B;YAC/B,IAAI,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACxC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACzC;4FACgF,EAChF,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;gBACD,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,YAAY,CAAA;YAC5D,CAAC;YAED,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,mBAAmB;YACnB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC;;;;;;0CAMgC,EAChC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CACjC,CAAA;YACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;QACpD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAiB,EAAE,EAAU;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAA;QAEpC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;QACnC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;QAEjD,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,uEAAuE;YACvE,uEAAuE;YACvE,kDAAkD;YAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC,mEAAmE,EACnE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,YAAY,CAAC,CAC/B,CAAA;YACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACnD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAEN;IACA;IAFnB,YACmB,IAAU,EACV,IAAa;QADb,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAS;IAC7B,CAAC;IAEJ,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,IAAW;QACvC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;YACzB,MAAM,IAAI,GACR,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,yDAAyD,CAAA;YACtF,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;YAE5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAOjC;;;gDAGsC,IAAI,+BAA+B,GAAG,EAAE,EAC9E,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAC7E,CAAA;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;gBACrC,iEAAiE;gBACjE,mEAAmE;gBACnE,qDAAqD;gBACrD,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;aACpC,CAAC,CAAC,CAAA;YAEH,OAAO,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrC,SAAS,EAAG,IAAI,CAAC,CAAC,CAAiC,CAAC,eAAe;gBACnE,EAAE,EAAE,CAAC,CAAC,EAAE;aACT,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,IAAY;QAC1C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;oCAE0B,EAC1B,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CACnB,CAAA;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;YACnB,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAA;YAEvC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAA;QACtF,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB,EAAE,EAAU;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAEhC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,wEAAwE;YACxE,0DAA0D;YAC1D,EAAE;YACF,uEAAuE;YACvE,oEAAoE;YACpE,aAAa;YACb,MAAM,MAAM,CAAC,KAAK,CAChB,yFAAyF,EACzF,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CACjB,CAAA;YAED,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAC1F,IAAI,CAAC,KAAK;gBACV,EAAE;aACH,CAAC,CAAA;YACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAiB,EACjB,OAAe,EACf,IAAW;QAEX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAA;QAEzC,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,kEAAkE;YAClE,8DAA8D;YAC9D,oEAAoE;YACpE,iDAAiD;YACjD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAC1C,oDAAoD,EACpD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CACtB,CAAA;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAA;YAE1C,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;YACzB,oEAAoE;YACpE,uEAAuE;YACvE,aAAa;YACb,MAAM,IAAI,GACR,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,4FAA4F,CAAA;YAClG,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;YAE5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAMjC;;;;;;qDAM2C,IAAI;4EACmB,GAAG,EAAE,EACvE,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC;gBACvB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CACrD,CAAA;YAED,MAAM,OAAO,GAAkB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,WAAW,KAAK,IAAI;gBACpB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;gBAC9D,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,YAAsB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAC7E,CAAA;YAED,OAAO,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,SAAS,EAAG,IAAI,CAAC,CAAC,CAAiC,CAAC,eAAe;gBACnE,EAAE,EAAE,CAAC,CAAC,EAAE;aACT,CAAC,CAAC,CAAA;QACL,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,IAAiB,EACjB,OAAe,EACf,MAA8C;QAE9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,UAAU,CAAA;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,WAAW,CAAA;QAE7C,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACxC,oDAAoD,EACpD,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CACtB,CAAA;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,UAAU,CAAA;YAEzC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACzC,MAAM,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,mDAAmD;gBACrD,CAAC,CAAC,oDAAoD,EACxD,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CACxB,CAAA;YACD,sEAAsE;YACtE,wEAAwE;YACxE,+DAA+D;YAC/D,mEAAmE;YACnE,8BAA8B;YAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAA;YAE3C,uEAAuE;YACvE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC,MAAM,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC;sCACwB;gBAC1B,CAAC,CAAC;sCACwB,EAC5B,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CACjC,CAAA;YAED,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,6CAA6C;YAC7C,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QAClD,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAiB,EACjB,OAAe,EACf,MAA8C;QAE9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAA;QAE9D,OAAO,OAAO,CACZ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CACrC,MAAM,CAAC,IAAI,KAAK,MAAM;gBACpB,CAAC,CAAC,oFAAoF;gBACtF,CAAC,CAAC,qFAAqF,EACzF,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CACjC,CAAA;YACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CACX,CAAA;IACH,CAAC;CACF"}

package/dist/server.d.ts

@@ -4,6 +4,7 @@ import { type AuthContext, type VerifyOptions } from './auth.js';
 import { type IdempotencyStore } from './idempotency.js';
 import { type LimitPolicy, type RateLimiter, type Resource } from './limits.js';
 import type { Login } from './login.js';
+import { type Groups, type Users } from './principals.js';
 import { type Page, type PageResult } from './pagination.js';
 export type { Page, PageResult };
 /**
@@ -330,6 +331,31 @@ export interface Layers {
         name?: string;
         description?: string;
     }): Promise<boolean>;
+    /**
+     * Delete a layer, and everything in it.
+     *
+     * A tombstone, like a document's, and for the same reason: the cascade
+     * underneath — points, chunk rows, bucket objects — is bounded by how much
+     * the layer holds, and that does not belong on a request. What happens
+     * synchronously is what correctness needs: the points stop matching, every
+     * document row is tombstoned so the collector has a queue, and the layer
+     * stops resolving. The collector reclaims the rest on its own clock, and
+     * nothing depends on when.
+     *
+     * `admin` on the layer's workspace — the same check renaming makes, for the
+     * same reason it makes it, and deleting is the more dangerous of the two so
+     * it does not get a lower bar. Never `write`: an ingest-only service account
+     * holds that, and it must not be able to remove what it fills.
+     *
+     * Grants naming the layer go with it. A grant on a scope that no longer
+     * exists resolves to nothing already, so leaving them changes no answer —
+     * but it leaves rows in `GET /v1/grants` that name something a reader cannot
+     * look up, which is the kind of debris that gets mistaken for a leak.
+     *
+     * `false` for absent, for another organization's, and for one this caller may
+     * not administer. One answer for all three.
+     */
+    remove?(auth: AuthContext, layerId: string): Promise<boolean>;
 }
 export interface GrantInput {
     readonly principalType: 'user' | 'group' | 'service_account';
@@ -656,6 +682,10 @@ export interface ApiOptions {
     readonly layers?: Layers;
     readonly grants?: Grants;
     readonly serviceAccounts?: ServiceAccountPort;
+    /** Absent means `/v1/users` answers 404, like any capability a surface lacks. */
+    readonly users?: Users;
+    /** Absent means `/v1/groups` and its membership paths answer 404. */
+    readonly groups?: Groups;
     /** `NACRE_MAX_DOCUMENT_BYTES`. Over it is `413`, not `400`. */
     readonly maxBodyBytes?: number;
     /**

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAeL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpG,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAAU,MAAM,YAAY,CAAA;AAS/C,OAAO,EAAY,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7F;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACtE,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAumBD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAuBrD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAA;AAMhG,OAAO,EAeL,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEb,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAsC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA;AAEpG,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAA;AACjH,OAAO,KAAK,EAAE,KAAK,EAAU,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAoC,KAAK,MAAM,EAAkB,KAAK,KAAK,EAAiB,MAAM,iBAAiB,CAAA;AAS1H,OAAO,EAAY,KAAK,IAAI,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACtE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAA;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7F;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAA;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC,CAAA;IACpG,iEAAiE;IACjE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAChE;AAED,MAAM,WAAW,GAAG;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,IAAI;IACnB;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wCAAwC;AACxC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC5F;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AAC/B;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE1D,MAAM,WAAW,MAAM;IACrB;;;;;;;OAOG;IACH,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9E,OAAO,CAAC,YAAY,CAAC,CAAA;IACxB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CAAC,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,iBAAiB,CAAA;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;CAChD;AAED,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,MAAM;IACrB,oFAAoF;IACpF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IACtE,sFAAsF;IACtF,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC7E;;;;;;;;OAQG;IACH,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAA;IAC7E,uEAAuE;IACvE,MAAM,CACJ,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,kBAAkB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;GAOG;AACH,YAAY,EAAE,UAAU,EAAE,CAAA;AAE1B;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,aAAa,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IAC1E,UAAU,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACvE,cAAc,EAAE;QAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;IACnF,YAAY,EAAE;QAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC1E;AAED;;;;;;;;GAQG;AACH,YAAY,EAAE,WAAW,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,KAAK,CACH,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;CAC/E;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE;AACvC,4DAA4D;GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAA;AAErE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAClD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,WAAW,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACjF,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2FAA2F;IAC3F,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;IACxF,OAAO,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,SAAS;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,GACjE,OAAO,CAAC,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC,CAAA;CAClD;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAA;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACvD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;IAChE;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;IACrD;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;IAClD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IAC5C,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;IACvC,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAA;IAC7C,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAClC;AA6nBD,wBAAgB,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAuBrD"}